1CAN122201, License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4

From kanterella
Jump to navigation Jump to search

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4
ML22356A249
Person / Time
Site: Arkansas Nuclear Entergy icon.png
Issue date: 12/22/2022
From: Couture P
Entergy Operations
To:
Office of Nuclear Reactor Regulation, Document Control Desk
References
1CAN122201
Download: ML22356A249 (1)


Text

[[:#Wiki_filter:Phil Couture Sr. Manager Fleet Regulatory Assurance - Licensing 601-368-5102 10 CFR 50.90 1CAN122201 December 22, 2022 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4" Arkansas Nuclear One - Unit 1 NRC Docket No. 50-313 Renewed Facility Operating License No. DPR-51

References:

1) Letter from the Technical Specification Task Force (TSTF) to the Nuclear Regulatory Commission (NRC), "TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, 'Provide Risk-Informed Extended Completion Times' and Submittal of TSTF-505, Revision 2,"

(ML18183A493), July 2, 2018

2) Letter from NRC to the TSTF, "Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b'," (ML18253A085), dated November 21, 2018 In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, "Application for Amendment of License, Construction Permit, or Early Site Permit," Entergy Operations, Inc. (Entergy) is submitting a request for an amendment to the Technical Specifications (TSs) for Arkansas Nuclear One, Unit 1 (ANO-1).

The proposed amendment would modify the ANO-1 TS requirements to permit the use of Risk-Informed Completion Times in accordance with TSTF-505, Revision 2, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b" (Attachment 3 of Reference 1). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (Reference 2).

  • Attachment 1 provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific variations.
  • Attachment 2 provides the existing TS pages marked up to show the proposed changes.

Entergy Operations, Inc. 1340 Echelon Parkway, Jackson, MS 39213

1CAN122201 Page 2 of 3 x Attachment 3 provides revised (retyped) TS pages. x Attachment 4 provides existing TS Bases pages for ANO-1 marked up to show the proposed changes and is provided for information only. x Attachment 5 provides a cross-reference between the TS included in TSTF-505, Revision 2, and the ANO-1 plant-specific TS. x Enclosures 1-12 are included in accordance with Section 4.0, "Limitations and Conditions," of the safety evaluation for Nuclear Energy Institute (NEI) 06-09-A (ML071200238). This letter contains no new regulatory commitments. Entergy requests approval of the proposed license amendment within 13 months from the date of this submittal with implementation within 180 days following NRC approval. Entergy has determined that there are no significant hazards considerations associated with the proposed change and that the TS change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9). In accordance with 10 CFR 50.91, "Notice for Public Comment; State Consultation," Entergy is notifying the State of Arkansas of this amendment request by transmitting a copy of this letter and enclosures to the designated State Official. If there are any questions or if additional information is needed, please contact Riley Keele, Manager, Regulatory Assurance, Arkansas Nuclear One, at 479-858-7826. I declare under penalty of perjury that the foregoing is true and correct. Executed on this 22nd day of December 2022. Sincerely, Philip Digitally signed by Philip Couture Couture Date: 2022.12.22 11:26:15 -06'00' PC/mar Attachments:

1. Evaluation of the Proposed Change
2. Technical Specification Page Markups
3. Retyped Technical Specification Pages
4. Technical Specification Bases Page Markups (Information Only)
5. ANO-1 Technical Specification TSTF-505 Cross-Reference

1CAN122201 Page 3 of 3

Enclosures:

1. List of Revised Required Actions to Corresponding PRA Functions
2. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2
3. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2
4. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models
5. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)
6. Justification of Application of At-Power PRA Models to Shutdown Modes
7. PRA Model Update Process
8. Attributes of the Real-Time Risk Model
9. Key Assumptions and Sources of Uncertainty
10. Program Implementation
11. Monitoring Program
12. Risk Management Action Examples cc: NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Designated Arkansas State Official

Attachment 1 1CAN122201 Evaluation of the Proposed Change 1CAN122201 Page 1 of 7 Evaluation of the Proposed Change 1.0

SUMMARY

DESCRIPTION The proposed amendment would modify the Technical Specification (TS) requirements related to Completion Times (CTs) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). A new program, the Risk Informed Completion Time Program, is added to TS Section 5, "Administrative Controls." The methodology for using the RICT Program is described in Nuclear Entergy Institute (NEI) 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, which was approved by the NRC on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program. The proposed amendment is consistent with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b;" however, only those Required Actions described in Attachment 5 and Enclosure 1, as reflected in the proposed TS markups provided in Attachment 2, are proposed to be changed, because some of the modified Required Actions in TSTF-505 are not applicable to Arkansas Nuclear One, Unit 1 (ANO-1), and there are some plant-specific Required Actions not included in TSTF-505 that are included in this proposed amendment. 2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation Entergy Operations, Inc. (Entergy) has reviewed TSTF-505, Revision 2, and the model safety evaluation (SE) dated November 21, 2018. This review included the supporting information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, Entergy has concluded that the technical basis is applicable to ANO-1 and supports incorporation of this amendment in the ANO-1 TS. 2.2 Verifications and Regulatory Commitments In accordance with Section 4.0, "Limitations and Conditions," of the safety evaluation for NEI 06-09-A, the following is provided:

1. Enclosure 1 identifies each of the TS Required Actions to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the probabilistic risk assessment (PRA) of the structures, systems and components (SSCs) subject to those actions.
2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as required by Regulatory Guide (RG) 1.200, Section 4.2.
3. Enclosure 3 is not applicable because each PRA model used for the RICT Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.

1CAN122201 Page 2 of 7

4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.
5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.
6. Enclosure 6 is not applicable because the RICT Program is not being applied to shutdown modes.
7. Enclosure 7 provides a discussion of the licensee's programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.
8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified to assess real time configuration risk, and describes the scope of, and quality controls applied to, the real-time model.
9. Enclosure 9 provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.
10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.
11. Enclosure 11 provides a description of the implementation and monitoring program.
12. Enclosure 12 provides a description of the process to identify and provide RMAs.

2.3 Optional Changes and Variations Entergy is proposing variations from the TS changes described in TSTF-505, Revision 2, or the applicable parts of the NRC staffs model SE dated November 21, 2018. These options were recognized as acceptable variations in TSTF-505 and the NRC model safety evaluation or are otherwise justified. A cross-reference of the TSTF-505 Standard Technical Specification (STS) changes versus the changes to the ANO-1 TSs is provided in Attachment 5. Attachment 5 provides individual dispositions of each STS and ANO-1 change. Where the changes are identical, a disposition of "no variation" is provided. Where a variation exists, the disposition provides a cross-reference to the paragraph in this attachment that provides justification. 1CAN122201 Page 3 of 7 2.3.1 Administrative Variations The following ANO-1 TS variations from the TSTF-505 template for NUREG-1430, "Standard Technical Specifications Babcock and Wilcox Plants," are considered to be administrative in nature. 2.3.1.1 ANO-1 Required Actions (RA) with alpha-numeric designations that differ from the corresponding NUREG-1430 RA (as applicable), have wording that is slightly different, and have differing existing CTs with a similar intent are administrative variations from TSTF-505 with no effect on the NRC staff's model SE. 2.3.1.2 For NUREG-1430 Limiting Conditions for Operation (LCOs) and RAs that are not contained in the ANO-1 TS, the corresponding NUREG-1430 markups included in TSTF-505 for these RAs and CTs are not applicable to ANO-1. These are administrative variations from TSTF-505 with no effect on the NRC staff's model SE. 2.3.1.3 Various TSTF-505, Section 3.3, instrumentation Conditions are invoked by instrumentation functions contained in tables. The analogous ANO-1 instrument functions may have different Conditions referenced or have slightly different wording. This includes differences in lettering in the tables. These are administrative variations from TSTF-505 that meet the criteria for administering a RICT and have no effect on the NRC staff's model SE. 2.3.1.4 TSTF-505 applies RICT to certain Required Actions that require additional plant-specific justification. In some cases, the ANO-1 design does not support the necessary justification; therefore, a RICT has not been applied. For example, as the proposed ANO-1 RICT Program is applicable in Modes 1 and 2, Entergy will not adopt changes in TSTF-505 for Required Actions that are only applicable in Mode 3 and below. 2.3.1.5 A RICT is not adopted for certain ANO-1 TSs that may be contained in the TSTF-505 markups because the function was not adequately modeled in the PRA or an appropriate surrogate was not available. 2.3.1.6 The addition of the RICT option to some Completion Times required information to be moved from one page to another due to space limitations. These are administrative variations from TSTF-505 with no effect on the NRC staff's model SE. 2.3.1.7 The TSTF-505 markup of STS 3.3.8, "Emergency Diesel Generator (EDG) Loss of Power Start (LOPS)," applies a RICT to Required Actions A.1 and B.1. Required Action A.1 governs a condition where one or more Functions with one channel per EDG inoperable. Required Action B.1 governs a condition where one or more Functions with two or more channels per EDG inoperable. ANO-1 TS 3.3.8, Condition A, combines these two configurations into one, stating "One or more Functions with one or more relays for one or more DGs [diesel generators] inoperable." Therefore, a RICT need only be applied to the Completion Time of ANO-1 TS 3.3.8, Required Action A.1, to meet the intent of the TSTF-505 markup. This is an administrative variation from TSTF-505 that meet the criteria for administering a RICT and has no effect on the NRC staff's model SE. 1CAN122201 Page 4 of 7 2.3.1.8 The TSTF-505 markup of STS 3.3.12, "Emergency Feedwater Initiation and Control (EFIC) Manual Initiation," applies a RICT to Required Actions A.1 and B.1 which govern conditions where one or more Functions with one or both manual initiation switches in one (Required Action A.1) or both (Required Action B.1) trains inoperable. ANO-1 TS 3.3.12 splits the equivalent of STS 3.3.12, Required Action A.1 into two separate actions (Required Actions A.1 and B.1), with Required Action A.1 governing one manual initiation switch inoperable in one train and Required Action B.1 governing both manual initiation switches inoperable in one train, each with a Completion Time of 72 hours. ANO-1 TS 3.3.12, Required Action C.1 is equivalent to STS 3.3.12, Required Action B.1. Therefore, applying a RICT to ANO-1 TS 3.3.12, Required Actions A.1, B.1, and C.1, is consistent with TSTF-505. This is an administrative variation from TSTF-505 that meet the criteria for administering a RICT and has no effect on the NRC staff's model SE. 2.3.1.9 The TSTF-505 markup of STS 3.8.4, "DC Sources - Operating," applies a RICT to Required Actions A.1 (inoperable battery charger), B.1 (inoperable battery), and C.1 (DC electrical power subsystem inoperable for other reasons). ANO-1 TS 3.8.4, Required Action A.1, governs any inoperability of DC sources, for which Entergy proposes to apply the RICT, consistent with the intent of TSTF-505. This is an administrative variation from TSTF-505 that meet the criteria for administering a RICT and has no effect on the NRC staff's model SE. 2.3.1.10 In adding Example 1.3-8 to TS Section 1.3, "Completion Times," consistent with TSTF-505, a missing title "Example 1.3-7" is added to the top of TS Page 1.3-10. This is an administrative variation from TSTF-505 with no effect on the NRC staff's model SE. 2.3.2 Technical Variations The following variations from the TSTF-505 template for NUREG-1430 are considered to be technical in nature. 2.3.2.1 ANO-1 TS 3.7.2, "Main Steam Isolation Valves (MSIVs)," Required Action A.1, states that with one or more MSIVs inoperable, restore the MSIV(s) to operable status within 24 hours. TSTF-505 applies a RICT when only one MSIV is inoperable (reference TSTF-505 markup of STS 3.7.2, Required Action A.1). Because ANO-1 TS 3.7.2, Required Action A.1, would permit both MSIVs to be inoperable, a Note is added to the Required Action A.1 proposed RICT statement, limiting application of a RICT to conditions where only one MSIV is inoperable. Additional discussion is included in Enclosure 1 of this submittal. In addition, STS 3.7.2, Required Action A.1, is limited to one inoperable MSIV in "MODE 1". ANO-1 TS 3.7.2, Required Action A.1, is applicable during operation in Modes 1 or 2. Entergy proposes to apply a RICT to ANO-1 TS 3.7.2, Required Action A.1, notwithstanding the difference in applicable Modes. Additional discussion is included in Enclosure 1 of this submittal. 1CAN122201 Page 5 of 7 2.3.2.2 ANO-1 TS 3.7.5, "Emergency Feedwater (EFW) System," Condition C, addresses conditions where a turbine-driven EFW train is inoperable due to one inoperable steam supply AND the motor-driven EFW train is also inoperable. In this event, either the inoperable steam supply or the motor-driven EFW train must be restored within 24 hours. TSTF-505 applies a RICT to either of the aforementioned inoperabilities; however, STS 3.7.5 does not contain an action addressing an inoperable steam supply coincident with an inoperable motor-driven EFW pump. Entergy is proposing to apply a RICT to Required Actions C.1 and C.2 of ANO-1 TS 3.7.5, Condition C. The risk associated with coincident inoperability of an inoperable steam supply and an inoperable motor-driven EFW pump can be quantified by the ANO-1 PRA model. In addition, assuming no single failure of the remaining steam supply to the turbine-driven EFW pump, a loss of safety function can only occur if a steam line break on the steam generator supplying steam via the remaining operable steam supply valve were to occur. Because the ANO-1 PRA model can also quantify the potential of a steam line break occurring, a RICT may be applied to this unique ANO-1 Action. 2.4 Bases Changes Revised TS Bases are provided in Attachment 4 for NRC information. TS Bases revisions will be incorporated as an implementing action pursuant to TS 5.5.14, "Technical Specifications (TS) Bases Control Program," following issuance of the amendment.

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Entergy Operations, Inc. (Entergy) has evaluated the proposed change to the Technical Specifications (TSs) using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration. Entergy requests Arkansas Nuclear One, Unit 1 (ANO-1) adoption of an approved change to the standard technical specifications (STS) and plant-specific TS to modify the TS requirements related to Completion Times for Required Actions, providing an option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Chapter 5, "Administrative Controls," entitled the "Risk Informed Completion Time Program." As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No. The proposed change permits the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change does not involve a significant increase in the probability of an accident previously evaluated because the change involves no change 1CAN122201 Page 6 of 7 to the plant or its modes of operation. The proposed change does not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time are no different from those during the existing Completion Time. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No. The proposed change does not change the design, configuration, or method of operation of the plant. The proposed change does not involve a physical alteration of the plant (no new or different kind of equipment will be installed). Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No. The proposed change permits the extension of Completion Times provided risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change implements a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS. Therefore, the proposed change does not involve a significant reduction in a margin of safety. Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified. 3.2 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with NRC regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. 1CAN122201 Page 7 of 7

4.0 ENVIRONMENTAL CONSIDERATION

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

Attachment 2 1CAN122201 Technical Specification Page Markups (55 Pages)

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) Example 1.3-7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Verify affected 1 hour subsystem subsystem isolated. inoperable. AND Once per 8 hours thereafter AND A.2 Restore subsystem 72 hours to OPERABLE status. B. Required B.1 Be in MODE 3. 6 hours Action and associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours Required Action A.1 has two Completion Times. The 1 hour Completion Time begins at the time the Condition is entered and each "Once per 8 hours thereafter" interval begins upon performance of Required Action A.1. If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour or any subsequent 8 hour interval from the previous performance (plus the extension allowed by SR 3.0.2), Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired. ANO-1 1.3-10 Amendment No. 215,218,265,

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) Example 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore subsystem 7 days subsystem to OPERABLE inoperable. status. OR In accordance with the Risk Informed Completion Time Program B. Required B.1 Be in MODE 3. 6 hours Action and associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours When a subsystem is declared inoperable, Condition A is entered. The 7-day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7-day Completion Time. The RICT cannot exceed 30 days. After the 7-day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered. The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less. If the 7-day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. ANO-1 1.3-11 Amendment No.

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated. IMMEDIATE When "Immediately" is used as a Completion Time, the Required COMPLETION TIME Action should be pursued without delay and in a controlled manner. ANO-1 1.3-12 Amendment No.

RPS Instrumentation 3.3.1 3.3 INSTRUMENTATION 3.3.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1 Four channels of RPS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.1-1. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel inoperable. A.1 Place channel in bypass or 1 hour trip. OR A.2 Prevent bypass of 1 hour remaining channels. B. Two channels B.1 Place one channel in trip. 1 hour inoperable. AND OR In accordance with the Risk Informed Completion Time Program B.2.1 Place second channel in 1 hour bypass. OR B.2.2 Prevent bypass of 1 hour remaining channels. C. Three or more channels C.1 Enter the Condition Immediately inoperable. referenced in Move Table 3.3.1-1 for the to Pg 3.3.1-2 OR Function. Required Action and associated Completion ANO-1 3.3.1-1 Amendment No. 215,

RPS Instrumentation 3.3.1 Move Time of Condition A or B to Pg not met. 3.3.1-2 ANO-1 3.3.1-1 Amendment No. 215,

RPS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME C. Three or more channels C.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.1-1 for the Moved OR Function. from Pg 3.3.1-1 Required Action and associated Completion Time of Condition A or B not met. D. As required by Required D.1 Be in MODE 3. 6 hours Action C.1 and referenced in AND Table 3.3.1-1. D.2 Open all control rod drive 6 hours (CRD) trip breakers. E. As required by Required E.1 Open all CRD trip 6 hours Action C.1 and breakers. referenced in Table 3.3.1-1. F. As required by Required F.1 Reduce THERMAL POWER 6 hours Action C.1 and < 45% RTP. referenced in Table 3.3.1-1. G. As required by Required G.1 Reduce THERMAL POWER 6 hours Action C.1 and < 10% RTP. referenced in Table 3.3.1-1. SURVEILLANCE REQUIREMENTS Move to Pg -------------------------------------------------------------NOTE-------------------------------------------------------- 3.3.1-3 Refer to Table 3.3.1-1 to determine which SRs apply to each RPS Function. ANO-1 3.3.1-2 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SURVEILLANCE FREQUENCY Move to Pg SR 3.3.1.1 Perform CHANNEL CHECK. In accordance with 3.3.1-3 the Surveillance Frequency Control Program ANO-1 3.3.1-2 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SURVEILLANCE REQUIREMENTS

       -------------------------------------------------------------NOTE--------------------------------------------------------

Refer to Table 3.3.1-1 to determine which SRs apply to each RPS Function. Moved from Pg SURVEILLANCE FREQUENCY 3.3.1-2 SR 3.3.1.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.1.2 ------------------------------NOTES--------------------------

1. Adjust power range channel output if the absolute difference is > 2% RTP.
2. Not required to be performed until 24 hours after THERMAL POWER is 20% RTP.

Compare results of calorimetric heat balance In accordance with calculation to power range channel output. the Surveillance Frequency Control Program AND Once within 24 hours after a THERMAL POWER change of 10% RTP SR 3.3.1.3 ------------------------------NOTES--------------------------

1. Adjust the power range channel imbalance output if the absolute value of the imbalance error is 2% RTP.
2. Not required to be performed until 24 hours after THERMAL POWER is 20% RTP.

Compare results of out of core measured AXIAL In accordance with POWER IMBALANCE to incore measured AXIAL the Surveillance POWER IMBALANCE. Frequency Control Program ANO-1 3.3.1-3 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SR 3.3.1.4 Perform CHANNEL FUNCTIONAL TEST. In accordance with Move the Surveillance to Pg 3.3.1-4 Frequency Control Program ANO-1 3.3.1-3 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SURVEILLANCE FREQUENCY Moved SR 3.3.1.4 Perform CHANNEL FUNCTIONAL TEST. In accordance with from the Surveillance Pg Frequency Control 3.3.1-3 Program SR 3.3.1.5 -----------------------------NOTE------------------------------ Neutron detectors are excluded from CHANNEL CALIBRATION. Perform CHANNEL CALIBRATION. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.1-4 Amendment No. 215,264,

ESAS Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation LCO 3.3.5 Three ESAS analog instrument channels for each Parameter in Table 3.3.5-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.5-1. ACTIONS

       -----------------------------------------------------------NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Parameter. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Parameters A.1 Place analog instrument 1 hour with one analog instrument channel in trip. channel inoperable. OR In accordance with the Risk Informed Completion Time Program B. One or more Parameters B.1 Be in MODE 3. 6 hours with more than one analog instrument channel AND inoperable. B.2 --------------NOTE-------------- OR Only required for RCS Pressure - Low setpoint. Required Action and ------------------------------------ associated Completion Time not met. Reduce RCS pressure 36 hours

                                                                 < 1750 psig.

AND B.3 --------------NOTES------------ Move 1. Only required for to Pg Reactor Building 3.3.5-2 Pressure High setpoint and High High setpoint. ANO-1 3.3.5-1 Amendment No. 215,253,

ESAS Instrumentation 3.3.5

2. LCO 3.0.4.a is not applicable when Move entering Mode 4.

to Pg 3.3.5-2 Be in MODE 4. 12 hours ANO-1 3.3.5-1 Amendment No. 215,253,

ESAS Instrumentation 3.3.5 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.3 --------------NOTES------------

1. Only required for Reactor Building Pressure High setpoint Moved and High High setpoint.

from Pg 2. LCO 3.0.4.a is not 3.3.5-1 applicable when entering Mode 4. Be in MODE 4. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.5.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.5.2 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program SR 3.3.5.3 Perform CHANNEL CALIBRATION. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.5-2 Amendment No. 215,264,

ESAS Manual Initiation 3.3.6 3.3 INSTRUMENTATION 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation LCO 3.3.6 Two manual initiation channels of each one of the ESAS Functions below shall be OPERABLE:

a. High Pressure Injection (channels 1 and 2);
b. Low Pressure Injection (channels 3 and 4);
c. Reactor Building (RB) Cooling (channels 5 and 6); and
d. RB Spray (channels 7 and 8).

APPLICABILITY: MODES 1 and 2, MODES 3 and 4 when associated engineered safeguards equipment is required to be OPERABLE. ACTIONS


NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more ESAS A.1 Restore channel to 72 hours Functions with one channel OPERABLE status. inoperable. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 --------------NOTE------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.3.6-1 Amendment No. 215,253,272,

DG LOPS 3.3.8 3.3 INSTRUMENTATION 3.3.8 Diesel Generator (DG) Loss of Power Start (LOPS) LCO 3.3.8 Two loss of voltage Function relays and two degraded voltage Function relays DG LOPS instrumentation per DG shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS

       ----------------------------------------------------------NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore relay(s) to 1 hour with one or more relays for OPERABLE status. one or more DGs OR inoperable.

                                                                                                         ---------NOTE---------

Not applicable when a loss of safety function exists. In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Declare affected DG(s) Immediately associated Completion inoperable. Time not met. SURVEILLANCE REQUIREMENTS Move SURVEILLANCE FREQUENCY to Pg 3.3.8-2 SR 3.3.8.1 Perform CHANNEL CHECK. In accordance with the Surveillance ANO-1 3.3.8-1 Amendment No. 215,264,

DG LOPS 3.3.8 Move Frequency Control to Pg Program 3.3.8-2 ANO-1 3.3.8-1 Amendment No. 215,264,

DG LOPS 3.3.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY Moved from Pg SR 3.3.8.1 Perform CHANNEL CHECK. In accordance with 3.3.8-1 the Surveillance Frequency Control Program SR 3.3.8.2 ------------------------------NOTE------------------------------ When DG LOPS instrumentation is placed in an inoperable status solely for performance of this Surveillance, entry into associated Conditions and Required Actions may be delayed up to 4 hours for the loss of voltage Function, provided the one remaining relay monitoring the Function for the bus is OPERABLE. Perform CHANNEL CALIBRATION with setpoint In accordance with Allowable Value as follows: the Surveillance Frequency Control

a. Degraded voltage 423.2 V and 436.0 V Program with a time delay of 8 seconds +/- 1 second; and
b. Loss of voltage 3251.5 V and 3349.5 V with a time delay of 2.0 seconds and 2.6 seconds.

ANO-1 3.3.8-2 Amendment No. 215,264,271,

EFIC System Instrumentation 3.3.11 3.3 INSTRUMENTATION 3.3.11 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation LCO 3.3.11 The EFIC System instrumentation channels for each Function in Table 3.3.11-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.11-1. ACTIONS

        -----------------------------------------------------------NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Emergency A.1 Place channel(s) in bypass 1 hour Feedwater (EFW) Initiation or trip. or Main Steam Line Isolation Functions listed in Table 3.3.11-1 with one channel inoperable. B. One or more EFW Initiation B.1 Place one channel in 1 hour or Main Steam Line Isolation bypass. Functions listed in Table 3.3.11-1 with two AND channels inoperable. B.2 Place second channel in trip. 1 hour OR In accordance with the Risk Informed Completion Time Program C. One EFW Vector Valve C.1 Restore channel to 72 hours Move to Control channel inoperable. OPERABLE status. Pg OR 3.3.11-2 In accordance with the Risk Informed ANO-1 3.3.11-1 Amendment No. 215,

EFIC System Instrumentation 3.3.11 Completion Time Program Move to Pg D. Required Action and D.1 Be in MODE 3. 6 hours 3.3.11-2 associated Completion Time not met for AND Function 1.b. D.2 Be in MODE 4. 12 hours ANO-1 3.3.11-1 Amendment No. 215,

EFIC System Instrumentation 3.3.11 CONDITION REQUIRED ACTION COMPLETION TIME C. One EFW Vector Valve C.1 Restore channel to 72 hours Control channel OPERABLE status. inoperable. OR In accordance with the Risk Informed Moved Completion Time from Pg Program 3.3.11-1 D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met for AND Function 1.b. D.2 Be in MODE 4. 12 hours E. Required Action and E.1 Reduce THERMAL 6 hours associated Completion POWER to 10% RTP. Time not met for Function 1.a or 1.d. F. Required Action and F.1 Be in MODE 3. 6 hours associated Completion Time not met for AND Functions 1.c, 2, or 3. F.2 Reduce steam generator 12 hours pressure to < 750 psig. SURVEILLANCE REQUIREMENTS

        -----------------------------------------------------------NOTE----------------------------------------------------------

Refer to Table 3.3.11-1 to determine which SRs shall be performed for each EFIC Function. SURVEILLANCE FREQUENCY SR 3.3.11.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.11-2 Amendment No. 215,227,264,

EFIC System Instrumentation 3.3.11 SR 3.3.11.2 Perform CHANNEL FUNCTIONAL TEST.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program Move to Pg 3.3.11-3 SR 3.3.11.3 Perform CHANNEL CALIBRATION.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program ANO-1 3.3.11-2 Amendment No. 215,227,264,

EFIC System Instrumentation 3.3.11 SURVEILLANCE REQUIREMENTS (continued) SURVEILLANCE FREQUENCY SR 3.3.11.2 Perform CHANNEL FUNCTIONAL TEST.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program Moved from Pg 3.3.11-2 SR 3.3.11.3 Perform CHANNEL CALIBRATION.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program The following notes apply only to the SG Level - Low function: Note 1: If the as-found channel setpoints are conservative with respect to the Allowable Value but outside their predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoints are not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Note 2: The instrument channel setpoint(s) shall be reset to a value that is equal to or more conservative than the Limiting Trip Setpoint; otherwise, the channel shall be declared inoperable. The Limiting Trip Setpoint and the methodology used to determine the Limiting Trip Setpoint and the predefined as-found acceptance criteria band are specified in the Bases. ANO-1 3.3.11-3 Amendment No. 215,227,264,

EFIC Manual Initiation 3.3.12 3.3 INSTRUMENTATION 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation LCO 3.3.12 Two manual initiation switches per actuation train for each of the following EFIC Functions shall be OPERABLE:

a. Steam generator (SG) A Main Steam Line Isolation;
b. SG B Main Steam Line Isolation; and
c. Emergency Feedwater (EFW) Initiation.

APPLICABILITY: When associated EFIC Function is required to be OPERABLE. ACTIONS

        ----------------------------------------------------------NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more EFIC A.1 Place affected trip bus in 72 hours Function(s) with one the affected train for the required manual initiation associated EFIC OR switch inoperable in one Function(s) in trip. actuation train. In accordance with the Risk Informed Completion Time Program B. One or more EFIC B.1 Restore one manual 72 hours Function(s) with both initiation switch for each of required manual initiation the affected EFIC OR switches inoperable in a Function(s) to OPERABLE single actuation train. status. In accordance with the Risk Informed Completion Time Program Move to C. One or more EFIC C.1 Restore one actuation train 1 hour Pg Function(s) with one or for the associated EFIC 3.3.12-2 both required manual Function(s) to OPERABLE OR initiation switches status. ANO-1 3.3.12-1 Amendment No. 215,

EFIC Manual Initiation 3.3.12 inoperable in both actuation In accordance with Move to trains. the Risk Informed Pg Completion Time 3.3.12-2 Program ANO-1 3.3.12-1 Amendment No. 215,

EFIC Manual Initiation 3.3.12 CONDITION REQUIRED ACTION COMPLETION TIME C. One or more EFIC C.1 Restore one actuation train 1 hour Function(s) with one or for the associated EFIC both required manual Function(s) to OPERABLE OR Moved initiation switches status. from Pg inoperable in both actuation In accordance 3.3.12-1 trains. with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met for EFW AND Initiation Function. D.2 Be in MODE 4. 12 hours E. Required Action and E.1 Be in MODE 3. 6 hours associated Completion Time not met for Main AND Steam Line Isolation Function. E.2.1 Reduce steam generator 12 hours pressure to < 750 psig. OR E.2.2 Close and deactivate all 12 hours associated valves. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.12.1 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.12-2 Amendment No. 215,264,

EFIC Logic 3.3.13 3.3 INSTRUMENTATION 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic LCO 3.3.13 Trains A and B of each Logic Function shown below shall be OPERABLE:

a. Main Steam Line Isolation; and
b. Emergency Feedwater (EFW) Initiation.

APPLICABILITY: When associated EFIC Function is required to be OPERABLE. ACTIONS

        ----------------------------------------------------------NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more train A A.1 Restore affected train to 72 hours Functions inoperable with OPERABLE status. all train B Functions OR OPERABLE; or one or more train B Functions In accordance with inoperable with all train A the Risk Informed Functions OPERABLE. Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met for EFW AND Initiation Function. B.2 Be in MODE 4. 12 hours C. Required Action and C.1 Be in MODE 3. 6 hours associated Completion Time not met for Main AND Move to Steam Line Isolation Pg Function. C.2.1 Reduce steam generator 12 hours 3.3.13-2 pressure to < 750 psig. OR ANO-1 3.3.13-1 Amendment No. 215,

EFIC Logic 3.3.13 Move to C.2.2 Close and deactivate all 12 hours Pg associated valves. 3.3.13-2 ANO-1 3.3.13-1 Amendment No. 215,

EFIC Logic 3.3.13 CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours associated Completion Time not met for Main AND Steam Line Isolation Moved Function. C.2.1 Reduce steam generator 12 hours from Pg pressure to < 750 psig. 3.3.13-1 OR C.2.2 Close and deactivate all associated valves. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.13.1 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.13-2 Amendment No. 215,264,

EFIC Vector Logic 3.3.14 3.3 INSTRUMENTATION 3.3.14 Emergency Feedwater Initiation and Control (EFIC) Vector Logic. LCO 3.3.14 Four channels of the EFIC vector logic shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 when steam generator pressure is 750 psig. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One vector logic channel A.1 Restore channel to 72 hours inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 Reduce steam generator 12 hours pressure to < 750 psig. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.14.1 Perform a CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.14-1 Amendment No. 215,264,

ECCS - Operating 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS - Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 with Reactor Coolant System (RCS) temperature > 350 °F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains A.1 Restore train(s) to 72 hours inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 Reduce RCS temperature 12 hours to 350 °F. C. Less than 100% of the C.1 Enter LCO 3.0.3. Immediately ECCS flow equivalent to a single OPERABLE train available. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.2.1 Verify each ECCS manual, power operated, and In accordance with automatic valve in the flow path, that is not locked, the Surveillance sealed, or otherwise secured in position, is in the Frequency Control correct position. Program ANO-1 3.5.2-1 Amendment No. 215,257,264,

Reactor Building Air Locks 3.6.2 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Lock an OPERABLE door 24 hours closed in the affected air lock. AND B.3 ---------------NOTE-------------- Air lock doors in high radiation areas may be verified locked closed by administrative means. Verify an OPERABLE door is Once per 31 days locked closed in the affected air lock. C. One or more reactor C.1 Initiate action to evaluate Immediately building air locks overall reactor building inoperable for reasons leakage rate per LCO 3.6.1. other than Condition A or B. AND C.2 Verify a door is closed in the 1 hour affected air lock. AND C.3 Restore air lock to 24 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND D.2 ---------------NOTE--------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.6.2-3 Amendment No. 215,253,

Reactor Building Isolation Valves 3.6.3 3.6 REACTOR BUILDING SYSTEMS 3.6.3 Reactor Building Isolation Valves LCO 3.6.3 Each reactor building isolation valve shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS


NOTES-------------------------------------------------------

1. Penetration flow paths, except for purge valve penetration flow paths, may be unisolated intermittently under administrative controls.
2. Separate Condition entry is allowed for each penetration flow path.
3. Enter applicable Conditions and Required Actions for system(s) made inoperable by reactor building isolation valves.
4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Reactor Building," when isolation valve leakage results in exceeding the overall reactor building leakage rate acceptance criteria.

CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------- A.1 Isolate the affected 48 hours Only applicable to penetration flow path by use penetration flow paths with of at least one closed and OR two reactor building de-activated automatic isolation valves. valve, closed manual valve, In accordance with

      ------------------------------------              blind flange, or check valve              the Risk Informed One or more penetration                           with flow through the valve               Completion Time flow paths with one reactor                       secured.                                  Program building isolation valve inoperable.                              AND ANO-1                                                       3.6.3-1                                Amendment No. 215,

Reactor Building Isolation Valves 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------------NOTES-------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.
2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. for isolation devices outside the reactor building AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside the reactor building B. -------------NOTE-------------- B.1 Isolate the affected 1 hour Only applicable to penetration flow path by use penetration flow paths with of at least one closed and two reactor building de-activated automatic isolation valves. valve, closed manual valve,

   ------------------------------------     or blind flange.

One or more penetration flow paths with two reactor building isolation valves inoperable. ANO-1 3.6.3-2 Amendment No. 215,

Reactor Building Isolation Valves 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME C. -------------NOTE-------------- C.1 Isolate the affected 72 hours Only applicable to penetration flow path by use penetration flow paths with of at least one closed and OR only one reactor building de-activated automatic isolation valve and a valve, closed manual valve, In accordance with closed system. or blind flange. the Risk Informed

   ------------------------------------                                             Completion Time AND                                         Program One or more penetration flow paths with one reactor          C.2 --------------NOTES-------------

building isolation valve 1. Isolation devices in high inoperable. radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND D.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.6.3-3 Amendment No. 215,253,

Reactor Building Spray and Cooling System 3.6.5 3.6 REACTOR BUILDING SYSTEMS 3.6.5 Reactor Building Spray and Cooling Systems LCO 3.6.5 Two reactor building spray trains and two reactor building cooling trains shall be OPERABLE.

                      ---------------------------------------------NOTE--------------------------------------------

Only one train of reactor building spray and one train of reactor building cooling are required to be OPERABLE during MODES 3 and 4. APPLICABILITY: MODES 1, 2, 3, and 4 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One reactor building spray A.1 Restore reactor building 72 hours train inoperable in spray train to OPERABLE MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program B. One reactor building B.1 Restore reactor building 7 days cooling train inoperable in cooling train to OPERABLE MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program C. Two reactor building C.1 Restore one reactor building 72 hours cooling trains inoperable cooling train to OPERABLE in MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.6.5-1 Amendment No. 215,268,

MSIVs 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs) LCO 3.7.2 Two MSIVs shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MSIV(s) A.1 Restore MSIV(s) to 24 hours inoperable in MODE 1 or 2. OPERABLE status. OR

                                                                     ----------NOTE----------

Only applicable when one MSIV remains OPERABLE. In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours associated Completion Time of Condition A not met. C. --------------NOTE------------- C.1 Close MSIV. 48 hours Separate Condition entry is allowed for each MSIV. AND C.2 Verify MSIV is closed. Once per 7 days One or more MSIV(s) inoperable in MODE 3. D. Required Action and D.1 Be in MODE 4. 24 hours associated Completion Time of Condition C not met. ANO-1 3.7.2-1 Amendment No. 215,

EFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Emergency Feedwater (EFW) System LCO 3.7.5 Two EFW trains shall be OPERABLE.

                            -----------------------------------------------NOTE--------------------------------------------

Only one EFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4. APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal. ACTIONS


NOTE---------------------------------------------------------

LCO 3.0.4.b is not applicable when entering Mode 1. CONDITION REQUIRED ACTION COMPLETION TIME A. Turbine driven EFW train A.1 Restore affected equipment 7 days inoperable due to one to OPERABLE status. inoperable steam supply. OR OR In accordance with the Risk Informed

        --------------NOTE------------                                                             Completion Time Only applicable if MODE 2                                                                  Program has not been entered following refueling.

Turbine driven EFW pump inoperable in MODE 3 following refueling. B. One EFW train inoperable B.1 Restore EFW train to 72 hours in MODE 1, 2, or 3 for OPERABLE status. reasons other than OR Condition A. In accordance with the Risk Informed Completion Time Program ANO-1 3.7.5-1 Amendment No. 215,232,260,268,

EFW System 3.7.5 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. Turbine driven EFW train C.1 Restore the steam supply to 24 hours inoperable due to one the turbine driven EFW train inoperable steam supply. to OPERABLE status. OR AND OR In accordance with the Risk Informed Motor driven EFW train Completion Time inoperable. Program C.2 Restore the motor driven 24 hours EFW train to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time of Condition A, B, AND or C not met. D.2 Be in MODE 4. 18 hours E. --------------NOTE------------ E.1 -------------NOTE---------------- Not applicable when the LCO 3.0.3 and all other LCO turbine driven EFW train is Required Actions requiring inoperable solely due to MODE changes are one inoperable steam suspended until one EFW supply. train is restored to

    -----------------------------------     OPERABLE status.

Two EFW trains inoperable in MODE 1, 2, Initiate action to restore one Immediately or 3. EFW train to OPERABLE status. F. Required EFW train F.1 Initiate action to restore Immediately inoperable in MODE 4. EFW train to OPERABLE status. ANO-1 3.7.5-2 Amendment No. 215,257,260,

SWS 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Service Water System (SWS) LCO 3.7.7 Two SWS loops shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SWS loop A.1 --------------NOTES------------- inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources

                                                     - Operating," for diesel generator made inoperable by SWS.
2. Enter Applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops
                                                     - MODE 4," for decay heat removal made inoperable by SWS.

Restore SWS loop to 72 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Move to Time not met. AND Pg 3.7.7-2 B.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. ANO-1 3.7.7-1 Amendment No. 215,253,

SWS 3.7.7 Move to Pg Be in MODE 4. 12 hours 3.7.7-2 ANO-1 3.7.7-1 Amendment No. 215,253,

SWS 3.7.7 CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND Moved from Pg B.2 ---------------NOTE-------------- 3.7.7-1 LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1 -------------------------------NOTE----------------------------- Isolation of SWS flow to individual components does not render the SWS inoperable. Verify each SWS manual, power operated, and In accordance with automatic valve in the flow path servicing safety the Surveillance related equipment, that is not locked, sealed, or Frequency Control otherwise secured in position, is in the correct Program position. SR 3.7.7.2 Verify each SWS automatic valve in the flow path In accordance with that is not locked, sealed, or otherwise secured in the Surveillance position, actuates to the correct position on an Frequency Control actual or simulated actuation signal. Program SR 3.7.7.3 Verify each required SWS pump starts In accordance with automatically on an actual or simulated signal. the Surveillance Frequency Control Program ANO-1 3.7.7-2 Amendment No. 215,218,264,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 ------------NOTE----------------- Startup Transformer No. 2 may be removed from service for up to 30 days for preplanned preventative maintenance. This 30 day Completion Time may be applied not more than once in any 10 year period. Restore required offsite 72 hours circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One DG inoperable. B.1 Perform SR 3.8.1.1 for 1 hour OPERABLE required offsite circuit(s). AND Once per 12 hours thereafter AND B.2 Declare required feature(s) 4 hours from supported by the inoperable discovery of DG inoperable when its Condition B redundant required concurrent with feature(s) is inoperable. inoperability of redundant required AND feature(s) B.3.1 Determine OPERABLE DG 24 hours is not inoperable due to common cause failure. OR B.3.2 Perform SR 3.8.1.2 for 24 hours OPERABLE DG. AND ANO-1 3.8.1-2 Amendment No. 215,236,268,

AC Sources - Operating 3.8.1 B.4 Restore DG to OPERABLE 7 days status. OR Move to Pg In accordance with 3.8.1-3 the Risk Informed Completion Time Program ANO-1 3.8.1-2 Amendment No. 215,236,268,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG to OPERABLE 7 days status. OR Moved from Pg 3.8.1-2 In accordance with the Risk Informed Completion Time Program C. Two required offsite C.1 Declare required feature(s) 12 hours from circuits inoperable. inoperable when its discovery of redundant required Condition C feature(s) is inoperable. concurrent with inoperability of redundant required AND feature(s) C.2 Restore one required offsite 24 hours circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. One required offsite circuit -------------------NOTE------------------- inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.6, AND "Distribution Systems - Operating," when Condition D is entered with One DG inoperable. no AC power source to any train. D.1 Restore required offsite 12 hours circuit to OPERABLE status. OR OR In accordance with the Risk Informed Completion Time Program Move to D.2 Restore DG to OPERABLE 12 hours Pg 3.8.1-4 status. OR ANO-1 3.8.1-3 Amendment No. 215,268,

AC Sources - Operating 3.8.1 In accordance with the Risk Informed Completion Time Move to Program Pg 3.8.1-4 E. Two DGs inoperable. E.1 Restore one DG to 2 hours OPERABLE status. ANO-1 3.8.1-3 Amendment No. 215,268,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 Restore DG to OPERABLE 12 hours status. OR In accordance with Moved from Pg the Risk Informed 3.8.1-3 Completion Time Program E. Two DGs inoperable. E.1 Restore one DG to 2 hours OPERABLE status. F. Required Action and F.1 Be in MODE 3. 6 hours Associated Completion Time of Condition A, B, C, AND D, or E not met. F.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours G. Three or more required G.1 Enter LCO 3.0.3. Immediately AC sources inoperable. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and indicated In accordance with power availability for each required offsite circuit. the Surveillance Frequency Control Program SR 3.8.1.2 -------------------------------NOTE----------------------------- Move to All DG starts may be preceded by an engine Pg prelube period and followed by a warmup period 3.8.1-5 prior to loading. ANO-1 3.8.1-4 Amendment No. 215,253,264,

AC Sources - Operating 3.8.1 Verify each DG starts from standby conditions and, In accordance with Move to in 15 seconds achieves ready-to-load the Surveillance Pg conditions. Frequency Control 3.8.1-5 Program ANO-1 3.8.1-4 Amendment No. 215,253,264,

AC Sources - Operating 3.8.1 SURVEILLANCE FREQUENCY SR 3.8.1.2 -------------------------------NOTE----------------------------- All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading. Moved from Pg 3.8.1-4 Verify each DG starts from standby conditions and, In accordance with in 15 seconds achieves ready-to-load the Surveillance conditions. Frequency Control Program SR 3.8.1.3 ------------------------------NOTES----------------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.
2. Momentary transients outside the load range do not invalidate this test.
3. This Surveillance shall be conducted on only one DG at a time.
4. This SR shall be preceded by and follow, without shutdown, a successful performance of SR 3.8.1.2.

Verify each DG is synchronized and loaded and In accordance with operates for 60 minutes at a load 2475 kW and the Surveillance 2750 kW. Frequency Control Program SR 3.8.1.4 Verify each day tank contains 160 gallons of fuel In accordance with oil. the Surveillance Frequency Control Program SR 3.8.1.5 Check for and remove accumulated water from In accordance with each day tank. the Surveillance Frequency Control Program SR 3.8.1.6 Verify the fuel oil transfer system operates to In accordance with transfer fuel oil from storage tanks to the day tank. the Surveillance Frequency Control Program ANO-1 3.8.1-5 Amendment No. 215,253,264,

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 Both DC electrical power subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One DC electrical power A.1 Restore DC electrical power 8 hours subsystem inoperable. subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours Associated Completion Time not met. AND B.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.8.4-1 Amendment No. 215,250,253,

Inverters - Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters - Operating LCO 3.8.7 The following inverters shall be OPERABLE.

a. Two Red Train inverters (Y11 and Y13, Y11 and Y15, or Y13 and Y15),

and

b. Two Green Train inverters (Y22 and Y24, Y22 and Y25, or Y24 and Y25),
                     -------------------------------------------------NOTE----------------------------------------

One of the four inverters required by LCO 3.8.7.a and LCO 3.8.7.b may be disconnected from its associated DC bus for 2 hours to perform load transfer to or from the swing inverter, provided:

a. The associated 120 VAC bus is energized from its alternate AC source; and
b. The other three 120 VAC buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One of the four inverters A.1 ---------------NOTE-------------- required by LCO 3.8.7.a Enter applicable Conditions and LCO 3.8.7.b and Required Actions of inoperable. LCO 3.8.9, "Distribution Systems - Operating" with any of the 120 VAC buses RS1, RS2, RS3, or RS4 de-energized. Restore inverter to 24 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.8.7-1 Amendment No. 215,230,268,

Distribution Systems - Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems - Operating LCO 3.8.9 Two AC, DC, and 120 VAC electrical power distribution subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more AC electrical A.1 Restore AC electrical power 8 hours power distribution distribution subsystem(s) to subsystem(s) inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One or more 120 VAC B.1 Restore 120 VAC electrical 8 hours electrical power power distribution distribution subsystem(s) subsystem(s) to OPERABLE OR (RS1, RS2, RS3, RS4) status. inoperable. In accordance with the Risk Informed Completion Time Program C. One or more DC electrical C.1 Restore DC electrical power 8 hours power distribution distribution subsystem(s) to subsystem(s) inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours Move to associated Completion Pg Time not met. AND 3.8.9-2 D.2 ---------------NOTE-------------- ANO-1 3.8.9-1 Amendment No. 215,218,230,253,268,

Distribution Systems - Operating 3.8.9 CONDITION REQUIRED ACTION COMPLETION TIME LCO 3.0.4.a is not applicable when entering Mode 4. Move to ------------------------------------- Pg 3.8.9-2 12 hours Be in MODE 4. ANO-1 3.8.9-1 Amendment No. 215,218,230,253,268,

Distribution Systems - Operating 3.8.9 CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND Moved D.2 ---------------NOTE-------------- from Pg 3.8.9-1 LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours E. Two or more electrical E.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments to required AC, In accordance with DC, and 120 VAC bus electrical power distribution the Surveillance subsystems. Frequency Control Program ANO-1 3.8.9-2 Amendment No. 215,218,230,264,

Programs and Manuals 5.5 5.0 ADMINISTRATIVE CONTROLS 5.5 Programs and Manuals 5.5.17 Metamic Coupon Sampling Program A coupon surveillance program will be implemented to maintain surveillance of the Metamic absorber material under the radiation, chemical, and thermal environment of the SFP. The purpose of the program is to establish the following:

  • Coupons will be examined on a two year basis for the first three intervals with the first coupon retrieved for inspection being on or before February 2009 and thereafter at increasing intervals over the service life of the inserts.
  • Measurements to be performed at each inspection will be as follows:

A) Physical observations of the surface appearance to detect pitting, swelling or other degradation, B) Length, width, and thickness measurements to monitor for bulging and swelling C) Weight and density to monitor for material loss, and D) Neutron attenuation to confirm the B-10 concentration or destructive chemical testing to determine the boron content.

  • The provisions of SR 3.0.2 are applicable to the Metamic Coupon Sampling Program.
  • The provisions of SR 3.0.3 are not applicable to the Metamic Coupon Sampling Program.

5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days;
b. A RICT may only be utilized in MODE 1 and 2; ANO-1 5.0-20 Amendment No. 228,239,250,

Programs and Manuals 5.5 5.0 ADMINISTRATIVE CONTROLS 5.5 Programs and Manuals

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.
1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less.
3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.
d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:
1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or
2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.
e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

ANO-1 5.0-20a Amendment No.

Attachment 3 1CAN122201 Retyped Technical Specification Pages (41 Pages)

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) Example 1.3-7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Verify affected 1 hour subsystem subsystem isolated. inoperable. AND Once per 8 hours thereafter AND A.2 Restore subsystem 72 hours to OPERABLE status. B. Required B.1 Be in MODE 3. 6 hours Action and associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours Required Action A.1 has two Completion Times. The 1 hour Completion Time begins at the time the Condition is entered and each "Once per 8 hours thereafter" interval begins upon performance of Required Action A.1. If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour or any subsequent 8 hour interval from the previous performance (plus the extension allowed by SR 3.0.2), Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired. ANO-1 1.3-10 Amendment No. 215,218,265,

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) Example 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore subsystem 7 days subsystem to OPERABLE inoperable. status. OR In accordance with the Risk Informed Completion Time Program B. Required B.1 Be in MODE 3. 6 hours Action and associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours When a subsystem is declared inoperable, Condition A is entered. The 7-day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7-day Completion Time. The RICT cannot exceed 30 days. After the 7-day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered. The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less. If the 7-day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. ANO-1 1.3-11 Amendment No.

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued) If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated. IMMEDIATE When "Immediately" is used as a Completion Time, the Required COMPLETION TIME Action should be pursued without delay and in a controlled manner. ANO-1 1.3-12 Amendment No.

RPS Instrumentation 3.3.1 3.3 INSTRUMENTATION 3.3.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1 Four channels of RPS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.1-1. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel inoperable. A.1 Place channel in bypass or 1 hour trip. OR A.2 Prevent bypass of 1 hour remaining channels. B. Two channels B.1 Place one channel in trip. 1 hour inoperable. AND OR In accordance with the Risk Informed Completion Time Program B.2.1 Place second channel in 1 hour bypass. OR B.2.2 Prevent bypass of 1 hour remaining channels. ANO-1 3.3.1-1 Amendment No. 215,

RPS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME C. Three or more channels C.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.1-1 for the OR Function. Required Action and associated Completion Time of Condition A or B not met. D. As required by Required D.1 Be in MODE 3. 6 hours Action C.1 and referenced in AND Table 3.3.1-1. D.2 Open all control rod drive 6 hours (CRD) trip breakers. E. As required by Required E.1 Open all CRD trip 6 hours Action C.1 and breakers. referenced in Table 3.3.1-1. F. As required by Required F.1 Reduce THERMAL POWER 6 hours Action C.1 and < 45% RTP. referenced in Table 3.3.1-1. G. As required by Required G.1 Reduce THERMAL POWER 6 hours Action C.1 and < 10% RTP. referenced in Table 3.3.1-1. ANO-1 3.3.1-2 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SURVEILLANCE REQUIREMENTS


NOTE--------------------------------------------------------

Refer to Table 3.3.1-1 to determine which SRs apply to each RPS Function. SURVEILLANCE FREQUENCY SR 3.3.1.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.1.2 ------------------------------NOTES--------------------------

1. Adjust power range channel output if the absolute difference is > 2% RTP.
2. Not required to be performed until 24 hours after THERMAL POWER is 20% RTP.

Compare results of calorimetric heat balance In accordance with calculation to power range channel output. the Surveillance Frequency Control Program AND Once within 24 hours after a THERMAL POWER change of 10% RTP SR 3.3.1.3 ------------------------------NOTES--------------------------

1. Adjust the power range channel imbalance output if the absolute value of the imbalance error is 2% RTP.
2. Not required to be performed until 24 hours after THERMAL POWER is 20% RTP.

Compare results of out of core measured AXIAL In accordance with POWER IMBALANCE to incore measured AXIAL the Surveillance POWER IMBALANCE. Frequency Control Program ANO-1 3.3.1-3 Amendment No. 215,264,

RPS Instrumentation 3.3.1 SURVEILLANCE FREQUENCY SR 3.3.1.4 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program SR 3.3.1.5 ------------------------------NOTE------------------------------- Neutron detectors are excluded from CHANNEL CALIBRATION. Perform CHANNEL CALIBRATION. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.1-4 Amendment No. 215,264,

ESAS Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation LCO 3.3.5 Three ESAS analog instrument channels for each Parameter in Table 3.3.5-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.5-1. ACTIONS


NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Parameter. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Parameters A.1 Place analog instrument 1 hour with one analog instrument channel in trip. channel inoperable. OR In accordance with the Risk Informed Completion Time Program B. One or more Parameters B.1 Be in MODE 3. 6 hours with more than one analog instrument channel AND inoperable. B.2 --------------NOTE-------------- OR Only required for RCS Pressure - Low setpoint. Required Action and ------------------------------------ associated Completion Time not met. Reduce RCS pressure 36 hours

                                                         < 1750 psig.

AND ANO-1 3.3.5-1 Amendment No. 215,253,

ESAS Instrumentation 3.3.5 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.3 --------------NOTES------------

1. Only required for Reactor Building Pressure High setpoint and High High setpoint.
2. LCO 3.0.4.a is not applicable when entering Mode 4.

Be in MODE 4. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.5.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.5.2 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program SR 3.3.5.3 Perform CHANNEL CALIBRATION. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.5-2 Amendment No. 215,264,

ESAS Manual Initiation 3.3.6 3.3 INSTRUMENTATION 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation LCO 3.3.6 Two manual initiation channels of each one of the ESAS Functions below shall be OPERABLE:

a. High Pressure Injection (channels 1 and 2);
b. Low Pressure Injection (channels 3 and 4);
c. Reactor Building (RB) Cooling (channels 5 and 6); and
d. RB Spray (channels 7 and 8).

APPLICABILITY: MODES 1 and 2, MODES 3 and 4 when associated engineered safeguards equipment is required to be OPERABLE. ACTIONS


NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more ESAS A.1 Restore channel to 72 hours Functions with one channel OPERABLE status. inoperable. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 --------------NOTE------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.3.6-1 Amendment No. 215,253,272,

DG LOPS 3.3.8 3.3 INSTRUMENTATION 3.3.8 Diesel Generator (DG) Loss of Power Start (LOPS) LCO 3.3.8 Two loss of voltage Function relays and two degraded voltage Function relays DG LOPS instrumentation per DG shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS


NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore relay(s) to 1 hour with one or more relays for OPERABLE status. one or more DGs OR inoperable.

                                                                                                 ---------NOTE---------

Not applicable when a loss of safety function exists. In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Declare affected DG(s) Immediately associated Completion inoperable. Time not met. ANO-1 3.3.8-1 Amendment No. 215,264,

DG LOPS 3.3.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.8.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.8.2 ------------------------------NOTE------------------------------ When DG LOPS instrumentation is placed in an inoperable status solely for performance of this Surveillance, entry into associated Conditions and Required Actions may be delayed up to 4 hours for the loss of voltage Function, provided the one remaining relay monitoring the Function for the bus is OPERABLE. Perform CHANNEL CALIBRATION with setpoint In accordance with Allowable Value as follows: the Surveillance Frequency Control

a. Degraded voltage 423.2 V and 436.0 V Program with a time delay of 8 seconds +/- 1 second; and
b. Loss of voltage 3251.5 V and 3349.5 V with a time delay of 2.0 seconds and 2.6 seconds.

ANO-1 3.3.8-2 Amendment No. 215,264,271,

EFIC System Instrumentation 3.3.11 3.3 INSTRUMENTATION 3.3.11 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation LCO 3.3.11 The EFIC System instrumentation channels for each Function in Table 3.3.11-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.11-1. ACTIONS


NOTE----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Emergency A.1 Place channel(s) in bypass 1 hour Feedwater (EFW) Initiation or trip. or Main Steam Line Isolation Functions listed in Table 3.3.11-1 with one channel inoperable. B. One or more EFW Initiation B.1 Place one channel in 1 hour or Main Steam Line Isolation bypass. Functions listed in Table 3.3.11-1 with two AND channels inoperable. B.2 Place second channel in trip. 1 hour OR In accordance with the Risk Informed Completion Time Program ANO-1 3.3.11-1 Amendment No. 215,

EFIC System Instrumentation 3.3.11 CONDITION REQUIRED ACTION COMPLETION TIME C. One EFW Vector Valve C.1 Restore channel to 72 hours Control channel inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met for AND Function 1.b. D.2 Be in MODE 4. 12 hours E. Required Action and E.1 Reduce THERMAL 6 hours associated Completion Time POWER to 10% RTP. not met for Function 1.a or 1.d. F. Required Action and F.1 Be in MODE 3. 6 hours associated Completion Time not met for AND Functions 1.c, 2, or 3. F.2 Reduce steam generator 12 hours pressure to < 750 psig. SURVEILLANCE REQUIREMENTS


NOTE----------------------------------------------------------

Refer to Table 3.3.11-1 to determine which SRs shall be performed for each EFIC Function. SURVEILLANCE FREQUENCY SR 3.3.11.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.11-2 Amendment No. 215,227,264,

EFIC System Instrumentation 3.3.11 SURVEILLANCE REQUIREMENTS (continued) SURVEILLANCE FREQUENCY SR 3.3.11.2 Perform CHANNEL FUNCTIONAL TEST.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program SR 3.3.11.3 Perform CHANNEL CALIBRATION.(Notes 1 & 2) In accordance with the Surveillance Frequency Control Program The following notes apply only to the SG Level - Low function: Note 1: If the as-found channel setpoints are conservative with respect to the Allowable Value but outside their predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoints are not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Note 2: The instrument channel setpoint(s) shall be reset to a value that is equal to or more conservative than the Limiting Trip Setpoint; otherwise, the channel shall be declared inoperable. The Limiting Trip Setpoint and the methodology used to determine the Limiting Trip Setpoint and the predefined as-found acceptance criteria band are specified in the Bases. ANO-1 3.3.11-3 Amendment No. 215,227,264,

EFIC Manual Initiation 3.3.12 3.3 INSTRUMENTATION 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation LCO 3.3.12 Two manual initiation switches per actuation train for each of the following EFIC Functions shall be OPERABLE:

a. Steam generator (SG) A Main Steam Line Isolation;
b. SG B Main Steam Line Isolation; and
c. Emergency Feedwater (EFW) Initiation.

APPLICABILITY: When associated EFIC Function is required to be OPERABLE. ACTIONS


NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more EFIC A.1 Place affected trip bus in 72 hours Function(s) with one the affected train for the required manual initiation associated EFIC OR switch inoperable in one Function(s) in trip. actuation train. In accordance with the Risk Informed Completion Time Program B. One or more EFIC B.1 Restore one manual 72 hours Function(s) with both initiation switch for each of required manual initiation the affected EFIC OR switches inoperable in a Function(s) to OPERABLE single actuation train. status. In accordance with the Risk Informed Completion Time Program ANO-1 3.3.12-1 Amendment No. 215,

EFIC Manual Initiation 3.3.12 CONDITION REQUIRED ACTION COMPLETION TIME C. One or more EFIC C.1 Restore one actuation train 1 hour Function(s) with one or for the associated EFIC both required manual Function(s) to OPERABLE OR initiation switches status. inoperable in both actuation In accordance with trains. the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met for EFW AND Initiation Function. D.2 Be in MODE 4. 12 hours E. Required Action and E.1 Be in MODE 3. 6 hours associated Completion Time not met for Main AND Steam Line Isolation Function. E.2.1 Reduce steam generator 12 hours pressure to < 750 psig. OR E.2.2 Close and deactivate all 12 hours associated valves. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.12.1 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.12-2 Amendment No. 215,264,

EFIC Logic 3.3.13 3.3 INSTRUMENTATION 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic LCO 3.3.13 Trains A and B of each Logic Function shown below shall be OPERABLE:

a. Main Steam Line Isolation; and
b. Emergency Feedwater (EFW) Initiation.

APPLICABILITY: When associated EFIC Function is required to be OPERABLE. ACTIONS


NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function. CONDITION REQUIRED ACTION COMPLETION TIME A. One or more train A A.1 Restore affected train to 72 hours Functions inoperable with OPERABLE status. all train B Functions OR OPERABLE; or one or more train B Functions In accordance with inoperable with all train A the Risk Informed Functions OPERABLE. Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met for EFW AND Initiation Function. B.2 Be in MODE 4. 12 hours ANO-1 3.3.13-1 Amendment No. 215,

EFIC Logic 3.3.13 CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours associated Completion Time not met for Main AND Steam Line Isolation Function. C.2.1 Reduce steam generator 12 hours pressure to < 750 psig. OR C.2.2 Close and deactivate all associated valves. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.13.1 Perform CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.13-2 Amendment No. 215,264,

EFIC Vector Logic 3.3.14 3.3 INSTRUMENTATION 3.3.14 Emergency Feedwater Initiation and Control (EFIC) Vector Logic. LCO 3.3.14 Four channels of the EFIC vector logic shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 when steam generator pressure is 750 psig. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One vector logic channel A.1 Restore channel to 72 hours inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 Reduce steam generator 12 hours pressure to < 750 psig. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.14.1 Perform a CHANNEL FUNCTIONAL TEST. In accordance with the Surveillance Frequency Control Program ANO-1 3.3.14-1 Amendment No. 215,264,

ECCS - Operating 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS - Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 with Reactor Coolant System (RCS) temperature > 350 °F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains A.1 Restore train(s) to 72 hours inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 Reduce RCS temperature 12 hours to 350 °F. C. Less than 100% of the C.1 Enter LCO 3.0.3. Immediately ECCS flow equivalent to a single OPERABLE train available. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.2.1 Verify each ECCS manual, power operated, and In accordance with automatic valve in the flow path, that is not locked, the Surveillance sealed, or otherwise secured in position, is in the Frequency Control correct position. Program ANO-1 3.5.2-1 Amendment No. 215,257,264,

Reactor Building Air Locks 3.6.2 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Lock an OPERABLE door 24 hours closed in the affected air lock. AND B.3 ---------------NOTE-------------- Air lock doors in high radiation areas may be verified locked closed by administrative means. Verify an OPERABLE door is Once per 31 days locked closed in the affected air lock. C. One or more reactor C.1 Initiate action to evaluate Immediately building air locks overall reactor building inoperable for reasons leakage rate per LCO 3.6.1. other than Condition A or B. AND C.2 Verify a door is closed in the 1 hour affected air lock. AND C.3 Restore air lock to 24 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND D.2 ---------------NOTE--------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.6.2-3 Amendment No. 215,253,

Reactor Building Isolation Valves 3.6.3 3.6 REACTOR BUILDING SYSTEMS 3.6.3 Reactor Building Isolation Valves LCO 3.6.3 Each reactor building isolation valve shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS


NOTES-------------------------------------------------------

1. Penetration flow paths, except for purge valve penetration flow paths, may be unisolated intermittently under administrative controls.
2. Separate Condition entry is allowed for each penetration flow path.
3. Enter applicable Conditions and Required Actions for system(s) made inoperable by reactor building isolation valves.
4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Reactor Building," when isolation valve leakage results in exceeding the overall reactor building leakage rate acceptance criteria.

CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------- A.1 Isolate the affected 48 hours Only applicable to penetration flow path by use penetration flow paths with of at least one closed and OR two reactor building de-activated automatic isolation valves. valve, closed manual valve, In accordance with

      ------------------------------------              blind flange, or check valve              the Risk Informed One or more penetration                           with flow through the valve               Completion Time flow paths with one reactor                       secured.                                  Program building isolation valve inoperable.                              AND ANO-1                                                       3.6.3-1                                Amendment No. 215,

Reactor Building Isolation Valves 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------------NOTES-------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.
2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. for isolation devices outside the reactor building AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside the reactor building B. -------------NOTE-------------- B.1 Isolate the affected 1 hour Only applicable to penetration flow path by use penetration flow paths with of at least one closed and two reactor building de-activated automatic isolation valves. valve, closed manual valve,

   ------------------------------------     or blind flange.

One or more penetration flow paths with two reactor building isolation valves inoperable. ANO-1 3.6.3-2 Amendment No. 215,

Reactor Building Isolation Valves 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME C. -------------NOTE-------------- C.1 Isolate the affected 72 hours Only applicable to penetration flow path by use penetration flow paths with of at least one closed and OR only one reactor building de-activated automatic isolation valve and a valve, closed manual valve, In accordance with closed system. or blind flange. the Risk Informed

   ------------------------------------                                             Completion Time AND                                         Program One or more penetration flow paths with one reactor          C.2 --------------NOTES-------------

building isolation valve 1. Isolation devices in high inoperable. radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND D.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.6.3-3 Amendment No. 215,253,

Reactor Building Spray and Cooling System 3.6.5 3.6 REACTOR BUILDING SYSTEMS 3.6.5 Reactor Building Spray and Cooling Systems LCO 3.6.5 Two reactor building spray trains and two reactor building cooling trains shall be OPERABLE.

                      ---------------------------------------------NOTE--------------------------------------------

Only one train of reactor building spray and one train of reactor building cooling are required to be OPERABLE during MODES 3 and 4. APPLICABILITY: MODES 1, 2, 3, and 4 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One reactor building spray A.1 Restore reactor building 72 hours train inoperable in spray train to OPERABLE MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program B. One reactor building B.1 Restore reactor building 7 days cooling train inoperable in cooling train to OPERABLE MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program C. Two reactor building C.1 Restore one reactor building 72 hours cooling trains inoperable cooling train to OPERABLE in MODE 1 or 2. status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.6.5-1 Amendment No. 215,268,

MSIVs 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs) LCO 3.7.2 Two MSIVs shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MSIV(s) A.1 Restore MSIV(s) to 24 hours inoperable in MODE 1 or 2. OPERABLE status. OR

                                                                     ----------NOTE----------

Only applicable when one MSIV remains OPERABLE. In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours associated Completion Time of Condition A not met. C. --------------NOTE------------- C.1 Close MSIV. 48 hours Separate Condition entry is allowed for each MSIV. AND C.2 Verify MSIV is closed. Once per 7 days One or more MSIV(s) inoperable in MODE 3. D. Required Action and D.1 Be in MODE 4. 24 hours associated Completion Time of Condition C not met. ANO-1 3.7.2-1 Amendment No. 215

EFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Emergency Feedwater (EFW) System LCO 3.7.5 Two EFW trains shall be OPERABLE.

                            -----------------------------------------------NOTE--------------------------------------------

Only one EFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4. APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal. ACTIONS


NOTE---------------------------------------------------------

LCO 3.0.4.b is not applicable when entering Mode 1. CONDITION REQUIRED ACTION COMPLETION TIME A. Turbine driven EFW train A.1 Restore affected equipment 7 days inoperable due to one to OPERABLE status. inoperable steam supply. OR OR In accordance with the Risk Informed

        --------------NOTE------------                                                             Completion Time Only applicable if MODE 2                                                                  Program has not been entered following refueling.

Turbine driven EFW pump inoperable in MODE 3 following refueling. B. One EFW train inoperable B.1 Restore EFW train to 72 hours in MODE 1, 2, or 3 for OPERABLE status. reasons other than OR Condition A. In accordance with the Risk Informed Completion Time Program ANO-1 3.7.5-1 Amendment No. 215,232,260,268,

EFW System 3.7.5 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. Turbine driven EFW train C.1 Restore the steam supply to 24 hours inoperable due to one the turbine driven EFW train inoperable steam supply. to OPERABLE status. OR AND OR In accordance with the Risk Informed Motor driven EFW train Completion Time inoperable. Program C.2 Restore the motor driven 24 hours EFW train to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time of Condition A, B, AND or C not met. D.2 Be in MODE 4. 18 hours E. --------------NOTE------------ E.1 -------------NOTE---------------- Not applicable when the LCO 3.0.3 and all other LCO turbine driven EFW train is Required Actions requiring inoperable solely due to MODE changes are one inoperable steam suspended until one EFW supply. train is restored to

    -----------------------------------     OPERABLE status.

Two EFW trains inoperable in MODE 1, 2, Initiate action to restore one Immediately or 3. EFW train to OPERABLE status. F. Required EFW train F.1 Initiate action to restore Immediately inoperable in MODE 4. EFW train to OPERABLE status. ANO-1 3.7.5-2 Amendment No. 215,257,260,

SWS 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Service Water System (SWS) LCO 3.7.7 Two SWS loops shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SWS loop A.1 --------------NOTES------------- inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources

                                             - Operating," for diesel generator made inoperable by SWS.
2. Enter Applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops
                                             - MODE 4," for decay heat removal made inoperable by SWS.

Restore SWS loop to 72 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.7.7-1 Amendment No. 215,253,

SWS 3.7.7 CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time not met. AND B.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1 -------------------------------NOTE----------------------------- Isolation of SWS flow to individual components does not render the SWS inoperable. Verify each SWS manual, power operated, and In accordance with automatic valve in the flow path servicing safety the Surveillance related equipment, that is not locked, sealed, or Frequency Control otherwise secured in position, is in the correct Program position. SR 3.7.7.2 Verify each SWS automatic valve in the flow path In accordance with that is not locked, sealed, or otherwise secured in the Surveillance position, actuates to the correct position on an Frequency Control actual or simulated actuation signal. Program SR 3.7.7.3 Verify each required SWS pump starts In accordance with automatically on an actual or simulated signal. the Surveillance Frequency Control Program ANO-1 3.7.7-2 Amendment No. 215,218,264,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 ------------NOTE----------------- Startup Transformer No. 2 may be removed from service for up to 30 days for preplanned preventative maintenance. This 30 day Completion Time may be applied not more than once in any 10 year period. Restore required offsite 72 hours circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One DG inoperable. B.1 Perform SR 3.8.1.1 for 1 hour OPERABLE required offsite circuit(s). AND Once per 12 hours thereafter AND B.2 Declare required feature(s) 4 hours from supported by the inoperable discovery of DG inoperable when its Condition B redundant required concurrent with feature(s) is inoperable. inoperability of redundant required AND feature(s) B.3.1 Determine OPERABLE DG 24 hours is not inoperable due to common cause failure. OR B.3.2 Perform SR 3.8.1.2 for 24 hours OPERABLE DG. AND ANO-1 3.8.1-2 Amendment No. 215,236,268,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG to OPERABLE 7 days status. OR In accordance with the Risk Informed Completion Time Program C. Two required offsite C.1 Declare required feature(s) 12 hours from circuits inoperable. inoperable when its discovery of redundant required Condition C feature(s) is inoperable. concurrent with inoperability of redundant required AND feature(s) C.2 Restore one required offsite 24 hours circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. One required offsite circuit -------------------NOTE------------------- inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.6, AND Distribution Systems - Operating, when Condition D is entered with One DG inoperable. no AC power source to any train. D.1 Restore required offsite 12 hours circuit to OPERABLE status. OR OR In accordance with the Risk Informed Completion Time Program ANO-1 3.8.1-3 Amendment No. 215,268,

AC Sources - Operating 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 Restore DG to OPERABLE 12 hours status. OR In accordance with the Risk Informed Completion Time Program E. Two DGs inoperable. E.1 Restore one DG to 2 hours OPERABLE status. F. Required Action and F.1 Be in MODE 3. 6 hours Associated Completion Time of Condition A, B, C, AND D, or E not met. F.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours G. Three or more required G.1 Enter LCO 3.0.3. Immediately AC sources inoperable. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and indicated In accordance with power availability for each required offsite circuit. the Surveillance Frequency Control Program ANO-1 3.8.1-4 Amendment No. 215,253,264,

AC Sources - Operating 3.8.1 SURVEILLANCE FREQUENCY SR 3.8.1.2 -------------------------------NOTE----------------------------- All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading. Verify each DG starts from standby conditions and, In accordance with in 15 seconds achieves ready-to-load the Surveillance conditions. Frequency Control Program SR 3.8.1.3 ------------------------------NOTES----------------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.
2. Momentary transients outside the load range do not invalidate this test.
3. This Surveillance shall be conducted on only one DG at a time.
4. This SR shall be preceded by and follow, without shutdown, a successful performance of SR 3.8.1.2.

Verify each DG is synchronized and loaded and In accordance with operates for 60 minutes at a load 2475 kW and the Surveillance 2750 kW. Frequency Control Program SR 3.8.1.4 Verify each day tank contains 160 gallons of fuel In accordance with oil. the Surveillance Frequency Control Program SR 3.8.1.5 Check for and remove accumulated water from In accordance with each day tank. the Surveillance Frequency Control Program SR 3.8.1.6 Verify the fuel oil transfer system operates to In accordance with transfer fuel oil from storage tanks to the day tank. the Surveillance Frequency Control Program ANO-1 3.8.1-5 Amendment No. 215,253,264,

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 Both DC electrical power subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One DC electrical power A.1 Restore DC electrical power 8 hours subsystem inoperable. subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours Associated Completion Time not met. AND B.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours ANO-1 3.8.4-1 Amendment No. 215,250,253,

Inverters - Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters - Operating LCO 3.8.7 The following inverters shall be OPERABLE.

a. Two Red Train inverters (Y11 and Y13, Y11 and Y15, or Y13 and Y15),

and

b. Two Green Train inverters (Y22 and Y24, Y22 and Y25, or Y24 and Y25),
                     -------------------------------------------------NOTE----------------------------------------

One of the four inverters required by LCO 3.8.7.a and LCO 3.8.7.b may be disconnected from its associated DC bus for 2 hours to perform load transfer to or from the swing inverter, provided:

a. The associated 120 VAC bus is energized from its alternate AC source; and
b. The other three 120 VAC buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One of the four inverters A.1 ---------------NOTE-------------- required by LCO 3.8.7.a Enter applicable Conditions and LCO 3.8.7.b and Required Actions of inoperable. LCO 3.8.9, "Distribution Systems - Operating" with any of the 120 VAC buses RS1, RS2, RS3, or RS4 de-energized. Restore inverter to 24 hours OPERABLE status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.8.7-1 Amendment No. 215,230,268,

Distribution Systems - Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems - Operating LCO 3.8.9 Two AC, DC, and 120 VAC electrical power distribution subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more AC electrical A.1 Restore AC electrical power 8 hours power distribution distribution subsystem(s) to subsystem(s) inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One or more 120 VAC B.1 Restore 120 VAC electrical 8 hours electrical power power distribution distribution subsystem(s) subsystem(s) to OPERABLE OR (RS1, RS2, RS3, RS4) status. inoperable. In accordance with the Risk Informed Completion Time Program C. One or more DC electrical C.1 Restore DC electrical power 8 hours power distribution distribution subsystem(s) to subsystem(s) inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program ANO-1 3.8.9-1 Amendment No. 215,218,230,253, 268,

Distribution Systems - Operating 3.8.9 CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 6 hours associated Completion Time not met. AND D.2 ---------------NOTE-------------- LCO 3.0.4.a is not applicable when entering Mode 4. Be in MODE 4. 12 hours E. Two or more electrical E.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function. SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments to required AC, In accordance with DC, and 120 VAC bus electrical power distribution the Surveillance subsystems. Frequency Control Program ANO-1 3.8.9-2 Amendment No. 215,218,230,264,

Programs and Manuals 5.5 5.0 ADMINISTRATIVE CONTROLS 5.5 Programs and Manuals 5.5.17 Metamic Coupon Sampling Program A coupon surveillance program will be implemented to maintain surveillance of the Metamic absorber material under the radiation, chemical, and thermal environment of the SFP. The purpose of the program is to establish the following:

  • Coupons will be examined on a two year basis for the first three intervals with the first coupon retrieved for inspection being on or before February 2009 and thereafter at increasing intervals over the service life of the inserts.
  • Measurements to be performed at each inspection will be as follows:

A) Physical observations of the surface appearance to detect pitting, swelling or other degradation, B) Length, width, and thickness measurements to monitor for bulging and swelling C) Weight and density to monitor for material loss, and D) Neutron attenuation to confirm the B-10 concentration or destructive chemical testing to determine the boron content.

  • The provisions of SR 3.0.2 are applicable to the Metamic Coupon Sampling Program.
  • The provisions of SR 3.0.3 are not applicable to the Metamic Coupon Sampling Program.

5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days;
b. A RICT may only be utilized in MODE 1 and 2; ANO-1 5.0-20 Amendment No. 228,239,250,

Programs and Manuals 5.5 5.0 ADMINISTRATIVE CONTROLS 5.5 Programs and Manuals

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.
1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less.
3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.
d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:
1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or
2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.
e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

ANO-1 5.0-20a Amendment No.

Attachment 4 1CAN122201 Technical Specification Bases Page Markups (Information Only) (28 Pages)

RPS Instrumentation B 3.3.1 ACTIONS (continued) A.1 and A.2 (continued) Operation in these configurations may continue indefinitely because the RPS is capable of performing its trip Function in the presence of any single random failure. The 1 hour Completion Time is sufficient to perform Required Action A.1 or Required Action A.2. B.1, B.2.1, and B.2.2 For Required Action B.1 and Required Action B.2, if one or more Functions in two protection channels become inoperable, one of two inoperable protection channels must be placed in trip. The second inoperable channel may be bypassed or may be maintained in an untripped and unbypassed condition. If the channel is not bypassed, bypass of the remaining channels must be prevented. This is accomplished by tagging them, under administrative controls, to prevent their being bypassed. This option assumes that the inoperability of the Function(s) in the second channel does not require that channel to remain in a tripped condition, and that the channel contains one or more Function(s) which remains OPERABLE. These Required Actions place all RPS Functions in either a one-out-of-two or one-out-of-three logic configuration. In either of these configurations, the RPS can still perform its safety functions in the presence of a random failure of any single channel. The 1 hour Completion Time is sufficient time to perform Required Action B.1, Required Action B.2.1, and Required Action B.2.2. Alternatively, a Completion Time can be determined for Required Action B.1 in accordance with the Risk Informed Completion Time Program. C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.1-1. The applicable Condition referenced in the table is Function dependent. If the Required Action and associated Completion Time of Condition A or B are not met or if more than two channels are inoperable, Condition C is entered to provide for transfer to the appropriate subsequent Condition. D.1 and D.2 If Required Action C.1 and Table 3.3.1-1 direct entry into Condition D, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and to open all CRD trip breakers without challenging unit systems. E.1 If Required Action C.1 and Table 3.3.1-1 direct entry into Condition E, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. To achieve this status, all CRD trip breakers must be opened. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to open CRD trip breakers without challenging unit systems. ANO-1 B 3.3.1-16 Amendment No. 215 Rev. 67,

ESAS Instrumentation B 3.3.5 ACTIONS (continued) If an analog instrument channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or ESAS bistable is found inoperable, then all affected functions provided by that channel should be declared inoperable and the unit must enter the Conditions for the particular protection Parameter affected. A.1 Condition A applies when one analog instrument channel becomes inoperable in one or more Parameters. If one ESAS analog instrument channel is inoperable, placing it in a tripped condition leaves the system in a one-out-of-two condition for actuation. Thus, if another analog instrument channel were to fail, the ESAS instrumentation could still perform its actuation functions. This action is completed when all of the affected output relays are tripped. This can normally be accomplished by tripping the affected bistables. The 1-hour Completion Time is sufficient time to perform the Required Action. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. B.1, B.2, and B.3 Condition B applies when Required Action A.1 and its associated Completion Time are not met, or when one or more parameters have more than one analog instrument channel inoperable. If Condition B applies, the unit must be brought to a condition in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours. Additionally, for the RCS Pressure - Low parameter, the unit must be brought to < 1750 psig within 36 hours, and for the RB Pressure - High and High High parameters, the unit must be brought to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 5). In MODE 4 the energy in the RCS is lower resulting in a lower risk of an event occurring which would require the ESAS instrumentation. The ESAS functions can be manually initiated if needed. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action B.3 is modified by a second Note. Note 2 states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. ANO-1 B 3.3.5-9 Amendment No. 215 Rev. 50,

ESAS Manual Initiation B 3.3.6 ACTIONS A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each ESAS manual initiation Function. A.1 Condition A applies when one manual initiation channel of one or more ESAS Functions becomes inoperable. Required Action A.1 must be taken to restore the channel to OPERABLE status within the next 72 hours or in accordance with the Risk Informed Completion Time Program. The Completion Time of 72 hours is based on unit operating experience and administrative controls, which provide alternative means of ESAS Function initiation via individual component controls. The 72-hour Completion Time is generally consistent with the allowed outage time for the safety systems actuated by ESAS. B.1 and B.2 If Required Action A.1 and the associated Completion Time are not met, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 2). In MODE 4 the energy in the RCS is lower resulting in a lower risk of an event occurring which would require the ESAS instrumentation. The ESAS functions can be manually initiated via the individual component controls if needed. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. ANO-1 B 3.3.6-3 Amendment No. 215 Rev. 50,

DG LOPS B 3.3.8 APPLICABILITY The DG LOPS actuation Function shall be OPERABLE in MODES 1, 2, 3, and 4 because ES Functions are required to be OPERABLE in these MODES. Automatic actuation is not required in MODES 5 or 6 since there is no automatic protective function on a loss of power or degraded power to the vital bus. ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. If a relay's trip setpoint is found nonconservative with respect to the Allowable Value (or any procedurally established OPERABILITY limit which may provide additional conservatisms), or the relay is otherwise found inoperable, then the function that the relay provides must be declared inoperable and the LCO Condition entered for the particular protection function affected. Since the required relay Functions are specified on a per DG basis, the Condition may be entered separately for each DG. A.1 With one or more relays in one or more Functions for one or more DGs inoperable, Required Action A.1 requires the inoperable relay(s) to be restored to OPERABLE status within 1 hour or in accordance with the Risk Informed Completion Time Program. This is modified by a Note stating that a Risk-Informed Completion Time cannot be applied if a loss of safety function exists. A loss of safety function, absent a single failure (a single failure is not assumed when complying with an LCO ACTION), would exist if both loss of voltage relays on both 4.16 kV trains are failed AND at least one degraded voltage relay on each of the vital 480 V load centers is failed. This configuration would result in defeating automatic LOPS separation from offsite power and starting of the respective DG. Therefore, a RICT cannot be applied when such a configuration exists. With a relay of a Function inoperable, the logic is not capable of providing an automatic DG LOPS signal for valid conditions for the associated DG. The 1-hour Completion Time is reasonable to evaluate and to take action by correcting the degraded condition in an orderly manner and takes into account the low probability of an event requiring LOPS occurring during this interval. B.1 Condition B applies if the Required Action and associated Completion Time of Condition A are not met. Required Action B.1 ensures that Required Actions for affected diesel generator inoperabilities are initiated. Depending on the DG(s) affected, the appropriate Actions specified in LCO 3.8.1, "AC Sources - Operating," are required immediately. ANO-1 B 3.3.8-4 Amendment No. 215 Rev. 56,67,73,

EFIC Instrumentation B 3.3.11 ACTIONS (continued) A.1 (continued) With one channel inoperable in one or more EFW Initiation or Main Steam Line Isolation Functions listed in Table 3.3.11-1, the channel(s) must be placed in bypass or trip within 1 hour. This Condition applies to failures that occur in a single channel, e.g., channel A, which when bypassed will remove initiate Functions within the channel from service. Since the RPS and EFIC channels are interlocked, only the corresponding channel in each system may be bypassed at any time. This feature is ensured by an electrical interlock. If testing of another channel in either the EFIC or RPS is required, the EFIC channel must be placed in trip to allow the other channel to be bypassed. With the channel in trip, the resultant logic is one-out-of-two. The Completion Time of 1 hour is adequate to perform Required Action A.1. B.1 and B.2 Condition B applies to a situation where two instrumentation channels of the same protection functions of EFW Initiation or Main Steam Line Isolation instrumentation are inoperable. For example, Condition B applies if channel A and B of the EFW Initiation Function are inoperable. With two EFW Initiation or Main Steam Line Isolation protection channels inoperable, one channel must be placed in bypass (Required Action B.1). Bypassing one of the remaining OPERABLE channels is not possible due to system interlocks. Therefore, the second channel must be tripped (Required Action B.2) to prevent a single failure from causing loss of the EFIC Function. The Completion Times of 1 hour are adequate to perform the Required Actions. Alternatively, a Completion Time can be determined for Required Action B.2 in accordance with the Risk Informed Completion Time Program. C.1 The function of the EFW Vector Valve Control is to meet the single-failure criterion while being able to provide EFW on demand and isolate an SG when required. These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system. Refer to LCO 3.3.14, "Emergency Feedwater Initiation and Control (EFIC) Vector Logic." With one EFW Vector Valve Control channel inoperable, the system cannot meet the single-failure criterion and still meet the dual functional criteria described earlier. This condition is analogous to having one EFW train inoperable. Therefore, when one vector valve control channel is inoperable, the channel must be restored to OPERABLE status (Required Action C.1) within 72 hours, which is consistent with the Completion Time associated with the loss of one train of EFW. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. ANO-1 B 3.3.11-11 Amendment No. 215 Rev. 12,67,

EFIC Manual Initiation B 3.3.12 LCO (continued) Two manual initiation switches per actuation train (Train A and Train B) of each Function (A and B Main Steam Line Isolation, and EFW Actuation) are required to be OPERABLE. This requirement may be satisfied by the manual trip switches located on the Remote Switch Matrix on the main control board, by the trip switches located on the EFIC control cabinets, or by any combination of switches located on the Remote Switch Matrix and the EFIC control cabinets such that Trip Bus 1 and Trip Bus 2 are available for each EFIC Function in each of the two EFIC trains. APPLICABILITY The EFIC System Manual Initiation Function shall be OPERABLE when the associated EFIC Instrumentation Main Steam Line Isolation or EFW Initiation Function is required to be OPERABLE in accordance with Table 3.3.11-1. Each Function, i.e., Main Steam Line Isolation and EFW Initiation, has its own requirements that are based on the specific accidents and conditions for which it is designed to mitigate the consequences. See Bases for LCO 3.3.11, EFIC Instrumentation, for additional discussion of each Function. ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC manual initiation Function. A.1 With one required manual initiation switch of one or more EFIC Function(s) inoperable in one train, the trip bus for the associated EFIC Function(s) must be placed in the tripped condition within 72 hours or in accordance with the Risk Informed Completion Time Program. With the trip bus in the tripped condition, the single-failure criterion is met. Failure to perform Required Action A.1 could allow a single failure of another switch to prevent manual actuation of at least one of the two trains. The Completion Time allotted to trip the trip bus allows the operator to take all the appropriate actions for the failed manual initiation switch and still ensure that the risk involved in operating with the failed manual initiation switch is acceptable. B.1 With both required manual initiation switches of one or more EFIC Function(s) inoperable in one train, one manual initiation switch must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. The effect for both required switches being inoperable simultaneously is the same as for the associated EFIC components for a single train being inoperable. Therefore, the 72-hour Completion Time is appropriate since it is consistent with the Completion Times of the associated system train. The trip bus associated with the remaining inoperable manual initiation switch must be placed in the tripped condition within 72 hours (Required Action A.1). With the affected trip bus in the tripped condition, the single failure criterion is met. The Completion Time allotted to restore a trip bus or place the trip bus in the tripped condition allows the operator to take all appropriate actions for the failed manual initiation switches and still ensure that the risk involved in operating with the failed manual initiation switches is acceptable. ANO-1 B 3.3.12-2 Amendment No. 215 Rev. 67,

EFIC Manual Initiation B 3.3.12 ACTIONS (continued) C.1 With one or both required manual initiation switches of one or more EFIC Function(s) inoperable in both actuation trains, one actuation train for each Function must be restored to OPERABLE status within 1 hour or in accordance with the Risk Informed Completion Time Program. With the train restored, the second train must be placed in the appropriate condition within 72 hours, or in accordance with the Risk Informed Completion Time Program, per Required Action A.1 or B.1, as applicable. Compliance with these actions ensures the single-failure criterion is met. The Completion Time allotted to restore the train allows the operator to take all the appropriate actions for the failed train and still ensures that the risk involved in operating with the failed train is acceptable. D.1 and D.2 If the Required Action and the associated Completion Time is not met for any EFW Initiation Function, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems. E.1, E.2.1, and E.2.2 If the Required Actions and associated Completion Times are not met for the Main Steam Line Isolation Function, the unit must be placed in a MODE or condition in which the requirement does not apply. This is initiated by placing the unit in MODE 3 within 6 hours and, either reducing SG pressure to less than 750 psig, or closing and deactivating all associated valves, i.e., the valves which EFIC would close if it were to actuate while OPERABLE. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE REQUIREMENTS SR 3.3.12.1 This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the trains can perform their intended functions. However, for Main Steam Line Isolation and EFW Initiation, the test need not include actuation of the end device. This is due to the risk of a unit transient caused by the closure of valves associated with Main Steam Line Isolation or EFW Initiation during testing at power. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. REFERENCES

1. IEEE-279-1971, April 1972.
2. 10 CFR 50.36.

ANO-1 B 3.3.12-3 Amendment No. 215 Rev. 67,

EFIC Logic B 3.3.13 ACTIONS (continued) A.1 (continued) Condition A can be thought of as equivalent to failure of a single train of a two train safety system (e.g., the safety function can be accomplished, but a single failure cannot be taken). Thus, the Completion Time of 72 hours has been chosen to be consistent with Completion Times for restoring one inoperable ESF System train. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The EFIC System has not been analyzed for failure of both trains of the same Function. Consequently, any combination of failures in both trains A and B is not covered by Condition A and must be addressed by entry into LCO 3.0.3. B.1 and B.2 If Required Action A.1 and its associated Completion Time is not met for the EFW Initiation Function, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems. C.1, C.2.1, and C.2.2 If the Required Actions and associated Completion Times are not met for the Main Steam Line Isolation Function, the unit must be placed in a MODE or condition in which the requirement does not apply. This is initiated by placing the unit in MODE 3 within 6 hours and, either reducing SG pressure to less than 750 psig, or closing and deactivating all associated valves, i.e., the valves which EFIC would close if it were to actuate while OPERABLE. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE REQUIREMENTS SR 3.3.13.1 This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the trains can perform their intended functions. This test verifies Main Steam Line Isolation and EFW Initiation automatic actuation logics are functional. This test simulates the required inputs to the logic circuit and verifies successful operation of the automatic actuation logic. The test need not include actuation of the end device. This is due to the risk of a unit transient caused by the closure of valves associated with Main Steam Line Isolation or actuation of EFW during testing at power. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. REFERENCES

1. SAR, Chapter 7.

ANO-1 B 3.3.13-4 Amendment No. 215 Rev. 67,

EFIC Vector Logic B 3.3.14 APPLICABILITY The EFIC Vector Logic shall be OPERABLE when the associated EFIC Instrumentation EFW Vector Valve Control Function is required to be OPERABLE in accordance with Table 3.3.11-1. The EFW Vector Valve Control Function is required to be OPERABLE in MODES 1 and 2, and in MODE 3 with SG pressure 750 psig because the SG inventory can contribute significantly to the reactor building peak pressure with a secondary side break. Both the normal feedwater and the EFW must be able to be isolated on each SG to limit overcooling of the primary and to limit mass and energy releases to the reactor building. Once the SG pressures have decreased below 750 psig, the energy level is low and the secondary side feedwater flow rate is low or nonexistent. Also, the primary system temperatures are typically too low to allow the SGs to effectively remove energy, or are sufficiently low to allow for operator action. Therefore, EFIC Vector Logic is not required to be OPERABLE in MODE 3 below 750 psig nor in MODES 4, 5, and 6. ACTIONS A.1 The function of the EFW control/isolation valves and the EFIC vector logic is to meet the single-failure criterion while maintaining the capability to:

a. Provide EFW on demand; and
b. Isolate an SG when required.

These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system. With one channel inoperable, the system cannot meet the single-failure criterion and still meet the dual functional criteria previously described. Therefore, when one vector valve logic channel is inoperable, the channel must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. This is analogous to having one EFW train inoperable; wherein a 72 hour Completion Time is provided by the Required Actions of LCO 3.7.5, "EFW System." As such, the Completion Time of 72 hours is based on engineering judgment. B.1 and B.2 If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and SG pressure must be reduced to < 750 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. ANO-1 B 3.3.14-3 Amendment No. 215 Rev. 67,

ECCS - Operating B 3.5.2 ACTIONS A.1 With one or more trains inoperable, but at least 100% of the injection flow equivalent to a single OPERABLE ECCS train still available, the inoperable components must be returned to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. The 72-hour Completion Time is based on NRC recommendations (Ref. 6) that are based on a risk evaluation and is a reasonable time for repairs. The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two diverse components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in unit operations under circumstances when diverse components in opposite trains are inoperable, i.e., an HPI subsystem in one train and an LPI subsystem in the opposite train. An event accompanied by a loss of offsite power and the failure of a DG can disable one ECCS train until power is restored. A reliability analysis (Ref. 6) has shown the risk of having one full ECCS train inoperable to be sufficiently low to justify continued operation for 72 hours. With one or more components inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be immediately entered. B.1 and B.2 If the Required Action and associated Completion Time of Condition A are not met, or one or more components are inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and RCS temperature must be reduced to less than or equal to 350 °F within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. C.1 Condition A is applicable with one or more trains inoperable. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available. With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the unit is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately. ANO-1 B 3.5.2-5 Amendment No. 215 Rev. 30,58,

Reactor Building Air Locks B 3.6.2 ACTIONS (continued) A.1, A.2, and A.3 (continued) This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the reactor building was entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open. B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A. The Required Actions have been modified by two Notes. Note 1 clarifies that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the reactor building under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable since it is overly conservative to immediately declare the reactor building inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), the reactor building remains OPERABLE, yet only 1 hour (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a unit shutdown. In addition, even with both doors failing the seal test, the overall reactor building leakage rate can still be within limits. Required Action C.2 requires that one door in the affected reactor building air lock must be verified to be closed. This action must be completed within the 1-hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that the reactor building be restored to OPERABLE status within 1 hour. Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24-hour Completion Time or in accordance with the Risk Informed Completion Time Program. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status assuming that at least one door is maintained closed in each affected air lock. ANO-1 B 3.6.2-4 Amendment No. 215 Rev. 50,

Reactor Building Isolation Valves B 3.6.3 ACTIONS (continued) The allowance provided by Note 1 is acceptable due to the expected infrequent need to apply these administrative controls and because the dedicated individual is assumed to close the penetration, when directed, without delay (Ref. 6). Containment penetration isolation response times are not applicable when these administrative controls are applied. When opening a penetration using the allowance of this Note, the LCO must be entered; however, the actions are delayed during the time period Note 1 is being applied. It is also acceptable to enter the applicable Required Action and, if the penetration must remain open beyond the stated Completion Time, Note 1 may be applied at the end of the Completion Time (i.e., the penetration need not be closed provided the administrative controls are in place prior to expiration of the Completion Time). In addition, in accordance with LCO 3.0.4, a penetration in which this Note is being applied may remain open during MODE changes because TS 3.6.3 permits continued plant operation in this configuration, provided the valve is closed when the required administrative controls are withdrawn. A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable reactor building isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable reactor building isolation valves are governed by subsequent Condition entry and application of associated Required Actions. The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable reactor building isolation valve. In the event isolation valve leakage results in exceeding the overall reactor building leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1. A.1 and A.2 In the event one reactor building isolation valve in one or more penetration flow paths is inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic reactor building isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to the reactor building. Required Action A.1 must be completed within the 48-hour Completion Time or in accordance with the Risk Informed Completion Time Program. The specified time period is reasonable, considering the time required to isolate the penetration and the relative importance of supporting reactor building OPERABILITY during MODES 1, 2, 3, and 4. ANO-1 B 3.6.3-4 Amendment No. 215 Rev. 39,50,

Reactor Building Isolation Valves B 3.6.3 ACTIONS (continued) A.1 and A.2 (continued) For affected penetration flow paths that cannot be restored to OPERABLE status within the 48-hour Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This periodic verification is necessary to ensure that the reactor building penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside the reactor building and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days following isolation for isolation devices outside the reactor building" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside the reactor building, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility. Condition A has been modified by a Note indicating this Condition is only applicable to those penetration flow paths with two reactor building isolation valves. For penetration flow paths in closed systems with only one reactor building isolation valve, Condition C provides appropriate actions. Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows the devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small. B.1 With two reactor building isolation valves in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of the reactor building and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low. ANO-1 B 3.6.3-5 Amendment No. 215 Rev. 39,50,

Reactor Building Isolation Valves B 3.6.3 ACTIONS (continued) B.1 (continued) Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two reactor building isolation valves. Condition A of this LCO addresses the condition of one reactor building isolation valve inoperable in this type of penetration flow path. C.1 and C.2 With one or more penetration flow paths with one reactor building isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within the 72-hour Completion Time or in accordance with the Risk Informed Completion Time Program. The specified time period is reasonable, considering the relative structural integrity of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting reactor building OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure that reactor building penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days following isolation for verifying that each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one reactor building isolation valve and a closed system. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system. Required Action C.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows these devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices, once verified to be in the proper position, is small. D.1 and D.2 If the Required Actions and associated Completion Times are not met, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. ANO-1 B 3.6.3-6 Amendment No. 215 Rev. 28,39,50,67,

Reactor Building Spray and Cooling Systems B 3.6.5 LCO (continued) For a RB Spray train to be considered OPERABLE, at least one qualified PAM RB Spray flow indication must be available in the control room (Reference 6). If the RB Spray train is considered inoperable solely due to flow indication inoperability, TS 3.0.6 can be invoked using the Safety Function Determination Program, and LCO 3.3.15 can alternately be used for TS compliance in lieu of LCO 3.6.5 Conditions and Required Actions. The RB Cooling system includes cooling coils, dampers, axial flow fans, single speed fan motors, instruments, and controls to ensure an OPERABLE flow path. APPLICABILITY In MODES 1, 2, 3, and 4, the RB OPERABILITY for the limiting DBAs is based on full power operation. Although reduced power in the lower MODES would not require the same level of accident mitigation performance, there are no accident analyses for reduced performance in the lower MODES. Since an event could cause a release of radioactive material in the RB as well as a temperature and pressure rise, the RB Spray and the RB Cooling systems are required to be OPERABLE in MODES 1, 2, 3, and 4. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the RB Spray and the RB Cooling systems are not required to be OPERABLE in MODES 5 and 6. ACTIONS A.1 With one RB Spray train inoperable in MODE 1 or 2, the inoperable RB Spray train must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE spray and cooling trains are adequate to support the iodine removal and perform the RB cooling functions. The 72-hour Completion Time takes into account the redundant heat and iodine removal capability afforded by the OPERABLE RB Cooling and Spray trains, reasonable time for repairs, and the low probability of a DBA occurring during this period. B.1 With one of the RB Cooling trains inoperable in MODE 1 or 2, the inoperable RB Cooling train must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. The remaining OPERABLE components are capable of providing at least 100% of the heat removal needs after an accident. The 7-day Completion Time takes into account the redundant heat removal capabilities afforded by combinations of the RB Spray and the RB Cooling systems and the low probability of a DBA occurring during this period. ANO-1 B 3.6.5-4 Amendment No. 215,218 Rev. 30,37,58,70,74,

Reactor Building Spray and Cooling Systems B 3.6.5 ACTIONS (continued) C.1 With two of the RB Cooling trains inoperable in MODE 1 or 2, one of the RB Cooling trains must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. The remaining spray system components (both spray trains are OPERABLE or else Condition G is entered) support iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 72-hour Completion Time takes into account the redundant heat removal capabilities afforded by the RB Spray system and the low probability of a DBA occurring during this period. D.1 If the Required Actions and associated Completion Times are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. E.1 With either one required RB Spray train or one required RB Cooling train inoperable in MODE 3 or 4, the inoperable train must be restored to OPERABLE status in 36 hours. The 36-hour Completion Time is reasonable based on consideration of the cooling capacity of the remaining required train of RB cooling or RB spray, the reduced reactor coolant energy in these MODES, and the short time spent in these MODES. F.1 If the Required Action and associated Completion Time of Condition E are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 5 within 36 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions in an orderly manner and without challenging unit systems. G.1 With two RB Spray trains inoperable in MODE 1 or 2, or any combination of three or more RB Spray and RB Cooling trains inoperable in MODE 1 or 2, or one required RB Spray train and one required RB Cooling train inoperable in MODE 3 or 4, then LCO 3.0.3 must be entered immediately. The first part of this Condition addresses the loss of RB Sump Buffering Agent System support which would result from two inoperable RB Spray trains in MODE 1 or 2. The second part of this Condition considers the loss of adequate RB cooling capacity in MODE 1 or 2 which would result from the loss of three or more of the four RB Spray and RB Cooling trains. Finally, the third part of this Condition addresses loss of RB cooling capability in MODES 3 and 4 when only one train of RB Spray and one train of RB Cooling are required. ANO-1 B 3.6.5-5 Amendment No. 215 Rev. 30,37,58,70,74,

MSIVs B 3.7.2 APPLICABLE SAFETY ANALYSES (continued) The MSIVs serve a closing safety function. In MODE 1 the MSIVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3). Although no licensing basis accidents or transients relating to the function of the MSIVs exist in other modes, the MSIVs are conservatively considered to satisfy Criterion 4 of 10 CFR 50.36 in MODEs 2 and 3. LCO This LCO requires that the MSIV in each steam line be OPERABLE. For an MSIV to be considered OPERABLE, the isolation time must be within limits and the MSIV must close on an isolation actuation signal when required. This LCO provides assurance that the MSIVs will perform their design safety function to isolate an SLB. APPLICABILITY The MSIVs must be OPERABLE to provide isolation of potential main steam line breaks in MODES 1, 2, and 3, when there is significant mass and energy in the RCS and steam generators. In MODE 4, the steam generator energy is low. Therefore, the MSIVs are not required to be OPERABLE. In MODES 5 and 6, the steam generators are depressurized and the MSIVs are not required for isolation of potential main steam line breaks. ACTIONS A.1 With one or more MSIVs inoperable in MODE 1 or 2, action must be taken to restore the component to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. The Risk-Informed Completion Time (RICT) is modified by a Note such that a RICT cannot be applied unless one MSIV remains OPERABLE. With both MSIVs inoperable, a loss of safety function exists and the MSIVs, therefore, must be restored to OPERABLE status within the 24-hour front-stop Completion Time. Some repairs can be made to the MSIV with the unit hot. The 24-hour Completion Time is reasonable, considering the probability of an accident that would require actuation of the MSIVs occurring during this time interval. Although not credited, the turbine throttle valves may be available to provide isolation for some postulated accidents. The main steam and feedwater systems do not provide a direct path from the reactor building atmosphere to the environment. Therefore, the Completion Time is reasonable, and provides for diagnosis and repair of many MSIV problems, thereby avoiding unnecessary shutdown. ANO-1 B 3.7.2-2 Amendment No. 215 Rev. 58,

EFW System B 3.7.5 APPLICABILITY (continued) In MODE 4, the EFW system must be OPERABLE when the steam generators are relied upon for decay heat removal since EFW is the safety related source of feedwater to the steam generators. In MODE 4, the steam generators are normally used for heat removal until the DHR system is in operation. In MODES 5 and 6, the steam generators are not used for DHR and the EFW system is not required. ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable EFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with EFW inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. A.1 With one of the two steam supply paths to the turbine driven EFW pump inoperable, or if the turbine driven EFW pump is inoperable in MODE 3 immediately following refueling, action must be taken to restore the steam supply to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. An OPERABLE steam supply path must include an OPERABLE AC-powered steam supply valve (CV-2617 or CV-2667), an OPERABLE DC-powered steam supply valve (CV-2613 or CV-2663), and an OPERABLE DC-powered steam supply bypass valve (CV-2615 or CV-2665). The 7-day Completion Time is reasonable, based on the following reasons:

a. For the inoperability of a turbine driven EFW pump due to one inoperable steam supply, the 7-day Completion Time is reasonable since there is a redundant steam line for the turbine driven pump and the turbine driven train is still capable of performing its specified safety function for most postulated events.
b. For the inoperability of the turbine driven EFW pump while in MODE 3 immediately subsequent to a refueling, the 7-day Completion Time is reasonable due to the minimal decay heat levels in this situation.
c. For both the inoperability of a turbine driven pump due to one inoperable steam supply and an inoperable turbine driven EFW pump while in MODE 3 immediately following a refueling, the 7-day Completion Time is reasonable due to the availability of the redundant OPERABLE EFW pump, and due to the low probability of an event requiring the use of the inoperable turbine driven EFW pump.

Condition A is modified by a Note which limits the applicability of the Condition for an inoperable turbine driven EFW pump in MODE 3 to when the unit has not entered MODE 2 following a refueling. Condition A allows one EFW train to be inoperable for 7 days vice the 72-hour Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical. ANO-1 B 3.7.5-3 Amendment No. 215 Rev. 22,52,62,64,70,

EFW System B 3.7.5 ACTIONS (continued) B.1 When one of the required EFW trains (pump or flow path) is inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore the train to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. This Condition includes the loss of two steam supply lines to the turbine driven EFW pump. The 72-hour Completion Time is reasonable, based on the redundant capabilities afforded by the EFW system, time needed for repairs, and the low probability of an event requiring EFW occurring during this time period. C.1 and C.2 With the required motor driven EFW train (pump or flow path) inoperable and the turbine driven EFW train inoperable due to one inoperable steam supply, action must be taken to restore the affected equipment to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. With respect to the turbine driven EFW train, an OPERABLE steam supply path must include an OPERABLE AC-powered steam supply valve (CV-2617 or CV-2667), an OPERABLE DC-powered steam supply valve (CV-2613 or CV-2663), and an OPERABLE DC-powered steam supply bypass valve (CV-2615 or CV-2665). Assuming no single active failures when in this condition, the accident (a FWLB or MSLB) could result in the loss of the remaining steam supply to the inoperable turbine driven EFW pump due to the faulted SG. In this condition, the EFW system may no longer be able to meet the required flow to the SGs assumed in the safety analysis. The 24-hour Completion Time is reasonable based on the remaining OPERABLE steam supply to the affected turbine driven EFW pump and the low probability of an event occurring that would require the inoperable steam supply to be available for the affected turbine driven EFW pump. D.1 and D.2 When Required Action A.1, B.1, C.1, or C.2 cannot be met within the required Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 18 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, with two EFW trains inoperable, operation is allowed to continue because only one motor driven EFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate DHR. ANO-1 B 3.7.5-4 Amendment No. 215 Rev. 22,52,62,64,70,

SWS B 3.7.7 ACTIONS A.1 If one SWS loop is inoperable, action must be taken to restore OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE SWS loop is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE SWS loop could result in loss of SWS function. Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," should be entered if an inoperable SWS loop results in an inoperable DG. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an inoperable SWS loop results in an inoperable DHR loop. The 72-hour Completion Time is based on the redundant capabilities afforded by the OPERABLE loop, and the low probability of a DBA occurring during this period. B.1 and B.2 If the Required Action and associated Completion Time are not met, the unit must be placed in a MODE in which overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 6). The stored energy in the RCS that must be removed by the SWS in the event of an accident in MODE 4 is substantially less than the energy assumed due to an accident at power. Therefore, the heat loads on the SWS are substantially reduced. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. ANO-1 B 3.7.7-3 Amendment No. 215 Rev. 41,46,50,

AC Sources - Operating B 3.8.1 ACTIONS (continued) If at any time during the existence of Condition A (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked. Discovering no offsite power to one train of the onsite Class 1E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with the other train that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown. The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to both trains of the onsite Class 1E Distribution System. The 24-hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. A.3 With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. The 72-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. Required Action A.3 has been modified by a Note extending the allowable outage time for Startup Transformer No. 2 only, for up to 30 days. The 30-day allowance is permitted not more than once in any 10-year period, which is considered sufficient for proper maintenance of the transformer. The 30-day window should permit extensive preplanned preventative maintenance without placing either unit in an action statement of short duration and would allow both units to be operating during such maintenance. Because this allowance assumes parts are prestaged, appropriate personnel are available, and proper contingencies have been established, it is not intended to be used for an unexpected loss of the transformer. Pre-established contingencies will consider the projected stability of the offsite electrical grid, the atmospheric stability projected for the maintenance window, the ability to adequately control other ongoing plant maintenance activities that coincide with the window, projected flood levels, and the availability of all other power sources. Since a station blackout is the most affected event that could occur when power sources are inoperable, the steam driven emergency feedwater pump will also be maintained available during the evolution. ANO-1 B 3.8.1-6 Amendment No. 215 Rev. 22,50,70,

AC Sources - Operating B 3.8.1 ACTIONS (continued) B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on the other DG, the other DG would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG. In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the corrective action program (CAP) will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24-hour constraint imposed while in Condition B. If while a DG is inoperable, a new problem with the DG is discovered that would have prevented the DG from performing its specified safety function, a separate entry into Condition B is not required. The new DG problem should be addressed in accordance with the plant CAP. According to Generic Letter 84-15 (Ref. 6), 24 hours is reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG. B.4 Operation may continue in Condition B for a period that should not exceed 7 days. In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 7-day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours is that a Completion Time of 24 hours is allowed for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are powered from redundant AC safety trains. The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both: ANO-1 B 3.8.1-8 Amendment No. 215 Rev. 22,50,57,70,

AC Sources - Operating B 3.8.1 ACTIONS (continued) C.1 and C.2 (continued)

a. All required offsite circuits are inoperable; and
b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable) a required feature becomes inoperable, this Completion Time begins to be tracked. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources. Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and
b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst-case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria. With the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation would continue in accordance with Condition A. D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train (one or more trains), the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train. ANO-1 B 3.8.1-9 Amendment No. 215 Rev. 22,50,70,

AC Sources - Operating B 3.8.1 ACTIONS (continued) D.1 and D.2 (continued) In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. The 12-hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ES functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation. With both DGs inoperable, operation may continue for a period that should not exceed 2 hours. F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 9). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. In particular, in MODE 4 the turbine-driven emergency feedwater pump[s] are available following a loss of AC sources to provide RCS cooling via the steam generators utilizing natural circulation. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action F.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. ANO-1 B 3.8.1-10 Amendment No. 215 Rev. 6,22,50,70,71,

DC Sources - Operating B 3.8.4 ACTIONS A.1 Condition A represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected subsystem. The 8-hour limit is consistent with the allowed time for an inoperable DC distribution subsystem. If one of the required DC electrical power subsystems is inoperable (e.g., inoperable battery, inoperable battery chargers, or inoperable battery chargers and associated inoperable battery), the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst-case single failure could, however, result in the loss of the minimum necessary electrical subsystems to mitigate a worse case accident, continued steady-state power operation should not exceed 8 hours. The 8-hour Completion Time reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. B.1 and B.2 If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 11). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. For example, in MODE 4 the turbine driven emergency feedwater pump[s] are available to provide RCS cooling via the steam generators utilizing natural circulation. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. ANO-1 B 3.8.4-4 Amendment No. 215 Rev. 49,50,71

Inverters - Operating B 3.8.7 ACTIONS (continued) Required Action A.1 allows 24 hours to fix the inoperable inverter and return it to service. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The 24-hour limit takes into consideration the time required to repair an inverter, the availability of a swing inverter, and the additional risk to which the unit is exposed because of the inverter inoperability. This must be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the 120 VAC bus is powered from its alternate AC source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the 120 VAC buses is the preferred source for powering instrumentation trip setpoint devices. B.1 and B.2 If the Required Actions and associated Completion Time are not met, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. For example, in MODE 4 the turbine driven emergency feedwater pump is available to provide RCS cooling via the steam generators utilizing natural circulation. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. C.1 and C.2 If any two inverters required by LCO 3.8.7.a and LCO 3.8.7.b are inoperable, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. ANO-1 B 3.8.7-3 Amendment No. 215 Rev. 13,16,50,71

Distribution Systems - Operating B 3.8.9 APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of abnormalities; and
b. Adequate core cooling is provided, and reactor building OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Electrical power distribution subsystem requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.10, "Distribution Systems - Shutdown." ACTIONS A.1 With one or more required AC electrical power distribution subsystems inoperable, the remaining OPERABLE portions of the AC electrical power distribution subsystem(s) may be capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ES functions not being supported. Therefore, the required AC buses, load centers, and motor control centers must be restored to OPERABLE status within 8 hours or in accordance with the Risk Informed Completion Time Program. Condition A worst case scenario is one train without AC power (i.e., no offsite power to the train and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8-hour time limit before requiring a unit shutdown in this Condition is acceptable because of:

a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train to the actions associated with taking the unit to shutdown within this time limit; and
b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.

ANO-1 B 3.8.9-3 Amendment No. 215 Rev. 50,70,

Distribution Systems - Operating B 3.8.9 ACTIONS (continued) B.1 With one or more 120 VAC bus electrical power distribution subsystems inoperable, the remaining OPERABLE portions of the 120 VAC bus subsystem(s) may be capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum ES functions not being supported. Therefore, the 120 VAC bus subsystem(s) must be restored to OPERABLE status within 8 hours by powering the affected bus(es) from the associated inverter via inverted DC or from its alternate AC source. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. Condition B represents one or more 120 VAC bus subsystem(s) without power; potentially both the DC source and the associated alternate AC source are nonfunctioning. In this situation the unit is significantly more vulnerable to a complete loss of all un-interruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining bus subsystem(s) and restoring power to the affected bus subsystem(s). The loss of any RS-panel requires entry into Condition B. This 8-hour limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate vital AC power. Taking exception to LCO 3.0.2 for components without adequate vital AC power, that would have the Required Action Completion Times shorter than 8 hours if declared inoperable, is acceptable because of:

a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;
b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without adequate vital AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and
c. The potential for an event in conjunction with a single failure of a redundant component.

The 8-hour Completion Time takes into account the importance to safety of restoring the 120 VAC bus subsystem(s) to OPERABLE status, the redundant capability afforded by the other OPERABLE bus subsystem, and the low probability of a DBA occurring during this period. C.1 With one or more DC subsystems inoperable, the remaining OPERABLE portions of the DC electrical power distribution subsystems may be capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ES functions not being supported. Therefore, the DC buses must be restored to OPERABLE status within 8 hours by powering the bus from the associated battery or one of the two associated chargers. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. ANO-1 B 3.8.9-4 Amendment No. 215 Rev. 50,70,

Attachment 5 1CAN122201 ANO-1 Technical Specification TSTF-505 Cross-Reference 1CAN122201 Page 1 of 9 ANO-1 Technical Specification TSTF-505 Cross-Reference TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference Completion Times 1.3 1.3 Administrative Variation Example 1.3-8 Example 1.3-8 Example 1.3-8 Incorporated example Section 2.3.1.10 Reactor Protective System 3.3.1 3.3.1 (system description provided in Enclosure 1) (RPS) Instrumentation B. Two channels inoperable B.1 B.1 RICT added to B.1 No Variation Engineered Safety Feature Actuation 3.3.5 3.3.5 (system description provided in Enclosure 1) System (ESFAS) Instrumentation A. One or more parameters with one A.1 A.1 RICT added to A.1 No Variation channel inoperable Engineered Safety Feature Actuation 3.3.6 3.3.6 (system description provided in Enclosure 1) System (ESFAS) Manual Initiation A. One or more ESFAS Functions with A.1 A.1 RICT added to A.1 No Variation one channel inoperable Emergency Diesel Generator (EDG) 3.3.8 3.3.8 (system description provided in Enclosure 1) Loss of Power Start (LOPS) Administrative Variation A. One or more Functions with one Section 2.3.1.7 A.1 A.1 RICT added to A.1 channel per EDG inoperable (additional justification provided in Enclosure 1) 1CAN122201 Page 2 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference Administrative Variation B. One or more Functions with two or Section 2.3.1.7 B.1 A.1 RICT added to A.1 more channels per EDG inoperable (additional justification provided in Enclosure 1) Emergency Feedwater Initiation and 3.3.11 3.3.11 (system description provided in Enclosure 1) Control (EFIC) System Instrumentation A. One or more Emergency Feedwater (EFW) Initiation, Main Steam Line No change - ANO-1 Isolation, or Main Feedwater (MFW) Administrative Variation A.2 N/A TSs do not contain Isolation Functions listed in Section 2.3.1.2 Required Action A.2 Table 3.3.11-1 with one channel inoperable B. One or more EFW Initiation, Main B.2 B.2 RICT added to B.2 No Variation Steam Line Isolation, or MFW Isolation Functions listed in No change - ANO-1 Administrative Variation Table 3.3.11-1 with two channels B.3 N/A TSs do not contain Section 2.3.1.2 inoperable Required Action B.3 C. One EFW Vector Valve Control C.1 C.1 RICT added to C.1 No Variation channel inoperable Emergency Feedwater Initiation and 3.3.12 3.3.12 (system description provided in Enclosure 1) Control (EFIC) Manual Initiation A. One or more EFIC Function(s) with one or both manual initiation RICT added to A.1 Administrative Variation A.1 A.1 and B.1 switches inoperable in one actuation and B.1 Section 2.3.1.8 channel 1CAN122201 Page 3 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference B. One or more EFIC Function(s) with Administrative Variation one or both manual initiation Section 2.3.1.8 B.1 C.1 RICT added to C.1 switches inoperable in both (additional justification actuation channels provided in Enclosure 1) Emergency Feedwater Initiation and 3.3.13 3.3.13 (system description provided in Enclosure 1) Control (EFIC) Logic A. One or more channel A Functions inoperable with all channel B Functions OPERABLE OR A.1 A.1 RICT added to A.1 No Variation One or more channel B Functions inoperable with all channel A Functions OPERABLE Emergency Feedwater Initiation and Control (EFIC) - Emergency Feedwater 3.3.14 3.3.14 (system description provided in Enclosure 1) (EFW) - Vector Valve Logic A. One vector valve logic channel A.1 A.1 RICT added to A.1 No Variation inoperable RCS Loops - MODE 3 3.4.5 3.4.5 No change - PRA not Administrative Variation A. One RCS loop inoperable A.1 A.1 applicable in Mode 3 Section 2.3.1.4 1CAN122201 Page 4 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference Pressurizer 3.4.9 3.4.9 C. Capacity of pressurizer heaters No change - not [capable of being powered by Administrative Variation C.1 C.1 quantifiable by ANO-1 emergency power supply] less than Section 2.3.1.5 PRA model limit ECCS - Operating 3.5.2 3.5.2 (system description provided in Enclosure 1) No change - ANO-1 A. One low pressure injection (LPI) Administrative Variation A.1 N/A TSs do not contain subsystem inoperable Section 2.3.1.2 separate action for LPI Administrative Variation B. One or more trains inoperable for Section 2.3.1.1 B.1 A.1 RICT added to A.1 reasons other than Condition A (additional justification provided in Enclosure 1) Containment Air Locks 3.6.2 3.6.2 (system description provided in Enclosure 1) C. One or more containment air locks No Variation inoperable for reasons other than C.3 C.3 RICT added to C.3 (additional justification Condition A or B provided in Enclosure 1) Containment Isolation Valves 3.6.3 3.6.3 A. One or more penetration flow paths with one containment isolation valve RICT added to A.1 A.1 A.1 inoperable (applicable to penetration Added "following No Variation flow paths with two [or more] A.2 A.2 isolation" to A.2 containment isolation valves) 1CAN122201 Page 5 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference C. One or more penetration flow paths with one containment isolation valve RICT added to C.1 inoperable (applicable to penetration C.1 C.1 Added "following No Variation flow paths with only one C.2 C.2 containment isolation valve and a isolation" to C.2 closed system) Containment Spray and 3.6.6 3.6.5 (system description provided in Enclosure 1) Cooling Systems No Variation A. One containment spray train A.1 A.1 RICT added to A.1 (additional justification inoperable provided in Enclosure 1) No Variation C. One [required] containment cooling C.1 B.1 RICT added to B.1 (additional justification train inoperable provided in Enclosure 1) No change - ANO-1 D. One containment spray train and TSs do not contain Administrative Variation one [required] containment cooling D.1 N/A action for this Section 2.3.1.2 train inoperable configuration No Variation E. Two [required] containment cooling E.1 C.1 RICT added to C.1 (additional justification trains inoperable provided in Enclosure 1) 1CAN122201 Page 6 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference Main Steam Isolation Valves (MSIVs) 3.7.2 3.7.2 (system description provided in Enclosure 1) Technical Variation RICT and proposed Section 2.3.2.1 A. One MSIV inoperable in MODE 1 A.1 A.1 Note added to A.1 (additional justification provided in Enclosure 1) Atmospheric Vent Valves (AVVs) 3.7.4 N/A No change - AVVs are Administrative Variation A. One required AVV [line] inoperable A.1 N/A not governed by ANO-1 Section 2.3.1.2 TSs Emergency Feedwater (EFW) System 3.7.5 3.7.5 A. One steam supply to turbine driven EFW pump inoperable OR A.1 A.1 RICT added to A.1 No Variation One turbine driven EFW pump inoperable in MODE 3 following refueling B. One EFW train inoperable [for reasons other than Condition A] in B.1 B.1 RICT added to B.1 No Variation MODE 1, 2, or 3. [C. Turbine driven EFW train inoperable RICT added to C.1 due to one inoperable steam supply and C.2 Technical Variation N/A C.1 and C.2 (Required Actions C.1 AND Section 2.3.2.2 and C.2 do not appear Motor driven EFW train inoperable] in the STS) 1CAN122201 Page 7 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference Component Cooling Water (CCW) 3.7.7 N/A System No change - CCW (ANO-1 intermediate Administrative Variation A. One CCW train inoperable A.1 N/A cooling water) is not Section 2.3.1.2 governed by ANO-1 TSs Service Water System (SWS) 3.7.8 3.7.7 A. One SWS train inoperable A.1 A.1 RICT added to A.1 No Variation Ultimate Heat Sink (UHS) 3.7.9 3.7.8 No change - no restore A. One or more cooling towers with Administrative Variation A.1 N/A time provided within the one cooling tower fan inoperable Section 2.3.1.2 ANO-1 TSs AC Sources - Operating 3.8.1 3.8.1 (system description provided in Enclosure 1) A. One [required] offsite circuit A.3 A.3 RICT added to A.3 No Variation inoperable B. One [required] DG inoperable B.4 B.4 RICT added to B.4 No Variation C. Two [required] offsite circuits C.2 C.2 RICT added to C.2 No Variation inoperable 1CAN122201 Page 8 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference D. One [required] offsite circuit inoperable. RICT added to D.1 D.1 and D.2 D.1 and D.2 No Variation AND and D.2 One [required] DG inoperable No change - F. One [required] [automatic load sequencers not Administrative Variation F.1 N/A sequencer] inoperable governed by ANO-1 Section 2.3.1.2 TSs DC Sources - Operating 3.8.4 3.8.4 (system description provided in Enclosure 1) A. One [or two] battery charger[s on Administrative Variation A.3 A.1 RICT added to A.1 one train] inoperable Section 2.3.1.9 B. One [or two] batter[y][ies on one Administrative Variation B.1 A.1 RICT added to A.1 train] inoperable Section 2.3.1.9 C. One DC electrical power subsystem Administrative Variation inoperable for reasons other than C.1 A.1 RICT added to A.1 Section 2.3.1.9 Condition A [or B] Inverters - Operating 3.8.7 3.8.7 (system description provided in Enclosure 1) A. One [required] inverter inoperable A.1 A.1 RICT added to A.1 No Variation Distribution Systems - Operating 3.8.9 3.8.9 (system description provided in Enclosure 1) A. One or more AC electrical power A.1 A.1 RICT added to A.1 No Variation distribution subsystems inoperable 1CAN122201 Page 9 of 9 TSTF-505 TS Section / TSTF-505 TS / ANO-1 / Attachment 1 Disposition Condition Description Required Action Required Action Variation Reference B. One or more AC vital buses B.1 B.1 RICT added to B.1 No Variation inoperable C. One or more DC electrical power C.1 C.1 RICT added to C.1 No Variation distribution subsystems inoperable Programs and Manuals 5.5 5.5 Risk Informed Completion Time Program 5.5.18 5.5.18 Program added No Variation

Enclosure 1 1CAN122201 List of Revised Required Actions to Corresponding PRA Functions 1CAN122201 Page 1 of 43 List of Revised Required Actions to Corresponding PRA Functions

1. Introduction Section 4.0, Item 2 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (Reference 2) identifies the following needed content when submitting a license amendment request to adopt Technical Specification (TS) Risk-Informed Completion Times (RICT):
  • The License Amendment Request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.
  • The LAR will provide a comparison of the TS functions to the probabilistic risk assessment (PRA) modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.
  • The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 50.46 ECCS flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure provides confirmation that the Arkansas Nuclear One, Unit 1 (ANO-1) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The ANO-1 PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program. Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions, and the results of the comparison:

   - Column "TS and Condition Description": Lists all of the LCOs and condition statements within the scope of the RICT Program.
   - Column "SSCs Covered by TS LCO Condition": The SSCs addressed by each action requirement.
   - Column "SSCs in PRA Model": Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.
   - Column "Function Covered by TS LCO Condition": A summary of the required functions from the design basis analyses.
   - Column "Design Success Criteria": A summary of the success criteria from the design basis analyses.
   - Column "PRA Success Criteria": The function success criteria modeled in the PRA.
   - Column "Disposition": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria.

1CAN122201 Page 2 of 43 Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09, Revision 0-A. The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to accurately model the as-built as-operated plant, and to conform to capability Category II of the PRA standard (as required by NEI 06-09, Revision 0-A). Table E1-1 provides a list of candidate TS Actions to which a RICT may be applied and how the associated SSC is addressed in the PRA. The referenced ANO-1 TS is followed by the associated standard TS numbering (referred to in the table as the improved technical specification or "ITS" number) obtained from the appropriate markup pages of TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2. In addition, the LCO and Action descriptions are not necessarily direct quotes from the TS but are summarized to reduce repetition. The following TSTF-505 specifications for which RICT is applied are not included in Table E1-1 because the TS is not applicable in Modes 1 or 2, or the ANO-1 TSs do not contain these specifications, except as noted below: 3.3.11 EFIC System Instrumentation, Required Actions A.2 and B.3 (ANO-1 TSs do not have an action for restoration with one channel inoperable or with two channels inoperable, except for the EFW Vector Valve Control channel) 3.4.5 RCS Loops - MODE 3 3.5.2 ECCS - Operating, Required Action A.1 (ANO-1 TSs do not have a separate restore time for one inoperable Low Pressure Injection pump) 3.6.5 Reactor Building Spray and Cooling Systems, Required Action D.1 (ANO-1 TSs do not have an action for coincident inoperability of a spray and cooling train during operation in Modes 1 and 2) 3.7.4 Atmospheric Vent Valves (AVVs) 3.7.7 Component Cooling Water (CCW) 3.7.9 Ultimate Heat Sink (UHS) (the associated ANO-1 TS does not have a restore time and, therefore, the RICT cannot be applied) 3.8.1 AC Sources - Operating, Required Action F.1 (ANO-1 does not have an action similar to ITS 3.8.1, Required Action F.1, associated with the Emergency Diesel Generator load sequencer) 1CAN122201 Page 3 of 43 3.8.4 DC Sources - Operating (ANO-1 TSs contain only a single action and restoration time for an inoperable DC subsystem; therefore, two of the three Conditions included in the TSTF-505 markup are unneeded) Examples of calculated RICT are provided in Table E1-2 for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). These example calculations demonstrate the scope of the SSCs covered by technical specifications modeled in the PRA. Note that the more limiting of the core damage frequency (CDF) and large early release frequency (LERF) RICT result is shown. Following implementation, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA models representing the as-built, as-operated condition of the plant, as required by NEI 06-09, Revision 0-A, and the NRC safety evaluation, and may differ from the RICTs presented. Section 2 lists the TSTF-505, Revision 2, Table 1, TSs that require additional justification along with a description of how the additional justification is provided in the LAR. Finally, Section 3 of this enclosure contains information regarding the diversity and redundancy of instrumentation and controls associated with ANO-1 TS Section 3.3 and vital electrical system capabilities associated with TS Section 3.8. 1CAN122201 Page 4 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.1, Reactor Protective System (RPS) Instrumentation Only the analog pressure and temperature sensor transmitters are Two-out-of- credited for initiating the trip signal four for the PRA accident sequences. Four channels of RPS coincidence Other sensors can also generate trip instrumentation shall be logic signals. Surrogates can be used at operable required to the RPS channel logic for Required Action B.1 Instruments Same as instrumentation not in the model for Not Reactor trip initiate a outlined in Design generating risk estimates. With two channels inoperable, explicitly initiation reactor trip Table 3.3.1-1 Criteria place one channel in trip within via input to Therefore, SSCs can be modeled at 1 hour the Reactor the RPS channels to be consistent Trip Module with the TS scope and can be (ITS 3.3.1, Required Action B.1) (RTM) directly included in the CRMP tool for channels the RICT program. A discussion of system design is included in Section 3 of this enclosure. 1CAN122201 Page 5 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.5, Engineered Safeguards Actuation System (ESAS) Instrumentation Two-out-of-three Instruments are modeled in the PRA ESAS SSC Three ESAS analog instrument coincidence and failure of any instrument renders actuations channels shall be operable logic the affected analog instrument (Reactor necessary to channel(s) inoperable. Required Action A.1 Instruments Same as Coolant produce an outlined in Yes Design SSCs are modeled consistent with One or more parameters with System (RCS) actuation Table 3.3.5-1 Criteria the TS scope and can be directly one channel inoperable, place pressure, signal input included in the CRMP tool for the channel in trip within 1 hour Reactor to the digital RICT program. A discussion of Building actuation (ITS 3.3.5, Required Action A.1) system design is included in integrity) logic Section 3 of this enclosure. channels 3.3.6, Engineered Safeguards Actuation System (ESAS) Manual Initiation Manual initiation is not explicitly High Pressure modeled. ESAS master relays, Two ESAS manual initiation Injection (HPI) LCO 3.3.6 successful operator actions, or the channels shall be operable One-out-of-Low Pressure covers only automatic actuations for the affected Required Action A.1 two manual Injection (LPI) the system Same as functions are modeled and can be Not pushbuttons One or more Functions with level manual Design used as surrogates for calculating a Reactor explicitly required for one channel inoperable, restore initiation of the Criteria conservative RICT estimate for Building (RB) each ESAS channel within 72 hours ESAS functions that require manual Cooling Function Functions operation in the PRA. A discussion (ITS 3.3.6, Required Action A.1) of system design is included in RB Spray Section 3 of this enclosure. 1CAN122201 Page 6 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.8, Diesel Generator (DG) Loss of Power Start (LOPS) Vital electrical Two Loss of Voltage (LOV) power trains The PRA models only include the relays and two Degraded (two trains 4.16 kV loss of voltage (LOV) relays Voltage (DV) relays per DG each supplied At least one and does not credit the 480 V shall be operable by offsite AC electrical degraded voltage (DV) relays. The DGs power or train modeling of a single actuation train Required Action A.1 Same as Not respective DG required to will provide a conservative RICT Vital AC Design One or more Functions with explicitly meet estimate in the PRA. The LOV electrical (reactivity, fuel Criteria one or more relays for one or accident relays can be used as a PRA model buses integrity, RCS more DGs inoperable, restore analyses surrogate for the DV relays. pressure, RCS within 1 hour assumptions Additional justification required by inventory, (ITS 3.3.8, Required Actions RCS heat TSTF-505 is included in Section 2 of A.1 and B.1) removal, this enclosure. RB integrity) 1CAN122201 Page 7 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.11, Emergency Feedwater Initiation and Control (EFIC) System Instrumentation At least one EFW train EFIC instrumentation channels and isolation for each Function in of one of the Table 3.3.11-1 shall be two main operable EFW (RCS steam heat removal) SSCs are modeled consistent with Required Action B.2 isolation the TS scope and can be directly Instruments MSLI (RCS valves Same as One or more EFW Initiation or included in the CRMP tool for the outlined in Yes pressure, (MSIVs) Design MSLI Functions with two RICT program. A discussion of Table 3.3.11-1 temperature, required to Criteria channels inoperable, place system design is included in and inventory meet second channel in trip within Section 3 of this enclosure. control) accident 1 hour analyses (ITS 3.3.11, assumptions Required Action B.2) (blowdown limited to one SG) EFIC instrumentation channels for each Function in Table 3.3.11-1 shall be EFW operable SSCs are modeled consistent with capability to the TS scope and can be directly Required Action C.1 feed intact Same as RCS heat included in the CRMP tool for the EFW valves Yes SG while Design One EFW Vector Valve Control removal RICT program. A discussion of isolating Criteria channel inoperable, restore system design is included in from faulted channel within 72 hours Section 3 of this enclosure. SG (ITS 3.3.11, Required Action C.1) 1CAN122201 Page 8 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.12, Emergency Feedwater Initiation and Control (EFIC) Manual Initiation Two manual initiation switches At least one per actuation train for each EFW train EFIC Function shall be and isolation Manual initiation is not explicitly operable of one of the modeled. EFIC/MSLI master relays, two main Required Action A.1 EFW (RCS successful operator actions, or the steam heat removal) automatic actuations for the affected One or more EFIC Function(s) isolation functions are modeled and can be with one required manual EFW MSLI (RCS valves Same as Not used as surrogates for calculating a initiation switch inoperable in pressure, (MSIVs) Design MSLI explicitly conservative RICT estimate for one actuation train, place temperature, required to Criteria functions that require manual affected trip bus in the affected and inventory meet operation in the PRA. Additional train for the associated EFIC control) accident justification required by TSTF-505 is Function(s) in trip within analyses included in Section 2 of this 72 hours assumptions enclosure. (blowdown (ITS 3.3.12, limited to Required Action A.1) one SG) 1CAN122201 Page 9 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria At least one Two manual initiation switches EFW train per actuation train for each and isolation EFIC Function shall be Manual initiation is not explicitly of one of the operable modeled. EFIC/MSLI master relays, two main EFW (RCS successful operator actions, or the Required Action B.1 steam heat removal) automatic actuations for the affected isolation One or more EFIC Function(s) functions are modeled and can be EFW MSLI (RCS valves Same as with both required manual Not used as surrogates for calculating a pressure, (MSIVs) Design initiation switch inoperable in a MSLI explicitly conservative RICT estimate for temperature, required to Criteria single actuation train, restore functions that require manual and inventory meet one manual initiation switch for operation in the PRA. Additional control) accident each of the affected EFIC justification required by TSTF-505 is analyses Function(s) within 72 hours included in Section 2 of this assumptions enclosure. (ITS 3.3.12, (blowdown Required Action A.1) limited to one SG) 1CAN122201 Page 10 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria At least one Two manual initiation switches EFW train per actuation train for each and isolation EFIC Function shall be Manual initiation is not explicitly of one of the operable modeled. EFIC/MSLI master relays, two main EFW (RCS successful operator actions, or the Required Action C.1 steam heat removal) automatic actuations for the affected isolation One or more EFIC Function(s) functions are modeled and can be EFW MSLI (RCS valves Same as with one or both required Not used as surrogates for calculating a pressure, (MSIVs) Design manual initiation switches MSLI explicitly conservative RICT estimate for temperature, required to Criteria inoperable in both actuation functions that require manual and inventory meet trains, restore one actuation operation in the PRA. Additional control) accident train for the associated EFIC justification required by TSTF-505 is analyses Function(s) within 1 hour included in Section 2 of this assumptions enclosure. (ITS 3.3.12, (blowdown Required Action B.1) limited to one SG) 1CAN122201 Page 11 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.3.13, Emergency Feedwater Initiation and Control (EFIC) Logic Train A and B of MSLI and One EFW EFW Initiation Logics shall be Logic operable Function Required Action A.1 EFW (RCS train and heat removal) one MSLI SSCs are modeled consistent with One or more train A Functions isolation the TS scope and can be directly inoperable with all train B EFW MSLI (RCS Same as Logic included in the CRMP tool for the Functions operable; or one or Yes pressure, Design MSLI Function RICT program. A discussion of more train B Functions temperature, Criteria train system design is included in inoperable with all train A and inventory required to Section 3 of this enclosure. Functions operable, restore control) meet channel within 72 hours accident (ITS 3.3.13, analyses Required Action A.1) assumptions 3.3.14, Emergency Feedwater Initiation and Control (EFIC) Vector Logic Four channels of the EFIC vector logic shall be operable EFW SSCs are modeled consistent with Required Action A.1 capability to the TS scope and so can be directly feed intact Same as One vector logic channel RCS heat included in the CRMP tool for the EFW valves Yes SG while Design inoperable, restore channel removal RICT program. A discussion of isolating Criteria within 72 hours system design is included in from faulted Section 3 of this enclosure. (ITS 3.3.14, SG Required Action A.1) 1CAN122201 Page 12 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.5.2, ECCS - Operating One LPI and one HPI Two Emergency Core Cooling train is System (ECCS) trains shall be SSCs are modeled consistent with required to operable the TS scope and can be directly satisfy the HPI Same as included in the CRMP tool for the Required Action A.1 RCS inventory accident Yes Design RICT program. Additional LPI control analyses One or more trains inoperable, Criteria justification required by TSTF-505 is (HPI also restore within 72 hours included in Section 2 of this required for enclosure. (ITS 3.5.2, Required Action B.1) hot leg injection capability) 3.6.2, Reactor Building Air Locks Two RB air locks shall be operable SSCs are not modeled in the PRA. A pre-existing containment failure for Required Action C.3 At least one large leaks can be modeled as a door in each Same as One or more reactor building air Not conservative surrogate in the PRA RB RB integrity air lock Design locks inoperable for reasons explicitly LERF assessment. Additional closed and Criteria other than Condition A or B, justification required by TSTF-505 is sealed restore within 24 hours included in Section 2 of this enclosure. (ITS 3.6.2, Required Action C.3) 1CAN122201 Page 13 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.6.3, Reactor Building Isolation Valves The RB isolation function is a PRA modeled function. SSCs for penetrations that exceed the PRA success criteria for LERF At least one (2 inches or larger) are modeled valve in consistent with the TS scope and each can be directly included in the CRMP Each RB isolation valve shall At least one tool for the RICT program. penetration be operable valve in is assumed Any RB isolation valve that is each Required Action A.1 to be closed screened due to size (< 2 inches) penetration upon receipt from the PRA model, has no One or more penetration flow is assumed RB Yes RB integrity of contribution to CDF or LERF and paths with one reactor building to be closed associated delta risk calculation is limited to the isolation valve inoperable, upon receipt ESAS signal seismic and high winds penalty isolate flow path within 48 hours of for factors. associated (ITS 3.6.3, Required Action A.1) penetrations ESAS signal For conditions where multiple with a diameter of screened penetrations are open

                                                                                          > 2 inches   (exceeding the 2 inches or larger criteria), a representative surrogate will be selected, such as the use of a modeled containment pathway that represents the bypass of containment.

1CAN122201 Page 14 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria The RB isolation function is a PRA modeled function. However, penetrations that are not directly connected to the RCS or RB atmosphere are typically screened due to low likelihood of a pipe rupture concurrent with a plant accident/transient. SSCs for penetrations that are 2 inches Isolation or larger that are modeled consistent with the TS scope and can be directly failures for included in the CRMP tool for the RICT each program. Each RB isolation valve shall At least one penetration be operable valve in SSCs for penetrations that are 2 inches where the each or larger that have been screened from Required Action C.1 associated penetration the PRA can be evaluated using a piping is One or more penetration flow Not is assumed modeled penetration as a surrogate for RB RB integrity connected penetrations screened due to the low paths with one reactor building explicitly to be closed directly to frequency of a pipe rupture. isolation valve inoperable, upon receipt the RB restore within 72 hours of Any RB isolation valve that is screened atmosphere associated due to size (< 2 inches) from the PRA (ITS 3.6.3, Required Action C.1) or the RCS ESAS signal model, has no contribution to CDF or and has a LERF. Therefore, the PRA delta risk diameter of calculation contribution will be limited to

                                                                                     > 2 inches   the seismic and high winds penalty factors.

For conditions where multiple screened penetrations are open (exceeding the 2 inches or larger criteria), a representative surrogate will be selected, such as the use of a modeled containment pathway that represents the bypass of containment. 1CAN122201 Page 15 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.6.5, Reactor Building Spray and Cooling Systems One RB Two RB spray trains and two At least one cooling RB spray is not modeled in the PRA. RB cooling trains shall be RB spray train RB coolers can be modeled as a operable and one RB required to surrogate for the RB sprays. See cooling train meet the Required Action A.1 Not additional justification required by RB Spray RB integrity required to PRA explicitly TSTF-505, included in Section 2 of One RB spray train inoperable, meet success this enclosure, for details on the PRA restore within 72 hours accident criteria. and the modeling of the associated analyses RB spray is (ITS 3.6.6, Required Action A.1) functions. assumptions not modeled. One RB Two RB spray trains and two At least one cooling RB cooling trains shall be RB spray train SSCs are modeled consistent with operable and one RB required to the TS scope and can be directly cooling train meet the included in the CRMP tool for the Required Action B.1 RB Coolers Yes RB integrity required to PRA RICT program. Additional One RB cooling train inoperable, meet success justification required by TSTF-505 is restore within 7 days accident criteria. included in Section 2 of this analyses RB spray is enclosure. (ITS 3.6.6, Required Action C.1) assumptions not modeled. 1CAN122201 Page 16 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria One RB Two RB spray trains and two At least one cooling RB cooling trains shall be RB spray train SSCs are modeled consistent with operable and one RB required to the TS scope and can be directly Required Action C.1 cooling train meet the included in the CRMP tool for the RB Coolers Yes RB integrity required to PRA RICT program. Additional Two RB cooling trains meet success justification required by TSTF-505 is inoperable, restore one train accident criteria. included in Section 2 of this within 72 hours analyses RB spray is enclosure. (ITS 3.6.6, Required Action E.1) assumptions not modeled. 3.7.2, Main Steam Isolation Valves (MSIVs) Two MSIVs shall be operable At least one SSCs are modeled consistent with MSIV is Required Action A.1 the TS scope and can be directly RCS pressure, assumed to Same as included in the CRMP tool for the One or more MSIVs inoperable temperature, isolate its MSIVs, SGs Yes Design RICT program. Additional in Modes 1 and 2, restore within and inventory respective Criteria justification required by TSTF-505 is 24 hours control SG, allowing included in Section 2 of this blowdown of (ITS 3.7.2, Required Action A.1) enclosure. only one SG 1CAN122201 Page 17 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.7.5, Emergency Feedwater (EFW) System One EFW train is required to Two EFW trains shall be meet operable accident Required Action A.1 analyses SSCs are modeled consistent with assumptions Same as Turbine driven EFW train RCS heat the TS scope and can be directly EFW Yes (turbine Design inoperable due to one removal included in the CRMP tool for the driven pump Criteria inoperable steam supply, RICT program. requires restore within 7 days only one of (ITS 3.7.5, Required Action A.1) the two steam supplies to function) Two EFW trains shall be operable One EFW train is Required Action B.1 SSCs are modeled consistent with required to Same as RCS heat the TS scope and can be directly One EFW train inoperable for EFW Yes meet Design removal included in the CRMP tool for the reasons other than Condition A, accident Criteria RICT program. restore within 72 hours analyses assumptions (ITS 3.7.5, Required Action B.1) 1CAN122201 Page 18 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria Two EFW trains shall be operable Required Actions C.1 and C.2 Turbine driven EFW train One EFW inoperable due to one train is SSCs are modeled consistent with inoperable steam supply AND required to Same as RCS heat the TS scope and can be directly motor driven EFW train EFW Yes meet Design removal included in the CRMP tool for the inoperable, restore either the accident Criteria RICT program. inoperable steam supply or the analyses motor driven EFW train within assumptions 24 hours (ITS 3.7.5 does not contain this combined condition) 3.7.7, Service Water System (SWS) HPI, LPI, and RB Spray pump and room cooling Two SWS loops shall be At least one operable RB cooling SWS loop is units SSCs are modeled consistent with Required Action A.1 required to Same as the TS scope and can be directly SWS Yes EFW pumps, meet Design One SWS loop inoperable included in the CRMP tool for the supply, and accident Criteria restore within 72 hours RICT program. room cooling analyses (ITS 3.7.8, Required Action A.1) assumptions Vital electrical bus room and DG engine cooling 1CAN122201 Page 19 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.8.1, AC Sources - Operating At least one AC electrical Two offsite circuits and two DGs train, shall be operable powered by SSCs are modeled consistent with AC electrical an offsite the TS scope and can be directly Required Action A.3 Vital AC power to Same as circuit or an included in the CRMP tool for the electrical Yes associated Design One offsite circuit inoperable, DG, is RICT program. A discussion of power sources TS-required Criteria restore within 72 hours required to system design is included in SSCs meet Section 3 of this enclosure. (ITS 3.8.1, Required Action A.3) accident analyses assumptions At least one AC electrical Two offsite circuits and two DGs train, shall be operable powered by SSCs are modeled consistent with AC electrical an offsite the TS scope and can be directly Required Action B.4 Vital AC power to Same as circuit or an included in the CRMP tool for the electrical Yes associated Design One DG inoperable, restore DG, is RICT program. A discussion of power sources TS-required Criteria within 7 days required to system design is included in SSCs meet Section 3 of this enclosure. (ITS 3.8.1, Required Action B.4) accident analyses assumptions 1CAN122201 Page 20 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria At least one AC electrical Two offsite circuits and two DGs train, shall be operable powered by SSCs are modeled consistent with AC electrical Required Action C.2 an offsite the TS scope and can be directly Vital AC power to Same as circuit or an included in the CRMP tool for the Two offsite circuits inoperable, electrical Yes associated Design DG, is RICT program. A discussion of restore one offsite circuit within power sources TS-required Criteria required to system design is included in 24 hours SSCs meet Section 3 of this enclosure. (ITS 3.8.1, Required Action C.2) accident analyses assumptions At least one Two offsite circuits and two DGs AC electrical shall be operable train, powered by SSCs are modeled consistent with Required Actions D.1 and D.2 AC electrical an offsite the TS scope and can be directly Vital AC power to Same as One offsite circuit AND one DG circuit or an included in the CRMP tool for the electrical Yes associated Design inoperable, restore at least one DG, is RICT program. A discussion of power sources TS-required Criteria source within 12 hours required to system design is included in SSCs meet Section 3 of this enclosure. (ITS 3.8.1, Required Actions accident D.1 and D.2) analyses assumptions 1CAN122201 Page 21 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.8.4, DC Sources - Operating Both DC electrical power subsystems shall be operable At least one DC electrical SSCs are modeled consistent with Required Action A.1 Vital DC DC electrical power the TS scope and can be directly electrical power to Same as One DC electrical power subsystem included in the CRMP tool for the power sources Yes associated Design subsystem inoperable, restore is required RICT program. A discussion of (chargers and TS-required Criteria within 8 hours to meet system design is included in batteries) SSCs accident Section 3 of this enclosure. (ITS 3.8.4, Required Actions analyses A.3, B.1, and C.1) 3.8.7, Inverters - Operating Inverter loss results in Inverters alternate AC Two red train and two green provide power train inverters shall be operable uninterruptible provided to SSCs are modeled consistent with Required Action A.1 power to 120 VAC the TS scope and can be directly safety buses; Same as One of the four inverters included in the CRMP tool for the Vital inverters Yes significant coincident Design required by LCO 3.8.7.a and RICT program. A discussion of instruments loss of AC Criteria LCO 3.8.7.b inoperable, restore system design is included in and controls, power inverter within 24 hours Section 3 of this enclosure. including RPS, results in (ITS 3.8.7, Required Action A.1) ESAS, and loss of EFIC system associated 120 VAC bus 1CAN122201 Page 22 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria 3.8.9, Distribution Systems - Operating At least one AC, DC, and Two AC, DC, and 120 VAC 120 VAC electrical power distribution distribution subsystems shall be operable subsystem SSCs are modeled consistent with Associated AC electrical Required Action A.1 is required the TS scope and can be directly vital buses, power to Same as to meet included in the CRMP tool for the One or more AC electrical load centers, Yes associated Design accident RICT program. A discussion of power distribution subsystem(s) and motor TS-required Criteria analyses system design is included in inoperable, restore subsystem control centers SSCs assumptions Section 3 of this enclosure. within 8 hours (reference (ITS 3.8.9, Required Action A.1) TS Bases Table B 3.8.9-1) At least one Two AC, DC, and 120 VAC AC, DC, and electrical power distribution 120 VAC subsystems shall be operable distribution 120 VAC subsystem SSCs are modeled consistent with Required Action B.1 electrical Supply is required the TS scope and can be directly power required AC Same as One or more 120 VAC electrical to meet included in the CRMP tool for the distribution Yes instrument Design power distribution subsystem(s) accident RICT program. A discussion of subsystems power to Criteria (RS1, RS2, RS3, RS4) analyses system design is included in RS1, RS2, required loads inoperable, restore subsystem assumptions Section 3 of this enclosure. RS3, RS4 within 8 hours (reference TS Bases (ITS 3.8.9, Required Action B.1) Table B 3.8.9-1) 1CAN122201 Page 23 of 43 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSC in Functions Design PRA TS and Condition Description Covered by PRA Covered by Success Success Disposition TS Condition Model TS Condition Criteria Criteria At least one AC, DC, and Two AC, DC, and 120 VAC 120 VAC electrical power distribution distribution subsystems shall be operable Vital DC subsystem SSCs are modeled consistent with DC electrical Required Action C.1 panels D01, is required the TS scope and can be directly power to Same as D02, RA1, to meet included in the CRMP tool for the One or more DC electrical Yes associated Design RA2, D11, accident RICT program. A discussion of power distribution subsystem(s) TS-required Criteria D15, D21, analyses system design is included in inoperable, restore subsystem SSCs D25 assumptions Section 3 of this enclosure. within 8 hours (reference (ITS 3.8.9, Required Action C.1) TS Bases Table B 3.8.9-1) 1CAN122201 Page 24 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS LCO Condition Required Action Estimate1,2 Required Action B.1 3.3.1, Reactor Four channels of RPS Protective System With two channels inoperable, place instrumentation shall be 30 Days (RPS) one channel in trip within 1 hour operable Instrumentation (ITS 3.3.1, Required Action B.1) Required Action A.1 3.3.5, Engineered Safeguards Three ESAS analog One or more parameters with one Actuation System instrument channels shall channel inoperable, place channel in 30 Days (ESAS) be operable trip within 1 hour Instrumentation (ITS 3.3.5, Required Action A.1) Required Action A.1 3.3.6, Engineered Safeguards One or more Functions with one Two ESAS manual initiation Actuation System channel inoperable, restore channel 30 Days channels shall be operable (ESAS) Manual within 72 hours Initiation (ITS 3.3.6, Required Action A.1) Required Action A.1 3.3.8, Diesel Two Loss of Voltage (LOV) One or more Functions with one or Generator (DG) relays and two Degraded more relays for one or more DGs 30 Days Loss of Power Start Voltage (DV) relays per DG inoperable, restore within 1 hour (LOPS) shall be operable (ITS 3.3.8, Required Actions A.1 and B.1) Required Action B.2 3.3.11, Emergency EFIC instrumentation One or more EFW Initiation or MSLI Feedwater Initiation channels for each Function Functions with two channels and Control (EFIC) 30 Days in Table 3.3.11-1 shall be inoperable, place second channel in System operable trip within 1 hour Instrumentation (ITS 3.3.11, Required Action B.2) Required Action C.1 3.3.11, Emergency EFIC instrumentation Feedwater Initiation One EFW Vector Valve Control channels for each Function and Control (EFIC) channel inoperable, restore channel 30 Days in Table 3.3.11-1 shall be System within 72 hours operable Instrumentation (ITS 3.3.11, Required Action C.1) 1CAN122201 Page 25 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS LCO Condition Required Action Estimate1,2 Required Action A.1 One or more EFIC Function(s) with 3.3.12, Emergency Two manual initiation one required manual initiation switch Feedwater Initiation switches per actuation train inoperable in one actuation train, 30 Days and Control (EFIC) for each EFIC Function place affected trip bus in the affected Manual Initiation shall be operable train for the associated EFIC Function(s) in trip within 72 hours (ITS 3.3.12, Required Action A.1) Required Action B.1 One or more EFIC Function(s) with 3.3.12, Emergency Two manual initiation both required manual initiation switch Feedwater Initiation switches per actuation train inoperable in a single actuation train, 30 Days and Control (EFIC) for each EFIC Function restore one manual initiation switch Manual Initiation shall be operable for each of the affected EFIC Function(s) within 72 hours (ITS 3.3.12, Required Action A.1) Required Action C.1 One or more EFIC Function(s) with 3.3.12, Emergency Two manual initiation one or both required manual Feedwater Initiation switches per actuation train initiation switches inoperable in both 30 Days and Control (EFIC) for each EFIC Function actuation trains, restore one Manual Initiation shall be operable actuation train for the associated EFIC Function(s) within 1 hour (ITS 3.3.12, Required Action B.1) Required Action A.1 One or more train A Functions 3.3.13, Emergency inoperable with all train B Functions Train A and B of MSLI and Feedwater Initiation operable; or one or more train B EFW Initiation Logics shall 30 Days and Control (EFIC) Functions inoperable with all train A be operable Logic Functions operable, restore channel within 72 hours (ITS 3.3.13, Required Action A.1) Required Action A.1 3.3.14, Emergency Four channels of the EFIC Feedwater Initiation One vector logic channel inoperable, vector logic shall be 30 Days and Control (EFIC) restore channel within 72 hours operable Vector Logic (ITS 3.3.14, Required Action A.1) 1CAN122201 Page 26 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS LCO Condition Required Action Estimate1,2 Required Action A.1 Two Emergency Core 3.5.2, ECCS - One or more trains inoperable, Cooling System (ECCS) 30 Days Operating restore within 72 hours trains shall be operable (ITS 3.5.2, Required Action B.1) Required Action C.3 One or more reactor building air 3.6.2, Reactor Two RB air locks shall be locks inoperable for reasons other 7.1 Days Building Air Locks operable than Condition A or B, restore within 24 hours (ITS 3.6.2, Required Action C.3) Required Action A.1 One or more penetration flow paths 3.6.3, Reactor Each RB isolation valve with one reactor building isolation Building Isolation 8.2 Days shall be operable valve inoperable, isolate flow path Valves within 48 hours (ITS 3.6.3, Required Action A.1) Required Action C.1 One or more penetration flow paths 3.6.3, Reactor Each RB isolation valve with one reactor building isolation Building Isolation 8.2 Days shall be operable valve inoperable, isolate flow path Valves within 72 hours (ITS 3.6.3, Required Action C.1) Required Action A.1 3.6.5, Reactor Two RB spray trains and One RB spray train inoperable, Building Spray and two RB cooling trains shall 30 Days restore within 72 hours Cooling Systems be operable (ITS 3.6.6, Required Action A.1) Required Action B.1 3.6.5, Reactor Two RB spray trains and One RB cooling train inoperable, Building Spray and two RB cooling trains shall 30 Days restore within 7 days Cooling Systems be operable (ITS 3.6.6, Required Action C.1) Required Action C.1 3.6.5, Reactor Two RB spray trains and Two RB cooling trains inoperable, Building Spray and two RB cooling trains shall 30 Days restore one train within 72 hours Cooling Systems be operable (ITS 3.6.6, Required Action E.1) 1CAN122201 Page 27 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS LCO Condition Required Action Estimate1,2 Required Action A.1 3.7.2, Main Steam One or more MSIVs inoperable in Two MSIVs shall be Isolation Valves Modes 1 and 2, restore within 30 Days operable (MSIVs) 24 hours (ITS 3.7.2, Required Action A.1) Required Action A.1 3.7.5, Emergency Turbine driven EFW train inoperable Two EFW trains shall be Feedwater (EFW) due to one inoperable steam supply, 30 Days operable System restore within 7 days (ITS 3.7.5, Required Action A.1) Required Action B.1 3.7.5, Emergency One EFW train inoperable for Two EFW trains shall be Feedwater (EFW) reasons other than Condition A, 30 Days operable System restore within 72 hours (ITS 3.7.5, Required Action B.1) Required Actions C.1 and C.2 Turbine driven EFW train inoperable due to one inoperable steam supply 3.7.5, Emergency Two EFW trains shall be AND motor driven EFW train Feedwater (EFW) 28.3 Days operable inoperable, restore either the System inoperable steam supply or the motor driven EFW train within 24 hours (ITS does not contain this Action) Required Action A.1 3.7.7, Service Two SWS loops shall be One SWS loop inoperable restore Water System 15.7 Days operable within 72 hours (SWS) (ITS 3.7.8, Required Action A.1) Required Action A.3 3.8.1, AC Sources Two offsite circuits and two One offsite circuit inoperable, restore 30 Days

    - Operating      DGs shall be operable        within 72 hours (ITS 3.8.1, Required Action A.3)

Required Action B.4 3.8.1, AC Sources Two offsite circuits and two One DG inoperable, restore within 30 Days

    - Operating      DGs shall be operable        7 days (ITS 3.8.1, Required Action B.4) 1CAN122201 Page 28 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS                  LCO Condition                     Required Action Estimate1,2 Required Action C.2 3.8.1, AC Sources     Two offsite circuits and two  Two offsite circuits inoperable, 30 Days
    - Operating       DGs shall be operable         restore within 24 hours (ITS 3.8.1, Required Action C.2)

Required Actions D.1 and D.2 One offsite circuit AND one DG 3.8.1, AC Sources Two offsite circuits and two inoperable, restore at least one 14.1 Days

    - Operating       DGs shall be operable         source within 12 hours (ITS 3.8.1, Required Actions D.1 and D.2)

Required Action A.1 Both DC electrical power One DC electrical power subsystem 3.8.4, DC Sources subsystems shall be inoperable, restore within 8 hours 4.1 Days

    - Operating operable (ITS 3.8.4, Required Actions A.3, B.1, and C.1)

Required Action A.1 One of the four inverters required by Two red train and two 3.8.7, Inverters - LCO 3.8.7.a and LCO 3.8.7.b green train inverters shall 30 Days Operating inoperable, restore inverter within 24 be operable hours (ITS 3.8.7, Required Action A.1) Required Action A.1 Two AC, DC, and 120 VAC 3.8.9, Distribution One or more AC electrical power electrical power distribution Systems - distribution subsystem(s) inoperable, 4.5 Days subsystems shall be Operating restore subsystem within 8 hours operable (ITS 3.8.9, Required Action A.1) Required Action B.1 Two AC, DC, and 120 VAC One or more 120 VAC electrical 3.8.9, Distribution electrical power distribution power distribution subsystem(s) Systems - 3.3 Days3 subsystems shall be (RS1, RS2, RS3, RS4) inoperable, Operating operable restore subsystem within 8 hours (ITS 3.8.9, Required Action B.1) 1CAN122201 Page 29 of 43 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS LCO Condition Required Action Estimate1,2 Required Action C.1 Two AC, DC, and 120 VAC 3.8.9, Distribution One or more DC electrical power electrical power distribution Systems - distribution subsystem(s) inoperable, 3.2 Days3 subsystems shall be Operating restore subsystem within 8 hours operable (ITS 3.8.9, Required Action C.1) Notes to Table E1-2: (1) Estimated RICTs are listed. Following program implementation, the actual RICT values will be calculated on a plant-specific basis, using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A, and the NRC safety evaluation, and may differ from the RICTs presented. RICT evaluations utilize the internal events, internal flood, and internal fire PRA model calculations with seismic and high winds CDF and LERF penalties applied. (2) RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. (3) Per NEI 06-09-A, (Reference 0), for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered. Table E1-2 above lists the calculated RICTs for each TS condition using the method outlined in NEI 06-09-A (Reference 2) shown below. The same equation was used to calculate the LERF RICT by simply using the RICT incremental conditional large early release frequency (ICLERP) limit and LERF instead.

                             =                          x 365(      )

1 The RICT incremental conditional core damage probability (ICCDP) limit is 1.00E-05, while the RICT incremental conditional large early release probability ICLERP limit is 1.00E-06. The RICTs are limited to a maximum of thirty (30) days and to a minimum of the original TS completion time. Table E1-2 provides example RICT calculations for the purposes of this enclosure. Following implementation, the RICT will be calculated using the actual plant configuration and may deviate from the example values. 1CAN122201 Page 30 of 43

2. Additional Justification for Specific Actions This section contains the additional technical justification for the list of Required Actions from Table 1, "Conditions Requiring Additional Technical Justification," of TSTF-505, Revision 2.

Entergy's additional justification for each of the identified ANO-1 TS is provided below: 2.1 TS 3.3.8 - Diesel Generator (DG) Loss of Power Start (LOPS) LCO: Two Loss of Voltage (LOV) relays and two Degraded Voltage (DV) relays per DG shall be OPERABLE. Condition A: One or more functions with one or more relays for one or more DGs inoperable. JUSTIFICATION ANO-1 TS 3.3.8, "Diesel Generator (DG) Loss of Power Start (LOPS)," Required Action A.1, states that with one or more Functions with one or more relays for one or more DGs inoperable, restore the relay to operable status within 1 hour. Each of the two ANO-1 vital AC trains can be powered from one of two qualified offsite power sources, an associated DG, or the station Alternate AC Diesel Generator (AACDG). The two DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow operation of safety related loads. Undervoltage protection will generate a LOPS in the event a loss of voltage (LOV) or degraded voltage (DV) condition occurs on unit vital buses. There are two LOPS Functions for each 4.16 kV vital bus. Two definite time LOV relays are provided on each 4.16 kV Class 1E bus for the purpose of detecting a loss of bus voltage. Upon loss of power to either of these relays, in approximately 2.6 seconds, load shedding and starting of the associated DG are initiated. Isolation of the safety related buses is delayed approximately 2.5 seconds to allow an automatic transfer to offsite power. Two definite time undervoltage relays are provided on each safety related 480 V load center bus with a coincident trip logic (2 out of 2) for the purpose of detecting a sustained undervoltage condition. Upon voltage degradation to 92% of 460 V and after a delay of 8 seconds, both relays must operate to isolate the associated safety related 4.16 kV bus from offsite power, and start and connect the associated DG. The relays are delayed 8.0 seconds to prevent spurious operation of the relays when large motors start on the safety related 4.16 kV and 480 V buses. If only one DG's relays are affected, then single failure protection for the required function may be lost; however, the function itself has not been lost since the other DG's relays are unaffected. Because ANO-1 TS 3.3.8, Condition A, governs any number of failed relays on both trains, a loss of function could result if both LOV relays on both trains were failed AND at least one DV relay on each train is failed. In this configuration, automatic separation from offsite power and DG start would not occur with either a degraded voltage or loss of voltage condition. Therefore, Entergy proposes a Note be inserted prior to the RICT statement preventing application of a RICT if a loss of function exists: 1CAN122201 Page 31 of 43

        --------------NOTE--------------

Not applicable when a loss of safety function exists. The associated TS 3.3.8 Bases is also modified to include discussion of voltage relay configurations that result in a loss of safety function. The proposed configuration is acceptable, with consideration of the proposed Completion Time Note, because the RICT will consider the risk of a potential loss of additional relays before being applied. 2.2 TS 3.3.12 - Emergency Feedwater Initiation and Control (EFIC) Manual Initiation LCO: Two manual initiation switches per actuation train for each of the following EFIC Functions shall be OPERABLE:

a. Steam generator (SG) A Main Steam Line Isolation;
b. SG B Main Steam Line Isolation; and
c. Emergency Feedwater (EFW) Initiation.

Condition B: One or more EFIC Function(s) with both required manual initiation switches inoperable in a single actuation train. JUSTIFICATION ANO-1 TS 3.3.12, Required Action C.1, states that with one or more EFIC Function(s) with one or both required manual initiation switches inoperable in both actuation trains, restore one actuation train for the associated EFIC Function(s) within 1 hour. The operation of the various instrumentation, logics, and manual initiation functions is discussed in Section 3 of this enclosure. The EFIC manual initiation capability provides the operator with the capability to actuate EFIC functions from the control room in the absence of any other initiation condition. Manually actuated functions include main steam line isolation (MSLI) for SG A, MSLI for SG B, and EFW actuation. These functions are provided in the event the operator determines that an EFIC function is needed prior to automatic actuation or in the event that EFIC does not automatically actuate when required. These are backup functions to those performed automatically by EFIC. The manual actuation logic within each train consists of two manual switches (one for Trip Bus 1 and one for Trip Bus 2). When one manual trip switch is depressed, a half trip occurs. When both manual trip switches are depressed, a full actuation of the train occurs for that particular Function. With one or more EFIC functions with one required manual initiation switch inoperable in one actuation train, assuming no single failures are present on the redundant train, the redundant train may still be actuated via the operable manual initiation switches. Likewise, with one or more EFIC functions with both required manual initiation switches inoperable in one actuation train, the redundant train may still be actuated via the operable manual initiation switches. 1CAN122201 Page 32 of 43 Because both trip buses must be actuated for a function in order for that function to result in train actuation, a loss of the manual initiation capability would result if the manual initiation switches on both trains were inoperable. However, this does not prevent the automatic actuation features of EFIC. Because automatic features remain available, the EFW and MSLI safety functions will continue to be met. The accident analyses assume EFIC will actuate automatically and that associated systems will respond within an assumed time period. Manual actuation is an operator aid and is not relied upon in the accident analyses. Therefore, the proposed configuration is acceptable because the RICT will consider the risk of a potential loss of automatic features before being applied. 2.3 TS 3.5.2 - ECCS - Operating LCO: Two ECCS trains shall be OPERABLE. Condition A: One or more trains inoperable. JUSTIFICATION ANO-1 TS Section 3.5 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1968, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 2), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." The LCOs also support meeting the requirements of GDC-35, "Emergency Core Cooling." ANO-1 TS 3.5.2, "ECCS - Operating," Required Action A.1, states that with one or more trains inoperable, restore train(s) to operable status within 72 hours. The HPI, LPI, and Core Flooding Systems are collectively designated as an ECCS. The function of the ECCS is to provide core cooling to ensure that the reactor core is protected following an accident. Two redundant, 100% capacity trains are provided. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two diverse components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in unit operations under circumstances when diverse components in opposite trains are inoperable, i.e., an HPI subsystem in one train and an LPI subsystem in the opposite train. Application of the RICT to TS 3.5.2, Required Action A.1, is acceptable because Required Action C.1 prevents continued operation when 100% of the flow equivalent to a single operable ECCS train is not available. In such cases, LCO 3.0.3 must be entered immediately, ensuring the unit is placed in a safe condition when a loss of safety function exists. 1CAN122201 Page 33 of 43 2.4 TS 3.6.2 - Reactor Building Air Locks LCO: Two reactor building air locks shall be OPERABLE. Condition C: One or more reactor building air locks inoperable for reasons other than Condition A or B. JUSTIFICATION ANO-1 TS Section 3.6 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1968, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 2), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." These LCOs also support meeting the requirements of GDC-16, "Containment Design," GDC 38, "Containment Heat Removal," and GDC 50, "Containment Design Basis." ANO-1 TS 3.6.2, "Reactor Building Air Locks," Required Action C.3, states that with one or more RB air locks inoperable for reasons other than Condition A (one air lock door inoperable in one or more air locks) or Condition B (inoperable air lock interlock mechanism), restore the air lock to operable status within 24 hours. RB air locks, also known as the personnel air lock and the emergency (or escape) air lock, form part of the RB pressure boundary and provide a means for personnel access during all modes of operation. Each air lock door has been designed and is tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a design basis accident (DBA) in the RB. As such, closure of a single door supports the RB operability. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To ensure a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in the RB internal pressure results in increased sealing force on each door). Application of the RICT to TS 3.6.2, Required Action C.3, is acceptable because when both doors in one or more air locks are inoperable, RB leakage must be assessed in accordance with Required Action C.1. If leakage limits are exceeded, LCO 3.6.1, "Reactor Building," requires restoration within 1 hour or a unit shutdown must be performed in accordance with LCO 3.6.1, Required Actions B.1 and B.2, ensuring the unit is placed is a safe condition. 2.5 TS 3.6.5 - Reactor Building Spray Cooling Systems LCO: Two reactor building spray trains and two reactor building cooling trains shall be OPERABLE. Condition A: One reactor building spray train inoperable in MODE 1 or 2. Condition B: One reactor building cooling train inoperable in MODE 1 or 2. Condition C: Two reactor building cooling trains inoperable in MODE 1 or 2. 1CAN122201 Page 34 of 43 JUSTIFICATION ANO-1 TS 3.6.5, "Reactor Building Spray and Cooling Systems," Required Actions A.1, B.1, and C.1, govern conditions where one RB spray train is inoperable, one RB cooling train is inoperable, or two RB cooling trains are inoperable, respectively. A Completion Time of 72 hours is provided for restoration of components in accordance with Required Actions A.1 and C.1, and a Completion Time of 7 days is provided for restoration of components in accordance with Required Action B.1. The RB spray and RB cooling systems provide RB atmosphere cooling to limit post-accident pressure and temperature in the RB to less than the design values. In the event of a DBA, reduction of RB pressure reduces the release of fission products from the RB to the environment. The RB spray and RB cooling systems provide redundant methods to limit and maintain post-accident conditions to less than the RB design values. During a DBA, the combination of one RB cooling train and one RB spray train is sufficient to reduce the RB pressure and temperature. TSTF-505 requires licensees to justify the ability to calculate a RICT for the aforementioned conditions, including how the system is modeled in the PRA, whether all functions of the system are modeled, and, if a surrogate is used, why the modeling is conservative. The RB sprays are not included in the PRA success criteria. Thermal hydraulic analysis concluded that that RB Cooling System is sufficient for reducing post-accident building pressure following a loss of coolant accident (LOCA). Therefore, the PRA conservatively models only the RB Cooling Systems function for maintaining RB integrity and reducing the driving force of leakage of radioactive materials from the RB in the PRA. However, the functions between the RB Cooling System and RB Spray System are not completely equivalent. The RB Cooling System does not support the design function of the RB Spray System which scrubs radioactive iodine from the RB atmosphere and reduces the concentration of fission products in the RB leakage. The PRA accident analysis considers the concentration of radioactive material for determining which accident sequences represent a large early release and are subsequently included in the LERF model. Thermal hydraulic calculations were performed and determined that crediting the RB sprays had minimal impact on the LERF accident analysis and timing sequences associated with the concentration of radioactive material at the time of the accident and crediting the RB sprays has minimal impact on the baseline risk and LERF analysis. In summary, since all the RB spray functions can be accounted for in the PRA, the RB coolers provide a justifiable surrogate for the RB Spray System for reducing post-accident RB pressure and the not modeled RB spray scrubbing function would have no impact on the risk assessment for the RICT program had it been included in the PRA accident analysis. 2.6 TS 3.7.2 - Main Steam Isolation Valves (MSIVs) LCO: Two MSIVs shall be OPERABLE. Condition A: One or more MSIV(s) inoperable in MODE 1 or 2. ANO-1 TS 3.7.2, "Main Steam Isolation Valves (MSIVs)," Required Action A.1, states that with one or more MSIVs inoperable, restore the MSIV(s) to operable status within 24 hours. 1CAN122201 Page 35 of 43 TSTF-505 applies a RICT when only one MSIV is inoperable (reference TSTF-505 markup of STS 3.7.2, Required Action A.1). Because ANO-1 TS 3.7.2, Required Action A.1, would permit both MSIVs to be inoperable, a Note is added above new proposed Required Action A.2 (RICT statement), limiting application of a RICT to conditions where only one MSIV is inoperable"

       --------------NOTE--------------

Only applicable when one MSIV remains OPERABLE. Addition of this Note is appropriate to ensure a RICT is not applied when a loss of safety function exists (i.e., both MSIVs inoperable). The MSIVs isolate steam flow from the secondary side of the SGs following a main steam line break (MSLB). MSIV closure terminates flow from the unaffected (intact) SG. One MSIV is located in each main steam line outside of, but close to, the RB. The MSIVs are downstream from the main steam safety valves (MSSVs) and turbine-driven EFW pump's steam supply to prevent these being isolated from the SGs by MSIV closure. Closing the MSIVs isolates each SG from the other, and isolates the turbine, Turbine Bypass System, and other auxiliary steam supplies from the SGs. Application of a RICT for one inoperable MSIV is acceptable because the failure of a single MISV to close will not result in a loss of safety function. The accident analysis assumes blowdown is limited to one SG following a MSLB. The following examples assume the MSIV on SG A fails to close following a MSLB.

1. With a MSLB on SG A (or it's respective main steam line), the SG B MSIV will close, preventing the blowdown of SG B. SG A will blowdown as assumed in the accident analysis.
2. With a MSLB downstream of the SG B MSIV, closure of the SG B MSIV will prevent blowdown of SG B. SG A may blowdown depending on whether any cross-tie between main steam lines exists downstream of the SG A MSIV; however, SG B remains intact.
3. With a MSLB upstream of the SG B MSIV, blowdown will be limited to SG B following closure of the SG B MSIV. RCS heat removal will be controlled thereafter via the SG A main steam line atmospheric dump valves, which are located upstream of the MSIVs.
4. With an unisolable break in either turbine-driven EFW pump steam supply, procedures require manual action to isolate one or both steam supplies such that any subsequent blowdown is limited to one SG. Crediting operator action is acceptable because this steam release is significant less in magnitude than that of a break of the main steam line itself, affording sufficient time for the operator action to be completed. Operator cues to perform this action include a continued decrease in SG B pressure following SG B MSIV closure.

Based on the above, a loss of safety function (i.e., blowdown of both SGs) is not assumed provided at least one MSIV performs its specified safety function to close following a MSLB. 1CAN122201 Page 36 of 43 In addition, STS 3.7.2, Required Action A.1, is limited to one inoperable MSIV in "MODE 1". ANO-1 TS 3.7.2, Required Action A.1, is applicable during operation in Modes 1 or 2. Entergy proposes to apply a RICT to ANO-1 TS 3.7.2, Required Action A.1, notwithstanding the difference in applicable Modes. In Modes 2 and 3, STS 3.7.2, Required Action C.1, requires an inoperable MSIV to be closed within [8] hours. Once closed, the STS permits continued operation in Modes 2 and 3 with no requirement to restore the MSIV to an operable status. ANO-1 TS 3.7.2, Required Action A.1, requires an inoperable MSIV to be restored to operable status within 24 hours with no option to close the MSIV. Failure to complete this action requires the unit to be placed in Mode 3 within 12 hours (Required Action B.1). Applying a RICT to the ANO-1 Action when operating in Mode 2 will not result in increased risk above that which is realized from an inoperable MSIV during Mode 1 operation. Therefore, application of a RICT to TS 3.7.2, Required Action A.1, is acceptable.

3. Additional Information Regarding Design of Protective Instrumentation and Vital Electrical Systems The following provides a summary description of relevant protective instrumentation and vital electrical system designs not previously discussed in Section 2 of this enclosure.

3.1 Protective Instrumentation ANO-1 TS Section 3.3 Limiting Conditions for Operation (LCOs) were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 5), and the diversity requirements as defined in 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants" (GDC), GDC-22, "Protection System Independence." 3.1.1 Reactor Protection System (RPS) Instrumentation (TS 3.3.1) The RPS initiates a reactor trip, if necessary, to protect against violating the core fuel design limits and the Reactor Coolant System (RCS) pressure boundary during abnormalities. By tripping the reactor, the RPS also assists the Engineered Safety Feature (ESF) Systems in mitigating accidents. The RPS consists of four separate and redundant protection channels that receive inputs of neutron flux, RCS pressure, RCS flow, reactor outlet temperature, RCS pump status, reactor building (RB) pressure, main feedwater (MFW) pump turbine status, and main turbine status. A protection channel is composed of measurement channels, a manual trip channel, a reactor trip module (RTM), and control rod drive (CRD) trip devices. LCO 3.3.1 provides requirements for the individual measurement channels. These channels encompass all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string. The RPS instrumentation measures critical unit parameters and compares these to predetermined setpoints. If the setpoint is exceeded, a channel trip signal is generated. The generation of trip signals in any two of the four RPS channels will result in the trip of the reactor. Bypassing one inoperable channel, or with the channel otherwise incapable of performing the trip function, places RPS in a two-out-of-three logic. With a second channel inoperable and assuming the channel is incapable of performing the trip function, if completion of Required 1CAN122201 Page 37 of 43 Action B.1 to place the channel in trip is delayed in accordance with the RICT, the RPS would be in a two-out-of-two trip logic. Because single failure of a third channel is not assumed while complying with TS Actions, the RPS trip function itself has not been lost. Two fully operable RPS channels remain in-service. In addition, inoperability of a channel does not necessarily result in the affected channel being unable to perform its function. For example, other parameter inputs to the channel can perform the trip function or loss of power to the RPS channel logic will also result in a trip signal from that channel. 3.1.2 Engineered Safeguards Actuation System (ESAS) Instrumentation (TS 3.3.5) The ESAS initiates necessary safety systems, based on the values of selected unit Parameters, to protect against violating core design limits and to mitigate accidents. The ESAS operates in a distributed manner to initiate the appropriate systems. The ESAS does this by determining the need for actuation in each of three analog instrument channels monitoring each actuation Parameter. Once the need for actuation is determined, the condition is transmitted to digital actuation logic channels, which perform the two-out-of-three logic to determine the actuation of each end device. Three Parameters are used for actuation:

  • Low Reactor Coolant System (RCS) Pressure;
  • High Reactor Building (RB) Pressure; and
  • High High RB Pressure.

LCO 3.3.5 covers only the analog instrument channels that measure these Parameters. These channels include the equipment necessary to produce an actuation signal input to the digital actuation logic channels. This includes sensors, bistable devices, operational bypass circuitry, and logic buffer modules. Digital actuation logic Functions are governed by LCO 3.3.7, "Engineered Safeguards Actuation System (ESAS) Actuation Logic." Each analog instrument channel provides input to the appropriate digital actuation logic channels that initiate equipment with a two-out-of-three coincidence logic on each digital channel. A RICT may only be applied to Required Action A.1 to place one channel in trip. There are three analog channels of ESAS. If the failed channel is assumed to be incapable of performing the actuation function, the ESAS is reduced to a two-out-of-two logic. Although single failure protection for the required function may be lost, the function itself has not been lost. Two fully operable ESAS channels remain in-service, and inoperability of a channel does not necessarily result in the affected channel being unable to perform its function. The analog channels provide inputs to the digital channels. De-energizing an analog channel will cause a partial trip of all of the associated digital channels. There are few failures that will not automatically trip an ESAS channel that would prevent all functions on the affected ESAS channel from actuating if inoperable. The exception being that failure or removal of a logic buffer module is unique as it would prevent that analog channel from tripping any digital channel functions. 3.1.3 Engineered Safeguards Actuation System (ESAS) Manual Initiation (TS 3.3.6) The ESAS manual initiation capability allows the operator to actuate ESAS Functions from the control room in the absence of any other initiation condition. This ESAS manual initiation capability is provided in the event the operator determines that an ESAS Function is needed 1CAN122201 Page 38 of 43 and has not been automatically actuated. A manual trip push button is provided on a control room console for each of the digital actuation logic channels. Operation of the push button energizes relays whose contacts perform a logical "OR" function with the automatic actuation. There are eight digital ESAS channels, two for each of the following ESAS functions:

  • High pressure injection (HPI)
  • Low pressure injection (LPI)
  • Reactor Building (RB) Cooling and Isolation
  • RB Spray One or more ESAS functions with one channel inoperable would prevent manual actuation of the affected digital channel; however, the opposite train digital channel would remain available and capable of being manually actuated.

Although single failure protection for the required function may be lost, the function itself would not be lost. LCO 3.3.6 covers only the system level manual initiation of these Functions. LCO 3.3.5 and LCO 3.3.7, "Engineered Safeguards Actuation System (ESAS) Actuation Logic," provide requirements on the portions of the ESAS that automatically initiate the Functions described earlier. For Condition A, one ESAS channel remains operable for each ESAS function with an inoperable manual initiation channel because its respective train of ES equipment is assumed to be capable of being actuated. Only one train of ESAS equipment is required to meet design basis criteria. 3.1.4 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation (TS 3.3.11) Note that ANO-1 TS 3.3.11 does not include the Main Feedwater (MFW) isolation function shown in NUREG 1430, "Standard Technical Specifications Babcock & Wilcox Plants" (STS); the MFW isolation function is included within MSLI function. The EFIC System instrumentation is designed to protect against the consequences of a simultaneous blowdown of both steam generators. Steam generator (SG) isolation is actuated to protect the core during an overcooling condition upon a main steam or feedwater line rupture. The EFW System is actuated to protect the core during an overheating condition upon a loss of MFW or a loss of primary side forced circulation (loss of all four reactor coolant pumps). In addition, EFIC controls the EFW flow rate to the SG(s) to control SG level and minimize overcooling. EFIC also selects the appropriate SG(s) under conditions of steam line break, or MFW or EFW line break downstream of the last check valve, and provides for isolation of the main steam and MFW lines of a depressurized SG. The EFIC System initiates EFW when an Engineered Safeguards Actuation System (ESAS) signal is initiated on low RCS pressure or high reactor building pressure (ESAS Channels 3 and 4) in order to support heat removal following Emergency Core Cooling System (ECCS) actuation. This is a digital signal provided by the ESAS Automatic Actuation Logic. 1CAN122201 Page 39 of 43 Condition B does not apply if one channel of different Functions is inoperable in the same protection channel. That condition is addressed by Condition A. EFIC consists of four instrument channels and only two of any combination of channels is required to actuate at least one train of EFW or MSLI. The actuation logic is:

  • Train A EFW/MSLI: (A or B) AND (C or D)
  • Train B EFW/MSLI: (A or C) AND (B or D)

Note that if EFIC channels A and D operate, then both trains of EFW and/or MSLI will actuate. Assuming that two channels of EFW initiation or MSLI functions listed in ANO-1 TS 3.3.11, Table 3.3.11-1, are inoperable, even without tripping a channel in conjunction with the channel that was placed in bypass, the two remaining EFIC channels would still be capable of initiating EFW or MSLI on at least one train regardless of the status of the two inoperable channels. Although single failure protection for the required function may be lost, the function itself would not be lost. In addition to the above, EFW initiation also enables EFIC vector logic which performs an EFW control function to preclude the delivery of fluid to a depressurized SG, thereby avoiding an uncontrolled cooling condition as long as the other SG remains pressurized. When both of the SGs are depressurized, the EFIC vector logic provides EFW flow to both SGs until a significant pressure difference between the two SGs is developed, thereby ensuring that core cooling is maintained. The function of the EFW Vector Valve Control is to meet the single-failure criterion while being able to provide EFW on demand and isolate a SG when required. With one EFW Vector Valve Control channel inoperable, the system cannot meet the single failure criterion and still meet the dual functional criteria described earlier; however, the function can be met assuming no other concurrent failures have occurred and the remaining channel is operating properly. This condition is analogous to having one EFW train inoperable. These conflicting requirements (isolate a faulted SG while feeding the intact SG) result in the necessity for two valves in series, in parallel with two valves in series, and a four-channel valve command system in order for the single failure criterion to be met. Failure of one EFW Vector Valve Control channel would prevent one train of EFW flow control valves and EFW isolation valves from automatically closing if one SG was faulted; however, the redundant valves in series with the failed valves would close as required to ensure that the function was met. 3.1.5 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation (TS 3.3.13) The four EFIC channels sensing a low SG pressure condition input initiate commands to the trip logic modules. The trip logic modules are identified as being part of the A and B trains. Train A actuation logic initiates when instrumentation Channel A or B initiates and Channel C or D initiates, which in simplified logic is: Train A actuation = (A and C) or (A and D) or (B and C) or (B and D) Train B actuation logic initiates when instrumentation Channel A or C initiates and Channel B or D initiates, which in simplified logic is: Train B actuation = (A and B) or (A and D) or (C and B) or (C and D) 1CAN122201 Page 40 of 43 Each of the two Functions (SG A MSLI, and SG B MSLI) has a Train A and a Train B of automatic actuation logic for each SG. The loss of one or more functions limited to a single train can be thought of as equivalent to failure of a single train of a two-train safety system (e.g., the safety function can be accomplished, assuming no additional failures). Since the function is assumed to be met by the opposite train, a Completion Time can be determined in accordance with the RICT Program. Only a failure of one train of one Function along with the opposite train of the same Function would result in a loss of function. 3.1.6 Emergency Feedwater Initiation and Control (EFIC) Logic (TS 3.3.14) The function of the EFIC vector logic is to determine whether EFW should not be fed to one or the other SG. This is to preclude the continued addition of EFW to a depressurized SG and, thus, minimize the overcooling effects. Each vector logic may isolate EFW to one SG or the other, never both. There are four sets of vector logic; one in each channel of EFIC. Each set of vector logic receives SG pressure information from bistables located in the input logic of the same EFIC channel. Each vector logic also receives an enable signal from both EFIC Train A and Train B when EFW is actuated. The vector logic outputs are in a neutral state with the valves fully open until enabled by the EFW Initiation (train A or B) trip logic. When enabled, the vector logic can issue close commands to the EFW control valves and open or close commands to the EFW isolation valves per the selected channel assignments. There are four vector logic channels, and each develops signals to open and close its SG A and SG B EFW valves. The vector logic outputs are in a neutral state with the valves fully open until enabled by the EFW Initiation (train A or B) trip logics. When enabled, the vector logic can issue close commands to the EFW control valves and open or close commands to the EFW isolation valves. With one channel of vector logic inoperable and no other single failures present, a SG can still be isolated in the event of a main steam line or MFW line rupture. 3.2 Vital Electrical Systems ANO-1 TS Section 3.8 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1968, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 6), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." These LCOs also support meeting the requirements of GDC-17, "Electric Power Systems." Included below is a description of the redundant and diverse means available to mitigate accidents for each required electrical system for which a RICT is proposed. This information is not required by TSTF-505 but is provided only for completeness. 1CAN122201 Page 41 of 43 Consistent with TSTF-505, a RICT is proposed for electrical system inoperabilities associated with offsite power sources, DGs, vital DC subsystems, vital AC and DC distribution subsystems, and vital inverters. A design summary of the two 4.16 kV and 480 V vital AC trains is provided under discussion of LCO 3.3.8 above. The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and 120 VAC vital buses (via inverters). The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems. Each subsystem consists of one 125 VDC battery, the associated battery charger for each battery, and all the associated control equipment and interconnecting cabling. Additionally, there is one spare battery charger per subsystem, which provides backup service in the event that a battery charger is out of service. When the spare battery charger is substituted, the requirements of independence and redundancy between subsystems are maintained. During normal operation, each 125 VDC subsystem is powered from the in-service battery charger with the battery floating on the system. In case of a loss of normal power to the battery charger, the DC load is automatically powered from the station battery. This results in a discharge of the associated battery (and may affect both the system and cell parameters). The onsite Class 1E AC, DC, and 120 VAC bus electrical power distribution systems are divided by train into two redundant and independent AC, DC, and 120 VAC bus electrical power distribution subsystems. Each AC electrical power subsystem consists of a vital 4.16 kV bus, a 480 V load center, and 480 V motor control centers (MCCs). MCC B55 is fed from MCC B56. These MCCs are swing components, in that MCC B56 may be energized from either load center B5 or load center B6. Normally, MCC B56, and thus B55, are energized from the same electrical train as SWS swing pump P-4B. There are two independent 125 VDC electrical power distribution subsystems (one for each train). The inverters are the preferred source of power for the 120 VAC buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital 120 VAC bus. The inverters are normally powered from 125 VDC vital electrical power. The inverters provide an uninterruptible power source for the safety significant instrumentation and controls, including the RPS, ESAS, and EFIC system. There are two RPS/ESAS related inverters per train. Additionally, there are two swing inverters (one per train) which provide backup service in the event that an RPS/ESAS related inverter is out of service. When the swing inverter is placed in service, the requirements of independence and redundancy between trains are maintained. The 120 VAC distribution panels are arranged in two load groups per subsystem and are normally powered from the inverters. Upon loss of the DC supply, or in the event of an inverter failure, a static transfer switch automatically transfers the 120 VAC vital load to a vital MCC (alternate source). With respect to uniform loading, each train is relatively balanced with the other, with the significant exception being the motor-driven EFW pump, which is powered from red train 4.16 kV switchgear A3. This pump is an additional load of approximately 550 kW. The combined accident loading is within the EDG's continuous load rating. In addition, the PRA model considers those SSCs which are affected by inoperability of a given electrical train. 1CAN122201 Page 42 of 43 Table E1-3: Vital 4.16 kV Switchgear SSC A3 (Red Train) A4 (Green Train) Vital 480 V Load Centers B5 B6 SWS Pumps P-4A P-4C SWS Pump P-4B (swing) P-4B (swing) RB Spray Pumps P-35A P-35B LPI Pumps P-34A P-34B HPI Pumps P-36A P-36C HPI Pumps P-36B (swing) P-36B (swing) EFW Pump P-7B x Table E1-4: Vital 480 V Load Centers SSC B5 (Red Train) B6 (Green Train) Vital 480 V MCCs B51, B52, B56 (swing), B57 B61, B62, B65, B56 (swing) RB Cooling Fans VSF-1A, VSF-1B VSF-1C, VSF-1D Control Room Chillers VCH-2A VCH-2B FLEX Supply B-514 and B-5525 B-6112 and B-6534 Control Rod Drives (CRDs) (1)x Power to CRDs Switchyard Supply B-632 Switchyard via Manual N/A Throwover Switch (1) One half of CRD power provided from Startup Transformer #1 via non-vital 4.16 kV breaker A-501 and transformer X-8. The AACDG (commonly referred to as the station blackout diesel generator) can also be started and connected, from the Control Room, to power either 4.16 kV switchgear. The AACDG is a non-seismic backup power source with a higher rating than the safety-related DGs. 1CAN122201 Page 43 of 43

4. References
1. Letter from the NRC to NEI, "Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines' (TAC No. MD4995)," (ADAMS Accession No. ML071200238), dated May 17, 2007

2. NEI Topical Report NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," (ADAMS Accession No. ML12286A322), dated October 2012
3. ASME Standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," dated February 2, 2009
4. PSA-ANO1-06-4B-EST, "ANO-1 PRA - RICT Estimates for TSTF-505 (RICT) Program LAR Submittal," Revision 0
5. IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations,"

April 1972

6. IEEE-279-1968, "Proposed IEEE Criteria for Nuclear Power Plant Protection Systems"

Enclosure 2 1CAN122201 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 1CAN122201 Page 1 of 4 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

1. Introduction This enclosure provides information on the technical adequacy of the Arkansas Nuclear One Unit 1 (ANO-1) probabilistic risk assessment (PRA) internal events model (including flooding) and the ANO-1 Fire PRA model in support of the license amendment request to revise Technical Specifications to implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1).

Topical Report NEI 06-09, Revision 0-A, as clarified by the NRC final safety evaluation of this report (Reference 2), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool, presently referred to as the Real Time Risk (RTR) tool, required to implement the risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3 (Reference 3), requirements for risk-informed plant-specific changes to a plant's licensing basis. ANO-1 employs a multi-faceted approach to establishing and maintaining the technical acceptability and fidelity of its PRA models. This approach includes both a proceduralized PRA maintenance and update process and the use of self-assessments and independent peer reviews. Section 2 outlines requirements related to the scope of the ANO-1 PRA Models. Section 3 outlines the technical adequacy of the Full Power Internal Events (FPIE) model, including internal flooding. Section 4 describes the technical adequacy of the Fire PRA (FPRA) model used in the respective license amendment applications.

2. Requirements Related to Scope of ANO-1 PRA Models The PRA models discussed in this enclosure have been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 4) consistent with NRC Regulatory Issue Summary (RIS) 2007-06, "Regulatory Guide 1.200 Implementation" (Reference 5).

Finding and Observation (F&O) closure reviews were conducted on the PRA models discussed in this enclosure. All closed findings were reviewed and resolved using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) (Reference 6) as accepted by NRC in the letter dated May 3, 2017 (Reference 7). Note that this portion of the ANO-1 PRA model does not incorporate the risk impacts of external events. The treatment of seismic risk and other external hazards for this application are discussed in Enclosure 4. 1CAN122201 Page 2 of 4

3. Scope and Technical Adequacy of ANO-1 Internal Events and Internal Flooding PRA Model The ANO-1 PRA FPIE model including internal flooding has been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 4), consistent with NRC RIS 2007-06 (Reference 5).

The Internal Events/Internal Flooding (IE/IF) PRA model was subject to a self-assessment and a full peer review conducted in August 2009 (Reference 18) against ASME/ANS RA-SA-2009 (Reference 8) and RG 1.200, Revision 2. The IF PRA model was subject to a self-assessment and a Focused-Scope Peer Review (FSPR) conducted in February-March 2017 (Reference 12) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 2. A Large Early Release Frequency (LERF) FSPR was conducted in August 2019 (Reference 13) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 2. In September/October of 2019, an F&O Closure Review (Reference 9) was conducted for ANO-1. The scope of the review included the IE/IF PRA model. The F&O Independent Assessment Team closed all 50 of the Finding level F&Os related to the IE/IF PRA model. There are no open peer review findings for the IE/IF PRA models and no unreviewed upgrades to PRA methods. Given there are no partially resolved or open findings that may impact Risk-Informed Completion Time (RICT) calculations, the ANO-1 IE/IF PRA model is of adequate technical capability to support the TSTF-505-A (Reference 11) program.

4. Scope and Technical Adequacy of ANO-1 Fire PRA Model The FPRA model was subject to a self-assessment and a full-scope peer review was conducted in October 2009 (Reference 17) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 2.

The ANO-1 FPRA has also been subject to three additional FSPRs in May 2012 (Reference 14), October 2012 (Reference 15), and June 2014 (Reference 16). During the evolution of the NFPA 805 project, some changes to the fire scenario methodologies were applied to both refine the model and results, and to comply with approved methods more fully. In September/October of 2019 an F&O Closure Review (Reference 9) was conducted for ANO-1. The scope of the review included the FPRA model. The F&O Independent Assessment Team closed all 52 of the Finding level F&Os related to the FPRA model. An additional F&O Closure by Independent Assessment (Reference 10) was held in December 2021 to perform an independent assessment to review Supporting Requirements (SRs) that were not originally assessed with a minimum of CC-II or greater and that were not reassessed during the previous F&O Closure. This lack of reassessment was due to either not having an associated Finding-level F&O or being linked to a Finding-level F&O originating in another SR where that SR was reassessed, but the linked SR was not reassessed. All nine SRs from the FPRA were assessed as C-II or greater during the review. All findings for the ANO-1 FPRA model were closed. There are no open peer review findings for the FPRA model and no unreviewed upgrades to PRA methods. The FPRA utilizes NRC-endorsed methodologies in the development of the FPRA and does not use any unapproved methods. 1CAN122201 Page 3 of 4 Given there are no partially resolved or open findings that may impact RICT calculations, the ANO-1 FPRA is of adequate technical capability to support the TSTF-505-A program.

5. References
1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

(ADAMS Accession No. ML071200238), dated May 17, 2007

3. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, (ADAMS Accession No. ML17317A256), dated January 2018
4. NRC Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, dated March 2009
5. NRC Regulatory Issue Summary 2007-06, "Regulatory Guide 1.200 Implementation," dated May 22, 2007
6. Nuclear Energy Institute (NEI) Letter to NRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," (ADAMS Accession No. ML17086A431), dated February 21, 2017
7. NRC Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," (ADAMS Accession No. ML17079A427), dated May 3, 2017
8. ASME/ANS RA-S-2009, Addenda to ASME/ANS RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," dated February 2009
9. PSA-ANO1-08-FNO-CL, "ANO-1 PRA Finding Level Fact and Observation Independent Assessment", Revision 0, dated April 27, 2020
10. PSA-ANO1-08-FNO-CL-01, "ANO-1 PRA - Fact and Observation Closure by Independent Assessment", Revision 0, dated March 10, 2022
11. Technical Specification Task Force (TSTF) Traveler TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2, dated November 21, 2018
12. ENTGANO150-REPT-001, "Arkansas Nuclear One Unit 1 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, 2017 1CAN122201 Page 4 of 4
13. ENTGS009-ANO1-PR-1000, "ANO-1 Power Plant Probabilistic Risk Assessment Focused-Scope Peer Review (LERF)," Revision 0, 2019
14. 0022-0021-005, Kleinsorg Group, "ANO-1 Focused Scope Peer Review," 2012
15. Kazarians & Associates, Inc., "Focused Scope Peer Review ANO-1 Fire PRA FSS-A, C, D, E and H," EC-47254, 2012
16. Curtiss-Wright, "Arkansas Nuclear One Unit 1 Fire HRA Peer Review Report," 2014
17. LTR-RAM-II-10-003, Westinghouse, "Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications for the Arkansas Nuclear One, Unit 1 Fire Probabilistic Risk Assessment," 2010
18. PWROG, "Arkansas Nuclear One Unit 1 PRA Peer Review Report Using ASME PRA Standard Requirements," 2009

Enclosure 3 1CAN122201 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 1CAN122201 Page 1 of 1 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 is not applicable because each probabilistic risk assessment (PRA) model used for the Risk Informed Completion Time (RICT) Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.

Enclosure 4 1CAN122201 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 1CAN122201 Page 1 of 45 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

1. Introduction and Scope Topical Report NEI 06-09, Revision 0-A (Reference 1), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference 2), requires that the License Amendment Request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on the insignificance to the calculation of configuration risk as well as discuss conservative or bounding analyses applied to the configuration risk calculation.

This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources. This enclosure also provides the Arkansas Nuclear One, Unit 1 (ANO-1) specific results of the application of the generic methodology and the disposition of impacts on the ANO-1 Risk Informed Completion Time (RICT) Program. Section 3 of this enclosure presents the plant-specific analysis of seismic risk to ANO-1. Section 4 of this enclosure presents the justification for excluding analysis of high wind risk to ANO-1. Section 5 of this enclosure presents the justification for excluding analyses of other external hazards from the ANO-1 PRA. Topical Report NEI 06-09 does not provide a specific list of hazards to be considered in a RICT Program. However, non-mandatory Appendix 6-A in the ASME/ANS PRA Standard (Reference 3) provides a guide for identification of most of the possible external events for a plant site. Additionally, NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk- Informed Decision Making" (Reference 4), provides a discussion of hazards that should be evaluated to assess uncertainties in plant PRAs and support the risk-informed decision-making process. This information was reviewed for the ANO-1 site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The information in the Updated Final Safety Analysis Report (UFSAR) regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well as present and projected industrial activities in the vicinity of the plant were also reviewed for this purpose. No new site-specific and plant-unique external hazards were identified through this review. The list of hazards in Appendix 6-A of the PRA Standard were considered for ANO-1 as summarized in Table E4-5. The scope of this enclosure is consideration of the hazards in Table E4-5 for ANO-1. As explained in subsequent sections of this enclosure, risk contribution from seismic events is evaluated quantitatively, and the other listed external hazards are evaluated and screened as having low risk. Although the tornado missiles hazard screened for total risk, it does not screen for all configurations; therefore, a "penalty factor" is developed to account for tornado missile risk in the RICT. 1CAN122201 Page 2 of 45

2. Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCOs) selected to be part of the RICT Program.

Consistent with NUREG-1855 (Reference 4), external hazards may be addressed by:

1) Screening the hazard based on a low frequency of occurrence,
2) Bounding the potential impact and including it in the decision-making, or
3) Developing a PRA model to be used in the RMAT/RICT calculation.

The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.

  • The first is the contribution from the occurrence of beyond design basis conditions, e.g.,

winds greater than design, seismic events greater than the design basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the structures, systems, and components (SSCs) to maintain functionality and support safe shutdown of the plant.

  • The second aspect addressed is the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power (LOOP), etc. While the plant design basis assures that the safety related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems that present a risk.

Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the NRCs 1975 Standard Review Plan (SRP) (Reference 5), which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance (Reference 6) as assuring a bounding CDF of less than 1E-6/yr for each hazard. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. If the bounding CDF for the hazard can be shown to be less than 1E-6/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program. 1CAN122201 Page 3 of 45 The basis for this is as follows:

  • The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-5.
  • The maximum time interval allowed for the RICT is 30 days.
  • If the maximum CDF contribution from a hazard is <1E-6/yr, then the maximum ICDP from the hazard is <1E-7 (1E-6/yr
  • 30 days/365 days/yr).
  • The bounding ICDP contribution from the hazard is shown to be less than 1% of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

The ANO-1 Individual Plant Examination of External Events (IPEEE) hazard screening analysis (Reference 7) has been updated to reflect current ANO-1 site conditions. The results are discussed in Section 5 and show that all the events listed in Table E4-5 can be screened except seismic events for ANO-1. Hazard Analysis - CDF There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-6/yr. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard. Evaluate Bounding LERF Contribution The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the large early release frequency (LERF) considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as follows: ILERFHazard = ICDFHazard

  • CLERPHazard The approach used for seismic LERF is described in Section 3.6.

Risks from Hazard Challenges Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out of service equipment. For ANO-1, as discussed in Section 3, the only beyond design basis hazard that could not be screened out is the seismic hazard. In addition, while the tornado missile hazard for ANO-1 was screened for the average test and maintenance conditions, it could not be screened under different configuration-specific conditions. 1CAN122201 Page 4 of 45 The above steps address the direct risks from damage to the facility from external hazards. While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using these steps without a full PRA, there are risks that may be addressed. These risks are related to the fact that some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events below the design basis levels can cause extended loss of offsite power conditions. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms. The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or are not significant to risk.

3. Seismic Risk Contribution Analysis 3.1 Introduction Technical Specification Task Force (TSTF) Traveler TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2 (Reference 8), requires accounting for seismic risk contribution in calculating extended RICTs.

Since a seismic PRA (SPRA) does not exist for ANO-1 (i.e., an SPRA was not submitted for either the ANO-1 IPEEE (Reference 9), or in response to the NRC Near-Term Task Force (NTTF) 2.1 seismic requests, (References 10 and 11), an alternative approach is taken here to provide an estimate of seismic CDF (SCDF) for use in the RICT Program. This alternative SCDF estimation approach is based on the current ANO-1 seismic hazard curve, (Reference 12) and using a plant level seismic fragility based on the ANO-1 IPEEE seismic margins assessment (SMA) (Reference 9), and NRC Generic Issue (GI)-199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," (Reference 13). The calculation of seismic LERF (SLERF) is performed by convolving the plant seismic core damage estimate described above with an assumed independent reactor building integrity seismic high confidence of low probability of failure (HCLPF) to estimate SLERF. That is, the SLERF can be estimated by convolving the plant seismic hazard with the plant limiting HCLPF for core damage and the limiting HCLPF for reactor building integrity. 3.2 Assumptions and Ground Rules

1. Hazard Curve: The ANO-1 seismic hazard is defined by the seismic hazard curve (SHC) provided to the NRC in Reference 14 and developed per the seismic hazard analysis documented in Reference 15.
2. PGA Metric: The ground motion metric used to define the seismic hazard in this analysis is peak ground acceleration (PGA). PGA is a common ground motion metric used in seismic risk assessment analyses for nuclear power plants (Reference 15). Based on review of NRC requests for additional information (RAIs) associated with industry LARs adopting a RICT Program, this analysis also assesses other hazard metrics (1.0 Hz, 2.5 Hz, 5 Hz, and 10 Hz) and concludes the PGA hazard is reasonable for use in RICT seismic risk estimation.

1CAN122201 Page 5 of 45

3. Plant Level Seismic Fragility: The assumed limiting plant seismic capacity used in the ANO-1 seismic penalty calculation has a HCLPF value of 0.30g PGA. The HCLPF capacity is defined as the earthquake level in which there is 95% confidence of less than 5%

seismic-induced failure probability. The bases for this value are:

   -   ANO-1 IPEEE SMA (Reference 9).
   -   NRC staff evaluation report of the ANO-1 IPEEE (Reference 16) which acknowledges that following completion of proposed seismic IPEEE-identified improvements (e.g., additional bolting, enhanced anchorage) the seismic capacity of all SSCs on the IPEEE SMA safe shutdown equipment list (SSEL) will meet or exceed the 0.30g PGA SMA review level earthquake (RLE).
   -   The Reference 17 Entergy Operations, Inc. (Entergy) post-IPEEE submittal fragility calculation determined that the anchorage capacity of the Unit 1 T-57A and B (and Unit 2 2T-57A and B) diesel generator fuel oil storage tanks meets the IPEEE 0.3g PGA RLE. The Reference 18 letter to the NRC documents completion of the IPEEE and Seismic Quality Utility Group (SQUG) seismic commitments.

The ANO-1 IPEEE SMA assessed SSEL SSCs to a review level earthquake value of 0.30g PGA in accordance with NRC guidance in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Reference 6). Electric Power Research Institute (EPRI) NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin", Revision 1 (Reference 19), was used for the ANO-1 IPEEE seismic analysis. The ANO-1 IPEEE (Reference 9) and the Reference 16 NRC staff evaluation report were reviewed for insights to determine the limiting plant HCLPF. For ANO-1, the RLE shape assigned by the NRC is the median NUREG/CR 0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," (Reference 20), spectrum anchored at 0.30g PGA. The IPEEE included a review of the integrity of the reactor building, isolation systems such as valves, mechanical and electrical penetrations, bypass systems, and plant-unique systems such as Reactor Building Cooling System (RBCS), Reactor Building Spray System (RBSS), and Reactor Building Isolation (RBI) system. Failure of the reactor building structure was assessed as seismically rugged at meeting the 0.3g PGA RLE. The IPEEE did not identify any reactor building vulnerabilities with respect to seismic events. The uncertainty parameter for the plant level seismic capacity in this analysis is represented by a composite beta factor (c) of 0.4. This is a commonly-accepted approximation and is consistent with the value used in GI-199, Table C.1, "Bases for Establishing Plant-Level Fragility Curves Parameters from IPEEE Information" (Reference 13). Refer to Section 4 of the EPRI Seismic Probabilistic Risk Assessment Implementation Guide (Reference 15), for further discussion of fragility uncertainty parameters. 1CAN122201 Page 6 of 45

4. Convolution to Determine SCDF: The estimation of SCDF in this calculation is performed by a mathematical convolution of various ANO-1 seismic hazard curves (i.e., PGA and other spectral acceleration curves from Reference 12) and the SMA-based plant level seismic fragility. This convolution estimation approach is a common analysis in approximating an SCDF for use in risk-informed decision making (e.g., it is commonly used in RICT seismic penalty calculations; the NRC used this approach in the GI-199 risk assessment in Reference 13) in absence of a current full-scope SPRA.
5. Convolution to Determine SLERF: The estimation of SLERF in this calculation is performed by a second mathematical convolution in parallel with the SCDF convolution of the PGA-based seismic hazard curve and using a PGA-based seismic HCLPF for the reactor building function based on the conclusions of the ANO-1 IPEEE SMA (Reference 9). This convolution estimation approach has been used in RICT seismic penalty calculations and accepted by the NRC in the absence of a full-scope SPRA.

3.3 Calculations The general approach to estimation of the SCDF is to use the plant level seismic fragility and convolve the corresponding failure probabilities as a function of seismic hazard level with the seismic hazard curve frequencies of occurrence. This is a commonly used approach to estimate SCDF when a seismic PRA is not available. This approach is the same as that used in previous TSTF-505 submittals, such as the Vogtle pilot TSTF-505 LAR (Reference 21) and the Calvert Cliffs TSTF-505 LAR (Reference 22). The key elements of the SCDF convolution calculation (i.e., seismic hazard curve and associated hazard intervals used in the convolution calculation, plant level seismic-induced failure probabilities based on the plant level seismic fragility, and the resulting SCDF from the convolution calculation) and the SLERF calculations are discussed below. 3.4 Seismic Hazard and Intervals The seismic hazard in units of g (PGA, peak ground acceleration) is shown in Table E4-1 (from Reference 14; the relevant hazard curves in that report were developed per the seismic hazard analysis from Reference 12). The mean fractile occurrence frequencies of Table E4-1 are used in the calculations here; use of mean values is a typical and expected PRA practice. To facilitate calculation of the ANO-1 plant fragility probability at each seismic hazard interval, a representative point value acceleration (g PGA) is calculated for each interval. The representative g value for the seismic hazard intervals is calculated using a geometric mean approach (i.e., the square root of the product of the g values at the beginning and end of a given interval). For the last open-ended seismic interval greater than 10g, the representative acceleration is estimated as 11g PGA. However, the precision of the representative magnitude used for the final open-ended seismic interval in the SCDF convolution is immaterial given that the calculated conditional failure probability of the final hazard interval (as well as the preceding three hazard intervals) is 1.0 and the contribution from this final interval has a negligible contribution to the overall SCDF estimate. 1CAN122201 Page 7 of 45 The seismic hazard interval annual initiating event frequency is calculated (except for the final interval) by subtracting the mean exceedance frequency associated with the g-interval (high) end point from the mean exceedance frequency associated with the g-interval beginning point. The frequency of the last seismic hazard interval is the exceedance frequency at the beginning point of that interval. This is common practice in industry SPRAs (Reference 15). Table E4-1: Seismic Hazard Data for ANO-1 (From Reference 12 Table A-1a - Mean and Fractile Seismic Hazard Curves for PGA (100 Hz) at ANO-1) AMPS(g) MEAN 0.05 0.16 0.50 0.84 0.95 0.0005 8.02E-02 4.31E-02 6.64E-02 8.12E-02 9.51E-02 9.93E-02 0.001 6.09E-02 2.76E-02 4.77E-02 6.09E-02 7.66E-02 8.72E-02 0.005 1.83E-02 7.77E-03 1.16E-02 1.69E-02 2.29E-02 3.84E-02 0.01 9.30E-03 3.73E-03 5.35E-03 8.23E-03 1.20E-02 2.25E-02 0.015 6.06E-03 2.10E-03 3.05E-03 5.27E-03 8.23E-03 1.51E-02 0.03 2.60E-03 5.50E-04 8.60E-04 1.92E-03 4.25E-03 7.34E-03 0.05 1.22E-03 1.77E-04 2.92E-04 6.93E-04 2.16E-03 4.19E-03 0.075 6.12E-04 7.45E-05 1.27E-04 2.96E-04 9.93E-04 2.32E-03 0.1 3.57E-04 4.07E-05 7.34E-05 1.67E-04 5.20E-04 1.38E-03 0.15 1.55E-04 1.74E-05 3.42E-05 7.66E-05 2.04E-04 5.75E-04 0.3 3.21E-05 3.47E-06 7.77E-06 1.92E-05 4.50E-05 1.04E-04 0.5 9.43E-06 7.89E-07 2.01E-06 5.91E-06 1.51E-05 2.92E-05 0.75 3.38E-06 1.82E-07 5.42E-07 1.98E-06 5.66E-06 1.11E-05 1 1.55E-06 5.35E-08 1.84E-07 8.23E-07 2.68E-06 5.42E-06 1.5 4.76E-07 7.03E-09 3.19E-08 1.98E-07 8.12E-07 1.82E-06 1CAN122201 Page 8 of 45 AMPS(g) MEAN 0.05 0.16 0.50 0.84 0.95 3 4.66E-08 2.39E-10 9.11E-10 1.02E-08 7.23E-08 2.10E-07 5 6.22E-09 1.42E-10 1.84E-10 8.35E-10 8.12E-09 3.01E-08 7.5 1.02E-09 1.32E-10 1.60E-10 2.13E-10 1.20E-09 5.12E-09 10 2.51E-10 1.21E-10 1.32E-10 1.82E-10 3.57E-10 1.36E-09 3.5 Seismic Failure Probabilities The seismic failure probability of the ANO-1 limiting plant fragility for each seismic hazard interval is calculated using the following fragility equations (this is for the Mean confidence level). These are the typical lognormal fragility equations used in most hazard PRAs (Reference 15). Fragility (i.e., failure probability) = [ln(A/Am)/c], Where: is the standard lognormal distribution function A is the g level in question, Am is the median seismic capacity, and the uncertainty parameters (betas) are related as follows: c = (u^2 + r^2)^0.5. HCLPF and Am are related as follows: Am = HCLPF / (exp -2.33c) As discussed previously, the HCLPF point of the ANO-1 IPEEE plant level seismic fragility curve is 0.30g PGA. The uncertainty variable c for the ANO-1 plant level fragility is set to a value of 0.4; this uncertainty variable value is consistent with that used by the NRC for the ANO-1 plant in Reference 13 as well as it is typical for use as a representative composite uncertainty (refer to Section 6.4 of Reference 23). 1CAN122201 Page 9 of 45 3.6 Seismic Core Damage Frequency The SCDF for each hazard interval is computed as the product of the hazard interval initiating event frequency (/yr) and the plant level seismic fragility failure probability for that same hazard interval. The results per hazard interval are then straight summed to produce the overall total SCDF across the entire hazard curve. The SCDF convolution calculation is summarized in Table E4-2 and shows the total estimated SCDF is 5.45E-6/yr. Table E4-2 provides the following information:

  • Seismic hazard intervals and the associated initiating event frequencies (Mean) and representative magnitudes
  • Plant level HCLPF fragility failure probabilities (Mean) per hazard interval
  • Convolved SCDF per interval and total SCDF To evaluate the effect of using the different available hazard curves from the ANO-1 probabilistic seismic hazards analysis (PSHA), the seismic penalty calculation has been re-performed with different hazard curves in the 1 Hz to 10 Hz range (i.e., the range of spectral values that would be used in an SPRA as an alternative to PGA). The plant-level fragility median (Am) value is adjusted per the ANO-1 2013 ground motion response spectra shape (Table 2.4-1 of Reference 12) for each convolution sensitivity case (keeping c=0.4 for each case). The convolved SCDF result from each hazard curve is summarized below:

PGA 10 Hz 5 Hz 2.5 Hz 1 Hz Plant-Level Fragility (Am): 0.76g 1.57g 1.27g 0.78g 0.49g Convolved SCDF: 5.45E-6 5.58E-6 5.17E-6 5.01E-6 5.03E-6 As can be seen, from 1 Hz to PGA (100 Hz) the resulting convolved SCDF estimates are very similar (differing by less than 10%). The 2.5 Hz and 1 Hz hazards produce the lowest SCDF estimates and the PGA and 10 Hz hazards produce the highest (the 10 Hz SCDF estimate is 2% higher than the PGA based SCDF estimate). These are small differences in such approximation calculations and considering the uncertainties in seismic hazard and response. The ANO-1 seismic penalty used in the RICT calculations is the PGA-based value; this is reasonable given these sensitivities. 3.7 Seismic Large Early Release Frequency The estimation of SLERF is performed here as a double convolution of the ANO-1 seismic hazard curve (refer to Section 3.4), the plant level fragility (refer to Section 3.5), and a separate independent seismic fragility for reactor building integrity. The results per hazard interval are then straight summed to produce the overall total SLERF across the hazard curve. This conservative approach typically produces a seismic CLERP (SCLERP) value of approximately 0.5 (a comparatively high value for a PWR). This approach has been used in past RICT LARs (e.g., Reference 24) and is an acceptable NRC approach as evidenced in recent (2020 - 2022) audits and RAIs associated with industry RICT LARs. 1CAN122201 Page 10 of 45 The assumed seismic capacity for reactor building integrity used in the ANO-1 SLERF calculation has a HCLPF value of 0.3g PGA (and, same as SCDF plant level fragility, with a composite beta factor (c) of 0.4), as described below:

  • The assumed 0.3g PGA HCLPF for ANO-1 reactor building integrity is based on the results of the ANO-1 IPEEE SMA (Reference 9).
  • The ANO-1 IPEEE SMA was performed to a 0.3g PGA RLE.
  • The ANO-1 IPEEE did not identify any reactor building vulnerabilities. The IPEEE SMA evaluated reactor building performance from structural, isolation, and bypass perspectives. The structure was found to be seismically rugged. The isolation valves and associated relays are seismically rugged.
  • All reactor building related SSCs were assessed to meet the 0.3g PGA RLE.

The SLERF convolution calculation is summarized in Table E4-3. Table E4-3 provides the following information:

  • Hazard intervals and the associated initiating event frequencies (Mean) and representative magnitudes.
  • Plant level fragility failure probabilities (Mean) per hazard interval.
  • Reactor building fragility failure probabilities (Mean) per hazard interval.
  • Convolved SLERF per interval and total SLERF.

The following equation applies to Table E4-3: SLERF_i = (Hazard_Interval_Plant Level Fragility Failure Prob_i) x (Hazard_Interval_Containment_Fragility Failure Prob_i) x (Hazard_Interval_Occurrence_Frequency_i) As shown in Table E4-3, the total estimated SLERF is 2.59E-06/yr. 1CAN122201 Page 11 of 45 Table E4-2: Convolution Calculation Summary of ANO-1 Seismic CDF Hazard Interval Mean Representative Hazard Interval Hazard Interval Peak Ground Exceedance Magnitude Plant-Level Occurrence Convolved Acceleration (g) Frequency (/yr) (geo. mean, g PGA) Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.0005 8.02E-02 0.0007 1.55E-68 1.93E-02 3.00E-70 0.001 6.09E-02 0.0022 1.95E-48 4.26E-02 8.30E-50 0.005 1.83E-02 0.0071 6.42E-32 9.00E-03 5.77E-34 0.01 9.30E-03 0.0122 2.68E-25 3.24E-03 8.69E-28 0.015 6.06E-03 0.0212 1.73E-19 3.46E-03 5.99E-22 0.03 2.60E-03 0.0387 4.74E-14 1.38E-03 6.54E-17 0.05 1.22E-03 0.0612 1.46E-10 6.08E-04 8.90E-14 0.075 6.12E-04 0.0866 2.72E-08 2.55E-04 6.94E-12 0.1 3.57E-04 0.1225 2.44E-06 2.02E-04 4.93E-10 0.15 1.55E-04 0.2121 6.96E-04 1.23E-04 8.55E-08 0.3 3.21E-05 0.3873 4.54E-02 2.27E-05 1.03E-06 1CAN122201 Page 12 of 45 Hazard Interval Mean Representative Hazard Interval Hazard Interval Peak Ground Exceedance Magnitude Plant-Level Occurrence Convolved Acceleration (g) Frequency (/yr) (geo. mean, g PGA) Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.5 9.43E-06 0.6124 2.92E-01 6.05E-06 1.77E-06 0.75 3.38E-06 0.8660 6.26E-01 1.83E-06 1.14E-06 1 1.55E-06 1.2247 8.82E-01 1.07E-06 9.48E-07 1.5 4.76E-07 2.1213 9.95E-01 4.29E-07 4.27E-07 3 4.66E-08 3.8730 1.00E+00 4.04E-08 4.04E-08 5 6.22E-09 6.1237 1.00E+00 5.20E-09 5.20E-09 7.5 1.02E-09 8.6603 1.00E+00 7.69E-10 7.69E-10 10 2.51E-10 11.0000 1.00E+00 2.51E-10 2.51E-10 Total Convolved SCDF Across PGA Hazard Curve (1/yr): 5.45E-6 1CAN122201 Page 13 of 45 Table E4-3: Convolution Calculation Summary of ANO-1 Seismic LERF Hazard Interval Hazard Mean Representative Interval Exceedance Magnitude Plant-Level Hazard Interval Hazard Interval Peak Ground Frequency (geo. mean, Fragility Reactor Bldg Occurrence Convolved Acceleration (g) (/yr) g PGA) (Mean) Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.0005 8.02E-02 0.0007 1.55E-68 1.55E-68 1.93E-02 4.65E-138 0.001 6.09E-02 0.0022 1.95E-48 1.95E-48 4.26E-02 1.62E-97 0.005 1.83E-02 0.0071 6.42E-32 6.42E-32 9.00E-03 3.70E-65 0.01 9.30E-03 0.0122 2.68E-25 2.68E-25 3.24E-03 2.33E-52 0.015 6.06E-03 0.0212 1.73E-19 1.73E-19 3.46E-03 1.04E-40 0.03 2.60E-03 0.0387 4.74E-14 4.74E-14 1.38E-03 3.10E-30 0.05 1.22E-03 0.0612 1.46E-10 1.46E-10 6.08E-04 1.30E-23 0.075 6.12E-04 0.0866 2.72E-08 2.72E-08 2.55E-04 1.89E-19 0.1 3.57E-04 0.1225 2.44E-06 2.44E-06 2.02E-04 1.20E-15 0.15 1.55E-04 0.2121 6.96E-04 6.96E-04 1.23E-04 5.95E-11 0.3 3.21E-05 0.3873 4.54E-02 4.54E-02 2.27E-05 4.67E-08 1CAN122201 Page 14 of 45 Hazard Interval Hazard Mean Representative Interval Exceedance Magnitude Plant-Level Hazard Interval Hazard Interval Peak Ground Frequency (geo. mean, Fragility Reactor Bldg Occurrence Convolved Acceleration (g) (/yr) g PGA) (Mean) Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.5 9.43E-06 0.6124 2.92E-01 2.92E-01 6.05E-06 5.18E-07 0.75 3.38E-06 0.8660 6.26E-01 6.26E-01 1.83E-06 7.16E-07 1 1.55E-06 1.2247 8.82E-01 8.82E-01 1.07E-06 8.36E-07 1.5 4.76E-07 2.1213 9.95E-01 9.95E-01 4.29E-07 4.25E-07 3 4.66E-08 3.8730 1.00E+00 1.00E+00 4.04E-08 4.04E-08 5 6.22E-09 6.1237 1.00E+00 1.00E+00 5.20E-09 5.20E-09 7.5 1.02E-09 8.6603 1.00E+00 1.00E+00 7.69E-10 7.69E-10 10 2.51E-10 11.0000 1.00E+00 1.00E+00 2.51E-10 2.51E-10 Total Convolved SLERF Across PGA Hazard Curve (1/yr): 2.59E-6 1CAN122201 Page 15 of 45 Reactor Building Isolation The following discussions regarding random and seismic-induced failure of RBI are provided to support the reasonableness of the average SLERF estimation (e.g., there are no normally-open AC-powered motor-operated reactor building isolation valves that would lead directly to an unscrubbed release and a LERF end state): RBI Random Failure: Random failure of RBI is already inherently included in the SLERF estimation discussed previously. The average SCLERP from the SLERF estimation is 0.47 (i.e., 2.59E-6/5.45E-6 = 0.47) whereas the non-seismic conditional probability of RBI failure is more than two orders of magnitude lower (dominated by the pre-existing leakage basic event L2TEAR in the RBI fault tree of the ANO-1 Full Power Internal Events (FPIE) Level 2 PRA Model (References 25 and 26). RBI Fragility: Seismic-induced failure of RBI is very low likelihood and encompassed by the previously calculated SLERF. The RBI valves of interest to the LERF risk metric are primarily air-operated valves (AOVs) and motor-operated valves (MOVs), all normally-closed at-power. The AOVs (whether initially open or not) would fail-safe (close) upon on loss of pneumatic or electric power (e.g., seismic-induced LOOP). The MOVs are supplied by onsite vital power and, assuming the failure of one vital power train, at least one RBI in each reactor building penetration would close as designed (the redundant valve being an MOV powered from the redundant vital electrical train or an AOV). The RBI valves have very high seismic capacities such that seismic loading will have a negligible likelihood of failing the RBI valves in the open position. The AOV RBI valves fail-safe (close) via internal spring force inside the AOV operator. Once closed, these valves do not need to open again during or after the seismic event. Therefore, AOVs do not meet the definition of an active valve per the AOV equipment class (per the EPRI SQUG Generic Implementation Procedure, GIP, and EPRI NP-7149 Seismic Adequacy of Equipment Classes). The spring will successfully cause the RBI valves to shut at accelerations much greater than those associated with the functional failure capacity used to determine the fragility of active valves. As such, these RBI valves are essentially inactive valves, which are inherently rugged as there is not a credible seismic failure mechanism that would prevent the valves from failing shut as desired. In addition, both in-series RBI valves in a penetration line would have to seismically fail open to result in an open release pathway. Some penetrations use MOVs for RBI which would require electric power for closure. However, such RBI MOVs are not significant to SLERF for one or more of the following reasons:

  • MOV is in closed position during at-power operation (or very low likelihood of being open) at the time of the seismic event (e.g., equipment drains)
  • Very small line
  • AOV or check valve in-series with the MOV 1CAN122201 Page 16 of 45
  • Penetration is a closed-loop system or otherwise scrubbed that would not represent a LERF (i.e., "large" magnitude release).
  • At least one in-series MOV in a penetration consisting of two redundantly vital-powered MOVs, an MOV and an AOV, or an MOV and a check valve, will close as designed (assuming loss of one onsite vital electrical train).

Application of SLERF in RICT Calculations The SLERF estimate documented above is conservatively used in the RICT process. Conservatism in the RICT process derived from the proposed approach applies the total estimated annual SLERF as a delta SLERF in each RICT calculation, regardless of the duration of the RICT. The total estimated annual SCDF and SLERF will be applied starting at time zero for each RICT calculation. 3.8 Evaluation of Seismic Induced LOOP Past TSTF-505 applications have also included separate discussion and evaluation of incremental risk associated with challenges to the facility that do not exceed the design capacity and the past submittals have focused on the challenge of seismically-induced LOOP. The ANO-1 seismic penalty calculation already encompasses seismic events within (i.e., at or below) the design basis by conservatively including very low magnitude seismic events (as low as 0.0005g peak ground acceleration, PGA, i.e., significantly lower than the ANO-1 Safe Shutdown Earthquake (SSE) of 0.20g PGA) in the SCDF and SLERF convolution calculations. These very low magnitudes are also well below the ANO-1 Operating Basis Earthquake (OBE) of 0.1g, half of the SSE); the plant is reasonably expected to remain online for seismic events below the OBE. Additional discussions and calculations are provided here regarding the inconsequential impact on RICT calculations from plant challenges associated with seismic-induced LOOP from earthquakes within the design basis. The approach used in the discussion below is the same as used in past LARs that have explicitly discussed this topic, i.e., 1) estimate the annual frequency of seismic-induced LOOP;

2) assume no offsite AC recovery within 24 hours; and 3) compare the result with the internal events PRA frequency estimate for non-recovered LOOP. The methodology used for computing the seismically-induced LOOP frequency is to convolve the ANO-1 mean PGA seismic hazard curve with an offsite power seismic fragility. Some previous TSTF-505 applications have approached this discussion conservatively by performing the seismic-induced LOOP convolution calculation over the entire hazard curve (not just the portion of the hazard curve below the design basis). That same approach is used here but the result for seismic events within the design basis is also provided.

Table E4-4 provides the ANO-1 mean PGA seismic hazard data and the LOOP seismic-induced failure probability (increasing with increasing seismic magnitude) based on the seismic fragility of offsite power. The seismic-induced LOOP convolution calculation in Table E4-4 includes the entire seismic hazard curve from earthquakes magnitudes well below the ANO-1 OBE to well beyond the ANO-1 SSE. 1CAN122201 Page 17 of 45 The failure probabilities for seismic-induced LOOP are represented by seismic induced failure of ceramic insulators in the offsite AC power distribution system, based on the following seismic fragility data from Table A-0-4 of the NRC RASP Handbook, Volume 2 (Reference 26). This is a common offsite power seismic fragility used for Central and Eastern US SPRAs and seismic risk calculations: Offsite Power Seismic Capacity (ceramic insulators):

  • Median Acceleration Capacity, Am = 0.30g PGA
  • Randomness uncertainty, R = 0.30
  • Modeling uncertainty, U = 0.45 Given the mean frequency and failure probability for each seismic hazard interval, it is straightforward to compute the estimated frequency of seismically-induced LOOP for the ANO-1 site by multiplying the hazard interval occurrence frequency and the offsite power fragility failure probability. As shown in Table E4-4, the total seismic-induced LOOP frequency across the entire seismic hazard curve is estimated at 6.9E-5/yr. Note that this overstates the within design basis challenge frequency but is conservative for this purpose.

The ANO-1 FPIE PRA models LOOP from plant-centered, switchyard-centered, grid-related, and weather-related events. Based on the ANO-1 FPIE PRA, the total 24-hour non-recovered LOOP frequency is 1.3E-3/yr. Assuming offsite AC recovery failure probability of 1.0 for 24 hours for seismic-induced LOOP, the total (i.e., across the entire hazard curve) 24-hour non-recovered seismic-induced LOOP frequency is 5.2% (i.e., 6.9E-05 / 1.3E-03 = 5.2%: single significant digit frequencies typed here, but all significant digits used in the calculations) of the total 24-hour non-recovered LOOP frequency already addressed in the FPIE PRA. The "within design basis" (i.e., up to the 0.2g PGA SSE) 24-hour non-recovered seismic-induced LOOP frequency is 1.7% (i.e., 2.3E-05 / 1.3E-03 = 1.7%: single significant digit frequencies typed here, but all significant digits used in the calculations) of the total 24-hour non-recovered LOOP frequency already addressed in the FPIE PRA. As can be seen, the 24-hour non-recovered seismic-induced LOOP frequency with the design basis is a very small percentage of the frequency of such challenges already captured in the FPIE PRA (which is explicitly used in RICT calculations) such that it will not significantly impact the RICT Program calculations and it can be omitted from explicit analysis in RICT calculations. In addition, the ANO-1 seismic penalty calculation already addresses the fraction of seismic-induced LOOP events within (i.e., at or below) the design basis by conservatively including very low magnitude seismic events in the seismic penalty convolution calculation. 1CAN122201 Page 18 of 45 Table E4-4: ANO-1 Seismic-Induced LOOP Frequency Estimate (Across Entire Seismic Hazard Curve) ANO-1 Offsite Power ANO-1 Seismic Hazard Convolution Calculation HCLPF Curve (PGA) (ANO-1 Offsite Power HCLPF Fragility with Seismic Hazard) Mean Hazard Interval Peak Ground Exceedance Representative Hazard Interval Convolved HCLPF Am Acceleration Frequency Magnitude (geo. Hazard Interval Occurrence Frequency (g,PGA) (g,PGA) C (q) (/yr) mean, g PGA) Fragility (Mean) Frequency (/yr) (/yr) 0.09 0.30 0.54 0.0005 8.02E-02 0.0007 1.89E-29 1.93E-02 3.64E-31 0.001 6.09E-02 0.0022 5.52E-20 4.26E-02 2.35E-21 0.005 1.83E-02 0.0071 1.83E-12 9.00E-03 1.65E-14 0.01 9.30E-03 0.0122 1.48E-09 3.24E-03 4.80E-12 0.015 6.06E-03 0.0212 4.37E-07 3.46E-03 1.51E-09 0.03 2.60E-03 0.0387 7.09E-05 1.38E-03 9.78E-08 0.05 1.22E-03 0.0612 1.55E-03 6.08E-04 9.42E-07 0.075 6.12E-04 0.0866 1.02E-02 2.55E-04 2.61E-06 0.1 3.57E-04 0.1225 4.68E-02 2.02E-04 9.46E-06 0.15 1.55E-04 0.2121 2.54E-01 1.23E-04 3.13E-05 0.3 3.21E-05 0.3873 6.75E-01 2.27E-05 1.53E-05 0.5 9.43E-06 0.6124 9.03E-01 6.05E-06 5.46E-06 0.75 3.38E-06 0.8660 9.74E-01 1.83E-06 1.78E-06 1 1.55E-06 1.2247 9.95E-01 1.07E-06 1.07E-06 1.5 4.76E-07 2.1213 1.00E+00 4.29E-07 4.29E-07 3 4.66E-08 3.8730 1.00E+00 4.04E-08 4.04E-08 5 6.22E-09 6.1237 1.00E+00 5.20E-09 5.20E-09 7.5 1.02E-09 8.6603 1.00E+00 7.69E-10 7.69E-10 10 2.51E-10 11.0000 1.00E+00 2.51E-10 2.51E-10 Total Convolved Seismic LOOP Across Hazard Curve (1/yr): 6.85E-05 1CAN122201 Page 19 of 45 3.9 Summary Estimates of SCDF and SLERF have been derived for use in the ANO-1 RICT Program. Since the estimates are intended to be treated as conservative values in the RICT calculations for that program, the results (listed below) for the case of plant level fragility HCLPF = 0.30g PGA (and reactor building fragility HCLPF of 0.30g PGA) with c = 0.4 will be used: Seismic CDF = 5.45E-6/yr Seismic LERF = 2.59E-6/yr

4. Extreme Winds Analysis This section describes the extreme wind hazard analysis for ANO-1.

As background to the screening analysis for high winds and tornados at ANO-1, Section 5.1.1 of the IPEEE (Reference 7) notes that the design and construction of the ANO units was initiated several years prior to the NRCs issuance of the 1975 SRP. Structures and components were designed using the guidance provided in American Society of Civil Engineers (ASCE) Paper 3269, "Wind Forces on Structures." Thus, there are some differences in the ANO design compared to the SRP requirements. 4.1 Wind Pressure Section 5.1.1 of the IPEEE (Reference 7) documents the screening of High Winds. It was determined that the ANO-1 design basis is mostly consistent with the 1975 SRP requirements (Reference 5) for non-tornadic winds. The differences with the SRP were determined to be insignificant, primarily because the ANO-1 design is controlled by tornadic and not straight winds. Table 5.1-1 of the IPEEE provides a comparison of the ANO-1 design basis tornado parameters to the requirements in Regulatory Guide (RG) 1.76, "Design-basis Tornado and Tornado Missiles for Nuclear Power Plants" (Reference 28). Key equipment and structures are designed to withstand a maximum wind speed of 300 mph, external pressure drop of 3 psi, and rate of pressure drop of 1 psi/sec. Additionally, key Category I components outside of Category I structures (e.g., diesel exhausts and certain tanks) were determined to be capable of withstanding the tornado effects (Reference 7). The RG 1.76 criteria are higher for wind speed (360 mph) and rate of pressure drop (2 psi/sec). The ANO-1 design considers all Category I structures unvented; therefore, the rate of pressure drop is not relevant to the design (Reference 7). However, the ANO-1 design does not meet the criteria for the maximum wind speed. Tornado wind speed hazard curve information for ANO-1 is provided in Table 6-1 of NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2 (Reference 29). The wind speed for the 1E-7 annual exceedance probability is 297 mph, using the Fujita Scale (F-Scale). Therefore, the frequency of the design tornado wind speed for ANO-1 is approximately equal to the 1E-7/yr (based on the conservative F-Scale), which is much less than 1E-6/yr. 1CAN122201 Page 20 of 45 Tropical storms (i.e., hurricanes) are not a concern at ANO-1 due its location (i.e., approximately 400 miles inland). Straight winds (e.g., due to thunderstorms) are typically in the 50 - 70 mph range, although in rare cases may be over 100 mph. However, the hazard curve for straight winds tails off very quickly, such that below approximately 1.0E-03/yr, straight winds do not affect the overall wind hazard for areas with hurricane and/or tornado hazards (Reference 30). Therefore, the CDF contribution from wind speeds greater than 300 mph is less than 1E-6/yr, and wind pressure effects from high winds and tornados are screened from further evaluation. 4.2 Tornado Missiles Section 5.1.3 of the IPEEE estimated that the contribution of tornado missiles to CDF was less than 1E-6/yr. This was based on the following:

  • The minimum 1'-6" thick reinforced concrete barrier (walls) utilized at ANO-1 are sufficient to preclude perforation or spalling damage from postulated SRP tornado missiles.
  • Although exposed tanks (e.g., condensate storage tank, borated water storage tank) are susceptible to perforation from tornado missiles, the contribution from tornado missile failure of each tank to CDF was estimated to be less than 1E-8/yr.
  • The diesel exhausts are exposed and could potentially be damaged due to missile perforation. The IPEEE stated that a missile large enough to crush or significantly block the flow of exhaust gases was not credible.

Subsequent to the IPEEE, some SSCs required to be protected against tornado missiles were found to be susceptible to tornado missiles and not in conformance with the ANO-1 current licensing basis. Analyses were performed to determine the risk associated with these non-conformances. During walkdowns in support of the risk evaluation of the non-conforming SSCs, additional vulnerable SSCs were identified. Several plant modifications were made to protect vulnerable SSCs (e.g., installation of missile barriers and steel reinforcement for certain walls). A conservative risk model was developed to calculate the contribution of tornado missile risk to the ANO-1 CDF and LERF and was reviewed in the Tornado Missile Penalty Factor Evaluation (Reference 31) to determine the impact for the TSTF-505 application. The results of the base (average maintenance) conservative tornado risk model are: CDF 1.8E-7/yr LERF 6.1E-9/yr These results are significantly less than 1E-6/yr and 1E-7/yr for CDF and LERF, respectively. Therefore, tornado missile hazard average risk can be screened from consideration for TSTF-505 application, based on Criterion PS4 of Table E4-6. However, the CDF due to tornado missiles for certain maintenance or LCO configurations is determined to be above 1E-6/yr requiring a tornado missile (TM) penalty factor to be established for RICT calculations. The Tornado Missile Penalty Factor Evaluation (Reference 31) documents the calculations used to determine the TM penalty factors (CDF and LERF). 1CAN122201 Page 21 of 45 The tornado missile risk model was quantified for all LCO configurations and several other risk significant combinations of unavailable SSCs. All other maintenance terms were set to FALSE for these configurations. For the CDF penalty factor:

  • The most limiting configurations include combinations with Emergency Feedwater (EFW)

Train B (turbine-driven EFW Pump P-7A).

  • The configuration with the highest CDF and CDF (5.5E-6/yr and 5.3E-6/yr, respectively) includes unavailability of EFW Train B (LCO 3.7.5, Condition B), Switchgear A4 (LCO 3.8.9, Condition A), Diesel Generator (DG) #2 (LCO 3.8.1, Condition B) and Service Water System (SWS) Loop 2 (LCO 3.7.7, Condition A).
  • CDF and CDF for all configurations are less than 6E-6/yr.
  • CDF and CDF for all configurations that do not include EFW Train B are less than 3E-6/yr.
  • The single LCO with the highest CDF and CDF (2.3E-6/yr and 2.1E-6/yr, respectively is LCO 3.8.9, Condition A, for Switchgear A3.
  • CDF and CDF for all other LCOs cases are less than 3E-6/yr.

For the LERF penalty factor:

  • The most limiting is configuration is LCO 3.6.2, Condition C.3, which is modeled as a reactor building failure with a LERF and LERF of less than 1.64E-7/yr and 1.58E-7/yr.
  • LERF and LERF for all LCOs and configurations evaluated are less than 2E-7/yr.

In summary, the conservative TM penalty factors that will be applied to all RICT configurations are: CDF 6E-6/yr [Any configuration or LCO with EFW Train B unavailable] CDF 3E-6/yr [All other configurations and LCOs] LERF 2E-7/yr [All LCOs]

5. Evaluation of External Event Challenges and IPEEE Update Results This Section provides an evaluation of other external hazards. The results of the assessment of these hazards are provided in Table E4-5. Table E4-6 provides the summary criteria for screening of the hazards listed in Table E4-5.

Hazard Screening The IPEEE for ANO-1 provides an assessment of the risk to ANO-1 associated with these hazards. Additional analyses have been performed since the IPEEE to provide updated risk assessments of various hazards, such as aircraft impacts, industrial facilities and pipelines, and external flooding. These analyses are documented in the UFSAR (Reference 32. Table E4-5 reviews and provides the bases for the screening of external hazards, identifies any challenges 1CAN122201 Page 22 of 45 posed, and identifies any additional treatment of these challenges, if required. The conclusions of the assessment, as documented in Table E4-5, assure that the hazard either does not present a design-basis challenge to ANO-1, or is adequately addressed in the PRA. In the application of RICTs, a significant consideration in the screening of external hazards is whether particular plant configurations could impact the decision on whether a particular hazard that screens under the normal plant configuration and the base risk profile would still screen given the particular configuration. The external hazards screening evaluation for ANO-1 has been performed accounting for such configuration-specific impacts. The process involves several steps. As a first step in this screening process, hazards that screen out for one or more of the following criteria (as defined in Table E4-6) still screen out regardless of the configuration, as these criteria are not dependent on the plant configuration.

  • The occurrence of the event is of sufficiently low frequency that its impact on plant risk does not appreciably impact CDF or LERF. (Criterion C2)
  • The event cannot occur close enough to the plant to affect it. (Criterion C3)
  • The event which subsumes the external hazard is still applicable and bounds the hazard for other configurations. (Criterion C4)
  • The event develops slowly, allowing adequate time to eliminate or mitigate the hazard or its impact on the plant. (Criterion C5)

The next step in the screening process is to consider the remaining hazards (i.e., those not screened per the above criteria) to consider the impact of the hazard on the plant given particular configurations for which a RICT is allowed. For hazards for which the ability to achieve safe shutdown may be impacted by one or more such plant configurations, the impact of the hazard to particular SSCs is assessed and a basis for the screening decision applicable to configurations impacting those SSCs is provided. As noted above, the configurations to be evaluated are those involving unavailable SSCs whose LCOs are included in the RICT program. 1CAN122201 Page 23 of 45 Table E4-5: Other External Hazards Disposition1 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Acceptance Criterion 1.A of SRP 3.5.1.6 (Reference 33) states the probability is considered to be less than an order of magnitude of 10-7 per An aircraft (either a portion of year by inspection if the plant-to-airport distance D is between 5 and 10 (e.g., missile) or the entire statute miles, and the projected annual number of operations is less than aircraft) that collides either 500 D2, or the plant-to-airport distance D is greater than 10 statute miles, directly or indirectly (i.e., and the projected annual number of operations is less than 1000 D2. skidding impact with one or Per the ANO-1 UFSAR, Section 2.2.6 (Reference 32), there is no major more SSCs at or in the Aircraft Impact PS2, PS4 airport with a control tower within 50 miles of the plant site. The closest plants analyzed area airports are the Russellville Municipal Airport (8 miles) and the Clarksville causing functional failure. Municipal Airport (15 miles). None of these airports has any regularly Secondary hazards resulting scheduled air traffic. from an aircraft impact Based on this review, the aircraft impact hazard is considered to be include, but are not negligible. necessarily limited to, fire. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Rapid flow of a large mass of accumulated frozen precipitation and other debris down a sloped surface Per the IPEEE Report (Reference 7), the topography is such that no resulting in dynamic loading avalanche is possible. Avalanche of SSCs at or in the plants C3 Based on this review, the avalanche hazard is considered to be negligible. analyzed area causing There are no configuration specific considerations for this hazard. This functional failure or adverse hazard can be excluded from the RICT Program evaluation. impact on natural water supplies used for heat rejection. 1 The list of hazards and their potential impacts considered those items listed in Tables D-1 and D-2 in Appendix D of RG 1.200, Revision 3 (Reference 41). E4-23 1CAN122201 Page 24 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Per ANO-1 UFSAR, Section 9.3.2 (Reference 32), to help limit biological fouling such as flow blockage from bivalve mollusks, Corbicula (Asiatic clams), a biocide is added at the intake structure in sufficient concentration to kill the mollusks. Accumulation or deposition of Station procedures provide for addition of biocide in the SWS and vegetation or organisms Emergency Cooling Pond (ECP). The SWS intake bays are also inspected (e.g., zebra mussels, clams, and cleaned at least once every refueling outage to prevent clam buildup fish, algae) on an intake and fouling. Biological Events structure or internal to a C5 Flow measurement orifices and instrumentation has been added to several system that uses raw cooling of the auxiliary building coolers. Flow measurements are periodically taken water from a source of and trended to detect any possible developing flow blockage from biological surface water, causing its fouling. functional failure. Based on this review, the biological event hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Removal of material from a Per the IPEEE Report (Reference 7), the site is located 6 miles W-NW of shoreline of a body of water Russellville, Arkansas, on the peninsula formed by the Dardanelle Reservoir (e.g., river, lake, ocean) due on the Arkansas River. There are several flood control dams upstream and to surface processes (e.g., downstream of the plant; therefore, erosion is not a significant concern. wave action, tidal currents, In addition, per ANO-1 UFSAR, Section 1.7.3 (Reference 32), the ECP is wave currents, drainage, or excavated in an impervious clay strata with the bottom of the pond about 4 Coastal Erosion C1, C3 to 16 feet above rock. Soundings of the pond will be taken annually to winds and including river bed scouring) that results in determine the amount of silting. damage to the foundation of Based on this review, the coastal erosion hazard is considered to be SSCs at or in the plants negligible. analyzed area, causing There are no configuration specific considerations for this hazard. This functional failure. hazard can be excluded from the RICT Program evaluation. E4-24 1CAN122201 Page 25 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria A shortage of surface water Per the IPEEE Report (Reference 7), drought is not a concern at ANO-1. supplies due to a period of Cooling water is provided by the Dardanelle Reservoir and ECP. In addition, below-average precipitation drought is a slowly developing hazard allowing time for orderly plant in a given region, thereby reductions, including shutdowns. Drought C1, C5 depleting the water supply Based on this review, the drought hazard is considered to be negligible. needed for the various water-cooling functions at the There are no configuration specific considerations for this hazard. This facility. hazard can be excluded from the RICT Program evaluation. E4-25 1CAN122201 Page 26 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria The evaluation of the impact of the external flooding hazard at the site was updated as a result of the NRC's post-Fukushima 50.54(f) Request for Information. The ANO Units 1 and 2 flood hazard reevaluation report (FHRR) was submitted to NRC for review on September 14, 2016 (Reference 34). The FHRR determined that the only location where water ingress may have potential to impact key SSCs was via the turbine building train bay doors due to local intense precipitation (LIP). By letter dated May 31, 2017, ANO submitted its focused evaluation (FE) An excess of water outside (Reference 35) for ANO Units 1 and 2. The FE demonstrated that no doors, the plant boundary that buildings, or propagation pathways that contain key SSCs are impacted by causes functional failure to floodwaters during the LIP event. The calculated ponding levels were below plant SSCs. External flood the controlling current design bases (CDB) event, which is a probable causes include, but may not maximum flood (PMF) from the Arkansas River coincident with upstream be limited to, flooding due to dam failure and wind-generated waves. External Flood dam failure, high tide, C1 Any other buildings that are inundated by floodwaters or the propagation of hurricane (tropical cyclone), floodwaters do not contain any SSCs or equipment that would affect the ice cover, local intense ability to maintain any of the key safety functions required to achieve and precipitation, river diversion, maintain safe shutdown. This includes the Turbine Building. river and stream overflow, All vulnerabilities due to the unbounded LIP mechanism were addressed by seiche, storm surge, and permanent flooding protection and available physical margin was tsunami. demonstrated to be adequate to protect SSCs required to achieve and maintain safe shutdown. After its review of the ANO FE (Reference 36), the NRC concluded that the station demonstrated effective flood protection from the reevaluated flood hazards. Attachment B of OP-1203.025, "Natural Emergencies," is used to ensure flood barriers are intact prior to the onset of flooding at the site. Based on this review, the external flooding hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-26 1CAN122201 Page 27 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Strong winds resulting in dynamic loading or missile impacts on SCCs causing functional failure. Hazards that could potentially result in high wind include the following:

  • hurricane - severe winds developed from a tropical depression resulting in missiles or dynamic loading on SSCs.

Secondary hazards Extreme Winds resulting from a hurricane, N/A See Section 4 of this enclosure. and Tornadoes include, but are not necessarily limited to tornado

  • straight wind - a strong wind resulting in missiles or dynamic loading on SSCs that is not associated with either hurricanes or tornadoes
  • tornado - a strong whirlwind that results in missiles or dynamic loading on SSCs E4-27 1CAN122201 Page 28 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), fog can increase the frequency of Low-lying water vapor in the occurrence for other events such as aircraft, railway, and highway accidents.

form of a cloud or obscuring Fog is implicitly included in data for other events such as aircraft, railway, haze of atmospheric dust or and highway accidents which are discussed elsewhere in this external Fog smoke resulting in impeded C4 hazards evaluation. visibility that could result in, for example, a transportation Based on this review, the fog hazard is considered to be negligible. accident. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Direct (e.g., thermal effects) and indirect effects (e.g., generation of combustion products, transport of Per the IPEEE Report (Reference 7), the ANO site is cleared of significant firebrand) of a forest fire forestry and brush, and therefore, forest or brush fire do not pose any outside the plant boundary danger. Forest Fire that causes functional failure C3 Based on this review, the forest or range fire hazard is considered to be of plant SSCs. negligible. Hazards that could cause or There are no configuration specific considerations for this hazard. This be caused by a forest fire hazard can be excluded from the RICT Program evaluation. include, but may not be limited to, wildfires and grass fires. A thin layer of ice crystals There is negligible impact on the plant due to frost. The worst-case impact that form on the ground or is frost induced freezing leading to a LOOP event which is addressed in the the surface of an earthbound weather-related LOOP initiating event in the ANO-1 FPIE PRA model. Frost object when the temperature C1, C4 Based on this review, the frost hazard is considered to be negligible. of the ground or surface of the object falls below There are no configuration specific considerations for this hazard. This freezing. hazard can be excluded from the RICT Program evaluation. E4-28 1CAN122201 Page 29 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Hail is bounded by other events for which the plant is designed. Per the A shower of ice or hard snow IPEEE Report (Reference 7), hail is less damaging than the tornado missile that could result in hazard. In addition, the principal effects of such events would be to cause a transportation accidents or LOOP and are addressed in the weather-related LOOP initiating event in the Hail C4 ANO-1 FPIE PRA model. directly causes dynamic loading or freezing conditions Based on this review, the hail hazard is considered to be negligible. as a result of ice coverage. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Per NUREG-1407 (Reference 6), the capacity reduction of the ultimate heat Effects on SSC operation sink would be a slow process that allows plant operators sufficient time to due to abnormally high take proper actions such as reducing power output level or achieving and ambient temperatures maintaining safe shutdown. resulting from weather In addition, Technical Specification (TS) 3.7.8, Surveillance Requirement High Summer phenomena. Secondary (SR) 3.7.8.2, verifies the average ECP water temperature to be less than or C1, C5 Temperature hazards resulting from high equal to 100 °F. ambient temperatures, include, but are not Based on this review, the high summer temperature hazard is considered to necessarily limited, to low be negligible. lake or river water levels. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Per the IPEEE Report (Reference 7), the site is located 6 miles W-NW of Russellville, Arkansas, on the peninsula formed by the Dardanelle Reservoir The periodic maximum rise of on the Arkansas River. There are several flood control dams upstream and sea level resulting from the downstream of the plant. combined effects of the tidal See also "External Flooding." High Tide C4 gravitational forces exerted by the moon and sun and the Based on this review, the high tide, lake level, or river stage hazard is rotation of the Earth. considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-29 1CAN122201 Page 30 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Flooding that results from the Per the IPEEE Report (Reference 7), hurricanes are bounded by the intense rain fall from a external flooding hazard and the high winds or tornados hazard. hurricane (tropical cyclone). Additionally, hurricanes, lose strength when moving inland and the greatest Hurricane Secondary hazards resulting concern is possible damage from winds or flooding due to excessive rainfall. from a hurricane include, but C4 (Tropical Cyclone) See External Flooding and Extreme Winds and Tornado Assessment. are not necessarily limited to, dam failure, high tide, river Based on this review, the hurricane hazard is considered to be negligible. and stream overflow, seiche, There are no configuration specific considerations for this hazard. This storm surge, and waves. hazard can be excluded from the RICT Program evaluation. Flooding due to downstream Per the IPEEE (Reference 7), ice formation in this portion of the Arkansas blockages of ice on a river. River basin is light and infrequent. Secondary hazards resulting Per ANO-1 UFSAR, Section 9.3.2.4 (Reference 32, possible layers of ice on Ice Cover from an ice blockage include, C1 the ECP surface would not cause flow blockage of the cooling water system. but are not necessarily Based on this review, the ice cover hazard is considered to be negligible. limited to, river and stream There are no configuration specific considerations for this hazard. This overflow. hazard can be excluded from the RICT Program evaluation. E4-30 1CAN122201 Page 31 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria SRP Chapters 2.2.1-2.2.2 (Reference 37) describe acceptance criteria for this hazard and states that NRC reviews should include all identified facilities and activities within 8 kilometers (5 miles) of the plant and that facilities and activities at distances greater than 8 kilometers (5 miles) should be considered if they have the potential for affecting plant safety-related features. An accident at an offsite Per IPEEE (Reference 7), there are no military bases, missile sites, chemical industrial or military facility plants and storage facilities, oil pipelines, or airports within a 5-mile radius of that results in a release of the centerline of the ANO-1 reactor building. Industrial or toxic gases, a release of Military Facility C3, PS2 Stationary offsite sources of hazardous materials were recently evaluated combustion products, a Accident (Reference 38). Based on communication with the four counties within the release of radioactivity, an 5-mile radius of the plant site (Pope, Johnson, Yell, and Logan counties), explosion, or the generation four facilities storing hazardous chemicals were identified in Pope County of missiles. and the chemical information was obtained. All chemicals screened out as being non-toxic, non-volatile, or were solid materials. Based on this review, the industrial or military facility accident hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. The ANO-1 Internal Events and Internal Flooding PRA model addresses risk Internal Flood N/A from internal flooding events. Internal Fire N/A The ANO-1 Internal Fire PRA model addresses risk from internal fires. E4-31 1CAN122201 Page 32 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Dynamic loading of SSCs or Per the ANO-1 UFSAR, Section 2.6.7.1 (Reference 32), slope stability impacts on natural water evaluation of the intake and discharge canals were performed. The factor of supplies used for heat safety is 1.5 for normal condition and 1.0 for seismic condition and is rejection due to the considered acceptable. Potential landslides are not of concern at the plant Landslide C3 site. movement of rock, soil, and mud down a sloped surface Based on this review, the landslide hazard is considered to be negligible. (does not include frozen There are no configuration specific considerations for this hazard. This precipitation). hazard can be excluded from the RICT Program evaluation. Lightning strikes may result in a LOOP or plant trip. These events are Effects on SSCs due to addressed in the plant design basis and are modeled in the ANO-1 Internal a sudden electrical discharge Events PRA model. Lightning C1, C4 from a cloud to the ground or Based on this review, the lightning hazard is considered to be negligible. Earth-bound object. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Per the IPEEE (Reference 7), the station can obtain the required minimum cooling water from the Dardanelle Reservoir through the canals based on the low water level of 336 ft. At a water level of 335 ft., the plant will be shut down and the water source shifted to the ECP. In addition, per the ANO-1 UFSAR, Section 9.3.2.4 (Reference 32, the average water depth of the pond is monitored daily to ensure that it is A decrease in the water level greater than or equal to the minimum depth specified in the TSs. The depth Low Lake or River is read from a permanently installed device in the pond and recorded in a log of the lake or river used for C1, C5 Water Level by plant personnel. Since day-to-day changes are expected to be power generation. insignificant, more than sufficient time is available to observe dangerous trends, e.g., decreasing water depth, and take appropriate action. Based on this review, the low lake level or river stage hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-32 1CAN122201 Page 33 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Effects on SSC operation due to abnormally low ambient temperatures Per the IPEEE (Reference 7), for winter operation, the ECP is designed to resulting from weather perform its safety function with an initial ice layer on the pond surface. Low Winter phenomena. Based on this review, the low winter temperature hazard is considered to be C1, C5 Temperature Secondary hazards resulting negligible. from low ambient There are no configuration specific considerations for this hazard. This temperatures include, but are hazard can be excluded from the RICT Program evaluation. not necessarily limited to, frost, ice cover, and snow. A release of energy due to the impact of a space object such as a meteoroid, comet, or human-caused satellite falling within the Earths atmosphere, a direct impact Per the IPEEE Report (Reference 7), this event has a very low annual with the Earths surface, or a probability of occurrence, less than 1E-9 (Section 2.10, NUREG-1407, combination of these effects. Reference 6); therefore, is eliminated on the basis of low frequency. Meteorite/Satellite This hazard is analyzed with PS4 Based on this review, the meteorite or satellite hazard is considered to be Strikes respect to direct impacts of negligible. an SSC and indirect impact There are no configuration specific considerations for this hazard. This effects such as thermal hazard can be excluded from the RICT Program evaluation. effects (e.g., radiative heat transfer), overpressure effects, seismic effects, and the effects of ejecta resulting from a ground strike. E4-33 1CAN122201 Page 34 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), there are no military installations, chemical plants, oil pipeline, or airports within 5 miles of the centerline of the reactor building. However, there is a natural gas pipeline located 600 feet A release of hazardous from the ANO-1 reactor building, which has been evaluated. Per ANO-1 material, a release of UFSAR, Section 2.2.6 (Reference 32), it has been concluded that the combustion products, an proximity of the gas line represents no safety hazard to the safe operation of explosion, or the generation the plant. Pipeline Accident C1, PS4 Additionally, per the ANO-2 UFSAR, Section 2.2.2, (Reference 39), the of missiles due to an accident involving the rupture of a probability of a rupture of this gas pipeline and subsequent ignition of the pipeline carrying hazardous gas is less than 1E-7 per year. materials. Based on this review, the pipeline accident hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. As stated previously, the ANO FE demonstrated that no doors, buildings, or propagation pathways that contain key SSCs are impacted by floodwaters Flooding that results from during the LIP event. The calculated ponding levels were below the local intense precipitation. controlling current design bases (CDB) event, which is a PMF from the Secondary hazards resulting Arkansas River coincident with upstream dam failure and wind-generated Precipitation, from local intense waves. C1 Intense precipitation, include, but are See also "External Flooding." not necessarily limited to, Based on this review, the Intense precipitation hazard is considered to be dam failure and river and negligible. stream overflow. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-34 1CAN122201 Page 35 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), chemicals stored onsite were A release of hazardous evaluated and an updated chemical hazardous survey was completed in material including, but not February 2020 (Reference 38). limited to liquids, combustion As stated in the updated survey, in the original plant design, chlorine was products, or radioactivity. stored onsite in one-ton cylinders for use as a water biocide. All chlorine has Such releases may be since been removed from the site since biocides based upon use of Release of concurrent with or induce an hypochlorite or bromine are now used. C4, PS1, Chemicals from explosion or the generation All chemicals stored onsite were evaluated in the updated survey and PS2 Onsite Storage of missiles. screened out consistent with RG 1.78 (Reference 40). In this context, an onsite See also "Toxic Gas." release of radioactivity is assumed to be associated Based on this review, the release of chemicals in onsite storage hazard is with low-level radioactive considered to be negligible. waste. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Per the IPEEE Report (Reference 7), upstream diversion/damming by land slide, ice blockage, or other cause is unlikely. The redirection of all or a In the unlikely event of upstream diversion or natural damming of the portion of river flow by natural Arkansas River by landslide, ice blockage, or other causes, there would be causes (e.g., a riverine sufficient storage in Dardanelle Reservoir to permit normal plant shutdown. River Diversion C1, C3 embankment landslide) or intentionally (e.g., power Based on this review, the river diversion hazard is considered to be production, irrigation). negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Persistent heavy winds Per the IPEEE Report (Reference 7), a sandstorm hazard is not relevant at transporting sand or dust that the ANO site. Sandstorm infiltrate SSCs at or in the C3 Based on this review, the sandstorm hazard is considered to be negligible. plants analyzed area There are no configuration specific considerations for this hazard. This causing functional failure. hazard can be excluded from the RICT Program evaluation. E4-35 1CAN122201 Page 36 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Flooding from water Per IPEEE Report (Reference 7), the Dardanelle Reservoir is not of displaced by an oscillation of sufficient size to be affected by surge or seiche flooding. the surface of a landlocked See also "External Flooding." Seiche body of water, such as a C3 lake, that can vary in period Based on this review, the seiche hazard is considered to be negligible. from minutes to several There are no configuration specific considerations for this hazard. This hours. hazard can be excluded from the RICT Program evaluation. Sudden ground motion or vibration of the Earth as produced by a rapid release of stored-up energy along an active fault. Secondary hazards resulting Seismic Activity from seismic activity include, N/A See Section 3 of this enclosure. but are not necessarily limited to, avalanche (both rock and snow), dam failure, industrial accidents, landslide, seiche, tsunami, and vehicle accidents. Per IPEEE Report (Reference 7), the roofs of all structures are designed for a conservative snow load of 20 psf. The accumulation of snow Snow storms may also result in a LOOP or plant trip. These events are could result in transportation addressed in the plant design basis and are modeled in the ANO-1 Internal accidents or directly cause Events PRA model. Snow C1, C4 dynamic loading or freezing See also "External Flooding." conditions as a result of snow cover. Based on this review, the snow hazard is considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-36 1CAN122201 Page 37 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Per the ANO-1 UFSAR, Section 2.6 (Reference 32), various investigations were performed to define site foundation conditions and regional and site Dynamic forces on geologic, geohydrologic, and seismological conditions. structures foundations due to As a result of the investigations performed, it was concluded that geologic, the expansion (swelling) and seismologic, and foundation conditions at the ANO site are adequate in all Soil Shrink-Swell C1 respects. contraction (shrinking) of soil resulting from changes in the Based on this review, the soil shrink-swell consolidation hazard can be soil moisture content. considered to be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. Flooding that results from an abnormal rise in sea level due to atmospheric pressure changes and strong wind The ANO site located on a peninsula of the Dardanelle Reservoir is not of generally accompanied by an sufficient size to be affected by surge or seiche flooding. Storm Surge intense storm. C3 Based on this review, the storm surge hazard is considered to be negligible. Secondary hazards resulting There are no configuration specific considerations for this hazard. This from a storm surge include, hazard can be excluded from the RICT Program evaluation. but are not necessarily limited to, high tide, river and stream overflow, and waves. E4-37 1CAN122201 Page 38 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria A release of hazardous toxic or asphyxiant gases. Such releases may be Toxic gas is covered under release of chemicals in onsite storage, industrial concurrent with or induce an or military facility accident, and transportation accident. explosion or the generation In addition, station procedures are established to address periodic control Toxic Gas of missiles. C4 room habitability self-assessments. In this context, an onsite Based on this review, the toxic gas hazard is considered to be negligible. release of radioactivity is There are no configuration specific considerations for this hazard. This assumed to be associated hazard can be excluded from the RICT Program evaluation. with low-level radioactive waste. Accidents involving transportation resulting in collision with SSCs, a release of hazardous materials or combustion products, an An updated evaluation was performed for transportation (mobile) accidents explosion, or a generation of that could impact the site (Reference 38). Mobile offsite sources evaluated missiles causing functional include barge traffic, rail traffic, and highway traffic. The total release failure of SSCs. frequency was less than 1E-6/yr. Transportation Hazards that could potentially No specific plant vulnerabilities were identified. PS2, PS4 Accidents result in transportation Based on this review, the transportation accidents hazard is considered to accidents include, for be negligible example, a vehicle, railcar or ship (boat) accident that There are no configuration specific considerations for this hazard. This involves a collision or hazard can be excluded from the RICT Program evaluation. derailment, potentially resulting in fire, explosions, toxic releases, missiles, or other hazardous conditions. E4-38 1CAN122201 Page 39 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Flooding that results from a series of long-period sea waves that displaces massive amounts of water as The location of ANO site located on a peninsula in Dardanelle Reservoir a result of an impulsive precludes the possibility of a tsunami. Tsunami disturbance, such as a major C3 Based on this review, the tsunami hazard is considered to be negligible. submarine slide or landslide. There are no configuration specific considerations for this hazard. This Secondary hazards resulting hazard can be excluded from the RICT Program evaluation. from a tsunami include, but are not necessarily limited to, river and stream overflow. Per the IPEEE Report (Reference 7), the annual probability of turbine generated missiles is less than 1.1E-8. In addition, per ANO-1 UFSAR, Damage to safety-related Section 14.1.2.9.5 (Reference 32), any missile resulting from a turbine-SSCs from a missile generator overspeed incident is not considered credible due to the generated internal or external redundancy and reliability of the turbine control and protection system, the to the plant PRA boundary control of oil purity, the periodic check of steam admission valve freedom, from rotating turbines or the periodic turbine disc inspections, and the high value of the bursting Turbine-Generated other external sources (e.g., overspeed. high-pressure gas cylinders). C1, PS4 In addition, the Unit 2 UFSAR, Section 3.5.2.2.2.1 (Reference 39), discusses Missiles Damage may result from a the probability of missiles generated due to failure of the Unit 1 and Unit 2 falling missile or a missile turbines at or near rated speed and during destructive overspeed. The ejected directly toward probabilities were shown to be much less than 1E-06/yr. safety-related SSCs (i.e., Based on this review, the turbine-generated missiles hazard is considered to low-trajectory missiles). be negligible. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-39 1CAN122201 Page 40 of 45 Screening Hazard Definition ANO-1 Disposition for TSTF-505 Criteria Opening of Earths crust resulting in tephra (i.e., rock fragments and particles ejected by volcanic eruption), lava flows, lahars (i.e., mud flows down volcano slopes), volcanic gases, pyroclastic flows (i.e., fast-moving flow of There are no active or dormant volcanoes located near the plant site. hot gas and volcanic matter moving down and away from Based on this review, the volcanic activity hazard is considered to be Volcanic Activity a volcano), and landslides. C3 negligible. Indirect impacts include There are no configuration specific considerations for this hazard. This distant ash fallout (e.g., tens hazard can be excluded from the RICT Program evaluation. to potentially thousands of miles away). Secondary hazards resulting from volcanic activity, include, but are not necessarily limited to, seismic activity and fire. Waves are bounded by other hazards that are considered and screen out An area of moving water that (e.g., seiche). is raised above the main See also "External Flooding." Waves surface of a body of water as C1, C4 a result of the wind blowing Based on this review, the waves hazard is considered to be negligible. over an area of fluid surface. There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation. E4-40 1CAN122201 Page 41 of 45 Table E4-6: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source C1. Event damage potential is NUREG/CR-2300 and ASME/ANS less than events for which plant is Standard RA-Sa-2009 designed. C2. Event has lower mean frequency and no worse NUREG/CR-2300 and ASME/ANS consequences than other events Standard RA-Sa-2009 analyzed. Initial Preliminary Screening C3. Event cannot occur close NUREG/CR-2300 and ASME/ANS enough to the plant to affect it. Standard RA-Sa-2009 C4. Event is included in the NUREG/CR-2300 and ASME/ANS definition of another event. Standard RA-Sa-2009 C5. Event develops slowly, allowing adequate time to ASME/ANS Standard RA-Sa-2009 eliminate or mitigate the threat. Progressive PS1. Design basis hazard cannot ASME/ANS Standard RA-Sa-2009 Screening cause a core damage accident. PS2. Design basis for the event NUREG-1407 and ASME/ANS meets the criteria in the NRC Standard RA-Sa-2009 1975 SRP. PS3. Design basis event mean frequency is < 1E-5/y and the NUREG-1407 as modified in mean conditional core damage ASME/ANS Standard RA-Sa-2009 probability is < 0.1. PS4. Bounding mean CDF is NUREG-1407 and ASME/ANS

                    < 1E-6/y.                               Standard RA-Sa-2009 Screening not successful. PRA NUREG-1407 and ASME/ANS Detailed PRA      needs to meet requirements in the Standard RA-Sa-2009 ASME/ANS PRA Standard.

1CAN122201 Page 42 of 45

6. Conclusions Based on this analysis of external hazards for ANO-1, no additional external hazards need to be added to the existing PRA models. The seismic and tornado missile external hazards were not screened for the RICT Program; therefore, penalty factors were developed that will be applied for each configuration where a RICT is invoked. The external hazards evaluation concluded that the hazards listed in Table E-5 (except for seismic and tornado missiles) either do not present a design-basis challenge to ANO-1, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.

In this application, all external hazards except seismic and tornado missile hazards are considered to be insignificant and will not be included in the RICT calculation. The ICDP/ILERP acceptance criteria of 1E-5/1E-6 will be used within the PHOENIX framework to calculate the resulting RICT and RMAT based on the total configuration-specific delta CDF/LERF attributed to internal events and internal fire, plus the seismic and tornado missile risk delta CDF/LERF values.

7. References
1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

(ADAMS Accession No. ML071200238), dated May 17, 2007

3. ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," Addendum A to RAS-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009
4. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk- Informed Decision Making," Revision 1, March 2017
5. NUREG-75/087, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition," 1975
6. NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991
7. Arkansas Nuclear One, IPEEE Other Events (Report (No. 94-R-0016-01), Revision 1, May 1995
8. Technical Specification Task Force (TSTF) Traveler TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2, dated November 21, 2018 1CAN122201 Page 43 of 45
9. 96-R-1006-02, Entergy Nuclear, "Individual Plant Examination for External Events (IPEEE) for SMA at ANO-01," Revision 0, May 1996
10. U.S. NRC, "Arkansas Nuclear One, Units 1 and 2 - Documentation of the Completion of Required Actions Taken in Response to the Lessons Learned from the Fukushima Dai-ichi Accident," (ADAMS Accession No. ML18163A418), dated August 28, 2020
11. NRC Letter to Power Reactor Licensees, "Final Determination of Licensee Seismic Probabilistic Risk Assessments [..] Regarding Recommendation 2.1 "Seismic" of the Near Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident," (ADAMS Accession No. ML15194A015), dated October 27, 2015
12. Attachment 3.1 to Reference 1, Unit 1 Areva Report 51-9218836-002, "Seismic Hazard Report - Arkansas Nuclear One Unit 1," March 31, 2014
13. Generic Issue (GI) 199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," U.S. NRC Information Notice (IN) 2010-18, Tables B.2, C.1 and C-2, (ADAMS Accession No. ML100270582), dated September 2, 2010
14. Entergy letter to NRC, "Seismic Hazard and Screening Report [] Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force (NTTF)

Review of Insights from the Fukushima Dai-ichi Accident Arkansas Nuclear One - Units 1 and 2," (ADAMS Accession No. ML14092A021), dated March 28, 2014

15. Seismic Probabilistic Risk Assessment Implementation Guide, EPRI, Palo Alto, CA: 2013, 3002000709
16. NRC letter to Entergy, Arkansas Nuclear One, Units 1 and 2, "Individual Plant Examination of External Events (Tac Nos. M83588 and M83589)," Enclosure, "Staff Evaluation Report of Individual Plant Examination of External Events (IPEEE) Submittal on Arkansas Nuclear One, Units 1 and 2," dated February 27, 2001
17. 95-SQ-2521-01, Entergy Operations, Arkansas Nuclear One Calculation, "Anchor Bolt Shear Capacity Evaluation of the T57 and 2T57 Emergency Diesel Fuel Tanks,"

Revision 0, January 1999

18. Entergy letter to NRC, Arkansas Nuclear One - Units 1 and 2 Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6, "Generic Letter 87-02 Completion Letter,"

TAC Nos. M69426 and M69427 (ADAMS Accession No ML993350052), dated November 18, 1999

19. Electric Power Research Institute (EPRI) NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Revision 1, August 1991
20. NUREG/CR-0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," May 1978 1CAN122201 Page 44 of 45
21. Vogtle Electric Generating Plant - Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

(Enclosure E3), September 13, 2012, (ADAMS Accession No. ML12258A055), dated September 13, 2012

22. Calvert Cliffs Nuclear Power Plant, Units 1 and 2 - License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML16060A223), dated February 25, 2016
23. Electric Power Research Institute (EPRI) "Seismic Evaluation Guidance, Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic," EPRI Report 1025287, (ADAMS Accession No. ML12333A170), dated February 2013
24. NRC letter to Exelon Generation Company, LLC, Braidwood Station, Units 1 and 2, and Byron Station, Unit Nos. 1 and 2 - Issuance of Amendments Nos. 206, 206, 212, and 212 RE: "Adoption of TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B' (EPID L-2018-LLA-0727)," (ADAMS Accession No. ML20037B221), dated March 30, 2020
25. PSA-ANO1-01-LE, Revision 2, "ANO-1 Level 2 LERF Analysis Notebook," January 2020
26. PSA-ANO1-01-SY-09, Revision 1, "ANO-1 PRA System Notebook - Appendix 09, Reactor Building Isolation (RBI)," April 2019
27. U.S. Nuclear Regulatory Commission, "Risk Assessment of Operational Events, Volume 2
    - External Events - Internal Fires - Internal Flooding - Seismic - Other External Events -

Frequencies of Seismically-Induced LOOP Events (RASP Handbook)," Revision 1.02, (ADAMS Accession No. ML17349A301), dated November 2017

28. RG 1.76, "Design-basis Tornado and Tornado Missiles for Nuclear Power Plants,"

April 1974

29. NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2, February 2007
30. High-Wind Risk Assessment Guidelines, EPRI, Palo Alto, CA: 2015. 3002003107
31. PSA-A1-06-4B-TMPF, "ANO-1 Tornado Missile Penalty Factor Calculations for RICT Application"
32. Updated Final Safety Analysis Report, Amendment 31, Arkansas Nuclear One - Unit 1
33. NUREG-0800, "Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants," Chapter 3.5.1.6, "Aircraft Hazards," Revision 4, March 2010 1CAN122201 Page 45 of 45
34. Entergy letter to NRC, "Flooding Hazard Re-evaluation Report - Required Response for Near-Term Task Force (NTTF) Recommendation 2.1," (ADAMS Accession No. ML16260A060), dated September 14, 2016
35. Entergy letter to NRC, "Focused Evaluation for External Flooding," (ADAMS Accession No. ML17153A212), dated May 31, 2017
36. NRC letter to Entergy, "Arkansas Nuclear One, Units 1 and 2 - Staff Assessment of Flooding Focused Evaluation (CAC NOS. MF9809 AND MF9810; EPID L-2017-JLD-0011)," (ADAMS Accession No. ML17214A029), dated February 12, 2018
37. NUREG-0800, Chapters 2.2.1-2.2.2, "Identification of Potential Hazards in Site Vicinity,"

Revision 3, March 2007

38. Calc 96-E-009-01, Revision 1, "Offsite Toxic Gas Release Probabilistic Safety Assessment," February, 2020
39. Updated Final Safety Analysis Report, Amendment 29, Arkansas Nuclear One - Unit 2
40. RG 1.78, "Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," Revision 1, (ADAMS Accession No. ML013100014), December 2001
41. NRC Regulatory Guide 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3, December 2020

Enclosure 5 1CAN122201 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) 1CAN122201 Page 1 of 2 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

1. Introduction Section 4.0, Item 6, of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," (Reference 2) requires that the license amendment request (LAR) provide the plant-specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm applicability of the limits of Regulatory Guide (RG) 1.174, Revision 1 (Reference 3). (Note that RG 1.174, Revision 3 (Reference 4),

issued by the NRC in January 2018, did not revise these limits.) The purpose of this enclosure is to demonstrate that the Arkansas Nuclear One, Unit 1 (ANO-1) total CDF and total LERF are below the guidelines established in RG 1.174. RG 1.174 does not establish firm limits for total CDF and LERF, but it recommends that risk-informed applications be implemented only when the total plant risk is no more than about 1E-4/year for CDF and 1E-5/year for LERF. Demonstrating that these limits are met confirms that the risk metrics of NEI 06-09 can be applied to the ANO-1 Risk Informed Completion Time (RICT) Program.

2. Technical Approach Table E5-1 lists the CDF and LERF point estimate values that resulted from a quantification of the baseline internal events (including internal flooding) and fire probabilistic risk assessment (PRA) models (References 5, 6, 7, and 8, respectively). This table also includes an estimate of the seismic contribution to CDF and LERF based on the methodology detailed in , Section 3. Other external hazards are below accepted screening criteria and, therefore, do not contribute significantly to the totals.

Table E5-1 Total Baseline CDF/LERF ANO-1 Baseline CDF ANO-1 Baseline LERF Source Contribution Source Contribution Internal Events PRA 6.5E-06 Internal Events PRA 3.5E-08 Fire PRA 4.6E-05 Fire PRA 3.0E-06 Seismic 5.5E-06 Seismic 2.6E-06 No significant No significant Other External Events Other External Events contribution contribution Total CDF 5.8E-05 Total LERF 5.7E-06 As demonstrated in Table E5-1, the total CDF and total LERF are within the guidelines set forth in RG 1.174 and support small changes in risk that may occur during RICT entries following implementation of Technical Specification Task Force (TSTF) Traveler TSTF-505, 1CAN122201 Page 2 of 2 Revision 2, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b." Therefore, ANO-1 TSTF-505 implementation is consistent with NEI 06-09-A guidance. Procedures will require a check of the overall PRA results against the RG 1.174 thresholds in the PRA model update procedures.

3. References
1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

(ADAMS Accession No. ML071200238), dated May 17, 2007

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0, (ADAMS Accession No. ML12286A322), dated October 12, 2012

3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (ADAMS Accession No. ML023240437), November 2002
4. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, (ADAMS Accession No. ML17317A256), January 2018
5. PSA-ANO1-01, Revision 2, "ANO-1 PSA Summary Report for Level 1 Model 6p0,"

December 2019

6. PSA-ANO1-01-LE, Revision 2, "ANO-1 Level 2 LERF Analysis Notebook," January 2020
7. PSA-ANO1-01-IF-QU, Revision 1, "Arkansas Nuclear One Unit 1 Internal Flooding Quantification Report," January 2020
8. PSA-ANO1-03, Revision 2, "ANO-1 Fire Probabilistic Risk Assessment (FPRA) Summary Report," March 2022

Enclosure 6 1CAN122201 Justification of Application of At-Power PRA Models to Shutdown Modes 1CAN122201 Page 1 of 1 Justification of Application of At-Power PRA Models to Shutdown Modes is not applicable because the Risk Informed Completion Time (RICT) Program is not being applied to shutdown modes.

Enclosure 7 1CAN122201 PRA Model Update Process 1CAN122201 Page 1 of 3 PRA Model Update Process

1. Introduction Section 4.0, Item 8 of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 2), requires that the license amendment request (LAR) provide a discussion of the licensees programs and procedures which assure the probabilistic risk assessment (PRA) models which support the RMTS are maintained consistent with the as-built/as-operated plant.

This enclosure describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications, will be identified and reviewed prior to implementation to determine if the changes could impact the PRA models per EN-DC-151, "PRA Maintenance and Update" (Reference 3). The configuration control program will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models. Should a plant change or a discovered condition be identified that has a significant impact to the RICT Program calculations as defined by the above procedures, an unscheduled update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until the changes are fully implemented into the PRA models. Periodic updates will be performed every two refueling cycles in accordance with the requirements of NEI 06-09.

2. PRA Model Update Process Internal Event, Internal Flood, and Fire PRA Model Maintenance and Update The Entergy Operations, Inc. (Entergy) fleet PRA maintenance process ensures that the applicable PRA model used for the RICT Program reflects the as-built/as-operated plant for Arkansas Nuclear One - Unit 1 (ANO-1). The PRA configuration control process delineates the responsibilities and guidelines for updating the full power internal events, internal flood, and fire PRA models, and includes both periodic and unscheduled PRA model updates.

The process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the real time risk model. The Entergy PRA maintenance and update processes are governed by procedures. Industry best practices and consensus modeling techniques are also reviewed and monitored to ensure Entergy PRA is using state of the art processes and methods. 1CAN122201 Page 2 of 3 Review of Plant Changes for Incorporation into the PRA Model The Entergy governing procedure for PRA updates is EN-DC-151 "PSA Maintenance and Update" (Reference 3). This procedure provides governance for periodic and interim model updates. Periodic model updates are performed every two refueling cycles while interim model updates are determined to be necessary if a model change is identified of sufficient importance to the model such that a special update is required. EN-DC-151 lists the ways that a change to the PRA can be initiated (including engineering changes, procedure revisions, Nuclear Licensing revisions, model improvements, plant-specific data changes, and industry research). Each change is evaluated as having an effect on the PRA results in the initiation of a model change request (MCR). The MCR is entered into the fleet MCR database and tracked to completion there. Each MCR is graded per the criteria and any MCR that receives a grade of "A" requires an interim model update. MCR Grade "A" is defined as "Extremely important and necessary to assure the technical adequacy of the PRA or quality of the PRA." As part of the implementation of the RICT program, EN-DC-151 will be updated to include more specific criteria for significant model change requests requiring interim model updates (Grade A MCRs). Significant model change requests will be defined as greater than 25% increase in core damage frequency (CDF) or large early release frequency (LERF). If the 25% increase in CDF or LERF criteria is exceeded, then use of the RICT program is suspended until the issue can be addressed, except when the deviation is such that impacted RICTs remain conservative. The PRA engineer may also perform and document a standalone, interim analysis that justifies continued use of the RICT program if the results of the analysis bound the issue documented in the MCR database. For example, the interim analysis could involve additional PRA refinement to model the system and/or issue in greater detail. The station will move forward with an unscheduled PRA update if the 25% CDF or LERF increase criteria are exceeded regardless of whether interim analyses justify continued use of the RICT program (i.e., interim analyses do not allow deferring an unscheduled PRA update when the criteria are exceeded, but these analyses can defend continued use of the program while the unscheduled PRA update is being implemented). If it is not practical to assess the impact quantitatively, then a qualitative assessment, utilizing the experience and judgment of the PRA engineer, is performed considering the potential change in basic event importance measures for each application. This assessment utilizes the experience and judgment of the PRA engineer to determine if there are any issues that are individually negligible but could collectively impact the RICT program. If a PRA model change is required for the CRMP model, but cannot be immediately implemented for a significant plant change or discovered condition, either one of the following is applied:

  • Analysis to address the expected risk impact of the change will be performed. In such a case, these interim analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A.

OR 1CAN122201 Page 3 of 3

  • Appropriate administrative restrictions on the use of the RICT program for extended Completion Time are put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.
3. References
1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

(ADAMS Accession No. ML071200238), dated May 17, 2007

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

3. EN-DC-151, Revision 9, "PRA Maintenance and Update"

Enclosure 8 1CAN122201 Attributes of the Real-Time Risk Model 1CAN122201 Page 1 of 5 Attributes of the Real-Time Risk Model

1. Introduction Section 4.0, Item 9, of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 2), requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support the RMTS. This includes identification of how the baseline PRA model is modified for use in the configuration risk management program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. NEI 06-09, Revision 0-A, uses the term CRMP for the program controlling the use of RMTS. This term is also used to designate the program implementing 10 CFR 50.65(a)(4) and the monitoring program for other risk informed LARs. To avoid confusion, the term Risk-Informed Completion Time (RICT) Program is used to indicate the program required by NEI 06-09, Revision 0-A, in lieu of the term CRMP. This item should also confirm that the RICT Program tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant-specific submittal.

This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the real time risk (RTR) tool to support the RICT Program. The process employed to adapt the baseline models is demonstrated:

1. to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results;
2. to maintain the quality of the peer-reviewed PRA models; and
3. to correctly accommodate changes in risk due to configuration-specific considerations.

Quality controls and training programs applicable for the RICT Program are also discussed in this enclosure.

2. Translation of Baseline PRA Model for Use in Configuration Risk The models that will be used to analyze the internal events, internal flood, and internal fire hazards for the RICT Program are the peer reviewed, baseline PRA models. These models are updated when necessary to incorporate plant changes to reflect the as-built/as-operated plant. The models may be optimized for quantification speed but are verified to provide the same result as the baseline models in accordance with approved procedures. Additionally, a single top fault tree model will be developed for calculation of CDF and LERF. The single-top model will calculate the total average annual CDF and LERF from internal events, internal floods, and internal fires and combine the numerical risk results for use in the RICT program.

The results obtained from the integrated single-top model are validated against the baseline model results to ensure the single-top model is properly calculating CDF and LERF. 1CAN122201 Page 2 of 5 The RTR tool will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. The PRA models utilize system initiator event fault trees so equipment unavailabilities can be captured explicitly in these system initiator fault trees. Therefore, no adjustment to initiating event frequencies are required within the RTR tool. The baseline PRA models are modified as follows for use in configuration risk calculations:

  • The unit availability factor is set to 1.0 (unit available).
  • Maintenance unavailability is set to zero/false unless unavailable due to the actual (at the time) configuration.
  • Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.
  • Plant-specific configurations and alignments will be evaluated as needed. For systems where some trains or components are in service and some in standby (system alignments), or there are seasonal dependencies, the RTR tool addresses the average configuration of the plant. The RTR model used for the RICT Program is required to either conservatively model these variations or include the capability to account for the variations given configuration-specific equipment alignments in effect at the time of a RICT calculation if system alignment is determined to impact the calculated RICT time.
  • Changes in success criteria based on the time in the core operating cycle (i.e., impact on anticipated transient without scram (ATWS) pressure relief) will be addressed in the RTR model.

The configuration risk software is designed to quantify the specific configuration for internal events (including internal flooding) and fire, while including the contribution from seismic and high winds penalty when calculating the Risk Management Action Times (RMAT) and RICT. Full quantifications will be used for each configuration. If there are any changes in the underlying PRA, the PRA results database in the RTR tool will be updated in accordance with the RTR update procedure. The unique aspect of the configuration risk software for the RICT Program is the quantification of fire risk and the inclusion of the seismic and high winds penalty. The other adjustments above are those used for the evaluation of risk under the 10 CFR 50.65(a)(4) program. Systems with shared components or capability across units which are credited in the RTR models are able to be represented in both unit PRA models simultaneously, reflecting availability or unavailability of the shared system to each unit based on the actual plant configuration. For a RICT program entry, the unit RTR tool will reflect the actual configuration of the plant, including availability or unavailability of shared systems and components.

3. Quality Requirements and Consistency of PRA Model and Configuration Risk Tools The approach for establishing and maintaining the quality of the PRA models, including the configuration risk model, includes both a PRA maintenance and update process (described in ), and the use of self-assessments and independent peer reviews (described in ).

1CAN122201 Page 3 of 5 The information provided in Enclosure 2 demonstrates that the sites internal event, internal flood, and internal fire PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 3). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions. For maintenance of an existing configuration risk model, changes made to the baseline PRA model in translation to the configuration risk model will be controlled and documented. An acceptance test is performed after every configuration risk model update. This testing also verifies correct mapping of plant components to the basic events in the configuration risk model. These actions are directed via the Risk Monitor Model Development and Control guide (Reference 7). The RTR model documentation will include changes made to the model of record (MOR) files to work with the RTR model software (e.g., quantification settings) along with verification that results are consistent between the RTR and PRA zero maintenance results (per guidance in Reference 7). In addition, the RTR update for the MOR will include quantifying the RTR model for representative maintenance configurations and examining the results for appropriateness. These actions will be procedurally controlled. Generally, updates are expected on a frequency of once every two fuel cycles in accordance with the scheduled PRA model update frequency but the RTR updates may be performed on more frequent basis, or to align with an emergent MOR update.

4. Training and Qualification The PRA staff is responsible for development and maintenance of the configuration risk model.

Operations and Work Control staff will use the configuration risk tool under the RICT Program. PRA Staff and Operations are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is also accredited by the Institute of Nuclear Power Operations (INPO).

5. Application of the Configuration Risk Tool to the RICT Program Scope The Electric Power Research Institute (EPRI) PHOENIX software will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. This program is specifically designed to support implementation of RMTS. PHOENIX will permit the user to evaluate all configurations within the scope of the RICT Program using appropriate mapping of equipment to PRA basic events. The RICT program will meet RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1 (Reference 4), and Entergy software quality assurance requirements.
6. Treatment of Common Cause Events The PRA models calculate Common Cause Basic Event (CCBE) probabilities from alpha factors and places the basic events under appropriate gates in the fault tree.

1CAN122201 Page 4 of 5 Adjustments to the common cause failure (CCF) grouping or CCF probabilities are not necessary when a component is taken out-of-service for preventative maintenance:

  • The component is not out-of-service for reasons subject to a potential CCF, and, therefore the in-service components are not subject to increases in common cause probabilities.
  • CCF relationships are retained for the remaining in-service components.
  • The net failure probability for the in-service components includes the CCF contribution of the out-of-service component.

As described in RG 1.177, "An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications," Revision 2 (Reference 6), Section A-1.3.2.2, the CCF term should be treated differently when a component is removed from service for preventive maintenance (PM) than as described for failure of a component. For PMs, the CCF is changed so that the model represents the unavailability of the remaining component. In the example provided in RG 1.177 for a two-train system, the CCF event can be set to zero for PMs. This is done so that the model represents the unavailability of the remaining component, and not the common cause multiplier. The ANO-1 approach is conservative in that for a two-train system, the CCF event is retained for the component removed from service. Likewise, for systems with three or more trains, the CCF events that are related to the out-of-service component are retained. The Vogtle RICT Safety Evaluation (SE) (Reference 5) describes the Vogtle approach for modeling common cause events with planned inoperability: "For planned inoperability, the licensee sets the appropriate independent failure to 'true' and makes no other changes while calculating a RICT." The ANO-1 approach is the same as this Vogtle approach. It is recognized that other modifications could be made to CCF factors for planned maintenance, particularly for common cause groups of three or more components. For example, in the Vogtle RICT SE (Reference 5), the NRC identifies a possible planned maintenance CCF modification to "modify all the remaining basic event probabilities to reflect the reduced number of redundant components." Like Vogtle, the ANO-1 CCF approach is a straightforward simplification that has inherent uncertainties. In the context of modifying CCF basic events for PMs, the Vogtle SE states the following:

   "The NRC staff also notes that common cause failure probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce non-conservative results and because the calculations reasonably include common cause failures consistent with the accuracy of the estimates." (Reference 5)

The ANO-1 approach for CCF during PMs is the same as the Vogtle approach; therefore, the ANO-1 CCF approach is acceptable for RICT calculations, and adjusting the common cause grouping is not necessary for PMs. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. 1CAN122201 Page 5 of 5 For emergent conditions where the extent of condition is not completed prior to entering into the RMAT or the extent of condition cannot rule out the potential for CCF, common cause Risk Management Actions (RMAs) are expected to be implemented to mitigate CCF potential and impact, in accordance with ANO-1 procedures. This is consistent with the guidance of NEI 06-09 and precludes the need to adjust CCF probabilities. However, if a numeric adjustment is performed to account for CCFs, the RICT calculation is adjusted to numerically account for the increased possibility of CCFs in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

7. References
1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI),"Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

(ADAMS Accession No. ML071200238), dated May 17, 2007

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

3. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009
4. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, January 2018
5. Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Regarding Implementation of Topical Report Nuclear Energy Institute NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specification (RMTS)

Guidelines," Revision 0-A (CAC NOS. ME9555 and ME9556), (ADAMS Accession No. ML15127A669), dated August 8, 2017

6. Nuclear Regulatory Commission, Regulatory Guide 1.177, "An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications," Revision 2, (ADAMS Accession No. ML20164A034), January 2021
7. EN-NE-G-015, "Risk Monitor Model Development and Control," Revision 5, February 2022

Enclosure 9 1CAN122201 Key Assumptions and Sources of Uncertainty 1CAN122201 Page 1 of 49 Key Assumptions and Sources of Uncertainty

1. Introduction The purpose of this enclosure is to disposition the impact of probabilistic risk assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.

Topical Report NEI 06-09-A "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1), Section 2.3.4, Item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties. The baseline internal events/internal flooding PRA (IE/IF PRA) and fire PRA (FPRA) models have assumptions and sources of uncertainty, and these were reviewed during the model peer reviews. The approach taken was, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results, and to provide dispositions for the RICT Program. The epistemic uncertainty analysis approach applies to the internal events PRA and any epistemic uncertainty impacts that are unique to the internal flood and fire PRAs. In addition, Topical Report NEI 06-09-A requires that the uncertainty be addressed in the RICT Program Configuration Risk Management Program (CRMP), otherwise referred to as the Real-Time Risk (RTR), by consideration of the translation from the PRA model to the RTR model. The RTR model discussed in Enclosure 8, also referred to as the PHOENIX model, includes internal events, flooding events, and fire events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the RTR tool during RICT Program calculations.

2. Assessment of Internal Events/Internal Flooding (IE/IF) PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty, the internal events baseline PRA model uncertainty report was developed, based on the guidance in NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making" (Reference 2), and EPRI 1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments" (Reference 3). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.

The State of Knowledge Correlation (SOKC), included within the parametric uncertainty evaluation, was addressed as part of the Arkansas Nuclear One, Unit 1 (ANO-1) baseline PRA model quantification. The parametric uncertainty evaluation for the IE/IF PRA model is documented in PSA-ANO1-01-QU-01, "ANO-1 PSA Uncertainty and Sensitivity Analysis" (Reference 4). The ANO-1 database uses type codes to perform the SOKC. Generic failure rates use variables so that correlations are maintained and the UNCERT computer code was run to propagate the probability distributions using a Monte Carlo analysis. The results of this analysis confirmed little variability in the overall results and, therefore, parametric uncertainty is not a source of uncertainty in the RICT program. 1CAN122201 Page 2 of 49 Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions made for each of the ANO-1 IE/IF PRA technical elements are noted in the respective Source of Uncertainty Notebooks, References 5 and 6. The IE/IF PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty, and characterizing that uncertainty, as necessary. The Electric Power Research Institute (EPRI) compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 3), and the evaluation performed for ANO-1 considered each of the generic sources of modeling uncertainty as well as the plant-specific sources. Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for the impact on a specific application. No specific issues of PRA completeness have been identified relative to the RICT application, based on the results of the IE/IF PRA and FPRA peer reviews. Based on following the methodology in EPRI TR-1016737 (Reference 3) for a review of sources of uncertainty, the impact of potential sources of uncertainty on the RICT application is discussed in Table E9-1, which identifies those potential sources that may be key sources of uncertainty for the RICT program. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration. All generic and plant specific sources of uncertainty in the full power IE/IF (FPIE/IF) PRA have been reviewed and assessed for the RICT program and are documented in PSA-ANO1-06-4B-SOU, "ANO-1 PRA - Assessment of Key Assumptions and Sources of Uncertainty for TSTF-505 (RICT) Submittal" (Reference 7). Digital subcomponents for the Engineered Safeguards Actuation System (ESAS) are implicitly modeled in the PRA. The ESAS in the PRA models the analogue inputs and the associated relays used to initiate the ESAS signals. The digital subcomponents are not modeled and, therefore, are not a key source of uncertainty in the RICT application. 1CAN122201 Page 3 of 49 Table E9-1: Internal Events Characterization of Generic Sources of Modeling Uncertainty Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Initiating Event Analysis (IE) The overall approach for the LOOP frequency estimation generally follows industry best-The loss of offsite power practice PRA methods but (LOOP) frequency is a The LOOP notebook presents the merging the LOOP categories is function of several factors LOOP frequency calculation for The generic industry frequencies for not a consensus approach. including switchyard design, each of the LOOP events the four LOOP event categories Based on the importance results, the number and (plant-centered, switchyard, developed in NUREG/CR-6890, LOOP frequency may be a independence of offsite weather-related and grid-related). "Reevaluation of Station Blackout potential source of uncertainty. power feeds, the local power The analysis utilizes the Risk at Nuclear Power Plants" The four LOOP event Applications pertaining to or production and consumption NUREG/CR-6890 LOOP (Reference 22), are applicable to the

1. Grid stability LOOP sequences categories are merged into a affected by LOOP scenarios environment, and the degree database. The raw data was ANO site. The generic industry single LOOP frequency event. should further evaluate plant-of plant control of the local analyzed to consider removing frequencies are appropriate to use as specific LOOP frequency as a grid and grid maintenance. events that would not apply to priors to develop a plant-specific potential source of uncertainty.

Three different aspects ANO-1. The resulting generic LOOP frequency. The plant-specific relate to this issue: data population was data is sufficient for the Bayesian The overall approach for the Bayesian-updated using ANO-1 update. LOOP frequency and failure to 1a. LOOP initiating event plant-specific experience. recover probabilities utilized is frequency values and consistent with industry practice. recovery probabilities Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 4 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 The approach and data for consequential LOOP frequency estimation generally follows industry best-practice PRA methods, but is not yet considered a consensus model approach. Consequential LOOP scenarios may be a potential source of uncertainty. Applications pertaining to or affected by these scenarios should further evaluate consequential LOOP as a potential source of uncertainty. The possibility that offsite power A realistic with slight conservative bias The generic industry data for The frequency for slant on the consequential LOOP is lost as a result of the consequential LOOP is consequential LOOP developed in probabilities is utilized. Conditional reactor/turbine trip is modeled. calculated for an ECCS signal LOOP probabilities can impact 1b. Conditional LOOP Consequential Consequential LOOP frequencies NUREG/CR-6890 (Reference 22) is and general plant trips: important sequences and is probability LOOP sequences are calculated following an applicable to the ANO-1 site. considered a potential source of Emergency Core Cooling System The consequential LOOP events are LOSP-ECCS = 2.4E-02 uncertainty for the PRA. However, (ECCS) signal or a plant trip in there is no justifiable alternative, i.e., similar to other loss of grid events. LOSP-EPRI = 1.0E-03 the LOOP notebook. an industry standard approach per NUREG/CR-6890 (Reference 22) has been used. For example, assuming higher or lower probabilities would represent a sensitivity but there would be no basis for deviating from the best-estimate values currently used in the PRA. Conditional LOOP has been included as a sensitivity in Sensitivity #5 in Section 8.5 of PSA-ANO1-06-4B (Reference 7) and is not a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 5 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Availability of DC power to perform restoration actions is judged to not be a source of model uncertainty. The batteries are assumed to be LOOP or required for their associated Credit for skill-of-the-trade actions 1c. Availability of DC power consequential diesel generator to be started (at Long term DC power to perform would not provide a significant to perform restoration LOOP sequences least to close the diesel generator restoration actions is provided from N/A reduction in LOOP and station actions with offsite power (DG) output circuit breaker or to the batteries. blackout (SBO) sequences, and recovered flash the field on the DG when such credit for recovery of offsite required). power without DC power would introduce other uncertainties. Therefore, this is not considered a Key Source of Uncertainty for the ANO-1 RICT application. Support System Initiating Event fault trees are developed for Feedwater/Condensate, loss of Service Water, loss of Instrument Increasing use of plant-Air, and loss of Intermediate specific models for support Cooling Water. system initiators (e.g., loss of CL, CC, or IA, and loss of All of the initiating event AC or DC buses) have led to The modeling of support system frequencies were developed inconsistencies in initiating events follows industry using system fault tree models. approaches across the Common cause failures and the best-practice PRA methods. No For normally-operating systems,

2. Support System industry. A number of Support system potential for recovery are treated modeling uncertainties are judged one train was assigned a run time N/A Initiating Events challenges exist in modeling event sequences explicitly in the modeling of support to exist. Therefore, this is not of one year. The standby train of support system initiating system initiating events. considered a key source of was assigned a mission time of events: uncertainty for the ANO-1 RICT the mean time to repair (MTTR) application.

for that train, or the allowable 2a. Treatment of common Limiting Condition for Operation cause failures (CCFs) (LCO) Completion Time. 2b. Potential for recovery Recovery of the failed system or train through human intervention was credited as appropriate in the fault tree models. 1CAN122201 Page 6 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737

a. The initiating event frequency a. Published frequency used for this for pressure vessel rupture extremely rare event. No No modeling uncertainties are (excessive LOCA) is based on significant assumptions were judged to exist for LOCA initiating PWR Owners Group Project made. event frequencies for the base It is difficult to establish PA-RMSC-0463, "White Paper model. The LOCA modeling and values for events that have on Consideration of Reactor frequency values represent never occurred or have Vessel Failure in Plant- present state-of-the-art modeling rarely occurred with a high Specific PRA Models for and their use is considered an level of confidence. The PWRs" (Reference 24). industry good practice, which has
3. LOCA initiating choice of available data sets been used in Peer Reviewed event or use of specific LOCA sequences b. The large-, medium-, and b. Industry consensus approach N/A industry PRAs. As such, this frequencies methodologies in the small-break LOCA mean used. No significant assumptions. meets the intent of consensus determination of loss of frequency from model approach as defined in coolant accident (LOCA) NUREG/CR-6928, Regulatory Guide (RG) 1.200, frequencies could impact "Industry-Average Reference 23), and is not required base model results and Performance for Components to be retained as a candidate some applications. and Initiating Events at U.S. modeling uncertainty. Therefore, Commercial Nuclear Power this does not represent a key Plants" (Reference 13), was source of uncertainty for the used for the LOCA ANO-1 RICT application.

frequencies. 1CAN122201 Page 7 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Accident Sequence Analysis (AS) No credit for equipment operation after battery depletion may SBO events are important represent a slight conservative contributors to baseline core treatment. Realistic assumptions damage frequency (CDF) at Because there are no ANO-1 are made for systems that allow Systems that normally require operation without control power nearly every U.S. nuclear procedures for recovering power Operation of systems without DC DC power for operation are not (EFW) as directed by procedures. power plant. In many cases, Credit for continued after the batteries are depleted, power that normally require DC power credited for continued This should not be a source of battery depletion may be operation of these no credit is taken for continued for operation is not readily viable, operation upon battery model uncertainty in most

4. Operation of assumed to lead to loss of all systems in operation of any systems that except in situations where the design depletion in the event applications.

equipment after system capability. Some sequences with normally require DC power for allows operators to manually control sequence modeling. The only battery depletion PRAs have credited manual batteries depleted operation. The only exception is the system. This is only applicable to exception is turbine-driven No credit for equipment operation operation of systems that (e.g., long term manual control of turbine-driven turbine-driven EFW flow to SGs A EFW flow to SG A or B, which after battery depletion may normally require DC power SBO sequences) EFW flow to Steam Generators or B. may be operated successfully represent a slight conservatism for successful operation (SGs) A or B after battery without control power. but this approach is consistent (e.g., turbine driven systems depletion. with standard industry practice. such as Emergency Feedwater (EFW)). Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 8 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 ANO-1 uses the RCP seal failure model of WCAP-16175-P-A which is an industry consensus model for RCP seal failure on Combustion Engineering (CE) plants. WCAP 16175-P is for CE plants, which Accident is an issue for B&W plants and other The modeling of RCP seal LOCAs

5. Reactor Coolant plants using a specific N-9000 seal The assumed timing and sequences uses an industry consensus model Pump (RCP) type with slotted carbon. ANO-1 magnitude of RCP seal involving loss of ANO-1 estimates a conservative which was reviewed and approved seal LOCA currently uses the timing basis from LOCAs given a loss of seal seal cooling. flow rate between 38.75 and The failure probability of by the NRC. Therefore, there is treatment - ANO-2 (WCAP 16175-P) to trip the cooling can have a Failure of RCP seal 44.93 lbm/s per pump given N-9000 seals is about 1E-4. no impact on overall results and Pressurized RCPs. Entergy maintains a substantial influence on the cooling could result failure of the RCP seals. does not represent a key source Water Reactors documented basis for the ANO-1 risk profile. in an RCP seal of uncertainty for the ANO-1 RICT (PWRs) specific seals that provides at least LOCA. application.

one hour before needing to trip the RCPs but is currently not an industry approved document and not credited in the PRA. Therefore, WCAP 16175-P provides a conservative basis for ANO-1 seal integrity (on loss of cooling).

6. Recirculation pump seal leakage treatment -

Boiling Water Not applicable to ANO-1. Reactors (BWRs) with isolation condensers 1CAN122201 Page 9 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Success Criteria (SC)

7. Impact of containment venting on core cooling system Not applicable to ANO-1.

net positive suction head (NPSH) Loss of containment heat removal leading to long-term containment over-pressurization and failure can be a significant contributor in some PRAs. Consideration of the containment failure mode There are not significant might result in additional The environmental conditions assumptions or impact on the

8. Core cooling mechanical failures of Core cooling resulting from each sequence is model. Therefore, the impact of success credited systems. success following explicitly discussed in the Reactor Building (RB) failure on following Containment venting through containment failure. Accident Sequence notebook. core cooling is not a source of containment "soft" ducts or containment Conditions that can impact the No significant assumptions. No impact on model. uncertainty for the ANO-1 base failure or venting failure can result in loss of Long term loss of system models, are included PRA and for applications.

through non-hard core cooling due to decay heat removal (e.g., impact of feedline break on pipe vent paths environmental impacts on (DHR) sequences. system operation is capture in the Therefore, this does not represent equipment in the fault tree). a key source of uncertainty for the reactor/auxiliary building, ANO-1 RICT application. loss of NPSH on ECCS pumps, steam binding of ECCS pumps, or damage to injection piping or valves. There is no definitive reference on the proper treatment of these issues. 1CAN122201 Page 10 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Loss of heating, ventilation, and air conditioning (HVAC) can result in room temperatures exceeding equipment qualification DHR room cooling is assumed to be Room heat-up and associated limits. Treatment of HVAC required for the low pressure equipment failures are not a requirements varies across recirculation (LPR) and DHR modes source of uncertainty. PRA the industry and often varies Dependency on The following HVAC of low pressure injection (LPI) system modeling is realistic and based on within a PRA. There are two HVAC for system dependencies are modeled in the operation. Room cooling is assumed Components required to supporting calculations. The aspects to this issue. One modeling and ANO-1 PRA: to not be required during injection provide room cooling to the modeled HVAC dependencies

9. Room heat-up mode because the Borated Water involves whether the timing of accident DHR and DG rooms contribute may be slightly conservative and calculations
  • LPI system (LPR and DHR Storage Tank (BWST) water result in a slight increase in risk structures, systems, or progressions and to failure of LPI and DG modes only) temperature is lower than it would be but is not judged to be significant components (SSCs) affected associated success systems.

by loss of HVAC are criteria.

  • DG rooms during ECCS recirculation or DHR. enough to affect the results.

assumed to fail (i.e., there is The failure of fans or the air louver in Therefore, this does not represent uncertainty in the fragility of the DG rooms is assumed to fail the a key source of uncertainty for the the components). The other affected DG. ANO-1 RICT application. involves how the rate of room heat-up is calculated and the assumed timing of the failure. 1CAN122201 Page 11 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Battery depletion times and SBO events are important associated accident sequence contributors to baseline CDF timing and related success criteria at nearly every U.S. nuclear are not a source of uncertainty. power plant. Battery life is PRA modeling is realistic and an important factor in The analysis assumes that the based on supporting calculations. assessing a plants ability to battery chargers or the batteries The analysis assumes that the Determination of cope with an SBO. Many can carry the required loads at battery chargers or the batteries battery depletion plants only have Design any time during the mission time No impact on model. can carry the required loads at time(s) and the The battery depletion time of five

10. Battery life Basis calculations for battery such that they are redundant. Assumptions judged to be any time during the mission time associated hours is used for success criteria calculations life. Other plants have very reasonable based on realistic such that the two are redundant.

accident sequence The results of detailed battery purposes. plant/condition-specific assessments of battery life. The results of detailed battery timing and related discharge calculations indicate calculations of battery life. discharge calculations indicate success criteria. battery depletion time for the PRA Failing to fully credit battery battery depletion time for the PRA capability can overstate risks is five hours. is five hours, which is used for and mask other potentially success criteria purposes. contributors and insights. Realistically assessing Therefore, this does not represent battery life can be complex. a key source of uncertainty for the ANO-1 RICT application. PWR Emergency Operating System logic The success criteria for high Procedures (EOPs) direct modeling pressure injection (HPI) cooling opening of all PORVs to representing includes one electromatic relief

11. Number of reduce Reactor Coolant success criterion valve (ERV) which serves a power-operated System (RCS) pressure for and accident similar function as a PORV and There is only one ERV for ANO-1.

relief valves initiation of bleed and feed sequence timing for two safety relief valves (SRVs). No significant assumptions pertaining The ERV is not required for Therefore, this does not represent (PORVs) cooling. Some plants have performance of The HPI pump shutoff head is to feed and bleed (HPI cooling). success of HPI cooling. a key source of uncertainty for the required for performed plant-specific bleed and feed and greater than the SRV set point, so ANO-1 RICT application. bleed and feed - analysis that demonstrates sequences they can provide cooling without PWRs that less than all PORVs involving success depressurizing the RCS. The may be sufficient depending or failure of feed ERV may be used to on ECCS characteristics and and bleed. depressurize but is not required. initiation timing. 1CAN122201 Page 12 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Recirculation from the sump and An industry-accepted approach is sequences used; however, the treatment of involving flow from RB sump / strainer performance these sources. may be a potential source of Plugging of the containment sump (Note that the model uncertainty. Applications was modeled using the guidance modeling should be pertaining to or affected by sump provided in WCAP-16882-NP. relatively recirculation should consider the All PWRs are improving further evaluate those events as a straightforward, the The PRA models potential for RB The WCAP provides a spectrum of The strainer failure

12. Containment ECCS sump management uncertainty is plugging probabilities given the probabilities are affected by the potential source of uncertainty.

sump / strainer practices including sump blockage depending on the related to the severity of the LOCA or steam line method used to determine performance installation of new sump size of the LOCA. There is no basis to justify any methods or break. strainer performance. strainers at most plants. other level of credit without references used to No significant assumptions were introducing other uncertainties. determine the made during the implementation of Model includes the PRA standard likelihood of this WCAP. and latest level of guidance. plugging the sump strainer, and Therefore, this does not represent common cause a key source of uncertainty for the failure by blockage ANO-1 RICT application. of the strainers.) Success criterion A portion of transient initiators Certain scenarios can lead for prevention of that result in RCS to RCS / reactor pressure RPV overpressure overpressurization due to relief The impact of pressure relief vessel (RPV) pressure (Note that valves failing to open have been during transients is judged to not transients requiring pressure It is assumed that failure to provide uncertainty exists neglected. be a source of model uncertainty relief. Usually, there is adequate pressure relief has in both the based on negligible impact to risk sufficient capacity to For anticipated transients without negligible probability, and failure is not The impact of pressure relief determination of profile. Based on the conservative

13. Impact of failure accommodate the pressure scram (ATWS), 2 of 2 code safety modeled (only failure to reclose is during transients is expected to criteria, pressure relief for ATWS the global CCF considered).

of pressure relief transient. However, in some valves and the electromatic relief have a negligible impact to risk is judged not to be a source of values that may scenarios, failure of valve (ERV) are required to lead to RPV For ATWS, if the peak RCS pressure profile. model uncertainty. adequate pressure relief can prevent RCS overpressurization. overpressure and is not relieved, it is assumed that the be a consideration. Various A value of 3750 psig for the RCS Therefore, this does not represent what is done with event leads to core damage. assumptions can be taken pressure integrity limit is a key source of uncertainty for the the subsequent on the impact of inadequate conservatively selected. ANO-1 RICT application. RPV overpressure pressure relief. Overpressurization is assumed to sequence result in core damage. modeling.) 1CAN122201 Page 13 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Systems Analysis (SY) Due to the scope of PRAs, Environmental factors are scenarios may arise where considered in systems and System and accident sequence modeling.

14. Operability of equipment is exposed to accident sequence Generally, credit for operation of equipment in beyond design basis Environmental factors are No credit given for operation of modeling of systems beyond the design-basis beyond design environments (no room considered in systems and systems if conditions exceed N/A available systems environment is not taken.

basis cooling, no component accident sequence modeling. environmental design limits. and required environments cooling, deadheading, in the Therefore, this does not represent support systems presence of an unisolated a key source of uncertainty for the LOCA in the area, etc.) ANO-1 RICT application. Human Reliability Analysis (HR) Most PRAs do not give much, if any credit, for initiation of the Emergency Credit for additional resources Response Organization and capabilities provided by the System and SAMGs is not taken in the Level 1 (ERO), including actions The HFEs for the SAMG-based accident sequence core damage sequence analysis. No credit for SAMGs for the Level 1 Based on industry-accepted included in plant-specific human reliability assessment (HRA) emergency actions are models with approach and the negligible Severe Accident included in the level 2 model. incorporation of It is assumed that the probability represents a potential conservatism. impact to risk profile, application of Management Guidelines of the operator failing to isolate The assumptions made may human failure Incorporation of the SAMG-based credit for ERO is judged not to be (SAMGs) and Section B5b of be conservative and slightly

15. Credit For ERO events (HFEs), and the SG is 1.0. This is emergency include actions for a source of model uncertainty.

the NRC's "Interim conservative, but there is not overestimate the frequency of human error isolating SG for thermally induced SG Compensatory Measures for large early releases. However, probability (HEP) instruction in the EOPs to close tube rupture (TI-SGTR) and Therefore, this does not represent High Threat Environment" the Main Steam Isolation Valves it is not expected that the a key source of uncertainty for the value determination depressurizing the RCS post core mitigation strategies. The overall results are impacted by in the Level 1 and (MSIVs). It is also assumed that damage. ANO-1 RICT application. additional resources and these assumptions. Level 2 models. the probability of operators capabilities brought to bear depressurizing the RCS post-via the ERO can be cooldown is 0.50. substantial, especially for long-term events. 1CAN122201 Page 14 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 An industry-accepted approach is used; however, the sensitivity results indicate that the treatment of pre-initiator and post-initiator human errors may be a potential source of model uncertainty. Applications pertaining to or In general, for procedure-directed affected by specific HFEs should actions, the cognitive part of the evaluate further those events as a post-initiator HEP is quantified potential source of uncertainty. using the Cause Based Decision Tree Methodology (CBDTM). For The ANO-1 PRA model is based immediate, memorized actions or on industry consensus modeling time-critical actions, the cognitive approaches for its HEP There is not a consistent portion is quantified using the calculations; therefore, this is not method for the treatment of System or accident HCR/ORE methodology Detailed analyses are only performed for the risk significant, post-initiator Standard sensitivity cases for considered a significant source of pre-initiator and post-initiator sequence models HFEs are performed as part of epistemic uncertainty for the PRA human errors. However, with incorporation The execution part of the post- HFEs. but may be important to certain

24. Basis for HEPs the quantification in order to HFEs are typically significant of HFEs, and HEP initiator HEP is quantified using No significant assumptions. HRA applications. The RICT Program THERP. determine the impact of contributors to CDF and value employs industry-accepted includes operator action RMAs.

assumptions. large early release frequency determination. The THERP analysis and methodologies. (LERF). However, the FLEX operator quantification for pre-initiators is action associated with moving and similar to that done for post-staging portable equipment initiators. In addition, for requires assumptions that may pre-initiators periodic testing is impact the RICT calculations. credited as a recovery factor. Sensitivity #3 in Section 8.3 of The HRA Calculator is used for PSA-ANO1-06-4B (Reference 7) calculation of realistic HEPs. failed the FLEX HFE and identified that this was not a key source of uncertainty for the ANO-1 RICT application. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 15 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Internal Flooding (IF) Flood initiator frequencies are Considered an industry consensus based on plant-specific model approach. One of the most important, The internal flooding analysis The use of generic flood frequencies estimates of pipe lengths and and uncertain, inputs to an Likelihood and generic flood frequencies (per a) Realistic in that procedures explicitly models floods of various updated to account for plant-specific foot) for different categories of direct that a faulted system be internal flooding analysis is characterization of magnitudes from various sources operating experience, design, and secured. the frequency of floods of internal flooding (for example, fire protection operating practices in conjunction with piping from the EPRI various magnitudes (e.g., sources and plant-specific estimates of pipe methodology. b) Slight conservative bias water, and cooling water) using

16. Piping failure small, large, catastrophic) internal flood event lengths is suitable for representation treatment in that the system the most current EPRI pipe break Spray initiator scenario impacts mode from various sources (e.g., sequences and the of the flood frequencies at the site. may not be totally disable in frequency data. Multiple are limited to the local effects clean water, untreated water, timing associated all cases. This should not be scenarios are developed for Unless specifically noted, all flood of the spray.

salt water, etc.). EPRI has with human actions a source of model uncertainty different break size categories events are assumed to totally disable Flood and major flood initiator developed some data, but involved in flooding in most applications. when the break size affects the the system and/or train from which the scenarios include failure of the the NRC has not formally mitigation. accident progression and timing. flood initiated from. Therefore, this does not represent endorsed its use. source system as well as the components that are failed due a key source of uncertainty for the to the flood event. ANO-1 RICT application. Data Analysis (DA) Based on industry-accepted ANO-1 uses the alpha factor approach and the sensitivity method for developing CCF results, intra-system common CCFs have been shown to probabilities. Consensus model and approach was cause is judged not to be a source be important contributors in utilized. No significant assumptions of model uncertainty. PRAs. As limited plant- The data used to develop the were made. CCF parameter values is taken Standard sensitivity cases for Generic uncertainty applied, but specific data is available, CCF data values

26. Intra-system from the CCF Parameter In accordance with Supporting CCFs are performed as part of not expected to be a source of generic common cause and associated common cause Estimations, 2010 update, or Requirement DA-D6, generic CCF the quantification in order to model uncertainty in most factors are commonly used. system model events WCAP-16883-P (Reference 32). probabilities from the NRC website for determine the impact of applications. The approach is Sometimes, plant-specific representations The CCF Parameter database is "CCF Parameter Estimations, 2007 assumptions. considered realistic. No alternative evidence can indicate that based on NUREG/CR-6268 Update" satisfy the requirement for approaches are judged reasonable the generic values are (Reference 13), which is updated meeting Capability Category II. to justify.

inappropriate. by the Idaho National Laboratory Therefore, this does not represent (INL) for the NRC. a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 16 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Quantification (QU) No significant assumptions. Joint The ANO-1 PRA model is based HEPs (JHEPs) use a floor value of There is not a consistent on industry consensus modeling 1E-06 in the internal events and method for the treatment of The methods used to address internal flooding models. Standard sensitivity cases for approaches for its HEP

25. Treatment of potentially dependent Quantification of HFE dependencies are integrated HFEs are performed as part of calculations; therefore, this is not HFE post-initiator human errors. dependent human into the HRA Calculator, which is This treatment is consistent with the quantification in order to considered a significant source of dependencies SPAR models do not errors designed to comply with the industry practices, the NRCs Good determine the impact of epistemic uncertainty for the PRA.

generally include ASME/ANS requirements. Practices for Implementing Human assumptions. Therefore, this does not represent dependencies. Reliability Analysis (HRA), a key source of uncertainty for the (NUREG-1792), and the ASME PRA ANO-1 RICT application. Standard. LERF Analysis (LE) Typically, the treatment of core melt arrest in-vessel has been limited. However, LOOP recovery allows recovering This modeling assumption is only The ANO-1 PRA only credits recent NRC work has LERF / Level 2 initially failed HPI components or Core melt arrest in-vessel is applicable to a very specific

17. Core melt arrest LOOP recovery as the means of indicated that there may be containment event other equipment that would be credited only in LOOP accident sequence and is not in-vessel recovering a damaged core within more potential than tree sequences capable of recovering the core within recovery sequences. judged to be a significant source of the reactor vessel.

previously credited. An the reactor vessel. uncertainty. example is credit for control rod drive (CRD) in BWRs. 1CAN122201 Page 17 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Based on using an industry consensus approach the treatment of TI-SGTR is judged not to be a source of model uncertainty. However, due to significance to WCAP-16341-P (Reference 33) is LERF results for non-SBO NRC analytical models and an analysis specific for sequences, applications with a research findings continue Westinghouse plants, and was focus on SGTR may want to to show that a TI-SGTR is performed with the knowledge of The results of the generic event tree consider use of more plant specific

18. Thermally-more probable than LERF/Level 2 the results of NUREG-1570 quantification reported in TI-SGTR can have a large analysis for TI-SGTR. As a result, induced failure of predicted by the industry. containment event (Reference 26) and WCAP-16341 are applicable to impact on LERF due to sensitivity #4 in Section 8.4 of hot leg/SG tubes There is a need to come to tree sequences. NUREG/CR-6595, Revision 1 ANO-1. Plant specific parameters is immediate RB bypass. PSA-ANO1-06-4B (Reference 7)
   - PWRs agreement with NRC on the                     (Reference 27). This document is used throughout the model.                                      performed a sensitivity on the thermal hydraulics modeling                   used as the primary reference                                                                    probability for both thermally of TI-SGTR.                                   document for modeling pressure-                                                                  induced and pressure induced and TI- SGTR.                                                                                    SGTRs and confirmed these are not a key source of uncertainty for the ANO-1 RICT application.

Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 18 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737

1) In-vessel steam explosion is low probability for low RCS pressure sequences and negligible to high pressure sequences
2) Steam release overpressure is not a credible early failure mode for a The progression of core melt large dry RB to the point of vessel failure remains uncertain. Some 3) Hydrogen burn has a very small codes (MELCOR) predict impact due to high ultimate that even vessels with lower strength for large dry RB head penetrations will The potential RB failure 4) Hydrogen detonation considered remain intact until the water mechanisms evaluated are negligible based on assessment of Phenomenological failure has evaporated from above in-vessel steam explosion, steam RB designs and hydrogen probabilities included in the Level 2 the relocated core debris. release overpressure, hydrogen production analysis represent a slight Other codes (MAAP), LERF / Level 2 burn, hydrogen detonation, Failure modes and conservative bias given the current
19. Vessel failure predict that lower head containment event ex-vessel steam explosion, rocket 5) Ex-vessel steam explosion no probabilities considered in understanding of these issues.

mode significant threat based on RB penetrations might fail early. tree sequences failure, direct RB heating, model for early RB failure. The failure mode of the basemat melt-through, ex-vessel designs, per NUREG 1524 Therefore, this does not represent vessel and associated core cooling, gradual RB (Reference 28) a key source of uncertainty for the timing can impact LERF over-pressurization, and bypass 6) Rocket failure only considered a ANO-1 RICT application. binning and may influence mechanisms. potential threat for Bechtel high pressure melt ejection designed small volume reactor (HPME) characteristics cavities (especially for some BWRs and PWR ice condenser 7) Direct RB heating impact based on plants). conditional RB failure probability from NUREG/CR-6338 (Reference 29) 8- Basemat melt-through,

10) ex-vessel core cooling, and gradual RB over-pressurization are late impacts only 1CAN122201 Page 19 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 The lower vessel head of some plants may be submerged in water prior to the relocation of core debris to the lower head. This
20. Ex-vessel presents the potential for the LERF / Level 2 ANO-1 does not credit ex-vessel cooling of lower core debris to be retained containment event N/A N/A N/A cooling.

head in-vessel by ex-vessel tree sequences cooling. This is a complex analysis impacted by insulation, vessel design, and degree of submergence. In some plants, core debris Modeling uncertainty is not can come in contact with the expected to challenge any containment shell (e.g., acceptance guidelines for some BWR Mark Is, some The assumptions made may anticipated applications. This is It is postulated for ANO-1 that a not retained as a candidate PWRs including be conservative and slightly high pressure vessel breach

21. Core debris free-standing steel LERF / Level 2 overestimate the frequency of modeling uncertainty and is not a given a dry cavity could result in It is assumed that core debris contact source of uncertainty for the RICT contact with containments). Molten core containment event large early releases.

debris traveling through the with the RB wall results in RB failure. application as no alternative containment debris can challenge the tree sequences However, the overall results instrument tunnel and reaching approaches are judged reasonable integrity of the containment are not impacted by these the RB outer wall. to justify. boundary. Some analyses assumptions. have demonstrated that core Therefore, this does not represent debris can be cooled by a key source of uncertainty for the overlying water pools. ANO-1 RICT application. 1CAN122201 Page 20 of 49 Part of Model Topic (QU-E1) from Discussion of Issue Affected from Plant-Specific Approach Taken Assumptions Made (QU-E2) Impact on Model (QU-E4) Characterization Assessment EPRI TR-1016737 from EPRI TR-1016737 EPRI TR-1016737 Inter-system LOCA (ISLOCA) is often a Based on industry-accepted significant contributor to approach the application of LERF. One key input to the ISLOCA is judged not to be a The plant-specific ISLOCA ISLOCA analysis are the source of model uncertainty. screening and modeling for assumptions related to ANO-1 is based on the guidelines common cause failure of The approach for the ISLOCA in Nuclear Science Advisory Failure of the low-pressure

22. ISLOCA IE isolation valves between the Industry-accepted approach utilized to frequency determination is Committee (NSAC) 154 piping upon exposure to RCS Frequency RCS/RPV and low-pressure ISLOCA sequences address CCFs. No significant considered an industry good (Reference 30). The ISLOCA pressure is assumed to be Determination piping. There is no assumptions made. practice. No alternative fault tree models are quantified 1.0.

consensus approach to the approaches are judged reasonable dynamically within the single-top data or treatment of this to justify. model fault tree models for CDF issue. Additionally, given an and LERF for each unit. Therefore, this does not represent overpressure condition in low pressure piping, there is a key source of uncertainty for the uncertainty surrounding the ANO-1 RICT application. failure mode of the piping.

23. Treatment of hydrogen combustion in Not applicable to ANO-1.

BWR Mark III and PWR ice condenser plants 1CAN122201 Page 21 of 48

3. Assessment of Supplementary Fire PRA (FPRA) Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the ANO-1 FPRA. The FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA, and because the state of knowledge in these elements continues to evolve. The development of the FPRA was guided by NUREG/CR-6850 (Reference 8). The FPRA model used consensus models described in NUREG/CR-6850. Enclosure 2 provides a detailed discussion of the Peer Review facts and observations (F&Os) and resolutions.

The SOKC, included within the parametric uncertainty evaluation, was addressed as part of the ANO-1 baseline PRA model quantification. The parametric uncertainty evaluation for the FPRA model is documented in PSA-ANO1-03-FQ-01 R2, "ANO-1 Fire PRA Uncertainty/ Sensitivity Analysis" (Reference 35). The ANO-1 database uses type codes to perform the SOKC. Generic failure rates use variables so that correlations are maintained and the UNCERT computer code was run to propagate the probability distributions using a Monte Carlo analysis. The results of this analysis confirmed little variability in the overall results and, therefore, parametric uncertainty is not a source of uncertainty in the RICT program. In order to identify key sources of uncertainty for the RICT Program application, an evaluation of FPRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and EPRI Technical Report (TR) 1026511 (Reference 9). As stated in Section 1.3 of NUREG-1855:

   "Although the guidance in the this [sic] report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards."

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions:

   "A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time.

In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time." 1CAN122201 Page 22 of 48 Section 2.1.3 of NUREG-1855 defines consensus model as:

          "Consensus model - In the most general sense, a consensus model is a model that has a publicly available published basis(2) and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRC has used or accepted for the specific risk-informed application for which it is proposed."

The potential sources of model uncertainty in the ANO-1 FPRA model were evaluated for the 71 FPRA topics outlined in EPRI TR-1026511 (Reference 9). This guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850 and was used to evaluate the baseline FPRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations. Table E9-5 summarizes the results of the EPRI 1026511 review within the Topic Areas outlined by NUREG/CR-6850. As noted above, the ANO-1 FPRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. Further, appropriate cable impacts were identified for the systems modeled in the IE PRA and were modeled in the FPRA. FPRA methods were based on NUREG/CR-6850, other more recent NUREGs, e.g., NUREG-7150 (Reference 10), and published "frequently asked questions" (FAQs) for the FPRA. It has been concluded that the uncertainties outlined in EPRI TR-1026511 do not present a significant impact on the ANO-1 RICT calculations. Note that risk management actions (RMAs) will be developed when appropriate using insights from the FPRA model results specific to the configuration. 2 It is anticipated that most consensus models would be available in the open literature. However, under the requirements of 10 CFR 2.390, there may be a compelling reason, for exempting a consensus model from public disclosure. 1CAN122201 Page 23 of 48 Table E9-2: Fire PRA Sources of Model Uncertainty Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) Based on a review of the This task poses a limited source assumptions and potential sources of uncertainty beyond the credit of uncertainly associated with this taken for boundaries and element, it is concluded that the partitions. Task 1 establishes methodology for the Analysis Plant Boundary the overall spatial scope of the Boundary and Partitioning task 1 Definition and analysis and provides a does not introduce any epistemic Partitioning framework for organizing the uncertainties that would require data for the analysis. The sensitivity treatment. partitioning features credited are required to satisfy established Therefore, this does not represent a industry standards. key source of uncertainty for the ANO-1 RICT application. This task involves the selection of components to be treated in In the context of the FPRA, the the analysis in the context of uncertainty that is unique to the initiating events and mitigation. analysis is related to initiating event The potential sources of identification. However, that impact uncertainty include those is minimized through use of the inherent in the internal events Pressurized Water Reactor Owners PRA model as that model Group (PWROG) Generic MSO list provides the foundation for the and the process used to identify FPRA. The mapping of basic and assess potential MSOs. FPRA events to components requires 2 Component not only the consideration of Based on the discussion of sources Selection failure modes (active versus of uncertainty and the discussion passive) but an understanding of above, it is concluded that the the fire function / PRA methodology for the Component component functions not Selection task does not introduce previously considered risk any epistemic uncertainties that significant in the FPIE model. would require sensitivity treatment. When performed correctly, the Therefore, this does not represent a only uncertainty not already key source of uncertainty for the captured in the FPIE model is ANO-1 RICT application. related to the Multiple Spurious Operation (MSO) process. 1CAN122201 Page 24 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) As part of the FPRA, some components were conservatively assumed to be failed in certain locations based on the high likelihood of cables being present in the physical analysis unit (PAU). Components in this category are referred to as Unknown Location (UNL) components because specific cables were not identified for the components. These The selection of cables to be components are documented in the considered in the analysis is ANO-1 FPRA Fire Scenario identified using industry Development Notebook and guidance documents. No assigned to a surrogate PAU treatment of uncertainty is (UNL) for fire risk quantification. typically required for Task 3 As part of the analysis, components beyond the understanding of the that were determined to significantly cable selection approach (i.e., contribute to risk had their cables mapping an active basic event to routed. A sensitivity analysis was a passive component for which performed and documented in FPRA Cable 3 power cables were not selected). Appendix D of the Summary Report Selection Additionally, PRA credited to measure the risk associated with components for which cable the assumption that these routing information was not components fail in select fire provided represent a source of scenarios. The sensitivity removed uncertainty (conservatism) in all UNL components from every fire those components whose cable scenario. Based on the results, the locations are not explicitly inclusion of the UNL components modeled (i.e., "UNL" introduces small risk to both fire components) could be assumed CDF and LERF. failed unnecessarily. To evaluate the impact on masking, a RICT specific sensitivity, Case #1 is provided in PSA-ANO1-06-4B-SOU, Section 8.1, and determined this was not a key source of uncertainty. However, in some RICT calculations (e.g., penetration valves) a shorter than expected RICT times will result due to the conservatism in some of the failed equipment. 1CAN122201 Page 25 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) In the event a structure (location) which could result in a plant trip was incorrectly excluded, its contribution to CDF would be small (with a conditional core damage probability (CCDP) commensurate Qualitative screening was not with base risk). Such a location performed; however, structures would have a negligible risk were eliminated from the global contribution to the overall FPRA. analysis boundary and ignition sources deemed to have no Based on a review of the Qualitative 4 impact on the FPRA were assumptions and potential sources Screening excluded from the quantification of uncertainty related to this based on qualitative screening element and the discussion above, criteria. The only criterion it is concluded that the methodology subject to uncertainty is the for the Qualitative Screening task potential for plant trip. does not introduce any epistemic uncertainties that would affect the ANO-1 RICT program. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. The methodology used to The identified source of uncertainty develop the FPRA Plant could result in the over-estimation Response Model (PRM) is of fire risk. In general, the FPRA consistent with the standard that development process would have used for the internal events PRA reviewed significant fire initiating model development and was events and performed supplemental subjected to industry Peer assessments to address this Review. possible source of uncertainty. The PRM model is applied in Based on a review of the Fire-Induced such a fashion that all postulated assumptions and potential sources 5 Risk Model fires are assumed to generate a of uncertainty related to this plant trip. This represents a element and the discussion above, source of uncertainty, as it is not it is concluded that the methodology necessarily clear that fires would for the Fire-Induced Risk Model result in a trip. In the event the task does not introduce any fire results in damage to cables epistemic uncertainties that would and/or equipment identified in affect the ANO-1 RICT program. Task 2, the PRA model includes Therefore, this does not represent a structure to translate them into key source of uncertainty for the the appropriate induced initiator. ANO-1 RICT application. 1CAN122201 Page 26 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) Ignition source counting is an The ANO-1 FPRA utilized the bin area with inherent uncertainty; frequencies from NUREG-2169. however, the results are not Consensus approaches are particularly sensitive to changes employed in the model. in ignition source counts. The Based on a review of the primary source of uncertainty for assumptions and potential sources this task is associated with the of uncertainty related to this frequency values from Fire Ignition element it is concluded that the 6 NUREG-2169 (Reference 11) Frequencies methodology for the Fire Ignition which result in uncertainty due to Frequency task does not introduce variability among plants along any epistemic uncertainties that with some significant would affect the ANO-1 RICT conservatism in defining the program. frequencies, and the associated heat release rates, based on Therefore, this does not represent a limited fire events and fire test key source of uncertainty for the data. ANO-1 RICT application. Quantitative screening criteria was defined for the ANO-1 FPRA as the CDF/LERF contribution of zero, such that all quantified fire scenarios are retained. All of the results were retained in the cumulative CDF/LERF; therefore, Other than screening out no uncertainty was introduced as a potentially risk significant result of this task. Quantitative 7 scenarios (ignition sources), this Screening Based on the discussion above, it is task is not a source of concluded that the methodology for uncertainty. the Quantitative Screening task does not introduce any epistemic uncertainties that would affect the ANO-1 RICT program. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 27 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) The approach taken for this task Detailed fire modeling was applied included: 1) the use of generic to risk significant scenarios where fire modeling treatments in lieu the reduction in conservatism was of conservative scoping analysis likely to have a measurable impact. techniques; and, 2) limited Consensus modeling approach is detailed fire modeling was used for the Fire Modeling tasks Fire Scoping performed to refine the 8 and it is concluded that the Model scenarios developed using the methodology does not introduce generic fire modeling solutions. any epistemic uncertainties that The primary conservatism would require sensitivity treatment. introduced by this task is associated with the heat release Therefore, this does not represent a rates specified in key source of uncertainty for the NUREG/CR-6850 (Reference 8). ANO-1 RICT application. Circuit analysis was performed as part of the deterministic post fire safe shutdown analysis. Refinements in the application of the circuit analysis results to the FPRA were performed on a case-The circuit analysis is performed by-case basis where the scenario using standard electrical risk quantification was large enough engineering principles. to warrant further detailed analysis. However, the behavior of Hot short probabilities and hot short electrical insulation properties duration probabilities as defined in and the response of electrical NUREG-7150 (Reference 10), circuits to fire induced failures is Volume 2, based on actual fire test a potential source of uncertainty. data, were used in the ANO-1 This uncertainty is associated FPRA. The uncertainty with the dynamics of fire and the (conservatism) which may remain in Detailed Circuit inability to ascertain the relative 9 the FPRA is associated with Analysis timing of circuit failures. The scenarios that do not contribute analysis methodology assumes significantly to the overall fire risk. failures would occur in the worst possible configuration, or if Based on a review of the multiple circuits are involved, at assumptions and potential sources whatever relative timing is of uncertainty related to this required to cause a bounding element and the discussion above, worst-case outcome. This it is concluded that the methodology results in a skewing of the risk for the Detailed Circuit Failure estimates such that they are Analysis task does not introduce over-estimated. any epistemic uncertainties that would affect the ANO-1 RICT program. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 28 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) The use of hot short failure probability and duration probability is based on fire test data and For the Circuit Failure Model associated consensus methodology Likelihood Analysis, one of the published in NUREG-7150, failure modes for a circuit (cable) Volume 2. Based on a review of given fire induced failure is a hot the assumptions and potential short. A conditional probability sources of uncertainty related to Circuit Failure and a hot short duration this element and the discussion Mode 10 probability are assigned using above, it is concluded that the Likelihood industry guidance published in methodology for the Circuit Failure Analysis NUREG-7150, Volume 2 Mode Likelihood Analysis task does (Reference 10). The uncertainty not introduce any epistemic values specified in uncertainties that would affect the NUREG-7150, Volume 2, are ANO-1 RICT program. based on fire test data. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 29 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) The application of fire modeling technology is used in the FPRA to translate a fire initiating event into a set of consequences (fire induced failures). The performance of the analysis requires a number of key input parameters. These input parameters include the heat release rate (HRR) for the fire, the growth rate, the damage threshold for the targets, and response of plant staff (detection, fire control, fire suppression). The fire modeling methodology itself is largely empirical in some respects and consequently is another source of uncertainty. For a given set of input parameters, the fire modeling Consensus modeling approach is results (temperatures as a used for Detailed Fire Modeling, function of distance from the fire) and it is concluded that the are characterized as having methodology for the Detailed Fire Detailed Fire some distribution (aleatory Modeling task does not introduce 11 any epistemic uncertainties that Modeling uncertainty). The epistemic uncertainty arises from the would require sensitivity treatment. selection of the input parameters Therefore, this does not represent a (specifically the HRR and growth key source of uncertainty for the rate) and how the parameters ANO-1 RICT application. are related to the fire initiating event. While industry guidance is available, that guidance is derived from laboratory tests and may not necessarily be representative of randomly occurring events. The fire modeling results using these input parameters are used to identify a zone of influence (ZOI) for the fire and cables/equipment within that ZOI are assumed to be damaged. In general, the guidance provided for the treatment of fires is conservative and the application of that guidance retains that conservatism. The resulting risk estimates are also conservative. 1CAN122201 Page 30 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) The HEPs include the consideration of degradation or loss of necessary cues due to fire. The fire risk importance measures indicate that HEPs represent a potentially the results are somewhat sensitive large uncertainty for the FPRA to HRA model and parameter given the importance of human values. The ANO-1 FPRA model actions in the base model. HRA is based on industry Since many of the HEP values consensus modeling approaches were adjusted for fire, the joint for its HEP calculations, so this is dependency multipliers not considered a significant source Post-Fire of epistemic uncertainty. developed for the FPIE model Human 12 also represent a potential for It is concluded that the Reliability introducing a degree of methodology for the Post-Fire Analysis conservatism. The HEPs Human Reliability Analysis task included the consideration of does not introduce any epistemic degradation or loss of necessary uncertainties that would require cues due to fire. Given the sensitivity treatment. methodology used, the impact of any remaining uncertainties is JHEPs use a floor value of 1E-05 in expected to be small. the FPRA which is consistent with industry guidance. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. The qualitative assessment of seismic-induced fires should not be a source of model uncertainty as it is not expected to provide changes to the quantified FPRA model. Based on the discussion above, it is Since this is a qualitative Seismic Fire concluded that the methodology for evaluation, there is no 13 Interactions the Seismic-Fire Interactions quantitative impact with respect Assessment Assessment task does not to the uncertainty of this task. introduce any epistemic uncertainties that affect the ANO-1 RICT program. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 31 of 48 Topic (To Item FPRA Key Assumptions Disposition For RICT Meet QU-E1) The selected truncation was confirmed to be consistent with the requirements of the PRA Standard (Reference 14). Based on a review of the As the culmination of other assumptions and potential sources tasks, most of the uncertainty of uncertainty related to this associated with quantification Fire Risk element and the discussion above, 14 has already been addressed. Quantification it is concluded that the methodology The other source of uncertainty for the Fire Risk Quantification task is the selection of the truncation does not introduce any epistemic limit. uncertainties that would affect the ANO-1 RICT program. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. Based on the discussion above, it is concluded that the methodology for This task does not introduce any the Uncertainty and Sensitivity new uncertainties. This task is Analyses task does not introduce Uncertainty any epistemic uncertainties that intended to address how the fire 15 and Sensitivity would affect the ANO-1 RICT risk assessment could be Analyses program. impacted by the various sources of uncertainty. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. This task does not introduce any new uncertainties to the fire risk as The FPRA Documentation task it outlines documentation Fire PRA requirements. 16 does not introduce any new Documentation uncertainties to the fire risk. Therefore, this does not represent a key source of uncertainty for the ANO-1 RICT application. Very Early Warning Installed in Unit 2 (only) in key Credit in the FPRA was removed Fire electrical cabinets. Procedures during the NFPA-805 approval Detection are established to address process given that NUREG-2180 System system operation and response. (Reference 12) was not published. (VEWFDS) 1CAN122201 Page 32 of 48

4. Assessment of Level 2 Epistemic Uncertainty Impacts In order to evaluate key sources of uncertainty for RICT Program application, an evaluation of Level 2 internal events PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and EPRI TR-1026511 (Reference 9). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.

The potential sources of model uncertainty in the ANO-1 PRA models were evaluated for the 32 Level 2 PRA topics outlined in EPRI TR-1026511 (Reference 9). Sensitivity analyses were developed, in response to conservatisms in the SGTR sequences as documented in PSA-ANO1-06-4B-SOU (Reference 7), Section 8.4, and was determined not to be a key source of uncertainty for the RICT application. Note that RMAs will be developed when appropriate using insights from the Level 2 PRA model results specific to the configuration.

5. Assessment of Translation Real Time Risk (RTR Model) Uncertainty Impacts Incorporation of the baseline PRA models into the RTR model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-3 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion on the RTR model.

Table E9-3: Assessment of Translation Uncertainty Impacts CRMP Model Change Part of Model Impact on Model Disposition and Assumptions Affected The model, if Since the restructured restructured, will be PRA model logic model will produce Fault tree logic model logically equivalent and structure may be comparable numerical structure, affecting both produce results optimized to increase results, this is not a IE PRA and FPRA. comparable to the solution speed. source of uncertainty baseline PRA logic for the RICT Program. model. Since this is a bounding approach for Incorporation of seismic The addition of addressing seismic risk risk bias to support bounding impacts for in the RICT Program, it RICT Program risk Calculation of RICT seismic events has no is not a source of calculations. and Risk Management impact on baseline translation uncertainty, Action Threshold PRA or RTR model. A conservative value and RICT Program (RMAT) within RTR. Impact is reflected in for the seismic delta calculations are not calculation of all RICTs CDF is applicable. impacted, so no and RMATs. mandatory RMAs are required. 1CAN122201 Page 33 of 48 CRMP Model Change Part of Model Impact on Model Disposition and Assumptions Affected Since the RTR model evaluates specific This change is configurations during consistent with RTR at-power conditions, tool practice; therefore, the use of a plant Set plant availability this change does not availability factor less (Reactor Critical represent a source of Typecode @AVAIL than 1.0 is not Years Factor) basic uncertainty, and RICT appropriate. This event to 1.0. Program calculations change allows the RTR are not impacted, so no model to produce mandatory RMAs are appropriate results for required. specific at-power configurations.

6. Diverse and Flexible Mitigating Strategies (FLEX) in the PRA Models Based on a review of prior TSTF-505 NRC requests for additional information (RAIs), this section provides a description of FLEX equipment and strategies applicable to the ANO-1 PRA models in support of risk-informed decision-making for this TSTF-505 application. The specific uncertainty impacts are discussed for the various models in subsequent sections of this enclosure.

Overview Description The FLEX equipment credited in the ANO-1 FPIE and IF PRAs are listed in Table E9-4. ANO-1 does not have seismic or other external hazard PRA models. Currently, the FPRA for ANO-1 does not credit any FLEX equipment but credit is planned to be included in the next model update (2024). The FLEX operator actions credited in the ANO-1 FPIE and IF PRAs are associated with "Operator Fails to Manually Start/Align/Run FLEX Steam Generator Makeup Pump to Feed Steam Generators." The FLEX diesel generator is planned to be included in the next model update (Q3 2023). The FLEX equipment, component failure rates, operator actions, and differences between the models are discussed in the following sections. a) IE and FPRA PRA I. A description of all FLEX equipment credited in the ANO-1 IE PRA. The FLEX equipment credited in the ANO-1 FPIE and IF PRAs are listed in the following table. 1CAN122201 Page 34 of 48 Table E9-4: FLEX Component Table FLEX Modeled Component IDs Component Description Strategy Failure State P-254/P-255/ Portable SG Feed Pumps (4) Secondary Fail to Start / P-260/P-261 Cooling Fail to Run CS-287 Qualified Condensate Storage Tank Secondary Fail to Open / (QCST) FLEX Supply to Portable Cooling Remain Open SG Feed Pump FW-3627 Manual Valve for FLEX Connection Secondary Fail to Open / into EFW System A Cooling Remain Open FW-3628 Manual Valve for FLEX Connection Secondary Fail to Open / into EFW System A Cooling Remain Open FW-3623 Manual Valve for FLEX Connection Secondary Fail to Open / into EFW System B Cooling Remain Open FW-3624 Manual Valve for FLEX Connection Secondary Fail to Open / into EFW System B Cooling Remain Open II. A description of all FLEX operator actions credited in the ANO-1 IE PRA. The post-initiator operator actions identified for the FLEX system are listed in Table E9-5. These HFEs were identified through procedure and FLEX strategy reviews and refined during the system modeling process. Table E9-5: FLEX System Post-Initiator Human Failure Events Post-Initiator Event ID Event Description AC8-HFC-FO-FLEX Fail to Re-Power Load Center (LC) or Motor Control Center (MCC) with Portable FLEX Generator EFW-HFC-FO-FLEX Failure to Manually Start/Align/Run FLEX SG Makeup Pump to Feed SGs 1CAN122201 Page 35 of 48 III. The methodology used to assess the failure probabilities of any modeled equipment credited in the mitigating strategies for FLEX. The industry average baseline values from NUREG-6928 (Reference 13) were used for FLEX feed pumps failure rates. To simplify the modeling, only one component (pump) is modeled for each portable equipment function in the model. This is recognized as potentially slightly conservative without common cause failure rates for portable equipment. Supporting requirements for HLR-DA-D (ASME Standard, RA-Sa-2009 (Reference 14) are addressed in Table E9-6 for the modeling of the Flex Portable Equipment. For non-portable equipment such as manual valves, the failure rates follow the same peer reviewed process as other similar plant equipment credited in the FPIE model which includes the same methods for the associated data analysis for requirements specified under HLR-DA-D. Table E9-6: Supporting Requirements for HLR-DA-D Supporting Req. Discussion for (SR) No. / Supporting Requirement Section of Report Capability Capability Category II Meeting Supporting Category Requirement CALCULATE realistic parameter estimates for significant basic events based on relevant generic and plant-specific evidence unless it is justified that there are adequate plant-specific data to characterize the parameter value and its uncertainty. When it is necessary to combine evidence from generic and plant-specific data, DA-D1 USE a Bayes update process or equivalent Not applicable. statistical process that assigns appropriate II See DA-D2 weight to the statistical significance of the generic and plant-specific evidence and provides an appropriate characterization of uncertainty. CHOOSE prior distributions as either non-informative, or representative of variability in industry data. CALCULATE parameter estimates for the remaining events by using generic industry data. 1CAN122201 Page 36 of 48 Supporting Req. Discussion for (SR) No. / Supporting Requirement Section of Report Capability Capability Category II Meeting Supporting Category Requirement If neither plant-specific data nor generic The data source for parameter estimates are available for the the Portable Feed parameter associated with a specific basic event, Pumps uses the 2015 DA-D2 USE data or estimates for the most similar industry average All equipment available, adjusting if necessary to baseline values from account for differences. Alternatively, USE NUREG-6928 for expert judgment and document the rationale EDP (FTS, FTLR, behind the choice of parameter values. FTR). The industry source data NUREG-6928, PROVIDE a mean value of, and a statistical provides the mean representation of the uncertainty intervals for, the DA-D3 value and uncertainty parameter estimates of significant basic events. intervals being used II Acceptable systematic methods include in the analysis. No Bayesian updating, frequentist method, or expert Bayesian update was judgment. performed with this data. When the Bayesian approach is used to derive a distribution and mean value of a parameter, CHECK that the posterior distribution is reasonable given the relative weight of evidence provided by the prior and the plant-specific data. Examples of tests to ensure that the updating is accomplished correctly and that the generic parameter estimates are consistent with the plant-specific application include the following: (a) confirmation that the Bayesian updating does not produce a posterior distribution Bayesian approach DA-D4 with a single bin histogram not used for data II/III (b) examination of the cause of any unusual values of the FLEX (e.g., multimodal) posterior distribution components. shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate (d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean value 1CAN122201 Page 37 of 48 Supporting Req. Discussion for (SR) No. / Supporting Requirement Section of Report Capability Capability Category II Meeting Supporting Category Requirement USE one of the following models for estimating CCF parameters for significant CCF basic events: No new CCF events (a) Alpha Factor Model created in the FLEX model. For the DA-D5 (b) Basic Parameter Model ANO-1 FLEX PRA II (c) Multiple Greek Letter Model model, only one piece of portable (d) Binomial Failure Rate Model equipment is JUSTIFY the use of alternative methods (i.e., modeled per function. provide evidence of peer review or verification of the method that demonstrates its acceptability). USE generic common cause failure probabilities DA-D6 consistent with available plant experience. See response to EVALUATE the common cause failure II DA-D5 probabilities in a manner consistent with the component boundaries. If screening of generic event data is performed DA-D7 for plant-specific estimation, ENSURE that No screening screening is performed on both the CCF events All performed. and the independent failure events in the data-base used to generate the CCF parameters. If modifications to plant design or operating practice lead to a condition where past data are no longer representative of current performance, LIMIT the use of old data: (a) If the modification involves new equipment or a practice where generic parameter estimates are available, USE the generic parameter estimates updated with plant-DA-D8 specific data as it becomes available for Not applicable II significant basic events; or (b) If the modification is unique to the extent that generic parameter estimates are not available and only limited experience is available following the change, then ANALYZE the impact of the change and assess the hypothetical effect on the historical data to determine to what extent the data can be used. 1CAN122201 Page 38 of 48 IV. Methodology used to assess operator actions related to FLEX equipment The methodology of the plant-specific HEPs and associated scenario-specific performance shaping factors listed in (a) - (j) of supporting requirement HR-G3 of ASME/ANS RA-Sa-2009 (Reference 14), as endorsed by RG 1.200 (Reference 23) for the FLEX operator actions are discussed in the following section. Operator actions related to FLEX equipment and strategies may be performed under unique operating circumstances and conditions. As such, the performance shaping factors (PSFs) were evaluated specifically for FLEX-related actions. Each of these PSFs is addressed in the development of the specific actions and is documented using the HRA calculator (Reference 15). Information was obtained via procedure review, operator interview, and FLEX specific sources such as the FLEX Validation Plan (Reference 16) and/or the FLEX Integrated Plan (Reference 17). The PSFs listed in HR-G3 of ASME/ANS RA-Sa-2009 are addressed as follows: a) quality [type (classroom or simulator) and frequency] of the operator training or experience Training has been performed to ensure operator familiarity with FLEX equipment and FLEX strategies. Training included walk-throughs, job aids, equipment deployment, placement strategies, and use of different FLEX strategies. b) quality of the written procedures and administrative controls FLEX strategy support guidelines have been developed in accordance with PWROG guidelines (Reference 18). FLEX support guidelines provide available, pre-planned FLEX strategies for accomplishing specific tasks in the EOPs or Abnormal Operating Procedures (AOPs). FLEX Support Guidelines (FSGs) would be used to supplement (not replace) the existing procedure structure that establishes command and control for the event. Procedural Interfaces have been incorporated into OP-2202.008, (Station Blackout procedure), to the extent necessary to include appropriate reference to FLEX Developed Strategies (FDSs) and provide command and control for the extended loss of AC power (ELAP). This is also assessed in the CBDTM, branches Pc-e through Pc-g of the HRA Calculator. c) availability of instrumentation needed to take corrective actions The instrumentation required for each action is specific to the action itself. Specifically, CBDTM branch Pc-a evaluates the availability of required instrumentation. d) degree of clarity of cues/indications The clarity of the cues/indications is considered in the CBDTM branches Pc-b and Pc-d. 1CAN122201 Page 39 of 48 e) human-machine interface The human-machine interface (HMI) is evaluated in the Pc-c branch of the CBDTM as well as in the execution steps for each action. f) time available and time required to complete the response Time windows were based on pertinent plant information (e.g., time to battery depletion). Operator talk-through and/or FLEX procedures provided the basis for the time to complete the response. Where applicable, site-specific thermal hydraulic (TH) analysis was used to determine the time window for FLEX actions. In other cases, the time window was based on other pertinent information which does not require TH data (e.g., time to refuel equipment). Operators talk-through and/or the FLEX validation plan (Reference 16) provided the basis for the time to complete the response. g) complexity of the required response The complexity of the response is assessed in the Execution PSFs window of the HRA calculator for each action. An assignment of complex or simple is selected, which in turn has an impact on the HEP. h) environment (e.g., lighting, heat, radiation) under which the operator is working The environment of the response is assessed in the Execution PSFs window of the HRA calculator for each action. This considers the lighting, heat/humidity, radiation level, and atmosphere where the action is performed. i) accessibility of the equipment requiring manipulation The accessibility of the equipment (accessible, with difficulty, or inaccessible) is assessed in the Execution PSFs window of the HRA calculator for each action. j) necessity, adequacy, and availability of special tools, parts, clothing, etc. The adequacy and availability of tools required for the FLEX actions was reviewed. The key equipment necessary for the implementation of the FLEX strategies is stored and maintained at the ANO FLEX storage building. There is sufficient time available to access and obtain the necessary equipment, parts, and tools to perform the FLEX actions. This is also assessed in the Execution PSFs window of the HRA calculator for each action. 1CAN122201 Page 40 of 48 V. Potential for pre-initiator human failures events Maintenance procedures for portable equipment were reviewed for possible pre-initiator human failures that could render the equipment unavailable. The assessment of the pre-initiator human failure as described in HLR-HR-D of ASME/ANS RA-Sa-2009 as endorsed by RG 1.200 is described in the following section. Consistent with the latest EPRI knowledge base article on treatment of FLEX pre-initiator actions (Reference 19), the FLEX procedures were reviewed for potential pre-initiator human actions for the FPIE PRA. Permanently installed equipment that are used as part of FLEX strategies (e.g., the turbine driven EFW pump) already have established pre-initiator events that are included in the system modeling and described within the respective system notebook. An exception is the engine-driven fire pump (P-6B), a permanently installed pump that was not previously credited; therefore, the associated test and maintenance procedure was reviewed for potential pre-initiator HFEs. Operators check the successful restoration of the pump to service. This includes acceptable operational tests and vibration readings to restore pump to online condition. Since an operational test is performed, pre-initiator HFEs can be screened. There were no pre-initiator HFEs associated with FLEX portable equipment that were identified as a result of this review. Operator interviews confirmed that even when explicit verification is not noted in procedures, operators perform self-check and peer check of alignments at every available opportunity. These checks ensure that any pre-initiating errors (misalignments or mis-calibrations) are corrected prior to placing the FLEX equipment into service. VI. Review of the conclusions provided in Memorandum dated May 6th, 2022 (ADAMS Accession No. ML22014A084) "Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments." E9-7: Assessment of FLEX Uncertainties Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates SCOPE - CONCLUSION 1: NEI 16-06 has not provided accepted HRA methods for inclusion of offsite portable equipment to take quantitative risk credits in risk- informed No offsite portable applications that should meet the guidance of RG 1.200; equipment is credited in therefore, claiming quantitative credits for offsite equipment the ANO-1 PRA models. is not appropriate until evaluations consistent with the guidance of RG 1.200 or improvements in the NEI guidance or state-of-art methods address the technical gaps. 1CAN122201 Page 41 of 48 Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates The current FLEX UPGRADE - CONCLUSION 2: For any new risk-informed modeling was application that has incorporated mitigating strategies and implemented on a very should meet the guidance of RG 1.200, the licensee should limited basis. The added either perform a focused- scope peer review of the PRA FLEX modeling was not a model or demonstrate that none of the following criteria is new method and did not satisfied: (1) use of new methodology, (2) change in scope enhance the model in that impacts the significant accident sequences or the scope or capability for significant accident progression sequences, (3) change in impacting significant capability that impacts the significant accident sequences accident sequences and or the significant accident progression sequences. progressions. UPGRADE - CONCLUSION 3: Licensees may incorporate mitigating strategies in PRA models after the issuance of amendments for applications that use PRA models to exercise self-approval for a plant change. For such applications, the licensee should, in addition to conforming Following ANO with specific license condition(s) associated with those procedures, focus scope applications, either perform a focused-scope peer review peer reviews will be and resolve the focused-scope peer review findings before performed for model using the new models to support any risk- informed upgrades and new decision-making or document an evaluation demonstrating methods. that none of the upgrade criteria is satisfied. NRC will monitor those evaluations and their documentation, along with evaluations and documents related to other items identified in this assessment, through appropriate regulatory processes (e.g., inspections). 1CAN122201 Page 42 of 48 Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates PWROG-18042-NP is not the source data for the FLEX portable equipment. PWROG-14003 is not used. A sensitivity for this source of uncertainty is provided in Section 8.2 that evaluates the use of the PWROG-18042-NP DATA - CONCLUSION 4: The use of expert judgment failure rates (see consistent with the ASME/ANS PRA Standard as endorsed Section 8.2 of PSA-by RG 1.200 is acceptable for estimating parameter values ANO1-06-4B-SOU under certain conditions and the rationale for estimated (Reference 7)). All FLEX values should be documented. In reviewing future risk- equipment will use failure informed applications, the staff may request additional data from the information to understand the rationale for parameter PWROG-18042-NP in the values. Using the appropriate regulatory processes, the next model update NRC will review the rationale for parameter values added to (expected completion 3rd PRA models after issuance of applications that use PRA quarter 2023). models to exercise self-approval for a plant change. Sensitivity #2 adjusts the FLEX portable equipment failure rates to their 95th percentile probabilities using the data from PWROG-18042-NP (Reference 18), and determined it was not a key source of uncertainty for the RICT application. DATA - CONLCUSION 5: The NRC staff does not agree with crediting spare portable equipment not modeled in the PRA in lieu of using appropriate failure rates because this approach is not consistent with the ASME/ANS PRA See response to item 4. Standard and RG 1.200. Furthermore, the potential impact of underestimating failure rates could be larger than the unquantified risk benefits of spare equipment not modeled in PRAs. 1CAN122201 Page 43 of 48 Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates DATA - CONLCUSION 6: The failure rates of permanently installed equipment cannot be used for portable equipment even if sensitivity analyses are performed. Licensees See response to item 4. should use plant-specific of generic data collected and analyzed using acceptable approaches to estimate the failure rates for portable equipment. DATA - CONCLUSION 7: NEI 1606 and risk-informed applications should address whether and how the analysis See response to item 4. described in SR DAD8 is performed. DATA - CONCLUSION 8: The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA See response to item 4. Standard, as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated. DATA - CONCLUSION 9: The NRC staff does not have access to and has not reviewed PWROG14003. At this See response to item 4. time, the NRC staff treats approaches proposed by that PWROG document as unreviewed methods. DATA - CONLCUSION 10: Without any additional data or Only a single FLEX evaluations, the currently available common-cause failure portable component is (CCF) parameter values should be used, which should modeled, no credit for appropriately reflect the higher CCF failure rates of the redundant equipment is portable equipment when applied to the higher independent currently in the PRA failure rates. model. 1CAN122201 Page 44 of 48 Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates

  • Human error probabilities are calculated for mitigation strategies for the internal events PRA which does not include extreme external hazards.
  • No additional surrogates are included in the FLEX modeling.
  • There have not been changes to the FLEX HRA - CONCLUSION 11: The staff finds that using strategies since the surrogates for specific actions or engineering judgement to performance of the estimate the failure probability does not adequately address feasibility study that the elements needed for a technically acceptable HRA as would impact described in the ASME/ANS PRA Standard (e.g., the loading/unloading impact of the environment under which the operators work). equipment.

Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, HEPs

  • Plant-specific associated with actions for which the existing approaches procedures for are not explicitly applicable, such as actions described in refueling portable equipment were used Sections 7.5.4 and 7.5.5 of NEI 1606, along with in the development of assumptions and assessments, should be submitted to the refueling HFE.

NRC for review.

  • Operator actions to perform DC load shed applied execution recoveries to reflect self-checking. A sensitivity for this source of uncertainty is provided in Section 8.3 of PSA-ANO1-06-4B-SOU (Reference 7) and determined not to be a key source of uncertainty for the RICT application.

1CAN122201 Page 45 of 48 Status of the ANO-1 Conclusions from 2017 Memo Incorporation of the 2021 Updates The in-progress model update (scheduled to be completed for 3Q 2023) will include a decision to HRA - CONCLUSION 12: If procedures for initiating declare ELAP modeled as mitigating strategies are not explicit and the associated a cognitive-only HFE. A failure probabilities are not directly analyzed by accepted sensitivity for this source approaches, technical bases for probability of failure to of uncertainty is provided initiate mitigating strategies should be submitted to NRC for in Section 8.3 of review. PSA-ANO1-06-4B-SOU (Reference 7) and determined not to be a key source of uncertainty for the RICT application. HRA - CONCLUSION 13: Until acceptable guidance is The guidance in EPRI provided for identifying and assessing unique aspects of KBA 2021-001 pre-initiator human failure events for mitigating strategies, (Reference 34) was used the staff may request additional information regarding for identifying pre-initiator assessment of those human failure events. HFEs. a) FLEX Portable Equipment in the FPRA The FPRA does not credit FLEX portable equipment in the analysis but is planned to be incorporated in the next model update. b) Evaluation of FLEX as a Source of Uncertainty for the RICT Program Two sensitivities have been performed regarding the sources of uncertainty associated with the FLEX modeling in the RICT program. Sensitivity #1 adjusts the FLEX portable equipment failure rates to their 95th percentile probabilities using the data from PWROG-18042-NP (Reference 18). Sensitivity #2 adjusts the FLEX operator actions associated with operating and aligning portable equipment to fail (Sections 8.2 and 8.3 of PSA-ANO1-06-4B-SOU (Reference 7)). Both sensitivities had no impact on the RICT calculations. Therefore, the FLEX equipment and HRA modeling is not a key source of uncertainty for the ANO-1 RICT application. 1CAN122201 Page 46 of 48

7. References
1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

2. NRC NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making," (ADAMS Accession No. ML17062A466), Revision 1, dated March 2017
3. Electric Power Research Institute (EPRI) TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Final Report, December 2008
4. PSA-ANO1-01-QU-01, "ANO-1 PSA Uncertainty and Sensitivity Analysis," Revision 1
5. PSA-ANO1-01-SOU, "ANO-1 PRA - Internal Events Sources of Uncertainty," Revision 3
6. PSA-ANO1-01-IF-SOU, "Arkansas Nuclear One Unit 1 Internal Flooding Sources of Uncertainty," Revision 3
7. PSA-ANO1-06-4B-SOU, "ANO-1 PRA - Assessment of Key Assumptions and Sources of Uncertainty for TSTF-505 (RICT) Submittal," Revision 0
8. NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities,"

Volumes 1 and 2, (ADAMS Assession Nos. ML15167A401 and ML15167A411), September 2005

9. Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012
10. Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 2: "Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure," Final Report, NUREG/CR-7150, Vol. 1, EPRI 3002001989, U.S.

NRC and Electric Power Research Institute, May 2014

11. "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, United States Fire Event Experience Through 2009," NUREG-2169/EPRI 3002002936, U.S. NRC and Electric Power Research Institute, January 2015
12. NUREG-2180, "Determining the Effectiveness, Limitations, and Operator Response for Very Early Warning Fire Detection Systems in Nuclear Facilities (DELORES-VEWFIRE),"

December 2016

13. NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants," (ADAMS Accession No. ML070650650),

February 2007 1CAN122201 Page 47 of 48

14. ASME/ANS RA-Sa-2009, Addenda to RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plants"
15. EPRI, "The EPRI HRA Calculator Software Users Manual," Version 5.1, EPRI, Palo Alto, CA, and Scientech, a Curtiss-Wright Flow Control company, Tukwila, WA: 2013. Software Product ID #: 300200314
16. ANO 2015-0078, "Entergy ANO Nuclear Plant, ANO FLEX Validation," Revision 0
17. "FLEX Final Integrated Plan, ANO Units 1 and 2," Revision 1
18. PWROG-18042-NP, Revision 1, "Flex Equipment Data Collection and Analysis"
19. EPRI, HRA Users Group Knowledge Base Article 2021-001, "Guidance for Pre-Initiator HRA for FLEX and Portable Equipment," Revision 1
20. Arkansas Nuclear One, Unit No. 1, "Issuance of Amendment Regarding Transition to a Risk-Informed, Performance-Based Fire Protection Program in Accordance with 10 CFR 50.48(c)," (TAC NO. MF3419), (ADAMS Accession No. ML16223A481), dated October 7, 2016
21. PSA-ANO2-06-4B-SOU, "ANO-2 PRA - Assessment of Key Assumptions and Sources of Uncertainty for TSTF-505 (RICT) Submittal," Revision 0
22. NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants,"

December 2005

23. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009
24. PWR Owners Group Project PA-RMSC-0463, "White Paper on Consideration of Reactor Vessel Failure in Plant-Specific PRA Models for PWRs," January 2009
25. Generic Safety Issue (GSI) 191, "The Impact of Debris Induced Loss of ECCS Recirculation on PWR Core Damage Frequency (NUREG/CR-6771)," August 2002
26. NUREG-1570, "Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture," March 1998
27. NUREG/CR-6595, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events," Revision 1, October 2004
28. NUREG-1524, "A Reassessment of the Potential for an Alpha-Mode Containment Failure and a Review of the Current Understanding of Broader Fuel-Coolant Interaction Issues,"

August 1996

29. NUREG/CR-6338, "Resolution of the Direct Containment Heating Issue for All Westinghouse Plants with Large Dry Containments or Subatmospheric Containments,"

February 1996 1CAN122201 Page 48 of 48

30. Nuclear Science Advisory Committee (NSAC) 154, "ISLOCA Evaluation Guidelines," Final Report, September 1991
31. WCAP-16175-P-A, "Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants," Revision 0, March 2007
32. WCAP-16883-P, "Common Cause Failure Parameter Estimates for Babcock & Wilcox Plants," Revision 0, March 2008
33. WCAP-16341-P, "Simplified Level 2 Modeling Guidelines," November 2005
34. EPRI Knowledge Base Article 2021/001, "How to Retain HFE Combinations Numbers/Names Between HRA Dependency Updates"
35. PSA-ANO1-03-FQ-01, "ANO-1 Fire PRA Uncertainty/Sensitivity Analysis," Revision 2

Enclosure 10 1CAN122201 Program Implementation 0 1CAN122201 Page 1 of 3 Program Implementation

1. Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (Reference 2), requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk Managed Technical Specifications (RMTS) implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT).

This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including training of plant personnel, and specifically discusses the decision process for RMA implementation during extended Completion Times (CT).

2. RICT Program and Procedures Entergy Operations, Inc. (Entergy) will develop a program description and implementing procedures for the RICT Program. The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT Program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT Program. The program description and implementing procedures will incorporate the programmatic requirements for RMTS included in NEI 06-09-A. The program will be integrated with the online work control process. The work control process currently identifies the need to enter a Limiting Condition for Operation (LCO)

Action statement as part of the planning process and will additionally identify whether the provisions of the RICT Program are required for the planned work. The risk thresholds associated with 10 CFR 50.65(a)(4) will be coordinated with the RICT limits. The maintenance rule performance monitoring provisions and Mitigating System Performance Index (MSPI) thresholds will assist in controlling the amount of risk expended in use of the RICT Program. The Operations Department (senior licensed operators) is responsible for compliance with the LCO and will be responsible for implementation of RICTs and RMAs. Entry into the RICT Program will require management approval prior to pre-planned activities and within the time limits of the Required Action CT (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less for emergent conditions. The procedures for the RICT Program will address the following attributes consistent with NEI 06-09-A:

  • Plant management positions with authority to approve entry into the RICT Program.
  • Important definitions related to the RICT Program.
  • Departmental and position responsibilities for activities in the RICT Program.
  • Plant conditions for which the RICT Program is applicable.
  • Limitations on implementing RICTs under voluntary and emergent conditions.
  • Implementation of the RICT Program 30-day back stop limit.

0 1CAN122201 Page 2 of 3

  • Use of the Configuration Risk Management Program (CRMP) tool.
  • Guidance on recalculating RICT and risk management action time (RMAT) within 12 hours or within the most limiting front-stop CT after a plant configuration change.
  • Requirements to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded.
  • Guidance on the use of RMAs including the conditions under which the RMAs may be credited in RICT calculations.
  • Guidance on crediting probabilistic risk assessment (PRA) functionality.
  • Conditions for exiting a RICT.
  • Requirements for training on the RICT Program.
  • Documentation requirements related to individual RICT evaluations, implementation of extended CTs, and accumulated annual risk.
3. RICT Program Training Training will be carried out in accordance with Entergy training procedures and processes that utilize the Systematic Approach to Training. These procedures were written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training.

Participation Departments that will receive training appropriate to their level of program responsibilities include:

  • Operations
  • Operations Training
  • Work Management
  • Outage Management
  • Planning and Scheduling Personnel
  • Work Week Managers
  • Regulatory Assurance
  • Maintenance
  • Engineering
  • Risk Management
  • Other Selected Management Scope of Training For those individuals directly involved in the implementation of the RICT Program the training topics will be developed with consideration of:
  • Specific training on the revised Technical Specifications
  • Record keeping requirements
  • Case studies 0

1CAN122201 Page 3 of 3

  • Hands-on experience with the CRMP tool for calculating RMAT and RICT
  • Identifying appropriate RMAs
  • Determining PRA functionality
  • Common cause failure considerations
  • Other detailed aspects of the RICT Program For management positions with authority to approve entry into the RICT Program, as well as supervisors, managers, and other personnel closely supporting RICT implementation, the training will provide a broad understanding of the purpose, concepts, and limitations of the RICT Program.
4. References
1. Letter from Jennifer M. Golder (NRC) to Buff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

(ADAMS Accession No. ML071200238), dated May 17, 2007

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

Enclosure 11 1CAN122201 Monitoring Program 1 1CAN122201 Page 1 of 2 Monitoring Program

1. Introduction Section 4.0, Item 12, of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A (Reference 2), requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (Reference 3) and NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (note that RG 1.174, Revision 2 (Reference 4), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation (SE) for Section 4.0, Item 12.)

This enclosure provides a description of the process applied to monitor the cumulative risk impact of implementation of the Risk-Informed Completion Time (RICT) Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.

2. Description of Monitoring Program The RICT Program will require calculation of cumulative risk impact at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09-A. For the assessment period under evaluation, data will be collected for the risk increase associated with each application of an extended CT for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk will be calculated by summing all risk associated with each RICT application. This summation is the change in CDF or LERF above the zero maintenance baseline levels during the period of operation in the extended CT (i.e., beyond the front-stop CT). The change in risk will be converted to average annual values.

The total average annual change in risk for extended CTs will be compared to the guidance of RG 1.174, Revision 2, Figures 4 and 5, acceptance guidelines for CDF and LERF, respectively. If the actual annual risk increase is acceptable (i.e., not in Region I of Figures 4 and 5 of RG 1.174, Revision 2), then the RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the acceptance guidelines of RG 1.174 and implementation of any necessary corrective actions to ensure future plant operation is within the guidelines will be conducted under the Corrective Action Program. The evaluation of cumulative risk will also identify areas for consideration, such as:

  • RICT applications that dominated the risk increase
  • Risk contributions from planned vs. emergent RICT applications
  • Risk Management Actions (RMAs) implemented but not credited in the risk calculations
  • Risk impact from applying RICT to avoid multiple shorter duration outages
  • Any specific RICT application that incurred a large proportion of the risk 1

1CAN122201 Page 2 of 2 Based on a review of the considerations above, corrective actions will be developed and implemented as appropriate. These actions may include:

  • Administrative restrictions on the use of RICTs for specific high-risk configurations
  • Additional RMAs for specific configurations
  • Rescheduling planned maintenance activities
  • Deferring planned maintenance to shutdown conditions
  • Use of temporary equipment to replace out-of-service systems, structures, or components (SSCs)
  • Plant modifications to reduce risk impact of future planned maintenance configurations In addition to impacting cumulative risk, implementation of the RICT Program may potentially impact the unavailability of SSCs. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts which may be incurred from implementation of the RICT Program. The SSCs in the scope of the RICT Program are also in the scope of the MR, which allows the use of the MR Program. RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications" (Reference 5), Section 3.2, Maintenance Rule Control, discusses that the scope of evaluations required under the Maintenance Rule should include prior related Technical Specification changes, such as extension of CTs.

The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as described in Element 3 of RG 1.174 and NEI 06-09-A.

3. References
1. Letter from Jennifer M. Golder (NRC) to Buff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

(ADAMS Accession No. ML07I1200238), dated May 17, 2007

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (ADAMS Accession No. ML023240437), November 2002
4. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, (ADAMS Accession No. ML10091006), May 2011
5. Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making:

Technical Specifications," Revision 1, (ADAMS Accession No. ML100910008), May 2011

Enclosure 12 1CAN122201 Risk Management Action Examples 2 1CAN122201 Page 1 of 6 Risk Management Action Examples

1. Introduction This enclosure describes the process for identification and implementation of Risk Management Actions (RMAs) applicable during extended Completion Times (CTs) and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program consistent with the guidance provided in NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (Reference 1).
2. Responsibilities For planned entries into the RICT Program, Work Management is responsible for developing the RMAs with assistance from Operations and Probabilistic Risk Assessment (PRA). Operations is responsible for approval and implementation of RMAs. For emergent entry into extended CTs, Operations is also responsible for developing the RMAs.
3. Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the Risk Management Action Time (RMAT) will be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs requiring recalculation of a RMAT already in place, the procedure will require a reevaluation of the existing RMAs for the new plant configuration to determine if new RMAs are appropriate.

These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A. For emergent entry into a RICT, if the extent of condition is not known, RMAs related to the success of redundant and diverse structures, systems, or components (SSCs) and reducing the likelihood of initiating events relying on the affected function will be developed to address the increased likelihood of a common cause event. RMAs will be implemented in accordance with program procedures no later than the time at which an Incremental Core Damage Probability (ICDP) of 1E-6 is reached, or no later than the time when an Incremental Large Early Release Probability (ILERP) of 1E-7 is reached. If, as the result of an emergent condition, the Instantaneous Core Damage Frequency (ICDF) or the Instantaneous Large Early Release Frequency (ILERF) exceeds 1E-3 per year or 1E-4 per year, respectively, RMAs are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A. By determining which SSCs are most important from a core damage frequency (CDF) or large early release frequency (LERF) perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. The guidance in NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," (Reference 2) and Electric Power Research Institute (EPRI) TR-1026511, "Practical Guidance 2 1CAN122201 Page 2 of 6 on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," (Reference 3) will be used in examining probabilistic risk assessment (PRA) results for significant contributors for the configuration, to aid in identifying appropriate compensatory measures (e.g., related to risk-significant systems that may provide diverse protection, or important support systems or human actions). If the planned activity or emergent condition includes an SSC that is identified to impact the Fire PRA, as identified in the current Configuration Risk Management Program (CRMP), Fire PRA specific RMAs associated with that SSC will be implemented per the current plant procedure. It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and Operator actions are modeled in the PRA; however, such quantification of RMAs is neither required nor expected by NEI 06-09-A. Nonetheless, if RMAs will be credited to determine RICTs, the procedure instructions will be consistent with the guidance in NEI 06-09-A. NEI 06-09-A classifies RMAs into the three categories described below:

1) Actions to increase risk awareness and control.

Shift brief Pre-job brief Training Presence of system engineer or other expertise related to the activity Special purpose procedure to identify risk sources and contingency plans

2) Actions to reduce the duration of maintenance activities.

Pre-staging materials Conducting training on mock-ups Performing the activity around the clock Performing walk-downs on the actual system(s) to be worked on prior to beginning work

3) Actions to minimize the magnitude of the risk increase.

Suspend or minimize activities on redundant systems Suspend or minimize activities on other systems that adversely affect the CDF or LERF Suspend or minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate Use temporary equipment to provide backup power, ventilation, etc. Reschedule other risk-significant activities 2 1CAN122201 Page 3 of 6 Determination of RMAs involves the use of both qualitative and quantitative considerations for the specific plant configuration and the practical means available to manage risk. The scope and number of RMAs are developed and implemented using a graded approach. Procedural guidance for development of RMAs in support of the RICT program builds off the RMAs developed for other processes, such as the RMAs developed under the 10 CFR 50.65(a)(4) program and the protected equipment program. Additionally, common cause RMAs are developed to address the potential impact of common cause failures. General RMAs will be developed and documented in plant procedures as candidates for initial selection for a RICT. These general candidate RMAs will be developed for the in-scope Technical Specification (TS) Required Actions, and will utilize risk insights, such as the identification of risk-significant SSCs, functions, operator responses, and/or initiating events. General RMAs are developed to serve as the preliminary scope of candidate RMAs, which are then supplemented with configuration-specific candidate RMAs. General RMAs may leverage existing plant programs and processes. These RMAs may include: Consideration of rescheduling maintenance to reduce risk Discussion of RICT in pre-job briefs Consideration of proactive return-to-service of other equipment Efficient execution of maintenance In addition to the general RMAs, configuration-specific RMAs are developed based on the CRMP tool to identify configuration-specific RMA candidates. These actions may include: Identification of important equipment or trains for protection Identification of important Operator Actions for briefings Identification of key fire initiators and fire zones for RMAs in accordance with the station Fire RMA process Identification of dominant initiating events and actions to minimize potential for initiators Consideration of insights from PRA model cutsets, through comparison of importances Common cause RMAs are also developed to ensure availability of redundant SSCs, to ensure availability of diverse or alternate systems, to reduce the likelihood of initiating events that require operation of the out-of-service components, and to prepare plant personnel to respond to additional failures. Common cause RMAs are developed by considering the impact of loss of function for the affected SSCs. Examples of common cause RMAs include: Performance of non-intrusive inspections on alternate trains Confidence runs performed for standby SSCs Increased monitoring for running components Expansion of monitoring for running components 2 1CAN122201 Page 4 of 6 Deferring maintenance and testing activities that could generate an initiating event which would require operation of potentially affected SSCs Readiness of operators and maintenance to respond to additional failures Shift briefs or standing orders which focus on initiating event response or loss of potentially affected SSCs Per Entergy Operations, Inc. (Entergy) standards, for emergent conditions where the extent of condition is not performed prior to entering into the Risk Management Action Times (RMAT) or the extent of condition evaluation cannot rule out the potential for common cause failure, common cause RMAs are expected to be implemented to mitigate common cause failure potential and impact. These can include the pre-identified RMAs developed as discussed above, as well as alternative common cause RMAs for the specific configuration. RMAs, including both regular and common cause considerations, are developed for the specific configuration following the steps outlined above.

4. Examples Example RMAs that may be considered during a RICT Program entry for a Diesel Generator (DG), a Low Pressure Injection (LPI) Pump, and an Emergency Feedwater (EFW) Train (turbine-driven) to reduce the risk impact and ensure adequate defense-in-depth are:

4.1 Diesel Generator For TS 3.8.1, "AC Sources - Operating," Condition B, one DG inoperable, additional RMAs would include:

1) Brief the on-shift Operations crew concerning the unit activities, including any compensatory measures established, and review the appropriate emergency operating procedures for a Loss of Offsite Power.
2) Contact the Transmission System Operator (TSO) to determine the reliability of offsite power supplies prior to entering a RICT and implement RMAs during times of high grid stress conditions, such as during high demand conditions.
3) Verify remaining DG and Alternate AC Diesel Generator (AACDG) are available and aligned for standby service.
4) Evaluate weather conditions for threats to the reliability of offsite power supplies.
5) Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.
6) Defer planned maintenance or testing that affects the reliability of the operable DG and associated support equipment. Defer planned maintenance activities on station blackout mitigating systems (such as the AACDG). Treat these as protected equipment.

2 1CAN122201 Page 5 of 6

7) Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
8) Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DG.

4.2 Low Pressure Injection Pump For TS 3.5.2, "Emergency Core Cooling Systems (ECCS)," Condition A, one LPI subsystem inoperable, additional RMAs would include:

1) Verify remaining LPI subsystem is available and aligned for standby service.
2) Defer planned maintenance or testing that affects the reliability of the safety systems that provide a defense-in-depth. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
3) Defer planned maintenance or testing on redundant ECCS LPI subsystem and associated support equipment. Treat these SSCs as protected equipment.
4) Minimize activities that could trip the unit.
5) Evaluate weather conditions for threats to the reliability of offsite power supplies.
6) Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected LPI subsystem.

4.3 Emergency Feedwater Train (Turbine Driven) For TS 3.7.5, "Emergency Feedwater (EFW) System," Condition A, turbine-driven EFW train inoperable due to one inoperable steam supply, additional RMAs include:

1) Verify remaining EFW train, including operability of motor-driven EFW and Common Feedwater (CFW) pumps, or Auxiliary Feedwater (AFW) train are available and aligned for standby service.
2) Defer planned maintenance or testing that affects the reliability of the safety systems that provide a defense-in-depth. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
3) Defer planned maintenance or testing on motor driven EFW/CFW and AFW trains and associated support equipment. Treat these SSCs as protected equipment.
4) Minimize activities that could trip the unit.
5) Evaluate weather conditions for threats to the reliability of offsite power supplies.
6) Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected turbine driven EFW train.

2 1CAN122201 Page 6 of 6

5. References
1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012

2. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," U.S. Nuclear Regulatory Commission, (ADAMS Accession No. ML090970525), dated March 2009
3. EPRI TR-1026511, "Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," Technical Update, Electric Power Research Institute, dated December 2012]]