CNL-16-076, Response to NRC Request for Additional Information Related to License Amendment Request for Adding New Specifications to Technical Specification 3.3.8.3 (BFN-TS-486) - Letter 2

Response to NRC Request for Additional Information Related to License Amendment Request for Adding New Specifications to Technical Specification 3.3.8.3 (BFN-TS-486) - Letter 2

ML16123A071
Person / Time
Site:	Browns Ferry
Issue date:	04/29/2016
From:	James Shea Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
BFN-TS-486, CNL-16-076, TAC MF6738, TAC MF6739, TAC MF6740
Download: ML16123A071 (16)

Text

1101 Market Street, Chattanooga, Tennessee 37402 CNL-16-076 April 29, 2016 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296

Subject:

Response to NRC Request for Additional Information Related to License Amendment Request for Adding New Specifications to Technical Specification 3.3.8.3 (BFN-TS-486) (CAC Nos. MF6738, MF6739, and MF6740) - Letter 2

References:

1. Letter from TVA to NRC, CNL-15-073, "Application to Modify the Browns Ferry Nuclear Plant, Units 1, and 2 Technical Specifications by Adding New Specification TS 3.3.8.3, 'Emergency Core Cooling System Preferred Pump Logic, Common Accident Signal (CAS) Logic, and Unit Priority Re-Trip Logic,' and Unit 3 TS by adding New Specification TS 3.3.8.3, 'Common Accident Signal (CAS) Logic, and Unit Priority Re-Trip Logic,' (BFN-TS-486)," dated September 16, 2015 (ML15260B125)

2. Letter from NRC to TVA, "Browns Ferry Nuclear Plant, Units 1, 2, and 3 -

Request for Additional Information Related to License Amendment Request for Adding New Specifications to Technical Specification 3.3.8.3 (CAC Nos. MF6738, MF6739, and MF6740)," dated March 21, 2016 (ML16074A126)

3. Letter from TVA to NRC, CNL-16-066, "Response to NRC Request for Additional Information Related to License Amendment Request for Adding New Specifications to Technical Specification 3.3.8.3 (BFN-TS-486) (CAC Nos. MF6738, MF6739, and MF6740) - Letter 1,"

dated April 15, 2016 (ML16106A323)

U.S. Nuclear Regulatory Commission CNL-16-076 Page 2 April 29, 2016 By letter dated September 16, 2015 (Reference 1), Tennessee Valley Authority (TVA) submitted a license amendment request (LAR) for Browns Ferry Nuclear Plant (BFN),

Units 1, 2, and 3, to revise the BFN , Units 1 and 2, Technical Specifications (TS) by adding a new specification governing the safety functions for the Emergency Core Cooling System (ECCS) Preferred Pump Logic, Common Accident Signal Logic, and the Unit Priority Re-Trip Logic. In addition, the LAR relocated the BFN , Unit 3 requirements for Common Accident Signal Logic and Unit Priority Re-trip Logic to a new specification governing the safety functions for the Common Accident Signal Logic, and the Unit Priority Re-Trip Logic for consistency with the changes to the BFN , Units 1 and 2 TS.

By letter dated March 21, 2016 (Reference 2), the Nuclear Regulatory Commission (NRC) requested additional information to support the review of the LAR. The required dates for responding to the requests for additional information varied from April 15, 2016, to May 25, 2016. provides the second set of TVA responses to some of the requests for additional information (RAls) identified in the Reference 2 letter. The due dates for the RAls were revised from the Reference 2 letter and detailed in the Reference 3 letter. As stated in the Reference 3 letter, the responses provided in Enclosure 1 to this letter are due by April 29, 2016. Enclosure 2 provides a listing of the RAls contained in the Reference 2 letter and the date of the TVA response to each of the RAls .

Consistent with the standards set forth in Title 10 of the Code of Federal Regulations (1 O CFR), Part 50.92(c), TVA has determined that the additional information, as provided in this letter, does not affect the no significant hazards consideration associated with the proposed application previously provided in Reference 1.

There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Edward 0 . Schrull at (423) 751 3850.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 29th day of April 2016.

Enclosures cc: See Page 3

U. S. Nuclear Regulatory Commission CNL-16-076 Page 3 April 29, 2016

Enclosures:

1. TVA Responses to NRC Request for Additional Information: Set 2

2. Summary of BFN Request for Additional Information Response Dates cc (Enclosure):

NRC Regional Administrator - Region II NRC Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant State Health Officer, Alabama Department of Public Health

ENCLOSURE 1 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT UNITS 1, 2, AND 3 TVA Responses to NRC Request for Additional Information: Set 2 Probabilistic Risk Assessment (PRA) Licensing Branch (APLA) RAI 10 The License Amendment Request (LAR) states that the 2009 peer review of the internal events PRA found that 63 supporting requirements were not met or met at Capability Category I. The NRC staff notes that the findings and observations (F&Os) from the 2009 peer review and their disposition were provided to the NRC as a part of the BFN application to transition to National Fire Protection Association (NFPA) Standard 805. The NFPA 805 LAR states that the peer reviews in May and September of 2009 resulted in 125 F&Os for the internal events and the internal flooding PRA.

Clarify the discrepancy in number of F&Os reported in the NFPA 805 LAR and in the current LAR.

TVA Response There is no discrepancy between the number of findings and observations (F&Os) reported in the Browns Ferry Nuclear Plant (BFN) National Fire Protection Association Standard 805 (NFPA 805) License Amendment Request (LAR) dated March 27, 2013, and supplemented by letter dated May 16, 2013, and the number of supporting requirements in the BFN Emergency Core Cooling System (ECCS) Preferred Pump Logic (PPL) LAR. The number of F&Os for the internal events Probabilistic Risk Assessment (PRA) or for the Fire PRA was not included in the BFN ECCS PPL LAR. The discussion related to supporting requirements in Section 4.4.2, Item 3, of the enclosure to the BFN ECCS PPL LAR provided a summary of the number of American Society of Mechanical Engineers (ASME) Standard supporting requirements that did not meet Capability Category II.

The PRA Summary Notebook was reviewed to determine if there was a discrepancy with the NFPA-805 LAR submittal. Section 6.1.13 of the PRA Summary Notebook states that the peer reviews resulted in a total of 125 F&Os for the internal events PRA, which is consistent with Attachment U of the NFPA-805 LAR.

The NFPA-805 LAR submittal states:

"The Peer Review Certification of the BFN PRA model performed by the BWROG in May, 2009, and September, 2009, resulted in a total of 125 findings for the three unit internal events and internal flooding model."

In addition, Table V-6 of the NFPA-805 LAR lists 77 fire-related F&Os. As noted in the NFPA-805 submittal "Based on the resolution of the peer review F&Os and the assessment of deferred items, the BFN Fire PRA is adequate to support the NFPA 805 Fire Risk Evaluation process." It should be noted that the number of F&Os for both the internal events model and the Fire PRA may change as additional peer review are performed.

CNL-16-076 Enclosure 1, Page 1 of 10

Additional peer reviews were performed for the BFN Fire PRA after the submittal of the NFPA 805 LAR in 2013. A focused-scope peer review (FSPR) of the BFN Fire PRA was conducted from May 12 to 15, 2015. This FSPR evaluated specific changes made to the Fire PRA and assessed the F&Os from the previous two Fire PRA peer reviews. The final conclusion of the fire peer reviews was that the BFN Fire PRA meets Capability Category II following final resolution and closure of all of the F&Os.

Similarly, an FSPR for the internal events model was conducted from July 28 to 31, 2015.

The results of the FSPR demonstrate that TVA has resolved a significant number of the findings. The F&Os which the FSPR has assessed as Resolved can be considered to be closed, and no longer relevant for future risk-informed applications of the BFN PRA. In addition, the associated supporting requirements that the FSPR has assessed as Met (or Category II) can be considered as having that capability category. The remaining unresolved findings have been addressed as part of the PRA Model of Record (MOR) update (PRA MOR Rev. 7).

APLA RAI 10.a Resolution to F&O 2-31 states:

The common cause failure probability of two Motor Operated Valves (MOV's) to close is less than 1 E-5. The Residual Heat Removal (RHR) pump start failure probability is approximately 1.4E-3. The failure of two MOV's to close is less than 2 orders of magnitude lower than another failure that would fail the system in a similar manner. Therefore, failure to close (or modulate) either the Low Pressure Coolant Injection (LPCI) or Suppression Pool Cooling (SPC) injection path can be neglected." NUREG/CR-6928 indicates a failure rate of

~1 E-3/demand for an MOV failing to close. NUREG/CR-5497 indicates a Common Cause Failure (CCF) probability for a Boiling Water Reactor (BWR) RHR MOV to close of ~ 3.2%

(CCCG=2), suggesting a "generic" CCF probability of ~3.2E-5/demand, or slightly above the two-order-of-magnitude threshold for neglecting the failure rate. Confirm that plant-specific Bayesian updating of the generic MOV failure rate could reduce this to the claimed

<1 E-5/demand. In addition, if these MOVs represent a potential interfacing system loss-of-coolant accident (ISLOCA) concern, discuss whether this pathway falls into the ISLOCA frequency used in the PRA and if it meets the screening supporting requirements IE-A2 and IE-C6.

TVA Response The resolution to F&O 2-31 quoted in APLA RAI 10.a is consistent with the response that was provided for the August 2009 peer review. However, since the August 2009 peer review the BFN PRA has undergone several revisions as summarized in the TVA response to APLA RAI 11 provided below. The current BFN PRA model uses an updated alpha factor of ~8.0E-3 (CCCG=2) for the Common Cause Failure (CCF) probability for a Boiling Water Reactor (BWR) Residual Heat Removal (RHR) motor operated valve (MOV) to close. This estimate is based on the data provided in Section 1.3.1.3 of the NRC "CCF Parameter Estimations, 2010 Update." Based on the updated alpha factor for CCCG=2, the CCF probability for failing to close both valves is more than two orders of magnitude lower than the independent failure probability for MOV failure to close and more than two orders of magnitude lower than an RHR pump failure to start probability (i.e., 1.48 E-3). However, because the BFN model uses a Bayesian updated failure probability of 1.7 E-3 for MOV failure to close, the CCF estimate (1.36 E-5) is slightly greater than 1 E-5.

CNL-16-076 Enclosure 1, Page 2 of 10

The RHR MOVs are considered in the BFN interfacing system loss-of-coolant accident (ISLOCA) analysis. The PRA includes ISLOCA scenarios involving the following RHR paths.

Two RHR injection lines with isolation for each path accomplished via one check valve and one MOV in series One RHR shutdown cooling suction line with isolation accomplished by two normally closed MOVs The postulated failure combinations that can result in an ISLOCA initiator in the RHR injection paths are summarized as follows.

Undetected rupture of the testable check valve and rupture of the MOV Undetected rupture of the testable check valve and spurious opening the MOV Undetected rupture of the testable check valve and the MOV position status indicates closed, but was actually left open after maintenance and/or testing The postulated failure combinations that can result in an ISLOCA initiator in the RHR System shutdown cooling suction flow path are summarized as follows.

Undetected rupture of inboard MOV and rupture of the outboard MOV Undetected rupture of inboard MOV and MOV position status indicates closed, but was actually left open after maintenance and/or testing Spurious opening of inboard MOV and rupture of the outboard MOV The ISLOCA initiator event tree models for the RHR injection flow paths were used as a basis for developing the RHR injection path ISLOCA initiator fault tree model. The fault tree model is an input to the VRLOCA event tree model described in the calculation for the Accident Sequence Analysis.

The ISLOCA initiator event tree model for the RHR shutdown cooling suction path were used as a basis for developing the RHR shutdown cooling suction path ISLOCA initiator fault tree model. The fault tree model is an input to the VSLOCA event tree model described in the calculation for the Accident Sequence Analysis.

RHR ISLOCA scenarios are considered in the spectrum of internal-event challenges discussed in IE-A2. These scenarios were not eliminated from further evaluation based on the criteria listed in IE-C6, and are explicitly included in the PRA models.

CNL-16-076 Enclosure 1, Page 3 of 10

APLA RAI 10.b F&Os 4-21: The peer review questioned the joint human error probability (HEP) for several combined operator actions as possibly being too low. In the resolution, the licensee noted that the human reliability analysis (HRA) calculator provides the capability to explicitly calculate the joint HEP for dependent and independent human failure events, thereby reducing potential conservatism that could result from the use of a threshold lower bound a priori, such as 1 E-5 as suggested by NUREG-1792. Discuss the impact on the application (using a PRA which accounts for any updates for this application) of using the HRA calculator results as lower bounds instead of the suggested threshold lower bound value of 1 E-5.

TVA Response The BFN baseline model uses a lower joint human error probability (JHEP) threshold of 1 E-7 because the PRA results were skewed by the choice of JHEP threshold. Models with a low number of combinations generally can use the threshold of 1 E-5 suggested by NUREG-1792 without significantly skewing the results. However, the BFN model includes a large number of independent HEPs (89) and it considers a very large number of combinations (the current MOR includes 12534 HEP combinations). A threshold of 1 E-5 may be appropriate for JHEPs in scenarios where core damage or release occurs early, but it is overly conservative in scenarios where core damage and/or release occurs late. In these late scenarios, there is significantly more time and resources (Technical Support Center, shift change, etc.) to help mitigate core damage and subsequent releases, and these scenarios contribute significantly to core damage frequency (CDF) and large early release (LERF). This over-conservatism is demonstrated by reviewing the top branches of the BFN events trees. For instance, in sequences where functions such as reactivity control, pressure control, and injection are successful, but operators fail to establish long term decay heat removal (DHR), using a threshold of 1 E-5 would imply that CDF for any plant would be greater than 1 E-5 (i.e., the product of an effective initiating frequency greater than 1/yr and a JHEP of 1 E-5). This is because all DHR systems such as suppression pool cooling (SPC), shutdown cooling (SDC) and hardened wetwell venting (HWWV) require manual actuation. It should be noted, a significant fraction of CDF is due to cutsets where core damage occurs late due to initial successful injection to the reactor pressure vessel. In order to address the JHEP threshold issue, a sensitivity analysis is being performed where early scenarios use a threshold of 1 E-5 and late scenarios use a threshold of 1 E-6. This approach is consistent with that used in the BFN NFPA 805 submittal approved by the NRC.

The results of the sensitivity will be included as part of the response for APLA RAI 14.

CNL-16-076 Enclosure 1, Page 4 of 10

APLA RAI 10.c F&O 6-5 found that high pressure coolant injection (HPCI) steamline breaks are excluded as an initiator from the PRA. The pipe break frequencies used old Electric Power Research Institute (EPRI) and WASH-1400 data, apparently a factor of 100 lower than more recent pipe rupture data. Also, a lower CCF value from NUREG/CR-6928 was used. The licensee's resolution states that until the newer EPRI pipe rupture frequency data are publicly released, results remain based on the older data, and that although the correct CCF value is now used, the results do not change the conclusion to exclude the HPCI steamline break as an initiator. The HPCI steamline break frequency of 1.97E-09/year does not appear consistent with NUREG/CR-6928. NUREG/CR-6928 estimates a frequency for BWR medium LOCA of 1 E-4/year (which includes diameters for steam). Justify the exclusion of HPCI steamline breaks or update the internal events PRA model to include this initiator. If the PRA is updated, discuss the update and provide the risk impact on the application as part of APLA-RAl-14.

TVA Response The BFN PRA uses the frequency of 1 E-04/yr for Medium LOCA (MLOCA) inside containment. High pressure coolant injection (HPCI) steamline breaks inside containment, depending on the size of the break, are implicitly included in the appropriate LOCA initiating events used inside containment. However, HPCI steamline breaks outside containment are excluded as an initiator from the PRA based on analysis showing that these are insignificant contributors as discussed below. The BFN PRA Initiating Events Analysis evaluation for High Energy Line Breaks (HELB) Outside of Containment for HPCI, Reactor Core Isolation Cooling (RCIC) and Reactor Water Cleanup (RWCU) lines considers the following HPCI cases to estimate the frequency of a HELB Outside Containment.

Case 1: Rupture of the HPCI line between penetration X-11 and the outboard isolation valve. Only the inboard isolation valve is available to isolate the rupture.

Case 2: Rupture of the outboard isolation valve. This has the same impact as Case 1.

Case 3: Rupture of the steam line outside of the outboard isolation valve.

Case 4: Rupture of the HPCI turbine casing during a HPCI demand.

The analysis was revised in March 2016 to incorporate new pipe rupture frequencies provided in Electric Power Research Institute (EPRI) TR-1021086, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments," April 2013, for RWCU, HPCI, and RCIC breaks outside containment. This revision also included Initiating Events from industry experience through September 1, 2015.

The revised BFN PRA Initiating Events Analysis resulted in the following summary for HPCI, RCIC, and RWCU breaks outside containment.

The calculated probability of each of the HPCI, RCIC, and RWCU line breaks outside containment is:

HPCI: 4.82E-09 / year RCIC: 4.82E-09 / year RWCU: 4.81E-09 / year CNL-16-076 Enclosure 1, Page 5 of 10

ASME/American National Standard (ASME/ANS) RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2, 2009, describes a significant cutset as the summed percentage is 95% and the individual percentage is 1% of the applicable hazard group. The calculated probabilities of each of the lines shown above for an individual cutset is less than 1% of the internal events hazard group contribution.

Summing the contribution for RWCU, HPCI and RCIC (~1.5E-8), the sum is less than 95%

of the internal events hazard group. Therefore, the HPCI, RCIC, and RWCU breaks outside containment initiators are considered to be insignificant contributors to CDF and LERF and are not included in the BFN PRA model.

APLA RAI 11 Provide an overview of the changes in the internal events PRA that occurred after the 2009 peer review, and determine whether any of these changes qualify as a PRA upgrade that would require a focused scope peer review.

TVA Response The following provides a summary of updates to the Internal Events PRA Model.

1. Revision 0 - Initial Computer Aided Fault Tree Analysis (CAFTA) model issued after the August 2009 peer review.

2. Revision 1 - Initiating events were updated to include current generic data, recent plant events and multiunit initiators. Fire initiators that fail offsite power were added to the model to assess the Diesel Generator Allowed Outage Time (AOT) Extension. Some logic errors and type code errors were also corrected that were identified from the Revision 0 to Revision 1 model.

3. Revision 2 - Initiators %VR (ISLOCA - RHR Injection Path) and %VS (ISLOCA - RHR Suction Path) were added for all units. The human error probability for HFA_0085ALIGNCST was re-evaluated based on an additional MAAP run performed. A design change was incorporated into the model that requires three air compressors to supply the entire plant instead of all four. Some logic errors were also corrected that were identified from the Revision 1 to Revision 2 model.

4. Revision 3 - The fire initiators used to asses the Diesel Generator AAOT extension were removed. Some logic errors and type code errors were also corrected that were identified from the Revision 2 to Revision 3 model.

5. Revision 4 - Changes were made to support increased unavailability for infrequent maintenance performed on the Emergency Diesel Generators and corrections to logic errors and type code errors found.

6. Revision 5 - The major change in this update was to revise the data and mutually exclusive logic. Changes were made to correct errors in the logic noted during review following the issuance of the Revision 4 documentation and to support increased unavailability for infrequent maintenance being performed on the Emergency Diesel Generators. The data in the PRA model was updated for plant specific failures and CNL-16-076 Enclosure 1, Page 6 of 10

successes through January 1, 2012. There were no changes in the Accident Analysis, Success Criteria, Internal Flooding, or LERF Analysis, from Revision 4 to Revision 5.

The initiating event analysis was updated to include initiating event data through January 1, 2012, to include current industry generic data, recent plant events and multi-unit initiators.

The unreliability, unavailability, and common cause data analyses were updated.

The unreliability (or failure rate) data are based on generic industry data that has undergone Bayesian updating with plant specific data. Plant specific data for the period January 1, 2003, to January 1, 2012, was evaluated and used as input to the Bayesian analysis. Plant maintenance unavailability data is based on the same time period as the failure data, January 1, 2003, to January 1, 2012. Generic industry data from NUREG/CR-6928 was used for components for which no plant specific data was available.

7. Revision 6 - A model update was performed to merge the Internal Events PRA and the Fire PRA into a single model, to improve the event tree logic, and to resolve issues for AC and DC power. The following changes were made.

Event Tree changes to credit RCIC for Stuck Open Relief Valve (IOOV) scenarios Event Tree changes to separate the DHR functional top logic in a more logical manner (Hardened Wetwell Vent and Drywell Vent, Drywell Sprays)

Event Tree changes to incorporate Alternate Shutdown Cooling (ASDC) for the Fire PRA Event Tree changes to incorporate the high pressure makeup (HPMU) for the Fire PRA Logic fault tree changes to address net positive suction head (NPSH) with no reliance on containment accident pressure (CAP)

Correct the logic for DC chargers (OR gate is now used between the batteries and chargers to address charger trips due to voltage swings caused by inrush current of large loads)

Logic fault tree changes to address overload and load shed logic Logic changes to address ECCS PPL Logic changes to address diesel paralleling logic Logic changes to address conditional Loss of Offsite Power (LOOP) logic for Multi Unit Initiator (MUI)

Limited enhancement for LOOP recovery Develop recoveries for Main Steam Line (MSL) Break Outside Containment instrumentation Updated Raw Water Cooling (RCW) logic

8. Revision 7 - The internal events PRA models were updated as follows.

A Bayesian update was done for initiating events.

A Bayesian update was done for reliability (demand, or failure rate) and unavailability basic events. The corresponding CCF events were also updated based on data changes.

A few test and maintenance (T&M) events were added to the PRA model. These include diesel exhaust fans and miscellaneous equipment room fans.

CNL-16-076 Enclosure 1, Page 7 of 10

The Human Reliability Analysis (HRA) was updated to address the update of the Emergency Operating Instructions (EOIs). The EOI update caused changes to the procedures, and steps referenced in the analyses due to consolidation of procedures and or steps in procedures. The EOI Program Manual was updated to BWROG EPG/SAG Revision 3 (including approved EPG issues through February 2015), and flowchart format/symbols changed to reflect industry standard. In addition, the analyses was updated to address resolution of F&Os, enhance the basis for the timing, address updates of procedures, add or delete operator actions and correct some minor errors.

The Large LOCA event tree was updated to remove sequences that assumed core damage if containment flooding fails.

The Main Steam Break Outside Containment logic was update to credit Main Steam Isolation Valve (MSIV) isolation on low steamline pressure. The prior version of the model only credited Reactor Pressure Vessel (RPV) low level for MSIV isolation.

Logic changes were incorporated to address minor discrepancies from the merging of the internal events and fire models, and to incorporate DCN changes.

Revised the approach for pipe failure frequency evaluations to consider pipe sections instead of linear foot failure estimates.

A significant number of changes in the PRA have been included as part of the PRA maintenance process. The maintenance update process includes model enhancements, data updates, and model corrections to address errors in the in event trees and fault tree models, data, and HRA. The PRA team has not incorporated new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences since the model was transitioned to the CAFTA software platform in 2009 (i.e., Revision 0).

It should be noted that in PRA Model of Record Revision 6, the Internal Events model and the Fire PRA models were merged. However, this merging was done to aid in maintaining a single model file and does not affect the results of either analysis. The internal events model is used with flags that turn off the Fire PRA logic. The fire PRA is quantified separately using FRANX instead of PRAQUANT. The only recent change in methodology involved the approach to evaluate pipe rupture frequencies (i.e., pipe sections vs. linear foot failure estimates) in Revision 7.

In summary, none of the above changes to the PRA model qualify as a PRA upgrade that would require an FSPR.

APLA RAI 16 RG 1.177, Sections 2.3.7.1 and 2.3.7.2 discuss the configuration risk management program (CRMP) and the key principles of the CRMP. Evaluate the BFN CRMP against the RG 1.177 CRMP key principles and confirm that the BFN CRMP satisfies these key principles.

TVA Response The BFN configuration risk management program (CRMP) satisfies the key principles in Regulatory Guide (RG) 1.177. A summary of the CRMP was included in Section 4.4.1 of the enclosure to the BFN ECCS PPL LAR. Sections 4.4.1.2.2 and 4.4.1.2.3 discuss the capability to perform contemporaneous assessment of the overall impact on the safety of proposed plant configurations before performing and during performance of maintenance CNL-16-076 Enclosure 1, Page 8 of 10

activities that remove equipment from service. This process is used to avoid risk-significant plant configurations per TVA procedures NPG-SPP-07.1 (On-Line Risk Management),

NPG-SPP-07.3 (Work Activity Risk Management Process), and NPG-SPP-7.2.11 (Shutdown Risk Management).

TVA procedure NPG-SPP-07.1 applies to all work activities that affect, or have the potential to affect, a plant component, system, or unit configuration. Attachment 3 of NPG-SPP-07.1 addresses the graded approach to scheduling. It provides the appropriate management involvement with the required emphasis on the appropriate systems, structures, and components (SSCs) to properly manage the maintenance of the facility. The attachment discusses the scheduling level and types of activities considered including both risk significant and non-risk significant activities.

Section 3.2.3 (Managing Risk) of procedure NPG-SPP-07.1 states:

"An on-line assessment of scheduled activities is performed before implementation of a work window. The assessment includes the following:

1. Any changes to planned unavailability of safety related components due to changes in plant conditions or schedule changes shall be re-evaluated for risk impact to the plant, referencing NPG-SPP-09.11.1, Equipment Out of Service (EOOS)

Management. Re-run the plant risk program (EOOS) for scheduled or emergent activities via a "what if" assessment for short term work or perform an assessment per the plant risk matrix. During the implementation week this is performed by Operations.

2. External event considerations involving the potential impacts of weather, external flooding, grid reliability, and other external impacts, are imminent or have a high probability of occurring during the planned out of service duration. Reference NPG-SPP-07.1.6, On Line Work Control Power System Alerts / Offsite Power."

As discussed in Section 4.4.1.2 of the enclosure to the BFN ECCS PPL LAR, TVA procedure NPG-SPP-09.11, "Probabilistic Risk Assessment (PRA) Program" controls the management of PRA applications and periodic PRA updates. Periodic changes made to the base plant-specific PRA model are required to incorporate system, structure, component and operating philosophy changes, and new plant-specific data. In accordance with TVA procedure NPG-SPP-09.11, plant modifications or design changes that result in new configurations, alignments, and capabilities of plant systems are assessed for inclusion in model updates. Furthermore TVA procedure NEDP-26, "Probabilistic Risk Assessment (PRA)," provides the requirements for the cumulative impact of plant configuration changes, including plant-specific design, procedure, and operational changes that require an update to the Model of Record (MOR). The CRMP assessment tool EOOS, is updated in accordance with NPG-SPP-09.11 per the Equipment Out of Service Management procedure (NPG-SPP-09.11.1)

The CRMP assessment is a well-defined process that is governed by TVA procedure NPG-SPP-07.1. The quantified change in risk is used as one input with respect to configuration risk management. Furthermore, the process prescribes successively higher levels of management approval for plant configurations resulting in an increase in risk at various levels.

CNL-16-076 Enclosure 1, Page 9 of 10

For on-line maintenance, a risk assessment is performed prior to implementation and emergent work is evaluated against the assessed scope. BFN assesses and manages plant configurations prior to entering the maintenance configuration. The proposed plant configuration is modeled in the computer code EOOS (Equipment Out Of Service) to determine the change in CDF (CDF) and change in LERF (LERF).

As noted above, the CRMP assessment tool (EOOS) is used to determine both CDF and LERF for the at-power, internal events PRA model. In addition, EOOS includes logic that provides qualitative inputs for the risk assessment associated with fires and also for the assessment of fuel pool cooling. The On-Line Work Management procedure includes guidance for assessing the potential impacts of weather, external flooding, grid reliability, and other external impacts, when these are imminent or have a high probability of occurring during the planned out of service duration.

CNL-16-076 Enclosure 1, Page 10 of 10

ENCLOSURE 2 Tennessee Valley Authority Browns Ferry Nuclear Plant, Units 1, 2, and 3 Summary of BFN Request for Additional Information Response Dates CNL-16-076 Enclosure 2, Page 1 of 3

Request for Additional Due Date Information (RAI) Question Actual Date of Response Number Electrical Engineering Branch (EEEB)

EEEB RAI 1 May 11, 2016 EEEB RAI 2 May 11, 2016 EEEB RAI 3 May 11, 2016 EEEB RAI 4 May 11, 2016 Instrumentation and Controls Branch (EICB)

EICB RAI 1 May 11, 2016 EICB RAI 2 May 11, 2016 EICB RAI 3 June 16, 2016 Probabilistic Risk Assessment Branch (PRA) Licensing Branch (APLA)

APLA-RAI-1 April 15, 2016 CNL-16-066, April 15, 2016 APLA-RAI-2 April 15, 2016 CNL-16-066, April 15, 2016 APLA-RAI-3 April 15, 2016 CNL-16-066, April 15, 2016 APLA-RAI-4 May 11, 2016 APLA-RAI-5 June 16, 2016 APLA-RAI-6a May 11, 2016 APLA-RAI-6b May 11, 2016 APLA-RAI-6c May 11, 2016 APLA-RAI-6d June 16, 2016 APLA-RAI-7 May 11, 2016 APLA-RAI-8 April 15, 2016 CNL-16-066, April 15, 2016 APLA-RAI-9 April 15, 2016 CNL-16-066, April 15, 2016 CNL-16-076 Enclosure 2, Page 2 of 3

Request for Additional Due Date Information (RAI) Question Actual Date of Response Number APLA-RAI-10 April 29, 2016 CNL-16-076, April 29, 2016 APLA-RAI-11 April 29, 2016 CNL-16-076, April 29, 2016 APLA-RAI-12 May 25, 2016 APLA-RAI-13a June 16, 2016 APLA-RAI-13b May 25, 2016 APLA-RAI-13c May 25, 2016 APLA-RAI-14 June 16, 2016 APLA-RAI-15 May 25, 2016 APLA-RAI-16 April 29, 2016 CNL-16-076, April 29, 2016 Summary April 15, 2016: APLA RAI 1, 2, 3, 8, 9 April 29, 2016: APLA RAI 10, 11, 16 May 11, 2016: APLA RAI 4, 6a, 6b, 6c, 7; EEEB RAI 1, 2, 3, 4; EICB RAI 1, 2 May 25, 2016: APLA RAI 12, 13b, 13c, 15 June 16, 2016: APLA RAI 5, 6d,13a, 14; EICB RAI 3 CNL-16-076 Enclosure 2, Page 3 of 3