CNL-17-056, Application to Revise Technical Specification 5.5.12 Primary Containment Leakage Rate Testing Program (BFN-TS-497)

Application to Revise Technical Specification 5.5.12 Primary Containment Leakage Rate Testing Program (BFN-TS-497)

ML17228A490
Person / Time
Site:	Browns Ferry
Issue date:	08/15/2017
From:	James Shea Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
BFN-TS-497, CNL-17-056
Download: ML17228A490 (251)

Text

1101 Market Street, Chattanooga, Tennessee 37402 CNL-17-056 August 15, 2017 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296

Subject:

Application to Revise Technical Specification 5.5.12 "Primary Containment Leakage Rate Testing Program" (BFN-TS-497)

Reference:

1. Nuclear Energy Institute 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," dated July 2012, (ML12221A202)

2. Electrical Power Research Institute (EPRI) report, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325" (EPRI Product No. 1018243), dated August 1994

3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011 (ML13109A112)

In accordance with the provisions of 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Tennessee Valley Authority (TVA) is submitting a request for an amendment to Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3.

The proposed changes would revise the BFN, Units 1, 2, and 3, Technical Specifications (TS) 5.5.12, "Primary Containment Leakage Rate Testing Program," by adopting Nuclear Energy Institute (NEI) 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," (Reference 1) as the implementation document for the performance-based Option B of 10 CFR Part 50, Appendix J. The proposed changes permanently extend the Type A containment integrated leak rate testing (ILRT) interval from 10 years to 15 years and the Type C local leakage rate testing intervals from 60 months to 75 months.

U.S. Nuclear Regulatory Commission CNL-17-056 Page 2 August 15, 2017 The proposed amendment is considered risk-informed. An evaluation has been performed to assess the risk effect of the proposed change. The risk assessment follows the guidelines of Reference 1, and the corresponding Electrical Power Research Institute (EPRI) Report, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325" (EPRI Report 1018243) (Reference 2), and the guidance of Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (Reference 3). to this letter provides a description of the proposed changes, technical evaluation of the proposed changes, regulatory evaluation, and a discussion of environmental considerations. Attachment 1 to the enclosure provides the existing TS pages marked-up to show the proposed changes. Attachment 2 to the enclosure provides the retyped TS pages incorporating the proposed changes. to this letter is a risk impact assessment for permanently extending the containment Type A test interval. The risk assessment includes external events analyses which assumes all modifications are implemented in support of transition to NFPA-805. This work is scheduled for completion in the spring of 2019. Appendix A to Enclosure 2 to this letter provides the resolutions of the Probabilistic Risk Assessment Peer Review Team Facts and Observations and the impact on the proposed license amendment.

TVA requests approval of the proposed license amendment by October 31, 2018, in order to incorporate these changes into the BFN schedule. The license amendment will be implemented prior to BFN Unit 2 startup following the spring 2019 refueling outage to coincide with the completion of all required NFPA-805 modifications. This would allow deferral of the next ILRT Type A tests, currently scheduled for Unit 2 in the spring of 2019, Unit 1 in the fall of 2020 and Unit 3 in the spring of 2022.

The proposed changes allow the ILRT to be performed within 15 years from the last test on each unit. This application represents a cost-beneficial licensing change by performing the ILRT every 15 years versus 10 years with no corresponding decrease in plant safety.

TVA has determined that there are no significant hazards considerations associated with the proposed change and that the change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9).

The BFN Plant Operations Review Committee and the TVA Nuclear Safety Review Board have reviewed this proposed change and determined that operation of BFN in accordance with the proposed change will not endanger the health and safety of the public.

Additionally, in accordance with 10 CFR 50.91(b)(1), TVA is sending a copy of this letter and the enclosure to the Alabama State Department of Public Health.

U.S. Nuclear Regulatory Commission CNL-17-056 Page 3 August 15, 2017 There are no regulatory commitments associated with this submittal. Please address any questions regarding this request to Mr. Edward D. Schrull at (423) 751-3850.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 15th day of August 2017.

Respectfully, J. W . Shea Vice President, Nuclear Regulatory Affairs and Support Services

Enclosures:

1. Evaluation of Proposed Change

2. Risk Impact Assessment cc (Enclosures) :

NRC Regional Administrator - Region II NRC Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant State Health Officer, Alabama State Department of Public Health

Enclosure 1 Tennessee Valley Authority Browns Ferry Nuclear Plant, Units 1, 2, and 3 Evaluation of Proposed Change

Subject:

Application to Revise Technical Specification 5.5.12, "Primary Containment Leakage Rate Testing Program" (BFN-TS-497)

Table of Contents 1.0

SUMMARY

DESCRIPTION ....................................................................................... 2 2.0 DETAILED DESCRIPTION ........................................................................................ 2

3.0 BACKGROUND

......................................................................................................... 3

4.0 TECHNICAL EVALUATION

...................................................................................... 5 4.1 Description of Containment .............................................................................................. 7 4.1.1 Drywell ............................................................................................................................... 8 4.1.2 Pressure Suppression Chamber and Vent System........................................................... 8 4.1.3 Isolation Valves ................................................................................................................. 9 4.1.4 Primary Containment Normal Heating, Ventilation, and Air Conditioning Systems ........ 10 4.2 Integrated Leak Rate Test History .................................................................................. 11 4.3 Type B and Type C Testing Programs............................................................................ 12 4.4 Supplemental Inspection Requirements ........................................................................ 14 4.4.1 IWE Examinations ........................................................................................................... 16 4.5 Deficiencies Identified ...................................................................................................... 21 4.6 Plant Specific Confirmatory Analysis............................................................................. 22 4.6.1 Methodology .................................................................................................................... 22 4.6.2 PRA Technical Adequacy................................................................................................ 24 4.6.3 Results and Conclusion of Plant-Specific Risk Assessment.......................................... 30

5.0 REGULATORY EVALUATION

.................................................................................33 5.1 Applicable Regulatory Requirements and Criteria ....................................................... 33 5.2 Precedent .......................................................................................................................... 34 5.3 No Significant Hazards Consideration ........................................................................... 34 5.4 Conclusions ...................................................................................................................... 37

6.0 ENVIRONMENTAL CONSIDERATION

....................................................................37

7.0 REFERENCES

.........................................................................................................38 Attachment 1. Proposed TS (Markups) for BFN, Units 1, 2, and 3 Attachment 2. Proposed TS Changes (Final Typed) for BFN, Units 1, 2, and 3 CNL-17-056 E1-1 of 39

Enclosure 1 1.0

SUMMARY

DESCRIPTION This evaluation supports a request to revise the current licensing basis of Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2 and 3, by revising the BFN, Units 1, 2, and 3, Technical Specifications (TS) 5.5.12, "Primary Containment Leakage Rate Testing Program," by adopting Nuclear Energy Institute (NEI) 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," (Reference 1) as the implementation document for the performance-based Option B of 10 CFR Part 50, Appendix J. The proposed changes permanently extend the Type A containment integrated leak rate testing (ILRT) interval from 10 years to 15 years and the Type C local leakage rate testing (LLRT) intervals from 60 months to 75 months.

2.0 DETAILED DESCRIPTION This proposed change in the current licensing basis is a permanent change of the Type A test interval from 10 years to 15 years and of the Type C tests from 60 months to 75 months. The approved change of the ILRT and LLRT would be incorporated into TS 5.5.12 by modifying the existing first paragraph of TS 5.5.12 to reflect the new revision of NEI 94-01.

The first paragraph of BFN, Units 1, 2, and 3, TS 5.5.12 states:

A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50 Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995.

The first paragraph of BFN, Units 1, 2, and 3, TS 5.5.12 is revised to state:

A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50 Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," dated July 2012, and Section 4.1, "Limitations and Conditions for NEI TR 94-01, Revision 2," of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

Attachment 1 to this enclosure provides the existing TS pages marked-up to show the proposed changes. Attachment 2 to this enclosure provides the retyped TS pages incorporating the proposed changes.

CNL-17-056 E1-2 of 39

Enclosure 1

3.0 BACKGROUND

The testing requirements of 10 CFR 50, Appendix J (Reference 2), provide assurance that leakage from the containment, including systems and components that penetrate the containment, does not exceed the allowable leakage values specified in TS 5.5.12.

The periodic surveillance of containment penetrations and isolation valves ensure that proper maintenance and repairs can be performed on the systems and components penetrating containment during the service life of the containment. The limitation on containment leakage provides assurance that the containment would perform its design function following an accident up to and including the plant design basis accident.

Appendix J identifies three types of required tests: (1) Type A tests, intended to measure the containment overall integrated leakage rate; (2) Type B tests, intended to detect local leaks and to measure leakage across pressure-containing or leakage limiting boundaries (other than valves) for containment penetrations; and (3) Type C tests, intended to measure containment isolation valve leakage. Type B and C tests identify the vast majority of potential containment leakage paths. Type A tests identify the overall (integrated) containment leakage rate and serve to ensure continued leakage integrity of the containment structure by evaluating those structural parts of the containment not covered by Type B and Type C testing.

This request modifies the existing Appendix J Type A and Type C testing intervals but does not change the Appendix J Type A or Type C test methods. The ILRT imposes significant expense on the station while the safety benefit of performing it within 10 years, versus 15 years, is minimal. The benefits of increasing the allowable extended testing interval for Type C LLRTs by 15 months will result in a reduction in the amount of testing required, with commensurate reductions in radiation exposure, personnel time in lining up for tests, draining systems, conducting tests, and the risk involved in performing such testing while the safety benefit of performing Type C LLRTs within 60 months, versus 75 months, is minimal. This request represents a cost-beneficial licensing change with no reduction in safety margin.

In 1995, 10 CFR 50, Appendix J was amended to provide a performance-based Option B for containment leakage testing requirements. Option B requires that test intervals for Type A, Type B, and Type C testing be determined by using a performance-based approach. Performance-based test intervals are based on consideration of the operating history of the component and resulting risk from its failure. The use of the term "performance-based" in 10 CFR 50, Appendix J refers to both the performance history necessary to extend test intervals, as well as to the criteria necessary to meet the requirements of Option B. Also in 1995, NRC Regulatory Guide (RG) 1.163 (Reference 3) was issued. RG 1.163 endorsed NEI 94-01, Revision 0, "Industry Guideline for Implementing Performance-Based Option of 94-01, Appendix J" (Reference 4), with certain modifications and additions. Option B, in concert with RG 1.163 and NEI 94-01, Revision 0, allows licensees with a satisfactory ILRT performance history (i.e., two consecutive successful Type A tests) to reduce the test frequency from the containment Type A (ILRT) test from three tests in ten years to one test in ten years. This relaxation was based on an NRC risk program documented in NUREG-1493, "Performance-Based Containment Leak-Test Program" (Reference 5) and Electric Power Research Institute (EPRI) Topical Report (TR)-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals" (Reference 6), both of which illustrated that the risk increase associated with extending the ILRT surveillance interval was very small.

CNL-17-056 E1-3 of 39

Enclosure 1 NEI 94-01, Revision 2 (Reference 7), describes an approach for implementing the optional performance-based requirements of Option B described in 10 CFR 50, Appendix J, which includes provisions for extending Type A intervals to up to 15 years and incorporates the regulatory positions stated in RG 1.163. NEI 94-01, Revision 2 delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance testing frequencies. This method uses industry performance data, plant-specific performance data, and risk insights in determining the appropriate testing frequency. NEI 94-01, Revision 2, also discusses the performance factors that licensees must consider in determining test intervals. However, NEI 94-01, Revision 2 does not address how to perform the tests because these details are included in existing documents (e.g., American National Standards Institute/American Nuclear Society [ANSI/ANS]-56.8-2002). The NRC final Safety Evaluation (SE), issued by letter dated June 25, 2008 (Reference 8), documents the NRC's evaluation and acceptance of NEI 94-01, Revision 2, subject to the specific limitations and conditions listed in Section 4.1 of the SE. The accepted version of NEI 94-01 was subsequently issued as Revision 2-A dated October 2008 (Reference 9).

EPRI Report 1009325, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," Revision 2 (Reference 10), provides a risk impact assessment for optimized ILRT intervals of up to 15 years, utilizing current industry performance data and risk-informed guidance, primarily Revision 1 of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases" (Reference 11). The assessment validates increasing allowable extended LLRT intervals to the 120 months as specified in NEI 94-01, Revision 0.

However, the industry requested that the allowable extended interval for Type C LLRTs be increased only to 75 months, to be conservative, with a permissible extension (for non-routine emergent conditions) of nine months (i.e., 84 months total). The NRC's final SE, issued by letter dated June 25, 2008, documents the NRC's evaluation and acceptance of EPRI Report 1009325, Revision 2, and extension of the Type C LLRT interval to 75 months, subject to the specific limitations and conditions listed in Section 4.2 of the SE. An accepted version of EPRI Report 1009325, Revision 2 was subsequently issued as EPRI Report 1018243, "Risk Impact of Extended Integrated Leak Rate Testing Intervals - Revision 2-A of 1009325," dated October 2008 (Reference 12).

NEI 94-01, Revision 3 (Reference 13), describes an approach for implementing the optional performance-based requirements of Option B described in 10 CFR 50, Appendix J, which includes provisions for extending Type A and Type C intervals to up to 15 years and 75 months, respectively, and incorporates the regulatory positions stated in RG 1.163. It delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance testing frequencies. This method uses industry performance data, plant-specific performance data, and risk insights in determining the appropriate testing frequency. NEI 94-01, Revision 3, also discusses the performance factors that licensees must consider in determining test intervals. However, it does not address how to perform the tests because these details are included in existing documents (e.g., ANSI/ANS-56.8-2002). The NRC final SE issued by letter dated June 8, 2012 (Reference 14), documents the NRC's acceptance of NEI 94-01, Revision 3, subject to the specific limitations and conditions listed in Section 4.0 of the SE. The accepted version of NEI 94-01 was subsequently issued as Revision 3-A dated July 2012.

CNL-17-056 E1-4 of 39

Enclosure 1

4.0 TECHNICAL EVALUATION

As required by 10 CFR 50.54(o), the BFN, Units 1, 2, and 3, containments are subject to the requirements set forth in 10 CFR 50, Appendix J. Option B of Appendix J requires that test intervals for Type A, Type B, and Type C testing be determined by using a performance-based approach. Currently, the BFN 10 CFR 50 Appendix J Testing Plan is based on RG 1.163, which endorses NEI 94-01, Revision 0. This LAR proposes to revise the BFN 10 CFR 50, Appendix J Testing Plan by implementing the guidance in NEI 94-01, Revision 3-A.

In the SE issued by the NRC dated June 8, 2012, the NRC concluded that NEI 94-01, Revision 3, as modified to include two limitations and conditions, is acceptable for referencing by licensees proposing to amend their TS with regard to containment leakage rate testing for the optional performance-based requirements of Option B of 10 CFR 50, Appendix J.

The following addresses each of the limitations and conditions of the 2008 and 2012 SEs.

Limitation / Condition TVA Response (from Section 4.1 of SE dated June 25,2008)

1. For calculating the Type A leakage rate, the Following NRC approval of this LAR, BFN, licensee should use the definition in the NEI TR Units 1, 2, and 3, will use the definition in 94-01, Revision 2, in lieu of that in ANSI/ANS- Section 5.0 of NEI 94-01, Revision 3-A, for 56.8-2002. calculating the Type A leakage rate when future BFN, Units 1, 2, and 3 Type A tests are performed. The definitions in Revision 2-A and 3-A are identical.

2. The licensee submits a schedule of The schedule of containment inspections is containment inspections to be performed prior to provided in Section 4.4 below.

and between Type A tests.

3. The licensee addresses the areas of the General visual examination of accessible containment structure, potentially subjected to interior and exterior surfaces of the degradation. containment system for structural problems is conducted in accordance with the BFN, Units 1, 2, and 3, Containment Inservice Inspection Plans that implement the requirements of the ASME,Section XI, Subsection IWE, as required by 10 CFR 50.55a. The provisions of 10CFR50.55a relative to examination of Class CC components (ASME Section XI Subsection IWL) are not applicable to BFN, since BFN does not have any ASME Code Class CC equivalent components.

CNL-17-056 E1-5 of 39

Enclosure 1 Limitation / Condition TVA Response (from Section 4.1 of SE dated June 25,2008)

4. The licensee addresses any tests and Any future containment modifications will be inspections performed following major addressed by the site design change process modifications to the containment structure, as including any containment post-modification applicable. testing as required by Section 3.1.4 of the NRC staff SE for NEI 94 01, Revision 2.

5. The normal Type A test interval should be less TVA acknowledges and accepts this NRC staff than or equal to 15 years. If a licensee has to position, as communicated to the nuclear utilize the provision of Section 9.1 of NEI TR 94- industry in Regulatory Issue Summary 2008-27 01, Revision 2, related to extending the ILRT dated December 8, 2008 (Reference 15).

interval beyond 15 years, the licensee must demonstrate to the NRC staff that it is an unforeseen emergent condition.

6. For plants licensed under 10 CFR Part 52, Not applicable. BFN Units 1, 2 and 3 are not applications requesting a permanent extension of licensed pursuant to 10 CFR Part 52.

the ILRT surveillance interval to 15 years should be deferred until after the construction and testing of containments for that design have been completed and applicants have confirmed the applicability of NEI TR 94-01, Revision 2, and EPRI Report No. 1009325, Revision 2, including the use of past containment ILRT data.

Limitation / Condition TVA Response (from Section 4.0 of SE dated July 2012)

1. The staff is allowing the extended interval for Following NRC approval of this LAR, BFN, Type C LLRTs be increased to 75 months with the Units 1, 2 and 3, will follow the guidance of requirement that a licensees post-outage report NEI 94-01, Revision 3-A to assess and include the margin between the Type B and Type monitor margin between the Type B and C leakage rate summation and its regulatory limit. Type C leakage rate summation and the In addition, a corrective action plan shall be regulatory limit. This will include corrective developed to restore the margin to an acceptable actions to restore margin to an acceptable level. The staff is also allowing the non-routine level.

emergent extension out to 84-months as applied to Type C valves at a site, with some exceptions that must be detailed in NEI 94-01, Revision 3. At no time shall an extension be allowed for Type C valves that are restricted categorically (e.g. BWR MSIVs), and those valves with a history of leakage, or any valves held to either a less than maximum interval or to the base refueling cycle interval. Only non-routine emergent conditions allow an extension to 84 months.

CNL-17-056 E1-6 of 39

Enclosure 1 Limitation / Condition TVA Response (from Section 4.0 of SE dated July 2012)

2. When routinely scheduling any LLRT valve Following NRC approval of this LAR, BFN, interval beyond 60-months and up to 75-months, Units 1, 2, and 3, will estimate the amount of the primary containment leakage rate testing understatement in the Types B and C total program trending or monitoring must include an and include determination of the acceptability estimate of the amount of understatement in the in a post-outage report, consistent with the Type B & C total, and must be included in a guidance of Section 11.3.2 of NEI 94-01, licensees post-outage report. The report must Revision 3-A.

include the reasoning and determination of the acceptability of the extension, demonstrating that the LLRT totals calculated represent the actual leakage potential of the penetrations.

To comply with the requirement of 10 CFR 50, Appendix J, Option B, BFN, Units 1, 2 and 3, TS 5.5.12 currently references RG 1.163. RG 1.163 states that NEI 94-01, Revision 0, provides methods acceptable to the NRC for complying with Option B of 10 CFR 50, Appendix J, with four exceptions described therein. The current BFN, Units 1, 2, and 3, TS 5.5.12 requires testing, including test intervals and extensions, to be in accordance with RG 1.163 with exceptions provided in the site implementing instructions and the following approved exemptions, which will remain in the revised program:

MSIV leak rate testing is performed at 25 psig to allow reverse testing of the inboard MSIV without lifting the valve seat. The NRC approved this deviation as meeting the equivalent or more conservative criteria of Section III.C.1 of Appendix J, and therefore not requiring exemption. This approval was communicated by letter dated October 24, 1984,

Subject:

10 CFR 50 Appendix J Compliance for Browns Ferry Nuclear Plant (ML013650063).

MSIV leakage is excluded from Appendix J Type B and Type C maximum and minimum pathway summation totals. This Appendix J exemption was approved by the NRC by letter dated September 26, 2006,

Subject:

Browns Ferry Nuclear Plant, Unit 1 - Exemption from the Requirement of 10 CFR Part 50, Appendix J (TAC No. MC3814) (ADAMS Accession No. ML062260141) for Unit 1, and by letter dated March 14, 2000,

Subject:

Browns Ferry Nuclear Plant, Units 2 and 3

- Issuance of Exemption from 10 CFR Part 50, Appendix J (TAC Nos. MA6815 and MA6816) (ML003691985) for Units 2 and 3.

4.1 Description of Containment The BFN design employs a pressure suppression primary containment that houses the reactor vessel, the reactor coolant recirculating loops, and other branch connections of the Reactor Primary System. The pressure suppression system consists of a drywell, a pressure suppression chamber that stores a large volume of water, connecting vents between the drywell and the pressure suppression chamber, isolation valves, containment cooling systems, and other service equipment. In the event of a process system piping failure within the drywell, reactor water and steam would be released into the drywell air space. The resulting increased drywell pressure would then force a CNL-17-056 E1-7 of 39

Enclosure 1 mixture of air, drywell atmosphere, steam, and water through the vents into the pool of water in the pressure suppression chamber. The steam would condense in the pressure suppression pool, resulting in a rapid pressure reduction in the drywell. Air that was transferred to the pressure suppression chamber pressurizes the pressure suppression chamber, and is subsequently vented back to the drywell to equalize the pressure between the two vessels. Cooling systems are provided to remove heat from the reactor core, the drywell, and from the water in the pressure suppression chamber, and thus provide continuous cooling of the primary containment under accident conditions.

Appropriate isolation valves are actuated during this period to ensure containment of radioactive material, which might otherwise be released from the reactor containment during the course of the accident.

4.1.1 Drywell The drywell is a steel pressure vessel with a spherical lower portion 67 feet in diameter, and a cylindrical upper portion 38 feet 6 inches in diameter. The overall height is approximately 115 feet. The design, fabrication, inspection and testing of the drywell vessel comply with requirements of the ASME Boiler and Pressure Vessel Code, 1965 edition,Section III, Class B, which pertain to containment vessels for nuclear power plants. The steel head and shell of the drywell are fabricated of SA-516 plate.

The drywell is designed for a maximum internal pressure of 62 psig coincident with a temperature of 281°F, plus the dead, live, and seismic loads imposed on the shell.

Thus, in accordance with the ASME Boiler and Pressure Vessel Code,Section III, the drywell design pressure is 56 psig. Thermal stresses in the steel shell due to temperature gradients were taken into account in the design.

The drywell is enclosed in reinforced concrete for shielding purposes to provide additional resistance to deformation and buckling of the drywell over areas where the concrete backs up the steel shell. Above the transition zone, the drywell is separated from the reinforced concrete by a gap of approximately two inches. This gap is filled with polyurethane foam.

4.1.2 Pressure Suppression Chamber and Vent System The vent system, which connects the drywell and pressure suppression chamber, conducts flow from the drywell to the pressure suppression chamber without excessive resistance and distributes this flow effectively and uniformly in the pool following a postulated pipe rupture in the drywell.

The pressure suppression chamber receives this flow, condenses the steam portion of this flow, and contains non-condensable gases and fission products driven into the pressure suppression chamber. The pressure suppression chamber-to-drywell vacuum breakers limit the pressure differential between the drywell and pressure suppression chamber. The pressure suppression chamber is designed for the same leakage rate as the drywell.

Large vent pipes form a connection between the drywell and the pressure suppression chamber. A total of eight circular vent pipes are provided, each having a diameter of 6.75 feet.

CNL-17-056 E1-8 of 39

Enclosure 1 The vent pipes are designed for an internal pressure of 56 psig (the ASME Boiler and Pressure Vessel Code,Section III, allows a maximum internal pressure of 62 psig) coincident with a temperature of 281°F and are designed to withstand an external pressure of 2 psi above internal pressure. Jet deflectors are provided in the drywell at the entrance of each vent pipe to prevent possible damage to the vent pipes from jet forces which might accompany a pipe break in the drywell. The vent pipes are fabricated of SA-516 steel, and comply with requirements of the ASME Boiler and Pressure Vessel Code,Section III, Subsection B. Expansion joints are provided on each vent pipe to accommodate differential motion between the drywell and pressure suppression chamber.

The pressure suppression chamber is a steel pressure vessel in the shape of a torus, below and encircling the drywell, with a centerline diameter of approximately 111 feet and a cross-sectional diameter of 31 feet. The pressure suppression chamber is held by supports that transmit vertical and seismic loading to the reinforced concrete foundation slab of the Reactor Building. Space is provided outside the pressure suppression chamber for inspection and maintenance. The eight drywell vents are connected to a 4.75 foot diameter vent header in the form of a torus, which is contained within the airspace of the pressure suppression chamber. Projecting downward from the header are 96 downcomer pipes, 24 inches in diameter, and terminating approximately 3 feet below the water surface of the pool. T-quenchers have been added to replace the ramshead discharge devices at the end of the main steam relief valve discharge pipes to ensure the controlled release and condensation of steam and reduce stresses on the torus and tailpipe assemblies. The vent header and vent pipes have the same temperature and pressure design requirements as the pressure suppression chamber.

Vacuum breakers discharge from the pressure suppression chamber into the drywell to limit the pressure differential and to prevent a backflow of water from the pressure suppression pool into the vent header system.

The pressure suppression chamber is designed to the same material and code requirements as the steel drywell vessel. All attachments to the torus are by full penetration welds.

The interior carbon steel surface of the pressure suppression chamber and all other exposed carbon steel surfaces within the pressure suppression chamber were originally coated for corrosion protection with Valspar Hi-Build Epoxy 78:00. This coating has passed test criteria for a design basis accident (DBA) for carbon steel substrate as outlined in ANSI N101.2-1972. Any repairs or replacement of this protective coating system are performed using other coating system(s) that are design basis accident qualified to ANSI N101.2-1972 and approved by TVA.

4.1.3 Isolation Valves The criteria governing isolation valves for the various categories of penetrations are as follows.

• Pipes or ducts which penetrate the primary containment and which connect to the reactor primary system, or are open to the drywell free air space, are provided with at least two isolation valves in series.

CNL-17-056 E1-9 of 39

Enclosure 1

• Excluding check valves and closed manual valves, valves in this category are designed to close automatically from selected signals and shall be capable of remote-manual actuation from the control room.

• The two valves are physically separated. On lines connecting to the reactor primary system, one valve is located inside the primary containment and the second outside the primary containment as close to the primary containment wall as practical.

• Lines that penetrate the primary containment, and which neither connect to the reactor primary system nor are open into the primary containment, are provided with at least one valve which may be located outside the primary containment. Valves in this category are capable of manual actuation from the control room.

• Motive power for the valves on process lines which require two valves are physically independent sources to provide a high probability that no single accidental event could interrupt motive power to both closure devices. Loss of power to each electrical division is detected and annunciated.

• For design basis breaks in a main steam line downstream of the outboard main steam isolation valve, isolation valve closure time is such that the valve will be closed prior to the start of uncovering the fuel.

• Valves, sensors, and other automatic devices essential to the isolation of the containment are provided with means to periodically test the functional performance of the equipment. Such tests include demonstration of proper working conditions, correct setpoint of sensors, proper speed of responses, and operability of fail-safe features.

• The control circuits for the isolation valves are designed so as to prevent the valves from automatically reopening when primary containment isolation logic is reset 4.1.4 Primary Containment Normal Heating, Ventilation, and Air Conditioning Systems Maintaining each drywell average ambient temperature 150°F during normal plant operation ensures that the insulation on motors, isolation valves, operators and sensors, instrument cable, electrical cable and gasket materials or sealants used at the penetrations has a sustained life without deterioration.

Each drywell is cooled during normal operation of the unit by a closed loop ventilation system designed to hold the average temperature in the drywell to 150°F. The atmosphere is circulated in the drywell normally by eight fans assembled in two groups of five, with one spare in each group (ten fans total). Spare fans may be placed in service at operator discretion to provide additional margin. Each fan has an individual cooling coil associated with it. Water from the Reactor Building Closed Cooling Water System (RBCCWS) is employed to remove heat from the coolers.

The drywell blowers and RBCCWS are kept in service upon extended loss of offsite power. This serves to prevent high drywell temperatures and associated equipment damage in units that have not sustained a loss-of-coolant accident (LOCA). Continued operation of the RBCCWS is desirable because this system provides the preferred method of cooling the drywell; however, the RBCCWS is not essential to safety. In the CNL-17-056 E1-10 of 39

Enclosure 1 event of failure of the RBCCWS and drywell blowers such that the drywell temperature in non-LOCA units could exceed the design value, the operator has sufficient time to manually initiate drywell cooling using torus water, the RHR pumps, and containment spray headers.

The loss of offsite power leads to the drywell blowers being unavailable for a short term.

The worst case unavailability is when a 480V load shed signal is received where restarting of the drywell cooling is delayed until the diesel generator loading will accept loading of the blowers. This leads to the conservative estimates of drywell temperature and pressure shown in Figure 5.2-5b through 5.2-5e for the short term transients in the drywell under normal operating conditions for the nonaccident unit (e.g., all equipment operates as expected). Emergency power reactivates the cooling which immediately terminates the temperature and pressure rises.

For BFN Units 1 and 2, six of the blowers are automatically returned in a staggered sequence from 40 to 90 seconds. While maintaining diesel generator load limits, as required, additional blowers are manually returned to service. The drywell pressure increases above 2.45 psig (drywell high-pressure setpoint) for a short period of time (satisfying half of the logic for an accident signal); however, the full accident signal is not created because normal reactor pressure is above the 450 psig low reactor pressure limit. The drywell air-space temperature remains below maximum containment design temperature limit.

For BFN Unit 3, eight of the drywell blowers are automatically returned after 40 seconds.

The drywell pressure remains below the 2.45 psig limit above which satisfies half of the logic for an accident signal (the other half is low reactor pressure below 450 psig), and the drywell air-space temperature remains below the maximum containment design temperature.

4.2 Integrated Leak Rate Test History Previous ILRT testing confirmed that BFN, Units 1, 2, and 3, containment structures' leakage are acceptable, with considerable margin, with respect to the TS acceptance criteria of 2.0 percent (%) of containment air weight at the design basis LOCA pressure (La). Because the last three BFN Units 1, 2, and 3 Type-A results (as shown below) meet the performance leakage rate criteria from NEI 94-01, Revision 3-A, a test frequency of at least once per 15 years would be in accordance with NEI 94-01, Revision 3-A.

CNL-17-056 E1-11 of 39

Enclosure 1 BFN, Unit 1 Test Date As Found Leakage Acceptance Limit*

Mass Point Upper Confidence Limit (UCL) 5/6/81 0.086 of La 1.0 La leakage with penalties 3/14/07 Mass Point UCL leakage with penalties 0.04 of La 1.0 La 11/19/10 Mass Point UCL leakage with penalties 0.10 of La 1.0 La BFN, Unit 2 Test Date As Found Leakage Acceptance Limit*

3/18/91 Mass Point UCL leakage with penalties 0.125 of La 1.0 La 11/7/94 Mass Point UCL leakage with penalties 0.175 of La 1.0 La 6/3/09 Mass Point UCL leakage with penalties 0.31 of La 1.0 La BFN, Unit 3 Test Date As Found Leakage Acceptance Limit*

3/22/82 Mass Point UCL leakage with penalties 0.164 of La 1.0 La 10/11/98 Mass Point UCL leakage with penalties 0.15 of La 1.0 La 5/12/12 Mass Point UCL leakage with penalties 0.29 of La 1.0 La

• The total allowable "as-left" leakage is 0.75 La, (La, 2% of primary containment air by weight per day, is the leakage assumed in design basis accident radiological analyses) with 0.6 La, the maximum leakage from Type B and Type C components.

Type B and Type C containment penetrations tests (e.g., electrical penetrations, airlocks, hatches, bellows, flanges, and valves) are being performed in accordance with Option B of 10 CFR 50, Appendix J. The current total penetration leakage on a minimum path basis is approximately 13.1%, for Unit 1, 18.4% for Unit 2, and 12.6% for Unit 3, of the leakage allowed for containment integrity (i.e., 0.6 La).

There are no known modifications that will require a Type A test to be performed prior to U1R15 (Fall 2024), U2R22 (Spring 2023), and U3R22 (Spring 2026), when the next Type A tests will be performed in accordance with this proposed change. Any unplanned modifications to the containment prior to the next scheduled Type A test would be subject to the testing requirements of NEI 94-01, Revision 0, Section 9.2.4 or NEI 94-01, Revision 3-A, Section 9.2.4, as applicable.

There have been no pressure or temperature excursions in either BFN, Units 1, 2, or 3 containments which could have adversely affected containment integrity since the performance of the last Type A tests. There is no other anticipated addition or removal of plant hardware within either BFN, Units 1, 2, or 3 containments that could affect leak-tightness.

4.3 Type B and Type C Testing Programs The BFN, Units 1, 2, and 3, Appendix J, Type B and Type C leakage rate test program CNL-17-056 E1-12 of 39

Enclosure 1 requires testing of electrical penetrations, airlocks, hatches, bellows, flanges, and valves within the scope of the program as required by 10 CFR 50, Appendix J, Option B and TS 5.5.12. The Type B and Type C testing program consists of LLRT of penetrations with a resilient seal, hatches, bellows, flanges, and containment isolation valves that serve as a barrier to the release of the post-accident containment atmosphere.

A review of the most recent Type B and Type C test results and a comparison with the allowable leakage rate was performed. The combined Type B and Type C leakage has remained below 0.6 La (i.e., approximately 646.3 standard cubic feet per hour (SCFH))

for BFN Unit 1 and 655.9 SCFH for BFN Units 2 and 3). The maximum and minimum pathway leak rate summary totals for the last three refueling outages are shown below.

BFN, Unit 1 U1R9 As-Found Minimum Pathway Leakage 107.8 SCFH Fall 2012 As-Left Maximum Pathway Leakage 194.7 SCFH U1R10 As-Found Minimum Pathway Leakage 149.8 SCFH Fall 2014 As-Left Maximum Pathway Leakage 177.8 SCFH U1R11 As-Found Minimum Pathway Leakage 90.65 SCFH Fall 2016 As-Left Maximum Pathway Leakage 184.3 SCFH BFN, Unit 2 U2R17 As-Found Minimum Pathway Leakage 199.3 SCFH Spring 2013 As-Left Maximum Pathway Leakage 220.9 SCFH U2R18 As-Found Minimum Pathway Leakage 152.9 SCFH Spring 2015 As-Left Maximum Pathway Leakage 247.6 SCFH U2R19 As-Found Minimum Pathway Leakage 122.17 SCFH Spring 2017 As-Left Maximum Pathway Leakage 207.01 SCFH BFN, Unit 3 U3R15 As-Found Minimum Pathway Leakage 162.1 SCFH Spring 2012 As-Left Maximum Pathway Leakage 225.1 SCFH U3R16 As-Found Minimum Pathway Leakage 123.3 SCFH Spring 2014 As-Left Maximum Pathway Leakage 199.5 SCFH U3R17 As-Found Minimum Pathway Leakage 177.8 SCFH Spring 2016 As-Left Maximum Pathway Leakage 204.8 SCFH Each unit has two airlock doors, 30 individual bellows tests, 31-33 electrical penetrations, 16 resilient seal and hatch type penetrations, and 20 piping flanges that are LLRT (Type B) tested. Additionally, the entire HPCI and RCIC exhaust vacuum breaker network lines for all three units are Type B tested. BFN Unit 1 has 43 penetration / pathways with 99 isolation valves, and BFN Units 2 and 3 have 45 penetration / pathways with 102 isolation valves that are LLRT (Type C). Currently, approximately 9.4% of the components (all units combined) are tested at the 30-month CNL-17-056 E1-13 of 39

Enclosure 1 nominal interval due to performance. However, no unit's overall Type B and Type C leakage has approached the La leakage limit.

As discussed in NUREG-1493, "Performance-Based Containment Leak-Test Program,"

Type B and Type C tests can identify the vast majority (greater than 95%) of all potential containment leakage paths. This amendment request adopts the guidance in NEI 94-01, Revision 3-A, in place of NEI 94-01, Revision 0, for the Type C test interval (up to 75 months), but otherwise does not affect the scope or performance of Type B or Type C tests. Type B and Type C testing will continue to provide a high degree of assurance that containment integrity is maintained.

4.4 Supplemental Inspection Requirements Prior to initiating a Type A test, a general visual examination of accessible interior and exterior surfaces of the containment system is performed to identify any potential structural problems that could affect either the containment structure leakage integrity or the performance of the Type A test. This inspection is typically conducted in accordance with the BFN, Units 1, 2, and 3, Containment Inservice Inspection (CISI) Program, that implements the requirements of ASME, Section Xl, Subsection IWE. The Code of Record for the examination of Class MC and Class CC components and related requirements for BFN, Units 1, 2, and 3 is currently the 2001 Edition including 2003 Addenda of the ASME Boiler and Pressure Vessel Code,Section XI, Division 1 in accordance with 10 CFR 50.55a(g)(4)(ii) and the additional requirements specified in 10 CFR 50.55a(b)(2)(ix)(A), (B), and (F) through (I).

The examinations performed in accordance with the BFN IWE program satisfy the general visual examination requirements specified in 10 CFR 50, Appendix J, Option B.

Identification and evaluation of inaccessible areas are addressed in accordance with the requirements of 10 CFR 50.55a(b)(2)(ix)(A). Examination of pressure-retaining bolted connections and evaluation of containment bolting flaws or degradation are performed in accordance with the requirements of 10 CFR 50.55a(b)(ix)(G) and 10 CFR 50.55a(b)(ix)(H). Each ten-year IWE interval is divided into three approximately equal-duration inspection periods. A minimum of one inspection during each inspection period of the IWE interval is required by the IWE program.

Subsection IWE ensures that at least three general visual examinations of metallic components would be conducted before the next Type A test if the Type A test interval is extended to 15 years. This meets the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A and Condition 2 in Section 4.1 of the NRC SE for NEI 94-01, Revision 2.

TVA performs a visual inspection of the accessible interior and exterior of the BFN, Units 1, 2, and 3 primary containment vessels prior to each Type A test. This examination is performed in sufficient detail to identify any evidence of deterioration which may affect the structural integrity or leak tightness of the containment vessels.

The examination is conducted in accordance with approved plant procedures to satisfy the requirements of the 10 CFR 50, Appendix J Testing Program. The activity is coordinated with the IWE examinations to the extent possible.

Together these examinations ensure that at least three general visual examinations of the accessible containment surfaces (exterior and interior) and one visual examination immediately prior to a Type A test would be conducted before the next Type A test if the CNL-17-056 E1-14 of 39

Enclosure 1 Type A test interval is extended to 15 years, thereby meeting the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A, as well as Condition 2 in Section 4.1 of the NRC SE for NEI 94-01, Revision 2.

The tables below provide dates of completed and scheduled ILRTs, completed containment surface examinations, along with an approximate schedule for future containment surface examinations, assuming the Type A test frequency is extended to 15 years.

Unit 1 Calendar Type A Test General Visual Examination of Year (ILRT) Accessible Interior and Exterior 2006 2007 3/14/2007 3/7/2007 2008 2009 2010 11/19/2010 11/17/2010 2011 2012 2013 2014 10/27/2014 2015 2016 10/27/2016 2017 2018 2019 2020 10/2020 2021 2022 2023 2024 11/2024 11/2024 Unit 2 Calendar Type A Test General Visual Examination of Year (ILRT) Accessible Interior and Exterior Surfaces 2006 2007 4/6/2007 2008 2009 6/3/2009 5/26/2009 2010 2011 2012 2013 4/30/2013 2014 2015 2016 2017 3/28/2017 2018 2019 2020 2021 3/2021 2022 2023 CNL-17-056 E1-15 of 39

Enclosure 1 2024 6/2024 6/2024 Unit 3 Calendar Type A Test General Visual Examination of Year (ILRT) Accessible Interior and Exterior Surfaces 2006 3/30/2006 2007 2008 2009 2010 3/31/2010 2011 2012 5/12/2012 5/8/2012 2013 2014 2015 2016 3/24/2016 2017 2018 2019 2020 3/2020 2021 2022 2023 2024 3/2024 2025 2026 2027 5/2027 5/2027 4.4.1 IWE Examinations In accordance with the Containment Inservice Testing Program, station personnel perform an IWE - General Visual examination on the accessible surface areas associated with the containment liner. A review of areas identified for augmented examination in accordance with IWE-1241 Category E-C examination requirements of the 1992 Edition with 1992 Addenda of ASME Section Xl for the initial 10-year interval was conducted for BFN, Units 1, 2 and 3. One area on both BFN Units 2 and 3 was determined to be susceptible to accelerated degradation and aging. This area was the Suppression Pool waterline region from elevation 536 to elevation 538. This area experienced repeated loss of coatings and was designated for augmented examination.

Augmented examinations were completed per the requirements of Category E-C and the components were removed from the augmented examination requirements per IWE-2420(c). The BFN, Unit 1 torus was not been maintained with the same amount of maintenance and inspection as BFN, Units 2 and 3 were. However, there was no evidence of excessive corrosion based on the results of recent UT thickness measurements. This information is documented in the First 10-year Containment ISI Plan for BFN, Units 1, 2, and 3.

First ten-year interval examination results are characterized by the following examples:

• In 1998, a visual examination of the BFN, Unit 3 Suppression Chamber exterior surface identified numerous areas of coating discontinuities, including minor CNL-17-056 E1-16 of 39

Enclosure 1 scratches, scrapes, flaking streaks, and loss of coating to the base metal. In the areas where loss of protective coatings occurred, base metal had only minor localized corrosion with no notable signs of significant material loss. The conditions noted did not affect the structural integrity or leak tightness of the Suppression Chamber. The areas identified for coating repair were cleaned and recoated in accordance with site procedures. A VT-3 preservice examination was performed following reapplication of coatings to satisfy the requirements of IWE 2200(g).

• In 1999, a visual examination of the BFN, Unit 2 Suppression Chamber exterior surface identified numerous areas of coating discontinuities, including minor scratches, scrapes, flaking streaks, and loss of coating to the base metal. In the areas where loss of protective coatings occurred, base metal had only minor localized corrosion with no notable signs of significant material loss. The conditions noted did not affect the structural integrity or leak tightness of the Suppression Chamber. The areas identified for coating repair were cleaned and recoated in accordance with site procedures. A VT-3 preservice examination was performed following reapplication of coatings to satisfy the requirements of IWE 2200(g). In areas where the Moisture Seal Barrier (MSB) was excavated for repair, a VT-1 examination of the exposed Drywell liner was examined and no reportable conditions were identified.

• In 2000, VT-3 examination of the BFN, Unit 3 Suppression Chamber exterior surface identified numerous areas rust and discoloration in areas identified for coating repairs. Peeling and flaking of Drywell Interior protective coatings was identified by VT 3 examination of areas identified for coating repairs. Degradation of the underlying base metal was not observed. The conditions noted did not affect the structural integrity or leak tightness of the Containment. The areas identified for coating repair were cleaned and recoated in accordance with site procedures. A VT-3 preservice examination was performed following reapplication of coatings to satisfy the requirements of IWE 2200(g). Coating deficiencies and corrosion of uncoated surfaces were identified by VT-3 examination of the Moisture Seal Barrier (MSB) to liner surface in areas identified for repair. In areas where the MSB was excavated for repair, a VT-3 examination of the exposed Drywell liner was examined and no reportable conditions were identified. Degradation of the underlying base metal was not observed.

• In 2002, a visual examination of the BFN, Unit 3 Drywell Interior surface identified gouges in the Drywell liner behind a duct that ruptured during plant operation. The gouges were blended and base metal recoated. The remaining HVAC ductwork was examined to determine no similar damage has occurred in another location. There were no conditions identified that affected the structural integrity or leak tightness of the Containment.

• In 2003, a visual examination of the BFN Unit 3 Suppression Chamber exterior surface identified arc strikes, dents, hammer marks and coating deficiencies. The conditions identified in these areas did not affect the structural integrity or leak tightness of the SCV.

• In 2006, a visual examination of the BFN, Unit 3 Drywell liner in areas excavated for MSB repair, identified pitting of the liner as the result of moisture entrapment where CNL-17-056 E1-17 of 39

Enclosure 1 the MSB separated from the liner. No evidence moisture bypassing the MSB was present in the concrete to steel interface in excavated areas. Numerous coating deficiencies were noted in areas identified for recoating. There was no degradation of the base metal present in areas where coatings were removed. Suppression Chamber exterior surface identified nicks, scratches, and surface rust. The conditions identified did not affect the structural integrity or leak tightness of the SCV.

• In 2007, a visual examination of the BFN, Unit 2 Suppression Chamber exterior surface identified arc strikes, minor chips and scratches in the protective coatings with light rust, and minor mechanical damage. The conditions identified did not affect the structural integrity or leak tightness of the SCV.

Examination results for BFN, Unit 1 during the First ten-year interval examination were similar to those identified on BFN, Units 2 and 3. All required examinations for the First ten-year Containment Inservice Inspection interval were completed prior to BFN, Unit 1 restart.

Second ten-year interval examination results are characterized by the following examples:

Unit 1

• In 2010, visual examination of the MSB identified a gouge in the MSB. The gouge did not penetrate the seal. The damaged portion of the seal was removed and exposed Drywell liner visually examined. No evidence of moisture intrusion observed in this area. A pit was identified in the Drywell liner in an area excavated for repair of the MSB. Remaining wall thickness was maintained greater than the required minimum wall thickness and was determined to be acceptable. Ductwork was found in contact with the Drywell liner. The interaction between the duct and liner was removed and the liner was inspected. No damage to the liner occurred.

Arc strikes and pitting with no appreciable depth and minor surface indications consisting of scrapes, dings, dents, etc. were identified on the exterior surface of the Suppression Chamber. Indications reported as gouges were identified; these indications were determined to be the result of removal of an attachment at some point in the past. The condition was not service induced and was determined to be acceptable. Grind marks were identified on the ECCS Ring Header exterior surface.

These grind marks appear to be legacy items from past activities and were coated.

No corrosion was present. The indications were evaluated and determined to be within allowable margins. Pitting on the lower Drywell Head Flange gasket sealing surface was identified. This condition has existed since the restart of Unit 1 and was addressed by a Design Change. The condition identified does not affect the leak tightness of the Drywell Head Flange as demonstrated by 10 CFR 50, Appendix J Leak Rate Testing. None of the conditions noted were considered suspect and did not affect the structural integrity or leak tightness of the containment.

• In 2014, a 3/8" long x 5/16" wide x 5/16" gouge was identified in the exterior surface of the Suppression Chamber in Bay 7. The Suppression Chamber is constructed from 3/4" plate. The depth of the gouge exceeded 10% nominal wall thickness and required engineering evaluation. The location of the gouge is in an area through which tools and equipment are transported. The indication is consistent with mechanical damage caused by impact of a tool or piece of equipment during CNL-17-056 E1-18 of 39

Enclosure 1 transport. The indication was re-examined in accordance with IWE-2420(b) U1R11.

The indication remained unchanged and was removed from augmented examination in accordance with IWE-2420(c). Pitting on the lower Drywell Head Flange gasket sealing surface was identified. This condition has existed since restart of Unit 1 and was addressed by DCN68136 for all three BFN units. The condition identified does not affect the leak tightness of the Drywell Head Flange as demonstrated by 10 CFR 50, Appendix J Leak Rate Testing. None of the conditions noted were considered suspect and did not affect the structural integrity or leak tightness of the containment.

• In 2016, pitting, mechanical damage, and corrosion was identified in Bay 1:

132.7 mils, Bay 12: 77 mils, Bay 13: 80.3 mils and 75.3 mils, and Bay 15 149 mils.

The pitting and localized spot corrosion identified is the result of coating failures in the areas noted in Bays 1, 13, and 15. The coating failures are consistent with surface preparation deficiencies, irregular surfaces, and inadequate coating application. Minor mechanical damage to the coating caused by work activities impacting the coated surface is a contributing factor. The indication in Bay 12 was the result of mechanical damage affecting the substrate. The indication was 0.25" wide and 1" long consistent with damage caused by work activities impacting the coated surface. Engineering evaluation determined that the indications were acceptable and continue to meet applicable code requirements. Protective coating was reapplied where localized pitting was identified with a pit depth greater than 30 mils to prevent further degradation. Mechanical damage was identified on the main vent header (MVH) exterior surface. There was little discernable corrosion present where the base metal that had been revealed, and no appreciable depth to the mechanical marks. Visual examination of the MSB revealed indications were the result of mechanical damage from outage related work activities. The indications identified did not affect the ability of the MSB to prevent intrusion of moisture against the inaccessible areas of the steel containment vessel below the MSB. The affected portions of the seal were cut out, the exposed drywell liner was examined, and the cut out seal sections re-poured. None of the conditions noted affected the structural integrity or leak tightness of the containment.

Unit 2

• In 2009, mechanical damage, dings, dents, minor corrosion, pitting, cracked tack welds, scrapes, gouges, arc strikes, tool marks, minor surface indications, and punch marks were identified on the exterior surface of the Suppression Chamber. These conditions are expected based on the age and service life of the containment. Two gouged areas behind ductwork and numerous nicks in approximately 1x1 area on the Drywell liner were identified. Coatings were intact in these areas and no corrosion was present. Ductwork in contact with the Drywell liner surface was identified in two locations. The ductwork was modified to eliminate contact. No damage to the Drywell liner was found when examined after the contact was eliminated. Light rust was present on two containment bellows assemblies. The light rust was removed from the bellows surface and re-examined. Cracked tack welds were identified on a bellows cover supporting ring. Pitting was identified along the o-ring groove on a Personnel Airlock Door. The pits are mechanical damage and not corrosion induced. This condition does not affect the sealing capability provided by the o-ring as demonstrated by satisfactory 10 CFR 50, Appendix J Leak Rate Testing. Pitting was identified in the Drywell liner in the area beneath the MSB. The CNL-17-056 E1-19 of 39

Enclosure 1 remaining wall thickness in the location of the pitting remained acceptable. Water was noted entering the area where the seal was excavated for repair. The entire MSB was removed and the exposed Drywell liner VT-3 examined. A broken area of concrete with a crack was identified. This concrete indication that created a potential flow path to the area beneath the MSB was repaired. Pitting on the lower Drywell Head Flange gasket sealing surface was identified. This condition has existed since restart of Unit 2 and was addressed by DCN68136 for all three BFN units. The condition identified does not affect the leak tightness of the Drywell Head Flange as demonstrated by 10 CFR 50, Appendix J Leak Rate Testing. Mechanical damage was identified on Drywell Equipment Hatches X-1A and X-1B. This damage was identified previously and has remained unchanged and does not affect the leak tightness of the Equipment Hatches as demonstrated by 10 CFR 50, Appendix J Leak Rate Testing None of the conditions noted affected the structural integrity or leak tightness of the containment.

• In 2013, seven damaged areas of the MSB were identified for repair. The damage found was the result of mechanical damage from either the U2R16 outage demobilization or mobilization for U2R17 outage work. None of the depressions penetrated the full depth of the seal and seal adhesion was good in all locations.

The indications noted did not affect the ability of the seal to prevent intrusion of moisture against the inaccessible areas of the steel containment vessel below the MSB. A visual examination (VT-1) of the drywell liner was conducted in areas excavated for seal repair. No conditions were noted affected the structural integrity or leak tightness of the containment.

• In 2017, peeling of protective coatings, pitting, gouges, arc strikes, and dents were identified on the exterior of the Suppression Pool and ECCS Ring Header. One indication on the ECCS Ring Header consisting of various arc strikes with the deepest measuring 0.125 inches required engineering evaluation. This location was determined to be acceptable based on the small area affected and the 0.0025 inch difference between the localized minimum measurement and the manufacturer tolerance and that the surface depression will have negligible effect on the pipe stiffness and the piping stresses documented in the existing pipe analysis calculation. This location has been identified for successive examination in accordance with IWE-2420(b) and (c). Moisture Seal Barrier (MSB) indications were identified. The indications were the result of mechanical damage from previous outage activities or separations at the seal surface previously identified, but within MSB acceptance criteria. None of the separations penetrated the full depth of the seal, therefore, no seal failure occurred. VT-1 examination revealed no reportable conditions in the exposed liner beneath the seal and confirmed the seal membrane was not breached and seal failure did not occur. No conditions were noted that affected the structural integrity or leak tightness of the containment.

Unit 3

• In 2010, MSB reportable indications consisting of a 1" diameter pitted area in the liner at the MSB with a maximum depth of 1/16", damage to the concrete at the edge of seal, and separation of the seal from the liner were identified. VT-3 examinations were conducted of the Drywell liner in areas where the seal was removed for seal repair. No evidence of moisture intrusion was found. No conditions were noted that affected the structural integrity or leak tightness of the containment. Scratches, CNL-17-056 E1-20 of 39

Enclosure 1 dents, punch marks, light pitting, and mechanical damage were identified on the flange surfaces of penetrations 3-X-1A, 3-X-1B, 3-X200A, and 3-X-223. The indications on the flange surfaces are consistent with routine use of these penetrations for personnel and equipment access during outage periods. The conditions noted were not due to any degradation mechanism that could challenge structural Integrity or leak tightness of the containment. Pitting on the Lower Drywell Head Flange and O-ring grooves was identified. This condition has existed since restart of Unit 3 and was addressed by DCN68136 for all three BFN units. The condition identified does not affect the leak tightness of the Drywell Head Flange as demonstrated by 10 CFR 50, Appendix J Leak Rate Testing. None of the conditions noted were considered suspect and did not affect the structural integrity or leak tightness of the containment.

• In 2012, indications consisting of mechanical damage, dings, dents, minor corrosion, pitting, scrapes, arc strikes, weld deposit, chip marks, grind marks, and minor surface indications were identified on the exterior of the Suppression Chamber. The conditions identified are expected based on the age and service conditions of the containment. None of the conditions noted were suspect. No conditions were noted that affected the structural integrity or leak tightness of the containment.

• In 2016, a 3/32 deep surface depression was identified in the exterior surface of the Suppression Chamber in Bay 1. The depression was produced by mechanical means during or after assembly and not an extended under thickness. The indication was evaluated and determined to be acceptable. This location has been identified for successive examination in accordance with IWE-2420(b) and (c). Areas of separation were identified during examination of the MSB. None of the areas penetrated the full depth of the seal, and seal adhesion was good in all locations, there was no seal failure. Portions of the seal identified for repair were excavated and the exposed liner beneath the seal VT-1 examined. This examination revealed no reportable conditions and confirmed the seal membrane was not breached and seal failure did not occur. The exposed liner was cleaned and prepared, and the MSB was then repoured in these areas and reexamined. No conditions were noted that affected the structural integrity or leak tightness of the containment.

BFN, Units 1, 2, and 3 have completed requirements of the first and second periods of the Second 10 Year Containment Inservice Inspection Interval. The Second 10-Year Containment Inservice Inspection Interval examinations were performed in accordance with the 2001 Edition, 2003 Addenda, of ASME Section Xl as modified by the 10 CFR 50.55a(b) limitations for all three units. The examinations are based on Category E-A and are visual (General, VT-3, and VT-1) examinations based on ASME Code or 10 CFR 50.55a requirements. Currently, BFN, Units 1, 2, and 3 have no areas identified for augmented examination per the requirements of Category E-C.

4.5 Deficiencies Identified Consistent with the guidance provided in NEI 94-01, Revision 3-A, Section 9.2.3.3, abnormal degradation of the primary containment structure identified during the conduct of IWE program examinations or at any other times would be entered into the corrective action program for evaluation to determine the cause of the degradation and to initiate appropriate corrective actions.

CNL-17-056 E1-21 of 39

Enclosure 1 4.6 Plant Specific Confirmatory Analysis 4.6.1 Methodology A plant-specific risk assessment was performed to assess the effect on plant risk of extending the BFN, Units 1, 2, and 3, ILRT surveillance intervals from the current 10 years to 15 years. The assessment is included as Enclosure 2 to this letter. This assessment followed the guidance of NEI 94-01, Revision 3-A, the methodology described in EPRI Report 1018243, and the NRC regulatory guidance outlined in Regulatory Guide 1.174 on the use of PRA and risk insights in support of a license amendment request (LAR) for changes to a plants licensing basis. In addition, the methodology used for the Calvert Cliffs Nuclear Power Plant (CCNP) to estimate the likelihood and risk implication of undetected corrosion-induced leakage of steel containment liners for the additional window of vulnerability from extending the ILRT interval was used to estimate the conditional containment failure probability and its effect on the Large, Early Release Frequency (LERF) and the estimated population dose. The estimated values determined by using the CCNP methodology were used as part of an analysis to characterize the sensitivity of the risk impact results from extending the ILRT interval.

The ILRT interval extension analysis used the BFN Model of Record (MOR) Revision 7, which represents the current as-built, as-operated plant and associated risk profile for internal events (with internal flooding) challenges. The BFN PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, common cause events, and inter-unit impacts. The PRA model quantification process is based on event tree / fault tree linking, which is a well-known methodology employed throughout the industry. It should be noted that TVA has chosen to use the BFN Fire PRA (FPRA) that represents the plant, once all NFPA-805 modifications (including operator actions) are installed, in this calculation to quantify and assess the impact of this application from internal fire risk. The FPRA model was developed in accordance with the ASME/ANS PRA Standard and NFPA 805.

The BFN PRA has a configuration control program consistent with the requirements of ASME/ANS RA-Sb-2013, Section 1-5.2. As such, the PRA model has been updated; however, no upgrades have been performed including the current MOR, Revision 7 (March 29, 2017). The Revision 7 PRA MOR for internal events (including internal flooding) was used in the ILRT interval extension analysis.

In the NRC Safety Evaluation issued by NRC letter dated June 25, 2008, the NRC concluded that the methodology in EPRI Report No. 1018243, which was Revision 2-A of EPRI Report No. 1009325, is acceptable for referencing by licensees proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.2 of the SE. The following table addresses each of the four limitations and conditions for use of EPRI Report 1009325, Revision 2-A. These limitations and conditions were incorporated into EPRI Report 1018243.

CNL-17-056 E1-22 of 39

Enclosure 1 From Safety Evaluation of EPRI - 1009325 BFN Response

1. The licensee submits documentation BFN, Units 1, 2, and 3, PRA technical indicating that the technical adequacy of adequacy is addressed in Section 4.6.2.

their PRA is consistent with the requirements of RG 1.200 relevant to the ILRT extension.

2. The licensee submits documentation EPRI Report No. 1018243, Revision 2-A of indicating that the estimated risk increase 1009325, incorporates these population dose associated with permanently extending the and CCFP acceptance guidelines. These ILRT surveillance interval to 15 years is guidelines have been used for the BFN, Units small and consistent with the specific risk 1, 2, and 3, assessment.

clarification provided in Section 3.2.4.5 of the SE. Specifically, a small increase in population dose should be defined as an increase in population dose of less than or equal to either 1.0 person-rem per year or 1% of the total population dose, whichever is less restrictive. In addition, a small increase in conditional containment failure probability (CCFP) should be defined as a value marginally greater than that accepted in a previous one- time ILRT extension requests. This would require that the increase in CCFP be less than or equal to 1.5 percentage point.

3. The methodology in EPRI Report No. EPRI Report No. 1018243, Revision 2-A of 1009325, Revision 2, is acceptable except 1009325, incorporated the use of 100 La as for the calculation of the increase in the average leak rate for the pre-existing expected population dose (per year of containment large leakage rate accident case reactor operation). In order to make the (accident case 3b). This value has been methodology acceptable, the average leak used in the BFN, Units 1, 2, and 3, specific rate for the pre-existing containment large risk assessment.

leak rate accident case (accident case 3b) used by the licensees shall be 100 La instead of 35 La.

4. A LAR is required in instances where BFN, Units 1, 2, and 3, do not rely on containment over-pressure is relied upon for containment overpressure to assure emergency core cooling system (ECCS) adequate ECCS pump net positive suction performance. head following design basis accidents. No additional risk analysis was needed for this consideration.

CNL-17-056 E1-23 of 39

Enclosure 1 4.6.2 PRA Technical Adequacy The analysis of the BFN PRA technical adequacy follows the guidance provided in Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Reference 17). The guidance in RG 1.200 indicates the following steps should be followed to perform this evaluation:

1. Identify the parts of the PRA used to support the application.

SSCs, operational characteristics affected by the application, and how these are implemented in the PRA model.

A definition of the acceptance criteria used for the application.

2. Identify the scope of risk contributors addressed by the PRA model.

If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Summarize the risk assessment methodology used to assess the risk of the application.

Include how the PRA model was modified to appropriately model the risk impact of the change request.

4. Demonstrate the Technical Adequacy of the PRA.

Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Document peer review facts and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide. Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Identify key assumptions and approximations relevant to the results used in the decision-making process.

The risk assessment performed for the containment ILRT permanent extension request is based on the current Level 1 and LERF PRA model, including Internal Flooding. The external events analyses include the current Fire PRA (FPRA) model which represents the plant after all modifications are implemented in support of transition to NFPA-805.

This work is scheduled for completion in 2019. The FPRA model will represent the as-built, as-operated plant in the time period for the proposed extended containment ILRT interval.

For this application, the accepted methodology involves a bounding approach to estimate the change in the LERF from extending the ILRT interval. Rather than exercising the PRA model itself, it involves the establishment of separate evaluations that are linearly related to the plant CDF contribution. Consequently, a reasonable representation of the plant CDF that does not result in a LERF does not require that Capability Category II be met in every aspect of the modeling if the Category I treatment is conservative or otherwise does not significantly impact the results.

CNL-17-056 E1-24 of 39

Enclosure 1 4.6.2.1 PRA Model History and Peer Review Summary This analysis used the BFN MOR Rev. 7, which represents the current as-built, as-operated plant and associated risk profile for internal events (with internal flooding) challenges. The BFN PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, common cause events, and inter-unit impacts. The PRA model quantification process is based on event tree / fault tree linking which is a well-known methodology employed throughout the industry. It should be noted that TVA has chosen to use the BFN FPRA that represents the plant, once all NFPA-805 modifications (including operator actions) are installed, in this calculation to quantify and assess the impact of this application from internal fire risk.

The FPRA model was developed in accordance with the ASME/ANS PRA Standard and NFPA 805.

4.6.2.2 PRA Modeling Process TVA employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all TVA nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the TVA PRA.

4.6.2.2.1 PRA Maintenance and Update The TVA risk management process ensures that the applicable PRA models reflect the as-built and as-operated plants. This process is defined in the TVA probabilistic risk assessment program, which consists of a governing procedure (Reference 18) and a subordinate implementation procedure (Reference 19). The procedures delineate the responsibilities and guidelines for updating the PRA models at TVA nuclear generation sites. The overall TVA PRA program defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA models accurately reflect the as-built, as-operated plant, the following activities are routinely performed:

- Design changes and procedure changes are reviewed for their impact on the PRA model.

- Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every five years, or sooner if estimated cumulative impact of plant configuration changes exceed the threshold of +/-25% of CDF or LERF.

In addition to these activities, TVA risk management procedures provide the guidance for risk management maintenance activities. This guidance includes:

- Documentation of the PRA model, PRA products, and bases documents.

- The approach for controlling electronic storage of risk management products including PRA update information, PRA models, and PRA applications.

CNL-17-056 E1-25 of 39

Enclosure 1

- Guidelines for updating PRA models for TVA nuclear generation sites.

- Procedural requirements for PRA documentation of the MOR and PRA applications.

The MOR is composed of 1) PRA computer model and supporting documentation, 2)

MAAP model and supporting documentation, and 3) other Supporting Computer Evaluation Tools (e.g., UNCERT, SYSIMP, EPRI HRA Calculator, etc.). The purpose of the PRA MOR is to provide a prescriptive method for quality, configuration, and documentation control. PRA applications and evaluations are referenced to an MOR and therefore the pedigree of PRA applications and evaluations is traceable and verifiable.

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated into the PRA model, relevant peer review findings, and consistency with applicable PRA Standards) is discussed in this section.

4.6.2.2.2 Pending Plant Changes Not Included in the Current Model of Record A PRA updating requirements evaluation (update tracking database) is created for all issues that are identified that could impact the PRA model. The database includes the identification of those plant changes that could impact the PRA model.

A review of the identified items since the current MOR, indicates that there are no plant changes that have not yet been incorporated into the PRA model that would affect this application.

4.6.2.3 Consistency with Applicable PRA Standards As shown in Table 1, the Full-Power Internal Events PRA with Internal Flooding and the Fire PRA have been subjected to full-scope and focused-scope peer reviews for a total of six peer reviews since 2009. These reviews were performed in accordance with RG 1.200 R2 and the endorsed ASME/ANS PRA Standard, ASME/ANS RA-Sa-2009.

Each review built upon the previous to continuously improve the technical adequacy of the BFN PRA models. These assessments are further discussed with information regarding supporting requirements status and F&O (findings) status. F&Os are listed explicitly in Appendix A to Enclosure 2 Table 1 Peer Reviews CNL-17-056 E1-26 of 39

Enclosure 1 Date Type of Review Guidance Model of Record MAY RG 1.200 R2 Internal Events (Full Scope) bfn123_mor_r04 2009 NEI 05-04 R3 SEP Internal Flooding (Focused RG 1.200 R2 bfn123_mor_r04 2009 Scope) NEI 05-04 R3 JAN RG 1.200 R2 Fire (Full Scope) JAN 2012 2012 NEI 07-12 R1 MAY RG 1.200 R2 Fire (Follow-On) MAY 2012 2012 NEI 07-12 R1 MAY RG 1.200 R2 Fire (Focused Scope) bfn123_mor_r05Ab46 2015 NEI 07-12 R1 Internal Events 2009 F&O RG 1.200 R2 JUL Resolution Review (Focused bfn123_mor_r06 2015 NEI 05-04 R3 Scope)

The PRA Peer Reviews were used as an initial input into the PRA Self-Assessments relative to the combined ASME/ANS PRA Standard. The F&Os were resolved and documented, and the models were judged to meet the ASME/ANS PRA Standard to support an overall Capability Category II.

4.6.2.3.1 Internal Events Hazards As shown in Table 1, the BFN Internal Events PRA has been subjected to three peer reviews using the RG 1.200 R2 guidance (i.e., a full scope review, a focused scope follow-on peer review for internal flooding, and a focused scope peer review) to evaluate specific aspects of the Internal Events PRA and assess existing F&O dispositions. All peer reviews used the process defined in NEI 05-04, Revision 1 (Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard),

ASME/ANS RA-Sa-2009, and Regulatory Guide 1.200, Revision 2. The initial Peer Review for BFN Units 1, 2, and 3 Internal Events PRA was performed in May 2009. A separate review was performed that was focused on the Internal Flooding portion of the BFN PRA in September 2009. The 2015 focused-scope peer review evaluated specific changes made to the Internal Events PRA (excluding internal flooding) and assessed the F&Os from the previous peer review that were considered resolved by a TVA self-assessment. Thirty-seven of the existing F&Os were not addressed in the focused scope peer review. A team of independent PRA experts from nuclear utility groups and PRA consulting organizations carried out the review.

The purpose of these reviews was to provide a method for establishing the technical adequacy of the BFN PRA for the spectrum of potential risk-informed plant licensing applications for which the BFN-PRA may be used. There have been no changes made to the internal events model or methodology following these peer reviews that would constitute an upgrade.

The peer reviews of the BFN PRA model performed in May 2009, September 2009, and July 2015 resulted in a total of 78 open findings for the integrated three unit model for internal events and internal flooding. All findings from these assessments have been dispositioned. The collective conclusion of the peer review teams determined that with CNL-17-056 E1-27 of 39

Enclosure 1 these proposed changes incorporated, the quality of all elements of the BFN PRA model is sufficient to support "risk significant evaluations with deterministic input." As a result of the effort to incorporate the latest industry insights into the BFN PRA model upgrades and peer reviews, TVA has concluded that the results of the risk evaluation are technically sound and consistent with the expectations for PRA quality set forth in Regulatory Guide 1.174 and Regulatory Guide 1.177 (Reference 1).

Complete results of the peer review findings are provided in Appendix A to Enclosure 2, which provides a copy of the F&O resolutions and the applicability to the proposed Containment ILRT interval extension.

4.6.2.3.2 Internal Flooding Hazards The internal flooding (IF) peer review evaluated all technical elements associated with IF in the ASME/ANS Combined PRA Standard against the NRC staff position included in Appendix A-3 of RG 1.200.

The IF peer review was performed in accordance with the requirements of the NEI Peer Review process, NEI 05-04. Section 3 of the ASME/ANS combined PRA Standard contains a total of 62 Supporting Requirements (SRs) under five Technical Elements, excluding configuration control. Configuration control was reviewed as part of the internal events peer review performed earlier in the year. Of these SRs, two were determined to not be applicable to the BFN internal flood PRA and one was not reviewed due to insufficient descriptive information provided in the BFN Internal Flood PRA notebook.

The following table presents an overall summary of the results of the peer review.

Table 2 Internal Flooding Peer Review Assessment by Capability Category Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 26 42%

Capability 1 3 5%

Capability 2 or Better 30 48%

Not Applicable 2 3%

Not Reviewed 1 2%

TOTAL: 62 100%

The key problem areas for the internal flood PRA were documentation and flood scenario development. All 15 documentation SRs were rated as not meeting the standard requirements. The primary problem associated with documentation was lack of details, numerous inconsistencies, and incomplete information in the input data, process, and results. The IF PRA was not prepared in a manner that can facilitate PRA applications, upgrades and peer review. To be consistent with the applicable SRs, more effort was needed to enhance the documentation. The major problem associated with the flood scenario development that was the development of flood scenarios was not rigorously performed. Many flood areas, flood sources and flood scenarios were CNL-17-056 E1-28 of 39

Enclosure 1 dismissed without adequate considerations of all the possible flooding effects that may cause damage to structures, systems or components credited in the PRA. As a result, a total number of flood scenarios that were quantitatively evaluated was far less than expected and the results of some top internal flood-induced risk contributors were not completely realistic.

The list of internal flooding F&Os and their resolutions and impact on the containment ILRT internal extension application are provided in Appendix A to Enclosure 2.

4.6.2.3.3 Internal Fire Hazards The BFN FPRA was subjected to three peer reviews: a full scope review, a follow-on review and a focused scope peer review. The full scope peer review was performed January 2012 and the focused scope follow-on peer review was conducted in June 2012. Both peer reviews used the NEI 07-12 process, ASME/ANS RA-Sa-2009, and RG 1.200, Revision 2. The purpose of these reviews was to establish the technical adequacy of the FPRA for the spectrum of potential risk-informed plant licensing applications for which the FPRA may be used. The full scope peer review examined all of the technical elements of the BFN FPRA against all technical elements in Part 4 of ASME/ANS RA-Sa-2009, including the referenced internal events SRs in Part 2. The focused scope follow-on peer review performed a review against a list of High Level Requirements (HLRs) and SRs that were selected based on the FPRA model changes implemented in the months that followed the full scope peer review in January 2012.

The final conclusion of the peer reviews was that the BFN FPRA meets Capability Category II following final resolution of all of the F&Os. Most of the F&Os from the full-scope peer review were resolved in the follow-on peer review. The F&Os from the follow-on peer review, some of which remain unresolved, are listed and discussed in Appendix A to Enclosure 2.

The TVA process for controlling updates to the Fire PRA is documented in TVA procedure NPG-SPP-09.11, The Probabilistic Risk Assessment Program and NEDP-26, Probabilistic Risk Assessment. NPG-SPP-09.11 covers the management of PRA application, periodic updates and interdepartmental PRA documentation.

Additionally, definitions for PRA model update, PRA model application, and PRA evaluation are also provided in NPG-SPP-09.11. Cross-discipline responsibilities for plant operations and system engineering are defined for PRA review to ensure the models represent the as-built, as-operated plant.

NEDP-26 describes the process used by the PRA staff to perform applications, model updates and PRA model maintenance and review. The terms PRA upgrade and maintenance are defined by the procedures using the definitions provided in the PRA standard. The procedure requires that updates should be completed at least once every five years (for the lead unit at multi-unit sites) or sooner if estimated cumulative impact of plant configuration changes exceeds +/-25% of CDF or LERF. Changes in PRA inputs or discovery of new information shall be evaluated to determine whether such information warrants an unscheduled PRA update. In accordance with NEDP-26, items exceeding the above threshold are tracked in the Corrective Action Program. Potential and/or implemented plant configurations changes that do not meet the threshold for immediate update are tracked in the PRA Model Open Items Database.

CNL-17-056 E1-29 of 39

Enclosure 1 PRA updates follow the guidelines established by the PRA Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications (ASME/ANS RA-Sa-2009), for a minimum of a Category II assessment. The NEDP-26 procedure also defines the requirements for PRA documentation of the MOR and PRA applications. The MOR is composed of 1) PRA computer model and supporting documentation, 2) MAAP model and supporting documentation, and 3) other Supporting Computer Evaluation Tools (e.g., UNCERT, SYSIMP, EPRI HRA Calculator). The purpose of the PRA MOR is to provide a prescriptive method for quality, configuration, and documentation control. PRA applications and evaluations are referenced to a MOR and therefore the pedigree of PRA applications and evaluations is traceable and verifiable. After September 2008, all PRA notebooks modified are converted to desirable calculations.

4.6.3 Results and Conclusion of Plant-Specific Risk Assessment NEI 94-01, Revision 3-A describes an NRC-accepted approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option B. NEI 94-01 incorporates the regulatory positions stated in RG 1.163, Performance-Based Containment Leak-Test Program and includes provisions for permanently extending Type A intervals to 15 years. Based on the results of calculations, sensitivity studies, and conservatisms used in this analysis as shown in Table 3 (Unit 1), Table 4 (Unit 2),

and Table 5 (Unit 3), a permanent extension of the BFN Containment ILRT to one test per 15 years presents an insignificant increase in risk to the general public.

4.6.3.1 Results Discussion - LERF Regulatory Guide 1.174 provides guidance for determining the risk impact of plant specific changes to the licensing basis. Leakage characterized by the Type A test does not affect the CDF; therefore, there is no change to the plant CDF as a result of implementing this proposed change to the licensing basis. The guidance describes a small change in risk for LERF as less than 1.0E-06/rx-yr, if it can be shown that the total LERF is less than 1.0E-05/rx-yr. For BFN, the analysis included the estimated contribution from external events in addition to the internal events analysis, summarizes the maximum LERF for BFN which is estimated to be 3.55E-07/yr, and the maximum upper bound total LERF (Including External Events) which is 8.10E-06/yr. Both results are within the acceptable bands for a small change in risk according to RG 1.174. Table 3 (Unit 1), Table 4 (Unit 2) and Table 5 (Unit 3) provide the results for the internal events LERF, combined external events (EE) and internal events (IE) LERF, and the delta LERF for combined EE and IE results for the change from the original licensing basis (OLB) of three tests per 10 years as compared to the proposed licensing basis (PLB) of one test in 15 years, and the delta from the current licensing basis (CLB) to the PLB.

4.6.3.2 Results Discussion - CCFP In accordance with the methodology in EPRI Report 1018243, the maximum conditional containment failure probability (CCFP) increase for BFN from the OLB to the PLB is 1.170%, which includes the increased contribution due to aging and corrosion effects.

Revision 2-A of the EPRI Report characterizes an increase in the CCFP of 1.5% as very small, which is consistent with the NRC Final Safety Evaluation for NEI 94-01.

Therefore, this increase is considered to be very small. Tables 27 (Unit 1), 28 (Unit 2) and 29 (Unit 3) of Enclosure 2 provide the detailed results for the CCFP change for the OLB to the PLB, and from the CLB to the PLB.

CNL-17-056 E1-30 of 39

Enclosure 1 4.6.3.3 Results Discussion - Population Dose The proposed licensing change in the Type A ILRT interval to one test per 15 years as measured in terms of the total integrated plant risk for those accident sequences influenced by Type A testing results in a maximum dose increase of 5.05E-01 person-rem/yr. This value is based on internal events and external events combined.

EPRI Report 1009325, Revision 2-A states that a small increase in population dose is defined as 1.0 person-rem/yr or 1% of the total population dose, whichever is less restrictive for the risk impact of the ILRT interval extension to 15 years. BFN uses the person-REM increase option, which is consistent with the NRC Final Safety Evaluation for NEI 94-01. Table 33 of Enclosure 2 provides the detailed results from the OLB to the PLB for BFN, Units 1, 2 and 3, including corrosion and external events.

4.6.3.4 Conclusion The following tables present the metrics, their values, and the associated acceptance criteria. All metrics meet the acceptance criteria for the three BFN units. Therefore, the risk associated with the proposed permanent extension for the Containment ILRT interval to one test-in-15 years on a permanent basis is not considered to be significant as it represents only a small change in the BFN risk profile.

Table 3 Unit 1 Results Table & Applicability Acceptable for Metric Value Acceptance Criteria Application?

LERFIE_Total 1.26E-06/yr

<1.0E-05/yr Yes LERFTotal(IE & EE) 7.86E-06/yr LERFTotal(CLBPLB) IE & EE 1.23E-07/yr <1.0E-06/yr Yes (Small)

LERFTotal(OLBPLB) IE & EE 2.96E-07/yr CCFP(CLBPLB), Inc. Corrosion 0.202%

1.5% Yes CCFP(OLBPLB), Inc. Corrosion 1.089%

DOSE(OLBPLB), IE & EE 3.82E-01/yr <1.0 person-rem/yr or <1% of total dose, whichever is less Yes With Corrosion person-REM restrictive CNL-17-056 E1-31 of 39

Enclosure 1 Table 4 Unit 2 Results Table & Applicability Acceptable for Metric Value Acceptance Criteria Application?

LERFIE_Total 1.21E-06/yr

<1.0E-05/yr Yes LERFTotal(IE & EE) 8.10E-06/yr LERFTotal(CLBPLB) 1.48E-07/yr <1.0E-06/yr Yes (Small)

LERFTotal(OLBPLB) 3.55E-07/yr CCFP(CLBPLB), Inc.

0.217%

Corrosion 1.5% Yes CCFP(OLBPLB), Inc.

1.170%

Corrosion 5.05E-01/yr <1.0 person-rem/yr or <1% of DOSE(OLBPLB), IE & EE total dose, whichever is less Yes With Corrosion person-REM restrictive Table 5 Unit 3 Results Table & Applicability Metric Value Acceptance Criteria Acceptable for Application?

LERFIE_Total 1.45E-06/yr

<1.0E-05/yr Yes LERFTotal(IE & EE) 7.89E-06/yr LERFTotal(CLBPLB) 1.19E-07/yr <1.0E-06/yr Yes LERFTotal(OLBPLB) 2.84E-07/yr (Small)

CCFP(CLBPLB), Inc. Corrosion 0.164%

1.5% Yes CCFP(OLBPLB), Inc. Corrosion 0.884%

<1.0 person-rem/yr or DOSE(OLBPLB), IE & EE 4.29E-01/yr <1% of total dose, Yes With Corrosion person-REM whichever is less restrictive A previous assessment performed by NRC in NUREG-1493 has concluded the following:

• Reducing the frequency of Type A tests (ILRTs) from three-per-ten years to one-per-twenty years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Types B and C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The CNL-17-056 E1-32 of 39

Enclosure 1 impact of relaxing the ILRT frequency beyond one-in-twenty years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test the integrity of the containment structure.

The findings from the BFN analysis confirm these general findings on a plant specific basis considering the severe accidents evaluated, the containment failure modes and the local population surrounding the plant out to a 50-mile radius.

5.0 REGULATORY EVALUATION

5.1 Applicable Regulatory Requirements and Criteria The proposed change has been evaluated to determine whether applicable regulations and requirements continue to be met. 10 CFR 50.54(o) requires primary reactor containments for water-cooled power reactors to be subject to the requirements of Appendix J to 10 CFR 50, "Leakage Rate Testing of Containment of Water Cooled Nuclear Power Plants. Appendix J specifies containment leakage testing requirements, including the types required to ensure the leak-tight integrity of the primary reactor containment and systems and components that penetrate the containment. In addition, Appendix J discusses leakage rate acceptance criteria, test methodology, frequency of testing, and reporting requirements for each type of test. RG 1.163 was developed to endorse NEI 94-01, Revision 0 with certain modifications and additions.

The adoption of the Option B performance-based containment leakage rate testing for Type A testing did not alter the basic method by which Appendix J leakage rate testing is performed; however, it did alter the frequency at which Type A, Type B, and Type C containment leakage tests must be performed. Under the performance-based option of 10 CFR 50, Appendix J, the test frequency is based upon an evaluation that reviews "as- found" leakage history to determine the frequency for leakage testing which provides assurance that leakage limits will be maintained. The previous change to the Type A test frequency did not directly result in an increase in containment leakage.

Similarly, the proposed change to the Type A test frequency is not expected to result in an increase in containment leakage.

NEI 94-01, Revision 3-A, describes an approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option B. The document incorporates the regulatory positions stated in RG 1.163 and includes provisions for extending Type A and Type C intervals to 15 years and 75 months, respectively. NEI 94-01, Revision 3-A, delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate test frequencies. In the SE issued by NRC letter dated June 8, 2012, the NRC concluded that NEI 94-01, Revision 3-A, describes an acceptable approach for implementing the optional performance-based requirements of 10 CFR 50, Appendix J, and is acceptable for referencing by licensees proposing to amend their TS with regard to containment leakage rate testing, subject to the limitations and conditions noted in Section 4.0 of the SE.

EPRI Report 1009325, Revision 2, provides a risk impact assessment for optimized ILRT intervals up to 15 years, utilizing current industry performance data and risk informed guidance. NEI 94-01, Revision 3-A, states that a plant-specific risk impact assessment should be performed using the approach and methodology described in EPRI Report 1009325, Revision 2, for a proposed extension of the ILRT interval to CNL-17-056 E1-33 of 39

Enclosure 1 15 years. In the SE issued by NRC letter dated June 25, 2008, the NRC concluded that the methodology in EPRI Report 1009325, Revision 2, is acceptable for reference by licensees proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.0 of that SE.

Based on the considerations above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will continue to be conducted in accordance with the site licensing basis, and (3) the approval of the proposed change will not be inimical to the common defense and security or to the health and safety of the public.

In conclusion, TVA has determined that the proposed change does not require any exemptions or relief from regulatory requirements, other than the TS, and does not affect conformance with any regulatory requirements/criteria.

5.2 Precedent TVA has determined that this request is similar to the following license amendments which adopted NEI 94-01, Revision 3-A and have been approved by the NRC:

• "Nine Mile Point Nuclear Station, Unit 2 - Issuance of Amendment Re: Extension of Primary Containment Integrated Leakage Rate Testing Interval (TAC No. ME1650),"

approved March 30, 2010 (ML100730032), Type A test interval only.

• "Arkansas Nuclear One, Unit No.2 - Issuance of Amendment Re: Technical Specification Change to Extend the Type A Test Frequency to 15 Years (TAC No.

ME4090)," approved April 7, 2011 (ML110800034), Type A test interval only.

• "Palisades Nuclear Plant - Issuance of Amendment to Extend the Containment Type A Leak Rate Test Frequency to 15 Years (TAC No. ME5997)," approved

• April 23, 2012 (ML120740081), Type A test interval only.

• "Virgil C. Summer Nuclear Station, Unit 1 - Issuance of Amendment Extending Integrated Leak Rate Test Interval (TAC No. MF1385)," approved February 5, 2014 (ML13326A204) Type A test interval only.

• "Surry Power Station, Units 1 and 2 - Issuance of Amendment Regarding the Containment Type A and Type C Leak Tests (TAC Nos. MF2612 and MF2613),"

approved July 3, 2014 (ML14148A235), Type A and Type C test intervals.

5.3 No Significant Hazards Consideration The Tennessee Valley Authority (TVA) proposes to revise the current licensing basis of Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, by revising the BFN, Units 1, 2, and 3, Technical Specifications (TS) 5.5.12, "Containment Leakage Rate Testing Program," by adopting Nuclear Energy Institute (NEI) 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J,"

as the implementation document for the performance-based Option B of 10 CFR Part 50, Appendix J. The proposed changes permanently extend the Type A containment CNL-17-056 E1-34 of 39

Enclosure 1 integrated leak rate testing (ILRT) interval from 10 years to 15 years and the Type C local leakage rate testing (LLRT) intervals from 60 months to 75 months.

TVA has concluded that the changes to BFN, Units 1, 2, and 3, TS 5.5.12 do not involve a significant hazards consideration. TVAs conclusion is based on its evaluation in accordance with 10 CFR 50.91(a)(1) of the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No.

The proposed revision to TS 5.5.12 changes the testing period to a permanent 15-year interval for Type A testing (10 CFR Part 50, Appendix J, Option B, ILRT) and a 75-month interval for Type C testing (10 CFR Part 50, Appendix J, Option B, LLRT). The current Type A test interval of 10 years would be extended to 15 years from the last Type A test.

The proposed extension to Type A testing does not involve a significant increase in the consequences of an accident because research documented in NUREG-1493, "Performance-Based Containment System Leakage Testing Requirements," September 1995, has found that, generically, very few potential containment leakage paths are not identified by Type B and C tests. NUREG-1493 concluded that reducing the Type A testing frequency to one per 20 years was found to lead to an imperceptible increase in risk. A high degree of assurance is provided through testing and inspection that the containment will not degrade in a manner detectable only by Type A testing. The last Type A test (performed November 19, 2010 for BFN, Unit 1, June 3, 2009 for BFN, Unit 2 and May 12, 2012 for BFN, Unit 3) shows leakage to be below acceptance criteria, indicating a very leak tight containment. Inspections required by the ASME Code Section Xl (Subsection IWE) and Maintenance Rule monitoring (10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants") are performed in order to identify indications of containment degradation that could affect that leak tightness. Types B and C testing required by TSs will identify any containment opening such as valves that would otherwise be detected by the Type A tests. These factors show that a Type A test interval extension will not represent a significant increase in the consequences of an accident.

The proposed amendment involves changes to the BFN, Units 1, 2, and 3, 10 CFR 50 Appendix J Testing Program Plan. The proposed amendment does not involve a physical change to the plant or a change in the manner in which the units are operated or controlled. The primary containment function is to provide an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment for postulated accidents. As such, the containment itself and the testing requirements to periodically demonstrate the integrity of the containment exist to ensure the plant's ability to mitigate the consequences of an accident, and do not involve any accident precursors or initiators. Therefore, the probability of occurrence of an accident previously evaluated is not significantly increased by the proposed amendment.

The proposed amendment adopts the NRC-accepted guidelines of NEI 94-01, Revision 3-A, for development of the BFN, Units 1, 2, and 3, performance-based leakage testing program. Implementation of these guidelines continues to provide adequate assurance that during design basis accidents, the primary containment and its CNL-17-056 E1-35 of 39

Enclosure 1 components will limit leakage rates to less than the values assumed in the plant safety analyses. The potential consequences of extending the ILRT interval from 10 years to 15 years have been evaluated by analyzing the resulting changes in risk. The increase in risk in terms of person-rem per year resulting from design basis accidents was estimated to be very small, and the increase in the LERF resulting from the proposed change was determined to be within the guidelines published in NRC RG 1.174.

Additionally, the proposed change maintains defense-in-depth by preserving a reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation. TVA has determined that the increase in CCFP due to the proposed change would be very small.

Based on the above discussions, the proposed changes do not involve an increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed revision to TS 5.5.12 changes the testing period to a permanent 15-year interval for Type A testing (10 CFR Part 50, Appendix J, Option B, ILRT) and a 75-month interval for Type C testing (10 CFR Part 50, Appendix J, Option B, LLRT). The current test interval of 10 years, based on past performance, would be extended to 15 years from the last Type A test (performed November 19, 2010 for BFN, Unit 1, June 3, 2009 for BFN, Unit 2 and May 12, 2012 for BFN, Unit 3). The proposed extension to Type A and Type C test intervals does not create the possibility of a new or different type of accident because there are no physical changes being made to the plant and there are no changes to the operation of the plant that could introduce a new failure mode creating an accident or affecting the mitigation of an accident.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed revision to TS 5.5.12 changes the testing period to a permanent 15-year interval for Type A testing (10 CFR Part 50, Appendix J, Option B, ILRT) and a 75-month interval for Type C testing (10 CFR Part 50, Appendix J, Option B, LLRT). The current test interval of 10 years, based on past performance, would be extended to 15 years from the last Type A test (performed November 19, 2010 for BFN, Unit 1, June 3, 2009 for BFN, Unit 2 and May 12, 2012 for BFN, Unit 3). The proposed extension to Type A testing will not significantly reduce the margin of safety.

NUREG-1493, "Performance-Based Containment System Leakage Testing Requirements," September 1995, generic study of the effects of extending containment leakage testing, found that a 20 year extension to Type A leakage testing resulted in an imperceptible increase in risk to the public. NUREG-1493 found that, generically, the design containment leakage rate contributes about 0.1% to the individual risk and that the decrease in Type A testing frequency would have a minimal effect on this risk since 95% of the potential leakage paths are detected by Type C testing. Regular inspections CNL-17-056 E1-36 of 39

Enclosure 1 required by the ASME Code Section Xl (Subsection IWE) and maintenance rule monitoring (10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants) will further reduce the risk of a containment leakage path going undetected.

The proposed amendment adopts the NRC-accepted guidelines of NEI 94-01, Revision 3-A, for development of the BFN, Units 1, 2, and 3, performance-based leakage testing program, and establishes a 15-year interval for the performance of the primary containment ILRT and a 75-month interval for Type C testing. The amendment does not alter the manner in which safety limits, limiting safety system setpoints, or limiting conditions for operation are determined. The specific requirements and conditions of the 10 CFR Part 50, Appendix J Testing Program Plan, as defined in the TS, ensure that the degree of primary containment structural integrity and leak-tightness that is considered in the plant safety analyses is maintained. The overall containment leakage rate limit specified by the TS is maintained, and the Type A, B, and C containment leakage tests will continue to be performed at the frequencies established in accordance with the NRC-accepted guidelines of NEI 94-01, Revision 3-A.

Containment inspections performed in accordance with other plant programs serve to provide a high degree of assurance that the containment will not degrade in a manner that is detectable only by an ILRT. This ensures that evidence of containment structural degradation is identified in a timely manner. Furthermore, a risk assessment using the current BFN, Units 1, 2, and 3, PRA model concluded that extending the ILRT test interval from 10 years to 15 years results in a very small change to the BFN, Units 1, 2, and 3, risk profile.

Accordingly, the proposed changes do not involve a significant reduction in a margin of safety.

5.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

CNL-17-056 E1-37 of 39

Enclosure 1

7.0 REFERENCES

1. Nuclear Energy Institute (NEI) NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," Revision 3-A, dated July 2012 (ML12221A202)

2. Title 10, Code of Federal Regulations, Part 50 (10 CFR 50), "Domestic Licensing of Production and Utilization Facilities," Appendix J, "Primary Reactor Containment Leakage Testing for Water-Cooled Reactors."

3. NRC Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995 (ML003740058)

4. NEI document NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," Revision 0, dated July 26, 1995 (ADAMS Legacy Library Accession No. 9510200180)

5. NUREG-1493, "Performance-Based Containment Leak-Test Program," dated September 1995

6. Electrical Power Research Institute (EPRI) Report 104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," dated August 1994.

7. NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," Revision 2, dated August 2007 (ML072970206)

8. NRC letter NEI, "Final Safety Evaluation For Nuclear Energy Institute (NEI)

Topical Report (TR) 94-01, Revision 2, "Industry Guideline For Implementing Performance-Based Option of 10 CFR PART 50, Appendix J" and Electric Power Research Institute (EPRI) Report No. 1009325, Revision 2, August 2007, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals" (TAC No. MC9663), dated June 25, 2008 (ML081140105)

9. NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of CFR Part 50, Appendix J," Revision 2-A, dated October 2008 (ML100620847)

10. EPRI Report 1009325, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," Revision 2, dated August 2007 (ML072970208)

11. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, dated May 2011 (ML100910006)

12. EPRI Report 1018243, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325," dated October 2008

13. NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," Revision 3, dated June 2011 (ML112920567)

14. NRC letter NEI, "Final Safety Evaluation of Nuclear Energy Institute (NEI) Report, 94-01, Revision 3, "Industry Guideline For Implementing Performance-Based Option of 10 CFR PART 50, Appendix J" (TAC No. ME2164)," dated June 8, 2012 (ML121030286)

CNL-17-056 E1-38 of 39

Enclosure 1

15. NRC Regulatory Issue Summary (RIS) 2008-27, "Staff Position on Extension of the Containment Type A Test Interval Beyond 15 Years Under Option B of Appendix J to 10 CFR Part 50," dated December 8, 2008 (ML080020394)

16. American Society of Mechanical Engineers/American National Standard (ASME/ANS) RA-S-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," dated February 2009

17. NRC Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Revision 2, dated March 2009 (ML090410014)

18. TVA Procedure NPG-SPP-09.11, Probabilistic Risk Assessment Program, Revision 3, dated October 14, 2016

19. TVA Procedure NEDP-26, "Probabilistic Risk Assessment (PRA), Revision 11, dated October 17, 2016

20. NRC Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Revision 1, dated May 2011 (ML100910006)

CNL-17-056 E1-39 of 39

Attachment 1 Proposed TS (Markups) for BFN, Units 1, 2, and 3 CNL-17-056

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program,"

dated September 1995.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 48.5 psig. The maximum allowable primary containment leakage rate, La, shall be 2% of primary containment air weight per day at Pa.

NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J,"

dated July 2012, and Section 4.1, "Limitations and Conditions for NEI TR 94-01, Revision 2," of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

(continued)

BFN-UNIT 1 5.0-20 Amendment No. 234, 269 March 06, 2007

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995, as modified by the following exception:

• NEI 94 1995, Section 9.2.3: The first Unit 2 Type A test performed after the November 6, 1994, Type A test shall be performed no later than November 6, 2009.

NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J,"

dated July 2012, and Section 4.1, "Limitations and Conditions for NEI TR 94-01, Revision 2," of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

(continued)

BFN-UNIT 2 5.0-20 Amendment No. 254, 293 March 9, 2005

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995, as modified by the following exception:

• NEI 94 1995, Section 9.2.3: The first Unit 3 Type A test performed after the October 10, 1998, Type A test shall be performed no later than October 10, 2013.

NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J,"

dated July 2012, and Section 4.1, "Limitations and Conditions for NEI TR 94-01, Revision 2," of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

(continued)

BFN-UNIT 3 5.0-20 Amendment No. 214, 252 March 9, 2005

Attachment 2 Proposed TS Changes (Final Typed) for BFN, Units 1, 2, and 3 CNL-17-056

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in NEI 94-01, Revision 3-A, Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, dated July 2012, and Section 4.1, Limitations and Conditions for NEI TR 94-01, Revision 2, of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 48.5 psig. The maximum allowable primary containment leakage rate, La, shall be 2% of primary containment air weight per day at Pa.

(continued)

BFN-UNIT 1 5.0-20 Amendment No. 234, 269, 000

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in NEI 94-01, Revision 3-A, Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, dated July 2012, and Section 4.1, Limitations of Conditions for NEI TR 94-01, Revision 2 of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

(continued)

BFN-UNIT 2 5.0-20 Amendment No. 254, 293, 000

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.11 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

5.5.12 Primary Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in NEI 94-01, Revision 3-A, Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, dated July 2012, and Section 4.1, Limitations and Conditions for NEI TR 94-01, Revision 2, of the NRC Safety Evaluation Report in NEI 94-01, Revision 2-A, dated October 2008.

(continued)

BFN-UNIT 3 5.0-20 Amendment No. 214, 252, 000

Enclosure 2 Risk Impact Assessment CNL-17-056

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Contents 1.0 Introductuion/Background ............................................................................................... 7 2.0 References and Acronyms ............................................................................................... 8 2.1 References ........................................................................................................................................ 8 2.2 Acronyms ........................................................................................................................................ 10 3.0 Assumptions ....................................................................................................................11 4.0 Ground Rules ...................................................................................................................12 5.0 Methodology ....................................................................................................................12 5.1 Step 1 - Baseline Risk Determination .......................................................................................... 16 5.2 Step 2 - Develop the Baseline Population Dose Per Year .......................................................... 17 5.3 Step 3 - Evaluate the Risk Impact (Bin Frequency and Population Dose) ............................... 18 5.4 Step 4 - Evaluate the Change in LERF ......................................................................................... 18 5.5 Step 5 - Evaluate the Change CCFP ............................................................................................. 19 5.6 Step 6 - Evaluate the Sensitivity of the Results .......................................................................... 19 6.0 Containment Overpressure .............................................................................................19 7.0 Inputs................................................................................................................................19 8.0 Calculation .......................................................................................................................21 8.1 Step 1 - Baseline Risk Determination .......................................................................................... 21 8.1.1 Class 1 - Intact Containment ................................................................................................. 22 8.1.2 Class 2 - Large Containment Isolation Failures .................................................................. 22 8.1.3 Class 7 - Severe Accident Phenomena ................................................................................ 22 8.1.4 Class 8 - Containment Bypass (ISLOCA)............................................................................. 23 8.1.5 Calculation of the 3a Probability and Frequency ................................................................ 23 8.1.6 Calculation of the 3b Probability and Frequency ............................................................... 24 8.1.7 Calculation of the Adjusted Class 1 Frequency .................................................................. 25 8.2 Step 2 - Develop the Baseline Population Dose ......................................................................... 25 8.2.1 50-Mile Radius Population Density and Adjustment .......................................................... 26 8.2.2 Reactor Power Level Adjustment ......................................................................................... 27 8.2.3 Containment Allowable Leakage Factor .............................................................................. 27 8.2.4 Population Dose Factor ......................................................................................................... 27 8.2.5 Peach Bottom Collapsed Accident Progression Bin Definitions ...................................... 28 8.2.6 Peach Bottom Population Dose by Accident Progression Bin ......................................... 29 8.3 Step 3 - Risk Impact Evaluation ................................................................................................... 31 8.3.1 Dose-Rate Increase and Percentile Increase....................................................................... 33 8.3.2 Unit-1 Population Dose-Rate Calculations .......................................................................... 33 8.3.3 Unit-2 Population Dose-Rate Calculations .......................................................................... 35 8.3.4 Unit-3 Population Dose-Rate Calculations .......................................................................... 36 8.4 Step 4 - Change in LERF............................................................................................................... 38 2

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 8.4.1 LERF Determination ............................................................................................................ 39 8.5 Step 5 - Conditional Containment Failure Probability ............................................................... 40 9.0 Sensitivity Analyses ........................................................................................................42 9.1 Differences in the BFN Design From Calvert Cliffs .................................................................... 42 9.1.1 Structural Design ................................................................................................................... 42 9.2 Liner Corrosion .............................................................................................................................. 43 9.2.1 Assumptions Used In the Corrosion Sensitivity Analysis ................................................. 44 9.3 Base Case Risk Assessment ........................................................................................................ 45 9.4 Likelihood of Non-Detected Containment Leakage and LERF Impact ..................................... 47 9.5 Liner Corrosion Effect on CCFP ................................................................................................... 49 9.6 Summary of Base Case and Corrosion Sensitivity Cases......................................................... 51 10.0 External Events Contribution........................................................................................56 10.1 Internal Fires Discussion ............................................................................................................ 57 10.2 Seismic Discussion ..................................................................................................................... 57 10.3 High Winds, External Floods, and Other Hazards Discussion ................................................ 58 10.4 External Events Impact Summary .............................................................................................. 59 11.0 Results/Conclusions .....................................................................................................63 11.1 Results Discussion - LERF ......................................................................................................... 64 11.2 Results Discussion - CCFP ......................................................................................................... 64 11.3 Results Discussion - Population Dose ...................................................................................... 64 11.4 Conclusion .................................................................................................................................... 65 Table 1 Detailed Description of EPRI Accident Classes ...................................................14 Table 2 CDF and LERF for Units 1, 2 and 3 .........................................................................20 Table 3 EPRI Release Classes (Containment Failure Classifications) .............................20 Table 4 EPRI Accident Class Frequencies .........................................................................21 Table 5 50-Mile Radius Population Density .......................................................................26 Table 6 Reactor Power (MWt) .............................................................................................27 Table 7 Peach Bottom Accident Progression Bins ...........................................................28 Table 8 Browns Ferry 50-Mile Radius Population Dose ....................................................30 Table 9 Browns Ferry EPRI Accident Class 7 Population Doses .....................................31 Table 10 BFN Accident Class Frequency and Dose as a Functions of ILRT Frequency 32 Table 11 Unit-1 Class 1 PDR Decrease Due to Extended CILRT Intervals .......................33 Table 12 Unit-1 Class 3a PDR Increase Due to Extended CILRT Intervals ......................33 3

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 13 Unit-1 Class 3b PDR Increase Due to Extended CILRT Intervals ......................34 Table 14 Unit-1 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval ..........................34 Table 15 Unit-2 Class 1 PDR Decrease Due to Extended CILRT Intervals .......................35 Table 16 Unit-2 Class 3a PDR Increase Due by CILRT Interval ........................................35 Table 17 Unit-2 Class 3b PDR Increase Due by CILRT Interval ........................................35 Table 18 Unit-2 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval ..........................35 Table 19 Unit-3 Class 1 PDR Decrease by CILRT Interval.................................................36 Table 20 Unit-3 Class 3a PDR Increase by CILRT Interval ................................................37 Table 21 Unit-3 Class 3b PDR Increase by CILRT Interval ................................................37 Table 22 Unit-3 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval ..........................37 Table 23 BFN Liner Corrosion Base-Case Risk Assessment ...........................................45 Table 24 Unit-1 Increase in LERF/yr ...................................................................................48 Table 25 Unit-2 Increase in LERF/yr ...................................................................................48 Table 26 Unit-3 Increase in LERF/yr ...................................................................................49 Table 27 Unit 1 Summary of Base Case and Corrosion Sensitivity Case ........................53 Table 28 Unit 2 Summary of Base Case and Corrosion Sensitivity Case ........................54 Table 29 Unit 3 Summary of Base Case and Corrosion Sensitivity Case ........................55 Table 30 Sources Of BFN IPEEE Information ...................................................................56 Table 31 External Events Contribution to CDF and LERF ................................................59 Table 32 LERF/yr for Internal & External Events by ILRT Frequency ..............................61 Table 33 External Events Contribution to LERF, Person-REM, & CCFP ...................62 Table 34 Impact of 15-Year ILRT Frequency on LERF (Upper Bound) .............................63 Table 35 Unit 1 Results Table & Applicability ....................................................................65 Table 36 Unit 2 Results Table & Applicability ....................................................................65 Table 37 Unit 3 Results Table & Applicability ....................................................................66 Table 38 Peer Reviews ........................................................................................................69 Table 39 IE Peer Review Assessment (May 2009) by Capability Category ......................71 Table 40 F&O Totals (May 2009) as a Function of Technical Element ...............................71 Table 41 IE Peer Review Assessment (July 2015) SRs Originally Not Met Or Cat I .....72 Table 42 2015 Peer Review F&O Resolution Review and Updated Status.......................73 4

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 43 Internal Flooding Peer Review Assessment by Capability Category ................75 Table 44 Fire PRA Peer Review Assessment (Jan 2012) by Capability Category ...........76 Table 45 Fire PRA Peer Review Assessment (May 2012) by Capability Category ..........77 Table 46 Fire PRA F&O Totals (May 2012) as a Function of Technical Element ...............77 Table 47 Fire PRA Peer Review Assessment (June 2015) by Capability Category .........78 Table 48 Fire PRA F&O Totals (June 2015) as a Function of Technical Element ..............79 Table 49 FPRA Focused-Scope Peer Review Assessment (June 2015) ..........................79 Table 50 Internal Events PRA F&O Resolution...................................................................83 Table 51 Fire PRA F&O Resolution...................................................................................143 Equation 1 Calculation of the Class 3a Failure Probability ..............................................24 Equation 2 Calculation of the Class 3a Failure Frequency ...............................................24 Equation 3 Calculation of the Class 3b Failure Probability ..............................................24 Equation 4 Calculation of the Class 3b Failure Frequency...............................................25 Equation 5 Calculation of the Adjusted Class 1 Frequency .............................................25 Equation 6 Population Adjustment, FPopulation .....................................................................26 Equation 7 Reactor Power Adjustment ..............................................................................27 Equation 8 Containment Allowable Leakage Factor (FLa) .................................................27 Equation 9 Population Dose Factor (FIntact) ........................................................................27 Equation 10 Population Dose Factor (FOthers) .....................................................................28 Equation 11 Unit 1 Percent Increase in Total Population Dose Rate (PDR) ..................34 Equation 12 Unit 2 Percent Increase in Total Population Dose Rate (PDR) ..................36 Equation 13 Unit 3 Percent Increase in Total Population Dose Rate (PDR) ..................38 Equation 14 Unit-1 LERF Determination for Class 3b ..................................................39 Equation 15 Unit-2 LERF Determination for Class 3b ..................................................39 Equation 16 Unit-3 LERF Determination for Class 3b ..................................................39 Equation 17 Unit-1 Conditional Containment Failure Probability ..................................40 Equation 18 Unit-1 Change in Conditional Containment Failure Probability ................40 Equation 19 Unit-2 Conditional Containment Failure Probability ..................................41 Equation 20 Unit-2 Change in Conditional Containment Failure Probability ................41 5

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Equation 21 Unit-3 Conditional Containment Failure Probability ..................................41 Equation 22 Unit-3 Change in Conditional Containment Failure Probability ................42 Equation 23 Total Likelihood of Non-Detected Containment Leakage ..........................47 Equation 24 CDFA-N ...........................................................................................................48 Equation 25 Liner Corrosion Increase in LERF .............................................................48 Equation 26 Unit 1 Increase in CCFP Due to Increase in Flaw Likelihood ....................49 Equation 27 Unit 2 Increase in CCFP Due to Increase in Flaw Likelihood ....................49 Equation 28 Unit 3 Increase in CCFP Due to Increase in Flaw Likelihood ....................50 Equation 29 Unit 1 CCFP Increase in Flaw Likelihood .................................................50 Equation 30 Unit 2 CCFP Increase in Flaw Likelihood .................................................51 Equation 31 Unit 3 CCFP Increase in Flaw Likelihood .................................................51 Equation 32 Seismic CDF Factor .......................................................................................58 Equation 33 Seismic LERF Estimation..............................................................................58 Equation 34 Internal Events CDF / LERF Factor Calculation ............................................59 Equation 35 High Winds LERF Approximation ..................................................................59 Equation 36 External Events - Internal Events Weighted Average Determination ..........60 Appendix A PRA Technical Adequacy 6

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 1.0 Introduction/Background In 1995 the NRC amended 10CFR50 Appendix J to include test methods referred to as Option B, a performance-based approach to leakage testing which allows licensees with acceptable test performance history to extend surveillance intervals. At that time, provisions were made for extending the Containment Integrated Leak Rate Test (CILRT) frequency from three-in-ten years to once-in-ten years, supported by the NRCs assessment (NUREG-1493)[4] that stated there is an imperceptible increase in risk associated with CILRT intervals up to twenty years.[3]

During the early 2000s most licenses applied for one-time extensions to once-in-fifteen years, including the Browns Ferry Nuclear (BFN) Plant.

Integrated leak-rate testing is the only method capable of detecting all existing leaks in the reactor containment system which is only performed during shutdown operations. During the test other activities within or affecting the containment structure cannot be performed; thus, there is an associated cost in terms of critical path, outage duration, lost generation and occupational radiation exposure.[4]

The purpose of this analysis is to provide a risk assessment of permanently extending the Current Licensing Basis (CLB) allowed Type A CILRT interval from once-in-ten years to once-in-fifteen years. The extension would allow for substantial cost savings as the CILRT could be deferred which over the remaining life of the plant would reduce the total required number of Type A ILRTs all the while having a negligible increase in risk.

Earlier assessments followed the guidance of EPRI TR-104285 that considered changes in local leak-rate testing (LLRT) and CILRT testing intervals.[2] That report considered the change in risk based only on population dose, whereas EPRI 1018243 guidance considers population dose, large early release frequency (LERF) and the conditional containment failure probability (CCFP).[1] This risk assessment follows the guidance from NEI 94-01[3], the methodology used in EPRI TR-1018243,[1] NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) as stated in RG 1.200,[9] and RG 1.174,[7] for risk insights in support of a request for a change to a plants licensing basis. Additionally, similar to other CILRT interval extension submittals, the methodology used by Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval[10] is used in the Browns Ferry analysis.

An earlier revision to 10CFR50, Appendix J (Option B) allowed individual plants to extend the original licensing basis (OLB) Type A CILRT surveillance testing requirement from three-in-ten years to once-in-ten years. The revised Type A frequency is based on an acceptable performance history.

This calculation evaluates the risk associated with the following CILRT intervals:

• 3 Years - Original Licensing Basis (OLB) test interval of three per ten years

• 10 Years - Current Licensing Basis (CLB) test interval is once per ten years

• 15 Years - Proposed Licensing Basis (PLB) test interval to once per fifteen years The risk analysis uses the Browns Ferry PRA Level 1 model (internal events and internal flooding), the LERF model, and an analysis which performed an evaluation (BFN-0-16-040)[12] of the distribution of core damage frequency for the various EPRI accident classes. The release category and dose (Person-Rem) information is based on the approach suggested by the EPRI guidance.[1] The NRC report on performance-based leak testing, NUREG-1493[4] analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In the NUREG-1493 analysis, it was a determined that for a representative BWR (i.e., Peach Bottom), increasing the containment leakage rate from 7

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 the nominal 0.5% per day to 5.0% per day leads to a barely perceptible increase in total population exposure; and that increasing the leakage to 50% per day increases the total population dose by less than 1%.[4]

2.0 References and Acronyms 2.1 References

1. EPRI Report 1018243, Oct 2008, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of EPRI 1009325

2. EPRI Report TR-104285, Risk Impact Assessment of Revised Containment Leak-Rate Testing Intervals

3. NEI 94-01 Rev. 3-A, Industry Guideline for Implementation Performance-Based Option of 10CFR Part 50, Appendix J

4. NUREG-1493, Performance-Based Containment Leak-Test Program

5. NUREG/CR-4551 Vol. 4, Rev. 1, Part 1 Evaluation of Severe Accident Risks: Browns Ferry, Unit 1

6. NUREG/CR-4551 Vol. 4 Rev. 1, Part 2 Evaluation of Severe Accident Risks: Browns Ferry, Unit 1

7. Reg. Guide 1.174 Rev. 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis

8. Reg. Guide 1.177 Rev. 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications

9. Reg. Guide 1.200 Rev. 2, An Approach For Determining The Technical Adequacy of Probabilistic Risk Assessment Results For Risk-Informed Activities

10. Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C.H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002. ML020920100

11. NDN-000-999-2010-0001 Rev. 7, Browns Ferry Probabilistic Risk Assessment -

Summary Notebook March 2016

12. PRA Evaluation Response BFN-0-16-040, BFN CDF Distribution for Various EPRI Accident Class Bins, May 2016 (B45 160503 001)

13. BWROG - Browns Ferry Units 1, 2 and 3 PRA Peer Review Report, August 2009

14. R-2205685-1797, Internal Flood PRA Peer Review for Browns Ferry Nuclear Plant, October 2009

15. Browns Ferry Individual Plant Examination - External Events (IPEEE)

16. 1-SI-4.7.A.2.a-f, Primary Containment Integrated Leak Rate Test

17. 2-SI-4.7.A.2.a-f, Primary Containment Integrated Leak Rate Test

18. 3-SI-4.7.A.2.a-f, Primary Containment Integrated Leak Rate Test

19. Browns Ferry Individual Plant Examination for External Events (IPEEE), July 1995 (R08 95-724 976)

20. Seismic IPEEE Report, Browns Ferry Nuclear Plant, June 1996 (R92 960624 851)

21. Browns Ferry Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - Submittal of Browns Ferry Nuclear Plant Unit 1 Seismic and Internal Fires IPEEE Reports, January 14, 2005 (R08 050114 823) 8

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

22. TVA/BFN-01-R-005 Rev. 0, Browns Ferry Nuclear Power Plant Unit 1 Seismic IPEEE Report, October 2004

23. MDN0-999-2001-0011 Rev. 0, Level 3 Consequence Assessment for Browns Ferry Nuclear (SAMA) March 2002

24. NDQ-099-998-0016 Rev. 12, Parameters Used in Dose Analysis

25. BFN Unit-1 Technical Specifications, Amendment 269, Section 5.5.12 Primary Containment Leakage Rate Testing Program

26. BFN Unit-2 Technical Specifications, Amendment 302, Section 5.5.12 Primary Containment Leakage Rate Testing Program

27. BFN Unit-3 Technical Specifications, Amendment 261, Section 5.5.12 Primary Containment Leakage Rate Testing Program

28. NDN-000-999-2010-0001 Rev. 7, BFN Probabilistic Risk Assessment - Summary Document March 2016

29. BFN Final Safety Analysis Report (FSAR)

30. NDN-000-999-2007-0038, Rev. 0, BFN Probabilistic Risk Assessment - Structural Analysis

31. NDN-000-999-2012-000096 Rev. 8, BFN Fire Probabilistic Risk Assessment - Summary Document

32. NDN-000-999-2012-00012 Rev. 4, Fire Risk Quantification

33. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications

34. NDN-000-999-2015-000337 Rev. 3, BFN Probabilistic Risk Assessment - Extended Power Uprate

35. NDN-000-909-2012-000096 Rev. 8, BFN Fire Probabilistic Risk Assessment - Summary Document

36. NEDP-26 Rev. 11, Probabilistic Risk Assessment

37. NPG-SPP-09.11 R3, Probabilistic Risk Assessment Program

38. NEDP-2 Rev. 20, Design Calculation Process Control

39. BFN Fire PRA Peer Review Report Using ASME/ANS PRA Standard Requirements, May 2012

40. BFN Fire PRA Follow-On Peer Review Report Using ASME/ANS PRA Standard Requirements, October 2012

41. BFN Fire PRA Focused-Scope Peer Review Report, June 2015

42. BFN Internal Events PRA F&O Resolution Focused Scope Peer Review, August 2015

43. NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard.

44. NEI 07-12, Fire Probabilistic Risk Assessment Peer Review Process Guidelines

45. ML081140105, Letter from M. J. Maxin (NRC) to J. C. Butler (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) 94-01, Revision 2, Industry Guideline for Implementing Performance-Based Option of 10 CFR 50, Appendix J, and Electric Power Research Institute (EPRI) Report No. 1009325, Revision 2, August 2007, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals (TAC No. MC9663), dated June 25, 2008

46. NEI 02-04 Rev. A3, Probabilistic Risk Assessment Peer Review Process Guideline, March 2000 9

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

47. BFN-0-16-031 (B45 160329 002), Response to FAQ 14-01. Site PRAs to perform and document a review of action to address Peer Review findings related to those SRs identified in NEI 99-02, Table G-5. March 2016 2.2 Acronyms The following acronyms are used in this system notebook:

APB - Accident Progression Bin BFN - Browns Ferry Nuclear Plant CCDP - Conditional Core Damage Probability CCFP - Conditional Containment Failure Probability CD - Core Damage CDF - Core Damage Frequency CET - Containment Event Tree CF - Containment Failure CLB - Current Licensing Basis DW - Drywell EPRI - Electric Power Research Institute F&O - Facts & Observations FPIE - Full-Power Internal Events FPRA - Fire PRA CILRT - Containment Integrated Leak Rate Test ILRT - Integrated Leak Rate Test IPEEE - Individual Plant Examination of External Events ISLOCA - Interfacing System LOCA La - Leakage (Allowable)

LERF - Large, Early Release Frequency MFCR - Mean Fractional Contribution to Risk MOR - Model of Record NEI - Nuclear Energy Institute NRC - Nuclear Regulatory Commission OLB - Original Licensing Basis PDR - Population Dose Rate PLB - Proposed Licensing Basis PMT - Post-Maintenance Test PRA - Probabilistic Risk Assessment 10

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 SERF - Small Early Release Frequency SMA - Seismic Margins Analysis SRP - Standard Review Plan SSE - Safe Shutdown Earthquake STG - Source Term Group USGS - United States Geological Survey VB - Vessel Breach WW - Wetwell 3.0 Assumptions

1. The assumed maximum containment leakage for EPRI Class 1 sequences is 1 La (acceptable leakage). This is because Class 3 has been added to account for increased leakage due to Type A inspections (e.g., containment liner flaws).[1, §4.2.2]

2. The characterization for the assumed maximum containment leakage (small) for Class 3a sequences is 10 La based on the EPRI guidance.[1, §4.3]

3. The assumed maximum containment leakage (large) for Class 3b sequences is 100 La based on the EPRI guidance.[1, §4.3]

4. Class 3b is conservatively categorized as LERF based on the NEI guidance and previously approved EPRI methodology.[1, §4.2.1]

5. Containment leakage due to EPRI Classes 4 and 5 are considered negligible based on the NEI guidance and the previously approved EPRI methodology and are not evaluated further by this analysis.[1, §4.3]

6. Conservatively, it is assumed that EPRI Class 8 sequences (e.g., ISLOCA) are containment bypass sequences; therefore, potential releases are assumed to go directly to the environment.[1, §4.3]

7. A change in the existing once-in-ten years testing frequency to the proposed once-in-fifteen years frequency assumes a constant failure rate and that the failures are randomly dispersed during the interval between tests.

8. It is assumed that a change in CCFP of up to 1.5% is small. This because NRC has accepted previous submittals with CCFP increase up to 1.1% for one-time extensions of the CILRT testing interval. In context, it is noted that NRC has approved CCFPs of 10%

for evolutionary light water reactor designs.[1, §2.2]

9. The interval between ILRTs at the original licensing basis of three tests in ten years is taken to be three years. This value is consistent with the EPRI guidance report. [1, §D.1]

10. The likelihood of liner flaw growth over the extended period without benefit of visual inspection is estimated to double every five years.[10] This assumption is generic in nature and does not depend on any plant specific inputs and is used in the EPRI guidance. [1] As such, the doubling of the liner flaw likelihood in the Browns Ferry analysis is judged to be reasonable.

11. A total visual inspection failure likelihood of 10% is assumed for that fraction of the liner that is available for visual inspection. This assumption is consistent with the EPRI methodology which reads: Five percent failure to identify visual flaws plus 5% likelihood 11

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 that the flaw is not visible (not through the cylinder but could be detected by CILRT).[1 §4.4]

All industry events have been detected through visual inspection. Five percent visual failure detection is a conservative assumption.

12. The EPRI guidance[1 §4.4] states the likelihood of leakage due to crack formation in the basemat region is considered to be ten times less likely than the cylinder or dome regions.

13. All non-detectable failures are assumed to result in early release. This approach is conservative and avoids detailed analysis of containment failure timing and operator recovery actions.[1, 5.2.5.1]

14. Since a larger assumed Containment CILRT pressure yields a worse result in the corrosion sensitivity analysis, an upper bound for containment pressure during an CILRT is used in the analysis. Based on reference [16 - 18, §7.6.9] the CILRT containment pressure range is 51.4 - 51.8 psig, or 66.1 - 66.5 psia. Accordingly, the upper bound pressure selected will be taken to be slightly larger than the 51.8 psig value. This value is considered reasonable because the test range is limited by procedure.

15. EPRI accident class 7c (large, late and scrubbed) is conservatively subsumed into the 7b (large, late and unscrubbed) data.

16. The Fire PRA represents the plant once the NFPA-805 modifications have been completely installed. It is assumed that Browns Ferry will meet the 2019 schedule to have all the credited work complete.

4.0 Ground Rules The following ground rules are used in this analysis:

1. The technical adequacy of the Browns Ferry PRA is consistent with the requirements of R.G. 1.200 and is relevant to the CILRT interval extension. The adequacy is based on peer review and resolution of the facts & observations (F&Os) which are included as an attachment to this document.

2. The Browns Ferry Level 1 and LERF internal events PRA models provide representative results.

3. Dose results for the containment failures modeled in the PRA can be characterized by information provided in NUREG/CR-4551.[5 ,6]

4. Accident classes describing radionuclide release end-states are defined consistent with the EPRI methodology[1] and are summarized in section 6.1 of this calculation.

5.0 Methodology Section 5 contains documents the analyses performed for characterizing the effect of containment isolation failures affected by leakage testing requirements. Section 5 includes the following:

Table 4 provides the description of the EPRI accident classes.

Section 5.1 describes how the baseline risk is determined, Step 1 Section 5.2 describes how the baseline population dose is determined, Step 2 Section 5.3 describes how the risk impact (Bin Frequency and Population Dose) are determined, Step 3 12

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Section 5.4 describes how the change in LERF is evaluated, Step 4 Section 5.5 describes how the change in CCFP is evaluated, Step 5 Section 5.6 describes how the sensitivity of results are evaluated, Step 6 The methodology employed is in accordance with NEI 94-01, Revision 3-A[3] and the NRC regulatory guidance on the use of PRA and risk insights in support of a license amendment request (LAR) for changes to a plants licensing basis, R.G. 1.174.[7] This methodology is similar to that presented in the EPRI guidance[1] as specified in NEI 94-01.[7, §9.2.4.3]

A simplified bounding analysis approach is used in the methodology to evaluate the risk impact on increasing the CILRT Type A interval from the current licensing basis of one test in ten years to the proposed licensing basis of one test in fifteen years by examining specific accident sequences in which the containment remains intact or those in which it is impaired. The aspects to consider include:

• Accident progression sequences in which the containment remains intact initially and in the long term (Class 1)

- Class 1 Frequency 1 = FINTACT - FClass 3a - FClass 3b where; Class 3a = small containment liner leakage Class 3b = large containment liner leakage

• Accident progression sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B 2 or Type C 3 tested components. .

• Accident progression sequences in which containment integrity is impaired due to containment isolation failures due to pathways (e.g., misalignment) left open following a plant post-maintenance testing (PMT).

• Accident progression sequences 4 involving containment failure by any of the following:

- Containment Isolation Failures (Class 2)

- Small Containment Isolation Failure-to-Seal Events (Class 4 and 5)

- Severe Accident Phenomena (Class 7)

- Containment Bypass Events (Class 8) 1 The adjustment to Class 1 is necessary to maintain the sum of the frequencies equal to CDF.

2 Type B tests measure component leakage across pressure retaining boundaries, e.g., gaskets, expansion bellows and air locks.

3 Type C tests measure component leakage rates across containment isolation valves.

4 The sequences of these classes are impacted by changes in Type B and Type C test intervals, and are not affected by changes in the Type A test interval.

13

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 1 provides detailed information regarding the EPRI accident classes.[1, §4.3]

Table 1 Detailed Description of EPRI Accident Classes Population Dose EPRI Population Dose Description[1, §4.3] Frequency Leakage Rate (person-Class (person-rem) rem/rx-yr)

CONTAINMENT INTACT - all core damage accident progression bins for which the containment remains intact with negligible leakage. Class Calculated Value 1 sequences arise from those core damage sequences where containment isolation is successful and long-term containment heat removal Value from 1 capability is available. The frequency of an intact containment is La NUREG/CR-4551 DOSEClass 1

• FClass 1 FClass 1 =

established on the individual plants PRA. For Class 1 sequences, it is assumed that the intact containment end-state is subject to a containment CDFIntact - F3a - F3b leakage rate less than the allowable containment leakage (La) rate.

LARGE CONTAINMENT ISOLATION FAILURES - all core damage From Plant PRA accident progression bins for which pre-existing containment leakage From Value from 2 due to failure to isolate occurs. These sequences are dominated by FClass 2 =

Plant PRA NUREG/CR-4551 DOSEClass 2

• FClass 2 failure-to-close of large (>2 diameter) containment isolation valves. PLargeCI

• CDFTotal SMALL PRE-EXISTING LEAK FROM THE CONTAINMENT Calculated Value LINER - all core damage accident progression bins with pre-existing (Class 1 dose for 3a leakage from the containment structure in excess of normal leakage (La). FClass 3a = 10 La La)

• 10 DOSE3a

• F3a Small leaks are characterized as > 1 La 10 La. PClass 3a

• CDF LARGE PRE-EXISTING LEAK FROM THE CONTAINMENT Calculated Value LINER - all core damage accident progression bins with a pre-existing (Class 1 dose for 3b leakage from the containment structure in excess of normal leakage (La). FClass 3b = 100 La La)

• 100 DOSE3b

• F3b Large leaks are characterized as > 10 La. PClass 3b* CDF SMALL CONTAINMENT ISOLATION FAILURE - FAILURE TO SEAL (TYPE B) - all core damage accident progression bins for which a failure-to-seal containment isolation of Type B tested components 4 occurs. Because these failures are detected by Type B tests and their N/A N/A N/A N/A frequency is very low compared with the other classes, this group is not evaluated further in this analysis. The frequency of Class 4 sequences is subsumed into Class 7, where it contributes insignificantly.

SMALL CONTAINMENT ISOLATION FAILURE - FAILURE TO 5 SEAL (TYPE C) - all core damage accident progression bins for which a N/A N/A N/A N/A failure-to-seal containment isolation of Type C tested components occurs. Because these failures are detected by Type C tests and their 14

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Population Dose EPRI Population Dose Description[1, §4.3] Frequency Leakage Rate (person-Class (person-rem) rem/rx-yr) frequency is very low compared with the other classes, this group is not evaluated further in this analysis. The frequency of Class 5 sequences is subsumed into Class 7, where it contributes insignificantly.

CONTAINMENT ISOLATION FAILURES (DEPENDENT FAILRUES AND PERSONNEL ERRORS) - similar to Class 2. These sequences involve core damage accident progression bins for which failure-to-seal containment leakage, due to failure to isolate the 6 containment occurs. These sequences are dominated by misalignment of N/A N/A N/A N/A containment isolation valves following test/maintenance evolutions. i.e.,

human error. All other failure modes are bounded by the Class 2 assumption.

From Plant PRA SEVERE ACCIDENT PHENOMENA - INDUCED FAILURES - all core damage accident progression bins in which containment failure FClass 7 = From Value from 7 induced by severe accident phenomena occurs (e.g., hydrogen Plant PRA NUREG/CR-4551 DOSE7

• F7 CDFCFL + CDFCFE combustion and direct containment heating).

From Plant PRA CONTAINMENT BYPASS - all core damage accident progression bins in which containment bypass occurs. Each plants PRA is used to FClass 8 = From Value from 8 determine the containment bypass contribution. Contributors include Plant PRA NUREG/CR-4551 DOSE8

• F8 CDFISLOCA+ CDFSGTR Interfacing System Loss-of-Coolant Accidents (ISLOCAs).

CDFIntact = core damage frequency for intact containment sequences from the plant-specific PRA PLarge CI = random containment large isolation failure probability (i.e., large valves)

CDFTotal = total plant-specific core damage frequency PClass 3a = the probability of a small (10 La) pre-existing containment leak PClass 3b = the probability of a large (100 La) pre-existing containment leak CDFCFL = the core damage frequency resulting from accident sequences that lead to late containment failure CDFCFE = the core damage frequency resulting from accident sequences that lead to early containment failure 15

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 The risk metrics used to evaluate the impact of a proposed change on plant risk include the following figures of merit and success.

The figures of merit (or risk metrics) [1, page 2-4]:

• Large, Early Release Frequency (Total LERF & LERF),

• change in risk as defined by the changes in dose (Population Dose [Person-Rem]),

• and, the change in the Conditional Containment Failure Probability (CCFP).

The acceptance criteria:

• Total LERF and LERF, RG 1.174[7]

• Population Dose, <1.0 person-rem or <0.1% Increase - whichever one is less restrictive[1 §1.2]

• CCFP 1.5% (Assumption 8)

Additionally, the EPRI guidance also lists the change in core damage frequency as a measure to be considered; however, the Type A containment test measures the ability of the containment to maintain its function, therefore, the proposed change has no measureable effect on the core damage frequency,[1 §5.0] CCDP and CDF remain constant.

5.1 Step 1 - Baseline Risk Determination In this step[1, §4.2.1] the baseline risk in terms of core damage frequency (CDF) for each EPRI accident class, excluding classes 4, 5 and 6, is defined and quantified. According to the EPRI guidance accident classes 4, 5 and 6 are excluded because the circumstances (i.e., Type B and Type C tests) and types of failures such as simultaneous failure of redundant isolation valves are not impacted by changes in the CILRT Type A frequency. The baseline risk is determined as follows:

• The plant-specific Browns Ferry Level 2 PRA Release categories[12] are mapped to EPRI accident classes 2, 7 and 8.[12]

• The release categories that represent accident Class 1 (Containment Intact) are those identified as not having containment failure. The Browns Ferry L2 analysis refers to these as INTACT. The release categories representing INTACT, or no containment failure outcomes may experience leakage due to the increased window of vulnerability of extending the test interval. The increase in leakage contribution (i.e., accident classes 3a and 3b) are subtracted to obtain the expected no containment failure outcome frequency as follows:

Class 1 Frequency = CDFINTACT - Class 3a Frequency - Class 3b Frequency The adjustment to the Class 1 frequency is necessary to maintain the sum of the frequencies of the accident classes equal to the total CDF, hence total CDF is preserved.

Class 3 end-states are developed specifically for this application. These end-states include all core damage accident progression bins with postulated pre-existing leakage in the containment structure in excess of normal leakage.[1, §4.3] The frequencies for Class 3a and Class 3b are determined as follows:

Class 3a Frequency = CDF

• Class 3a leakage probability (Ref. Table 1)

Class 3b Frequency = CDF

• Class 3b leakage probability (Ref. Table 1) 16

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Class 3a represents containment liner leakage characterized as small. The probability is based on industry data. Class 3b represents containment liner leakage that is large which has a probability based on Jeffreys Non-Informative Prior, as there have been no industry large containment liner flaws.[1]

According to the EPRI guidance[1] The methodology employed for determining LERF (Class 3b frequency) involves conservatively multiplying the CDF by the failure probability for this class (3b) accident. This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and thus not associated with the postulated large Type A containment leakage path (LERF). The contributors can be removed from class 3b in the evaluation of LERF by multiplying the class 3b probability by only that portion of CDF that may be impacted by Type A leakage.

• An example of the type of sequences that may independently cause LERF is a sequence associated with an interfacing system loss of coolant accidents, (ISLOCA). Another example may include those accident sequences associated with anticipated transients without SCRAM (ATWS) events.

• An example of the type of sequence that may never result in LERF is a sequence where containment sprays and containment heat removal are available. In these sequences, containment sprays and cooling reduce the fission products via scrubbing and rapidly reduce containment pressure. The basis for the removal of sequences to reduce conservatism is plant and PRA specific and should be documented by analysis in the risk impact assessment.[1, §4.2.1]

Core damage accident progression end-states are developed for the Browns Ferry PRA Level 2 results.[12] which are used to define the representative sequences. Based on the discussion above, determining the Type A CDF contribution involves identifying two different scenarios. 1) those scenarios corresponding to release categories which include unmitigated containment bypass or pre-existing large isolation failures, and 2) those release categories where there is no containment isolation failures prior to core damage combined with effective mitigation of fission product releases. Specifically, there is no containment isolation failures prior to core damage.

5.2 Step 2 - Develop the Baseline Population Dose Per Year In step 2[1, §4.2.2] the baseline dose/yr corresponding to the current licensing basis CILRT testing interval (1-in10 years) is estimated. The BFN population dose is calculated using the data provided by the NUREG/CR-4551 reference plant, Peach Bottom and the results are adjusted for applicability to Browns Ferry. Each Peach Bottom accident sequence was assigned to an applicable Accident Progression Bin (APB) in NUREG/CR-4551.[5] The definitions of the APBs are provided in Table 1.

To normalize the reference plant data to BFN parameters, factors are calculated to reflect population dose and reactor power differences.

The yearly population dose is estimated for each accident class by multiplying the dose estimate for a class by either the frequency estimated in Step 1 or the La factor corresponding to the Class.[1,§4.2.2] Various options are available for performing this analysis, including the following.

17

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

1. From the BFN specific Level 2 results, determine the relationship between offsite dose measured in person-rem and containment leakage rate (the dose in person-rem) for Class 1. Assumed to be equal to 1 La.

2. From the plant IPE, determine the offsite dose (person-rem) for the accident classes where analysis is available, typically Classes 1, 2, 7 and 8.

3. For those accident classes where analysis is not available in the IPE or PRA, determine the dose estimate by determining the class containment leak rate and multiplying by the 1.0 La dose.

4. The offsite dose estimate for EPRI accident Classes 3a and 3b are estimated as following in accordance with the EPRI guidance.

- 3a = Class 1 (1 La)

• 10

- 3b = Class 1 (1 La)

• 100

5. Determine the baseline accident class dose-rates (person-rem/yr) by multiplying the dose by the frequency for each of the accident classes. Sum the accident class dose-rates to obtain the total dose-rate.

5.3 Step 3 - Evaluate the Risk Impact (Bin Frequency and Population Dose)

In this step,[1, §4.2.3] the risk impact associated with the change in CILRT intervals is evaluated.

1. Determine the change in probability of leakage detectable only by ILRT (Classes 3a and 3b) for the new surveillance intervals of interest. NUREG 1493[4] states that relaxing the CILRT frequency from three-in-ten years (OLB) to once-in-ten years (CLB) will increase the average time that a leak that is detectable only by ILRT (i.e., liner flaw) goes undetected from 18 to 60 months (1/2 the surveillance interval), a factor of 60/18 = 3.33 increase. Therefore, relaxing the ILRT frequency from three-in-ten years to once-in-fifteen years (PLB) will increase the average time that a leak that is detectable only by ILRT goes undetected from 18 to 90 months (1/2 the surveillance interval), a factor of 90/18 = 5.0 increase.

2. Determine the population dose-rate for the new surveillance intervals of interest by multiplying the dose by the frequency for each accident class of interest. Sum the accident class dose-rates to obtain the total dose-rate.

3. Determine the increase in dose-rate and percentile increase for each extended interval as follows: Increase in dose-rate = (total dose-rate of new interval minus total baseline dose), and percent increase = [(increase in dose-rate) divided by (total baseline dose-rate)] x 100%.

5.4 Step 4 - Evaluate the Change in LERF In this step,[1, 4.2.4] the changes in the Large Early Release Frequency (LERF).

Evaluate the risk impact in terms of change in LERF. The risk associated with extending the CILRT interval involves a potential that a core damage event that normally would result in only a small radioactive release from containment could result in a large release due to an undetected leak path growing in size during the extended interval. Only Class 3 sequences have the potential to result in early releases if a pre-existing leak were present. Late releases are excluded regardless of the size of the leak because late releases are not, by definition, LERF 18

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 events. The frequency of class 3b sequences is used as a measure of LERF, and the change in LERF is determined by the change in class 3b frequency. Refer to Regulatory Guide 1.174[7] for LERF acceptance guidelines.

LERF = (frequency class 3b interval x) - (frequency class 3b baseline) 5.5 Step 5 - Evaluate the Change CCFP Evaluate the change in CCFP. The conditional containment failure probability is defined as the probability of containment failure given the occurrence of an accident that results in core damage, which can be expressed as:

CCFP = [1 - (frequency that results in no containment failure)/CDF]

• 100%

CCFP = [1 - (frequency class 1 + frequency class 3a)/CDF]

• 100%

CCFP Change (increase) = (CCFP at interval x) - (CCFP at baseline interval),

expressed as percentage point change.

5.6 Step 6 - Evaluate the Sensitivity of the Results In this step,[1, §4.2.5] a sensitivity analysis to determine the risk impact of assumptions used in the liner corrosion study are investigated along with the sensitivity of extended intervals on liner corrosion.

The methodology developed for Calvert Cliffs[10] investigates how an age-related degradation mechanism can be factored into the risk impact associated with longer CILRT testing intervals.

The instances of through-wall penetration of the containment liner are considered in the development of the risk assessment methodology and are part of the plant-specific analyses performed for assessing the potential for liner corrosion.

• As stated in the Calvert Cliffs analysis,[10] occurrences of through-wall liner corrosion related defects had been found between September 1996 implementation of the visual inspection requirements of 10CFR50.55a and the submittal date for that reference. Two defects identified in the cylinder region of the liner and no defects were identified in the basemat region.

6.0 Containment Overpressure For those plants that credit containment overpressure for the mitigation of design basis accidents, a brief description of whether overpressure is required in this section. The Browns Ferry plant does not credit containment overpressure to aid in net-positive suction head (NPSH) for emergency core cooling system (ECCS) injection.

7.0 Inputs In this section inputs from the Browns Ferry Level 2 PRA are provided and relationship to the corresponding EPRI accident class is given.

Table 2 provides the CDF and LERF values for Units 1, 2 and 3 for the Base PRA Model.

19

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 3 provides the EPRI release classifications and the interpretation for assignment to the Browns Ferry Release categories.

Table 4 provides the EPRI Accident Class Totals by BFN Unit.

Section 6.1 provides the decomposition of the Browns Ferry accident sequences and EPRI classification.

The Browns Ferry internal events with internal flooding models result in CDF and LERF as indicated in Table 2. [28 Table 13]

Table 2 CDF and LERF for Units 1, 2 and 3 Metric Unit 1 Unit 2 Unit 3 CDF/yr 6.93E-06 6.29E-06 7.72E-06 LERF/yr 1.26E-06 1.21E-06 1.45E-06 Table 3 EPRI Release Classes (Containment Failure Classifications)

EPRI Interpretation for Assigning Description Class Browns Ferry Release Category Containment remains intact with containment 1 Intact containment bins initially isolated Isolation faults that are related to a loss of Dependent failure modes, or common cause 2 power or other isolation failure mode that is failures not a direct failure of an isolation component Independent containment isolation failures Isolation failures identified by Type A testing, 3

due to Type A related failures Large (3b) or Small (3a)

Independent containment isolation failures 4 due to Type B related failures Isolation failures identified by Type B testing Independent containment isolation failures 5 due to Type C related failures Isolation failures identified by Type C testing Isolation failure with scrubbing or small 6 Other penetration failures isolation fails Early and Late containment failure 7 Induced by severe accident phenomena sequences as a result of hydrogen burn or other early phenomena 8 Bypass Bypass sequences, e.g., ISLOCA The Browns Ferry Level 2 accident sequences are parsed into the EPRI accident class categories that represent the summation of individual accident categories due to similar characteristics. Table 4 provide the CDF associated with each category.

20

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 4 EPRI Accident Class Frequencies

[12]

EPRI Accident Class Totals Frequency (CDF/yr)

Classification Equation/Section Unit 1 Unit 2 Unit 3 1

EPRI Class 1 Section 7.1.1 2.91E-06 2.89E-06 2.54E-06 Sum of EPRI Class 1 (Adjusted)

Equation 5 2.87E-06 2.85E-06 2.50E-06 (Class 1 Without 3a & 3b)

Sum of EPRI Class 2 Section 7.1.2 3.17E-08 2.99E-08 3.23E-08 EPRI Class 3a Equation 2 3.32E-08 3.24E-08 3.01E-08 EPRI Class 3b Equation 4 8.27E-09 8.07E-09 7.48E-08 Sum of EPRI Class 7a (early) Table 9 6.88E-07 6.30E-07 7.14E-07 Sum of EPRI Class 7b (late) Table 9 2.98E-06 2.41E-06 4.09E-06 Sum of EPRI Class 8 Section 7.1.4 3.11E-07 3.31E-07 3.35E-07 Total CDF: 6.92E-06 6.29E-06 7.71E-06

1. The Class 1 frequency is before the contribution from Class 3a and 3b are subtracted, and is not included in the total CDF. The adjusted Class 1 frequency accounts for the calculated 3a and 3b frequencies and is included in the total CDF.

8.0 Calculation The section documents the analyses performed for characterizing the effect of containment isolation failures affected by leakage testing requirements. Section 8 includes the following:

Section 8.1 the baseline (three-year CILRT frequency) risk is quantified in terms of frequency per reactor-year for the EPRI accident classes of interest.

Section 8.2 the baseline population dose (person-rem) is developed for the applicable accident classes.

Section 8.3 the risk impact (in terms of population dose-rate) is evaluated for the EPRI accident classes of interest.

Section 8.4 the risk impact in terms of the change in LERF and the change in CCFP are determined.

Section 8.5 the Conditional Containment Failure Probability (CCFP) is determined.

8.1 Step 1 - Baseline Risk Determination Section 8.1 documents the calculations for the quantification of the baseline (three-year CILRT frequency) risk in terms of frequency per reactor year for the EPRI accident classes of interest.[1,

§4.2]

Section 8.1.1 discusses the baseline Class 1 frequencies for Intact Containment.

Section 8.1.2 discusses the Class 2 frequencies which consists of large containment isolation failures.

21

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Section 8.1.3 discusses Class 7 failures which consists of early and late severe accident phenomena.

Section 8.1.4 discusses Class 8 failures which consist of bypass events such as an un-isolable ISLOCA.

Section 8.1.5 provides the calculation for the Type A leakage estimate, including the determination of the 3a probabilities and frequencies.

Section 8.1.6 provides the calculation for the Type A leakage estimate, including the determination of the 3b probabilities and frequencies.

Section 8.1.7 provides the calculation of the Adjusted Class 1 frequency.

8.1.1 Class 1 - Intact Containment The Browns Ferry frequency of EPRI Class 1 is equal to the frequency of those accident sequences where the containment is intact. From Table 4:

Unit 1 FREQU1_Class_1 = Class_1 Accident Sequences

= 2.91E-06/yr Unit 2 FREQU2_Class_1 = Class_1 Accident Sequences

= 2.89E-06/yr Unit 3 FREQU3_Class_1 = Class_1 Accident Sequences

= 2.54E-06/yr 8.1.2 Class 2 - Large Containment Isolation Failures This class represents large containment isolation failures. Class 2 contains LERF contributions related to isolation failures without scrubbing credited. The frequency of Class 2 is the sum of those release categories identified in Table 4 as Class 2 taken from the Browns Ferry specific L2 analysis.[12]

Unit 1 FREQU1_Class_2 = Class_2 Accident Sequences

= 3.17E-08/yr Unit 2 FREQU2_Class_2 = Class_2 Accident Sequences

= 2.99E-08/yr Unit 3 FREQU3_Class_2 = Class_2 Accident Sequences

= 3.23E-08/yr 8.1.3 Class 7 - Severe Accident Phenomena Class 7 represents the accident sequences where containment is failed as a result of severe accident phenomena. This accident class is not affected by the ILRT testing interval. However, for the purposes of population dose calculation, the Browns Ferry frequency associated with this accident class is divided into two categories as shown in Table 4. The frequency of Class 7 is 22

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 the sum of those release categories identified as Class 7. Class 7c (large, late and scrubbed) is conservatively treated and are assumed to not be scrubbed and therefore included in the 7b frequency, Class 7 (Total of 7a and 7b)

Reference Table 9 for distribution of 7a and 7b sequences.

Unit 1 FREQU1_Class_7 = Class_7 Accident Sequences

= 3.67E-06/yr Unit 2 FREQU2_Class_7 = Class_7 Accident Sequences

= 3.04E-06/yr Unit 3 FREQU3_Class_7 = Class_7 Accident Sequences

= 4.80E-06/yr 8.1.4 Class 8 - Containment Bypass (ISLOCA)

The frequency of Class 8 is the sum of those release categories where the containment is bypassed, the total is provided from Table 4.

Class 8 events which include un-isolable ISLOCA events.

Unit 1 FREQU1_Class_8 = Class_8 Accident Sequences

= 3.11E-07/yr Unit 2 FREQU2_Class_8 = Class_8 Accident Sequences

= 3.31E-07/yr Unit 3 FREQU3_Class_8 = Class_8 Accident Sequences

= 3.35E-07/yr 8.1.5 Calculation of the 3a Probability and Frequency Containment Type A leakage is associated with EPRI accident Class 3. Consistent with the EPRI methodology[1] Class 3 has been divided into two subclasses, 3a for small liner breaches, and 3b for large liner breaches. The estimate for Class 3 was redistributed back into Class 1 (INTACT). Therefore each of these classes must be evaluated for applicability to this analysis.

The Class 3 containment failures are due to flaw in the containment liner that result in leakage outside of the containment structure. These type of leaks can only be detected by performing a Type A CILRT. In order to determine the impact of the extended test interval the probability of Type A leakage must be calculated.

Calculation of the 3a probability and frequency data presented in the EPRI report[1, §4.3] contains two Type A leakage events out of 217 tests. Using the data, a mean estimate for the probability is determined for Class 3a as shown in Equation 1.

23

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Equation 1 Calculation of the Class 3a Failure Probability PClass_3a = #Events ÷ #Tests

= 2 ÷ 217

= 0.0092 This probability is based on a test interval of three tests every ten years, opposed to Browns Ferrys current one test per ten years frequency. The probability must be adjusted to reflect this difference which is performed later in this calculation.

Multiplying the Internal Events (Level 2) CDF by the probability of a Class 3a leak develops the Class 3a frequency contribution in accordance with guidance provided by EPRI. The total CDF includes contributions already binned to LERF. Including these contributions would lead to an over-conservatism in the analysis. Therefore, LERF contribution from CDF is removed, additionally, those sequences that can never result in LERF are removed as well (i.e., 7b).[1 §5.2.1]

Equation 2 Calculation of the Class 3a Failure Frequency FREQxx_Class 3a = PClass_3a x (CDF - Always or Never LERF)

Unit 1 FREQU1_Class_3a = PClass_3a x CDFU1 - (Class 2, 8, 7b)

= 0.0092 x 6.93E (3.17E-08/yr + 3.11E-07/yr + 2.98E-06/yr)

= 3.32E-08/yr Unit 2 FREQU2_Class_3a = PClass_3a x CDFU2 - (Class 2, 8, 7b)

= 0.0092 x 6.29E-06/yr - (2.99E-08/yr + 3.31E-07/yr + 2.41E-06/yr)

= 3.24E-08/yr Unit 3 FREQU3_Class_3a = PClass_3a x CDFU3 - (Class 2, 8, 7b)

= 0.0092 x 7.72E-06/yr - (3.23E-08/yr + 3.35E-07/yr + 4.09E-06/yr)

= 3.01E-08/yr 8.1.6 Calculation of the 3b Probability and Frequency To estimate the failure probability given that no failures have occurred, the EPRI guidance [8 §2.3]

suggests the use of a non-informative prior. This approach updates a uniform distribution (no bias) with the available evidence (data) to provide a better estimation of an event.

A beta distribution is typically used for the uniform prior with the parameters = 0.5 and

= 1. This is combined with the existing data (i.e., no Class 3b events in 217 tests) using Equation 3. The 3b failure probability is determined by Equation 3 and the frequency is determined by Equation 4.

Equation 3 Calculation of the Class 3b Failure Probability PClass_3b = (n + ) ÷ (N + )

= (0 + 0.5) ÷ (217 + 1)

= 0.5 ÷ 218

= 0.0023 where: n = the number of events of interest (large leakage) 24

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 N = the number of tests

= non-informative prior distribution parameter

= non-informative prior distribution parameter Equation 4 Calculation of the Class 3b Failure Frequency FREQxx_Class 3b = PClass_3b x (CDF - Always or Never LERF)

Unit 1 FREQU1_Class_3b = PClass_3b x CDFU1 - (Class 2, 8, 7b)

= 0.0023 x 6.93E-06/yr - (3.17E-08/yr + 3.11E-07/yr + 2.98E-06/yr)

= 8.27E-09/yr Unit 2 FREQU2_Class_3b = PClass_3b x CDFU2 - (Class 2, 8, 7b)

= 0.0023 x 6.29E-06/yr - (2.99E-08/yr + 3.31E-07/yr + 2.41E-06/yr)

= 8.07E-09/yr Unit 3 FREQU3_Class_3b = PClass_3b x CDFU3 - (Class 2, 8, 7b)

= 0.0023 x 7.72E-06/yr - (3.23E-08/yr + 3.35E-07/yr +4.09E-06)

= 7.48E-09/yr 8.1.7 Calculation of the Adjusted Class 1 Frequency Although the frequency of Class 1 is not directly impacted by Type A testing, the frequency is reduced by the estimated frequencies in Class 3a (Equation 2) and 3b (Equation 4) in order to preserve total CDF. The refined Class 1 frequency The adjusted Class 1 frequency is determined by subtracting the calculated 3a and 3b frequencies.

Equation 5 Calculation of the Adjusted Class 1 Frequency Unit 1 FREQU1_Class_1_ADJ = FREQU1_Class_1 - (FREQU1_Class_3a + FREQU1_Class_3b)

= 2.91E-06/yr - (3.32E-08/yr + 8.27E-09/yr)

= 2.87E-06/yr Unit 2 FREQU2_Class_1_ADJ = FREQU2_Class_1 - (FREQU2_Class_3a + FREQU2_Class_3b)

= 2.89E-06/yr - (3.24E-08/yr + 8.07E-09/yr)

= 2.85E-06/yr Unit 3 FREQU3_Class_1_ADJ = FREQU3_Class_1 - (FREQU3_Class_3a + FREQU3_Class_3b)

= 2.54E-05/yr - (3.01E-08/yr + 7.48E-09/yr)

= 2.50E-06/yr 8.2 Step 2 - Develop the Baseline Population Dose In this step, the baseline population dose is calculated. The population dose is a function of the accident class frequency and the population within a 50-mile radius of the Browns Ferry plant.

The Browns Ferry population dose is calculated using the Peach Bottom data provided in 25

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 NUREG/CR-4551[8] and adjusting the results for applicability to Browns Ferry. NUREG/CR-4551 assigned each Peach Bottom accident sequence to an applicable Accident Progression Bin (APB). The definitions of the APBs are provided in Table 7. The associated Peach Bottom population doses are adjusted for Browns Ferry population and reactor power level.

Section 8.2 consists of the following subsections:

Section 8.2.1 discusses the BFN 50-mile radius population density and adjustment Table 5 provides the projected 2036 population density for the 50-mile radius surrounding Browns Ferry and the NUREG/CR-4551 population density for Peach Bottom Section 8.2.2 provides the calculation for the reactor power adjustment factor Table 6 provides the Peach Bottom and BFN reactor power levels, and Equation 7 calculates the power adjustment factor Section 8.2.3 provides the discussion on the containment allowable leakage factor determination Section 8.2.4 provides the discussion on the population dose factors.

Section 8.2.5 provides the discussion on the Peach Bottom collapsed accident progression bin definitions (Table 7)

Section 8.2.6 provides the discussion on the Peach Bottom population dose by accident progression bin, Table 8 provides the BFN 50-mile radius population dose for each of the NUREG/CR-4551 accident progression bins 8.2.1 50-Mile Radius Population Density and Adjustment The projected 2036 population within a 50-mile radius of the Browns Ferry Plant was taken from the Browns Ferry Level 3 analysis for Severe Accident Mitigation Alternatives (SAMA).[23, Attachment A Table 1]

Table 5 50-Mile Radius Population Density Data Source Population Projected BFN 2036 Data - SAMA[23] 1.3E+06 Peach Bottom NUREG/CR-4551 3.2E+06 Equation 6 Population Adjustment, FPopulation Population of Browns Ferry (50-Mile Radius) / Population of Peach Bottom (50-Mile radius)

FPopulation = 1.3E+06 / 3.2E+06

= 0.41 26

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 8.2.2 Reactor Power Level Adjustment The Peach Bottom power level used in NUREG/CR-4551 consequence analysis is 3293 MWt.

Using the data in Table 6, the Browns Ferry reactor power adjustment factor is calculated by Equation 7, i.e., a factor of 1.2 greater than Peach Bottoms (at the time of NUREG/CR-4551).

Table 6 Reactor Power (MWt)

Data Source MWt

[24 §8.1]

BFN Power 5 (MWt) 3952 Peach Bottom NUREG/CR-4551 3293 Equation 7 Reactor Power Adjustment Browns Ferry MWt / Peach Bottom MWt FPower = 3952 / 3293

= 1.20 8.2.3 Containment Allowable Leakage Factor The resultant population dose is a function of the allowable leakage since it is measured on a percentage by weight basis. Peach Bottom has an allowable leakage rate of 0.5 percent/day; however, the BFN has a 2.0 percent/day allowable leakage rate.[25,26,27 §5.5.12] Therefore, Browns Ferry has a factor of 4.0 greater (Fleakage = 4.0) than the reference plant.

Equation 8 Containment Allowable Leakage Factor (FLa)

FLa = La(BFN) ÷ La(PB)

= 2.0 / 0.5

= 4.0 8.2.4 Population Dose Factor The three factors, population, power-level and allowable containment leakage are used to adjust the population dose for the surrogate plant (Peach Bottom) for Browns Ferry. For intact containment end-states, the total population dose factor is as follows:

Equation 9 Population Dose Factor (FIntact)

FIntact = FPopulation

• FPower

• FLa

= 0.41

• 1.2

• 4.0

= 1.95 5

Browns Ferrys operating license at the time of this analysis is 3458 MWt. TVA has submitted a license amendment request (LAR) to increase the power at the three units by 14.3% which will take the units up to 3952 MWt. The change is expected to be approved by NRC in 2017; therefore, the EPU power level is used in this analysis.

27

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 For EPRI accident classes not dependent on containment leakage, the population dose factor is as follows:

Equation 10 Population Dose Factor (FOthers)

FOthers = FPopulation

• FPower-Level

= 0.41

• 1.2

= 0.488 8.2.5 Peach Bottom Collapsed Accident Progression Bin Definitions Table 7 provides a description of the ten accident progression bins developed for the Peach Bottom analysis in NUREG/CR-4551.

Table 7 Peach Bottom Accident Progression Bins Collapsed Accident Progression Bin Definition APB 4551 CD, VB, Early CF WW Failure, RPV Pressure > 200 psi at VB Core damage occurs, 1 followed by vessel breach. The containment fails early in the wetwell (i.e., either before core damage, during core damage, or at vessel breach), and the RPV pressure is greater than 200 psi at the time of vessel breach (this means Direct Containment Heating [DCH] is possible).

CB, VB, Early CF, WW Failure, RPV Pressure < 200 psi at VB Core damage occurs, 2 followed by vessel breach. The containment fails early in the wetwell (i.e., either before core damage, during core damage, or at vessel breach), and the PRV pressure is less than 200 psi at the time of vessel breach (this means DCH is not possible).

CD, VB, Early CF, DW Failure, RPV Pressure > 200 psi at VB Core damage occurs, 3 followed by vessel breach. The containment fails early in the drywell (i.e., either before core damage, during core damage, or at vessel breach), and the RPV pressure is greater than 200 psi at the time of the vessel breach (this means DCH is possible).

CD, VB, Early CF, DW Failure, RPV Pressure < 200 psi at VB Core damage occurs, 4 followed by vessel breach. The containment fails early in the drywell (i.e., either before core damage, during core damage, or at vessel breach), and the RPV pressure is less than 200 psi at the time of the vessel breach (this means DCH is not possible).

CD, VB, Late CF, WW Failure, N/A Core damage occurs, followed by vessel breach. The 5 containment fails late in the wetwell (i.e., after vessel breach during Molten Core-Concrete Interaction [MCCI]), and the RPV pressure is not important since, even if DCH occurred, it did not fail containment at the time it occurred.

CD, VB, Late CF, DW Failure, N/A Core damage occurs, followed by vessel breach. The 6 containment fails late in the drywell (i.e., after vessel breach during MCCI), and the RPV pressure is not important since, even if DCH occurred, it did not fail containment at the time it occurred.

CD, VB, No CF, Vent, N/A Core damage occurs, followed by vessel breach. The containment 7 never structurally fails but is vented some time during the accident progression. RPV pressure is not important (characteristic 5 is N/A) since, even if it occurred, DCH does not significantly affect the source term as the containment does not fail and the vent limits its effect.

28

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 CD, VB, No CF, N/A, N/A Core damage occurs, followed by vessel breach. The containment never fails structurally (characteristic 4 is N/A) and is not vented. RPV pressure is not important 8 (characteristic 5 is N/A) since, even if it occurred, DCH did not fail containment. Some nominal leakage from the containment exists and is accounted for in the analysis so that while the risk will be small it is not completely negligible.

CD, No VB, N/A, N/A, N/A Core damage occurs but is arrested in time to prevent vessel breach. There are no releases associated with vessel breach or MCCI. It must be remembered, 9

however, that the containment can fail due to overpressure or venting even if vessel breach is averted. Thus, the potential exists for some of the in-vessel releases to be released to the i

No CD, N/A,t N/A, N/A, N/A Core damage did not occur. No in-vessel or ex-vessel release 10 occurs. The containment may fail on overpressure or be vented. The RPV may be at high or low pressure depending on the progression characteristics. The risk associated with this bin is negligible 8.2.6 Peach Bottom Population Dose by Accident Progression Bin The Peach Bottom population distributed by APB is presented in Table 8. The dose for the EPRI accident classes is determined by associating the EPRI accident class with an accident progression bin (or bins). For example, in the case of Class 1, the APB that most closely approximates an intact containment is Bin #8. Browns Ferry is a BWR-4 having a Mark I containment design similar to Peach Bottom. Therefore; the association of a given APB with the EPRI accident class for BFN is the same as for Peach Bottom.

The dose for EPRI accident class 2 is associated with APB #3. This assignment is based on assuming that the containment isolation failure of EPRI Class 2 occurs in the drywell as an unscrubbed release. APB #3 results in the highest dose of all the Peach Bottom containment failure APBs, which is indicative of an unscrubbed release.

In the case of EPRI Classes 3a and 3b, no association is made with the NUREG/CR-4551 APBs. Rather, in accordance with the methodology, these accident classes are assigned 10 La and 100 La, or 10x and 100x the dose associated with Class 1.

The dose associated with EPRI accident Class 7 is based on a frequency-weighted average person-rem dose representative of the EPRI accident sub-class 7a, 7b ad 7c. The Browns Ferry analysis grouped 7b and 7c together as they both represent late releases. The Class 7 accidents are associated with APBs 3, 4 and 5. The Class 7 population doses are calculated in the Table 9. Class 7 accidents are not dependent on the CILRT interval; therefore, an adjustment factor of 0.492 from Equation 10 is used.

The Browns Ferry population dose for EPRI Class 8 is assigned the highest of the dose rates associated with the Peach Bottom APBs, APB 3. Table 8 provides a summary of the Browns Ferry population doses for the collapsed accident progression bins.

Table 8 is developed in accordance with the EPRI guidance (ref. Table 5-18).[1]

29

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 8 Browns Ferry 50-Mile Radius Population Dose NUREG/CR-4551 Collapsed Fractional Population Population Dose Risk Browns Ferry Accident Collapsed Accident Collapsed APB APB Dose (50- Population 1 2 (Peach Bottom) at 50- 6 50-Mile Dose Progression Progression Bin (APB) Frequency/yr) Contributions miles) Per- Dose Factor 3 Miles (Person-Rem/yr - 5 (Person-REM)

Bin # to Risk 4 Rem)

Mean)

CD, VB, Early CF, WW 1 9.55E-08 0.021 0.166 1.74E+06 0.488 8.47E+05 Failure, RPV>200 psia at VB CD, VB, Early CF, WW 2 4.77E-08 0.007 0.052 1.09E+06 0.488 5.33E+05 Failure, RPV<200 psia at VB CD, VB, Early CF, DW 3 1.48E-06 0.556 4.390 2.97E+06 0.488 1.45E+06 Failure, RPV>200 psia at VB CD, VB, Early CF, DW 4 7.94E-07 0. 226 1.785 2.25E+06 0.488 1.10E+06 Failure, RPV<200 psia at VB CD, VB, Late CF, WW 5 1.30E-08 0.002 0.017 1.34E+06 0.488 6.53E+05 Failure 6 CD, VB, Late CF, DW Failure 2.04E-07 0.059 0.466 2.28E+06 0.488 1.11E+06 7 CD, VB, Vent 4.77E-07 0.118 0.932 1.95E+06 0.488 3.81E+06 CD, VB, No CF (Normal 8 7.99E-07 0.001 0.004 4.94E+03 1.950 9.64E+03 Releases) 9 CD, No VB (No Releases) 3.85E-07 0.010 0.079 2.05E+05 1.950 4.00E+05 10 No CD 4.34E-08 0.000 0.000 0 1.950 0.00E+00 3

Total From All APBs: 4.23E-06 1.000 7.9

1. This table is presented in the form of a calculation because NUREG/CR-4551 does not document dose results as a function of accident progression bin. As such, the dose results as a function of APB must be calculated from documented APB frequencies and APB dose results.

2. The total CDF of 4.34E-06 per year and the CDF subtotals by APB are taken from Figure 2.5-6 of NUREG/CR-4551, Volume 4, Revision 1, Part I.

3. The individual APB contributions to the total 50-mile radius dose rate are taken from Table 5.2-3 of NUREG/CR-4551, Volume 4, Revision 1, Part I.

4. The APB 50-mile dose rate is calculated by multiplying the individual APB dose rate fractional contributions (column 5) by the total 50-mile radius dose rate of 7.9 person-rem per year (taken from Table 5.1-1 of NUREG/CR-4551, Volume 4, Revision 1, Part I).

5. The individual doses are calculated by dividing the individual APB dose rate (column 5) by the APB frequencies (column 3).

6. Equation 9 (Intact = 1.95) Equation 10 (Not-Intact (0.488) 30

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 9 Browns Ferry EPRI Accident Class 7 Population Doses BFN BFN Peach Population Population EPRI Peach Browns Ferry Bottom Dose (50- Dose Rate Accident (1)

Bottom APB Frequency Population miles) (50-miles)

Class (2)

Dose Person-Rem Person-(3) (4) rem/yr U1: 6.88E-07 9.95E-01 7a 3 U2: 6.30E-07 2.97E+06 1.45E+06 9.11E-01 U3: 7.14E-07 1.03E+00 U1: 2.98E-06 5.22E+00 7b 4, 5 U2: 2.41E-06 3.59E+06 1.75E+06 4.22E+00 U3: 4.09E-06 7.16E+00 (5)

U1: 3.67E-06 1.69E+06 6.22E+00 TOTAL: U2: 3.04E-06 1.69E+06 5.13E+00 U3: 4.80E-06 1.71E+06 8.20E+00

1) From BFN-0-16-40

2) Taken from Table 8

3) COL 4

• Adjustment Factor (0.488)

4) COL 3

• COL 5

5) BFN Class 7 Population Dose Rate (COL 6) ÷ BFN Total Frequency (COL 3) 8.3 Step 3 - Risk Impact Evaluation In this step, the risk associated with the change in CILRT testing intervals is evaluated in terms of change to the accident class frequencies and population doses for classes 1, 3a and 3b. This is accomplished in a three step process.

The current surveillance testing requirement of Type A testing and allowed by 10CFR50, Appendix J is at least once-in-ten years based on an acceptable performance history and represents the current licensing basis for Browns Ferry. Extending the Type A CILRT interval from three-in-ten years (original licensing basis) to once-in-ten years increased the window of vulnerability for undetected leakage from 18 to 60 months (1/2 the surveillance interval), a factor of 60/18 or a factor of 3.33 increase. Therefore, considering the proposed licensing basis of extending the CILRT Type A test interval from three-in-ten years to once-in-fifteen years increases the average time the leaks can be undetected from 18 to 90 months (1/2 the surveillance interval), a factor of 90/18 or a factor of five increase.[1 §5.2.3]

Therefore, based on the approved EPRI methodology and the NEI guidance, the increased probability of not detecting excessive leakage due to Type A tests directly impacts the frequency of the Class 3 sequences only. The risk contribution is determined by multiplying the Class 3 accident frequency by a factor of 3.33. Additionally, the Class 1 frequency is adjusted downward to maintain the overall core damage frequency constant. The approach for developing the risk 31

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 contribution for a 15-yr interval is the same as that used for the 10-yr interval. The increase for a 15-yr CILRT interval is the ratio of the average time for a failure to be detected for the increased CILRT test interval (from 18-months to 90-months); therefore, the baseline data for 3a and 3b are multiplied by a factor of 5, and the Class 1 frequency is reduced accordingly to maintain the overall core damage frequency constant.

Table 10 BFN Accident Class Frequency and Dose as a Functions of ILRT Frequency CILRT FREQUENCY EPRI Population Dose 3 Per 10 Years 1 Per 10 Years 1 Per 15 Years Accident Unit Class (Per-REM) Per- Per- Per-Freq/yr Freq/yr Freq/yr REM/yr REM/yr REM/yr 1 9.64E+03 2.87E-06 2.77E-02 2.73E-06 2.63E-02 2.66E-06 2.57E-02 1 2 9.64E+03 2.85E-06 2.75E-02 2.71E-06 2.62E-02 2.65E-06 2.55E-02 3 9.64E+03 2.50E-06 2.41E-02 2.38E-06 2.29E-02 2.31E-06 2.23E-02 1 1.45E+06 3.17E-08 4.58E-02 3.17E-08 4.58E-02 3.17E-08 4.58E-02 2 2 1.45E+06 2.99E-08 4.32E-02 2.99E-08 4.32E-02 2.99E-08 4.32E-02 3 1.45E+06 3.23E-08 4.67E-02 3.23E-08 4.67E-02 3.23E-08 4.67E-02 1 9.64E+04 3.32E-08 3.21E-03 1.11E-07 1.07E-02 1.66E-07 1.60E-02 3a 2 9.64E+04 3.24E-08 3.13E-03 1.08E-07 1.04E-02 1.62E-07 1.56E-02 3 9.64E+04 3.01E-08 2.90E-03 1.00E-07 9.65E-03 1.50E-07 1.45E-02 1 9.64E+05 8.27E-09 7.98E-03 2.76E-08 2.66E-02 4.14E-08 3.99E-02 3b 2 9.64E+05 8.07E-09 7.78E-03 2.69E-08 2.59E-02 4.04E-08 3.89E-02 3 9.64E+05 7.48E-09 7.21E-03 2.49E-08 2.40E-02 3.74E-08 3.61E-02 1 1.69E+06 3.67E-06 6.21E+00 3.67E-06 6.21E+00 3.67E-06 6.21E+00 7 2 1.69E+06 3.04E-06 5.13E+00 3.04E-06 5.13E+00 3.04E-06 5.13E+00 3 1.71E+06 4.80E-06 8.19E+00 4.80E-06 8.20E+00 4.80E-06 8.19E+00 1 1.45E+06 3.11E-07 4.50E-01 3.11E-07 4.50E-01 3.11E-07 4.50E-01 8 2 1.45E+06 3.31E-07 4.79E-01 3.31E-07 4.79E-01 3.31E-07 4.79E-01 3 1.45E+06 3.35E-07 4.84E-01 3.35E-07 4.84E-01 3.35E-07 4.84E-01 1 5.66E+06 6.92E-06 6.75E+00 6.92E-06 6.77E+00 6.92E-06 6.79E+00 Totals: 2 5.65E+06 6.29E-06 5.69E+00 6.29E-06 5.72E+00 6.29E-06 5.73E+00 3 5.67E+06 7.71E-06 8.76E+00 7.71E-06 8.78E+00 7.71E-06 8.80E+00 32

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 8.3.1 Dose-Rate Increase and Percentile Increase Given the above estimates, the increase in population dose-rate (PDR) for each extended interval for EPRI Classes 1, 3a and 3b are estimated as presented in section 7.3.3.1 (Unit 1),

7.3.3.2 (Unit 2) and 7.3.3.3 (Unit 3). Note: The population dose-rate for Class 1 decreases as Class 3b increases to preserve total CDF.

Section 7.3.3.1 presents the Unit-1 population dose-rate data and calculations.

Section 7.3.3.2 presents the Unit-2 population dose-rate data and calculations.

Section 7.3.3.2 presents the Unit-3 population dose-rate data and calculations.

8.3.2 Unit-1 Population Dose-Rate Calculations This section provides the Unit-1 population dose-rate data due to extending the CILRT interval including the OLB comparison with the CLB and PLB intervals, and the CLB and PLB interval.

Table 11 provides the Unit-1 Class 1 population dose-rate increase due to extending the CILRT interval Table 12 provides the Unit-1 Class 3a population dose-rate increase due to extending the CILRT interval Table 13 provides the Unit-1 Class 3b population dose-rate increase due to extending the CILRT interval Table 14 provides the Total Unit-1 PDR Increase (Class 1, 3a, 3b) due to Extended CILRT Intervals Table 11 Unit-1 Class 1 PDR Decrease Due to Extended CILRT Intervals 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 1 PDR 2.766E-02 2.632E-02 2.565E-02 Class 1 PDR (3-yr vrs. 10 & -1.332E-03 -2.002E-03 15)

Class 1 PDR (10-yr vrs. 15-yr) -6.685E-04 Table 12 Unit-1 Class 3a PDR Increase Due to Extended CILRT Intervals 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3b PDR 3.205-03 1.067E-02 1.603E-02 Class 3b PDR (3-yr vrs. 10 & 15) 7.469E-02 1.282E-02 Class 3b PDR (10-yr vrs. 15-yr) 5.353E-03 33

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 13 Unit-1 Class 3b PDR Increase Due to Extended CILRT Intervals 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3b PDR 7.977E-03 2.656E-02 3.988E-02 Class 3b PDR (3-yr vrs. 10 & 1.859E-02 3.191E-02 15)

Class 3b PDR (10-yr vrs. 15- 1.332E-02 yr)

Table 14 Unit-1 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Total PDR 3.884E-02 6.356E-02 8.156E-02 Class 1 + Class 3a + Class 3b Total PDR (3-yr Baseline) 2.472E-02 4.273E-02 Class 1 + Class 3a + Class 3b Total PDR (10-yr Baseline) 1.801E-02 Class 1 + Class 3a + Class 3b Given the above values, the percentile increases in total population dose-rate (PDR) from Table 14 for the each test interval are estimated by dividing the increase in total PDR by the adjusted baseline total (6.75 person-rem/yr).

Equation 11 Unit 1 Percent Increase in Total Population Dose Rate (PDR)

Percent Increase in Total PDR [1-In-3 1-In-10] = (2.47E-02 / 6.75)*100%

= 0.366%

Percentile Increase in Total PDR [1-In-3 1-In-15] = (4.27E-02 / 6.75)*100%

= 0.633%

Percentile Increase in Total PDR [1-In-10 1-In-15] = (1.80E-02 / 6.75)*100%

= 0.267%

34

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 8.3.3 Unit-2 Population Dose-Rate Calculations This section provides the Unit-2 population dose-rate (PDR) data due to extending the CILRT interval including the OLB comparison with the CLB and PLB intervals, and the CLB and PLB interval.

Table 15 provides the Unit-2 Class 1 population dose-rate increase due to extending the CILRT interval Table 16 provides the Unit-2 Class 3a population dose-rate increase due to extending the CILRT interval Table 17 provides the Unit-2 Class 3b population dose-rate increase due to extending the CILRT interval Table 18 provides the Total Unit-2 PDR Increase (Class 1, 3a, 3b) Due to Extended CILRT Intervals Table 15 Unit-2 Class 1 PDR Decrease Due to Extended CILRT Intervals 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 1 PDR 2.747E-02 2.617E-02 2.552E-02 Class 1 PDR (3-yr vrs. 10 & 15) -1.300E-03 -1.953E-03 Class 1 PDR (10-yr vrs. 15-yr) -6.522E-04 Table 16 Unit-2 Class 3a PDR Increase Due by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3a PDR 3.127E-03 1.041E-02 1.564E-02 Class 3a PDR (3-yr vrs. 10 & 15) 7.286E-03 1.251E-02 Class 3a PDR (10-yr vrs. 15-yr) 5.222E-03 Table 17 Unit-2 Class 3b PDR Increase Due by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3b PDR 7.782E-03 2.591E-02 3.891E-02 Class 3b PDR (3-yr vrs. 10 & 15) 1.813E-02 3.113E-02 Class 3b PDR (10-yr vrs. 15-yr) 1.300E-02 Table 18 Unit-2 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted) (person-rem) (person-rem) 35

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 (person-rem)

Total PDR 3.838E-02 6.250E-02 8.006E-02 Class 1 + Class 3a + Class 3b Total PDR (3-yr Baseline)

Class 1 + Class 3a + Class 2.412E-02 4.168E-02 3b Total PDR (10-yr Baseline)

Class 1 + Class 3a + Class 1.757E-02 3b Given the above values, the percentile increases in total population dose-rate (PDR) from Table 18 for the each test interval are estimated by dividing the increase in total PDR by the adjusted baseline total (5.69 person-rem/yr).

Equation 12 Unit 2 Percent Increase in Total Population Dose Rate (PDR)

Percentile Increase in Total PDR [1-In-3 1-In-10] = (2.41E-02 / 5.69)*100%

= 0.424%

Percentile Increase in Total PDR [1-In-3 1-In-15] = (4.17E-02 / 5.69)*100%

= 0.732%

Percentile Increase in Total PDR [1-In-10 1-In-15] = (1.76E-02 / 5.69)*100%

= 0.309%

8.3.4 Unit-3 Population Dose-Rate Calculations This section provides the Unit-3 population dose-rate (PDR) data due to extending the CILRT interval including the OLB comparison with the CLB and PLB intervals, and the CLB and PLB interval.

Table 19 provides the Unit-3 Class 1 population dose-rate increase due to extending the CILRT interval Table 20 provides the Unit-3 Class 3a population dose-rate increase due to extending the CILRT interval Table 21 provides the Unit-3 Class 3b population dose-rate increase due to extending the CILRT interval Table 22 provides the Total Unit-3 PDR Increase (Class 1, 3a, 3b) Due to Extended CILRT Intervals Table 19 Unit-3 Class 1 PDR Decrease by CILRT Interval 36

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 1 PDR 2.413E-02 2.292E-02 2.232E-02 Class 1 PDR (3-yr vrs. 10 & 15) -1.206E-03 -1.810E-03 Class 1 PDR (10-yr vrs. 15-yr) -6.047E-04 Table 20 Unit-3 Class 3a PDR Increase by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3a PDR 2.899E-03 9.654E-03 1.450E-02 Class 3a PDR (3-yr vrs. 10 & 15) 6.755E-03 1.160E-02 Class 3a PDR (10-yr vrs. 15-yr) 4.842E-03 Table 21 Unit-3 Class 3b PDR Increase by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Class 3b PDR 7.215E-03 2.403E-02 3.607E-02 Class 3b PDR (3-yr vrs. 10 & 15) 1.681E-02 2.886E-02 Class 3b PDR (10-yr vrs. 15-yr) 1.205E-02 Table 22 Unit-3 Total PDR Increase (Class 1, 3a, 3b) by CILRT Interval 3-Yrs 10-Yrs (Current) 15-Yrs (Proposed)

CILRT Interval (Baseline -Adjusted)

(person-rem) (person-rem)

(person-rem)

Total PDR 3.424E-02 5.660E-02 7.289E-02 Class 1 + Class 3a + Class 3b Total PDR (3-yr Baseline)

Class 1 + Class 3a + Class 2.236E-02 3.865E-02 3b Total PDR (10-yr Baseline)

Class 1 + Class 3a + Class 1.629E-02 3b 37

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Given the above values, the percentile increases in total population dose-rate (PDR) from Table 22 for the each test interval are estimated by dividing the increase in total PDR by the adjusted baseline total (8.76 person-rem/yr).

Equation 13 Unit 3 Percent Increase in Total Population Dose Rate (PDR)

Percentile Increase in Total PDR [1-In-3 1-In-10] = (2.24E-02 / 8.76)*100%

= 0.255%

Percentile Increase in Total PDR [1-In-3 1-In-15] = (3.87E-02 / 8.76)*100%

= 0.441%

Percentile Increase in Total PDR [1-In-10 1-In-15] = (1.63E-02 / 8.76)*100%

= 0.186%

8.4 Step 4 - Change in LERF In accordance with the methodology presented above, the LERF increase due to an CILRT interval extension is estimated as the difference in the Class 3b frequency values of the original licensing basis of once-in-three years, the current licensing basis of once-in-ten years, and the proposed licensing basis of once-in-fifteen years.

The risk impact associated with extending the CILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from containment could in fact result in a larger release due to failure to detect a pre-existing leak during the extended window of vulnerability of an additional five years.

Collapsed accident progression bin 8 from NUREG/CR-4551[5] represents those sequences whereby the containment remains intact. The NRUEG postulated a dose at a 50 mile radius to be 9.73E+03 person-rem, reference Table 8. In accordance with the EPRI guidance, the Class 3a (Small Liner Leak) dose is assumed to be 10 times the allowable intact containment leakage, 10 La (or 9.73E+04 person-rem) and the Class 3b is assumed to be 100 La (or 9.73E+05 person-rem). The method for defining the dose equivalent for allowable leakage (La) is developed in the EPRI report.[1 §4.3] This compares to a historical observed average of twice La.

Therefore, the estimate is conservative.

Based on the EPRI guidance, only accident Class 3b has the potential to result in large release if a pre-existing leak were present. Class 1 sequences are not considered as potential large release pathways because the containment remains intact. Therefore, the containment leak-rate is expected to be small (i.e., less than 2 La). A larger leak-rate would imply an impaired containment, e.g., Classes 2, 3, 6 and 7. Late releases are excluded regardless of the size of the leak because late releases are by definition, not a LERF event.

Therefore, the change in the frequency of Class 3b sequences is used as the increase in LERF for Browns Ferry and the change in LERF can be determined by the differences of the three test intervals. The EPRI guidance[1§4.3] states that Class 3b sequences are considered the contributor to LERF associated with the Type A CILRT.

Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. The EPRI guidance cites RG 1.174 and defines very small 38

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 changes in risk as resulting in increases below 1.0E-06/yr and 1.0E-07/yr, for CDF and LERF, respectively.[7 §2.4] Since the CILRT does not impact CDF, only LERF is relevant.

Calculating the increase in LERF requires determining the impact on the CILRT interval on the leakage probability. The calculations to determine the change in LERF based on a change in test frequency follow in the subsections below.

8.4.1 LERF Determination Unit-1 Equation 14 Unit-1 LERF Determination for Class 3b LERF [1-In-3 1-In-10] = Class 3b Frequency [1-In-10] - Class 3b Frequency [1-In-3]

= 2.76E-08/yr - 8.27E-09/yr

= 1.93E-08/yr LERF [1-In-3 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-3]

= 4.14E-08/yr - 8.27E-09/yr

= 3.31E-08/yr LERF [1-In-10 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-10]

= 4.14E-08/yr - 2.76E-08/yr

= 1.38E-08/yr Unit-2 Equation 15 Unit-2 LERF Determination for Class 3b LERF [1-In-3 1-In-10] = Class 3b Frequency [1-In-10] - Class 3b Frequency [1-In-3]

= 2.69E-08/yr - 8.07E-09/yr

= 1.88E-08/yr LERF [1-In-3 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-3]

= 4.04E-08/yr - 8.07E-09/yr

= 3.23E-08/yr LERF [1-In-10 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-10]

= 4.04E-08/yr - 2.69E-08/yr

= 1.35E-08/yr Unit-3 Equation 16 Unit-3 LERF Determination for Class 3b LERF [1-In-3 1-In-10] = Class 3b Frequency [1-In-10] - Class 3b Frequency [1-In-3]

= 2.49E-08/yr - 7.48E-09/yr 39

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

= 1.74E-08/yr LERF [1-In-3 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-3]

= 3.74E-08/yr - 7.48E-09/yr

= 2.99E-08/yr LERF [1-In-10 1-In-15] = Class 3b Frequency [1-In-15] - Class 3b Frequency [1-In-10]

= 3.74E-08/yr - 2.49E-08/yr

= 1.25E-08/yr 8.5 Step 5 - Conditional Containment Failure Probability In accordance with the methodology presented is Step 5 above, the change in the Conditional Containment Failure Probability (CCFP) due to an CILRT interval extension is estimated as the difference in the CCFP values for the original and extended intervals. The change in CCFP is indicative of the effect of the ILRT on all radionuclide releases, not just LERF. In this assessment, the CCFP is defined such that containment failure includes all radionuclide release end states other than the intact state, and in accordance with the EPRI guidance, Class 3a. The conditional part of the definition is conditional given a severe accident (i.e., core damage).[1 App H

§5.5]

The change in CCFP can be calculated by using the method specified in the EPRI methodology.

The NRC Safety Evaluation has noted a change in CCFP of <1.5% as the acceptance criterion to be used as the basis for showing that the proposed change is consistent with the defense-in-depth philosophy.

To determine the conditional containment failure probability, the following equation is used:

CCFP = [1 - (Class 1 Frequency + Class 3a Frequency) / CDF] *100 Unit-1 Equation 17 Unit-1 Conditional Containment Failure Probability CCFP [1-In-3] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.87E-06/yr + 3.33E-08/yr) / 6.93E-06/yr] *100%

= 58.128%

CCFP [1-In-10] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.73E-06/yr + 1.11E-07/yr) / 6.93E-06/yr] *100%

= 59.005%

CCFP [1-In-15] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.66E-06/yr + 1.66E-07/yr) / 6.93E-06/yr] *100%

= 59.205%

Equation 18 Unit-1 Change in Conditional Containment Failure Probability CCFP Increase [3-In-10 1-In-15] = CCFP [1-In-15] - CCFP [1-In-3]

40

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

= 59.205% - 58.128%

= 1.077%

CCFP Increase [1-In-10 1-In-15] = CCFP [1-In-15] - CCFP [1-In-10]

= 59.205% - 59.005%

= 0.199%

Unit-2 Equation 19 Unit-2 Conditional Containment Failure Probability CCFP [1-In-3] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.85E-06/yr + 3.24E-08/yr) / 6.29E-05/yr] *100%

= 54.182%

CCFP [1-In-10] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.72E-06/yr + 1.08E-07/yr) / 6.29E-05/yr] *100%

= 55.125%

CCFP [1-In-15] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.65E-06/yr + 1.62E-07/yr) / 6.29E-05/yr] *100%

= 55.340%

Unit-2 Equation 20 Unit-2 Change in Conditional Containment Failure Probability CCFP Increase [3-In-10 1-In-15] = CCFP [1-In-15] - CCFP [3-In-10]

= 55.340% - 54.182%

= 1.157%

CCFP Increase [1-In-10 1-In-15] = CCFP [1-In-15] - CCFP [1-In-10]

= 55.340% - 55.125%

= 0.214%

Unit-3 Equation 21 Unit-3 Conditional Containment Failure Probability CCFP [1-In-3] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.50E-06/yr + 3.01E-08/yr) / 7.72E-06/yr] *100%

= 67.195%

CCFP [1-In-10] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.38E-06/yr + 1.00E-07/yr) / 7.72E-06/yr] *100%

= 67.908%

CCFP [1-In-15] = [1 - (Class 1 Freq + Class 3a Freq) / Total CDF] *100%

= [1 - (2.32E-06/yr + 1.50E-07/yr) / 7.72E-06/yr] *100%

41

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

= 68.07%

Unit-3 Equation 22 Unit-3 Change in Conditional Containment Failure Probability CCFP Increase [3-In-10 1-In-15] = CCFP [1-In-15] - CCFP [3-In-10]

= 68.070% - 67.195%

= 0.874%

CCFP Increase [1-In-10 1-In-15] = CCFP [1-In-15] - CCFP [1-In-10]

= 68.070% - 67.908%

= 0.162%

9.0 Sensitivity Analyses The EPRI guidance for extending the CILRT interval suggests using the liner corrosion sensitivity analysis performed by Calvert Cliffs.[10] Additionally, the contribution of external events will be addressed in this section.

This section consists of the following subsections and tables:

Section 9.1 Differences in the BFN Design from Calvert Cliffs Section 9.1.1 Structural Design Section 9.2 Liner Corrosion Section 9.2.1 Assumptions Used in the Corrosion Sensitivity Analysis Section 9.3 Base Case Risk Assessment Table 23 BFN Liner Corrosion Base-Case Assessment Section 9.4 Likelihood of Non-Detected Containment Leakage & LERF Impact Table 24 Unit 1 Increase in LERF/yr Table 25 Unit 2 Increase in LERF/yr Table 26 Unit 3 Increase in LERF/yr Section 9.5 Liner Corrosion Effect on CCFP Section 9.6 Summary on Base Case and Corrosion Sensitivity cases Table 27 Unit 1 Summary of Base-Case and corrosion Sensitivity Case Table 28 Unit 2 Summary of Base-Case and corrosion Sensitivity Case Table 29 Unit 3 Summary of Base-Case and corrosion Sensitivity Case 9.1 Differences in the BFN Design From Calvert Cliffs 9.1.1 Structural Design The BFN design employs a pressure suppression primary containment. The pressure suppression system consists of a drywell, and a pressure suppression chamber which stores a large volume of water. In the event of a process system piping failure within the drywell, reactor 42

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 water and steam would be released into the drywell airspace. The resulting increased drywell pressure would then force a mixture of air, drywell atmosphere, steam and water though vents into the pool of water in the pressure suppression chamber. The steam would condense in the pressure suppression pool, resulting in a rapid pressure reduction in the drywell. Air that was transferred to the pressure suppression chamber pressurizes the pressure suppression chamber, and is subsequently vented back to the drywell to equalize the pressure between the two vessels. Cooling systems are provided to remove heat from the reactor core, the drywell, and from the water in the pressure suppression chamber, and thus provide continuous cooling of the primary containment under accident conditions. Appropriate isolation valves are actuated during this period to ensure containment of radioactive material, which might otherwise be released from the reactor containment during the course of the accident. [29, §1.6.2.6]

Cooling systems are provided to remove heat from the drywell and from the water in the pressure suppression chamber, thus cooling the primary containment, when required, under accident conditions. Appropriate isolation valves are actuated during this period to ensure containment of radioactive materials within the primary containment which might be released from the reactor during the course of the accident. If long-term cooling capability is lost, resulting in a pressure increase that would jeopardize the structural integrity of the primary containment, the hardened containment venting system (HCVS) (Unit 1 ) or hardened wetwell vent (HWWV)

(Units 2 and 3) would relieve the corresponding pressure increase.[29 §5.2.3.1]

The drywell is a steel pressure vessel with a spherical lower portion 67 feet in diameter, and a cylindrical upper portion 38 feet 6 inches in diameter. The overall height is approximately 115 feet. The design, fabrication, inspection and testing of the drywell vessel comply with requirements of the ASME Boiler and Pressure Vessel Code, 1965 edition,Section III, Class B, which pertain to containment vessels for nuclear power plants. The steel head and shell of the drywell are fabricated of SA-516 plate. The drywell is enclosed in reinforced concrete for shielding purposes to provide additional resistance to deformation and buckling of the drywell over areas where the concrete blocks up the steel shell. Above the transition zone, the drywell is separated from the reinforced concrete by a gap of approximately two inches filled with polyurethane foam. Irradiation tests have shown that no change in the resilient characteristics will take place for exposures up to 1x108 R.[29 §5.2.3.2]

The secondary containment substructure consists of poured-in-place, reinforced concrete exterior walls that extend up to the refueling floor. The refueling room floor is also constructed of reinforced, poured-in-place concrete. The superstructure of the secondary containment above the refueling floor is a structural steel frame which supports metal roof decking, foamwall-stepped fascia panels, and insulated metal siding panels. The secondary containment structure completely encloses the primary containment drywells, fuel storage and handling facilities, and essentially all of the Core Standby Cooling Systems for the three units.

Containment Design - General Information

• Maximum Pressure, 62.0 psig @ 281°F[29 §5.2.3.2]

• Design Pressure, 56.0 psig[29 §5.2.3.2]

• Design & Maximum Allowable Leakage Rate, 2.0%/day[29 §5.2.4.5]

9.2 Liner Corrosion The analysis approach uses the Calvert Cliffs Nuclear Plant (CCNP) methodology[10] as modified by the EPRI guidance.[1] The methodology investigates how an age-related 43

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 degradation mechanism can be factored into the risk impact associated with longer CILRT testing intervals.

This analysis evaluates the sensitivity of risk impact results to assumptions in containment liner corrosion. The metric used in the sensitivity analysis is the conditional containment failure probability (CCFP) which is defined as the probability of containment failure given the occurrence of a core damaging accident.

Consistent with the Calvert Cliffs analysis the following considerations are used to determine the change in likelihood of containment liner corrosion due to extending the CILRT interval. This likelihood is used to determine the potential change in risk in the form of a sensitivity analysis.

• Differences between the containment basemat and the containment cylinder and dome,

• The historical steel liner flaw likelihood due to corrosion,

• The impact of aging,

• The corrosion leakage dependency on containment pressure,

• The likelihood that visual inspections will be effective at detecting a flaw.

9.2.1 Assumptions Used In the Corrosion Sensitivity Analysis The assumptions used in this sensitivity study are consistent with the Calvert Cliffs methodology and include the following:

1. Based on a review of industry events, an Oyster Creek incident is assumed to be applicable to BFN for a concealed shell failure in the drywell floor. In the Calvert Cliffs analysis, this event was assumed not to be applicable, thus, a half-failure was assumed for basemat concealed liner corrosion due to the lack of identified failures. BFN will use one failure in the analysis. (Table 23 Step 1)

2. Two corrosion events are used to estimate the liner flaw probability. These events, one at North Anna Unit 2 and the other at Brunswick Unit 2, were initiated from the non-visible (backside) of the containment liner.

3. The success data was limited to 5.5 years to reflect the years since September 1996 when 10CFR50.55a started requiring visual inspection and the Calvert Cliffs analysis. 6 (Table 23 Step 1)

4. The likelihood of the containment atmosphere reaching the outside atmosphere given a liner flaw exists was estimated at 1.0% for the cylinder/dome and 0.1% (1/10 of the cylinder failure probability) for the basemat. These values are conservative as the BFN containment analysis[30] shows and approximate 1.0% leakage probability at 94.7 psia; whereas the maximum pressure is 62.0 psia at 281°F.[29]

5. The likelihood of leakage escape (due to crack formation) in the basemat region is assumed to be ten times less likely than the containment cylinder and dome region.

(Table 23, Step 4)

6. A 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is assumed in the analysis. 7 (Table 23, Step 5) 6 Additional success data was not used to limit the aging impact of the corrosion issue, although inspections were being performed prior to the requirement. Furthermore, there was no evidence that other liner corrosion issues were identified.

44

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

7. All non-detectable failures are assumed to result in large early releases. This approach is conservative and avoids detailed analysis of containment failure timing and operator recovery actions. That is, the probability of all non-detectable failures from the corrosion sensitivity analysis are added to the EPRI Class 3b (and subtracted from EPRI Class 1).

8. The liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is consistent with the Calvert Cliffs approach. This is done to address the increased likelihood of corrosion as the liner ages. (Table 23 Steps 2 and 3) 9.3 Base Case Risk Assessment Table 23 summarizes the results obtained from the CCNP methodology using plant-specific data for Browns Ferry. The data is typical for all three units.

Table 23 BFN Liner Corrosion Base-Case Risk Assessment Containment Cylinder Containment Step Description and Dome (85%) Basemat (15%)

8 Historical Liner Flaw Likelihood Failure Data: Containment Location Specific Events: 2 Events: 0 1 Success Data: Based on 70 steel-lined 9 (Brunswick & North Anna) Assume 1 Failure containments and 5.5 years since the 10CFR50.55a requirements of periodic visual 2 / (70

• 5.5) = 5.19E-03 1.0 / (70

• 5.5) = 2.60E-03 inspection of cont. surfaces Year Failure Rate Year Failure Rate Aged Adjusted Liner Flaw Likelihood 1 2.1E-03 1 1.0E-03 During the fifteen-year interval, assume the 5-10 (ave) 5.2E-03 5-10 (ave) 2.6E-03 2 failure rate doubles every five years (14.9%

increase per year). The average for the fifth to 15 1.4E-02 15 7.0E-03 tenth year set to the historical failure rate.

15 Year Ave = 6.27E-03 15 Year Ave = 3.14E-03 Increase in Flaw Likelihood Between Range 11 Range 13

% Increase  % Increase Three and Fifteen Years 1 - 3 yrs 1 - 3 yrs 3 Uses aged adjusted liner flaw likelihood (Step 0.71 0.36 2), assuming failure rate doubles every five 1 - 10 yrs 1 - 10 yrs 4.06 2.03 years.

1 - 15 1 - 15 7

During the 5.5 year data period used in the Calvert Cliffs analysis all liner corrosion events were detected through visual inspection. Sensitivity studies are included that evaluate total detection failure likelihoods of 5% and 15%.

8 [10]

Containment location specific (consistent with the Calvert Cliffs analysis.

9 Based on a review of industry events, an Oyster Creek incident s assumed to be applicable for BFN for a concealed shell failure in the floor. In the Calvert Cliffs analysis, this event was assumed not to be applicable and a 0.5 failure was assumed (i.e., a typical PRA value when no failures have been identified). For BFN one failure (rather than 0.5) is assumed for the floor area.

45

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Containment Cylinder Containment Step Description and Dome (85%) Basemat (15%)

10 12 yrs 9.24 yrs 4.70 Likelihood of Breach in Containment Given Liner Flaw (At 300 F).

[30 Figure 6- BFN DATA BFN DATA 6]

PSIA  % Failure PSIA  % Failure The BFN CILRT pressure is 66.5 (CILRT) <1 66.5 (CILRT) <0.1 significantly below the pressure that 94.7 1 94.7 0.1 4 would remotely begin to challenge 156.7 10 156.7 1 containment. 204.7 50 204.7 5 314.7 100 314.7 10 14 Assumed Value 10.0% 1.0%

Visual Inspection Detection Failure Likelihood (Assumptions 15 16 5 10% 100%

consistent with the Calvert Cliffs analysis).

11 The Calvert Cliffs analysis presents the delta between 3 and 15 years of 8.7% to utilize in the estimation of the LERF value. For this analysis, the values are calculated based on the 3, 10 and 15 year intervals.

13 The Calvert Cliffs analysis presents the delta between 3 and 15 years of 2.2% to utilize in the estimation of the LERF value. For this analysis, twice that value is used since 1 failure is assumed (CCNP used 0.5) and the values are calculated based on 3, 10 and 15 year test intervals.

10 The Calvert Cliffs analysis presents the delta between 3 and 15 years of 8.7% to utilize in the estimation of the delta LERF value. For this analysis; however, the values are calculated based on 3,

[1, §5.2.5.1]

10 and 15 year intervals, consistent with the desired presentation of the results.

12 The Calvert Cliffs analysis presents the delta between 3 and 15 years of 2.2% to utilize in the estimation of the delta-LERF value. For this analysis; however, the values are calculated based on 3,

[1, §5.2.5.1]

10 and 15 year intervals, consistent with the desired presentation of the results.

14 The failure probability of the cylinder and dome is assumed to be 10%, and the basement 1.0% as compared to 1.1% and 0.11% in the Calvert Cliffs analysis). The basemat failure probability is assumed to be a factor of ten less, 1% (compared to the 0.11% in the Calvert cliffs analysis). The failure probability at the CILRT pressure was determined by mathematical interpolation.

15 5% failure to identify visual flaws plus 5% likelihood that the flaw is not visible (not through-cylinder but could be detected by CILRT). All events have been detected through visual inspection. 5%

visible failure detection is a conservative assumption.

16 The containment basemat liner cannot be visually inspected.

46

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 3-Year (Ave) Interval 3-Year (Ave) Interval (OLB) (OLB) 0.71% x 10.0% x 10% 0.36% x 1.0% x 100%

0.0071% 0.0036%

Likelihood of Non-Detected 10-Year Test Interval Containment Leakage 10-Year Test Interval (CLB) (CLB) 6 4.06% x 10.0% x 10% 2.03% x 1.0% x 100%

(Steps 3 x 4 x 5) 0.0203%

0.0410%

15-Year Test Interval 15-Year Test Interval (PLB) (PLB) 9.24% x 10.0% x 10% 4.70% x 1.0% x 100%

0.0924% 0.0470%

9.4 Likelihood of Non-Detected Containment Leakage and LERF Impact The total likelihood of non-detected containment leakage is the sum of Step 6 for the containment cylinder and dome and the containment basemat.

Equation 23 Total Likelihood of Non-Detected Containment Leakage Total Likelihood of Non-Detected Containment Leakage (OLB) = 0.0071% + 0.0036% = 0.0107% or 1.07E-04 (CLB) = 0.0410% + 0.0203% = 0.0613% or 6.13E-04 (PLB) = 0.0924% + 0.0470% = 0.1394% or 1.39E-03 The above factors are applied to those core damage accidents that are not already independently LERF (Class 2 and 8) or that could never result in LERF (Class 7b). The following example explains how this data is used in Table 24, Table 25 and Table 26 for Unit 1, 2 and 3, respectively.

• From Table 4, the Unit-1 EPRI Class 3b frequency is 8.27E-09/yr.

• As discussed in section 7.1, the BFN CDF associated with accidents that are not independently LERF or could never result in LERF is CDF - Class 2 - Class 7b - Class 8.

See Equation 24.

• The increase in the base case 3b frequency due to the corrosion-induced concealed flaw issue is calculated as CDFAlways/Never-LERF x NON-DET LEAKAGEOLB (i.e., non-detected leakage at a 3 years). Where 1.07E-04 was previously shown (Equation 23) to be the cumulative likelihood of non-detected containment leakage due to corrosion at three years.

47

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Equation 24 CDFA-N CDFA-N = CDFUx - Class 2 - Class 7b - Class 8 Unit 1 CDFA-N_U1 = 6.93E-06/yr - 3.17E-08/yr - 2.98E-06/yr - 3.11E-07/yr

= 3.60E-06/yr Unit 2 CDFA-N_U2 = 6.29E-06/yr - 2.99E-08/yr - 2.41E-06/yr - 3.31E-07/yr

= 3.52E-06/yr Unit 3 CDFA-N_U3 = 7.72E-06/yr - 3.23E-08/yr - 4.09E-06/yr - 3.35E-07/yr

= 3.25E-06/yr Equation 25 is used in Table 24 (Unit 1), Table 25 (Unit 2) and Table 26 (Unit-3) to determine the increase in LERF due to corrosion over extended test intervals.

Equation 25 Liner Corrosion Increase in LERF LERFINC = CDFA-N (Eq 24)

• PNon-Detected Leakage (Eq 25)

Example: LERFINC_U1 = 3.60E-06/yr

• 1.07E-04

= 3.85E-10/yr Table 24 Unit-1 Increase in LERF/yr CLASS Class Class Non-Det Increase in CASE CDF/YR 2/yr 8/yr CDFA-N Leakage LERF (TBL 10) 7b/yr (EQ 24)

(TBL 10) (TBL 9) (TBL 11) (EQ 23) (EQ 25)

OLB 6.92E-06 3.17E-08 2.98E-06 3.11E-07 1.07E-04 3.85E-10 CLB 6.92E-06 3.17E-08 2.98E-06 2.41E-07 3.60E-06 6.13E-04 2.16E-09 PLB 6.92E-06 3.17E-08 2.98E-06 3.11E-07 1.39E-03 5.02E-09 Table 25 Unit-2 Increase in LERF/yr CLASS Class Class Non-Det Increase in CASE CDF/YR 2/yr 8/yr CDFA-N Leakage LERF (TBL 10) 7b/yr (EQ 24)

(TBL 10) (TBL 9) (TBL 11) (EQ 23) (EQ 25)

OLB 6.29E-06 2.99E-08 2.41E-06 3.31E-07 1.07E-04 3.77E-10 3.52E-06 CLB 6.29E-06 2.99E-08 2.41E-06 3.31E-07 6.13E-04 2.16E-09 48

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 PLB 6.29E-06 2.99E-08 2.41E-06 3.31E-07 1.39E-03 4.91E-09 Table 26 Unit-3 Increase in LERF/yr CLASS Class Class Non-Det Increase in CASE CDF/YR 2/yr 8/yr CDFA-N Leakage LERF (TBL 10) 7b/yr (EQ 24)

(TBL 10) (TBL 9) (TBL 11) (EQ 23) (EQ 25)

OLB 7.71E-06 3.23E-08 4.09E-06 3.35E-07 1.07E-04 3.48E-10 CLB 7.71E-06 3.23E-08 4.09E-06 3.35E-07 3.25E-06 6.13E-04 1.99E-09 PLB 7.71E-06 3.23E-08 4.09E-06 3.35E-07 1.39E-03 4.54E-09 The values in the far right column of Table 24 (Unit 1), Table 25 (Unit 2) and Table 26 (Unit

3) represent the increase in the baseline Class 3b frequency due to the corrosion-induces concealed flaw issue.

9.5 Liner Corrosion Effect on CCFP Equation 18 (Unit-1), Equation 20 (Unit-2) and Equation 22 (Unit-3) present the effect the increased likelihood of corrosion has on the conditional containment failure probability (CCFP) for the three test intervals of interest. The CCFP calculated in Equation 17 (Unit-1), Equation 19 (Unit-2) and Equation 21 (Unit-3) are multiplied by the assumed value in increased flaw likelihood from Step 3 of Table 23.

This section uses the likelihood of the containment atmosphere reaching the outside atmosphere given a liner flaw exists which was estimated at 1.0% for the cylinder/dome and 0.1% (1/10 of the cylinder failure probability) for the basemat. These values are conservative as the BFN analysis has 1.0% leakage probability at 94.7 psia; whereas the design pressure is 56.0 psia. This methodology is consistent with the Calvert Cliffs methodology.[10]

Equation 26 Unit 1 Increase in CCFP Due to Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval) x 1.1% + CCFP(Test Interval)

OLB INCU1_CCFP = 58.128% x 1.1% + 58.128%

= 58.767%

CLB INCU1_CCFP = 59.005% x 1.1% + 59.005%

= 59.654%

PLB INCU1_CCFP = 59.205% x 1.1% + 59.205%

= 59.856%

Equation 27 Unit 2 Increase in CCFP Due to Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval) x 1.1% + CCFP(Test Interval) 49

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 OLB INCU2_CCFP = 54.182% x 1.1% + 54.182%

= 54.778%

CLB INCU2_CCFP = 55.125% x 1.1% + 55.125%

= 55.732%

PLB INCU2_CCFP = 55.340% x 1.1% + 55.340%

= 55.948%

Equation 28 Unit 3 Increase in CCFP Due to Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval) x 1.1% + CCFP(Test Interval)

OLB INCU3_CCFP = 67.195% x 1.1% + 67.195%

= 67.935%

CLB INCU3_CCFP = 67.908% x 1.1% + 67.908%

= 68.655%

PLB INCU3_CCFP = 68.070% x 1.1% + 68.070%

= 68.818%

Equation 29 (Unit 1), Equation 30(Unit 2) and Equation 31 (Unit 3) calculates the change in the conditional containment failure probability for the corrosion case compared to the without corrosion case for each test interval. The CCFP with corrosion for each test interval is from Equation 26 (Unit 1), Equation 27 (Unit 2) and Equation 28 (Unit 3). The CCFP for each test interval without corrosion are calculated in Equation 17 (Unit 1), Equation 19 (Unit 2) and Equation 21 (Unit 3).

Equation 29 Unit 1 CCFP Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval-With Corrosion) - CCFP(Test Interval-Without Corrosion) 50

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 OLB INCU1_CCFP = 58.767% - 58.128%

= 0.639%

CLB INCU1_CCFP = 59.654% - 59.005%

= 0.649%

PLB INCU1_CCFP = 59.856% - 59.205%

= 0.651%

Equation 30 Unit 2 CCFP Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval-With Corrosion) - CCFP(Test Interval-Without Corrosion)

OLB INCU2_CCFP = 54.778% - 54.182%

= 0.596%

CLB INCU2_CCFP = 55.732% - 55.125%

= 0.606%

PLB INCU2_CCFP = 55.948% - 55.340%

= 0.609%

Equation 31 Unit 3 CCFP Increase in Flaw Likelihood INCCCFP(Test Interval) = CCFP(Test Interval-With Corrosion) - CCFP(Test Interval-Without Corrosion)

OLB INCU2_CCFP = 67.935% - 67.195%

= 0.739%

CLB INCU2_CCFP = 68.655% - 67.908%

= 0.747%

PLB INCU2_CCFP = 68.818% - 68.070%

= 0.749%

9.6 Summary of Base Case and Corrosion Sensitivity Cases Table 27 (Unit 1), Table 28 (Unit 2) and Table 29 (Unit 3) provides a summary of the base case as well as the corrosion sensitivity case. The table is divided into three columns representing the frequency of the ILRT: Base Case (three per 10 years), one per 10 years, and one per 15 years.

Each of the three columns is sub-divided further into corrosion and non-corrosion cases. For both the corrosion and non-corrosion cases, the frequencies of the EPRI accident classes are provided.

In the non-corrosion cases, an additional column titled person-rem/yr is provided. The person-rem/yr column provides the change in person-rem per year between the corrosion 51

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 and non-corrosion cases. Negative values in the person-rem/yr column indicate a reduction in the person-rem per year for the selected accident class. This occurs only in EPRI accident class 1 and is a result of the reduction in the frequency of the accident class 1 and an increase in accident class 3b.

Rows for the totals, both frequency and dose rate, are provided in the table. Additional summary rows are also provided.

• The change in dose rate, expressed as person-rem/yr and percentage of the total base dose is provided in the row below the CDF row.

• The Conditional Containment Failure Probability (CCFP) is provided in the next row, followed by the change in CCPF in percentage points.

• Class 3b LERF is also provided and indicates the accident class 3b frequency as well as the change in the class 3b frequency in the subsequent row. This difference is calculated between the non-corrosion and corrosion cases.

• The next row titled LERF Class 3b & Non-Corrosion LERF provides the change in LERF as a function of ILRT frequency from the base case. The difference between the non-corrosion and corrosion cases is provided in parentheses.

The sensitivity analysis of this section presents an estimate of the likelihood and risk implications of corrosion-induced leakage of steel containment liners not being detected during the extended ILRT test intervals evaluated in this report. The analysis considers ILRT extension time, inspections, and concealed degradation in uninspectable areas. As can be seen from the tables, the change from the base case of three tests per 10 years to one test per 15 years in LERF with corrosion is very small3.77E-08/yr, 3.68E-08/yr and 3.41E-08/yr for Units 1, 2 and 3, respectively. Similarly, the change in delta-LERF between the corrosion and non-corrosion cases for one per 15 years is correspondingly very small at 5.02E-09/yr, 4.91E-09/yr and 4.54E-09/yr for Units, 1, 2 and 3, respectively. Therefore, the inclusion of corrosion does not result in an increase in LERF sufficient to invalidate the baseline analysis and the overall impact is negligible.

52

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 27 Unit 1 Summary of Base Case and Corrosion Sensitivity Case Person-REM Contribution by EPRI Accident Class With and Without Corrosion Original Licensee Basis Current Licensing Basis Proposed Licensing Basis Base Case (3 Tests per 10 Years) (1 Test per 10 Years) (1 Test per 15 Years)

EPRI Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class PER- PER- PER- PER- PER- PER- PER- PER- PER-Frequency Frequency Frequency Frequency Frequency Frequency REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr 1 2.87E-06 2.77E-02 2.87E-06 2.77E-02 -3.71E-06 2.73E-06 2.63E-02 2.73E-06 2.63E-02 -2.13E-05 2.66E-06 2.57E-02 2.66E-06 2.56E-02 -4.84E-05 2 3.17E-08 4.58E-02 3.17E-08 4.58E-02 0.00E+00 3.17E-08 4.58E-02 3.17E-08 4.58E-02 0.00E+00 3.17E-08 4.58E-02 3.17E-08 4.58E-02 0.00E+00 3a 3.32E-08 3.21E-03 3.32E-08 3.21E-03 0.00E+00 1.11E-07 1.07E-02 1.66E-07 1.60E-02 0.00E+00 1.66E-07 1.60E-02 1.66E-07 1.60E-02 0.00E+00 3b 8.27E-09 7.98E-03 8.66E-09 8.35E-03 3.71E-04 2.76E-08 2.66E-02 2.98E-08 2.87E-02 2.13E-03 4.14E-08 3.99E-02 4.64E-08 4.47E-02 4.84E-03 7 3.67E-06 6.22E+00 3.67E-06 6.22E+00 0.00E+00 3.67E-06 6.22E+00 3.67E-06 6.22E+00 0.00E+00 3.67E-06 6.22E+00 3.67E-06 6.22E+00 0.00E+00 8 3.11E-07 4.50E-01 3.11E-07 4.50E-01 0.00E+00 3.11E-07 4.50E-01 3.11E-07 4.50E-01 0.00E+00 3.11E-07 4.50E-01 3.11E-07 4.50E-01 0.00E+00 Total 6.92E-06 6.75E+00 6.92E-06 6.75E+00 3.67E-04 6.88E-06 6.77E+00 6.92E-06 6.78E+00 2.11E-03 6.92E-06 6.79E+00 6.92E-06 6.80E+00 4.79E-03 Dose PER-REM/Yr (310yr) %Increase (310yr) PER-REM/Yr (315yr) %Increase (315yr)

Dose Without With Without With Without With Without With Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion 2.47E-02 3.18E-02 0.36% 0.47% 4.27E-02 4.71E-02 0.63% 0.69%

Conditional Containment Failure Probability (CCFP)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion CCFP 58.128% 58.767% 59.005% 59.654% 59.205% 59.856%

CCFP 0.877% 0.887% 1.077% 1.089%

Large Early Release Frequency (LERF)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class 3b 8.27E-09 8.66E-09 2.76E-08 2.98E-08 4.14E-08 4.64E-08 LERF/yr LERF/yr 3.85E-10 2.21E-09 5.02E-09 Class 3b LERF/yr 1.93E-08 2.11E-08 3.31E-08 3.77E-08 From Base 53

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 28 Unit 2 Summary of Base Case and Corrosion Sensitivity Case Person-REM Contribution by EPRI Accident Class With and Without Corrosion Original Licensee Basis Current Licensing Basis Proposed Licensing Basis Base Case (3 Tests per 10 Years) (1 Test per 10 Years) (1 Test per 15 Years)

EPRI Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class PER- PER- PER- PER- PER- PER- PER-Frequency Frequency PER-REM/Yr Frequency Frequency Frequency PER-REM/Yr Frequency REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr 1 2.85E-06 2.75E-02 2.85E-06 2.75E-02 -3.63E-06 2.71E-06 2.62E-02 2.71E-06 2.62E-02 -2.08E-05 2.65E-06 2.55E-02 2.64E-06 2.55E-02 -4.73E-05 2 2.99E-08 4.32E-02 2.99E-08 4.32E-02 0.00E+00 2.99E-08 4.32E-02 2.99E-08 4.32E-02 0.00E+00 2.99E-08 4.32E-02 2.99E-08 4.32E-02 0.00E+00 3a 3.24E-08 3.13E-03 3.24E-08 3.13E-03 0.00E+00 1.08E-07 1.04E-02 1.08E-07 1.04E-02 0.00E+00 1.62E-07 1.56E-02 1.62E-07 1.56E-02 0.00E+00 3b 8.07E-09 7.78E-03 8.45E-09 8.14E-03 3.63E-04 2.69E-08 2.59E-02 2.90E-08 2.80E-02 2.08E-03 4.04E-08 3.89E-02 4.53E-08 4.36E-02 4.73E-03 7 3.04E-06 5.13E+00 3.04E-06 5.13E+00 0.00E+00 3.04E-06 5.13E+00 3.04E-06 5.13E+00 0.00E+00 3.04E-06 5.13E+00 3.04E-06 5.13E+00 0.00E+00 8 3.31E-07 4.79E-01 3.31E-07 4.79E-01 0.00E+00 3.31E-07 4.79E-01 3.31E-07 4.79E-01 0.00E+00 3.31E-07 4.79E-01 3.31E-07 4.79E-01 0.00E+00 Total 6.29E-06 5.69E+00 6.29E-06 5.69E+00 3.59E-04 6.29E-06 5.72E+00 6.29E-06 5.72E+00 2.06E-03 6.29E-06 5.73E+00 6.29E-06 5.74E+00 4.68E-03 Dose PER-REM/Yr (310yr) %Increase (310yr) PER-REM/Yr (315yr) %Increase (315yr)

Dose Without With Without With Without With Without With Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion 2.41E-02 2.82E-02 0.42% 0.49% 3.92E-02 4.60E-02 0.68% 0.80%

Conditional Containment Failure Probability (CCFP)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion CCFP 54.182% 54.778% 55.125% 55.732% 55.340% 55.948%

CCFP 0.943% 0.953% 1.157% 1.170%

Large Early Release Frequency (LERF)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class 3b 8.07E-09 8.45E-09 2.69E-08 2.90E-08 4.04E-08 4.53E-08 LERF/yr LERF/yr 3.77E-10 2.16E-09 4.91E-09 Class 3b LERF/yr 1.88E-08 2.06E-08 3.23E-08 3.68E-08 From Base 54

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 29 Unit 3 Summary of Base Case and Corrosion Sensitivity Case Person-REM Contribution by EPRI Accident Class With and Without Corrosion Original Licensee Basis Current Licensing Basis Proposed Licensing Basis Base Case (3 Tests per 10 Years) (1 Test per 10 Years) (1 Test per 15 Years)

EPRI Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class PER- PER- PER- PER- PER- PER- PER-Frequency Frequency PER-REM/Yr Frequency Frequency Frequency Frequency PER-REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr REM/Yr 1 2.50E-06 2.41E-02 2.50E-06 2.41E-02 -3.36E-06 2.38E-06 2.29E-02 2.38E-06 2.29E-02 -1.92E-05 2.31E-06 2.23E-02 2.31E-06 2.23E-02 4.37E-03 2 3.23E-08 4.67E-02 3.23E-08 4.67E-02 0.00E+00 3.23E-08 4.67E-02 3.23E-08 4.67E-02 0.00E+00 3.23E-08 4.67E-02 3.23E-08 4.67E-02 0.00E+00 3a 3.01E-08 2.90E-03 3.01E-08 2.90E-03 0.00E+00 1.00E-07 9.65E-03 1.00E-07 9.65E-03 0.00E+00 1.50E-07 1.45E-02 1.50E-07 1.45E-02 0.00E+00 3b 7.48E-09 7.21E-03 7.83E-09 7.55E-03 3.36E-04 2.49E-08 2.40E-02 2.69E-08 2.59E-02 1.92E-03 3.74E-08 3.61E-02 4.20E-08 4.04E-02 4.37E-03 7 4.80E-06 8.20E+00 4.80E-06 8.20E+00 0.00E+00 4.80E-06 8.20E+00 4.80E-06 8.20E+00 0.00E+00 4.80E-06 8.20E+00 4.80E-06 8.20E+00 0.00E+00 8 3.35E-07 4.84E-01 3.35E-07 4.84E-01 0.00E+00 3.35E-07 4.84E-01 3.35E-07 4.84E-01 0.00E+00 3.35E-07 4.84E-01 3.35E-07 4.84E-01 0.00E+00 Total 7.71E-06 8.76E+00 7.71E-06 8.76E+00 3.32E-04 7.71E-06 8.79E+00 7.71E-06 8.79E+00 1.90E-03 7.71E-06 8.80E+00 7.71E-06 8.81E+00 8.75E-03 Dose PER-REM/Yr (310yr) %Increase (310yr) PER-REM/Yr (315yr) %Increase (315yr)

Dose Without With Without With Without With Without With Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion Corrosion 2.48E-02 2.64E-02 0.28% 0.30% 4.11E-02 4.51E-02 0.47% 0.51%

Conditional Containment Failure Probability (CCFP)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion CCFP 67.195% 67.935% 67.908% 68.655% 68.070% 68.818%

CCFP 0.712% 0.720% 0.874% 0.884%

Large Early Release Frequency (LERF)

Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion Class 3b 7.48E-09 7.83E-09 2.49E-08 2.69E-08 3.74E-08 4.20E-08 LERF/yr LERF/yr 3.48E-10 1.99E-09 4.54E-09 Class 3b*

LERF/yr 1.74E-08 1.91E-08 2.99E-08 3.41E-08 From Base 55

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 10.0 External Events Contribution In accordance with the EPRI guidance, where possible, the analysis should include a quantitative assessment of the contribution of external events (e.g., fire and seismic) in the risk impact assessment for extended ILRT intervals. In absence of these models, an assessment can be taken from existing, previously submitted and approved analyses or another alternate method (e.g., FIVE, SMA, etc.) of assessing an order of magnitude estimate for contribution of the external event to the impact of the changed interval.[1 §4.2.7] Browns Ferry does not have PRA models for external hazards, with exception to Internal Fires. The Fire PRA model does not currently represent the as-built, as-operated plant; however, it will represent the plant configuration immediately following the first outage of occurrence whereby the ILRT extension is requested. As such, the results of the Fire PRA model are applicable to this analysis. This section consists of the following subsections and tables:

Table 30 presents the Sources of IPEEE Information Section 10.1 Internal Fires Discussion Section 10.2 Seismic Discussion Section 10.3 High Winds, External Floods and Other External Hazards Discussion Section 10.4 External events Impact Summary Table 31 presents the External Events Contribution to CDF and LERF Table 32 LERF/yr for Internal + External Events by ILRT Frequency Table 33 External Events Contribution to LERF, Person-REM & CCFP Table 34 Impact of 15-Year ILRT Frequency on LERF (Upper Bound)

The BFN IPEEE analysis of Seismic, High Winds (Including Tornadoes), External Floods.

Transportation, Nearby Industrial Facilities and other external hazards was accomplished by reviewing the plant environs against the regulatory requirements (Generic Letter 88-20 Supplement 4) regarding these hazards. No other external events (e.g., volcanic activity) are applicable to the Browns Ferry site.[19 §1.3] The IPEEE Program was a one-time review of external hazard risk and was limited in its purpose to the identification of potential plant vulnerabilities and the understanding of associated severe accident risks.

The results of the BFN IPEEE study is documented across several submittals as all hazards were not submitted together at the same time. Table 30 is provided to show the reference for each source.

Table 30 Sources Of BFN IPEEE Information Hazard Unit 1 Unit 2 Unit 3

[21] [8] [8]

Seismic January 14, 2005 June 1996 June 1996 High Winds, External Floods, Transportation [19] [19] [19]

July 24, 1995 July 24, 1995 July 24, 1995 and Nearby Industrial Facilities 56

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 The IPEEE seismic evaluation did not result in CDF or LERF results. Bounding seismic CDF values from the NRC have been made public as part of the development of Generic Issue 199.

Referencing the Risk Assessment for NRC GI-199, Table D-1 lists the postulated core damage frequencies using the updated 2008 USGS Seismic Hazard Curves. The weakest link model for BFN is used in the external events analysis. These values are utilized for the bounding external events assessment.

The overall conclusion of these analyses is that Browns Ferry is well designed and capable of withstanding severe external challenges. Additionally, BFN confirmed that no other plant-unique external events with potential severe accident vulnerability are being excluded from the IPEEE.

It was concluded that BFN meets the applicable Standard Review Plan (1975) requirements, with exception to high winds, and therefore has an acceptably low risk with respect to these hazards. A bounding analysis was performed for high winds contribution to risk.

10.1 Internal Fires Discussion A Fire PRA model was developed for BFN to support transition to NFPA-805. The model of record does not represent the current as-built, as-operated plant as there are modifications that remain to be performed in the plant. TVA has committed to NRC to have all modifications in support of NFPA-805 in place by 2019 which coincides with the first outage of opportunity that the ILRT extension is proposed to be used is scheduled for the spring of 2019. As such, the Fire PRA model will represent the as-built, as-operated plant in the cycle commencing immediately following the refueling outage, and therefore, is appropriate to use in this analysis. CDF and LERF values are documented in Table 31.

The Fire PRA model has been subjected to peer review. The results of the PRA technical adequacy are discussed in Appendix B.

10.2 Seismic Discussion BFN does not currently have a seismic PRA model. Seismic risk was evaluated for Units 2 & 3 whereby TVA elected to complete a Seismic Margins Analysis (SMA) following NUREG-1407 and EPRI NP-6041 as a focused-scope plant. The SMA methodology was designed to demonstrate sufficient margin over the Safe Shutdown Earthquake (SSE) to ensure plant safety and to find any "weak links" that might limit the plant shutdown capacity to safely withstand a seismic event larger than an SSE or lead to seismically induced core damage.[20] Unit 1 seismic evaluation was performed and submitted separately as part of the plant restart following a lengthy shutdown period. The Unit 1 analysis was performed similar to the Unit 2 & 3 analyses.[22]

Newer information from NRC regarding GI-199 Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States (CEUS) on Existing Plants, Table D-1 lists the postulated core damage frequencies using the updated 2008 USGS Seismic Hazard Curves. For BFN the Seismic Hazard CDF using the Weakest Link: is 3.7E-06/yr (Unit 1), 5.4E-06/yr (Unit 2) and 5.4E-06/yr (Unit 3). Given the seismic CDF contributions (e.g., by accident class) are not available, seismic LERF is estimated by assuming the internal events CDF contributions to LERF also apply to the seismic LERF. Similar to other Containment ILRT submittals, a seismic CDF factor is calculated in Equation 32 in the EPRI guidance,[1] LERF values are multiplied by the seismic CDF factors to provide an estimate of the seismic contribution to LERF.

57

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Equation 32 Seismic CDF Factor SeismicCDF_Factor = CDFSeismic ÷ CDFFPIE where; FPIE is the Full-Power Internal Events Model Unit 1 SeismicCDF_Factor = 3.70E-06/yr ÷ 6.93E-06/yr

= 0.534 Unit 2 SeismicCDF_Factor = 5.40E-06/yr ÷ 6.29E-06/yr

= 0.859 Unit 3 SeismicCDF_Factor = 5.40E-06/yr ÷ 7.72E-06/yr

= 0.699 Equation 33 Seismic LERF Estimation LERFSeismic = SeismicCDF_Factor X LERFInternal_Events (Table 2) where; FPIE is the Full-Power Internal Events Model Unit 1 LERFSeismic = 0.53 X 1.26E-06/yr

= 6.73E-07/yr Unit 2 LERFSeismic = 0.86 X 1.21E-06/yr

= 1.04E-06/yr Unit 3 LERFSeismic = 0.70 X 1.45E-06/yr

= 1.01E-06/yr The assumptions regarding the CDF and LERF values provided above are used to provide insight into the impact of the total external hazard risk on the conclusions of this ILRT risk assessment.

10.3 High Winds, External Floods, and Other Hazards Discussion In addition to seismic hazards, the BFN IPEEE submittals analyzed a variety of other external hazards, including high winds/tornadoes, external floods, transportation and nearby industrial facilities. The screening approach used in the analysis demonstrates all these hazards, with exception to high winds, met the USNRC Standard Review Plan (SRP) 1975 criteria and has adequate defense in depth against these threats. Therefore, these external events have been screened from further consideration and are judged to have acceptability low risk. As such, these hazards were determined in the BFN IPEEE to be negligible contributors to overall risk.

Accordingly, these hazards are not included explicitly in this analysis and are reasonably assumed not to impact the results or conclusion of the ILRT interval extension risk assessment.

58

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Since BFN did not meet the SRP 1975 criteria for high winds, a bounding analysis was performed and submitted with the IPEEE. The analysis showed the contribution to core damage frequency due to high winds to be less than the IPEEE screening criteria of 10-6/yr.[19 §1.4] For this analysis, conservatively, it is assumed that the high winds CDF contribution is 1.0E-06/yr for all three units. LERF is determined by taking the LERF/ CDF ratio from the internal events quantification (Table 2), and multiplying the ratio by the assumed CDF contribution.

Equation 34 Internal Events CDF / LERF Factor Calculation LERF/CDF (Factor) = LERFIE / CDFIE Unit 1 LERF/CDF (Factor) = 1.26E-06/yr ÷ 6.93E-06/yr

= 0.182 Unit 2 LERF/CDF (Factor) = 1.21E-06/yr ÷ 6.29E-06/yr

= 0.192 Unit 3 LERF/CDF (Factor) = 1.45E-06/yr ÷ 7.72E-06/yr

= 0.188 Equation 35 High Winds LERF Approximation LERFHigh_Winds = CDFHigh_Winds X CDF/LERF FactorIE Unit 1 LERFHigh_Winds = 1.00E-06/yr X 0.182

= 1.82E-07/yr Unit 2 LERFHigh_Winds = 1.00E-06/yr X 0.192

= 1.92E-07/yr Unit 3 LERFHigh_Winds = 1.00E-06/yr X 0.188

= 1.88E-07/yr Note: A bounding analysis approach taken by the IPEEE indicates the CDF associated with high winds is <1.0E-06/yr. Conservatively 1.0E-06/yr is used in this analysis.

10.4 External Events Impact Summary In summary, the contribution to CDF from external events is about eight to ten times higher than for internal events. With respect to LERF external events are approximately four to five times higher than for internal events.

Table 31 External Events Contribution to CDF and LERF CDF/yr LERF/yr External Hazard Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Fire 3.70E-06 5.40E-06 5.40E-06 6.73E-07 1.04E-06 1.01E-06 Seismic 5.03E-05 5.64E-05 5.92E-05 5.47E-06 5.37E-06 5.02E-06 High Winds 1.00E-06 1.00E-06 1.00E-06 1.82E-07 1.92E-07 1.88E-07 Other Hazards Screened Screened Screened Screened Screened Screened 59

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 External Events - Total 5.50E-05 6.28E-05 6.56E-05 6.32E-06 6.60E-06 6.22E-06 Internal Events 6.93E-06 6.29E-06 7.72E-06 1.26E-06 1.21E-06 1.45E-06 External + Internal Events 6.19E-05 6.91E-05 7.33E-05 7.58E-06 7.81E-06 7.67E-06 As noted earlier, the 3b contribution is approximately proportional to CDF. As increase in CDF is expected to result in a higher 3b frequency and assumed LERF. To determine a suitable multiplier of external CDF to internal event CDF, a weighted average approach is used.

Equation 36 External Events - Internal Events Weighted Average Determination CDFWeighted_Ave = CDFEE ÷ CDFIE LERFWeighted_Ave = LERFEE ÷ LERFIE Unit 1 CDFWeighted_Ave = 5.05E-05yr ÷ 6.93E-06yr

= 7.94 LERFWeighted_Ave = 6.32E-06/yr ÷ 1.26E-06yr

= 5.02 Unit 2 CDFWeighted_Ave = 6.28E-05/yr ÷ 6.29E-06yr

= 9.98 LERFWeighted_Ave = 6.60E-06/yr ÷ 1.21E-06yr

= 5.46 Unit 3 CDFWeighted_Ave = 6.56E-05/yr ÷ 7.72E-06yr

= 8.5 LERFWeighted_Ave = 6.22E-06/yr ÷ 1.45E-06yr

= 4.29 60

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 The EPRI Category 3b test frequency for the three-per-ten years, once-in-ten, and once-in-fifteen years ILRT intervals are shown in Table 27 (Unit 1), Table 28 (Unit 2) and Table 29 (Unit 3). Using the conservative external events CDF multiplier determined by Equation 36, the change in the LERF risk determined due to extending the ILRT test frequency from three-per-ten years to once-in-fifteen years, including both internal and external hazards risk, is shown in Table 32.

Table 32 LERF/yr for Internal & External Events by ILRT Frequency 3b Frequency (310) 3b Frequency (110) 3b Frequency (115) LERF Increase1 Contributor Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Internal (3b)

From 8.27E-09 8.07E-09 7.48E-09 2.76E-08 2.69E-08 2.49E-08 4.14E-08 4.04E-08 3.74E-08 3.31E-08 3.23E-08 2.99E-08 Tables 27-29 Factor From 7.94 9.98 8.50 7.94 9.98 8.50 7.94 9.98 8.50 Eq 36 IE x Eq 36 6.57E-08 8.06E-08 6.36E-08 2.19E-07 2.68E-07 2.12E-07 3.28E-07 4.03E-07 3.18E-07 2.63E-07 3.22E-07 2.54E-07 Factor Combined 7.39E-08 8.87E-08 7.11E-08 2.46E-07 2.95E-07 2.37E-07 3.70E-07 4.43E-07 3.55E-07 2.96E-07 3.55E-07 3.84E-07 1

Associated with the change from the baseline test frequency of three-per-ten years to the proposed once-in-fifteen years 61

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 The other metrics for the ILRT extension risk assessment can be similarly derived using the multiplier approach. The results between the test frequency of three-per-ten years to the proposed once-in-fifteen years interval compared to the acceptance criteria are shown in Table

33. As can be seen, the impact from including the external events contributors would not change the conclusion of the risk assessment. That is, the acceptance criteria are all met such that the estimated risk increase associated with permanently extending the ILRT surveillance interval to one test per fifteen years has been demonstrated to be small. Note that a bounding analysis for total LERF contribution follows in Table 34.

Table 33 External Events Contribution to LERF, Person-REM, & CCFP 1

Event LERF/yr Person-REM/yr CCFP Contributor Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Unit 1 Unit 2 Unit 3 Internal 3.31E-08 3.23E-08 2.99E-08 4.27E-02 4.60E-02 4.51E-02 1.08% 1.16% 0.87%

External 2.63E-07 3.22E-07 2.54E-07 3.39E-01 4.59E-01 3.84E-01 1.08% 1.16% 0.87%

Combined 2.96E-07 3.55E-07 2.84E-07 3.82E-01 5.05E-01 4.29E-01 1.08% 1.16% 0.87%

<1.0 person-rem/yr or <1.0%

Acceptance

<1.0E-06/yr (Small) (Whichever is LESS <1.5%

Criteria 3 Restrictive) 1 The probability of leakage due to ILRT extension is assumed to be the same for both internal and external events.

Therefore, the percentage change for CCFP remains constant.

2 Calculated as the full power internal events value times the external events multiplier developed in Equation 36.

3 Use of the multiplier for the per-cent change in dose will exceed the 1.0% delta/ However, the guidance allows for a change in the total dose of less than 1.0 person-REM. Therefore, for the combined risk contribution, the less restive metric is used.

The increase in LERF due to the combined internal and external events from extending the ILRT frequency from three-in-ten years to once-in-fifteen years falls within Region II between 1.0E-7 to 1.0E-6 per reactor year (small change in risk) of the RG 1.174 acceptance guidelines. Per RG 1.174, when the calculated increase in LERF due to the proposed plant change is in the small change range, the risk assessment must also reasonably show that the total LERF is less than 1.0E-5/yr. Similar bounding assumptions regarding the external event contributions that were made above are used for the total LERF estimate which follows.

From Table 2, the LERF contribution to risk from internal events is added to the calculated external events contribution from Table 31, and the calculated increase in LERF for an ILRT frequency of fifteen years which includes age-related corrosion failure likelihood.

As can be seen, the estimated upper bound LERF for Brown Ferry is estimated as shown in Table 34. These values are less than the RG 1.174 requirement to demonstrate that the total LERF due to internal and external events is less than 1.0E-05/yr.

62

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 34 Impact of 15-Year ILRT Frequency on LERF (Upper Bound)

LERF/yr LERF Contributor Unit 1 Unit 2 Unit 3 Internal Events 1.26E-06 1.21E-06 1.45E-06 External Events 6.32E-06 6.60E-06 6.22E-06 Internal Events Due to ILRT at 15-year 4.64E-08 4.53E-08 4.20E-08 1

Frequency External Events Due to ILRT at 15-year 2.33E-07 2.47E-07 1.80E-07 1

Frequency Total LERF 7.86E-06 8.10E-06 7.89E-06 Acceptance Criteria <1.0E-05/yr 1

Including age adjusted steel liner corrosion likelihood, reference Table 27 Unit 1), Table 28 (Unit 2) and Table 29 (Unit 3).

11.0 Results/Conclusions NEI 94-01, Revision 3-A[8] describes an NRC-accepted approach for implementing the performance-based requirements of 10CFR50, Appendix J, Option B. It incorporates the regulatory positions stated in R.G. 1.163, Performance-Based Containment Leak-Test Program and includes provisions for permanently extending Type A intervals to fifteen years.

Based on the results of calculations, sensitivity studies, and conservatisms used in this analysis as shown in Table 35 (Unit 1), Table 36 (Unit 2) and Table 37 (Unit 3), a permanent extension of the BFN Containment ILRT to one test per fifteen years presents an insignificant increase in risk to the general public.

Section 11.0 includes the following subsections and tables:

Section 11.1 Results Discussion - LERF Section 11.2 Results Discussion - CCFP Section 11.3 Results Discussion - Dose Section 11.3 Results Tables Table 35 presents the Unit 1 results and applicability for this application Table 36 presents the Unit 2 results and applicability for this application Table 37 presents the Unit 3 results and applicability for this application In the discussions that follow, the maximum result (from all three units) for the figure of merit will be presented and bound the other two units.

63

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 11.1 Results Discussion - LERF Regulatory Guide 1.174 provides guidance for determining the risk impact of plant specific changes to the licensing basis. Leakage characterized by the Type A test does not affect the Core Damage Frequency (CDF); therefore, there is no change to the plant CDF as a result of implementing this proposed change to the licensing basis. The guidance describes a small change in risk for LERF as less than 1.0E-06/rx-yr, IF, it can be reasonably shown that the total LERF is less than 1.0E-05/rx-yr. For Browns Ferry, the analysis included the estimated contribution from external events in addition to the internal events analysis. Table 33 summarizes the maximum LERF for BFN which is estimated to be 3.55E-07/yr, AND the maximum upper bound total LERF (Including External Events) 8.10E-06/yr, as shown in Table

34. Both results are within the acceptable bands for a small change in risk according to R.G.

1.174. Table 35 (Unit 1), Table 36 (Unit 2) and Table 37 (Unit 3) provides the results for the internal events LERF, combined external events (EE) and internal events (IE) LERF, and the delta LERF for combined EE and IE results for the change from the original licensing basis (OLB) of three tests per ten years as compared to the proposed licensing basis (PLB) of one test in fifteen years, and the delta from the current licensing basis (CLB) to the (PLB).

11.2 Results Discussion - CCFP In accordance with the methodology in EPRI Report 1018243[1] a maximum conditional containment failure probability (CCFP) increase for Browns Ferry from the OLB to the PLB is 1.170% which includes the increased contribution due to aging and corrosion affects. Revision 2-A of the EPRI Report characterizes an increase in the CCFP of 1.5% as very small.[1 §1.2] This is consistent with the NRC Final Safety Evaluation for NEI 94-01. Therefore, this increase is judged to be small. Table 27 (Unit 1), Table 28 (Unit 2) and Table 29 (Unit 3) provides the detailed results for the CCFP change for the OLB to the PLB, and from the CLB to the PLB.

11.3 Results Discussion - Population Dose The proposed licensing change in the Type A ILRT interval to one test per fifteen years as measured in terms of the total integrated plant risk for those accident sequences influenced by Type A testing results in a maximum dose increase of 5.05E-01 person-rem/yr. This value is based on internal events and external events combined. EPRI Report 1009325, Revision 2-A[1]

states that a small increase in population dose is defined as 1.0 person-rem/yr or 1% of the total population dose, whichever is less restrictive for the risk impact of the ILRT interval extension to fifteen years. BFN will use the person-REM increase option. This is consistent with the NRC Final Safety Evaluation for NEI 94-01. Table 33 provides the detailed results from the OLB to the PLB for Units 1, 2 and 3, including corrosion and external events.

64

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 11.4 Conclusion The following tables present the metrics, their values, their data source, the associated acceptance criteria and the reference for the criteria. All metrics meet the acceptance criteria for the three Browns Ferry units; therefore, the risk associated with the proposed permanent extension for the Containment ILRT interval to one test-in-fifteen years on a permanent basis is not considered to be significant as it represents only a small change in the BFN risk profile.

Table 35 Unit 1 Results Table & Applicability Acceptable for Metric Value Data Source Acceptance Criteria Application?

LERFIE_Total 1.26E-06/yr Table 34 <1.0E-05/yr

[8]

Yes LERFTotal(IE & EE) 7.86E-06/yr Table 34 RG 1.174 §2.4 Table 32 <1.0E-06/yr LERFTotal(CLBPLB) IE & EE 1.23E-07/yr Calculated (Small) Yes

[8]

LERFTotal(OLBPLB) IE & EE 2.96E-07/yr Table 32 RG 1.174 §2.4 Table 27 CCFP(CLBPLB), Inc. Corrosion 0.202% 1.5%

Calculated Yes

[8 NEI 94-01 R 2 §2.2 CCFP(OLBPLB), Inc. Corrosion 1.089% Table 27 3.82E-01/yr <1.0 person-rem/yr or DOSE(OLBPLB), IE & EE <1% of total dose, person- Table 33 Yes With Corrosion whichever is less REM restrictive Table 36 Unit 2 Results Table & Applicability Metric Value Data Source Acceptance Criteria Acceptable for Application?

LERFIE_Total 1.21E-06/yr Table 34 <1.0E-05/yr

[8]

Yes LERFTotal(IE & EE) 8.10E-06/yr Table 34 RG 1.174 §2.4 Table 32 <1.0E-06/yr LERFTotal(CLBPLB) 1.48E-07/yr Calculated (Small) Yes

[8]

LERFTotal(OLBPLB) 3.55E-07/yr Table 32 RG 1.174 §2.4 Table 28 CCFP(CLBPLB), Inc. Corrosion 0.217% 1.5%

Calculated Yes

[8 NEI 94-01 R 2 §2.2 CCFP(OLBPLB), Inc. Corrosion 1.170% Table 28

<1.0 person-rem/yr or 5.05E-01/yr <1% of total dose, DOSE(OLBPLB), IE & EE Table 33 whichever is less Yes person-With Corrosion restrictive REM

[8]

EPRI 1018243 App H 65

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 37 Unit 3 Results Table & Applicability Data Source Acceptable for Metric Value Acceptance Criteria Application?

LERFIE_Total 1.45E-06/yr Table 34 <1.0E-05/yr

[8]

Yes LERFTotal(IE & EE) 7.89E-06/yr Table 34 RG 1.174 §2.4 Table 32 <1.0E-06/yr LERFTotal(CLBPLB) 1.19E-07/yr Calculated (Small) Yes

[8]

LERFTotal(OLBPLB) 2.84E-07/yr Table 32 RG 1.174 §2.4 Table 29 CCFP(CLBPLB), Inc. Corrosion 0.164% 1.5%

Calculated Yes

[8 NEI 94-01 R 2 §2.2 CCFP(OLBPLB), Inc. Corrosion 0.884% Table 29

<1.0 person-rem/yr or 4.29E-01/yr <1% of total dose, DOSE(OLBPLB), IE & EE Table 33 whichever is less Yes person-With Corrosion restrictive REM

[8]

EPRI 1018243 App H A previous assessment performed by NRC in NUREG-1493 has previously concluded the following:

• Reducing the frequency of Type A tests (ILRTs) from three-per-ten years to one-per-twenty years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B and C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond one-in-twenty years has not been evaluated.

Beyond testing the performance of containment penetrations, ILRTs also test the integrity of the containment structure.

The findings from the BFN analysis confirms these general findings on a plant specific basis considering the severe accidents evaluated, the containment failure modes and the local population surrounding the plant out to a 50-mile radius.

Appendix A PRA Technical Adequacy A-1.0 Technical Adequacy Overview The analysis of the Browns Ferry PRA technical adequacy follows the guidance provided in Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.[9] The guidance in RG 1.200 indicates the following steps should be followed to perform this evaluation:

66

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

1. Identify the parts of the PRA used to support the application.

SSCs, operational characteristics affected by the application and how these are implemented in the PRA model.

A definition of the acceptance criteria used for the application.

2. Identify the scope of risk contributors addressed by the PRA model.

If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Summarize the risk assessment methodology used to assess the risk of the application.

Include how the PRA model was modified to appropriately model the risk impact of the change request.

4. Demonstrate the Technical Adequacy of the PRA.

Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide. Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Identify key assumptions and approximations relevant to the results used in the decision-making process.

Steps 1 through 3 are covered in the main body of this analysis. The purpose of this appendix is to address the requirements identified in Step 4 above. Each of these Steps (plant changes not yet incorporated into the PRA model, relevant peer review findings, consistency with applicable PRA standards and the identification of key assumptions) are discussed in the following sections.

The risk assessment performed for the containment ILRT permanent extension request is based on the current Level 1 and LERF PRA model, including Internal Flooding. The external events analyses include the current Fire PRA (FPRA) model which represents the plant once all modifications are implemented in support of transition to NFPA-805. This work is scheduled for completion in 2019. The FPRA model will represent the as-built, as-operated plant in the time period for the proposed extended containment ILRT interval.

For this application, the accepted methodology[1] involves a bounding approach to estimate the change in the LERF from extending the ILRT interval. Rather than exercising the PRA model itself, it involves the establishment of separate evaluations that are linearly related to the plant CDF contribution. Consequently, a reasonable representation of the plant CDF that does not result in a LERF does not require that Capability Category II be met in every aspect of the modeling if the Category I treatment is conservative or otherwise does not significantly impact the results.

67

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 A discussion of the TVA model update process, model history, peer reviews performed on the Browns Ferry models, the results of those peer reviews and the potential impact of peer review findings on the containment ILRT extension risk assessment are provided in A-2.0 PRA Model History and Peer Review Summary This analysis uses the Browns Ferry Model of Record (MOR) Rev. 7 which represents the current as-built, as-operated plant and associated risk profile for internal events (with internal flooding) challenges. The BFN PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, common cause events, and inter-unit impacts. The PRA model quantification process is based on event tree / fault tree linking which is a well-known methodology employed throughout the industry. It should be noted that TVA has chosen to use the BFN Fire PRA (FPRA) which represents the plant once all NFPA-805 modifications (including operator actions) are installed, in this calculation to quantify and assess the impact of this application from internal fire risk. The fire PRA model was developed in accordance with the ASME/ANS PRA Standard and NFPA 805.

A-3.0 PRA Modeling Process TVA employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all TVA nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews.[36] The following information describes this approach as it applies to the TVA PRA.

• PRA Maintenance and Update The TVA risk management process ensures that the applicable PRA models reflects the as-built and as-operated plants. This process is defined in the TVA probabilistic risk assessment program, which consists of a governing procedure[36] and a subordinate implementation procedure.[37] The procedures delineate the responsibilities and guidelines for updating the PRA models at TVA nuclear generation sites. The overall TVA PRA program defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, industry operating experience, etc.), and for controlling the model and associated computer files. To ensure that the current PRA models accurately reflect the as-built, as-operated plant, the following activities are routinely performed:[36 §3.2.2]

- Design changes and procedure changes are reviewed for their impact on the PRA model.

- Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every five years, or sooner if estimated cumulative impact of plant configuration changes exceed the threshold of +/-25% of CDF or LERF.

In addition to these activities, TVA risk management procedures provide the guidance for risk management maintenance activities. This guidance includes:[36, 37]

- Documentation of the PRA model, PRA products, and bases documents.

- The approach for controlling electronic storage of risk management products including PRA update information, PRA models, and PRA applications.

68

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

- Guidelines for updating PRA models for TVA nuclear generation sites.

Procedural requirements for PRA documentation of the model of record (MOR) and PRA applications. The MOR is composed of 1) PRA computer model and supporting documentation, 2) MAAP model and supporting documentation, and 3) other Supporting Computer Evaluation Tools (e.g., UNCERT, SYSIMP, EPRI HRA Calculator, etc.). The purpose of the PRA MOR is to provide a prescriptive method for quality, configuration, and documentation control. PRA applications and evaluations are referenced to a MOR and therefore the pedigree of PRA applications and evaluations is traceable and verifiable. After September 2008 all PRA notebooks modified are converted to desirable calculations. The NEDP-2 calculation process requires calculations to be prepared and independently checked and approved. NEDP-2 states Verification is required for calculations associated with the safety-related and quality-related NPG structures, systems, components and equipment and others in accordance with the requirements of NEDP-5, Design Document Reviews. Verification is not typically required for Study Calculations, which are generally the type of calculations performed to support the PRA.

NEDP-26 also specifies the requirements for independent review and periodic self-assessments of the model.[36, 38]

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated into the PRA model, relevant peer review findings, and consistency with applicable PRA Standards) will be discussed in turn in this section.

• Pending Plant Changes Not Included in the Current Model of Record A PRA updating requirements evaluation (update tracking database) is created for all issues that are identified that could impact the PRA model. The database includes the identification of those plant changes that could impact the PRA model.

A review of the identified items since the current MOR, indicates that there are no plant changes that have not yet been incorporated into the PRA model that would affect this application.

A-4.0 Consistency with Applicable PRA Standards As shown in Table 38 the Full-Power Internal Events PRA with Internal Flooding and the Fire PRA have been subjected to full-scope and focused-scope peer reviews for a total of six peer reviews since 2009. These reviews were performed in accordance with RG 1.200 R2[9] and the endorsed ASME/ANS PRA Standard, ASME/ANS RA-Sa-2009[33]

Each review build upon the previous to continuously improve the technical adequacy of the BFN PRA models. These assessments are further discussed with information regarding supporting requirements status and F&O (findings) status. F&Os are listed explicitly in Table 50 (FPIE)

Table 51 (FPRA).

Table 38 Peer Reviews Date Type of Review Guidance Model of Record 69

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 MAY 2009 Internal Events (Full Scope)

[13] RG 1.200 R2 APR 2009 NEI 05-04 R3 SEP 2009 Internal Flooding (Focused Scope)

[14] RG 1.200 R2 APR 2009 NEI 05-04 R3 JAN 2012 Fire (Full Scope)

[39 §1.2] RG 1.200 R2 JAN 2012

[39 §1.2]

NEI 07-12 R1 MAY 2012 Fire (Follow-On)

[40 §1.1 ] RG 1.200 R2 MAY 2012

[40 §3]

NEI 07-12 R1 MAY 2015 Fire (Focused Scope)

[41 §1.1] RG 1.200 R2 bfn123_mor_r05Ab46

[41 §Table 3-1]

NEI 07-12 R1 Internal Events 2009 F&O Resolution RG 1.200 R2 JUL 2015 [42] N/A Review (Focused Scope) NEI 05-04 R3 The PRA Peer Reviews were used as an initial input into the PRA Self-Assessments relative to the combined ASME/ANS PRA Standard. The F&Os were resolved and documented, and the models were judged to meet the ASME/ANS PRA Standard to support an overall Capability Category II.

• Internal Events Hazards[13]

As shown in Table 38 the BFN Internal Events PRA has been subjected to three peer reviews using the RG 1.200 R2 guidance - a full scope review, a focused scope follow-on peer review for internal flooding, and a focused scope peer review to evaluate specific aspects of the Internal Events PRA and assess existing F&O dispositions. All peer reviews used the process defined in NEI 05-04, Revision 1 (Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard), ASME/ANS RA-Sa-2009,[9] and Regulatory Guide 1.200, Revision 2.[8] The initial Peer Review for BFN Units 1, 2, and 3 Internal Events PRA was performed in May, 2009. A separate review was performed which was focused on the Internal Flooding portion of the BFN PRA in September, 2009. The 2015 focused-scope peer review evaluated specific changes made to the Internal Events PRA (excluding internal flooding) and assessed the F&Os from the previous peer review that were considered resolved by a TVA self-assessment.

Thirty-seven of the existing F&Os were not addressed in the focused scope peer review.

A team of independent PRA experts from nuclear utility groups and PRA consulting organizations carried out the review.

The purpose of these reviews was to provide a method for establishing the technical adequacy of the BFN PRA for the spectrum of potential risk-informed plant licensing applications for which the BFN-PRA may be used. There have been no changes made to the internal events model or methodology following these peer reviews that would constitute an upgrade.

The Peer Review of the BFN PRA model performed in May 2009, September 2009, and July 2015 resulted in a total of 78 open findings for the integrated three unit model for internal events and internal flooding. All findings from these assessments have been dispositioned. The collective conclusion of these peer review teams determined that with these proposed changes incorporated, the quality of all elements of the BFN PRA model is sufficient to support "risk significant evaluations with deterministic input." As a result of the effort to incorporate the latest industry insights into the BFN PRA model 70

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 upgrades and peer reviews, TVA has concluded that the results of the risk evaluation are technically sound and consistent with the expectations for PRA quality set forth in Regulatory Guide 1.174 and Regulatory Guide 1.177.

Complete results of the peer review findings are provided in Table 50 which provides a copy of the F&O resolutions and the applicability to the proposed Containment ILRT interval extension.

Table 39 IE Peer Review Assessment (May 2009) by Capability Category

[13 Table 4-1]

Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 53 20%

Capability 1 10 4%

Capability 2 or Better 189 76%

Not Applicable 2 1%

TOTAL: 264 100%*

• Actual number is 101% due to rounding.

Of the 189 unique Facts and Observations (F&Os) generated by the Peer Review Team, 95 were Findings, 92 were Suggestions and 2 were Best Practices. The distribution of F&Os by Technical Element are provided in the table that follows:

Table 40 F&O Totals (May 2009) as a Function of Technical Element Type of F&O Technical Element Element Designator Finding Suggestion Best Practice Total Initiating Events IE 23 28 1 52 Accident AS 6 8 0 14 Sequences Success Criteria SC 4 10 0 14 Systems Analysis SY 22 20 0 42 Human Reliability HR 30 14 0 44 Analysis Data Analysis DA 18 10 1 29 Internal Flooding IF 0 0 0 0 Quantification &

QU 20 10 0 30 Results LERF Analysis LE 23 11 0 34 Maintenance &

MU 4 10 0 14 Update 71

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Total Related F&Os 150 121 2 273 (Includes Overlap)

Total Unique F&Os 95 92 2 189 A focused scope peer review was performed in July 2015 to assess Not Met supporting requirements from the 2009 peer review, and to assess BFNs resolutions for corresponding F&Os.[42 Tables 6-1, 6-2, 6-3] Table 41 summarizes the supporting requirements capability category and Table 42 summarizes the F&Os resolution status.

Table 41 IE Peer Review Assessment (July 2015) SRs Originally Not Met Or Cat I 2009 Peer 2015 Peer 2009 Peer 2015 Peer Supporting Supporting Review Review Review Review Requirement Requirement Assessment Assessment Assessment Assessment DA-A4 Not Met Cat I/II/III HR-C3 Not Met Not Met DA-C1 Not Met Cat I/II/III HR-D5 Not Met Not Met DA-C3 Not Met Cat I/II/III HR-F2 Not Met Not Met DA-C13 Not Met Cat II/III HR-G4 Not Met Not Met DA-D2 Not Met Cat I/II/III HR-G5 Not Met Not Met DA-D8 Not Met Cat II HR-G7 Not Met Not Met DA-E1 Not Met Cat I/II/III HR-I2 Not Met Not Met HR-A3 Not Met Cat I/II/III HR-I3 Not Met Not Met HR-C1 Not Met Cat I/II/III IE-C6 Not Met Not Met HR-C2 Cat I Cat II/III IE-C8 Not Met Not Met HR-D6 Not Met Cat I/II/III IE-C14 Not Met Not Met HR-G1 Cat I Cat II IE-D3 Not Met Not Met HR-H1 Cat I Cat II LE-B1 Not Met Not Met HR-H3 Not Met Cat II LE-F2 Not Met Not Met IE-A5 Cat I Cat II LE-F3 Not Met Not Met IE-C2 Not Met Cat I/II/III LE-G6 Not Met Not Met IE-C4 Not Met Cat I/II/III QU-C2 Not Met Not Met IE-C12 Not Met Cat I/II/III QU-D2 Not Met Not Met LE-A4 Not Met Cat I/II/III QU-D5 Not Met Not Met LE-C2 Cat I Cat II/III QU-E1 Not Met Not Met LE-C3 Cat I Cat II/III QU-E4 Not Met Not Met LE-C6 Not Met Cat I/II/III QU-F2 Not Met Not Met 72

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 2009 Peer 2015 Peer 2009 Peer 2015 Peer Supporting Supporting Review Review Review Review Requirement Requirement Assessment Assessment Assessment Assessment LE-C7 Not Met Cat I/II/III QU-F4 Not Met Not Met LE-E4 Not Met Cat I/II/III QU-F6 Not Met Not Met MU-F1 Not Met Cat I/II/III SC-C3 Not Met Not Met SC-A4 Not Met Cat I/II/III SY-B6 Not Met Not Met SY-A17 Not Met Cat I/II/III SY-C3 Not Met Not Met AS-B3 Not Met Not Met LE-C10 Cat I Cat I DA-B2 Not Met Not Met LE-C11 Cat I Cat I DA-C6 Not Met Not Met LE-C12 Cat I Cat I DA-C10 Not Met Not Met SC-A5 Cat I Cat I DA-E3 Not Met Not Met Table 42 2015 Peer Review F&O Resolution Review and Updated Status F&O From 2015 Peer F&O From 2015 Peer 2015 Peer 2015 Peer 2009 Peer Review 2009 Peer Review Review Review Review Assessment Review Assessment Assessment Assessment 1-14 Resolved 6-16 Resolved 6-8 Not Resolved 1-15 Resolved 6-19 Resolved 6-10 Not Resolved 2-2 Resolved 6-22 Resolved 6-13 Not Resolved 2-4 Resolved 6-26 Resolved 6-25 Not Resolved 2-6 Resolved 6-34 Resolved 6-28 Not Resolved 2-13 Resolved 6-35 Resolved 6-30 Not Resolved 2-38 Resolved 6-48 Resolved 6-36 Not Resolved 2-41 Resolved 7-5 Resolved 7-6 Not Resolved 3-32 Resolved 1-6 Not Resolved 7-7 Not Resolved 3-34 Resolved 1-12 Not Resolved 1-26 Met SR Resolved 4-4 Resolved 1-17 Not Resolved 2-17 Met SR Resolved 4-5 Resolved 1-22 Not Resolved 2-39 Met SR Resolved 4-7 Resolved 1-33 Not Resolved 3-22 Met SR Resolved 4-8 Resolved 1-34 Not Resolved 4-10 Met SR Resolved 4-11 Resolved 2-14 Not Resolved 4-12 Met SR Resolved 23 Resolved 3-10 Not Resolved 4-17 Met SR Resolved 73

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O From 2015 Peer F&O From 2015 Peer 2015 Peer 2015 Peer 2009 Peer Review 2009 Peer Review Review Review Review Assessment Review Assessment Assessment Assessment 4-27 Resolved 3-12 Not Resolved 6-46 Met SR Resolved 4-31 Resolved 3-28 Not Resolved 6-47 Met SR Resolved 4-43 Resolved 3-31 Not Resolved 6-49 Met SR Resolved 4-45 Resolved 4-21 Not Resolved 2-35 Met SR Not Resolved 4-46 Resolved 4-25 Not Resolved 3-7 Met SR Not Resolved 4-47 Resolved 4-28 Not Resolved 4/18 Met SR Not Resolved 4-53 Resolved 4-36 Not Resolved 4-29 Met SR Not Resolved 5-1 Resolved 4-40 Not Resolved 4-41 Met DR Not Resolved 5-30 Resolved 4-48 Not Resolved 4-51 Met SR Not Resolved 6-1 Resolved 4-50 Not Resolved 4-51 Met SR Not Resolved 6-6 Resolved 5-3 Not Resolved 4-54 Met SR Not Resolved 6-7 Resolved 6-2 Not Resolved 5-5 Met DR Not Resolved 6-11 Resolved 6-5 Not Resolved 6-50 Met SR Not Resolved Subsequent to the 2015 peer review, the F&Os that remained not resolved were subsequently resolved. The resolutions are listed for the associated F&O in Table 50.

The internal flooding technical element is discussed in section 2.2.2.

• Internal Flooding Hazards The internal flooding peer review evaluated all technical elements associated with IF in the ASME/ANS Combined PRA Standard against the NRC staff position included in Appendix A-3 of RG 1.200.[14 §1.3]

The internal flooding peer review was performed in accordance with the requirements of the NEI Peer Review process, NEI 05-04. Section 3 of the ASME/ANS combined PRA Standard contains a total of 62 Supporting Requirements (SRs) under five Technical Elements, excluding configuration control. [14 §2.1] Configuration control was reviewed as part of the internal events peer review performed earlier in the year. Of these SRs, two were determined to not be applicable to the BFN internal flood PRA and one was not reviewed due to insufficient descriptive information provided in the BFN Internal Flood PRA notebook.

The following table presents an overall summary of the results of the peer review.

74

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 43 Internal Flooding Peer Review Assessment by Capability Category

[14 Table 4-1]

Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 26 42%

Capability 1 3 5%

Capability 2 or Better 30 48%

Not Applicable 2 3%

Not Reviewed 1 2%

TOTAL: 62 100%

The key problem areas for the internal flood PRA were documentation and flood scenario development. All fifteen documentation SRs were rated as not meeting the standard requirements. The primary problem associated with documentation was lack of details, numerous inconsistencies, and incomplete information in the input data, process, and results. It was not prepared in a manner that can facilitate PRA applications, upgrades and peer review. To be consistent with the applicable SRs, much more effort was needed to enhance the documentation. The major problem associated with the flood scenario development was the development if flood scenarios was not rigorously performed. many flood areas, flood sources and flood scenarios were dismissed without adequate considerations of all the possible flooding effects that may cause damage to structures, systems or components credited in the PRA. As a result, a total number of flood scenarios that were quantitatively evaluated was far less than expected and the results of some top internal flood-induced risk contributors were not completely realistic.

The list of internal flooding F&Os and their resolutions and impact on the containment ILRT internal extension application are provided in Table 50.

• Internal Fire Hazards The BFN Fire PRA was subjected to three peer reviews - a full scope review, a follow-on review and a focused scope peer review. The full scope peer review was performed January 2012 and the focused scope follow on peer review was conducted in June 2012.

Both peer reviews used the NEI 07-12 process, ASME/ANS RA-Sa-2009, and RG 1.200, Revision 2. The purpose of these reviews was to establish the technical adequacy of the Fire PRA for the spectrum of potential risk-informed plant licensing applications for which the Fire PRA may be used. The full scope peer review examined all of the technical elements of the BFN Fire PRA against all technical elements in Part 4 of ASME/ANS RA-Sa-2009, including the referenced internal events Supporting Requirements (SRs) in Part

2. The focused scope follow-on peer review performed a review against a list of High Level Requirements (HLRs) and Supporting Requirements (SRs) that were selected based on the Fire PRA model changes implemented in the months that followed the full scope peer review in January 2012. The final conclusion of the peer reviews was that the BFN Fire PRA meets Capability Category II following final resolution and closure of all of the Facts and Observations (F&Os). Most of the F&Os from the full-scope peer review 75

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 were resolved in the follow-on peer review. The F&Os from the follow-on peer review, some of which remain unresolved, are listed and discussed in Table 51.

The TVA process for controlling updates to the Fire PRA is documented in TVA procedure NPG-SPP-09.11, The Probabilistic Risk Assessment Program[37] and NEDP-26, Probabilistic Risk Assessment.[37] NPG-SPP-09.11 covers the management of PRA application, periodic updates and interdepartmental PRA documentation. Furthermore, definitions for PRA model update, PRA model application, and PRA evaluation are provided. Cross-discipline responsibilities for plant operations and system engineering are defined for PRA review to ensure the models represent the as-built, as-operated plant.

NEDP-26[36] describes the process used by the PRA staff to perform applications, model updates and PRA model maintenance and review. The terms PRA upgrade and maintenance are defined by the procedures using the definitions provided in the ASME standard. The procedure requires that updates should be completed at least once every five years (for the lead unit at multiunit sites) or sooner if estimated cumulative impact of plant configuration changes exceeds +25% of CDF or LERF. Changes in PRA inputs or discovery of new information shall be evaluated to determine whether such information warrants an unscheduled PRA update. In accordance with NEDP-26, items exceeding the above threshold shall be tracked in the Corrective Action Program. Potential and/or implemented plant configurations changes that do not meet the threshold for immediate update are tracked in the PRA Model Open Items Database.

PRA updates follow the guidelines established by the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications (ASME/ANS RA-Sa-2009), for a minimum of a Category II assessment. The NEDP-26 procedure also defines the requirements for PRA documentation of the model of record (MOR) and PRA applications. The MOR is composed of 1) PRA computer model and supporting documentation, 2) MAAP model and supporting documentation, and 3) other Supporting Computer Evaluation Tools (e.g., UNCERT, SYSIMP, EPRI HRA Calculator, etc.). The purpose of the PRA MOR is to provide a prescriptive method for quality, configuration, and documentation control. PRA applications and evaluations are referenced to a MOR and therefore the pedigree of PRA applications and evaluations is traceable and verifiable. After September 2008 all PRA notebooks modified are converted to desirable calculations. The NEDP-2[38] calculation process requires calculations to be prepared and independently checked and approved. NEDP-2 states Verification is required for calculations associated with the safety-related and quality-related NPG structures, systems, components and equipment and others in accordance with the requirements of NEDP-5, Design Document Reviews. Verification is not typically required for Study Calculations, which are generally the type of calculations performed to support the PRA.

NEDP-26 also specifies the requirements for independent review and periodic self-assessments of the model.

Table 44 Fire PRA Peer Review Assessment (Jan 2012) by Capability Category

[]

Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 53 12.4 Capability 1 11 2.6 76

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Capability 2 or Better 212 50.7 Not Reviewed 0 0 Not Applicable 144 34.3 TOTAL: 420 100%*

Table 45 Fire PRA Peer Review Assessment (May 2012) by Capability Category

[]

Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 53 12.4 Capability 1 11 2.6 Capability 2 or Better 212 50.7 Not Reviewed 0 0 Not Applicable 144 34.3 TOTAL: 420 100%*

Table 46 Fire PRA F&O Totals (May 2012) as a Function of Technical Element Type of F&O Element Technical Element Unreviewed Designator Finding Suggestion Total Method Plant Partitioning PP 13 0 2 15 Equipment Selection ES 13 0 4 17 Cable Selection CS 18 0 4 22 Qualitative Screening QLS 0 0 0 0 Plant Response Model PRM 27 0 10 37 Fire Scenario FSS 42 4 9 55 Selection & Analysis Fire Ignition Frequency IGN 10 0 6 16 Quantitative Screening QNS 1 0 0 1 Circuit Failure Analysis CF 5 0 0 5 Post-Fire Human HRA 15 0 2 17 Reliability Analysis Fire Risk FQ 28 0 9 37 Quantification Seismic/Fire SF 0 0 0 0 Interactions 77

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Type of F&O Element Technical Element Unreviewed Designator Finding Suggestion Total Method Uncertainty &

UNC 7 0 2 9 Sensitivity Analysis Fire Maintenance &

FMU 0 0 1 1 Upgrade Total Related F&Os (include overlap) 179 4 49 232 Total Unique F&Os 96 1 32 130 Subsequent to BFNs LAR for NFPA-805, the NRC issued requests for additional information on the Fire PRA model. The scope of the 2015 FPRA peer review was to review the FPRA against selected technical elements of Section 4 of the ASME/ANS PRA Standard. The detailed scope of the Focused-Scope Peer Review was based on the results from the 2012 peer reviews. as can be seen in Table 47 the 60 supporting requirements reviewed all met the requirements from the Standard. The scope of the review consisted of:[41 §1.3]

• 60 Supporting requirements (SRs)

- 24 SRs were from Section 4 of the FPRA Standard

- 36 SRs were from Section 2 of the Full-Power Internal Events Standard that are back-references from the FPRA requirements

• Review of the resolutions of 68 Facts & Observations (F&Os)

• The review focused on specific aspects of the FPRA that had changed

- PRA modeling changes that credit Alternate Shutdown Cooling (ASDC) mode of the Residual Heat removal (RHR) System

- PRA modeling changes associated with a planned modification to install Emergency High Pressure Makeup Pumps and related support systems

- Updated PRA methodologies/approaches

- Areas of focus in response to RAIs from NRC as part of the NFPA 805 transition Table 47 Fire PRA Peer Review Assessment (June 2015) by Capability Category

[41 Table 4-2]

Peer Team Assessment Capability Category Number of SRs  % of Total Not Met 0 0 Capability 1 0 0 Capability 2 or Better 55 92%

Not Reviewed 0 0 Not Applicable 5 8%

TOTAL: 60 100%

78

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 48 Fire PRA F&O Totals (June 2015) as a Function of Technical Element

[41 Table 4-3]

Type of F&O Element Technical Element Best Designator Finding Suggestion Total Practice Plant Partitioning PP N/A N/A N/A N/A Equipment Selection ES N/A N/A N/A N/A Cable Selection CS 0 1 0 1 Qualitative Screening QLS N/A N/A N/A N/A Plant Response Model PRM 1 0 0 1 Fire Scenario FSS 0 0 0 0 Selection & Analysis Fire Ignition Frequency IGN N/A N/A N/A N/A Quantitative Screening QNS N/A N/A N/A N/A Circuit Failure Analysis CF 1 0 0 1 Post-Fire Human HRA 0 2 0 2 Reliability Analysis Fire Risk FQ 0 1 0 1 Quantification Seismic/Fire SF N/A N/A N/A N/A Interactions Uncertainty &

UNC 0 1 0 1 Sensitivity Analysis Fire Maintenance &

FMU N/A N/A N/A N/A Upgrade Total Related F&Os (include overlap) 2 5 0 7

• Back-referenced IE SRs (IE, AS, SC, LE), F&Os were written against the Fire SR Table 49 provides a list of capability categories for supporting requirements reviewed during the June 2015 focused-scope FPRA peer review.

Table 49 FPRA Focused-Scope Peer Review Assessment (June 2015)

Supporting Capability Active F&Os Supporting Capability Active F&Os Requirement Category Findings Requirement Category Findings CS-A1 CAT I/II/III None IE-A9* CAT II PRM-B9-01 CS-A2 CAT III None IE-A10* CAT I/II/III PRM-B9-01 CS-A3 CAT I/II/III None IE-B1* N/A N/A 79

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Supporting Capability Active F&Os Supporting Capability Active F&Os Requirement Category Findings Requirement Category Findings CS-A4 CAT I/II/III None IE-B2* N/A N/A CS-A9 CAT I/II/III None IE-B3* N/A N/A CS-A10 CAT II None IE-B4* N/A N/A CS-B1 CAT II/III None IE-B5* N/A N/A PRM-B6 CAT I/II/III None AS-A2* CAT I/II/III PRM-B9-01 PRM-B7 CAT I/II/III PRM-B9-01 AS-A3* CAT I/II/III PRM-B9-01 PRM-B8 CAT I/II/III PRM-B9-01 AS-A4* CAT I/II/III PRM-B9-01 PRM-B9 CAT I/II/III PRM-B9-01 AS-A6* CAT I/II/III None FSS-A4 CAT I/II/III None AS-A7* CAT III None CF-A1 CAT II/III CF-A1-01 AS-A8* CAT I/II/III None CF-A2 CAT I/II/III None AS-A9* CAT II None CF-B1 CAT I/II/III None AS-A11* CAT I/II/III None HRA-B3 CAT III None AS-B1* CAT I/II/III PRM-B9-01 HRA-D1 CAT II None AS-B2* CAT I/II/III PRM-B9-01 HRA-D2 CAT I/II/III None AS-B3* CAT I/II/III PRM-B9-01 HRA-E1 CAT I/II/III None AS-B4* CAT I/II/III None FQ-B1 CAT I/II/III None AS-B6* CAT I/II/III PRM-B9-01 FQ-D1 CAT I/II/III None AS-B7* CAT I/II/III PRM-B9-01 FQ-E1 CAT I/II/III None AS-C1* CAT I/II/III None UNC-A1 CAT I/II/III None AS-C2* CAT I/II/III None UNC-A2 CAT I/II/III None AS-C3* CAT I/II/III PRM-B9-01 IE-A1* CAT I/II/III PRM-B9-01 SC-A2* CAT II/III PRM-B9-01 IE-A2* CAT I/II/III PRM-B9-01 SC-A3* CAT I/II/III PRM-B9-01 IE-A3* CAT I/II/III PRM-B9-01 SC-A4* CAT I/II/III PRM-B9-01 IE-A5* CAT II PRM-B9-01 SC-B2* CAT II/III None IE-A6* CAT II PRM-B9-01 SC-C2* CAT I/II/III PRM-B9-01 IE-A7* CAT I/II/III PRM-B9-01 LE-C6* CAT I/II/III PRM-B9-01

• Internal Events SRs (Section 2 of the PRA Standard) are back-references from Section 4 of the Standard The conclusion of the peer review team is that two findings remain open from the scope reviewed.[41 §Table 4-3]

A-5.0 PRA Model History The following information is gleaned from the corresponding revision of the BFN PRA Summary Document, NDN-000-999-2010-0001.

1. Rev. 0 - Initial CAFTA model issued after August 2009 peer review.

80

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

2. Rev. 1 - Initiating events were updated to include current generic data, recent plant events and multi-unit initiators. Fire initiators that fail offsite power were added to the model to assess the Diesel Generator Allowed Outage Time Extension. Some logic errors and type code errors were also corrected that were identified from the Revision 0 to Revision 1 model.

3. Rev. 2 - Initiators %VR and %VS were added for all units. The human error probability for HFA_0085ALIGNCST was re-evaluated based on an additional MAAP run performed. A design change was incorporated into the model that requires three air compressors to supply the entire plant instead of all four. Some logic errors were also corrected that were identified from the Revision 1 to Revision 2 model.

4. Rev. 3 - The Fire initiators used to asses the Diesel Generator Allowed Outage Time Extension were removed from Revision 3 of the model. Some logic errors and type code errors were also corrected that were identified from the Revision 2 to Revision 3 model.

5. Rev. 4 - Changes were made from the Revision 3 to Revision 4 model to support increased unavailability for infrequent maintenance performed on the Emergency Diesel Generators and corrections to logic errors and type code errors found.

6. Rev. 5 - The major change in this update was to revise the data, and mutually exclusive logic. Changes were made in the Revision 5 model to correct errors in the logic noted during review following the issuing of the Revision 4 documentation and to support increased unavailability for infrequent maintenance being performed on the Emergency Diesel Generators. The data in the PRA model was updated for plant specific failures and successes through January 1, 2012. There were no changes in the Accident Analysis, Success Criteria, Internal Flooding, or LERF Analysis, from Revision 4 to Revision 5.

• The initiating event analysis has been updated to include initiating event data through January 1, 2012 to include current industry generic data, recent plant events and multi-unit initiators.

• Changes were made in the Revision 5 model to correct errors in the logic noted during review following the issuing of the Revision 4 documentation.

• The unreliability, unavailability, and common cause data analyses were updated.

The unreliability (or failure rate) data are based on generic industry data that has undergone Bayesian updating with plant specific data. Plant specific data for the period 1/1/2003 to 1/1/2012 was evaluated and used as input to the Bayesian analysis. Plant maintenance unavailability data is based on the same time period as the failure data, 1/1/2003 to 1/1/2012. Generic industry data from NUREG/CR-6928 was used for components for which no plant specific data was available.

7. Rev. 6 - A model update was performed to merge the Internal Events PRA and the Fire PRA into a single model, to improve the event tree logic, to resolve issues for AC and DC power. A brief overview of these changes is included in the bullets shown below:

• Event Tree changes to credit RCIC for IOOV scenarios

• Event Tree changes to separate the DHR functional top logic in a more logical manner (HWV and DWV, Drywell Sprays)

• Event Tree changes to incorporate ASDC for the Fire PRA

• Event Tree changes to incorporate the HPMU for the Fire PRA

• Logic fault tree changes to address NPSH w/o CAP 81

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026

• Correct the logic for DC chargers (OR gate is now used between the batteries and chargers to address charger trips due to voltage swings caused by inrush current of large loads.

• Logic fault tree changes to address overload and load shed logic

• Logic changes to address preferred pump logic (PPL)

• Logic changes to address diesel paralleling logic

• Logic changes to address conditional LOOP logic for MUI

• Limited enhancement for LOOP recovery

• Develop recoveries for MSL BOC instrumentation

• Updated RCW logic A-6.0 Summary of FPIE and FPRA Facts and Observations As indicated above, a PRA model update was completed in 2016, resulting in PRA Model of Record Rev. 7. The list of F&Os shown below have been resolved as documented by the BFN PRA Summary Document,[28], previously submitted information for regulatory review as part of Browns Ferrys License Amendment Request for Extended Power Uprate,[34] and a sunset of responses have been augmented with additional information that was performed in response to FAQ 14-01 that required each site to perform and document a review of actions taken to address peer review findings to those SRs identified in NEI 99-02 Table G-5.[47] The list of F&O and impact is shown below in Table 50 (FPIE) Table 51 (FPRA) which were reviewed to determine their impact on the Containment ILRT interval extension application.

82

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 50 Internal Events PRA F&O Resolution Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension AS-B3 Resolved 1-6 The sequence descriptions Basis for The phenomenology is discussed in the ATWS F&O Resolved - No generally include a description of Significance: sequence descriptions. The statement There no Impact on CILRT SY-B14 the sequences but the The SR calls for phenomenological conditions identified was removed Interval Extension phenomenological conditions identification of the from the TVA Calculation, NDN00099920070036 created are not specifically phenomenological Revision 0, AS - BFN Probabilistic Risk Assessment -

identified. Some references to conditions for each Accident Sequence Analysis.

phenomenology are provided but sequence.

not consistently (e.g., ATWS In addition, other phenomena are discussed as noted sequence descriptions conclude Possible Resolution: below:

with the statement "There no Include a listing of phenomenological conditions phenomenological Loss of suction due to venting is discussed in TVA identified.") conditions that result for Calculation, NDN00099920070036, AS - BFN each sequence. Probabilistic Risk Assessment - Accident Sequence Analysis, Section 6.2.2.

Harsh environment is discussed in TVA Calculation, NDN00099920070036 Revision 0, AS - BFN Probabilistic Risk Assessment - Accident Sequence Analysis, Section 6.2.4.

83

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SC-B1 Resolved 1-12 Several examples found for lack Basis for Significance: Keep fill systems are monitored daily by operations. F&O Resolved - No of engineering analyses regarding The SR expects that They are alarmed so failures of these systems are Impact on CILRT SY-B6 HVAC System that could be engineering analyses detected and corrected in a timely manner. Based on Interval Extension SY-B7 justified by calcs. Condensate will be performed to this, an assumption is made that these systems are System Notebook (SY.01) determine whether properly charged with water at the time of an initiator. With the PSC Head assumes active ventilation is not these statements are Based on operator interviews, no system has leakage Tank volume available, required due to plant experience. correct. great enough to create a water hammer condition Calculation Core Spray System Notebook should its keep fill system fail after the scram. The only MDN099920110021 (SY.04) assumes keep-fill system Possible Resolution: exception to this is the potential drain down of the RHR Rev. 0 concludes that is not required. HPCI System Perform analyses to loop if it is being used for SPC and LOOP occurs. This the PSC system Notebook (SY.07) assumes validate these condition is modeled and discussed in calculation pressure would remain dependence on quad cooling for statements. NDN-000-074-2007-0025 Revision 4, SY.19 - BFN adequate to prevent the remaining 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of post Probabilistic Risk Assessment - Residual Heat ECCS line voiding for at accident operation. Removal. Calculations are not needed for these least 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after PSC systems. The assumptions section for each applicable pump failure on Units 1 SY notebook reflects the discussion above. and 3. Unit 2 can only be shown to last about A consensus model is not available to guide the HVAC 21/2 hours after PSC System dependency issues. The intent of SY-B6 is to pump failure. The make sure adequate analysis exists to support operators are trained to removing modeled dependencies from systems. It is check header pressure not the intent of SY-B6, or the ASME standard for that before manually starting matter, to establish what analysis is needed to support an ECCS pump.

plant operations and design. In the case of HVAC Therefore, it is assumed System, adequate plant specific analysis is not that, after 2 1/2 hours, available to remove room cooling dependencies from the operators will have most equipment. Room heat-up calculations may be established positive available, but realistic (non-EQ) equipment failure control over the ECCS temperatures are not available. This situation is shared pumps and will have by many plants in the industry. The BFN model took properly started them.

the conservative approach and required an HVAC Hence, spurious Primary System dependency for all equipment that could not be Containment Isolation reasonably argued to not have the dependency. Since System (PCIS) signals that time, room heatup calculations have been isolating the PSC Head performed which resulted in the removal of many of the Tank pump system is HVAC System dependencies. There are still HVAC not modeled.

systems required for the RHR and Core Spray pump rooms and the main control room.

The condensate and condensate booster pumps are not located in a room. They are in a long corridor that is continually open to the turbine building environment.

These pumps have cooling air from fans ducted directly onto the pumps. The system engineers and 84

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension operators were interviewed and stated plant operational experience showed these pumps would operate for an extended length of time without that forced cooling. (NDN-000-002-2007-0008 Revision 2, SY.01 - BFN Probabilistic Risk Assessment -

Condensate System). They concluded the pumps would survive for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without forced cooling. This conclusion was based on a qualitative analysis that included plant walkdowns, expert opinion from both operators and engineers, and past plant operating experience.

DA-C6 Resolved 1-17 Reviewed DA.01. The source of Basis for Significance: As it stands the ability to remove post maintenance F&O Resolved - No demands is not discussed. Post-maintenance testing (PMT) from the database would require a Impact on CILRT Based upon discussions with the testing must be massive re-tool of the database to allow for discrete Interval Extension PRA staff, exposure is collected excluded from the removal of specific times. The ability to perform these directly from plant data systems exposure data per the actions is limited due to the lack of interface between and is therefore actual SR. the Operations Logs and the Plant Equipment Display component exposure. However, System (PEDS).

post-maintenance testing Possible Resolution:

demands are also included in Develop a means of these numbers and are not identifying the post- To quantify the amount of effect removal of potential removed. maintenance related PMT would have on the results, seven scenarios were exposure and remove analyzed with the CDF & LERF for each unit and them from the data compared This review is documented by PRA calculations. Evaluation BFN-0-15-079.

The results show that even with an extremely unrealistic number of PMTs the data is not significantly skewed by the inclusion of the PMT data.

85

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension DA-C10 Resolved 1-22 There is no discussion of the Basis for Significance: A description of the process to be applied in the use of F&O Resolved - No process to be applied in the use All levels of capability in surveillance test data has been incorporated in Impact on CILRT of surveillance test data. The use this SR indicate that the calculation NDN-000-999-2007-0033 Revision 7, Interval Extension of this data is required for process for use of DA.01 - BFN Probabilistic Risk Assessment - Data situations in which there is no MR surveillance data needs Analysis.

data available (for example), so a to possess specific process for its use should be in attributes. There is no DataWare takes the actual component demands and place. process defined. hours as documented in PEDS. When PEDS does not track the component being looked at, either the IST Possible Resolution: database was used or the system engineer was Provide a process for contacted to figure out the number of demands/hours use of surveillance data that occurred for that particular component. This that incorporates the information is described in the DA Notebook and Table requirements of this SR. 13 shows specifically where the success information comes from. The process described in the DA notebook was updated to clarify how the data collection is performed.[28]

LE-F2 Resolved 1-33 There is no discussion of the LE-F2 is related to this The review of the LERF contributors (ASME/ANS RA- F&O Resolved - No review of the LERF contributors F&O. The SR is NOT Sa-2009 Table 2-2.8-9) for reasonableness was Impact on CILRT (ASME/ANS RA-Sa-2009 Table met. performed as discussed in calculation NDN-000-999- Interval Extension 2-2.8-9) for reasonableness per 2007-0041 Revision 6, QU - BFN Probabilistic Risk the review of the QU Notebook Basis for Significance: Assessment - Quantification.

and LE.01. A review of the reasonableness of the The review of the CDF and LERF cutsets was results of the analysis of performed and documented in Attachment D and E of the contributors to the Quantification Notebook. Section 6.3.2.3 of the LERF is required per Quantification notebook specifies the types of things the SR. that were looked at when reviewing the cutsets. The Top 100 cutsets, a sample of 100 cutsets from the Possible Resolution: middle and the last 100 cutsets were all reviewed and Perform and document showed no signs of inconsistencies in logic.[28]

a review of the reasonableness of the contributors to LERF.

86

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension QU-D2 Resolved 1-34 Additional attention should be Basis for Significance: The BFN Internal Events PRA has undergone six F&O Resolved - No applied to significant cutsets to The top accident revisions since the 2009 peer review. It has been Impact on CILRT determine that the bases for the sequence cutset for subjected to several cutset reviews. The intake Interval Extension cutsets are consistent with both CDF and LERF structure model has been modified and clogging of the modeling and operating deals with clogging of intake structure is no longer a significant contributor to The MOR has been philosophies. the intake and includes risk. The review of the significant accident sequences updated and results events that are very is documented in calculation NDN-000-999-2007-0041 reviewed and uncertain. The Revision 6, BFN Probabilistic Risk Assessment - documented based on attention given this Quantification. model control process cutset to minimize the (NEDP-26).

uncertainty associated The review of the CDF and LERF cutsets was with the contributing performed and documented in Attachment D and E of basic events has not the Quantification Notebook. Section 6.3.2.3 of the been sufficient. The Quantification notebook specifies the types of things approach to dealing that were looked at when reviewing the cutsets. The with such important Top 100 cutsets, a sample of 100 cutsets from the cutsets should assure middle and the last 100 cutsets were all reviewed and that the contributors are showed no signs of inconsistencies in logic. In understood and are addition, the top accident sequences were also supported by reviewed as documented in Section 6.3.2.2 of the QU appropriate rigorous Notebook. Each of these were reviewed to determine analyses and/or whether they were appropriate. In regards to the assessment. questions asked, the mechanisms by which 480V AC bus failures become initiating events would be Possible Resolution: documented in the system notebook or initiating event Make sure that the top notebooks, the basis for the 2 CRD pump requirement cutsets (reviewed per is in the success criteria notebook based on the MAAP the PRA Procedures) runs in the Thermal Hydraulics calculation, the are discussed and conservatisms related to modeling transients with stuck evaluated. During the open MSIVs directly as LERF events would be in the quantification process Accident Sequence notebook.[28]

make sure that an evaluation is performed in addition to capturing the results.

87

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension HR-D5 Resolved 2-14 HFL_1003_CCFT0056 is Basis for Significance: The F&O relates to all of the pre-initiators that F&O Resolved - No Common cause miscalibration of The pair CCFs will have accounted for common miscalibration errors. Fault Impact on CILRT HR-C3 all 4 level transmitters, inspection a higher value than the trees have been updated and calculation NDN-000- Interval Extension of the fault tree shows that 4 of 4 event thus impact 999-2007-0032 Rev. 4, HR - BFN Probabilistic Risk specific pairs of failures (AC, BD) the results. Assessment - Human Reliability Analysis has been would also cause a failure to revised to reflect this change. HFL_1003_LT56A, initiate the logic. These CCF pairs Possible Resolution: HFL_1003_LT56B, HFL_1003_LT56C, and should be added to the model. Calculate the pair CCFs HFL_1003_LT56D have been added to the model.

This will apply to other and add to the fault tree miscalibration CCFs also.

SY-A3 Resolved 2-23 In section 3.2.6.1 of the HVAC- Given Priority 2 Failure of the operating ACU to trip has been added to F&O Resolved - No system notebook, it states that because model change the model as a failure mode of the standby ACU. Impact on CILRT the running ACU for Unit 3 may be required. Interval Extension electric boards must be tripped Since the original resolution of this F&O was before the standby unit can be Basis for Significance developed, room heatup calculations have been SR SY-A3 was started. Failure of this trip to A breaker failing to developed which shows the HVAC System is not assessed as MET for occur is not reflected in the fault provide tripped required for the Unit 3 Electric Board Rooms. The Category 2 in the May tree. indication for a start model was modified to add a switch that removes the 2009 Peer Review.

permissive can happen HVAC System dependency from the Unit 3 4kV electric and this failure mode boards.

should be included.

Possible Resolution:

Include running ACU fail to trip (indicate as tripped) as a start failure for the standby ACU.

SY-A5 Resolved 2-31 For SPC and LPCI, the LPCI Priority 2 is given The injection valves need to change position for split F&O Resolved - No injection valves and SPC return because of the potential LPCI/SPC flow; two valves would have to fail to cycle Impact on CILRT SY-A13 valves are required to reposition for model changes. or close in either path to fail either system. Interval Extension when swapping RHR modes, but this is not included in the model. Basis for Significance: An operator interview was conducted to discuss the The RHR system notebook All active components method of modeling LPCI and SPC in the transient event tree and a concern that either LPCI injection SRs SY-A5 and SY-A13 indicates that these valves need should be included in were assessed as MET to close for the opposite function. the failure modes of a valves or SPC torus supply valves would have to close if LPCI and SPC both had to be successful on the for Category 2 in the However in one location in the system. May 2009 Peer Review.

notebook it is indicated that flow same RHR loop. The following was concluded from can be split between LPCI and Possible Resolution:

88

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SPC. Add failure mode to the this conversation:

fault trees and clarify documentation 1. If either LPCI or SPC did have to be isolated, then two MOVs on either system would have to fail to close in order to fail to isolate the system. Each valve has a different power supply.

2. The operators may either initiate LPCI to fill up the vessel and then shut the pump off, or they may use just enough LPCI injection to maintain level and divert the rest back to the suppression pool. The only difference in the latter mode and the mode in question is the use of the RHR heat exchangers.

3. The normally open LPCI injection valve FCV 52(66) would have to modulate in order to allow adequate SPC flow to prevent pump run out, or the normally closed LPCI injection valve FCV-74-53(67) would have to fail to modulate.

The common cause failure probability of two MOVs to close is less than 1E-5. The RHR pump start failure probability is approximately 1.4E-3. The failure of two MOVs to close is less than 2 orders of magnitude lower than another failure that would fail the system in a similar manner. Therefore, failure to close (or cycle) either the LPCI or SPC injection path can be neglected. Calculation NDN-000-074-2007-0025 Revision 3, SY.19 - BFN Probabilistic Risk Assessment - Residual Heat Removal was modified to reflect this and the operator interview was added.

LE-D1 Resolved 2-35 The containment structural Basis for Significance: Calculation NDN-000-999-2007-0037 Revision 3, F&O Resolved - No analysis does not address the All three unit LE.01 - BFN Probabilistic Risk Assessment - LERF Impact on CILRT Unit 3 primary containment containments must be Analysis calculations are applicable to all three BFN Interval Extension ultimate capacity in section 6.3. addressed. units. However, much of the previous work, including industry studies, has been based on BFN Unit 1. SR LE-D1 was Possible Resolution: Thus, the plant description in the LERF analysis NDN- assessed as MET for Address the Unit 3 000-999- that specifically applies to Unit 1 is Category 2 in the May containment ultimate supplemented with a discussion of unit differences. 2009 Peer Review.

capability. The unit differences are examined from the perspective of LERF and it is concluded that the minor differences between the units do not impact the LERF quantification.

89

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IE-A7 Resolved 3-7 Scheduled manual shutdowns IE-A7 is related to this Calculation NDN-000-999-2007-0030 Revision 2, F&O Resolved - No (especially for refueling outages) F&O. SR is met. IE.01 - BFN Probabilistic Risk Assessment - Initiating Impact on CILRT should not be included in the Event Analysis, describes treatment of manual Interval Extension statistical basis for the scram Basis for Significance shutdowns which have been conservatively initiator. This can lead to an CRNM ASME Standard consolidated with automatic reactor scrams. There SR IE-A7 was assessed overly conservative scram initiator Interpretation #5 (for are no identifiable plant response differences between as MET for Category 2 frequency. FAQ 06-1060) states automatic and manual shutdown above low power in the May 2009 Peer that normal controlled situations. Low power manual shutdowns will be Review.

Note that CNRM interpretation for shutdowns should not included in the Low Power/Shutdown PRA at a future FAQ 06-1060 (should non-forced be included when date.

manual trips which are part of the counting initiating normal shutdown procedure be events. The current Manual Scrams have been broken up into its own counted) states that 'a normal practice at Browns initiator in the MOR R7. Further refinement of the controlled shutdown would not Ferry regarding this manual scram initiator is currently being investigated present the same challenges as a item, therefore, does and will be included once finished. Since the results trip from full power if the manual not meet the are conservative without the refinement, the model will trip was prompted by conditions requirements of the continue to use the unrefined manual scram initiator.[28]

other than the normal shutdown standard.

procedure which could occur at full power, it should be counted. Possible Resolution Remove planned shutdowns from the SCRAM initiator data set.

HR-I3 Resolved 3-10 Modeling uncertainty comes from Basis for Significance Identified sources of uncertainty are documented in F&O Resolved - No two general types of issues, plant Sources of uncertainty Table A8-1 of calculation NDN-000-999-2007-0041 Impact on CILRT IE-D3 specific and generic. Plant must be identified and Revision 6, QU - BFN Probabilistic Risk Assessment - Interval Extension LE-F3 specific uncertainties and documented. Quantification per SR QU-E1 and QU-E2 of ASME assumptions should be identified Possible Resolution RA-Sa 2009 Addendum B. Parametric, model, and SY-C3 and documented during the NUREG-1855 and EPRI completeness model development. The generic 1016737 provide an Key modeling uncertainties (e.g., HVAC System uncertainties have been SC-C3 sources of uncertainty are listed acceptable approach to dependencies and intake structure plugging) are addressed.

in EPRI Report 1016737 Table A- identifying, addressed in the Quantification calculation in the QU-E2 various accident sequence contribution discussions.

1. Both types of uncertainties documenting and QU-E4 must be addressed for the base characterizing sources The requirements and procedures for characterizing model. of uncertainty. Use this generic and plant-specific modeling uncertainties are QU-F4 method or a similar specified in SR QU-E4 of ASME-ANS RA-Sa 2009, RG QU-E1 Examples of plant specific method. 1.200, Revision 2, NUREG 1855, and EPRI-1016737.

uncertainties include: These requirements and procedures were formalized DA-E3 (1) ISLOCA valve failing to close shortly before the 2009 peer review for BFN. The after testing is not listed in the additional requirements for ASME-ANS RA-S 2009 are sources of uncertainty, nor is the 90

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension conditional probability that the documented in revision 6 of the BFN PRA model.

break is greater than 93 or 600 gpm. EPRI Report 1016737 was looked at to confirm that (2) For Initiating Events, the BFN models uncertainty consistently. A discussion of factors affecting INTAKE initiating how BFN models uncertainty and meets this report is event is not included in the located in Section 2.7.[47]

assumptions section, nor are any of the other assumptions in the analysis.

(3) Specific assumptions for the detailed HFEs is not discussed, including assumptions made for timing of operator responses (versus analyzed or those observed on a simulator).

SC-A5 Resolved 3-12 There is no evidence of an Basis for Significance: General Transient sequence GTRAN_S002 is a non- F&O Resolved - No analysis for sequences that go A CC II/III for SC-A5 Inadvertent opening of a relief valve/stuck open relief Impact on CILRT beyond the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period to requires that options valve (IORV/SORV) success sequence with successful Interval Extension evaluate the appropriate other than assuming SPC and long term HPCI or RCIC. MAAP (Modular treatment relative to the CC II/III sequences in which a Accident Analysis Program) analysis show HPCI and requirements for SC-A5. stable state has not RCIC can be successful for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with been reached in 24 effective SPC. Drywell temperature, however, hours goes to core increases throughout this sequence due to heat damage. transfer from the vessel and drywell piping (drywell fan coil units are not credited). MAAP analysis shows Possible Resolution: drywell temperature increases to, but does not Perform and document surpass, 300 within a 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> analysis time duration.

an analysis of The EOIs require the operators to emergency sequences that do not depressurize when drywell temperature reaches 281 achieve a stable state in . This will fail HPCI and RCIC and prevent further 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to determine high pressure injection. This sequence was analyzed which of the options by interviews with operators and review of other non-presented in the SR MAAP analysis to determine 1) if the operators would would be a most emergency depressurize if there were no low pressure appropriate disposition injection sources available, and 2) if the MAAP for that sequence. analysis was reasonable.

Then change the PRA model accordingly. Operator interviews determined that the operators would emergency depressurize when instructed by the EOIs even if no low pressure injection systems were available. A review of General Electric calculation W79 040331 003 confirmed the conclusions drawn from the 91

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension MAAP results.

As a result of the above analysis, the sequence was changed to require successful low pressure injection for sequence success.

Basis for Safe and Stable for HFA_0085ALIGNCST -

During a single unit accident, refill of the CST inventory is credited in the model (HFA_0085ALIGNCST) by refilling from the non-accident units CST. During a multi-unit accident, it is assumed that the TSC would direct the operators to provide additional inventory to the CSTs from an outside source given the CST depletion would not occur for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This assumption is not documented in the current model.[28]

• It is already considered in the cognitive analysis for HFA_0085ALIGNCST and the assumption that the TSC would direct operators to provide additional inventory to the CSTs is documented in the HRA Notebook. The alarm response procedures 1(2,3)-

ARP-9-6B provides a list of alternative sources including: 1) Hotwell or Radwaste transfer to CST, 2)

Demin or another CST transfer to the affected CST, and 3) CST Crosstie. The TSC and OSC would determine and perform the appropriate actions based on conditions at the plant and the choices identified in ARP.[28]

92

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension QU-F2 Resolved 3-28 A detailed discussion of the Basis for Significance: Calculation NDN-000-999-2007-0041 Revision 6, QU F&O Resolved - No quantification asymmetries (with This is an important part - BFN Probabilistic Risk Assessment - Quantification Impact on CILRT respect to different units, system of the quantification documents unit differences that impact the Interval Extension alignments, etc.) is not presented. documentation process. quantification results.

Possible Resolution: This calculation documents the quantification of all A detailed discussion three BFN units. Unit differences are explicitly of the quantification addressed in the system fault tree models. Some unit asymmetries (with differences have a significant impact on the respect to different quantification results as follows:

units, system alignments, etc.) should 1. The HVAC dependencies on electrical boards have be presented in the a significant impact on the results. The Units 1 and 2 Quantification electrical boards are cooled by air conditioning units Notebook. that depend on chillers. The Units 3 electrical boards are cooled by air conditioning units that depend on EECW.

2. The USSTs supply power to the 4-kV shutdown boards via the unit boards and shutdown buses (Units 1 and 2 only; there is no shutdown bus for Unit 3). This allows Unit 1 or 2 to experience a single unit LOOP and still utilize the shutdown buses to power the respective 4kV shutdown boards.

The QU Notebook Section 4.3 was expanded to include specific differences that impact the results between units. The numbering was also revised in the QU notebook.[28]

93

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension QU-D6 Resolved 3-31 The definitions for significant Basis for Significance: Calculation NDN-000-999-2007-0041 Revision 6, "QU F&O Resolved - No when presenting lists of important This issue causes the - BFN Probabilistic Risk Assessment - Quantification Impact on CILRT QU-F3 equipment, operator actions, etc. supporting requirement Section 6.3.2.2 was revised to indicate significant Interval Extension QU-F6 do not always conform to the QU-F6 not to be met. accident sequences were those that contributed at strict ASME standard definition of least 1% to CDF or at least 1% to LERF. The definition Documentation Issue LE-G6 significant. Justifications for the Possible Resolution: of significant accident sequences now appropriately only.

alternatives used are not When presenting lists of reflects that of the ASME standard.[28]

presented. significant equipment strictly adhere to the ASME standard definition or present a rationale for using an alternative.

HR-G2 Resolved 4-18 Some operator actions assume Basis for Significance In general, errors of omission in execution were not F&O Resolved - No that the execution failure Execution failure is a modeled when execution entails a single action. Impact on CILRT probability (Pe) is 0.0. required part of the Skipping the step in the procedure is accounted for in Interval Extension HEP calculation, and the cognitive portion; for a single execution step, it is Example 1: Several operator the argument for non-sensical to say that the step is not skipped, but SR HR-G2 was actions for ATWS scenarios (e.g., ignoring execution that the execution is not performed. There still could be assessed as MET for HFA_1063SLCINJECT: Failure to failure is not necessarily a commission error in execution (that is, trying to Category 2 in the May SLC in response to an ATWS compelling, especially implement the action but doing it wrong), even if there 2009 Peer Review.

event) assume the execution for maintaining level is a single execution step. TVA staff considered failure probability (Pe) is 0.0. (HFA_0_ATWSLEVEL). plant data and judged Some of the actions for With respect to the events listed by the reviewer, they are documented in the HRA Calculator files, with that the most recent Example 2: Operator action which Pe is not history is most HFA_0024RCWINTAKE (Failure considered are exception to HFA_0024IFISOL which had been updated to include execution errors. applicable of the current to clear debris at intake before important to the overall as-operated plant. It reactor scram) assumes an results. The following is from Reference 28: is justifiable to screen execution error of 0.0 based on Execution error has not been included for ADS inhibit break-in period events the following: 'Cleaning traveling Note 1: The explanation given for no execution (HFA_0_ADSINHIBIT). This is modeled only for from the history of a screens does not relate to a ATWS in the PRA. There is a single step to implement stably operating plant.

series of manual actions, but to failure for HFA_0_ATWSLEVEL this action, errors of omission are integral to the BFN justification is an effort among several cognitive error to omit the action. Errors of commission judged adequate and operators. It is assumed that, if describes the actions required for starting are neglected because the action to inhibit ADS is appropriate.

the action is initiated within 1 hr, it unique (no transition to any EOI Appendix is required, will be successful.' The same SLC (HFA_1063SLCINJECT and there are several places in the EOI that call for rationale is provided for no inhibiting ADS), and because it is routinely performed execution error in )

for every reactor scram, graphically distinct and HFA_0027INTAKE. Note 2: Cleaning debris performed after SLC.

from traveling screens is not a simple action, Execution error was added for SLC. This is a time critical operator action, and the EOI specifies the 94

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension an assumption, that if appropriate steps required in EOI-Appendix 3A. While the actions are started the actions are simple, these require transition they are guaranteed to between procedures for the execution, so it is be completed in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, appropriate to include execution errors.

is not justified.

HFA_0_ATWSLEVEL -Execution errors are included Possible Resolution for this event. NO CHANGE.

Include Pe in the quantification of HFA_0024RCWINTAKE - Execution error set to zero HFA_1063SLCINJECT, and it deemed not necessary to add detail for this HFA_0_ADSINHIBIT, activity. Clearing traveling screens does not relate to HFA_0_ATWSLEVEL, a series of manual actions, but to an effort among HFA_0024RCWINTAK several operators, so errors of execution are in parallel E and and considered unlikely. It is assumed that, if the HFA_0027INTAKE. action is initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, it will be successful (i.e.

Insure that execution only the cognitive error is included). The RCW system errors are considered is supplied river water from the CCW conduits of each appropriately in other unit through fine mesh strainers that include a dP HEPs, as well. alarm. Pumps are run periodically to avoid fouling.

HFA_0027INTAKE - Basic event is not in the model.

NO CHANGE HFA_0IR2_LPI -Execution errors are included for this event. NO CHANGE.

HFA_0024IFISOL - This event is not used in the PRA model. NO CHANGE.

QU-C2 Resolved 4-21 The joint HEP for several Basis for Significance: Section 5.3.3.6 of NUREG -1792 states that the total F&O Resolved - No combined operator actions are If the joint HEP for combined probability of all the HFEs in the same Impact on CILRT HR-I3 too low and cannot be justified. combined events is too accident sequence/cutset should not be less than a Interval Extension HR-G7 Specifically, three combined low, sequence and justified value. A suggested floor value of 1.0E-05 is actions have joint HEPs of less overall results may be provided based on potential dependent failure modes The MOR uses a than 1E-7, and eight are less than artificially lowered, and that are not typically treated. minimum joint HEP 1E-6. Note that the HRA the importance of the threshold of 1E-7 acknowledges these low operator actions may be The HRA Calculator provides the capability to explicitly because the large combined HEPs, but does not understated. calculate the joint probability of dependent and number of independent enforce any lower bound. independent post-initiator HFEs in the same accident operator errors and Further, it states that a sensitivity Possible Resolution: sequence/cutset: This methodology improvement associated combinations will be performed in the Establish a reasonable reduces the need for a threshold value. Overly skew the results Quantification Notebook, but lower bound for conservative threshold values have the potential for conservatively.

none is performed. combined HFE skewing the results. Sensitivity evaluations probabilities. Perform using different The MOR uses a floor value of 1.0E-07 because of the thresholds are included sensitivities to large number of independent operator errors and 95

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension determine the associated combinations skew the results in a in Section 6.18.

significance of this conservative direction.

lower bound.

The following is from Reference 28:

Basis for JHEP floor value (The floor value applied in the dependency analysis lacks a justification for divergence from industry standards and it has a significant impact on BFN results. In addition, the automated HRAC dependency process does not account for intervening successes in the accident sequences, which is an element of this SR).

The HRA floor value recommended by is 1E-5.

However, this arbitrary value tends to skew the PRA results. The HRA industry group has been working on developing guidance for the minimum Joint Human Error Probability to be used in PRA, but this guidance is not available at this time. However, as recommended by EPRI HRAUG, sensitivity #3 is included in the quantification notebook to determine the impact of the selected floor value.

HR-F2 Resolved 4-25 There are many operator actions Basis for Significance HFEs have been reviewed and detailed analyses have F&O Resolved - No that use screening values; see Without any real timing been performed for many HFEs that previously used Impact on CILRT HR-G4 Table 8 of the HRA. None of information, it is not screening values. All significant HFEs have detailed Interval Extension HR-G5 these actions appear to use any possible to estimate, analyses. In addition, timing analyses have been information to base the time even at a screening reviewed. Timing is based primarily on plant specific available and the times to level, the probability of MAAP calculations, timing from BFN simulator operator cues and perform the operator failure or exercises, or estimates from BFN operator interviews.

actions are not documented. success. In response to this comment, updated timing analyses have been re-reviewed by BFN operations staff and Possible Resolution: additional changes have been incorporated.

Provide timing information for all operator actions, All model changes are included in calculation NDN-including those HEPs 000-999-NDN-000-999-2007-0032 Rev. 4, HR - BFN estimated by using Probabilistic Risk Assessment - Human Reliability screening values. Analysis.

The BFN resolution to this is documented in Section 2.4.47] of calculation NDN-000-999-NDN-000-999-2007-0032.

96

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension HR-C1 Resolved 4-28 Non-screened miscalibration Basis for Significance: Calculation NDN-000-999-2007-0032 Revision 4, BFN F&O Resolved - No events are not provided with The requirements of Probabilistic Risk Assessment - Human Reliability Impact on CILRT designators in Appendix A of the HR-C1 cannot be Analysis, Appendix A Screening of Routine Interval Extension HRA. Thus HFEs associated with verified due to lack of Procedures for Relevance to Pre-Initiator Human these miscalibration events traceability from HRA Failure Events had been updated, subsequent to the SR HR-C1 was cannot be readily determined. Appendix A table to the 2009 peer-review to include the designators for the assessed as MET for rest of the pre-initiator non-screened miscalibration events to provide Category 2 in the July analysis. traceability. 2015 Peer Review.

Possible Resolution: A table has been added to Appendix A of the HRA For miscalibration Notebook that list all the pre-initiator CCF HFEs.[28 events, provide traceability from Table A of the HRA to the remainder of the pre-initiator analysis and the PRA model.

HR-A1 Resolved 4-29 The list of activities reviewed in Basis for Significance: A focus on review of procedures that may be different F&O Resolved - No the HRA Appendix A table is The review of between the units was performed. No changes were Impact on CILRT HR-A2 primarily focused on Unit 2 or Unit procedures should not made to the pre-initiators as a result of this review. Interval Extension 0 SRs and SIs. There are a few be limited to one unit.

Unit 1 procedures listed, but it is Differences between As mentioned on Section 4.3 of the HRA notebook, the SRs HR-A1 and HR-A1 not clear why certain procedures units may present operating practices, staffing and training for all three were assessed as MET from Unit 1 are reviewed but not additional pre-initiator units are identical. Differences that could relate to the for Category 2 in the others. actions. Although the HRA are reflected in the system fault trees. The May 2009 Peer Review.

one example found procedures were reviewed and only one unit was More importantly, there do not would not likely result in referenced for each different procedure in the HRA appear to be any Unit 3 a pre-initiator, the point notebook. This is because each unit has the same procedures reviewed. A sample is that there are steps within the procedure and the only thing that review of one procedure between differences between the would be different would be specific UNIDs, but the all three units (3.5.1.5(CS I)) units' procedures. overall result would be the same.[28]

found that the Units 1/2 tests affected two relays that are not Possible Resolution:

tested in the Unit 3 procedure. A more complete review of the procedures for all three units is warranted.

There should at least be a focus on procedures for systems that may be different between the units.

97

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SY-A8 Resolved 4-32 Several electrical system boards Priority 1 because The EDG logic to start and load (close output breaker) F&O Resolved - No are modeled to receive power model change is is currently modeled. The component description for Impact on CILRT SY-B9 from multiple sources ( e.g., required. the circuit breaker component in Appendix A of Interval Extension normal and alternate buses, NUREG/CR-6928 states:

and/or EDGs) without considering Basis for Significance: SRs SY-A8 and SY-B9 the need for undervoltage Component boundaries The circuit breaker (CBK) is defined as the breaker were assessed as MET detection and operation circuitry for breakers do not itself and local instrumentation and control circuitry. for Category 2 in the for breakers and EDGs. include such circuitry, External equipment used to monitor under voltage, May 2009 Peer Review.

based on NUREG/CR- ground faults, differential faults, and other protection 6928. Note that local schemes for individual breakers are considered part of circuitry and protection the breaker.

devices are included. External equipment used to monitor under voltage is considered part of the breaker. The modeling of Possible Resolution: automatic bus transfer in the BFN model contains both Review component the normal supply breaker failure to open (FTO), and boundaries and the alternate supply breaker failure to close (FTC).

modeled events for Since both failure modes are included, and the data automatic electrical bus from NUREG/CR-6928 includes under voltage transfers. detection in the breaker boundary, the current modeling methodology is appropriate.

No model change was required.

98

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SY-A19 Resolved 4-33 The unavailability or failure of a Priority 2 because The failure of the bus has been added to the BFN PRA F&O Resolved - No bus is not considered in the logic Model change is model. The applicable 4 kV shutdown board failure Impact on CILRT used to provide alternate required. has been added to gates U1_SDREC_A, Interval Extension electrical power supplies to other U2_SDREC_A, U3_SDREC_A, U1_SDREC_B, buses and boards. Example: Basis for Significance: U2_SDREC_B, U3_SDREC_B, U1_SDREC_C, SR SY-A19 was U1_SDREC_A is used to re- Unavailability or failure U2_SDREC_C, U3_SDREC_C, U1_SDREC_D, assessed as MET for energize 4kV SD Board A from of the alternate power U2_SDREC_D, and U3_SDREC_D. Category 2 in the May 4kV SD Board 3A. However, the supply would prevent 2009 Peer Review.

unavailability or failure of 4kV SD being able to credit it as Board 3A does not fail the an alternate source.

function (it should). Although the failure probability of a bus is much less than the failure probability of other equipment that could affect the power transfer (e.g., breaker demand failure), the unavailability could be substantial, especially during an outage Possible Resolution:

Include unavailability and/or bus failures as appropriate, or justify not modeling due to low failure probability.

99

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension QU-D2 Resolved 4-36 The assumption that A HVAC is Basis for Significance: The running and standby flags for the HVAC System F&O Resolved - No normally running and B HVAC is The assumption that trains have been changed to 0.5 to represent equal Impact on CILRT QU-D7 in standby leads to skewed basic one train is always running times for all trains. Interval Extension QU-F2 event importance's and non- normally running (the sensical cutsets. HVAC is only an To prevent non-sensical cutsets, the mutually exclusive The majority of the example) does not (MUTEX) logic was expanded to include all events HVAC System For example, with A HVAC reflect the plant under the unit start gates (any failure event that only dependencies have always running: operation, and can occurs during a unit start). In order to ensure proper been removed from both (1) The Loss of RMOV Board A result in skewed application of the failure of a unit to start, the AHU fails the internal events PRA importance is much higher than importance results or to start after a LOOP event was made unique by models. The stated RMOV Board B (10% vs. 2.5%) missing adding a _LOOP to the event name. resolution still applies to (2) Non-sensical cutsets exist, cutsets/sequences (i.e., the remaining HVAC such as where RMOV Board A is how would the results The run and standby flags have been reviewed and the System dependencies.

in maintenance and B HVAC fails be different if the other model is reflective of the normal operating to start (due to operator or train were assumed to configuration. A sensitivity was run on the PCS pump hardware failure). be running?). configuration which is documented in the QU notebook. This sensitivity showed no change to Possible Resolution: CDF/LERF for any unit.[28]

Potential resolution is to remove flag settings for what train is normally running, and use flag events to represent the fraction of time that a given train is running and standby (e.g., 0.5).

100

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension HR-H3 Resolved 4-40 A review of non-significant Basis for Dependency analysis has been re-performed and F&O Resolved - No cutsets found many LOOP Significance: results are documented in the TVA Calculation, Impact on CILRT QU-D5 cutsets that have combinations of This is an example of NDN00099920070032 Rev. 3, HR - BFN Interval Extension two independent HFEs which non-significant cutsets Probabilistic Risk Assessment - Human Reliability should have some level of that, had they been Analysis. A review of non-significant cutsets prior to dependency: reviewed, would have finalizing and documenting results was performed and HFA_02114KVCRSTIE (Failure uncovered the need to was documented in the TVA Calculation, to cross-tie 4kV SD Board) AND perform additional NDN00099920070041 Revision 3, "QU - BFN HFA_0231480SDBTIE (Failure to operator dependency Probabilistic Risk Assessment - Quantification."

provide alternate power to 480V analyses.

SD Board). Section 6.3.2.10 of the QU Notebook R7 was updated Possible Resolution: to include an example of what is looked at during the (1) Re-perform operator non-significant accident sequence review. (See action dependency Section 2.6)[47]

analysis.

(2) Re-perform review of non-significant cutsets prior to finalizing and documenting results.

QU-D3 Resolved 4-41 Offsite power recovery is applied Basis for Significance: The recovery logic/rules have been reviewed to ensure F&O Resolved - No in cutsets where it might not be Recoveries should only that recoveries are not applied to non-recoverable Impact on CILRT possible. See U1 CDF cutset at be applied to scenarios failures The example cited in the F&O is incorrect. If Interval Extension 1.151E-08: LOOP with common or cutsets where the the breakers failed to open, they would still be closed cause failure of shutdown board recovery can be and available for offsite power recovery. SR QU-D3 was normal feeder breakers to open. expected to be assessed as MET for successful. The offsite power recoveries are applied to cutsets that Category 2 in the May involve a loss of offsite power event or a loss of a 2009 Peer Review.

Possible Resolution: diesel generator. Therefore recovering power to the Review recovery shutdown board would still be a viable pathway as at logic/rules to ensure least one shutdown board would still be available. In that recoveries are not the LOOP recovery rules there are some instances applied to non- where battery depletion or HVAC might be lost along recoverable failures. with a LOOP, but this is still a recoverable event as the operator would still have at least one shutdown board available to recover power to.

In addition, a review of the CDF and LERF cutsets was performed and documented in Attachment D and E of the Quantification Notebook. The Top 100 cutsets, a sample of 100 cutsets from the middle and the last 100 cutsets were all reviewed and there were no identified instances where recoveries were applied 101

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension to non-recoverable failures.[28]

SY-A8 Resolved 4-42 Table 3 of the data notebook says Basis for Significance: The output breakers (1818, 1822, 1812, 1816, 1838, F&O Resolved - No that EDG boundaries included the Apparent inconsistency 1842, 1832, and 1836) are no longer explicitly Impact on CILRT output breakers, but the EDG in data and component modeled, but within the boundary of the EDG. Interval Extension system notebook and the model boundary definitions. Calculations NDN-000-082-2007-0012 Revision 4, have them as separate events. "SY.05 - BFN Probabilistic Risk Assessment - SR SY-A8 was NUREG/CR-6928 lists breakers Possible Resolution: Emergency Diesel Generator System" and NDN-000- assessed as MET for as WITHIN the boundary of the Resolve discrepancy. 999-2007-0033 Revision 7, "DA.01 - BFN Probabilistic Category 2 in the May EDG. Risk Assessment - Data Analysis" have been updated 2009 Peer Review.

to reflect this change.

LE-C11 Resolved 4-48 No credit is taken for equipment Basis for Significance: LE-C11 states: F&O Resolved - No survivability or human actions LE-C11 implies credit Impact on CILRT LE-C12 following containment failure. be taken for equipment JUSTIFY any credit given for equipment survivability or Interval Extension survivability following continued operation of equipment and operator actions containment failure, for that could be impacted by equipment failure. No undue credit taken Cat II/III. for the operation of equipment that is Possible Resolution: Section 3.1.3 of calculation NDN-000-999-2007-0037 exposed to an extreme REVIEW significant Revision 3, "LE.01 - BFN Probabilistic Risk environment resulting accident progression Assessment - LERF Analysis" contains the following: from core damage and sequences resulting in subsequent containment a large early release to The equipment survivability assessment, based on a breach.

determine if engineering review of the IDCOR Technical Report 17 is analyses can support documented in the Structural Analysis Notebook [NDN-continued equipment 000-999-2007-0038 Revision 36, LE.02 - BFN operation or operator Probabilistic Risk Assessment - Structural Analysis" for actions after BFN Unit 1. NDN-000-999- As long as the drywell containment failure that and torus are intact, it is assumed that the environment could reduce LERF. in the reactor and turbine buildings will not prevent the use of equipment in those buildings. However, at the time of drywell failure, it is assumed in the Level 2 assessment that any active equipment in the torus room, adjacent corner rooms, and anywhere else in the reactor building will not be available due to elevated temperature, humidity, and radiation environments.

Qualitatively, this equipment survivability assessment does not take any undue credit for the operation of equipment that is exposed to an extreme environment resulting from core damage and subsequent 102

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension containment breach.

Therefore, credit given for equipment survivability or continued operation of equipment and operator actions that could be impacted by equipment failure is justified since it is only credited if the containment is still intact.

The significant accident progression sequences resulting in a large early release were reviewed to determine if engineering analyses can support continued equipment operation or operator actions after containment failure that could reduce LERF.

None were identified. This is documented in calculation NDN-000-999-2007-0037 Revision 3, "LE.01 - BFN Probabilistic Risk Assessment - LERF Analysis." Section 7.5, CET Development and Appendix A, Containment Event Tree Nodal Overview.

LE-C10 Resolved 4-50 Although equipment survivability Basis for Significance: Significant large early release sequences have been F&O Resolved - No beyond equipment qualification LE-C10 Cat II/III reviewed to determine where additional equipment Impact on CILRT limits is credited, there is no requirements are to credit may be taken. The significant sequences are Interval Extension indication that significant accident REVIEW significant ISLOCA sequences, Main Steam Breaks Outside of progression sequences were sequences to determine Containment (MSBOC) Sequences and Feedwater reviewed to determine if if engineering analyses Breaks Outside of Containment (FWBOC) sequences.

continued equipment operation can be used to take could be credited to REDUCE credit for additional Section 6.3.1.3 of calculation NDN-000-999-2007-0036 LERF. equipment operation Revision 2, AS - BFN Probabilistic Risk Assessment -

beyond normal Accident Sequence Analysis discusses the equipment qualification limits to credited to prevent LERF for MSBOC and FWBOC reduce LERF. sequences.

Section 6.3.4.5 of calculation NDN-000-999-2007-0039 Possible Resolution: Revision 0, "IE.02 - BFN Probabilistic Risk Assessment Review significant large - Interfacing Systems LOCA Analysis" discusses credit early release for isolating the LOCA before the ECCS pumps are sequences to determine flooded. This is intended to reduce LERF. Credit is where additional based on a review of the ISLOCA cutsets that indicate equipment credit may sufficient time to depressurize the ISLOCA path to be taken. allow isolation. Depressurization is required to facilitate operation of isolation valves at lower differential 103

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension pressure.

The significant accident sequences were reviewed as described in the QU Notebook Section 6.3.2.3.

Equipment survivability was looked at and used where achievable as the discussion in the ISLOCA notebook Section 6.3.4.5 attests. The two cutsets that were brought up were not refined for equipment reliability as they would both involve addition of HRA events while we are already at the floor value with respect to HRA.

Addition of the HRA events would increase the number of combination events which increases the number of HRA recovery rules, and that would in turn increase the time to quantify. There would not be much gain (if any) of LERF either, as the dependency analysis would limit the amount of credit the human action would give.[28]

LE-C1 Resolved 4-51 Class3A (B,C)-006 LERF Basis for Significance: TD2 is successful if Low Pressure Injection (LPI), Core No impact. SRs LE-C1 sequences are non-sensical. In Sequence is invalid Spray (CS), Alternate Vessel Injection (AVI) or Drywell and LE-C8 were LE-C8 these sequences, TD2 succeeds since DWS is assumed Spray (DWS) is available. It is not guaranteed that assessed as MET for (i.e., DW Spray hardware is to work but at the same DWS is the available system. From this perspective, a Category 2 in the May available and operator initiates time be unavailable. subsequent failure of DWS may still be valid. The 2009 Peer Review.

injection per Table A.5.7-1) but Boolean logic works itself out when the failure branch DWS fails later in the CET Possible Resolution: fault tree models are linked in the accident sequence (DWS_ALL_SUP branch is Review and correct quantification.

questioned). CET.

A review of the old CETs indicates that the DWS top is really DWI which does not involve failure of DW sprays. It should only be asked if TD (Injection established to RVP or containment) fails.

The LERF Notebook Attachment A Section A.7.6.1 under the heading Nodes Affected by Success/Failure of (FD/FC) states: The upward path will be used to represent flooding of containment resulting in a release through the drywell vent. This will not be a contributor to LERF if coolant injection is available to the debris, i.e., TD/TR = S. This question is treated in the RME/RBE node. From the RME/RBE node section Table A.10-3, RME6 results in LERF due to the DW vent and the operator action failure to initiate DWS, while RME4 does not contribute to LERF because of the delayed containment failure.[28]

104

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension LE-G2 Resolved 4-54 The method used to quantify split Basis for Significance: Calculation NDN-000-999-2007-0037 Revision 3, BFN F&O Resolved - No fractions was very difficult to Split fraction values Probabilistic Risk Assessment - Large Early Release Impact on CILRT review and appears to be based could not be determined Frequency Analysis Attachment A Containment Event Interval Extension on an old LERF model that is not by the reviewer, and Tree Nodal Overview has been has been revised to consistent with the current Level descriptions for many address this comment. Note that Appendix is now SR LE-G2 was 1 model. The split fraction fault split fractions do not Attachment in the Revision 3 calculation. assessed as MET for trees were not provided. Further, appear to be valid any Category 2 in the May many of the split fraction more. Fault tree events specific to the LERF analysis are 2009 Peer Review.

descriptions provided in Appendix discussed and methodology to obtain split fractions A of LE.01 do not appear to be Possible Resolution: has been revised.

current or are no longer used in Review and update the LERF model. LE.01 Appendix A, As mentioned in the LERF Notebook Attachment A especially to remove Section A.6.4, the detailed phenomenology fault tree discussions or was developed and quantified using RISKMAN and explanations that no has not changed for the current PRA. The nodes are longer apply to the calculated using the old RISKMAN Program and are LERF model. shown in Table A.6-4. The phenomenological basic events do not need to have any importances assessed as they involve no equipment failures and the split fractions are generated using current industry practices.[28]

DA-B2 Resolved 5-3 The data analysis does not Basis for Significance: The plant-specific raw data was reviewed to identify F&O Resolved - No appear to consider outlier The inclusion of outlier any outlier components; none were found. Discussion Impact on CILRT components. components can of the lack of outliers is documented in calculation Interval Extension incorrectly impact the NDN-000-999-2007-0033 Revision 7, "DA.01 - BFN failure rate assigned to Probabilistic Risk Assessment - Data Analysis."

a component group.

Such outlier components should be During the data collection the current grouping of the placed into a separate component is used, however the data analyst looks at suitable component the data and any components that are never tested group. would have little or no data to update the failure rate of the type code in the model with. These are looked at Possible Resolution: and determined whether it is more appropriate to keep Add to Section 6.1.4 of them within the same grouping as they are the same DA.01 a discussion of type of component, experience the same type of how outlier components environmental conditions, and have about the same were analyzed. If type of failure rates or whether they should be put into outlier components a separate grouping. This was the intent of bullet 3 of were not analyzed, then Section 5.0. As shown in the DA Notebook Appendix add such a discussion E, the prior and posterior distributions were reviewed and perform the and it was determined whether generic data was a 105

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension required analysis. suitable representation for BFN.[28]

AS-A7 Resolved 5-5 Section 6.3.2.4.1 of the Accident Basis for Significance A qualitative justification was added to calculation F&O Resolved - No Sequence Analysis states that if The omission of this NDN-000-999-2007-0036 Revision 2, AS - BFN Impact on CILRT Alternate Rod Insertion succeeds sequence could result Probabilistic Risk Assessment - Accident Sequence Interval Extension and either the recirculation pumps in an incorrectly-low Analysis. It states that the frequency of an ATWS fail to trip or the SRVs fail to CDF or cause the induced non-ATWS LOCA is less than the ASME SR AS-A7 was open, then a non-ATWS LOCA analyst to miss standard recommended limit of 1E-7 /rx-yr; therefore is assessed as MET for occurs which is not modeled in important insight about screens from further consideration because of its low Category 2 in the May the PRA. While this new LOCA the event. probability of occurrence. 2009 Peer Review.

might be quantitatively insignificant, no qualitative The AS notebook was updated to explain that not only argument is made to justify its would the ATWS Induced LOCA probability be below Possible Resolution: the ASME initiator frequency cutoff recommended by omission.

Either model the IE-C4 of 1e-7 but would also be bounded by other sequence explicitly or LOCA IEs.[28]

qualitatively justify its omission in the Accident Sequence Analysis.

SY-A11 Resolved 5-7 Control power for the RHRSW Priority 1 because Control power was placed under pump start gates in F&O Resolved - No and RCW pumps is currently model change is the BFN PRA Model for all pumps and air compressors Impact on CILRT AS-B6 modeled such that failure of required. where it was determined that control power was not Interval Extension SY-B9 control power will result in failure necessary to maintain a running pump or compressor.

of the pumps to continue running. Basis for Significance: This model treatment documented in the respective SRs SY-A11, AS-B6, Typically, control power is only Calculations, NDN-000-023-2007-0026 Revision 4, and SY-B9 were Currently the model assessed as MET for needed for starting the pump. overestimates the "SY.20 - BFN Probabilistic Risk Assessment - Residual Heat Removal Service Water System", NDN-000-024- Category 2 in the May dependency on control 2009 Peer Review.

power. 2007-0019 Revision 2, "SY.13 - BFN Probabilistic Risk Assessment - Raw Cooling Water System" and Plant Control Air.

Possible Resolution:

Move the DC control logic under the gate associated with RHRSW and RCW pump start. Review this also for other normally 106

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension running pump fault trees.

IE-A5 Resolved 6-2 Loss of HVAC System as an Basis for Significance Screening of the loss of HVAC System initiating event F&O Resolved - No initiating event is screened, based Modeling changes have is based upon the current calculation NDN-000-999- Impact on CILRT IE-C6 on the 1995 PRA of the event. It resulted in HVAC 2007-0040 Revision 5, "SY.08 - BFN Probabilistic Risk Interval Extension appears the model and the System becoming one Assessment - Heating, Ventilation, and Air assumptions for loss of HVAC of the top 5 systems in Conditioning." BFN plant specific System have changed, and loss the present PRA. Based HVAC System of HVAC System as an initiating on this, a loss of HVAC Discussion of the 1995 PRA model was included to calculations have been event should not be screened. System initiating event add additional insight into the impact of loss of HVAC developed to provide the is likely to be significant System. Discussion of the 1995 PRA model has been basis for the elimination as a contributor to core removed from calculation NDN-000-999-2007-0030 of many of the HVAC damage, and should not Revision 1, "IE.01 - BFN Probabilistic Risk Assessment System dependencies be screened. - Initiating Events Analysis" to avoid confusion in the previously in the PRA future. Calculation NDN-000-999-2007-0040 Revision model. The HVAC Possible Resolution 5, "SY.08 - BFN Probabilistic Risk Assessment - System is no longer a Add Loss of HVAC Heating, Ventilation, and Air Conditioning" states "It is top 5 system in the System initiating not expected that failure of any of these systems will present PRA.

events to the analyzed cause a scram due to the long time available to repair events for the PRA. them, provide a backup, or provide alternate room cooling. Additionally, many of the systems cool areas that do not have high heat loads during normal power operations or do not have equipment necessary for normal operation."

Calculation NDN-000-999-2007-0030 Revision 1, "IE.01 - BFN Probabilistic Risk Assessment - Initiating Events Analysis" has been updated to state The loss of important HVAC System is well annunciated, and heat up calculations show that there is ample time for the operators to restore HVAC System or take procedurally guided steps to prevent unnecessary isolation or SCRAM. Additionally, many of the systems cool areas that do not have high heat loads during normal power operations or do not have equipment necessary for normal operation. For additional 107

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension discussion see calculation NDN-000-999-2007-0040 Revision 5, "SY.08 - BFN Probabilistic Risk Assessment - Heating, Ventilation, and Air Conditioning."

This meets ASME standard IE-C4 part c screening criteria which states the resulting reactor shutdown is not an immediate occurrence. That is, the event does not require the plant to go to shutdown conditions until sufficient time has expired during which the initiating event conditions, with a high degree of certainty (based on supporting calculations), are detected and corrected before normal plant operation is curtailed (either administratively or automatically).

Discussion added to Section 6.2.3.3 and 6.2.3.8 of IE notebook R2. [47]

IE-B4 Resolved 6-5 The calculation of HPCI Steam Basis for Significance DCD BFN-80-707 R19 states: Temperature detectors F&O Resolved - No Lines breaks (IE Section 6.2.3.8) Pipe break in the HPCI shall be located in the HPCI equipment area and shall Impact on CILRT IE-C6 does not appear to be line can affect RCIC initiate isolation before ambient room temperature Interval Extension IE-A5 reasonable, using older EPRI and many other reaches the Environmental Qualification (EQ) data and Wash-1400 data. The components, due to the temperature limits for safety related devices located in resulting steam line break HPCI pump being open this area. This statement with a reference to the calculated is 4.55E-10/year, to other areas. The Design Criteria Document has been added to which does not compare with modeling as calculation NDN-000-999-2007-0030 Revision 1, results from other plants. Using documented does not "IE.01 - BFN Probabilistic Risk Assessment - Initiating newer data, the pipe break provide basis for Events Analysis."

frequencies would likely be 2- screening, and if orders of magnitude higher. reperformed, the The generic MOV FTC value of 1.07E-03/demand from Additionally, although the analysis will likely result NUREG/CR-6928, is now utilized.

isolation valves may be available in orders of magnitude The HPCI MOV FTC CCF probability has been to eventually isolate the break, increases here. updated to the value of 1.41E02 which is consistent the impact of the break may have with NUREG CR/5497 (2007 Version).

already occurred prior to isolation. Possible Resolution Consider including a The updated HPCI Steam Line Break value is 1.93E-Also, the generic MOV FTC value HELB for HPCI in the 09/year. However, this does not change the (from NUREG/CR-6928) in Data PRA. Also, look at the conclusion of calculation NDN-000-999-2007-0030 Table 4 is 1.07E-03/demand. impact of the HPCI Revision 1, "IE.01 - BFN Probabilistic Risk Assessment Finally, the CCF probability used analysis with respect to - Initiating Events Analysis" to not include this IE in the should be changed to the HPCI the RCIC. BFN PRA model.

MOV FTC, with Alpha = 1.41E-

02. The pipe rupture frequency numbers were updated for HPCI, RCIC, and RWCU and a discussion was added to Section 6.2.3.8 (last paragraph) to give rationale for 108

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension screening each BOC (See Section 2.2). Regarding the documentation issue, the HPCI piping references is there for clarity of how the analysis was performed. It is necessary so the reader can understand how the failure rates were established.[47]

IE-C8 Resolved 6-8 RCW initiating event appears to Basis for Significance: The RCW initiator model is described in calculation F&O Resolved - No be incorrectly reduced by factor Loss of RCW initiating NDN-000-024-2007-0019 Revision 2, "SY.13 - BFN Impact on CILRT RCWMTCF for combinations event appears to be Probabilistic Risk Assessment - Raw Cooling Water Interval Extension where the reduction factor does reduced by a factor of System."

not appear to be valid. In 1E-02 from the actual particular, the event is applied to The RCW success criteria states that a net loss of cutsets containing common Possible Resolution three pumps must occur before RCW fails. When this transformer events. Also, Correct the fault tree happens, it is assumed to fail for all thee units and all reduction factor appears to be initiating event for Loss supported equipment. The failure of three RCW pumps calculated incorrectly (1/365)**2. of RCW to get correct is considered a loss of RCW. The frequency is results. calculated by summing all combinations of a failure of three pumps. All combinations of the failure of a single running pump (frequency per yr) and the failure of two additional pumps (probabilities) are included in the system initiating event model.

The Loss of Raw Cooling Water (LRCW) is described in calculation NDN-000-999-2007-0030 Revision 2, 109

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IE.04 - BFN Probabilistic Risk Assessment - Initiating Events Analysis.

110

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IE-C8 Resolved 6-10 CCF for Battery Chargers is not Basis for Significance Common Cause Factors (CCFs) were not included in F&O Resolved - No included in the Initiating Event Can affect the loss of fault tree initiating events with year-long mission times. Impact on CILRT Fault Tree for loss of 2 DC buses, DC initiating events by As stated in Support System Initiating Events: Interval Extension other than for the standby a factor of 10, Identification and Quantification Guideline. EPRI, Palo chargers (not in the yearly failure depending on how CCF Alto, CA, and U.S. Nuclear Regulatory Commission, rate logic). is calculated. Washington, D.C.: 2008. 1016741: Current models and data for common cause failure (CCF) of operating Possible Resolution components are often based on minimal data that have Include CCF under the been evaluated and developed for use in a post-yearly failure rate logic initiator, 24-hour mission time model (which typically or as a top event for all involves some conservatism). While the conservatism loss of DC initiating may be acceptable for a 24-hour mission time, events. extrapolation of this data to model common cause failure frequencies for the year-long mission time used in initiating event modeling often results in frequencies exceeding those observed in industry experience.

Based on the above recommendation, CCF of battery chargers has not been added to the yearly failure rate logic in the Loss of 2 DC bus initiating events fault tree.

The data used for modeling the individual buses is so conservative that it would be overly conservative to include common cause failure. No changes to the model or the documentation are required.

The IE Notebook lists an Assumption about why inclusion of common cause is not included for support system initiators. Inclusion of common cause into the support system initiator development would produce overly conservative initiator frequencies as mentioned in the previous response. In order to obtain a more realistic model TVA decided to leave out the common cause events for initiator development. Inclusion of the common cause for support system initiator development will be reevaluated and incorporated as required following completion of the evaluation.[28]

111

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IE-C14 Resolved 6-13 The impact of Surveillance Basis for Significance: The impact of surveillance procedures for the CS and F&O Resolved - No Procedures is not included in the Unknown impact on the RHR injection paths are addressed in the third through Impact on CILRT ISLOCA Calculation. For ISLOCA Frequency, fifth paragraphs of Section 6.3.1.7 of calculation NDN- Interval Extension example, for Core Spray, without analyzing the 000-999-2007-0039 Revision 0, "IE.02 - BFN Surveillances in the CS Notebook specifics of the site Probabilistic Risk Assessment - Interfacing Systems indicate an MOV opening every procedure. If the LOCA Analysis." The fourth paragraph and remaining 92 days. The likelihood of an procedure has the paragraphs of this section addresses the methodology ISLOCA during this MOV test is operator check used to address the quantification of the surveillance not calculated in the ISLOCA IE downstream pressure test impact.

Fault Tree, including the (etc.) prior to opening sequence where the check valve the MOV, likely there is There is an open permissive interlock between the would have previously failed prior minimal impact. inboard and outboard injection valves that allows both to the surveillance. However, given the valves to be open only when reactor pressure is below ISLOCA has a large the low reactor pressure setpoint. The CS inboard and impact on LERF, the outboard injection valves have in-line valve interlocks impact could be to prevent both valves from being opened with RPV significant. pressure at or above 450 psig. Both receive auto open signals when there is a CS initiation signal and RPV Possible Resolution: pressure is below 450 psig. The inboard valve may be Include the impact of throttled immediately after initiation. Therefore failure Surveillance of the operator to check downstream pressure prior to Procedures in the opening the MOV for testing would not occur due to the ISLOCA Analysis. low pressure permissive interlocks.[28]

112

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SY-A2 Resolved 6-17 System models do not appear to Basis for Significance: The write-up in the system notebooks discussing the F&O Resolved - No incorporate operating experience Review of experience level of SER, OER and LER reviews has been Impact on CILRT in developing the fault tree logic. from BFN and other enhanced. There is no requirement in the ASME Interval Extension RHR Service Water operating plants does not appear standard that requires a detailed listing or discussion of experience does not appear to be to be used in the generic or plant specific experience reviewed. SR SY-A2 was complete or reviewed. HVAC developing the fault tree assessed as MET for System Notebook says LERs and system logic or data. In Therefore, no detailed listing or discussion of the Category 2 in the May OER was reviewed, but none are some cases, review of generic or plant specific experience reviewed needs to 2009 Peer Review.

listed (no evidence of the review). BFN OE is not included be included in the documentation.

Similarly for 120 VAC and others. in the notebooks.

CRD Notebook includes only a discussion of the BFN Fire, but no Possible Resolution:

review of OE is presented. Expand operating experience review and account for any lessons learned in the PRA model.

SY-A14 Resolved 6-20 Event STRPL1STN_0750664, CS Basis for Significance: The core spray suction strainer plugging event was F&O Resolved - No Suction Strainer Plugging, is only Affects multiple added for Medium Loss of Coolant Accident Impact on CILRT assumed for Large LOCA in the Initiating Events. Pre- (MLOCA).All SRVs discharge directly to the Interval Extension Model. The phenomenon causing existing material in the suppression pool, so a stuck open SRV could not plugging is not limited to large Torus can also affect dislodge material from the drywell. Calculation NDN- SR SY-A14 was LOCA only, and is possible on the strainer plugging 000-075-2007-0010 Revision 4, SY.04 - BFN assessed as MET for Medium LOCA, SRV opening, likelihood. Probabilistic Risk Assessment - Core Spray System Category 2 in the May etc. A question was asked to the documents the discussion for this scenario. 2009 Peer Review.

analyst on this, and the reference Possible Resolution:

to the absence of permanently Include CS Suction installed air filters or other Strainer failure for all sources in the drywell. However, applicable LOCA the debris, if present, would be events, including SRV swept into the suction strainer by lift events. It is possible any LOCA. to use different plugging likelihood values for each LOCA size.

113

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension HR-H1 Resolved 6-25 Event HFA_3003P_START_A Basis for The human action HFA_3003P_START_A has been F&O Resolved - No does not appear to be applied Significance: changed to the non unitized name Impact on CILRT correctly in the model. A question Significance is HFA_0003P_START_A. It is used in every situation Interval Extension was asked of the analysts on the unknown, since model where a feedwater pump has to be started (for all three logic, and the response referred modification is required units). One of those cases is where the pump is to gate U3_FWH_INIT for events in order to determine running and is tripped due to excessive feedwater flow.

were FW recovery is not credited. the impact. It is assumed the pump can still be operated but must However, the logic under gate be restarted. This gate is ORd with a gate where the U3_FWH_G50 limits the operator Possible Resolution: feedwater pump is not running and either has to be failure event to only excessive Remove the started or is in T&M. This human action is used in that FW events; resulting in no failures requirement for tree also. There is no incorrect logic with this human coming through for other events excessive FW events action. No changes are necessary.

were FW is credited. only when applying the HFE.

HR-G5 Resolved 6-28 Basis for operator action time (30 Basis for Significance: HFA_0085ALIGNCST is used in fault trees for F&O Resolved - No min) for HFA_0085ALIGNCST Event provides over 5% sequences where the source of inventory from the CST Impact on CILRT appears to be roughly estimated, of CDF. is required for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. A MAAP case documented in Interval Extension as is the time available (7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). calculation NDN-000-999-2008-0006 Revision 3, Possible Resolution: "SC.02 - BFN Probabilistic Risk Assessment - PRA Provide more a more MAAP Thermal Hydraulics Calculation" shows that a accurate assessment single CST will provide adequate inventory for 10 for the timing for hours.

HFA_0085ALIGNCST.

Case 3F used an initial level in the Condensate Storage Tank (CST) of 15 feet (180,000 gallons or 24,060 ft3). The purpose of this case was to allow for a more realistic analysis of the time to core damage following a loss of feedwater with one stuck open safety relief valve. Plant data indicates that the level of the CSTs for all three units is an average of approximately 19 feet and operator interviews reveal that it is plant practice to keep the levels of the CSTs above 15 feet during corresponding unit operation.

The HRA for HFA_0085ALIGNCST has been revised using the 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> time period.

The basis for the tm value and the Tsw value is documented in Section 2.5[47] of the RHA calculation.

114

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension HR-G7 Resolved 6-30 Dependencies between operator Basis for Significance: In general, dependencies between operator actions F&O Resolved - No actions appear to be non- Systematic error have been derived within the rules outlined in the HRA Impact on CILRT QU-C2 conservatively applied. Mainly, affecting around 1/2 of Calculator. In one case, the dependency rules have Interval Extension the Zero Dependence (ZD) the combo events, been over-ridden by a user defined rule. In this between actions is commonly including combo 18. particular case, a note was added stating the reason applied, simply when one of the for the over-ride, which is documented in calculation actions takes longer than 60 Possible Resolution: NDN-000-999-NDN-000-999-20070032 Rev. 4, HR -

minutes. What appears to be the Correct dependency BFN Probabilistic Risk Assessment - Human Reliability mistake is applying the last event analysis in the HRA. Analysis.

tree node in the Dependency Event Tree. In this tree, if the Need to depressurize would arise no less than 2 hr stress of either HFE is moderate after ability to initiate SPC would no longer permit use or high, the upper leg of the event of HPCI/RCIC after CST depletion. This statement is tree is used. SO for combo 2, the under the dependency event tree and occurs for HRA assumes ZD, while the combinations of HFA_0074HPSPC1, Failure to align event tree would designate Low RHR for SPC (non-ATWS/IORV) and Dependency. HFA_0001HPRVD1, Failure to initiate reactor-vessel depressurization (transient or ATWS). The timing for the cues implies that there should be a complete dependence; however the timing for HFA_0074HPSPC1 occurs over 5.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and therefore there is no time dependence. The cue comes in, but the required action has such a long time in which to be accomplished, there is no dependence, hence zero dependence was manually chosen. The note in the calculator is sufficient to address the issue and the discussion in the calculation.

The basis for ZD between early depressurization HFA_0001HPRVD1, and failure to align suppression pool cooling is significant differences, cues and timing.

Early depressurization is associated with failure to maintain RPV level, while failure to align SPC (non-ATWS/IORV) is associated with SP temperature.

MAAP analysis demonstrates that operators have 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to start suppression pool cooling to avoid exceeding 190F and thus eventually impacting HPI systems taking suction from the SP. Since HPCI and RCIC take suction from the CST initially, it would take several hours to deplete the CST prior to any swapping suction to the SP. Early SPC failure was included in the model under late failure for HPI since early failure 115

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension would result in high SP temperature that may preclude late swap over of suctions for HPI.

The basis for the User Defined dependency levels has been added to the HRA calculation in Appendix E.[28]

IE-C8 Resolved 6-36 The ISLOCA Conditional Pipe Basis for Section 6.3.4.2 and Table 6.21 of the TVA Calculation F&O Resolved - No Break Frequencies calculated for Significance: NDN00099920070039 Revision 0, "IE.02 - BFN Impact on CILRT the analysis appear to be too low, ISLOCA is a significant Probabilistic Risk Assessment - Interfacing Systems Interval Extension in comparison with other pants. contributor to LERF LOCA Analysis" were revised to include calculation From NUREG/CR-5102, details for the ISLOCA break frequencies assuming a Appendix F, Table 2, the RHR Possible Resolution: temperature of 600oF.

and CS piping would generally Revise the conditional get a failure probability of 2.65E- pipe break frequencies 02 and 2.54E-03 respectively. to match industry The indicated parameters were updated in MOR 7 to Other reference documents used accepted values, based indicate the documented values. The reference links should get similar results. The on use of RCS were broken when the document was converted into a BFN analysis is supported by and temperature in the CS PDF for record submittal and this was missed prior to Excel Spreadsheet for the and RHR piping. issuance into the vault. The references were fixed for overpressure estimate, and this Benchmarking of other all applicable instances and the specific references for analysis is not included in the plant methods and the tables for section 6 are either labeled directly or system notebook. In the excel values may be useful taken from references 26 and 27 of the ISLOCA spreadsheet it appears the here. Include the notebook. Section 6.3.3 specifies that these are the temperature assumed for the CS overpressure/pipe references for the overpressure analysis.[28]

and RHR analysis assumes room break analysis (excel temperature, where as full RCS spreadsheet) as a part temperature is more appropriate. of the reviewed system notebook.

116

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension SY-B11 Resolved 6-41 Fuel oil transfer pumps to refill the Priority 1 is given NUREG/CR-6928 states that the EDG boundary is the F&O Resolved - No day tank are not part of the EDG because a model is following: Impact on CILRT boundary in NUREG/CR-6928. required. Interval Extension Basis for Significance: The EDG boundary includes the diesel engine with all SR SY-B11 was Issue with EDG components in the exhaust path, electrical generator, assessed as MET for Component Boundary. generator exciter, output breaker, combustion air, lube Category 2 in the May oil systems, fuel oil system, and starting compressed 2009 Peer Review.

Possible Resolution: air system, and local instrumentation and control Add separate failure of circuitry. However, the sequencer is not included. For fuel oil transfer to the the service water system providing cooling to the EDG Fault Tree Model. EDGs, only the devices providing control of cooling flow to the EDG heat exchangers are included. Room heating and ventilating is not included.

Calculation NDN-000-082-2007-0012 Revision 3, SY.05 - BFN Probabilistic Risk Assessment -

Emergency Diesel Generator System documents the modeling for the emergency diesel generator system which defines the fuel oil system as up to the fuel oil day tank including the safety-related fuel oil transfer pumps. Each EDG at BFN has a 550-gallon day tank that provides enough fuel to operate for 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> at full load. Fuel is then transferred from the 40,000-gallon 7-day diesel storage tank with one of two diesel fuel oil safety-related transfer pump to continue operation. There is one 40,000-gallon 7-day diesel storage tank for each diesel generator and it is included in the diesel generator boundary.

The non-safety related pumps that transfer fuel from the 71,000 gallon yard storage tank to the 40,000-gallon 7-day diesel storage tanks are outside the boundary and are not considered in the model.

117

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension AS-A5 Resolved 6-49 The %1INTAKE initiating event is Basis for Significance An intake plugging initiator that scrams all three units F&O Resolved - No modeled in a simplistic manner, %1INTAKE is the and fails RCW was developed from plant specific data. Impact on CILRT and does not appear to represent number 1 CDF and This initiator replaces the current initiator estimate and Interval Extension the expected plant and operating LERF contributor. operator actions in the model. A conditional probability response. On the conservative event of the RHRSW/EECW system failure due to SR AS-A5 was side, the plant in many instances Possible Resolution: intake plugging was developed that replaces the assessed as MET for can reduce power to extend the human action in the model. Category 2 in the May Modify the model to 2009 Peer Review.

time to clean the screens. On the include the factors the non-conservative side, there are The model, along with the calculations listed below affect risk, including have been revised to reflect the refined modeling.

possible events that operator power reductions, actions (cleaning the screens) will screen breakthroughs, NDN-000-999-2007-0036 Revision 2, AS - BFN not prevent plugging, given a very operator actions Probabilistic Risk Assessment - Accident Sequence large amount of material plugging causing screen Analysis, the intake. Additionally, some breakthroughs, and the events could break through the likelihood that an event NDN-000-999-2007-0030 Revision 2, "IE.01 - BFN screens causing plugging of the would occur where Probabilistic Risk Assessment - Initiating Events system (Hx, strainers, or pumps). cleaning activities will Analysis",

The above events have actually not prevent plugging.

occurred at other plants. NDN-000-024-2007-0019 Revision 2, "SY.13 - BFN Other plants have Probabilistic Risk Assessment - Raw Cooling Water typically assumed a System",

single CCF event (much lower in frequency) for NDN-000-023-2007-0026 Revision 4, "SY.20 - BFN plugging of all intakes, Probabilistic Risk Assessment - Residual Heat where operator Removal Service Water System", and response for cleaning is not possible, but with NDN00006720070013 Revision 4, "SY.06 - BFN other sequences where Probabilistic Risk Assessment - Emergency Equipment partial plugging occurs. Cooling Water System."

118

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IE-C11 Resolved 6-50 Some of the MOVs credited in the Basis for Significance: Some MOVs credited for closure for isolation during an F&O Resolved - No ISLOCA Fault Tree are not tested MOVs closing for ISLOCA cannot be shown to close against full reactor Impact on CILRT SY-A22 to close against full DP. These ISLOCA are risk pressure because they are not in the MOVATs 89-10 Interval Extension MOVs are not originally included significant, with a RAW program. Therefore, credit for MOV closure for in the design as RCS isolation of greater than 2. isolation during an ISLOCA event is based on alarmed SRs IE-C11 and SY-A22 valves. Examples include 74-55 procedural actions to reduce RCS pressure as RCS were assessed as MET and 74-66 (note: this is not a Possible Resolution: inventory is discharged through the break. Reduced for Category 2 in the complete list, but 2 of 4 valves Do not credit MOVs in differential pressure across the MOVs allows for May 2009 Peer Review.

reviewed were not in the the ISLOCA without ISLOCA isolation prior to flooding the reactor building MOVATs 89-10 program). verification the valves quads where the ECCS pumps are located. This will close against full DP clarification was added to the second paragraph of of RCS pressure. Section 6.3.4.5 of calculation NDN-000-999-2007-0039 Revision 0, "IE.02 - BFN Probabilistic Risk Assessment - Interfacing Systems LOCA Analysis.

Assumption was added to the ISLOCA Notebook.

Depressurization is not modeled in the ISLOCA initiator before valve closure. The probability of this failing to occur is only 5.077E-02. The fact that all ISLOCA events go directly to core damage without any mitigation actions is more than adequate to make up for not modeling the low probability of SRV failure.[28]

LE-B1 Resolved 7-6 Section 7.1 of BFN Probabilistic Basis for Significance: ASME/ANS RA-Sa-2009 Standard for Level 1/Large F&O Resolved - No Risk Assessment - LERF The SR requires the Early Release Frequency Probabilistic Risk Impact on CILRT Analysis LE.01 directly addresses consideration of unique Assessment for Nuclear Power Plants, Table 2-2.8.9 Interval Extension those contributors from the table, plant issues. LERF Contributors to be Considered identifies but plant specific issues do not potential contributors to LERF for BWR plants with appear to be addressed. Possible Resolution: Mark I containment designs. Each of these LERF Include discussion of contributors is considered in the Browns Ferry PRA plant specific issues through various CET top events as described in that may contribute to calculation NDN-000-999-2007-0037 Revision 3, LERF. "LE.01 - BFN Probabilistic Risk Assessment - LERF Analysis," Attachment A Containment Event Tree Nodal Overview.

There were no plant specific contributors to LERF identified through the LERF Analysis.

119

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension The LERF Notebook Section 7.1 was revised to indicate that MSBOC and FWBOC are both LERF contributors. The common cause failure of the battery was also included as a plant specific contributor to LERF.[28]

LE-B1 Resolved 7-7 The definition of Early appears to Basis for Significance: Calculation NDN-000-999-2007-0037 Revision 3, F&O Resolved - No be inconsistent and may eliminate Definition of the timing "LE.01 - BFN Probabilistic Risk Assessment - LERF Impact on CILRT some scenarios from of accident sequences Analysis" provides clarity with respect to the timing Interval Extension consideration for LERF. determines whether a definition used and includes information that shows the sequence can timing used for each scenario or group of scenarios contribute to LERF. based on the MAAP calculations.

Timing based from accident initiation will be different than timing The referenced EALs do specify a GE at containment from declaration of pressure of 55 psig, however the referenced EALs also General Emergency. specify a GE at a reactor water level not being maintained (ie low). During a loss of decay heat Possible Resolution removal the water level would decrease and HCTL Clarify the timing limits would be exceeded which would signify definition used and impending loss of fission product barriers which would include information that lead to the declaration of the General Emergency. It is shows the timing used TVAs belief that the LERF notebook adequately states for each scenario or the definition of LERF based on the above group of scenarios discussion.[28]

based on the MAAP calculations.

IFEV-A5 Resolved IFEV- For flooding events that cannot N/A The spray and flood frequencies for all applicable F&O Resolved - No A5-03 result in the major flood floods were combined. This is documented in the Impact on CILRT scenario due to limit in the flood calculation NDN-000-999-2007-0031 Revision 0, "IF - Interval Extension source system inventory, the BFN Probabilistic Risk Assessment - Internal Flooding portion of the piping system Analysis.

failure frequencies for major flood should be combined with the flood scenario. In this case, only the flood impact should be 120

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension modeled. For example, the total frequency for the RBCCW flood on El. 593 or El. 565 of Reactor Building (derived from the total piping system failure frequency) was split into three portions based on the possible spill rate:

major flood (> 2,000 gpm), flood (between 100 gpm and 2,000 gpm), and spray (up to 100 gpm).

Even though the RBCCW could not cause the impact of a major flood because of the limited system inventory, the total flood frequency resulting from failure of the RBCCW piping system should be accounted for in modeling the RBCCW-induced flooding scenario (by combining both the major flood frequency and the flood frequency for the flood scenario) since the RBCCW pipe dimension permits a spill rate in excess of 2,000 gpm.

IFEV-A6 Resolved IFEV- Only generic data is used in the N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A6-01 estimation of pipe failure and BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT flooding frequencies including Analysis, Table C-1 Summary of Flood Experience in Interval Extension pressure boundary rupture and the U.S. provides a summary of the internal flooding human-induced breach of events that have occurred at-power in nuclear power boundary. No plant-specific plants within the United States. There is one event in operating experience is the table that was recorded at Browns Ferry; however, accounted for. it was classified as failure of HPCI turbine and was inconsequential as flood. There is no other plant data available to incorporate into the BFN PRA, so only generic data was used.

121

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFEV-A6 Resolved IFEV- It appears that the data used for N/A Browns Ferry is unique in that it has a very large lower F&O Resolved - No A6-02 the Circulating Water expansion area in the turbine building that has to be flooded. This Impact on CILRT joint may not be consistent with is because the lower areas of all three units turbine Interval Extension the latest version of EPRI data as areas are interconnected. Most plants only have to fill documented in EPRI report the area under a single turbine unit before significant 1013141 (Reference 6). damage is encountered. The time available to detect Additionally, it is not clear why the and mitigate this accident is much greater for Browns analysis did not consider the Ferry. This same condition also significantly reduces possibility of flood scenario (i.e., the difference between a small major flood and a leak rate between 100 gpm and large major flood.

2,000 gpm) for expansion joint failure (no justification was given in the IFPRA notebook). The most recent version of EPRI data represents the major flood resulting from expansion joint failure by two separate scenarios:

one between 2,000 gpm and 10,000 gpm, and another one greater than 10,000 gpm.

However, the BFN IFPRA only has one scenario for major flood representing a flood spill rate of more than 2,000 gpm.

122

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFEV-A7 Resolved IFEV- Generic data was used to N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A7-01 estimate the frequency of human- BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT induced flooding scenarios Analysis, Section 6.5 Characterization of Flood Interval Extension associated with maintenance on Scenarios includes a subsection on maintenance-the EECW/RCW system induced flooding. This section systematically (Reference Section 6.5 indicates evaluates all of the systems potentially susceptible to 2 events for EECW in the Reactor maintenance-induced flooding scenarios. The Building (not accounted for in the conclusions from this section have been verified to be BFN IFPRA result), while consistent with Appendix G Initiating Event Frequency Appendix G indicates 1 event for Calculations RCW in the Turbine Building (not clearly documented in Section 6.5)). Systematic evaluation of all of the systems potentially susceptible to this type of flooding scenarios was not consistently provided. Maintenance-related human-induced flooding scenarios are highly plant-specific and system-specific. Using only sparse generic data cannot systematically identify vulnerable areas for human-induced flooding scenarios that may result during power operation; e.g.,

maintenance of the condenser water boxes (opening of the manways for tube plugging),

RBCCW heat exchanger maintenance (opening of the heat exchanger), maintenance of the fire water pre-action/clapper valves, frequent maintenance on the chillers, etc. The description of analysis for operation/maintenance-related flood associated with condenser waterboxes given in the IFPRA notebook indicates that human-induced flood is extremely unlikely because of the local operator monitoring, etc.

However, with the same types of protection, human-induced 123

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension flooding events resulting from condenser waterbox maintenance has actually occurred in the past at other plant. The description of analysis for operation/maintenance-related flood associated with EECW and A/C equipment indicates that human-induced flood is very unlikely because the system is rarely opened for maintenance and local operator monitoring of the proper isolation of chillers.

However, chiller maintenance is actually a quite frequent event.

More thorough and better justifications should be considered, including the size of the possible human-induced leak/flood, etc.

IFEV-B2 Resolved IFEV- It appears that not all of the N/A All assumptions have been documented in the F&O Resolved - No B2-01 assumptions used in the analysis Assumptions section of calculation NDN-000-999- Impact on CILRT were documented; e.g., the 2007-0031 Revision 0, "IF - BFN Probabilistic Risk Interval Extension assumption that the pipe Assessment - Internal Flooding Analysis.

diameters and pipe lengths for the same systems at the same locations are approximately identical among the 3 units was used for some areas, but was not documented.

124

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFEV-B3 Resolved IFEV- Sources of uncertainty and N/A All assumptions are listed in the assumptions section F&O Resolved - No B3-01 relevant assumptions associated of calculation NDN-000-999-2007-0031 Revision 0, "IF Impact on CILRT with potential flood initiating - BFN Probabilistic Risk Assessment - Internal Interval Extension events were not identified Flooding Analysis.

consistently. Table 4-1 did not identify sources of uncertainty Table 4-1 Identification of Key Sources of Uncertainty in calculation NDN-000-999-2007-0031 was revised to .

relative to the flood-induced risk contributors (e.g., frequencies of include additional discussion on potential uncertainties.

failure/leakage/rupture from the various flood sources, and other mitigation factors such as door failure likelihood, etc.).

125

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFQU-A5 Resolved IFQU- Operator actions for flood N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A5-01 mitigation analyzed are not listed BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT in Table F-1 as stated in Section Analysis, Section 6.8 Evaluate Flood Mitigation Interval Extension 6.8. Table 4 in Appendix H Strategies, describes the methodology used to provides the description of two evaluate the flood mitigation strategies. .

actions (i.e., Reactor Building major flood isolation, The HRA performed for the Internal Flooding analysis HFA_0_RXMAJORFLOOD; and is documented in Appendix K of calculation NDN-000-isolation of major RCW flood in 999-2007-0031, Human Reliability Analysis.

Turbine Building, HFA_024RCW- Appendix K includes references to alarm response M with a HEP value of 1.0). The procedures for each modeled human action related to same HEP for flood mitigation. These procedures identify the HFA_0_RXMAJORFLOOD is instrumentation that is relied upon for the detection of a used for all scenarios where this flood event, the identification of the flood source, and action is applied. However, no the location of the breach. These instruments are analysis details (e.g., required to determine the specific operator actions to performance shaping factors such perform to mitigate the breach (e.g., identification of as timing, accessibility, etc.) were specific valves to close for isolation).

documented in the IFPRA notebook for either HFE. Based on a word search, HFA_0_RXMAJORFLOOD was not found in any of the HRA notebooks. It is not clear what instrumentation was relied on for the detection of a flood event and for the identification of the flood source and the location of the breach which are required to determine the specific isolation action to perform (e.g., the specific valves to close for the isolation of the breach).

126

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFQU-A6 Resolved IFQU- The effects of flood on the human N/A The internal flooding documentation was revised to F&O Resolved - No A6-01 actions modeled in the internal address this F&O. Section 6.7 of calculation NDN-000- Impact on CILRT events PRA that are not directly 999-2007-0031 Revision 0, "IF - BFN Probabilistic Risk Interval Extension related to flood mitigation (i.e., Assessment - Internal Flooding Analysis provides the isolation of the flood) may not methodology used for the flood consequence analysis.

have been considered Appendix H of calculation NDN-000-999-2007-0031 consistently. Only one human Revision 0, "IF - BFN Probabilistic Risk Assessment -

action event Internal Flooding Analysis contains the listing of (HFA_0074UNITXTIE) is listed in unscreened initiators, the list of affected components, Table 4 of Appendix H. It is not and the list of impacted Human Actions for each flood clear if this is the only non-flood scenario.

human action in the PRA model for which no credit is taken due to the effects of the flood. Typically, the effects of flood on these human actions may result in either an increase in the HEP (e.g., due to increase in stress, workload, etc.) or failure of the human action (i.e., no credit can be taken for the human action if it is an ex-control room action performed in an area affected by the flooding effects). Additionally, manual isolation action to terminate the flooding scenario may not have been applied to all applicable scenarios where appropriate.

IFQU-A7 Resolved IFQU- The flood-induced CDF and N/A The following provides information that was F&O Resolved - No A7-01 LERF for selected spray documented in calculation NDN-000-999-2007-0031 Impact on CILRT scenarios (e.g., such high Revision 0, "IF - BFN Probabilistic Risk Assessment - Interval Extension CDF/LERF contribution scenarios Internal Flooding Analysis to address this F&O.

as %IFS1RB565-ECS,

%IFS1RB565-RCW, In formulating the potential impacts of specific flood

%IFS3RB565-ECS, sources on PRA-relevant equipment, spray effects

%IFS3RB565-RCW, etc.) are were not explicitly modeled if the impact of the spray probably conservative without was to cause failure of only one component (e.g., one considering some of the unique pump motor). The intent of the flood analysis is to characteristics of water spray; search for potential common causes of failure; failure 127

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension e.g., portion of the piping system of a single component due to spray effects is assumed considered in the calculation of to be captured adequately by the failure rate for the the spray frequency may be component.

outside the spray impact range, equipment within the spray The risk contribution from sprays in the turbine building impact range (360o) may not be is negligible. Sprays would only affect the power damaged simultaneously in the conversion system (PCS). The estimated failure same spray scenario due to the frequency of the PCS due to sprays is at least two directional nature of spray, orders of magnitude lower than other non flood equipment being sprayed on may initiators that assume PCS is failed. Sprays are not necessarily fail even if the considered for a grouping of electrical equipment in component is not designed for one TB corridor.

water intrusion proof, etc. Sprays of jacketed or insulated pipes were not considered since the spray stream would mitigated by the jacket/insulation. Only flood damage due to inundation was considered for these pipes.

Failure due to sprays was not considered for PRA components outside the spray range (10 feet used in this analysis).

Due to the insignificant contribution of internal flooding to overall CDF and LERF (less than 1% in the Revision 5 Model), it is apparent that the spray contributions are not overly conservative.

IFQU-B1 Resolved IFQU- The derivation of the XINIT input N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No B1-01 file and the XINIT input BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT information should be presented Analysis, Appendix H Flood Initiating Events and Interval Extension in the Internal Flood PRA Impacts includes the listing of unscreened initiators, notebook. Table 4 in Appendix H the list of affected components, and the list of human lists the impact of the flood actions. The failed basic events are included in Table scenarios (i.e., components failed H-1 of the calculation.

and human failure events).

However, the specific model elements affected by these flood impacts and incorporated into the PRA model are not documented in the IFPRA report (e.g., how the effects of the initiating event is modeled in the PRA).

128

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFQU-B2 Resolved IFQU- Description should be provided N/A Descriptions of flooding scenarios are provided in F&O Resolved - No B2-01 for each of the top (based on calculation NDN-000-999-2007-0031 Revision 0, "IF - Impact on CILRT CDF/LERF contribution) flooding BFN Probabilistic Risk Assessment - Internal Flooding Interval Extension scenarios presented in the results Analysis, Table 7 Quantification Results for Internal section. Flooding, along with CDF and LERF contributions.

Discussion of the top CDF/LERF flooding scenarios has been added to the results section (Section 7.0).

IFQU-B3 Resolved IFQU- Sources of uncertainty and N/A All assumptions are now listed in the assumptions F&O Resolved - No B3-01 relevant assumptions associated section of calculation NDN-000-999-2007-0031 Impact on CILRT with potential flood initiating Revision 0, "IF - BFN Probabilistic Risk Assessment - Interval Extension events were not identified Internal Flooding Analysis. Table 4-1 Identification of consistently. Table 4-1 did not Key Sources of Uncertainty, was revised to include identify sources of uncertainty more discussion on potential uncertainties.

relative to the flood-induced risk contributors (e.g., Failure probabilities of operator flood mitigation actions, impact of flooding scenarios on the HEPs associated with the non-flood operator actions included in the internal events PRA model, effects of the initiating event group selection for modeling the flooding scenarios in the PRA model, etc.).

IFSN-A10 Resolved IFSN- Flood scenarios resulting from N/A Analysis shows that at least 500,000 gal is required to F&O Resolved - No A10- failure of the CST suction lines flood the RB519 level to a point where equipment is Impact on CILRT 01 causing failure of RCIC or HPCI failed by submergence. The CST maximum volume is Interval Extension were not enumerated in Tables 6- only 375,000 gal; therefore, this flood cannot fail 4, F-1, and Appendix H. Even if components due to submergence. Walk downs have the water inventory in each CST confirmed that all of the PRA components in the is insufficient to cause PRA reactor building basement quadrants (i.e., all four equipment damage in the Reactor corner rooms in each unit) are protected from sprays.

Building basement due to water The CST flooding scenario is therefore screened. This submergence, some PRA discussion has been added to Section 6.5 of the components could still be Internal Flooding calculation NDN-000-999-2007-0031 damaged by spray effects. Revision 0, "IF - BFN Probabilistic Risk Assessment -

Internal Flooding Analysis.

129

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A10 Resolved IFSN- The use of the pre-action fire N/A Discussions with the BFN fire protection engineer F&O Resolved - No A10-02 water system reduces the determined that all of the preaction clapper valves for Impact on CILRT likelihood of flooding resulting the control bay are in the turbine building. Walk downs Interval Extension from failure of the dry pipe provided the pipe lengths and locations for these segments and spurious actuation. sections of fire protection piping in the reactor building.

However, failure of the wet pipe Initiators for these RB flood sources have been segments (i.e., upstream of the included. Turbine building elevation 565 is the only pre-action/clapper valves) in the area that has the water charged sections of fire buildings evaluated could still protection piping. Scenarios involving fire water piping lead to the water spray and are now included in the PRA model.

submergence effects considering the unlimited supply of fire water. The wet pipe segments should be present in the Reactor Building, Turbine Building, and the Control Bay Corridor. No flood submergence scenarios resulting from Fire Water piping system failure are shown in Table 7, Appendix G, and Appendix H.

Only spray scenarios resulting from the Fire Water piping system failure in the Turbine Building are considered in Table 7, Appendix G, and Appendix H.

IFSN-A10 Resolved IFSN- Consideration, analysis, or N/A Walk downs were conducted for all three units. F&O Resolved - No A10-03 documentation of the flood Initiators were developed for all three units for both Impact on CILRT scenarios do not appear to be spray and submergence. Credible spray scenarios Interval Extension consistent between the 3 units. were not screened out. This was reflected in the body For example, The initiating event of calculation NDN-000-999-2007-0031 Revision 0, "IF frequency calculations in - BFN Probabilistic Risk Assessment - Internal Appendix G only include flooding Flooding Analysis as well as in the appendices in a scenarios for Unit 1 and Unit 2 consistent manner.

Raw Cooling Water on El. 593 in Reactor Building, while the walkdown sheet in Appendix A documents the Raw Cooling Water lines on El. 593 in the Unit 3 Reactor Building. However, 130

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension Table 4 in Appendix H includes major flood scenarios resulting from Raw Cooling Water piping system failure on El. 593 in the Reactor Building for all 3 units.

Additionally, the spray effects were not considered for any of these spray, flood, and major flood scenarios. Spray and flood scenarios were screened out even though PRA equipment could be damaged by the spray effects (Reference no probabilistic basis provided to satisfy standard requirement IFEV-A8(b)). Treatment of the spray effects for EECW line failure on El. 565 in the Unit 1 Reactor Building and for piping system failures in the Reactor Building suppression pool area is similar (i.e., spray and flood scenarios were screened out).

131

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A10 Resolved IFSN- Inconsistency exists between N/A The piping in the shutdown board room was found to F&O Resolved - No A10-04 Table F-1, Appendix G and be drain piping from the roof. There is no RCW piping Impact on CILRT Appendix H for failure of the Raw in this room. The shutdown board rooms in the reactor Interval Extension.

Cooling Water piping system in building have no sources including drains that might shutdown board room B on El. allow propagation into the rooms. Documentation has 593 in Reactor Building. Table F- been changed to reflect this. .

1 indicates that both flood and spray scenarios for the RCW line in the shutdown board room B on El. 593 in Unit 1 Reactor Building should be analyzed.

However, Appendix H only includes the frequencies for the major flood and flood scenarios for the RCW line in the shutdown board room B on El.

593 in Unit 1 Reactor Building.

Also, Table F-1 indicates that the spray and major flood scenarios resulting from failure of the RCW piping system in shutdown board room A on El.

621 in Unit 1 Reactor Building are not screened and should be analyzed. However, neither Appendix G nor Appendix H included the analysis of flooding scenarios in shutdown board room A on El. 621 in Unit 1 Reactor Building.

IFSN-A12 Resolved IFSN- Some of the rooms/zones were N/A After the peer review, additional internal flooding F&O Resolved - No A12-01 qualitatively screened out (in analysis was performed on those areas that were Impact on CILRT Table 6-4 and F-1) solely based previously qualitatively screened out (in Table 6-4 and Interval Extension.

on the consideration of flood F-1) solely based on the consideration of flood submergence (i.e., insufficient submergence (i.e., insufficient flood volume); i.e.,

flood volume); i.e., without without considering the possible damage potential by considering the possible damage the spray effects. Spray sources were located, potential by the spray effects. components identified, and sprays assessed in all flood areas of the reactor buildings, control bay, diesel 132

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension generator buildings, and intake pumping station.

Calculation NDN-000-999-2007-0031 Revision 0, "IF -

BFN Probabilistic Risk Assessment - Internal Flooding Analysis was revised to reflect this. turbine building spray was handled differently as discussed in the original flooding report.

IFSN-A12 Resolved IFSN- DG building was screened out N/A Flooding in the EDG building was evaluated in a F&O Resolved - No A12-02 because flood damage to the manner consistent with the other plant areas. Initiators Impact on CILRT EDG equipment would not lead to were included even if they did not cause a reactor Interval Extension.

an automatic reactor scram or scram. The analysis is documented in calculation immediate plant shutdown NDN-000-999-2007-0031 Revision 0, "IF - BFN (Section 6.4). This does not meet Probabilistic Risk Assessment - Internal Flooding the requirement for IFSN-A12 in Analysis.

which an area is only screened out if flooding of the area would not cause an initiating event and would not cause damage to mitigating equipment. To screen out the EDG flood areas in this case, justification should be provided to satisfy PRA standard requirement IFEV-A8(b). Damage to a major component (e.g., EDG) due to spray resulting from failure of other equipment (piping associated with other systems such as EECW) is typically not accounted for in the generic and plant-specific random failure rates of the affected component (Assumption 2 in Section 4.1).

133

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A12 Resolved IFSN- RHRSW/EECW pump bays in the N/A Flooding in the pumping station was evaluated in a F&O Resolved - No A12-03 Pumping Station were screened manner consistent with the other plant areas. Initiators Impact on CILRT out because it was determined were included even if they did not cause a plant reactor Interval Extension.

that there is no PRA impact scram. The analysis is documented in calculation (Section 6.4 and Tables 6-4 and NDN-000-999-2007-0031 Revision 0, "IF - BFN F-1). However, 3 of these pumps Probabilistic Risk Assessment - Internal Flooding could be damaged if one bay is Analysis.

flooded. In accordance with PRA standard requirements IFSN-A12 and IFSN-A13, this flood area should be retained. Note that PRA standard requirement IFEV-A8(b) may not be applicable since multiple components are involved.

IFSN-A12 Resolved IFSN- Some of the flood sources in the N/A Evaluations were performed on the flood sources F&O Resolved - No A12-04 Reactor Building were screened identified in the finding, which were previously Impact on CILRT out (e.g., rupture of EECW piping) screened out. Calculation NDN-000-999-2007-0031 Interval Extension.

because only limited PRA Revision 0, "IF - BFN Probabilistic Risk Assessment -

equipment is damaged (e.g., one Internal Flooding Analysis was updated to reflect the loop of Core Spray, one loop of analysis of the previously screened flood sources.

RHR, or RCIC) requiring no immediate plant shutdown (and Some of the previously screened out flood sources still would not cause an automatic screen out, but for other reasons (e.g., all piping in the scram). See Tables 6-4, F-1, and area is insulated or sheathed so spray of PRA Appendix H. This does not satisfy components is not a concern).

the PRA standard requirements IFSN-A12 and IFSN-A13. To allow screening of these flood areas, justification should be provided to satisfy PRA standard requirement IFEV-A8(b).

134

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A15 Resolved IFSN- Spray scenario resulting from N/A The RBCCW line failures were evaluated further and F&O Resolved - No A15-01 failure of the RBCCW line was not screened just because they may not cause a Impact on CILRT screened out based on the scram. Calculation NDN-000-999-2007-0031 Revision Interval Extension.

consideration that break is not 0, "IF - BFN Probabilistic Risk Assessment - Internal large enough to cause failure of Flooding Analysis was updated to reflect the analysis the RBCCW system and thus will of the potential flood and spray scenarios associated not cause a reactor scram with the RBCCW piping. The flooding due (Tables 6-4 and F-1). This is submergence or spray from RBCCW piping is not a questionable because RBCCW is significant contributor to risk since the piping is a Resolved loop system with no sheathed and the system does not a volume large automatic makeup. Loss of enough to submerge components in the basement of inventory will result in failure of the reactor buildings.

the RBCCW and thus a scram eventually due to impact to its loads.

135

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A5 Resolved IFSN- Table 6-1 in Section 6.1 is N/A Due to the number of PRA components (components F&O Resolved - No A5-01 intended to also identify SSCs for modeled in the PRA that have the potential to affect Impact on CILRT each flood area. However, no the mitigation of core damage or large early release) in Interval Extension.

SSCs are listed in this table. The the flood areas, they are now delineated in Appendix A only section that includes the Walkdown Notes and Appendix H Flooding Initiating SSCs by location is in Table 6- Events and Impacts of the analysis. They include the 3C, Appendix A.2, and Appendix component ID numbers. A component location table, H. However, the flood damage Appendix I Moderate Energy Line Break Analysis (Unit susceptible components listed in 1), has also been included that delineates, in addition Table 6-3C are high level, to the component ID numbers, the component descriptive (does not distinguish locations. The main body of the report was changed to between MOVs/AOVs, etc. and reflect this.

does not include component IDs).

Both Table 6-3C and Appendix A.2 only include SSCs for Appendix H Flooding Initiating Events and Impacts of locations that were walked down. calculation NDN-000-999-2007-0031 Revision 0, "IF -

Similarly, Appendix H does not BFN Probabilistic Risk Assessment - Internal Flooding include all flood areas either. The Analysis has been updated to include all initiating information related to SSCs events for which effects need to be included in the should include the full component PRA. Flood areas that are screened are not included IDs (tag numbers), not just the in this appendix.

train designation and descriptive name. Selected information collected during plant walkdowns should be documented in Appendix A Walkdown Notes of Calculation NDN-Appendix A walkdown sheets 000-999-2007-0031 Revision 0, "IF - BFN Probabilistic (e.g., spray shield, whether the Risk Assessment - Internal Flooding Analysis has component is located within the been updated to include Information collected during spray impact range, etc.). plant walkdowns (e.g., spray shield, whether the component is located within the spray impact range, etc.).

136

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A6 Resolved IFSN- The effects of high energy line N/A The High Energy Line Break analysis was performed F&O Resolved - No A6-01 breaks for Main Steam, earlier for BFN for the power uprate. The HELB report Impact on CILRT Feedwater, RWCU, HPCI steam has been identified in the reference section for this Interval Extension.

supply line, and RCIC steam flooding report. That analysis was limited to break supply line (e.g., jet impingement, scenarios that were successfully isolated (RWCU, high temperature/humidity, pipe HPCI, and RCIC successfully isolated). Main steam whip, etc.) are not fully addressed line and feedwater line breaks that are not successfully and accounted for in the flood isolated are treated in the non-flood PRA model with scenario analysis (see Section break outside containment events that consider the 6.5 under Initiating Events). The initiator frequencies based on line lengths.

detrimental effects of the high energy line break could cause damage to cables and other equipment that would not otherwise be failed by water submergence and spray.

Although this is a Capability Category III issue, it needs to be considered for such application as Risk-Informed Inservice Inspection of Piping. It is possible that the effects of high energy line breaks were already evaluated in the previous RI-ISI program completed for BFN.

137

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A6 Resolved IFSN- The water spray effects may not N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A6-02 have been modeled consistently BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT for all flooding scenarios Analysis Revision 0," has been revised and all spray Interval Extension.

considered. In many instances, scenarios from all sources have been considered and the decisions to not quantitatively either modeled or justification provided for not evaluate the flooding scenarios modeling the spray source.

were based on the consideration of PRA equipment damage due to water submergence only (i.e.,

without considering the damage effects of water spray). For example, only two flooding scenarios were quantitatively considered for the Control Bay, while there may be other spray damage scenarios that should have been quantitatively evaluated.

IFSN-A8 Resolved IFSN- No actual consideration was N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A8-01 given in the evaluation for inter- BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT area propagation through drain Analysis has been revised to include the following Interval Extension.

lines or back flow through drain information.

lines due to failed back flow prevention devices (e.g., check The diesel generator flood areas are served by large valves or other isolation valves). (24) drains to the outside so there are no propagation paths through drains. The intake pumping station rooms are not interconnected by drains so there are no propagation paths through drains.

All of the reactor building drains go to the RB sumps on the 519 level. Most of these drains interconnect on their way to the sumps; however, the same areas have large open hatches or stairwells that go to the 519 level so the drains are immaterial. The only way the drains could cause a problem is if they backed up into a shutdown board room, and the shutdown board rooms do not have any floor drains.

The turbine building drains are immaterial due to the way the flooding analysis is performed in that area.

138

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A9 Resolved IFSN- A screening value of 0.1 is used N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A9-01 for the failure of the door to the air BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT conditioning equipment room at Analysis has been revised to include the following Interval Extension.

El. 606 in Control Bay (IF-CB593- information. Flooding scenarios within the Control Bay DOOR for %IFM1CB606-AC). show propagation from the 606 elevation to the Flooding in this room (resulting stairwell and subsequently to the 593 corridor. At this from failure of the EECW piping level, the continued accumulation of flood water will system) could potentially cause release to the outside through the double door water accumulation to a height in emergency exit doors at the Unit 3 end of the corridor.

excess of several feet according However, a 0.1 factor was applied to the failure of this to the flood height analysis emergency door to release flood waters and to cause performed for 1CB606-ACM the propagation to the battery rooms and battery board (Appendix E). Since this door rooms for the units. This factor of 0.1 is conservative opens outward from the room, the given the glass double door emergency exit opens door could potentially fail with an easily to the outside and the single doors to the internal flood height in excess of adjacent rooms open outward (into the CB corridor).

1 to 4 (per EPRI draft final guideline for IFPRA). As such, the use of a screening value of 0.1 (without actual structural analysis of the door capability) for scenario

%IFM1CB606-AC is probably optimistic. For %IFL1CB606-AC, the flood accumulation in the room could potentially reach to more than 2, which in principle could also cause failure of this door to withstand the static pressure from the flood.

139

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-A9 Resolved IFSN- Flood height calculations for N/A Calculation NDN-000-999-2007-0031 Revision 0, "IF - F&O Resolved - No A9-02 selected Control Bay scenarios BFN Probabilistic Risk Assessment - Internal Flooding Impact on CILRT were provided in Appendix E. For Analysis has been revised to include the following Interval Extension.

Reactor Building and Turbine information. Two RB calculations were performed to Building, however, no calculations obtain timing for 2,000 gpm floods (upper limit for are provided to demonstrate that Flood) and 24,000 gpm floods (upper limit for Major selected flood sources would not Floods). These are the only two calculations needed cause damage to PRA equipment since all reactor building breaks flow to the 519 level due to flood immersion in the without submerging any other area that contains PRA basement. For example, it is equipment that could be failed by submergence.

indicated in the IFPRA notebook that neither CST has sufficient inventory to result in a flood height severe enough to cause failure of the PRA equipment located at the lowest level in the Reactor Building, but no actual analysis is provided to substantiate that conclusion.

140

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSN-B2 Resolved IFSN- Information collected during the N/A Additional walk downs were conducted and F&O Resolved - No B2-03 walkdown should be documented documented. Plant studies and drawings were Impact on CILRT more fully and consistently in the examined to locate all of the PRA components in flood Interval Extension.

walkdown sheets (Reference e.g., areas. . Appendix A Walkdown Notes of calculation the type of doors (normally NDN-000-999-2007-0031 Revision 0, "IF - BFN .

open/Resolved egress door, fire Probabilistic Risk Assessment - Internal Flooding door, door with card key entry, Analysis contains the information collected during the water tight submarine door, etc.), walkdown (Reference e.g., the type of doors (normally floor/wall/ceiling openings, sumps open/Resolved egress door, fire door, door with card and sump capacity, sump level key entry, water tight submarine door, etc.),

instrumentation, number, size, floor/wall/ceiling openings, sumps and sump capacity, and condition of drains, sump level instrumentation, number, size, and equipment occupancy fraction, condition of drains, equipment occupancy fraction, etc.). There are some etc.).

inconsistencies in the information related to these items presented between different sections of the Appendix A has been reviewed for consistency with the report. For example, the remainder of the document and corrections have been walkdown sheets show no drain made in the revision 0.

in the corridor area on El. 593 in the Control Bay. However, the flood height evaluation in Appendix E shows 2 drains in this area.

141

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Internal Events PRA F&O Resolution F&O F&O Impact on the CILRT SR Status Finding Resolution ID Recommendations Internal Extension IFSO-A1 Resolved IFSO- Tables 6-1 and 6-2 provide a list N/A A complete list of flood sources for each flood area has F&O Resolved - No A1-01 of the potential flooding sources. been included in calculation NDN-000-999-2007-0031 Impact on CILRT However, some of the plant water Revision 0, "IF - BFN Probabilistic Risk Assessment - Interval Extension.

and steam systems (e.g., Internal Flooding Analysis for the reactor building, domestic water/potable water/ control bay, diesel generator buildings and the intake sanitary water system, chilled pumping station. The Turbine building is being handled water system, hot water system, in a manner that does not require detailed listing of main steam, etc.) appear to be flood sources. Tables 6-1 and 6-2 have been updated.

absent from the evaluation The sources have also been listed in Appendix A of considered in these tables. In Calculation NDN-000-999-2007-0031 Revision 0, "IF -

addition, there is no BFN Probabilistic Risk Assessment - Internal Flooding documentation of the complete Analysis.

flood sources for locations that were not walked down (the flood sources documentation is geared to the walk down). Flood sources need to be identified by location as the basis for developing flooding scenarios.

142

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Table 51 Fire PRA F&O Resolution F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension 1-6 Resolved The documentation is in a state of flux that is Basis for Significance All documentation supporting the Fire PRA F&O Resolved - No perhaps consistent with the ongoing analysis The contents of the report as currently has been finalized to support the fire risk Impact on CILRT refinements and dynamics associated with the structured would require an analyst to refer evaluations and the LAR submittal. Interval Extension.

FPRA. Although documentation is largely to other analysis documents to determine if complete, its organization and structure does indicated model changes (injected logic or not necessarily facilitate ongoing maintenance example) were actually retained in the final Discussion added to section 6.3.3.5.1, and applications. While it is clear that an 6.3.4.5.7, and 6.3.5.5.7 of the AS Notebook model. R3. (See Section 2.3)[47]

individual fluent in the analysis can use and apply the documents, it is less clear that it would The report does not necessarily stand on its be useable by a new analyst. own. In addition, there is no specific discussion or documentation for the process For example, Attachment 9 of the task report that is used.

refers to Excel files to identify 'injected' logic that subsequently was either determined to be not Possible Resolution necessary or otherwise not needed in a The indicated changes reflected in the subsequent task. The report should contain this report should be annotated with notes if the final disposition so that it is clear what is and indicated change was ultimately determined isn't ultimately used (and meaningful) to the to be not necessary and/or resulted in an analysis. (This F&O originated from SR ES-D1) implementation different than stated in this report.

In addition, a reference to the process that is used (procedure or work instruction) should be provided.

1-7 Resolved The development for the majority of the fire Basis for Significance The mapping for systems or trains for each F&O Resolved - No scenarios relied on automated processes using The manual development of fire scenarios inmain control board scenarios (MCB) has Impact on CILRT databases and SAFE. The process used for the main control room needs to properly been updated to include any basic event Interval Extension.

these scenarios were found to be generally evaluate the potential combination of fire associated with the trains or systems acceptable. However, the nature and induced failures. These potential failures identified in TVA Calculation requirements for the Main Control Room include both functional failures as well as MDQ0009992012000102, BFN Main analysis, this automated process could not be spurious operations. The spurious Control Room Analysis, Revision 3. The used. Instead, the individual MCR scenarios are operations are of particular interest as they basic events selected include functional developed manually. As an example, the can have consequential impacts on other failures as well as spurious operation.

scenarios for the 3B MCB panels was expected systems some of which are noted in the Based on a review of fire scenarios, it was to consider a postulated fire that impacts MSO Report. In addition, depending on the determined that electrical cabinets, 3-PNLA-ADS/SRVs (functional failure as well as spurious nature of some of the impacts, plant 009-0023CD and 3-PNLA-009-0023BA are opening), impacts on CS and RHR. It was also features credited (relied upon) given more correctly classified as main control noted that several feet to one side of this section abandonment of the MCR could be boards rather than electrical cabinets. This are the controls for HPCI. Fire scenarios that rendered unusable for that purpose. change has been implemented in the latest consider these combinations could not be found. version of the fire ignition frequency, and the (This F&O originated from SR FSS-A4) Possible Resolution Main Control Room Analysis notebook has The treatment of the Main Control Room been updated accordingly.

scenarios should be reviewed to confirm 143

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension that an appropriate scope of fire scenarios The following updates to the Main Control and their induced impacts are considered. Room Analysis notebook have been made The panels of particular interest are those in order to address the concern behind this that have controls associated with ECCS F&O:

and their associated support systems. Section 7.3 of TVA Calculation MDQ0009992012000102, BFN Main Control Room Analysis, Revision 3 details the methodology of determining the target sets for main control board fires. This section was expanded in response to this F&O in order to better describe the methodology used to determine control board target sets and how this methodology minimizes "missed" significant target sets.

The following has been added to Section 7.3:

The development of these target sets involved the utilization of personnel familiar with plant systems, operations, and the systems credited in the FPRA. Target sets were developed for each main control board section within each control room. Fire PRA personnel evaluated the entire length of all main control board sections to determine target sets. Potential target sets were developed without regard to control board sections, as these are arbitrary divisions and would not impede actual fire growth.

Target sets that involved large lengths which may be screened as an abandonment-only scenario, or those that involved systems and functional groups where it was uncertain of the impact on CCDP or CLERP, were retained for further analysis in order to ensure no potentially significant target sets were omitted. Those that were found to be unrealistic due to target distance span or those that did not result in a significant CCDP or CLERP were screened in Section 8.2. All functional group combinations were evaluated during the development of target sets. The minimum number of target sets that realistically captured the risk involved due to potential 144

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension damage to all risk significant functional group combinations was retained.

Appendix C of TVA Calculation MDQ0009992012000102, BFN Main Control Room Analysis, Revision 3 contains the functional group control board diagrams used to develop target sets and fire scenarios. This appendix has been updated to include an outline of the boundary for each target set to more easily identify those components on the control board that are included in each target set.

This resolution indicates that the specific example given in the F&O did have fire scenarios representing the failures discussed, but were not easily verified using the peer review documentation. The documentation has been updated as described above in order to make the target sets evaluated easier to verify. Based on the reviews undertaken to validate the existing main control board fire scenarios and the expanded documentation included within TVA Calculation MDQ0009992012000102, BFN Main Control Room Analysis, Revision 3, it has been shown that no significant fire scenarios are omitted from the analysis and this F&O is resolved.

2-2 Resolved As shown in the Section 7 of BFN PRM Basis for Significance The BFN Internal Event system analysis F&O Resolved - No notebook, system analyses were performed by

• SY-A2 and A3 requirements not met notebooks were updated to reflect changes Impact on CILRT collecting pertinent information to ensure that the made for the FPRA model development to Interval Extension.

systems analysis appropriately reflects the as-

• Possible Resolution ensure that the Internal Events built and as operated systems. For example,

• Document the collection and review of documentation accurately reflects the as-condenser water box valves were added to pertinent plant information to ensure that the built, as-operated plant. TVA Procedure model flow blockage through the main systems analysis appropriately reflects the NEDP-26 "Probabilistic Risk Assessment condenser. All of these new components are as-built and as-operated systems (examples (PRA)" Section 3.3 provides the criteria and restricted to the fire PRA through the use of fire see SR SY-A2 and SY-A3 requirements). elements required for an update. Therefore, flags. However, the documentation of the Fire PRA model changes have been carried collection and review of system P&Ids, one-line over to the applicable system notebooks to diagrams, instrumentation and control drawings, ensure consistency between the FPRA and spatial layout drawings, and other detailed the Internal Events PRA model.

information has not performed yet. (This F&O To ensure the revised system notebooks 145

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension originated from SR SY-A2) accurately reflect the as-built, as-operated plant pertinent information was collected and reviewed from the following sources, as necessary.

Plant drawings including, P&IDs (Flow Diagrams), one-lines, instrumentation &

control (logic) and spatial layout drawings, Procedures including, system operations, abnormal operations, emergencies, Calculations including, success criteria, Training information & system descriptions, Actual system operations, e.g., system health reports, Interviews where appropriate with system engineers and operations representatives.

A new system (applicable to each unit) is being designed to aid in core damage mitigation given a severe fire that prevents emergency core cooling systems (ECCS) from performing their designed reactor inventory makeup function. This new system will supply reactor inventory (CST -

preferred source) over a wide range of low and high pressures at flow rates commensurate to provide adequate core cooling. Results from previous MAAP (Modular Accident Analysis Program) runs were used to determine the success criteria for flow rates, injection pressure and timing.

MAAP runs are contained in TVA Calculation SC.02 - BFN Probabilistic Risk Analysis - Thermal Hydraulic Analysis, NDN00099920080006. Revision 3.

Details of the new system are being developed at the time of the LAR submittal; however, the important attributes for the system are known, e.g., power supplies, switchgear, MCCs, distribution transformers, indication, alarms, and controls, human actions, etc. such that the system can be modeled by the FPRA. A draft system (SY.27) notebook, NDN-000-NA-2012-146

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension 000090, has been initiated to document this new system.

Inputs to the potential changes that could affect the Internal Events PRA model that were reviewed included:

FPRM Change Log - TVA Calculation NDN0009992012000013, TVA Fire PRA -

Task 7.5 Fire-Induced Risk Model, Revision 4, Attachment 1 Multiple Spurious Operation - TVA Calculation NDQ-0999-2010-0002, BFN NFPA 805 Multiple Spurious Operation Review, Revision 1 Fire PRA Quantification - TVA Calculation NDN0009992012000012, TVA Fire PRA -

Task 7.14: Fire Risk Quantification, Revision 3 The 805 transition team included plant staff (Operations, Engineering, etc.) with the necessary site specific knowledge engaged with the development of the fire PRA throughout the entire process. The addition of new components or operator actions that required change to Internal Events documentation became part of the documentation; therefore, many, if not all attributes defined in SR SY-A3 are enveloped in the Internal Events documentation. However, with the diverse team that reviewed and engaged in discussion on the Fire PRA model, those attributes in the SR were inherently included.

As stated previously, the system analysis is documented by system notebooks maintained in accordance with TVA Procedure NEDP-26, Probabilistic Risk Assessment (PRA). Section 3.3 addresses the PRA update process and requires the PRA analyst to address changes requiring system modeling notebook revision to accurately reflect the as-built, as-operated plant configurations. TVA Calculation 147

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension NDN00099920080005 SY.00 - BFN Probabilistic Risk Assessment - System Overview, Revision 0 provides the roadmap to the detailed system modeling notebooks, including interfaces with other PRA elements such as initiating events, accident sequences, data and others. The ASME PRA Standard is referenced throughout the overview which was used to ensure the system analyses were developed in accordance with the various supporting requirements. Included in the system models are walkdown information, interviews, mapping of accident analysis functions, human error probabilities, dependencies, operating and emergency instructions/procedures, and others. This methodology was carried over for the system modeling changes required to reflect the Fire PRA model development. The peer team concluded Browns Ferry met supporting requirement SY-C1.

Changes to the system analyses were performed in accordance with the high level requirements of HLR-SY-A and HLR-SY-B.

The FPRA peer review team had the following to say about these high level requirements. "The BFN internal events PRA model files have been modified to address fire PRA changes. The changes are mainly documented in the Attachment 1 of the BFN PRM notebook. A high-level summary has been provided for major system changes. New components were added to address the above MSOs. These were all spurious valve operations and are in logic that utilized fire flags to prevent it from being used in the IE PRA model. A review of SY-A and SY-B SRs has been provided and a list of F&Os is linked here."

Additional failure events resulting from fire scenarios have been added to the applicable system notebook. The revised notebooks provide a description of fault tree 148

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension changes including multiple spurious operation failures.

The Fire PRA plant response model has been documented in a manner that facilitates FPRA applications, upgrades and peer review. The system model changes are documented in the TVA Calculation NDN0009992012000013, TVA Fire PRA -

Task 7.5 Fire-Induced Risk Model,"

Revision 4. About 9 F&Os [Reference 2-2, 2-3, 2-20, 2-22, 2-36, 4-3, 7-1, 9-1, 9-2]

have been linked from the HLR-SC-C and HLR-SY-C and their SRs.

2-3 Resolved A summary of all detailed changes to internal Basis for Significance Section 7, High Level Fire PRA Model F&O Resolved - No events system models is provided in Section 7 of The majority of the systems were deemed toChange Discussions, of the TVA Calculation Impact on CILRT the PRM notebook. A listing of changes not require formal interviews; however, NDN0009992012000013, TVA Fire PRA - Interval Extension.

implemented in FPRA model is provided in formal interviews for a couple of the more Task 7.5 Fire-Induced Risk Model,"

Attachment 1. The majority of the changes are significant changes are needed. Revision 4 describes the composition of the limited to fire impact and have been determined team that performed walkdowns and to not impact the PRA models. It states that in Possible Resolution interviews with knowledgeable plant lieu of formal interviews the model changes were PERFORM formal interviews with personnel confirming the system analysis developed by a team of individuals with site knowledgeable plant personnel (e.g., correctly reflects the as-built as-operated specific knowledge using informal interviews. engineering, plant operations, etc.) to plant. PRA model changes were made Formal interviews should be performed for some confirm that the systems analysis changes throughout the Fire PRA development of the more significant model changes, for for the rapid core flood-up using condensate process as necessary to support the fire example the rapid vessel flood-up using and RCW success criteria correctly reflects analysis. Changes were dictated by efforts condensate and the success criteria change to the as-built, as-operated plant. such as the Multiple Spurious Operations RCW. (This F&O originated from SR SY-A4) (MSOs) evaluations or quantifications, and were planned and evaluated by a multi-discipline consisting of individuals with plant specific Browns Ferry engineering or operations experience. Therefore, in lieu of performing formal interviews with plant staff, the expertise from Operations and Engineering became part of the 805 Transition Staff and thus provided direct input to the treatment of PRA modeling with respect to the as-built as-operated plant.

Each subsection to Section 7 describes if walkdowns were required for each system and if not, why not.

To address this F&O, interviews were performed with system engineers for the 149

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension systems below to discuss PRA treatment to ensure the Fire PRA model represents the as-built, as-operated plant on the following:

Condensate System (for Condensate Flood-Up)

Raw Cooling water (RCW) System Emergency Essential Cooling water (EECW) System Interview information is included in the section 7 of the TVA calculations for the condensate system (TVA Calculation NDN-000-002-2007-0008, SY.01 - BFN Probabilistic Risk Assessment -

Condensate System Revision 1), the raw cooling water system (TVA Calculation NDN-000-024-2007-0019, SY.13 - BFN Probabilistic Risk Assessment - Raw Cooling Water System Revision 1) and the emergency essential cooling water system (TVA Calculation NDN-000-067-2007-0013, SY.06 - BFN Probabilistic Risk Assessment - Raw Cooling Water System Revision 3).

2-20 Resolved Dependencies or interfacing systems may not Basis for Significance The incorporation of the SAFE logic into the F&O Resolved - No have been fully modeled. The cable selection Not considered systematic. But some model FPRA model was designed to pull in all of Impact on CILRT task may pick up dependencies. However, this changes could be significant. the cable impacts including power supplies. Interval Extension.

does not fully satisfy SY-B5 requirements. For The action mentioned, example, the instruments were added to Possible Resolution HFFA0031STARTHVAC is assumed to be incorporate fire impact. The power dependency Update system models to model cued by the fire procedures when they are and other supporting system failures were not dependencies, instrumentation & control available through required post fire walk modeled in details. and other requirements in accordance with downs. TVA calculations For example, gate HFFA0031STARTHVAC is SR SY-B5. MDN0009992012000027, Thermal added under gate U0_CBHVAC_G01 for Analysis of Control bay Rooms Unit 3 Diesel operator failure to restart HVAC after fire. The Generator Building Shutdown Boards and instruments and controls were not considered in Battery Room 4 Board Room Following the model, or at least not evaluated for the Loss of Cooling, Revision 1 and potential failure of these supporting systems. MDN0009992012000010, Thermal Analysis of RB Corner Rooms Following (This F&O originated from SR SY-B5) General Transient, Revision 0 show that the HVAC systems crediting this action do not need to be recovered until over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the scram. Therefore, the plant staff 150

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension has adequate time to manually initiate standby HVAC systems if they are not fire impacted. Procedures will be available to manually start these redundant HVAC systems even if their controllers are fire impacted. Also, based on post peer review calculations, the fire PRA model only requires HVAC for quad cooling, EDG cooling, and cooling the 120 VAC instrument busses.

The resolution of this F&O with regard to instrumentation required to support the HFEs is delineated in section 5.1.7 and 5.2.4 of the fire HRA notebook. Also, Table 7 - Fire HFE Instrumentation was updated. The HVAC calculation reference was added to the reference table.

2-22 Resolved Prior to the on-site peer review, the following Basis for Significance All documentation supporting the Fire PRA F&O Resolved - No BFN FPRA notebooks / reports are in draft. Incomplete task and documentation has been finalized to support the fire risk Impact on CILRT Some are close to the final documentation but evaluations and the LAR submittal. The Interval Extension.

several require significant amount of work Possible Resolution specific examples cited are discussed in the beyond the documented materials that have Complete and review the identified following calculations:

been peer reviewed: notebooks / reports in draft. TVA Calculation NDQ-0999-2010-0002,

1. MSO report: Open items are still not Ensure consistency between the final BFN NFPA 805 Multiple Spurious addressed as noted in this report. Still have open notebooks / reports and BFN FPRA models. Operation Review, Revision 1 items, see App. 1: 2d, 2w, 2z, The MSO Expert TVA Calculation NDN0009992012000013, panel approval date is not provided. 2PSx - did TVA Fire PRA - Task 7.5 Fire-Induced Risk not clearly conclude if this issue is resolved Model, Revision 4 although a calculation has been performed. 4w, 5PSf, 5k, etc. Also in Appendix 3 of the MSO TVA Calculation NDN0009992012000014, report, several open items remain: 4w, 5a, 5PSf, TVA Fire PRA - TASK 7.6 Fire Ignition 5k, etc. Frequency, Revision 3 2.. PRM notebook: Seems to be close to final. TVA Calculation NDN0009992012000017, However, new model changes are expected for TVA Fire PRA - Task 7.7: Quantitative Risk the final FPRA model development, which Screening, Revision 1 require updates to this notebook. TVA Calculation NDN0009992012000011,

3. IGN notebook: Seems to be close to final. TVA Fire PRA -Task 7.12 Post-Fire Human Need to finalize and approve this notebook. Reliability Analysis, Revision 3

4. QNS notebook: Seems to be close to final.

Need to finalize and approve this notebook.

5. HRA notebook: Seems to be close to final.

151

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension However, new model changes are expected for the final FPRA model development, which require updates to this notebook.

(This F&O originated from SR IGN-B1, ES-D1, QNS-D1, and HRA-E1) 2-38 Open The existing BFN procedures are based on the Basis for Significance Since the peer review, the BFN FPRA team No Impact on CILRT existing SISBO strategy and the current fire Analysis does not reflect the as-built as- has worked closely with the 805 transition Interval Extension.

model is based on an as yet to be defined non- operated plant team to match the FPRA recovery actions The evaluation used SISBO strategy for which there are no with those actions proposed and credited by the FPRA model that procedures yet in place. Possible Resolution the 805 transition team for the 805 RISK will represent BFN at (This F&O originated from SR HRA-A2) When non-SISBO procedures are available, analysis. The FPRA team is only crediting the time this ILRT incorporate any new fire-specific safe those recovery actions that have been application is shutdown actions called out in the plant fire shown to sufficiently reduce CDF. A applied. Therefore, response procedures. feasibility study (TVA Calculation the SISBO approach MDQ0009992012000108 Revision 1, will no longer be a NFPA 805 Operator Action Feasibility strategy employed Analysis) has been performed to by BFN for fire demonstrate that the credited actions can hazards.

be performed in the available time.

TVA Calculation NDN0009992012000011, Although BFN TVA Fire PRA -Task 7.12 Post-Fire Human procedures that will Reliability Analysis, Revision 3 documents be put in place upon the BFN Fire PRA human reliability analysis. transition to NFPA Human failure event timing information was 805 are not yet obtained from two sources. The total time finalized, available was obtained from MAAP analysis corresponding HFEs by a practitioner who had adequate and HEPs have been knowledge of the BFN accident sequences. developed for the The cognitive and execution times were FPRA based on obtained both from a PRA practitioner who realistic proposed had previous knowledge of the IE HRA, and actions, including from operator interviews (Attachment B of credit for logical AND NDN0009992012000011). Timing of routed redundant information is documented in the HRA instrumentation calculator files and in the operator interview trains.

forms. The operator interview forms instructed the operators to consider the assumed worst case conditions for performing the action with regard to work load, additional procedures, response time during fire conditions, travel time impacted by fire conditions, etc.

152

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension The FPRA credited actions have been developed to the extent possible to make these HRAs represent those proposed actions. The final fire procedures are not available to complete and verify the fire HRAs. The FPRA model therefore assumes that these actions will be in the final procedures as currently proposed. Before the FPRA recovery actions can be considered complete, they will have to be re-evaluated when the fire procedures are approved and ready to be implemented in the post 805 transition.

The new recovery actions are included in the HRA calculator database that is delineated in Attachment D of the fire HRA calculation.

This F&O is considered open until the procedures are finalized. (Refer to Attachment S, Table S-3, Item 33).

2-39 Open Scoping as well as detailed (non-scoping) HRA Basis for Significance TVA Calculation NDN0009992012000011, No Impact on CILRT analyses in some instances have no Systematic issue TVA Fire PRA -Task 7.12 Post-Fire Human Interval Extension.

documentation of some or all of the following: Reliability Analysis, Revision 3 documents The evaluation used applicable procedure(s), timing, cues, Possible Resolution the BFN Fire PRA human reliability analysis. the FPRA model that performance shaping factors and availability / Complete the definition of HFEs including: The significant non-MCR abandonment will represent BFN at adequacy of manpower. For one example, the applicable procedure(s), timing, cues, HFEs have been defined and analyzed to the time this ILRT main control room abandonment HRA is performance shaping factors and availability the extent possible utilizing currently application is incomplete from the perspective that 1) the / adequacy of manpower. available, but draft, procedures, timing, cues applied. Therefore, diagnosis related to making the decision to and performance shaping factors, including the HFEs that will be abandon control room appears to be availability/adequacy of manpower. When in place will no unrealistically low (5E-4 with recovery), and 2) the fire procedures have been completed, longer be a strategy control of LPCI requires swapping the discharge approved and adopted, verification must be employed by BFN for from suppression pool cooling to injection; made to ensure the fire HRAs still fire hazards.

however; now diagnosis HEP is included for this sufficiently match the final procedures.

action. (This F&O originated from SR HRA-B3) The main control room abandonment HRA Although BFN has been expanded significantly since the procedures that will peer review and the two specific F&O be put in place upon statements no longer apply. The concerns transition to NFPA represented by these findings have been 805 are not yet addressed. New abandonment HFEs have finalized, been developed and include detailed corresponding HFEs procedures, timing, cues and performance and HEPs have been 153

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension shaping factors, including developed for the availability/adequacy of manpower. As for FPRA based on the non-MCR actions (including the realistic proposed swapping of LPCI from SPC to injection), actions, including when the fire procedures have been credit for logical AND completed, approved and adopted, of routed redundant verification must be made to ensure the fire instrumentation HRAs still sufficiently match the final trains.

procedures.

• This F&O response is documented in the HRA calculation and in the HRA calculator, the results of which are delineated in Attachment D to the HRA calculation. The operator interviews have been expanded and are delineated in Attachment B. The risk significant actions are delineated in Attachment C. The new HFEs are listed in Table 5. The MCR abandonment discussion is provided in section 5.12.

• This F&O is considered open until the procedures are finalized. (Refer to Attachment S, Table S-3, Item 33).

2-46 Resolved In the current draft notebooks for BFN Circuit Basis for Significance The Peer Review team possible resolution F&O Resolved - No Failure Mode Likelihood Analysis and TVA Fire Mainly documentation issue while the error refers to SR CF-A1 which has the following Impact on CILRT PRA - TASK 15 UNCERTAINTY AND factors were assumed in the RR database requirement to meet capability category Interval Extension.

SENSITIVITY ANALYSIS, no basis has been used for uncertainty analysis. II/III. REVIEW the conditional failure documented for the uncertainty associated with probabilities for fire-induced circuit failures the applied conditional failure probability. Possible Resolution and ASSIGN the appropriate industry-wide (This F&O originated from SR CF-A2) Document the basis for the uncertainty generic values for risk-significant associated with the applied conditional contributors based on the specific circuit failure probability assigned per CF-A1. configuration under consideration.

TVA Calculation EDQ0009992012000110, Circuit Failure Mode Likelihood Analysis, Revision 4 documents the failure probabilities derived using the industry-wide methodology presented in NUREG/CR-6850. These fire-induced circuit failure probabilities were assigned to cables based on their circuit configuration. Section 6.0 of the analysis documents the methodology, and the results are documented in Appendix C.

154

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension The bases for uncertainty are documented in section 7, and can be summarized as follows:

While, in the Fire PRA version initially submitted for the LAR, Option 2 of NUREG/CR-6850 was used, this option was subsequently abandoned and the failure probabilities were instead updated using as a basis generic values obtained from test data documented in NUREG/CR-7150, Volume 2. As documented in Section 7.0 of TVA Calculation EDQ0009992012000110, Circuit Failure Mode Likelihood Analysis, Revision 4, these probabilities were assigned to cables based on their circuit configuration. Component failure probabilities were generated on a fire scenario basis. Industry-wide generic error factors (EF) were applied to the aggregate value of each type of cable failure assuming a lognormal distribution. These EFs ranged from 1.17 to 3.67.

2-47 Resolved A check in the baseline RR database shows that Basis for Significance At the time of the initial Peer Review only a F&O Resolved - No about 476 basic events were modeled for Not all risk-significant contributors have small population of components Impact on CILRT spurious operation. The majority of these events been identified. (approximately 30) was analyzed for their Interval Extension.

are fire-induced. A number of these basic events circuit failure mode likelihood. To address (components) do not have conditional failure Possible Resolution this F&O a larger scope (i.e., more than probabilities for fire-induced circuit failures For the final FPRA model, identify all risk- 200) of components were analyzed.

assigned. Some components are expected to be significant contributors, REVIEW the The scope of components (e.g., motor-risk significant, such as SRVs and some relays. conditional failure probabilities for fire- operated valves, breakers, etc.) to analyze A discussion with BFN PRA staff showed that induced circuit failures and ASSIGN the for their circuit failure mode likelihood were circuit failure analysis for some of these appropriate industry-wide generic values identified during cutset reviews of the top components is in progress. based on the specific circuit configuration contributors to risk. During the initial review (This F&O originated from SR CF-A1) under consideration. the top 50 scenarios for CDF and LERF for all three units were reviewed. Subsequent cutset review meetings were held as a multi-discipline team consisting of representatives from the NSCA, Electrical Design, Fire Protection, Operations, and PRA. This cutset review effort was iterative and took place over a period of months.

While in the Fire PRA version initially 155

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension submitted for the LAR, Option 2 of NUREG/CR-6850 was used, this option was subsequently abandoned and the failure probabilities were instead updated using as a basis generic values obtained from test data documented in NUREG/CR-7150, Volume 2. As documented in Section 7.0 of TVA Calculation EDQ0009992012000110, Circuit Failure Mode Likelihood Analysis, Revision 4, these probabilities were assigned to cables based on their circuit configuration.

Component failure probabilities were generated on a fire scenario basis.

Industry-wide error factors (EFs) were applied to the aggregate value of each type of cable failure assuming a lognormal distribution. These EFs ranged from 1.17 to 3.67.

2-50 Open The modeling of the human actions in the FPRA Basis for Significance TVA Calculation NDN0009992012000011, No Impact on CILRT includes the consideration of instruments that are The treatment as modeled could conceal TVA Fire PRA -Task 7.12 Post-Fire Human Interval Extension.

credited as cues. There are several instances instances where instrumentation failures Reliability Analysis, Revision 3 documents The evaluation used that were noted where the listing of possible have a material impact on the HEP. Failure the BFN Fire PRA human reliability analysis. the FPRA model that instrument cues includes many individual to address this situation could cause the The Fire HRA Notebook Calculation will represent BFN at devices. This modeling is treated as multiple analysis to apply invalid credit. includes a discussion on the treatment of the time this ILRT inputs to a single AND gate, as an example. As the instrumentation. Every routed instrument application is modeled, the availability of any single instrument Possible Resolution train that was credited by an HFE was applied. Therefore, even if the majority of the other instruments are A justification for the current modeling included in the modeling. The redundant the HFEs that will be failed, would not disable the human action. This treatment needs to be provided. Such a instruments are still ANDed together and an in place will no treatment is made without any consideration of or justification would need to address the assumption is made that the fire procedures longer be a strategy confirmation that operator guidance is available manner by which an operator would be able will include the impacted instrumentation for employed by BFN for to allow them to discern which instrument is the to discern which instrument should be used fires in the respective area. Therefore, as fire hazards.

known valid (not failed) instrument. and/or how they would recognize the need long as one instrument is available and the Although BFN (This F&O originated from SR HRA-C1) for action even if the majority of the operators know, from the applicable fire procedures that will available instrument might indication that no procedure, which instrument that is, that be put in place upon action is required. In the absence of such a instrument can be credited even though the transition to NFPA justification, a modification to the logic redundant instruments are impacted by the 805 are not yet structure would be required. fire. finalized, This F&O is resolved to the extent possible corresponding HFEs with the current state of the 805 project. The and HEPs have been instrumentation cannot be listed in the fire developed for the procedures until the procedures are FPRA based on developed. Once the fire procedures are consideration of 156

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension complete, approved and accepted, realistic proposed verification must be made to ensure the actions and the operator can determine from the fire instrumentation that procedure which instruments are free of fire is needed by damage for the applicable fire scenarios and operators performing those instruments are properly credited in the actions.

the FPRA model. Therefore, any This F&O is considered open until the change in risk procedures are finalized. (Refer to estimated by the Attachment S, Table S-3, Item 33). FPRA models for EPU is expected to be small and is not expected to change the conclusions of the EPU FPRA calculation. When the new procedures have been completed, approved and adopted, verification must be made to ensure the fire HRA still sufficiently matches the final procedures and to ensure that operators can determine from the fire procedures which instruments are free of fire damage for the applicable fire scenarios and those instruments are properly credited in the FPRA model..

2-53 Resolved The review of component to component mapping Basis for Significance A review was done for risk significant F&O Resolved - No revealed that some of the mappings are Could be risk significant. Note the current conservatisms and none were identified. Impact on CILRT conservative. For example, the following sub- mapping is conservative. The Diesel Batteries and Chargers were Interval Extension.

components mapped to 0-BATB-254-0000B conservatively mapped due to circular logic (battery supporting DG) are linked to the same Possible Resolution issues. This is not risk significant based on basic event DGGFD0EDG_082__DGB. There Refine the component-to-component the location of the EDG to the batteries and 157

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension are different paths for the charging of the battery. mapping plus the linking of the sub- chargers. Conservative mapping was done Therefore, a more detailed modeling could components to the fire PRA basic events to on a limited basis to simplify the FPRA reduce the impact of the fire-induced failure of remove conservatism. model. TVA Calculation the battery, which in turn fails the DG. Note a NDN0009992012000013, TVA Fire PRA -

discussion with TVA PRA staff indicated that Task 7.5 Fire-Induced Risk Model, Revision such mapping may not be critical due to other 4 documents the Fire PRA model.

fire-induced failures in the area. However, these mappings show up in the FRANX zone-to-raceway mapping table for some of the CCDP=1 fire scenarios.

0-CHGB-254-0000BA DGGFD0EDG_082__DGB 1

0-CHGB-254-0000BA DGGFD0EDG_082__DGB 2

0-CHGB-254-0000BB DGGFD0EDG_082__DGB 2 0-DG-BAT-B-CHG-TOGGLE DGGFD0EDG_082__DGB 3 (This F&O originated from SR CS-A4) 2-54 Resolved Main Control Board Fire Ignition Frequency Basis for Significance While in the Fire PRA version initially F&O Resolved - No calculation has been reviewed for the calculation Calculation of MCB ignition frequencies may submitted for the LAR, the method Impact on CILRT of the MCB ignition frequencies for each be under-estimated. The risk significance is described in the F&O was employed to Interval Extension.

scenario. It is calculated by dividing the total not expected to be significant since the total calculate Main Control Board fire scenario MCB bin frequency for each unit by the total MCB contribution for each unit is less than frequencies, this method was subsequently number of unscreened scenarios. This may not 1E-5/yr. However, this statement may be abandoned. Instead, the guidance in be accurate since the ignition frequencies should impacted by F&O 1-7. NUREG/CR-6850, Appendix L was applied be tied to the sections modeled for these MCB and the risk impact that apportioning the full scenarios. For example, a total of 52 scenarios Possible Resolution Bin 4 frequency to each postulated Main are counted. Assuming there are about 25 MCB Revise the MCB fire ignition frequency Control Board (MCB) scenario would have sections, the ignition frequency for each section calculation with the MCB sections instead of on the total fire risk was calculated for each could be a factor of 2 higher. the number of modeled scenarios. unit.

(This F&O originated from SR FSS-A6) 2-55 Resolved The documentation provided does not include Basis for Significance It was determined that a quantitative F&O Resolved - No any statistical representation of uncertainty FSS-E3 requirement not met analysis of uncertainty intervals did not Impact on CILRT interval for the significant fire scenarios. provide sufficient benefit over a qualitative Interval Extension.

Possible Resolution analysis to complete the analysis.

(This F&O originated from SR FSS-E3)

Develop statistical representation of A qualitative analysis of uncertainty uncertainty intervals for the significant fire parameters is provided in each fire modeling scenarios. report, including the Scoping Fire Modeling Scenario Report (TVA Calculation 158

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension MDQ0009992012000104, BFN Scoping Fire Modeling Scenario Report,"

Revision 2), Main Control Room Analysis (TVA Calculation MDQ0009992012000102, BFN Main Control Room Analysis, Revision 3), and individual Detailed Fire Modeling Report (TVA Calculation MDQ0009992012000101, BFN Units 1, 2,

& 3 Detailed Fire Modeling Report, Revision 2). The qualitative analysis provides:

The input parameter value(s) and the reasoning for the value or distribution used Whether the input value provides a conservative, non-conservative, bounding, etc. value or distribution for fire model calculations The overall impact of the input parameter on the Fire PRA A qualitative analysis was used, as it was determined to provide sufficient insight into conservatisms of the fire modeling used, as well as the impact of input parameter uncertainty on the results of the Fire PRA.

Because of the wide range in modeling choices, such as the t-squared growth model provided for in NUREG/CR-6850, modeling uncertainties drive the fire PRA results insights. The development of the parametric data uncertainty characterization provides information that does not provide meaningful insights into the decision-making process. Thus, the parametric data uncertainty is not applicable to the NFPA-805 LAR submittal. In the fire PRA, the endpoints of the fire damage state trees represent mean values for each of the fire scenarios. Conservatisms are embedded in the FPRA through modeling assumptions or rules. For example, the ignition frequencies are developed through severity factor, detection and suppression conditional probabilities, and detailed fire modeling into 159

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension fire damage state (FDS) frequencies. The NUREG/CR-6850 fire modeling assumptions involving the growth and propagation of a fire include conservative peak heat release rates, conservative cable flame spread rates, and conservative cable tray propagation rule sets which directly lead to reduction in effectiveness of detection/suppression and the time available for operator action tend to produce conservative estimates of the damage.

These conservatisms are implicitly included in the FDS and are not represented with parametric data uncertainty.

Based on experience in developing parametric data uncertainty for Fire PRA models, the conservatisms in the selection of methods and data associated with NUREG/CR-6850 clearly outweigh and influence the variability in results more than the parametric data uncertainty. Thus, the parametric data uncertainty has been deferred to a future update of the fire PRA.

Therefore, the use of the current qualitative assessment of fire modeling input parameter uncertainty is sufficient and justified. This is consistent with the practices of other utilities in the nuclear industry.

2-56 Resolved 1JMW-6006-100-RPT-001, Risk Assessment of Basis for Significance TVA Calculation MDN0009992013000131, F&O Resolved - No Fire Impact to Structural Steel Elements, has FSS-F3 requirement for quantitative Risk Assessment of Fire Impact to Impact on CILRT been developed for the structural steel analysis. assessment of unscreened scenarios. Structural Steel Elements, Revision 1 Interval Extension.

Although a qualitative assessment has been addresses SR FSS-F3, which requires performed, there is no basis for the Cable SpreadPossible Resolution quantification of the fire risk associated with Room scenario. Either modify the criteria for structural failure scenarios generating a structure collapse (This F&O originated from SR FSS-F3) or perform quantitative assessment for the compromising the ability to safely shutdown unscreened scenarios. the reactor.

Supporting requirement FSS-F3 requires the quantification of the identified scenarios with the potential of generating fire damage to structural steel elements and compromising the integrity of the building structure. Based on the walkdowns and the 160

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension review of ignition sources identified for the Fire PRA, two physical analysis units (PAUs) meet the criteria for the selection of scenarios that have the potential of damaging structural steel elements, PAUs 16-A and 26A.

A catastrophic turbine generator oil fire for each unit in PAU 26A has been evaluated quantitatively. A further examination of the ignition sources and intervening combustibles in the cable spreading room (PAU 16A) shows that they do not present the characteristics that would lead to a "high hazard" fire as described in the ASME/ANS-RA-SA-2009 standard. This provides ground to qualitatively eliminate from further consideration the fire-induced structural steel collapse in the cable spreading room.

2-57 Resolved Incipient fire detectors are credited in the panels Basis for Significance Incipient fire detection is credited for F&O Resolved - No in PAUs 16-M, 16-O, 16-K. The credit is also FSS-F3 requirement for quantitative transient and panel fires within Fire Impact on CILRT extended to transient ignition source fire assessment of unscreened scenarios. Compartments 16-K, 16-M, and 16-O. Interval Extension.

scenarios. Given that the detectors are panel Within these fire compartments, incipient based, the credit should be removed from the Possible Resolution detection is credited for those cabinets transient fire scenarios. (This F&O originated Either modify the criteria for structural failure where the incipient detectors are located.

from SR FSS-D7) or perform quantitative assessment for the Incipient detection in the panels is credited unscreened scenarios. at Browns Ferry in accordance with FAQ 08-0046. Additional details for incipient detection are provided in TVA Calculation MDQ0009992012000104, BFN Scoping Fire Modeling Scenario Report," Revision 2 and TVA Calculation MDQ0009992012000101, BFN Units 1, 2,

& 3 Detailed Fire Modeling Report,"

Revision 2. While, in the Fire PRA model of the peer review, incipient fire detection credit was taken for transient fire scenarios, this is no longer the case. In-panel incipient detection is credited in the auxiliary instrument rooms only for panel fires.

3-2 Resolved The PP notebook does not have a listing of Basis for Significance TVA Calculation MDQ099920100002, F&O Resolved - No buildings included in the global analysis Not having a distinct list of buildings within Browns Ferry Plant Boundary and Impact on CILRT 161

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension boundary. A number of the buildings in the global the fire analysis boundary has impacts in Partitioning Report, Revision 8 includes a Interval Extension.

analysis boundary may need to be included as the qualitative screening and multi distinct list of buildings in plant analysis physical analysis boundaries. For example, compartment analysis. An example of a units YARD and SWITCH (switchyard) building W1 is mapped to Yard PAU. It is not specific impact is the inclusion of a multi which indicates if they are inside or outside clear if W1 is in or out of the scope of the FPRA. compartment scenario from W1 to the of the global analysis boundary. The criteria If it is in the scope, it should be included for turbine building. to determine whether they are screened qualitative screening, multi compartment analysis Possible Resolution from further consideration is based on etc. NUREG/CR-6850, section 4.5.

Add a distinct list of buildings in the yard (This F&O originated from SR PP-A1) and switch and indicate if they are inside or Section 4.4 of the calculation describes PAU outside of the global analysis boundary. SWITCH - A PAU named SWITCH is created for the 161KV and 500KV Switchyard areas and includes the Main Transformers area. The Switchyard is included due to the requirement for offsite power in shutdown operations. The SWITCH PAU does not have any physical boundaries or barriers which would meet the definition of a typical fire compartment.

The SWITCH PAU boundary is instead defined by significant spatial separation and the Turbine Building wall. Per the FHA, a fire in the yard will either be controlled by the available automatic fire extinguishing features (i.e., in the switchyard and H2 trailer port) or the fire will be confined to its location. The substantial distances between combustible sources and non-rated plant boundaries will prevent the fire from propagating to the plant areas. There are several buildings located in and considered to be a part of the SWITCH PAU because they do not contain, and are spatially separated from buildings that do contain cables related to safe shutdown.

Section 4.5 of the calculation describes PAU YARD - created for the balance of the protected area not covered by the switchyard or the buildings in other PAUs.

The Yard area is included due to the possibility of equipment important to Fire PRA residing outside of the other PAUs yet still within the protected area of the plant.

The YD PAU does not have any physical boundaries or barriers which would meet the 162

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension definition of a typical fire compartment.

The YD PAU boundary is instead defined by significant spatial separation or the building walls from other PAUs. Per the FHA, a fire in the yard will either be controlled by the available automatic fire extinguishing features (i.e., in the switchyard and H2 trailer port) or the fire will be confined to its location. The substantial distances between combustible sources and non-rated plant boundaries will prevent the fire from propagating to the plant areas.

3-5 Resolved The cable selection and cable routing tasks of Basis for Significance The Cable and Equipment Tables F&O Resolved - No the FPRA were not completed at the time of the The global analysis boundaries and plant (Attachments 2 & 3 of TVA Calculation Impact on CILRT peer review. Therefore, at this point in time the locations where fires may need to be EDN0009992012000056, TVA Fire PRA - Interval Extension.

peer review team cannot check if there are postulated/quantified may need to be Subtask 7.3 Fire PRA Cable Selection and raceways, duct banks, manholes, etc. outside of expanded if there are cables routed outside Routing, Revision 13) are direct outputs what has been defined as the global analysis the existing boundaries. from SAFE which houses all cables selected boundary that may be outside of those and routed within the PAUs. Attachments 2 boundaries. Possible Resolution & 3 of the CS calculation lists the cables (This F&O originated from SR PP-B6) When cable selection is completed, check and/or equipment aligned with fire the all cable routes are within the existing compartments and zones within the global global analysis boundary. analysis boundary as defined in as the Browns Ferry Plant Boundary and Partitioning Calculation, MDQ099920100002 Revision 8.

3-7 Resolved No justification is provided for exclusion of Basis for Significance TVA Calculation MDQ099920100002, F&O Resolved - No locations within the controlled area. No disposition of buildings outside of the Browns Ferry Plant Boundary and Impact on CILRT (This F&O originated from SR PP-C2) global analysis boundary but within the Partitioning Report, Revision 8, Section 4 Interval Extension.

control area is provided. discusses the basis, and provides a justification for excluding buildings outside Possible Resolution of the global analysis area; however, within Add a table to the PP notebook listing the Owner Controlled Area (OCA). Tables buildings/structures outside the global 4.4.1, 4.5.1 and 4.6.1- Buildings located in analysis boundary but within the owner the Switchyard (SWITCH) plant analysis unit controlled area. (PAU), and the Yard (YD) PAU and buildings located in the Cooling Tower (CT) area PAU; respectively, list the buildings screened from further consideration.

External buildings cited from the Plant Boundary and Partitioning Analysis, that 163

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension have a spatial separation screening criteria, were walked down and evaluated to ensure that a fire could not propagate to any other building or structure that contain safe shutdown related cables or equipment. This includes damaging hot gas layers and/or radiant heat effects.

3-13 Resolved At the time of the peer review, the fire scenario Basis for Significance This F&O was resolved by recalculating the F&O Resolved - No analysis was developed under conservative The credit for detection and suppression in credit assigned (for each scenario in the Impact on CILRT assumptions for target damage. However, the fire scenario analysis is incorrect as it FPRA model subjected to detailed fire Interval Extension.

inappropriate credit for fire suppression can does not account for failure/success modeling) so that the progression of target generate non-conservative/ non-realistic scenario branches. The credit for detection damage after ignition is considered.

representation as the application of the non- suppression is applied for all target failures Specifically, the fire scenarios are suppression probability does not consider targets without consideration for time to damage or represented as a progression of target that may fail before the suppression agent is system activation. damage states in time. Credit for automatic effective in controlling/suppressing the fire. and manual suppression is applied to each Possible Resolution damage state considering the suppression (This F&O originated from SR FSS-D3)

The fire scenario quantification needs to systems that have been determined to properly credit non suppression probabilities activate at that time. Under this approach, by considering activation and target damage credit for suppression is apportioned and times. normalized for the different damage states in the progression of the fire scenario and reflects which targets receive protection at each point in time. This process which follows that prescribed in NUREG/CR-6850 Appendix P, Detection and Suppression Analysis, is described in TVA Calculation MDQ0009992012000101, BFN Units 1, 2,

& 3 Detailed Fire Modeling Report, Revision 2, section 5.8.2.

Detailed fire scenarios in the Fire PRA are modeled as a progression of damage states. Damage states have the following characteristics:

Damage states are postulated at chronological points in time after ignition.

Damage states accumulate targets damaged from time zero until the time they are postulated.

The final damage state in the progression can represent either: 1) a hot gas layer scenario where all the targets in the fire 164

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension zone are assumed damaged by the fire, or

2) a new set of targets damaged that does not encompass full zone damage.

Since the damage states are represented in chronological points in time, an event tree is an appropriate logic model to capture the progression. The conceptual event tree in the figure below depicts a progression of three damage states as follows:

The initiating event is characterized by a frequency that consists of a generic frequency times the corresponding apportioning factors.

The first damage state is always at t = 0, which is the ignition time. The target at time zero is the ignition source itself if it is a component within the scope of the Fire PRA. A specific number of power boards, pumps, compressors, etc. are usually components credited in the Fire PRA and therefore are considered targets in the fire scenario analysis. The first target set will have no targets if the ignition source is not a component credited in the Fire PRA. The success branch for the first damage state (top branch) in the event tree represents scenarios where the fire is limited to the ignition source and no other target is damaged. The failure branch for the first damage state (bottom branch) represents a scenario progression where targets outside the ignition source are damaged.

The second damage state is postulated at t

= t1, which is a scenario specific time determined by fire modeling analysis. This time is interpreted as the "time at which ALL the targets in Target Set 1 are damaged". A conservative and practical approach is to define this time as the minimum time necessary to fail all the target sets. As an example, assume that target set 1 consists of a three tray stack. A conservative modeling approach is to assume that the 165

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension three trays will be damaged at the time the first tray is damaged. This time to damage will be t1.

Remaining damage states are treated the same way as damage state 1.

In event tree analysis, typically the initiating event frequency is multiplied by the applicable branch probabilities to determine the frequency of each outcome (sequence) of events. The branch probabilities are calculated using the event tree approach described in Appendix P of NUREG/CR-6850 for each characteristic damage state time. This approach considers which suppression systems are activated at each point in time and the appropriate manual suppression credit can be determined.

Initiating Target Set 1 Target Set 2 Target Set 3 Event Seq 1-SF g x Wis Seq 1-PNS-1 Seq SF 1-PNS-2 PNS-1 Seq PNS-2 t=0 t = t1 t = t2 3-15 Resolved Based on the discussions with the FPRA Basis for Significance TVA Calculation NDN0009992012000012, F&O Resolved - No development team, the understanding is that The current method for crediting control TVA Fire PRA - Task 7.14 Fire Risk Impact on CILRT there are scenarios in the control room or in otherroom abandonment may be potentially non Quantification, Revision 3 documents the Interval Extension.

fire zones where control room abandonment is conservative as impacts in scenarios that control room abandonment scenarios. The credited. In some cases, the HEP for control cant be recovered by ex-control room fire initiators which can result in control room abandonment probability replaces the actions are not considered. room abandonment have been identified.

CCDP of the scenario as calculated by FRANX if The failure impacts of these fires on the 166

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension the scenario results in a CCDP value larger than Possible Resolution remote shutdown equipment, including a 0.1. This approach may miss scenarios where Identify, list and describe scenarios where Variance From Deterministic Requirements the fire generates damage that can't be main control room abandonment HEP is (VFDR) with recovery actions, have been recovered from ex-control room activities and a credited, which such a credit may not be identified. The recovery actions which are CCDP larger than 0.1 would be appropriate. appropriate. In addition, the appropriate feasible to overcome VFDR have been (This F&O originated from SR FSS-B2) CCDP for the scenario should be calculated.identified, grouped by location of the action, quantified, and applied to the relevant initiating events. Where the fire impact is such that remote shutdown is unavailable due to equipment damage, no credit is taken (CCDP=1.0). This process gives a CCDP for each specific scenario, which accounts for fire damage which may fail remote shutdown, and for fire damage which requires recovery action.

The CCDP for abandonment can be used together with the CCDP for non-abandonment to develop a baseline CDF value for each scenario, assuming a split between abandonment and non-abandonment.

3-25 Resolved This finding is documented to track the credit for Basis for Significance Similar to most, if not all licensees F&O Resolved - No incipient detection in selected ignition source The fire PRA is crediting a future plant mod. transitioning to NFPA 805, the post- Impact on CILRT cabinets in the model. The incipient detection transition FPRA model (variant case) Interval Extension.

system is a proposed plant modification that is Possible Resolution includes future plant modifications to not currently installed in the cabinets where the Update the model according to the final mitigate the likelihood of fire-induced system is credited. The FPRA will need to be design of the incipient detection system. damage to plant components. These updated if the plant MOD is not fully executed as modifications are included in the License currently represented in the model. (This F&O Amendment Request (LAR) and are originated from SR FSS-D8) commitments to the NRC.

Any deviations from the commitments in the LAR will require an amendment approved by the NRC. Configuration control of the Fire PRA model will be maintained by integrating the Fire PRA model into the existing processes used to ensure configuration control of the Internal Events PRA model. The as-built risk related modifications and any other refinements that may be addressed by the Fire PRA and the Internal Events model will be incorporated into the model. The updated risk results will be evaluated to ensure that there is no 167

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension unacceptable change (Refer to Attachment S, Table S-3, Items 24 and 32).

TVA Calculation MDQ0009992012000101, BFN Units 1, 2, & 3 Detailed Fire Modeling Report, Revision 2, Table 5-4 describes treatment of incipient detection credited in the fire analysis for several compartments within Fire Area 16. The detailed fire modeling event trees in Attachment 10 include a node for incipient detection that is used in the calculation to determine the scenario frequency for various end states.

The FPRA model takes output from the detailed fire modeling calculation which is factored into the PRA quantification for a given fire scenario for which the incipient detection credit was taken.

TVA Calculation MDQ0009992012000104, BFN Scoping Fire Modeling Scenario Report," Revision 2, Section 5.2, Incipient Detection, documents the methodology employed at Browns Ferry to determine the failure probability of incipient detection to be installed in all electrical panels in the Auxiliary Instrument Rooms 16-K (Unit 1),

16-M (Unit 2) and 16-O (Unit 3). The development of the failure probability methodology for the incipient detection system is based on Chapter 13 of NUREG/CR-6850 Supplement 1. The methodology documented in this analysis is designed to be valid for future incipient detection applications as well.

TVA Calculation NDN0009992012000012, TVA Fire PRA - Task 7.14: Fire Risk Quantification, Revision 3, Appendix A BFN Fire PRA Modifications Table A-1, provides the list of modification commitments for NFPA-805 transition. This modification list is used to track future plant modifications that are included in the FPRA.

The modification Incipient detection in aux instrument rooms is tracked by Design Change Notification (DCN) 70493. The 168

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension equipment modifications are modeled in the Fire PRA by removing the component failures of concern from all fire scenarios in the applicable fire compartment. The removed fire impacts are documented in Attachment 12 of the Quantification Report and the FireImpact table in FRANX. In-panel incipient detection is credited in the auxiliary instrument rooms only for panel fires.

4-1 Open The identified common enclosure issue (i.e., 250 Basis for Significance TVA Calculation EDQ0009992011000004, No Impact on CILRT VDC batteries and battery chargers tap directly toStep is required ensure associated circuits NFPA 805: Associated Circuit - Common Interval Extension.

shunts in the positive leg of the DC system) is issues are fully addressed. Power Supply / Common Enclosure, As noted in the addressed by Design Change 70434. Battery Revision 1 provides the design inputs, FPRA summary Board 1 has already been corrected. The other Possible Resolution methodology, acceptance criteria and report a review of all batteries are scheduled to be corrected this year. Complete planned activities to address BFN analysis with respect to treatment of Browns buses credited in the Therefore, the cables failures are not considered common enclosure issues. Ferry common enclosure issues. The fire PRA for circuit in the model. We also have an action item to purpose of the analysis was to evaluate failures including track implementation of this modification. common power supply and common overcurrent Although this modeling approach doesn't match enclosure associated circuits as applied to protective devices for the as-built as-operated plant, the design change the Browns Ferry Nuclear Safety Capability a power supply process and action time provides assurance that Assessment (NSCA) and Fire Probabilistic potentially not being the plant design will agree with the FPRA Risk Assessment (FPRA). coordinated with modeling. The objectives of the analysis include: upstream supply (This F&O originated from SR CS-B1) Identify electrical power supplies credited by devices (resulting in the NSCA and FPRA, and document the de-energization) was electrical coordination requirements conducted. The applicable to these power supplies. documented review provides assurance Provide a 'road map' for electrical that all electrical coordination and protection calculations that supplies credited in facilitate easy correlation between the the fire PRA are associated circuit requirements specified in properly coordinated this calculation and the specific BFN design and circuits are calculations that demonstrate acceptability. adequately protected.

For credited electrical power supplies, assess electrical coordination - as documented in controlled calculations, analyses, or studies - to determine if any vulnerabilities exist with respect to common power supply associated circuits.

Assess electrical circuit protection - as 169

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension documented in controlled calculations, analyses, studies, or design criteria - to determine if any vulnerability exists with respect to common enclosure associated circuits.

Identify for existing electrical coordination and protection calculations/studies any weaknesses in the objectives, methodology, criteria, or results that do not fully support the criteria for associated circuits.

The scope of the analysis includes:

An evaluation of common power supply associated circuits for the NSCA and FPRA electrical power supplies, as identified by the NSCA and FPRA equipment lists.

An evaluation of common enclosure associated circuits for NSCA and FPRA equipment and cables, as identified by the NSCA and FPRA equipment lists.

An evaluation of two special subcategories of associated circuits should be:

Open circuits on the secondary side of current transformers (CTs), which pose a potential common enclosure fire concern.

Loss of control power to medium-voltage power circuit breakers coincident with a fault on the circuit breaker load-side power cables. This failure mode poses both a common power supply and common enclosure concern.

Evaluation of multiple high-impendence fault (MHIF) associated circuits is not within the scope of this evaluation. The MHIF analysis is documented in a different calculation.

Key conclusions of the analysis are: A majority of NSCA and Fire PRA power supplies are demonstrated to have adequate coordination. Exceptions are noted in Section 9 of the calculation and are 170

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension discussed in detail in the body of the analysis. The affected power supplies are:

1) 480 VAC Water Supply Board, Busses 1, 2, and 3,

2) 250 VDC Turbine Building Distribution Boards, 1, 2 and 3,

3) 120 VAC Plant Preferred Panel 11 (Units 1, 2, and 3).

The results of the common-enclosure analysis (Section 9 of the calculation) have the following conclusions:

The common enclosure associated circuits analysis identifies applicable plant electrical calculations that collectively address electrical protection of cables and equipment.

The existing BFN calculations provide reasonable assurance that plant cables are suitably protected with one notable exception - ammeter cables for the 250 VDC batteries and battery chargers tap directly to shunts in the positive leg of the DC system. Addressed in the following bullet:

A potential common enclosure concern was identified with ammeter cables that run from the 250 VDC boards to the Main Control Room. These cables connect to DC shunts within the battery boards and provide a signal to the ammeters in the Control Room.

These cables tap off the positive leg of the battery system without fuse protection or other form of overcurrent protection.

Although unfused, the cable represents a low risk of auto-ignition, since any fire-induced hot short circuit would necessarily involve a conductor from the negative leg of the battery system and this conductor would be protected with a small size fuse or circuit breaker. Nonetheless, these cables are not adequately protected and are thus classified as potential common enclosure associated 171

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension circuits of concern. This issue has been placed in the corrective action program, PER 452185.

Regarding the comment with respect to "Although this modeling approach doesn't match the as-built as-operated plant, the design change process and action time provides assurance that the plant design will agree with the FPRA modeling." All plants transitioning to NFPA805 have committed to a scope of plant modifications as a result of going through the NUREG/CR-6850 process. Therefore, it is not unexpected that the FPRA model will include modifications that have a regulatory commitment and do not represent the post transition as-built as-operated plant. A list of committed modifications is provided in Attachment S of the License Amendment Request (LAR).

This F&O is considered open until completion of the modifications committed to in the LAR. Configuration control of the Fire PRA model will be maintained by integrating the Fire PRA model into the existing processes used to ensure configuration control of the Internal Events PRA model. The as-built risk related modifications and any other refinements that may be addressed by the Fire PRA and the Internal Events model will be incorporated into the model. The updated risk results will be evaluated to ensure that there is no unacceptable change (Refer to Attachment S, Table S-3, Items 24 and 32).

4-2 Resolved The Associated Circuits Analysis Common Basis for Significance This finding has been addressed by F&O Resolved - No Power Supply and Common Enclosure analysis Step to be completed. including in the BFN Fire PRA the risk Impact on CILRT identifies issues identified with Current contribution of secondary fires due to the Interval Extension.

Transformer Open Circuit Secondary Circuits. Possible Resolution presence of a specific type of current Current Transformer Open Circuits are currently Resolve / address associated circuits issues transformer in electrical buses. This is not accounted for in the FPRA model. Current identified with Current Transformer Open consistent with section B.3.4.2 of NFPA transformers with external cabling are currently Circuit Secondary Circuits, and ensure that 805, which states that current transformers being identified. Reviews indicate that the safety the FPRA model reflects these resolutions that are constructed such that an open related board CT's have transducers to isolate circuit could cause ignition of a transformer 172

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension external cables. Open circuit vulnerabilities exist and the as-built as-operated plant. should be considered. Thus, current on BOP switchgear like the 4kV Unit Boards and transformers that are susceptible to ignition 4kV Common Boards in the Turbine Building. due to an open secondary winding and have (This F&O originated from SR CS-B1) secondary circuits extending outside of the current transformer enclosure that are not isolated by transducers should be considered for inclusion in the NSCA. In the BFN NSCA and Fire PRA, current transformer cables that meet the following conditions are included in the analysis:

The corresponding current transformer has a turn ratio greater than 1200:5 The corresponding current transformer is not used in differential over current protection The corresponding current transformer has external cables that leave the housing enclosing the current transformer Based on the above screening criteria, the relevant current transformers have been identified as a first step for incorporating the risk contribution in the Fire PRA. After identifying the transformers, the corresponding cables were routed so that:

1. The ignition sources that may affect the cables associated with the current transformers are identified and the ignition frequency corresponding to secondary fires is calculated.

2. The targets (i.e., raceways and conduits) nearby the electrical buses where the secondary fires are postulated (i.e., the electrical boards where the current transformers are located) were identified so that the impacts of these fires is accounted for in the secondary fire scenario where the boards are located. The targets affected by the secondary fires were identified both by drawing inspections and by walkdowns.

The targets affected by the secondary fires were added to the fire scenarios in the Fire PRA that could affect the relevant current 173

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension transformer cables.

4-3 Resolved The following items were noted regarding Basis for Significance TVA Calculation NDN0009992012000013, F&O Resolved - No calculations that support success criteria: Items 1 and 3 are risk-significant. Item 2 is TVA Fire PRA - Task 7.5 Fire-Induced Risk Impact on CILRT

1) Room heat-up calculations are underway to potentially risk significant. Other items are Model, Revision 4 section 6.6.1, 7 and Interval Extension.

support the timing for HFFA0031STARTHVAC. open. Attachment 1 provides a discussion of the These calculations have progressed to a point modification and incorporation of success Possible Resolution criteria associated with the fire-induced where BFN is comfortable taking a position that more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is available before a mitigating Use appropriate realistic generic thermal- initiating events into the BFN FPRA model is action has to be taken (i.e. open doors, etc.). hydraulic bases or plant-specific models to provided in Section 6.6.1 and 7. With the Because the HVAC was masking important support success criteria. exception of fire-specific HRA response time results, BFN decided to credit the 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in the considerations, the internal events PRA current model assuming the calculations will be sequence/ system success criteria were completed with consistent results. This approach retained for the fire-induced risk model. A is judged to be sound. This item is noted here to listing of changes implemented to the ensure that the final HRA for internal events model is provided in TVA HFFA0031STARTHVAC conforms to the final Calculation NDN0009992012000013.

findings of the room heat-up calculation. Each of the specific items in this F&O is

2) Potentially conservative and risk significant: addressed below:

MSO panel evaluations determined that spurious The HFE HFFA0031STARTHVAC is using opening of the HPCI min flow valve with HPCI 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> instead of 8. TVA calculations running would drain the CST to the suppression (MDN0009992012000027 Revision 1 and pool in a short time and therefore fail the suction MDN0009992012000010 Revision 0) and source for HPCI and RCIC. The SP was not show that the HVAC systems crediting this credited as a suction source at this time. The action do not need to be recovered until MSO EP characterization of MSO scenario 2x over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the scram. The final and 2y is accurate. In reality, a single spurious calculations are referenced in the HRA open of the HPCI min. flow valve will cause HPCI calculation.

(if running) to draw down the CST to a level that would prevent RCIC from having an adequate An analysis is available for evaluating the supply of inventory to support a 24-hr mission impact of a spuriously open HPCI min flow time. This is recognized as a potential over- valve and is documented in TVA Calculation conservatism that may be readdressed during NDQ-0999-2010-0002, BFN NFPA 805 model refinements, if necessary. Multiple Spurious Operation Review, Revision 1. It shows that this MSO can The flow path to drain the CST to the deplete the CST inventory, with HPCI as an suppression pool is as follows: HPCI Running injection source, in about 1.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This is and aligned to the CST a Flow Diversion due to almost 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> short of what HPCI is Min. Flow Line isolation valve (4) Open which credited. The model fails early HPCI for this Ts off the 14-inch HPCI injection line. This is a MSO and this is not overly conservative.

potential over-conservatism because HPCI will RCIC is also failed due to the spurious run level up to RPV L8 then trip, restarting at L2. opening of the HPCI minimum flow valve.

This attribute is not accounted for in the FPRA for the spurious operation sub-trees, but is Tripping the EHC pumps is no longer a 174

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension accounted for in the internal events modeling. As scenario considered in the model. See MSO a refinement TVA may later on perform a MAAP report.

run to actually determine the impact of the 2x and 2y MSO scenarios on CST inventory. MSO scenario 1a is Resolved as the decision has been made on how it will be

3) Considerations and evaluations are being addressed. This action and other pending made to credit tripping of the EHC pumps to MSO actions are tracked under PER recover the MSO scenario for MSIV(s) stuck (Condition Report) 424389. These actions open. This new potential recovery should be will be committed to in the LAR, and supported by thermal hydraulic calculations as prioritized for completion in accordance with applicable. the implementation schedule.

4) MSO scenario 1a was documented as OPEN.

MSO scenario 1a is Resolved as the decision TVA performed a calculation to address this has been made on how it will be addressed. This seal LOCA leakage and that calculation is action and other pending MSO actions are referenced in the MSO report. The MSO tracked under PER (Condition Report) 424389. report discusses this in more detail and These actions will be committed to in the LAR, indicates that this leakage is not significant and prioritized for completion in accordance with and the MSO does not warrant modeling.

the implementation schedule. This leakage was factored into the HPCI min flow valve spurious opening analysis

5) Scenario 2d Recirc pump seal LOCA - The discussed in item 2 above.

open disposition is to ensure that TH analysis accounts for recirc seal leakage. TVA indicates There is no need for new TH calculations for the TH analysis being performed by GE is not MSO 2ai. This MSO is properly modeled complete. Completion of the TH analysis is and not overly conservative. Model reviews tracked in the Project Schedule. have not shown that an action to close the

6) Scenario 2ai Uncontrolled feedwater injection MSIVs to mitigate this MSO is needed.

into RPV - 1) A thermal hydraulic calculation has MSO 2PSs has been resolved by cable not been performed on vessel overfill due to routing the (Turbine Bypass Valve) TBV's uncontrolled feedwater injection. The only draft and the model has been changed thermal hydraulic calculation that has been accordingly. The TBV's cannot be impacted performed on overfill due to condensate and by the same fire as the MSIV's and an RHR, and is included in the draft thermal action has been included to prevent ECCS hydraulic analysis available on the ExtraNet. 2) start for those scenarios where time was

'taking away high pressure inventory make up available based on random TBV failures.

systems.' refers to a flood up from feedwater See the MSO report.

could fill the steam lines and defeat the steam driven high pressure make up systems HPCI or There is no action required for MSO 2PSu.

RCIC. No action has been modeled in the PRA to close the MSIVs in response to a vessel overfeed MSO 4w was resolved by a TVA analysis of event. Scenario 2PSg loss of CRD pumps - notes the ring header. FPRA Modeling was not indicate to validate a calculation exists for necessary. See the MSO report.

acceptability of no RVLIS backfill function. What TVA Calculation EDQ02482002042 is the status of this validation? TVA notes The Revision 42 was issued to demonstrate calculation is in progress with a forecast battery capacity is acceptable with four 175

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension completion of 21-FEB-12. worst case spurious operations. This

7) Scenario 2PSs Spurious opening of the analysis worst case anticipated alternate Pressure regulator (TCV and BPV) - Notes alignments for a fire event. Results indicate indicate this is to be dispositioned with MSO 2b, the battery capacity is acceptable for at but it is not clear how or whether this was done. least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> without a charger. Batteries 4, Please discuss how this scenario was disposed. 5, and 6 are evaluated in TVA Calculation TVA indicates The Turbine Control Valves and EDN0248920111 and may require charger Bypass Valves have not been routed, and are restoration in 30 minutes.

assumed to fail open. Routing of the EHC is being performed so that an operator action to de-energize the EHC pumps can be modeled.

8) Scenario 2PSu potential RHR water hammer -

expert panel disposition indicates head tank system has sufficient capacity provided leakage rate limits are monitored. Does 'monitored' mean post-fire or during normal plant operations? What assurance is there that monitoring occurs? TVA responded that Monitored means during normal plant operation. System performance criteria will be put in place for the leakage rates and system monitoring requirements will be established for normal plant operation.

9) Scenario 4w Too much flow through ring header - Thermal hydraulic calculations appear to be an open item. TVA indicates This TH analysis is tracked in the Project Schedule.

10) Scenario 5PSf Battery drain - Battery duty cycle calculation appears to be needed. TVA indicates The calculation is in progress. The completion of the calculation is tracked in the Project Schedule.

(This F&O originated from SR SC-B1) 4-7 Resolved A list of recovery actions is provided in table 5.0 Basis for Significance TVA Calculation NDN0009992012000011, F&O Resolved - No of the HRA report. The majority of the actions are Step not performed TVA Fire PRA -Task 7.12 Post-Fire Human Impact on CILRT assigned scoping HFEs or are stated as being Reliability Analysis, Revision 3 documents Interval Extension.

dependent on future procedures for detailed Possible Resolution the BFN Fire PRA human reliability analysis.

analysis. Additionally, newly identified potential For recovery human failure events, All risk significant HFEs are evaluated with recoveries are developed in section 5.4 and are document applicable procedure(s), cues, detailed HRAs. New operator interviews also assigned scoping HFEs. (This F&O performance shaping factors and availability have been obtained in incorporated into the originated from SR HR-H2) / adequacy of manpower. For risk-significant HRAs. Risk significant actions have been recoveries, perform detailed HRA. identified. The resulting HFEs have been applied to the BFN FPRA quantification.

176

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension The fire HRA will be updated upon completion of procedure updates, modifications and training. (Refer to Attachment S, Table S-3, Item 33).

4-9 Resolved There is no documentation of a review to identify Basis for Significance TVA Calculation NDN0009992012000011, F&O Resolved - No potential recovery actions to improve modeling Risk-significance TVA Fire PRA -Task 7.12 Post-Fire Human Impact on CILRT realism at the accident sequence / cutset level Reliability Analysis, Revision 3 documents Interval Extension.

based on review of the FPRA results, and a Possible Resolution the BFN Fire PRA human reliability analysis.

finding is made to do so. For example, a review To provide a more realistic evaluation of Potential recovery actions were identified for potential recoveries for locally aligning MOVs significant accident sequences, identify during the cutset review process. The 805 has not been performed. The potential for additional potential operator recovery transition team consisting of operations, recovering fire-impacted offsite power or diesel actions that can restore the functions, design engineering, and fire protection generator operation in instances where circuit systems, or components. personnel with site specific experience and failures don't preclude recovery has not been knowledge, and the fire PRA team jointly reviewed or modeled. TVA has, however, evaluated risk significant fire scenarios to identified one potential recovery action to trip the identify recovery actions and modifications EHC pumps to recover a risk-significant stuck that could reduce the risk of these open MSIV MSO scenario, based on a review of scenarios. These identified fire PRA actions the FPRA results, but this potential action has not were then aligned with the recovery actions yet been modeled or documented. being credited for the NSCA to ensure the (This F&O originated from SR HRA-D1) PRA actions would be properly represented by proposed fire procedures.

The proposed action to trip the EHC pumps was not utilized. Further analysis showed that this MSIV MSO, if it occurred within the first hour of the accident, could cause a rapid depressurization, ECCS pump start, and subsequent pump down of the suppression pool to the hotwell in a time frame that did not allow adequate detection and mitigation of the sequence with a human action. After approximately one hour, mitigation was considered feasible by inhibiting the ECCS start. This sequence was assumed to result in core damage due to the failure of the suppression pool function. Cable routing showed the turbine control valves and turbine bypass valves were not impacted by fires that could impact the MSIVs so they were subject to random failures only. This scenario was modeled for 177

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension two time frames. The first only required random failures or either the bypass valves or the control valves with a one hour mission time and no mitigation. The second required random failures of the bypass valves or control valves with a 23 hour2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> mission time and credited a recovery action to bypass the ECCS auto start and prevent the pump down of the suppression pool.

Offsite power recovery is modeled by crediting action to recover AC busses.

These bus recovery actions are included in the new recovery actions.

4-12 Open As documented in Section 6.2 of Component Basis for Significance TVA Calculation NDN0009992012000011, No Impact on CILRT Selection report, a review of the fire emergency Step not performed TVA Fire PRA -Task 7.12 Post-Fire Human Interval Extension.

procedures (FEPs) or similar fire-related Reliability Analysis, Revision 3 documents The evaluation used instructions was not conducted since the BFN fire Possible Resolution the BFN Fire PRA human reliability analysis. the FPRA model that safe shutdown strategies will updated as part of Consider modifications of existing internal A review of the EOIs for all three units was will represent BFN at the NSCA. The FPRA therefore does not events accident sequences that will require performed and documented in the analysis. the time this ILRT consider modifications of existing internal events modification based on unique aspects of the The fire procedures when complete will be application is accident sequences that will require modification plant fire response procedures when it is reviewed for infeasible operator actions. If applied. Therefore, based on unique aspects of the plant fire available. undesired operator actions are identified, the HFEs that will be response procedures. This approach does not either the procedure will be modified to in place will no reflect the as-built as operated plant. (This F&O eliminate the potential action or the potential longer be a strategy originated from SR PRM-B5) action will be modeled and its risk employed by BFN for significance determined. This review will fire hazards.

include the main control room abandonment procedures. If modifications to the existing internal events accident sequences require Although BFN modification based on unique aspects of the procedures that will plant fire response procedures after the be put in place upon procedures are approved, TVA Calculation transition to NFPA NDN0009992012000015, TVA Fire PRA - 805 are not yet Subtask 7.2.1 Fire PRA Component finalized, Selection," Revision 1, will be updated to corresponding HFEs reflect the required changes. This F&O is and HEPs have been considered open until the procedures are developed for the finalized. The fire HRA will be updated FPRA based on upon completion of procedure updates, realistic proposed modifications and training. (Refer to actions, including Attachment S, Table S-3, Item 33). credit for logical AND of routed redundant instrumentation 178

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 F&O Basis for Significance/Possible Impact on CILRT Status Fact/Observation Disposition No. Resolution Interval Extension trains.

4-15 Resolved Finding The 480V AC High-Low Pressure Interface (High Basis for Significance The Fire PRA was updated to reflect the F&O Resolved - No Consequence) Motor Operator Valves had their Model realism; likely not risk-significant latest guidance of NUREG/CR-7150 Impact on CILRT power cable selected for potential for spurious (Reference [Reference 35]), which finds that Interval Extension.

operation due to three-phase hot shorts. Possible Resolution 3-phase proper polarity hot short are not Suggestions are made for refinements: For three-phase hot shorts involving credible.

1-FCV-069-0001 (ungrounded, Thermoset power thermoset cable for high consequence cables) - power is not removed; FPRA models equipment, screen such events as not fails to close; three-phase hot short probability is credible and provide dispositions of such negligible due to thermoset insulation; suggestionscreening in the documentation.

is made to provide a disposition for non-credibility of three-phase hot short for this functional state 1-FCV-074-0048 (functional state applies when desired position is RESOLVED and power to starter is removed; ungrounded, Thermoset power cables routed in dedicated conduit with power removed from the starter) - power is removed from this valve; hot short probability is negligible due to thermoset insulation, but hot short is modeled as a 1.0 probability. Suggestion is made to model this realistically by removing this as a credible impact from the FPRA 1-FCV-074-0053 (Normally Resolved, Required Resolved; ungrounded, Thermoset power cables)

- power is not removed; three-phase hot short probability is negligible due to thermoset insulation; suggestion is made to provide a disposition for non-credibility of three-phase hot short for this functional state 1-FCV-074-0067-XO (Normally Resolved, Required Resolved; ungrounded, Thermoset power cables) - power is not removed; three-phase hot short probability is negligible due to thermoset insulation; suggestion is made to provide a disposition for non-credibility of three-phase hot short for this functional state 1-FCV-075-0025-XO (Normally Resolved, Required Resolved; ungrounded, Thermoset power cables) - power is not removed; three-phase hot short probability is negligible due to 179

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 thermoset insulation; suggestion is made to provide a disposition for non-credibility of three-phase hot short for this functional state 1-FCV-075-0053-XO (Normally Resolved, Required Resolved; ungrounded, Thermoset power cables) - power is not removed; three-phase hot short probability is negligible due to thermoset insulation; suggestion is made to provide a disposition for non-credibility of three-phase hot short for this functional state (This F&O originated from SR CS-A8) 4-17 Open Finding In considering whether there are possible new Basis for Significance A review was conducted of 1) screened No Impact on CILRT scenarios not addressed in the Internal Events Insufficient documentation initiating events from the internal events Interval Extension.

PRA that should be considered for the Fire PRA PRA model documentation, and 2) MSO The evaluation used resulting in additional equipment that needs to be Possible Resolution impacts on plant safe shutdown and on the the FPRA model that included in the Fire PRA, Section 6.2 states that Document a review of any new accident potential for new initiating events. The will represent BFN at the following was performed with the sequences, including timing considerations results of this review are documented in the the time this ILRT observations documented. (1) Considered not in the internal events, including a review Component Selection report, subtask 7.2.1, application is sequences screened out of the Internal Events of fire emergency procedures. section 6.2, and Table 16. The review applied. Therefore, PRA that may become relevant to the Fire PRA included an evaluation of generic and plant the HFEs that will be and need to be implemented in the Fire PRA specific MSO scenarios to identify the in place will no Model. A review was conducted for such potential for any unique failure impacts. No longer be a strategy scenarios, originally eliminated from the Internal new sequences were identified which were employed by BFN for Events PRA, to determine if the analyst needs to not already included in the Fire PRA model, fire hazards.

add components to the Fire PRA Component or adequately addressed by system logic List, as well as, model those components (and models as modified for the Fire PRA. A failure modes) in new sequences in the Fire PRA review of fire emergency procedures will be Model; (2) Considered the possible effects of performed after procedure development is spurious operations that may result in new complete.

accident sequences and associated components of interest that should be addressed in the Fire PRA and go beyond considerations in the Internal Events PRA. Typically, these new sequences arise as a result of spurious events that cause a LOCA: e.g., spurious opening of safety relief valves, Adversely affect plant pressure control: e.g., safety relief valve events, Allow overfill situations: e.g., reactor vessel overfill that if unmitigated could subsequently fail credited safe shutdown equipment such as HPCI or RCIC pumps, or Introduce other new scenarios that may not be addressed in the Internal Events PRA; and (3) A review of the fire emergency procedures (FEPs) or similar fire-related instructions was not conducted since the BFN fire safe shutdown strategies will be updated as part of the NSCA. To the extent that 180

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 the associated human actions and their effects will be explicitly included in the Fire PRA Model, new sequences and corresponding components may need to be included in the Fire PRA. It should be recognized that some of the human actions from these potentially new sequences may have to be addressed in the Fire PRA.

Examples are: The Internal Events PRA likely will not have addressed main control room abandonment scenarios where fire-specific operator actions and equipment sets are relied upon; Fire-specific manual actions designed to preclude or overcome spurious operations will likely not have been addressed in the Internal Events PRA. Other procedural actions may address a degraded barrier, or deal with a breaker coordination problem, among others; Fire specific manual actions may cause intentional failure of a safe shutdown function or a subset of that functional response. For example, a proceduralized action may be to trip a power supply thereby disabling (failing) certain equipment in the plant. The effect of this action should be implemented in the Fire PRA Model by acknowledging the affected components in the Fire PRA Component List and noting the success of the proceduralized human action as a failure mode of that component in the Fire PRA Model (including any new resulting accident sequences as appropriate).

Table 9 of the CS notebook provides this review for new accident sequences. However, Table 9 does not provide much information. It lists the following considerations: Spurious opening of one or more safety relief valves, Spurious closure of all MSIVs, Loss of Condenser Vacuum, Loss of Feedwater, and Turbine Bypass Unavailable.

The expectation would be to document the entire review to accomplish the above steps, such as (examples only) 1) examining all MSO scenarios for potentially new accident sequences (e.g.,

overfill as an initiating event); 2) fire-induced floods, from causes such as: a. system relief valves opening due to system overpressurization that result from spurious operations (not the SRVs, but relief valves designed to protecting from system overpressure), b. spurious opening of system drain valves, or c. water hammer; examples are: i) fire water system actuates and 181

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 isolation valve spuriously closes, ii) keep fill pump for injection system fails, pump outlet piping drains and pump starts, iii) drain valve spuriously opens on pump outlet piping, draining the piping and pump receives signal to start, etc.

d. fire-specific ISLOCA leakage sources; 3) Loss of power to the control room annunciator tile boards.

(This F&O originated from SR PRM-B5) 4-18 Resolved Finding For fire-induced flooding, Scenario 2e, 2f, 2ae Basis for Significance MSOs (Multiple Spurious Operations) F&O Resolved - No are high-low pressure interface concerns, but no Step not performed credible for the Browns Ferry design have Impact on CILRT discussion is provided of considerations of been identified in TVA Calculation NDQ- Interval Extension.

potential flood locations, extent and Possible Resolution 0999-2010-0002, BFN NFPA 805 Multiple consequences. Document considerations of flood locations, Spurious Operation Review, Revision 1 and (This F&O originated from SR AS-B3) extent and consequences for fire-induced addressed by TVA Calculation floods, such as fire-induced ISLOCA. NDN0009992012000013, TVA Fire PRA -

Task 7.5 Fire-Induced Risk Model, Revision

4. The subject of ISLOCAs (Interfacing System Loss of Coolant Accidents) is addressed by Fire-Induced Risk Model report. These types of events are modeled similarly for both Internal Events and FPRA.

ISLOCAs are assumed to lead directly to core damage and are modeled under the ISLOCA Top; therefore flooding concerns are of no further consequence with respect to core damage. Reference NUREG/CR-5928, "ISLOCA Research Program Final Report."

The three MSO listed in the description include:

MSO 2e - RPV coolant drain through the SDV vent and drain MSO 2f - Inventory control Hi/Lo pressure interface valve spurious operation -

(Residual Heat Removal) Shutdown Cooling (SDC) Suction Isolation Valves MSO 2ae - Spurious operation (open) of both Reactor Water Clean-up isolation valves may route RPV inventory into the RWCU system In addition to the ISLOCA scenarios above, several plant-specific scenarios that could result in fire-induced flooding were identified by the MSO expert panel. These potential 182

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 fire-induced flooding scenarios were the result of the draining of normally full discharge piping prior to spurious start of Emergency Core Cooling System (ECCS) pumps, which then would have caused a water hammer to the pumps discharge piping, resulting in potential flooding due to piping failure. The scenarios were evaluated by the Fire PRA, and addressed both qualitatively and quantitatively.

4-21 Open Finding The review of EOIs and annunciator response Basis for Significance TVA Calculation NDN0009992012000011, No Impact on CILRT procedures for instruments applicable to Incomplete analysis TVA Fire PRA -Task 7.12 Post-Fire Human Interval Extension.

undesired operator actions is documented in Reliability Analysis, Revision 3 documents The evaluation used Section 5.6.1 and 5.6.2 of HRA notebook, and Possible Resolution the BFN Fire PRA human reliability analysis. the FPRA model that Attachment F. A review of the EOIs for all three units was will represent BFN at However, fire emergency procedures and control performed and documented in the analysis. the time this ILRT room abandonment procedures were not The fire procedures when complete will be application is reviewed, since these procedures employ the reviewed for infeasible operator actions. If applied. Therefore, SISBO approach. Therefore, review is not for the undesired operator actions are identified, the HFEs that will be as-built as operated plant. either the procedure will be modified to in place will no eliminate the potential action or the potential longer be a strategy (This F&O originated from SR ES-C2) action will be modeled and its risk employed by BFN for significance determined. This review will fire hazards.

include the main control room abandonment procedures.

Although BFN This F&O is considered open until the procedures that will procedures are finalized. The fire HRA will be put in place upon be updated upon completion of procedure transition to NFPA updates, modifications and training. (Refer 805 are not yet to Attachment S, Table S-3, Item 33). finalized, corresponding HFEs and HEPs have been developed for the FPRA based on realistic proposed actions, including credit for logical AND of routed redundant instrumentation trains.

4-28 Resolved Finding LERF is relatively high, in relation to CDF. TVA Basis for Significance FPRA model refinements have been F&O Resolved - No indicated that Fire PRA model refinements have Risk significance implemented for LERF to reduce the Impact on CILRT primarily focused on fire CDF. Fire induced contributions due to MSOs. Design Interval Extension.

MSOs are dominating the CDF and LERF, which Possible Resolution changes proposed to reduce CDF values 183

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 is decreasing the difference in the CDF and As part of refining the FPRA for CDF are no longer credited in a fashion that LERF values. As these MSOs are refined, Fire results, include FPRA refinements that results in a consequential containment induced LERF will be reduced to a more address realism for the LERF results. failure. In the Revision 4 Internal Events expected value relative to the Fire CDF. LERF is 18%, 21% and 10% of CDF for Design changes proposed to reduce CDF values Units 1, 2, and 3, respectively. In the are credited in a fashion that results in a Revision 0 Fire PRA post transition model consequential containment failure. LERF is 3.4%, 2.9% and 3.5% of CDF for Units 1, 2, and 3, respectively, and is less (This F&O originated from SR FQ-D1) than the respective percentages for internal events. The current LERF reviews are documented in TVA Calculation NDN0009992012000012, TVA Fire PRA -

Task 7.14: Fire Risk Quantification, Revision 3. Changes to the model are documented in TVA Calculation NDN0009992012000013, TVA Fire PRA -

Task 7.5 Fire-Induced Risk Model, Revision 4.

4-30 Resolved Finding An HFE dependency analysis / modeling was not Basis for Significance In the Fire PRA model initially submitted for F&O Resolved - No performed for LERF. Step not performed the LAR, there was no dependency between Impact on CILRT (This F&O originated from SR FQ-D1) non-LERF and LERF actions. This approach Interval Extension.

Possible Resolution was subsequently abandoned and Perform an HFE dependency analysis / dependencies involving LERF actions were modeling for LERF. subsequently taken into account. This is documented in TVA Calculation NDN0009992012000011, TVA Fire PRA -

Task 7.12 Post-Fire Human Reliability Analysis, Revision 3.

5-1 Resolved Finding A sampling of walkdown sheets was provided to Basis for Significance A walkdown within the global analysis F&O Resolved - No justify barriers and separation. The criteria to Due to no information provided boundary that included all elevations, all Impact on CILRT judge barrier adequacy were not provided. three units of the Control Building, Diesel Interval Extension.

Possible Resolution Generator Buildings, Intake Pumping Walkdown sheets provided as evidence but should be formally referenced to a file or Provide Walkdown Sheets with criteria for Station and RHR Service Water (RHRSW) attachment. assessing the fire barrier adequacy. cubicles was conducted in April 2012 by a Fire Protection Engineer with more than (This F&O originated from SR PP-B7) seven years of experience who is also a licensed Professional Engineer. The walkdown sheets are included in TVA Calculation MDQ099920100002, NFPA-805 Transition - Browns Ferry Plant Boundary and Partitioning Report, Revision 8, Attachment B. This walkdown confirmed the conditions and characteristics (criteria) to justify barriers and separation used in the Browns Ferry analysis.

184

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 5-2 Resolved Finding Comparing FRANX Access Database and Table Basis for Significance PAUs 28-1 and 28-2 were reserved for a F&O Resolved - No 5-1 of the PP documentation: Information not consistent between future location on the Unit 3 Diesel Impact on CILRT

a. Database has PAU 28, table does not documentation and FRANX database Generator Building Roof to house new Interval Extension.

chillers. The arrangement is planned to be

b. Table lists PAU 'Refuel', DB lists 'RF'. Possible Resolution similar to PAUs 27-1 and 27-2 which are (This F&O originated from SR PP-B1) Reconcile Database and Documentation located on the Units 1 and 2 Diesel Generator Building Roof. Currently, there is a plant modification (non-NFPA 805 related) that has not been scheduled and therefore, 28-1 and 28-2 do not exist and were simply proposed as new (future) PAU IDs. As such:

References to PAUs 28-1 and 28-2 have been removed from the FRANX Model.

Reference to PAUs 28-1 and 28-2 have been removed from TVA Calculation MDQ099920100002, NFPA-805 Transition

- Browns Ferry Plant Boundary and Partitioning Report, Revision 8.

The database of plant analysis units documented in the Plant Boundary &

Partitioning Calculation has been reviewed to ensure consistency in the naming convention for PAUs.

5-3 Resolved Finding The Unit 3 Chillers are not currently configured Basis for Significance This finding is strictly editorial and has F&O F&O Resolved - No similar to the Unit 1/2 Chillers. A planned design NFPA-805 Design Change Commitment Resolved - No Impact on CILRT Interval Impact on CILRT change will relocate the Unit 3 Chillers to the 595 Extension on the Fire PRA development Interval Extension.

Elevation of the Unit 3 Diesel Generator building. Possible Resolution and/or quantification process. The revision However, since the potential design change is Proposed Resolution is to follow through on of the Plant Boundary & Partitioning only a plan at this time, the Unit 3 Chillers are not the design change calculation available to the peer reviewers included in this analysis. included references to the Unit 3 chillers (This F&O originated from SR PP-B1) that do not reflect the as-built plant, or commitments in the NFPA-805 transition LAR.

It has been verified that the proposed system is not credited in the FPRA mods model.

Other areas of the NFPA-805 transition effort, such as TVA Calculation MDQ099920100002, NFPA-805 Transition

- Browns Ferry Plant Boundary and Partitioning Report, Revision 8 does not include a reference to this proposed modification.

185

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 5-6 Resolved Finding There were not sufficient details as to why it is Basis for Significance TVA Calculation NDN0009992012000014, F&O Resolved - No justified that there was no plant specific fire IGN-B4 requirement not met. BFN Fire PRA - TASK 7.6 Fire Ignition Impact on CILRT updates. Frequency, Revision 3 documents the Interval Extension.

Possible Resolution Bayesian update of the fire ignition A. The word search does not seem sufficiently deep. In section 7.2, the PER database was Re-examine BFN Historical Fire History and frequencies.

searched for keywords Fire and Smoke. It more accurately disposition why this data Section 6.2, Collect and Review Plant Fire seems Browns Ferry should use the larger should not be used Event Data describes the review of historical number of keywords given in the EPRI survey to plant-specific data for Browns Ferry to search from. This leads to a question of the determine if generic fire ignition frequencies comprehensiveness of the fire history search. require updating based on prior events. The B. Guidance for subjective criteria not addressed. BFN plant fire history was collected by searching the PER (Problem Evaluation C. There is no Bayesian Update: In attachment 8 Report) database, TVAs CAP for the there is no Bayesian updates using plant fire keywords Fire, Smolder, Explosion, history. Due to the amount of operating Extinguish and Smok (to capture experience for browns ferry it seems as if some Smoke and Smoking). A 10-year period challenging fires were found, and given the extending from January 01, 2000 to number of units at Browns Ferry, there should be December 31, 2009 of historical fire data for an adequate data size for a Bayesian update as units 1, 2 and 3 was reviewed.

to accurately reflect a realistic state of the plant. Configuration control of the Fire PRA model (This F&O originated from SR IGN-A4) will be maintained by integrating the Fire PRA model into the existing processes used to ensure configuration control of the Internal Events PRA model, which requires periodic data updates (Refer to Attachment S, Table S-3, Item 24). This is consistent with current practice in the nuclear industry.

It should be noted that during this review period, the BFN Unit 1 was not operational (shutdown from 1985 - 2007) for more than 7 of the 10 year review period. A summary of the BFN historical fire events identified from the PER database is provided in Attachment 8, BFN Fire Events. This review resulted in the identification of one additional potentially challenging fire event from the events identified prior to the peer review. Section 6.2 of the Fire Ignition Frequency calculation and Attachment 8 contains additional discussion of the expanded PER search.

Based on the plant-specific review of BFN fire events for Units 1, 2, and 3, a total of 67 fire events were identified and reviewed, with 58 of these events being immediately screened based on where (building, area, location, e.g., outside plant boundary area) and when (at-power, shutdown, etc.) the fire 186

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 events occurred. The remaining events were placed into their respective fire ignition bins. Only two of these events were identified as potentially challenging events:

one for Bin 9 and the other for Bin 19. The two potentially challenging events were a hydrogen fire in the switchyard/yard and a compressor fire.

No unusual patterns of occurrence or outlier fire events were noted. Given that there were no unusual patterns of fires and no more than one fire event per bin that wasnt immediately screened based on where and when the fire event occurred, no plant specific updates of generic frequencies were considered. Guidance in NUREG/CR-6850 states that if there are only a small number of fire events in the plant, use of generic fire frequencies is warranted.

Otherwise, a plant-specific update of the fire ignition frequencies may significantly alter the fire frequencies. With only one plant specific fire event associated with each bin, the frequency of that bin would increase significantly if Bayesian updates were employed. Typically the fire frequency for each bin is smaller than once per 100 years, while a plant will have less than 100 years of total experience. Therefore, with just one fire event the frequency would increase significantly after performing a Bayesian update. The updated frequency could be considered as overly conservative based on the thought that since there is some small probability of occurrence, the event happened to occur at an earlier stage of the observation period.

5-7 Resolved Finding The administration building was placed into the Basis for Significance TVA Calculation MDQ099920100002, F&O Resolved - No PP Global Analysis and then be excluded without Need to show qualitative screening Browns Ferry Plant Boundary and Impact on CILRT a qualitative screening. Partitioning Report, Revision 8, includes Interval Extension.

Possible Resolution Section 4.5 "Addition of Yard PAU". This (This F&O originated from SR IGN-A8)

Show qualitative screening for the section been added to discusses the administration building. qualitative screening for the buildings located within plant analysis area YARD.

The Plant Office Building is included in the list of buildings associated with the YARD so that it becomes part of the global analysis boundary; and therefore, subject to 187

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 qualitative screening analysis. Table 4.5.1 indicates the Plant Administration Building has been screened based on:

NUREG/CR-6850 The compartment does not contain any of the equipment (and their associated circuits) identified in Task 2 and 3, and Lack of ignition sources / combustible material, and A fire in the compartment will not lead to:

An automatic trip, or A manual trip as specified in fire procedures or plans, EOPs, or other plant policies, procedures, practices, or A mandated controlled shutdown as prescribed by Tech Specs due to entering an LCO.

5-10 Resolved Finding In attachment 4, justifications for engineer Basis for Significance TVA Calculation NDN0009992012000014, F&O Resolved - No changing counts during walkdowns were missing. Justification needed for changing source TVA Fire PRA - TASK 7.6 Fire Ignition Impact on CILRT (This F&O originated from SR IGN-A7) counts. Frequency, Revision 3, Section 6.6 states Interval Extension.

that each ignition source was counted in Possible Resolution accordance with the guidance from Resolve the example listed and similar NUREG/CR-6850, Volume 2, Section 6.5.6 justification Provide specific response for: Fixed Ignition Source Counts. This 1-1 includes both visual examination of drawings and plant walkdowns.

1-BDBB-268-0001C The walkdown results are documented as Reactor MOV Board 1C Attachment 4 Fixed Ignition Source Counts HEAF 480V = 1000V of the Fire Ignition Frequency calculation.

480V The resolution proposed by this F&O is focused on the initial count of 2 and the Counts - 2 notes indicated the count was changed to LF - 1 15. The notes column in the calculation Bin # - 16A have been edited to better explain why the ignition source count changed.

Notes - Count changed to 15 per Larry Long The adjusted count value is not applicable to the HEAF (i.e., Bin 16a in NUREG/CR-6850, Supplement 1) for this ignition source.

This ignition source is an MCC panel for which HEAFs are not postulated unless specific conditions are met, based on the guidance in NUREG/CR-6850, Section M.1 and FAQ 06-0017, which is included in 188

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 NUREG/CR-6850, Supplement 1. In this particular case, HEAFs are only assigned to MCC vertical sections with switchgear for the load center supply to the MCC.

Therefore, the Reactor MOV board is assigned a count of two for each vertical section containing supply breakers from the load centers. This approach is documented in Section 6.6 of the Fire PRA Ignition Frequency notebook.

5-11 Resolved Finding For Junction boxes, more detail needed when Basis for Significance The approach to evaluate the contribution of F&O Resolved - No saying boxes appeared well sealed. This is not a justification for exclusion. junction boxes to the fire risk was changed. Impact on CILRT (This F&O originated from SR IGN-A7) As documented in Section 6.6 of TVA Interval Extension.

Possible Resolution Calculation NDN0009992012000014, TVA Add the contribution from junction boxes Fire PRA - TASK 7.6 Fire Ignition Frequency, Revision 3, junction boxes were addressed as follows:

The junction box frequency (bin 18) is apportioned based on the ratio of cable located in the area to the total cable in the plant. The ignition source weighting factor of the cables is used for this bin. A small number of components included as fixed ignition sources have equipment IDs similar to junction boxes (i.e., X-JBOX-XX-XXX) but have attributes like switches and lights. It was observed that these sources meet the definition of electrical cabinets so they were binned as electrical cabinets in bin 15.

5-12 Resolved Finding In attachment 6 of the FIF documentation, many Basis for Significance Transient Influence Factors have been F&O Resolved - No of expert panel judgments for transients have no This process needs to be better described postulated and are documented in TVA Impact on CILRT basis. Due to the missing expert judgments, it is and expert panel judgments justified. Calculation NDN0009992012000014, TVA Interval Extension.

expected that some transient fire ignition Fire PRA - TASK 7.6 Fire Ignition frequencies may be different. Possible Resolution Frequency," Revision 3, Attachment 6, (This F&O originated from SR IGN-A9) Please provide justification for transients in "Transient Influence Factors Expert Panel the FIF documentation. Update the FIF Results," provides the bases for each results when necessary. transient influencing factor used for maintenance, occupancy and storage. Table 10, Ignition Frequency Development Files, documents the File name, file size, file date and DOS time for the EXCEL spreadsheet used to calculate the data.

5-13 Resolved Finding PAUs 28-1 and 28-2 are not counted or Basis for Significance Plant Analysis Units (PAUs) 28-1 and 28-2 F&O Resolved - No walkdowned for FIF (and yet they are listed in F&O created to track this future plant design were credited as future placeholders for new Impact on CILRT your expert panel analysis for transients). It was Control Building Chillers. TVA Calculation 189

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 found out that these are the PAUs for planned 3A change MDQ099920100002, Browns Ferry Plant Interval Extension.

and 3B chillers. Possible Resolution Boundary and Partitioning Report," Revision (This F&O originated from SR IGN-A7) 3 available to the peer reviewers included Follow through on plant design change. references to the Unit 3 chillers that do not Also, walkdown and count these new PAUs reflect the as-built plant (i.e., the PAUs when design change occurs. currently do not exist), or commitments in the NFPA-805 transition LAR. The following activities were completed to resolve this finding:

It has been verified that the proposed system is not credited in the FPRA post-transition model which includes modifications in support of NFPA-805 transition that are committed to in the License Amendment Request (LAR).

Reference to PAUs 28-1 and 28-2 have been removed throughout TVA Calculation MDQ099920100002, Browns Ferry Plant Boundary and Partitioning Report, Revision 8.

5-14 Resolved Finding Counting inaccuracies as follows: Basis for Significance TVA Calculation NDN0009992012000014, F&O Resolved - No

1. Diesel generator battery and battery chargers The counting of items in the incorrect bin TVA Fire PRA - TASK 7.6 Fire Ignition Impact on CILRT are counted in bins 1 and 10, respectively. could inappropriately dilute the per Frequency, Revision 3 documents the Interval Extension.

However, they should be counted in bin 8 with component fire frequency. While this is counting of plant components and identifies the EDG. generally a minor issue, those bins for whichthe mapping to the associated NUREG/CR-6850 bin. Counting of fixed fire sources

2. Counted elevator MG-SET in PAU RF as a bin the total plant count is small could followed NUREG/CR-6850 guidance unless 10 battery charger. This should be counted as experience a significant impact. In the specific case of batteries and battery superseded by an FAQ.

bin 14 motor.

chargers, the unique design of TVA with The following addresses the three counting

3. MSIVs are counted each having one pump; dedicated batteries and chargers could discrepancies identified in this F&O.

however review of training material indicates that cause a notable impact on the resulting per the valves are pneumatic only and there is no The diesel generator battery and battery component fire frequencies. charger counts have been revised as pump.

Possible Resolution indicated in Assumption 3 of the Fire Ignition (This F&O originated from SR IGN-A7) frequency calculation which states the The EDG dedicated batteries and battery chargers should not be included in the following:

population for bins 1 and 10, respectively. It Each diesel generator has two 125VDC is recognized that the resultant approach battery chargers. One (the "B" charger) creates an anomaly in the methodology in located in the same PAU (Physical Analysis that there is no defined methodology for Unit) as the diesel and one (the "A" charger) parsing the EDG fire frequency to allow a located in a separate PAU. The battery frequency to be assigned for the dedicated chargers that are not located in the same batteries and chargers. It is recommended PAU as the diesel are not being included in that the per component fire frequency for bin 8 as a subsystem of the diesel. They are batteries and battery chargers that results being counted as a plant wide charger in bin from the resolution of this F&O then be used 10. A sensitivity study was performed that as the frequency for the EDG dedicated increases the station battery charger 190

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 batteries and chargers. frequency by removing the 8 battery As an alternative, since the concern is chargers out of the denominator of the related to dilution of the main station battery ignition source weighting factor to assess charger frequency, a sensitivity analysis the impact. This would take the total site could be performed. That study would count of 46 for bin 10 and change it to 38.

increase the station battery charger This would result in the per source frequency to assess that impact. frequency for bin 10 being increased by a multiple of 1.21. The results of the sensitivity The elevator MG-set is effectively a motor can be seen in the Task 15 Uncertainty and combination and should also not be counted Sensitivity report.

in bin 10.

The MSIVs should not be counted as a Based on the Component Counts Table in pump. Attachment 4 of the Fire Ignition Frequency calculation, the elevator MG-Set count has been revised such that the MG-Set is considered a part of the motor and is counted with the motor in bin 14, rather than bin 10 as previously reported. The notes column of Attachment 4 states:

This Elevator MG Set is effectively part of the Elevator Motor and is included in its count.

Based on the Component Counts Table in Attachment 4 of the Fire Ignition Frequency calculation, the MSIV count has been revised as indicated in the notes column, which states:

Removed as ignition source based on the definitions in NFPA-30. The two hydraulic fluids allowed for use in the BFN MSIVs are nonflammable.

5-16 Resolved Finding Fire Frequency for bins 5,6,11,24, and 31 are Basis for Significance This finding is editorial and did not impact F&O Resolved - No based on recently published information, that is No reference in documentation the calculated fire ignition frequencies in the Impact on CILRT not referenced of identified in the calculation Fire PRA quantification. TVA Calculation Interval Extension.

Possible Resolution NDN0009992012000014, TVA Fire PRA -

(This F&O originated from SR IGN-B2)

Please include reference TASK 7.6 Fire Ignition Frequency, Revision 3 documents the fire ignition frequencies including the mapping to the generic Bins defined in NUREG/CR-6850 and applicable FAQs. The FAQs are now identified and referenced in the calculation.

The reference referred to in this F&O is NUREG/CR-6850 Supplement 1.

Attachment 12 from the Fire Ignition Frequency calculation addresses the values for bins 5, 6, 11, 24 and 31 and uses the 191

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 information from the supplement. The reference is now explicitly identified in the documentation.

NUREG/CR-6850 developed a fire ignition frequency for two types of hot work related fires - those impacting cables (Bins 5, 11, and 31) and transient combustibles (Bins 6, 24, and 36). These frequency values were subsequently updated in FAQ 08-0048 and Supplement 1 to NUREG/CR-6850. The further review of the industry fire events resulted in another updating of the generic fire frequency values for cable fires caused by hot work (Bins 5, 11, and 31).

5-18 Resolved Finding For assumption 7, 'It is assumed that the loss of Basis for Significance The list of fire scenarios for the three units F&O Resolved - No a single piece of equipment will not adversely This assumption may result in missing within the scope of the BFN Fire PRA has Impact on CILRT affect the ability of the plant to safely shutdown scenarios where the ignition source by itself been expanded to include the contribution of Interval Extension.

and is not risk significant. This allows the use of results in a risk contributing sequence. non-propagating fires. Non-propagating severity factors, non-suppression probabilities, fires are the success branch of a scenario and probabilities of propagation outside the Possible Resolution progression where the fire remains within initiator to limit target set damage. The use of Include fire scenarios where the ignition the ignition source, and therefore, only these factors requires that the success state for source by itself is a target unless it can be generates damage to the ignition source the factor results in only damage to the fire shown that the fire induced damage is itself. Quantitatively, this success branch is initiator. With specific exceptions such as the 4kV bounded by the random failure probability. characterized by the complement of the shutdown panels, auxiliary instrument room severity factor term, i.e., 1-SF. That is, the panels, and others specified by the Fire PRA, it is severity factor is the term that characterizes assumed that the loss of a single fire initiator with the failure branch of the scenario sequence no damage outside the initiator is not risk to account for those fires that propagate significant and a separate fire scenario is not outside the ignition source.

created or quantified', there should be a Each ignition source within the scope of the distinction tying FIF to Random failure probability BFN Fire PRA has been evaluated for to decide if this assumption is valid. identifying if:

(This F&O originated from SR FSS-C4) The severity factor and non suppression probabilities are less than 1.0. Ignition sources with severity factors and non suppression probabilities equal to 1.0 are ignored as the full contribution from this fire is included in the analysis, i.e., there is no split fraction for success or failure branch.

The CDF associated with the propagating scenarios is higher than 1.0E-7. It is assumed that CDF values less than 1.0E-7 are associated with ignition sources that, by themselves will not be significant contributors as long as the sum of the CDF contributions for all screened fire 192

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 compartments is less than 10% of the estimated Fire CDF.

The success branch for those ignition sources with severity factors and non suppression probabilities less than 1.0 and have propagating sequences higher than 1.0E-7 to account for the risk contribution of non-propagating fire scenarios. The ignition frequency for these scenarios is the ignition source frequency (i.e., generic frequency times the corresponding location and ignition source weighting factors) times the compliment of the severity factor (i.e. 1-SF), which is the non propagating probability of the fire event. The targets for these scenarios are the basic events mapped to the Fire PRA cables connecting to the corresponding ignition sources.

The technical details of this F&O resolution are included in TVA Calculation MDQ0009992012000104, BFN Scoping Fire Modeling Scenario Report," Revision 2, Attachment 2.

5-24 Resolved Finding EPMs QA walkdown procedure, EPM-DP-FP- Basis for Significance As stated by the F&O, Walkdowns were F&O Resolved - No 002, Rev. 0., was reviewed and states: In reviewing the walkdown procedure, there performed at Browns Ferry in accordance Impact on CILRT

'Proper quality assurance practices require that is a disconnect between the procedure and with applicable procedures. The analysis Interval Extension.

data collected during these walkdowns be the results of using that procedure. documentation has been updated to reflect completed using two-party verification and However, this was found to be due to this.

appropriately documented and archived for future wording in the FSS document that does not reference' properly connect resolution of errors in During target data entry into the electronic However, while reviewing the Fire Scenario automatic target validation with manual database and automatic validation of Selection (FSS) documentation, Section 4.4.2.1, target validation. raceway targets, it was found that many

'Automatic Target Validation', states: Possible Resolution raceways had formatting differences

'It should be noted that this raceway ID validation Adjust wording in 4.4.2.1 'automatic target between the field ID tags and the electronic does not account for transcription errors other validation' to link to 4.4.2.2 'manual target data. In these cases, the targets were than formatting variances. These could include validation' to show that errors would be manually validated using drawings, the unclear handwritten characters (S vs. 5, I vs. 1, 0 properly found and corrected. Possible electronic database, and other resources.

vs. O, etc.) as well as mismarked conduits within solution is deleting immaterial wording in The validation was used as a means to the field where the wrong ID was used or the 4.4.2.1 detailing an acceptable level of error.ensure the walkdown data was converted to wrong conduit labeled. As noted in Section 2, the same format as each raceway appears these errors are assumed to not have a in the electronic database. The analysis significant effect on the Fire PRA plant response documentation was also updated to discuss model damage state. This assumption is with more detail the raceway identification considered acceptable because the number of issues encountered and their resolution.

errors described here is considered to be low relative to the large number of targets collected 193

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 during walkdowns' This example shows a disconnect between the procedure and the results of using that procedure. The statement that this level of error is acceptable requires justification so that the impact of errors on the model results is acceptable in terms of model fidelity and risk results.

However, section 4.4.2.2 details manual target validation to fix the errors found above. Wording in 4.4.2.1 should be adjusted to better link this process.

(This F&O originated from SR FSS-D10) 5-26 Resolved Finding In section 5.5.2.1, 'Transient Zone Basis for Significance For many transient fire scenarios, the F&O Resolved - No Determination', explain why damage to conduits Conduits by themselves could result in risk scoping fire modeling analysis Impact on CILRT in areas w/o cable trays or electrical cabinets significant damage conservatively assumed full compartment Interval Extension.

would not result in risk significant damage damage. For risk significant fire Possible Resolution compartments, the floor area of the fire (This F&O originated from SR FSS-A2)

Resolve or give reasoning as to why this compartment was divided into multiple would not result in risk significant damage. transient zones. The Fire PRA targets, including any conduit, within each transient zone were assumed damaged.

Because conduit damage was considered for all fire scenarios, a sensitivity study is not required.

7-1 Resolved Finding The MSO report indicates that several MSOs did Basis for Significance TVA Calculation NDQ-0999-2010-0002, F&O Resolved - No not have a final disposition listed. These events Incomplete MSO final resolutions. BFN NFPA 805 Multiple Spurious Impact on CILRT were still in the process of deriving and Operation Review, Revision 1 indicates the Interval Extension.

documenting the basis for how the MSO was Possible Resolution final disposition for each MSO. The intended to be treated in the PRA. In fact, the Complete the MSO final resolutions. treatment of MSOs in the fire PRA is MSO report documents the intended treatment. complete and the Fire PRA model has been However, as the basis for these events in not confirmed match the final resolution (TVA complete, their treatment in the fire PRA is Calculation NDN0009992012000096, BFN tentative and cannot be considered complete Fire Probabilistic Risk Assessment -

until the bases documentation is complete and Summary Document Revision 1).

the model is modified (or confirmed) to match the final resolution.

(This F&O originated from SR ES-A4) 8-3 Resolved Finding The scenarios were analyzed for fires damaging Basis for Significance This F&O was resolved as follows; the 98th F&O Resolved - No the closest target. The minimum severity factor is Cat II of SR requires analysis to be based percentile heat release rate was used to Impact on CILRT established based on this configuration. The on two-point intensity model. Only one point characterize each ignition source that did Interval Extension.

not contain oil in order to screen out fires 194

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 following points address this SR: is used (minimum severity factor), which is that are not capable of damaging potential

- Only one point is used for fire intensity. multiplied to the non-suppression targets. Based on report Non-Propagating probability. The non-suppression probability Fire Scenarios, which is Attachment 2 to

- The possibility of automatic or manual includes a notion of time for the suppression TVA Calculation MDQ0009992012000104, suppression is credited for some the scenarios in system activation that was not taken into BFN Scoping Fire Modeling Scenario combination with minimum severity factor. consideration in the analysis. Report," Revision 2, fire scenarios were The non-severe fire scenarios seem to be Possible Resolution considered non-risk significant if the sum of missing. the CDF contributions for all screened fire Ensure that the non-severe fire scenarios compartments is less than 10% of the (This F&O originated from SR FSS-C1) are included. Additional refinements to the estimated total Fire CDF. A fire scenario severe fire scenarios may be appropriate, was developed for risk-significant ignition consistent with their risk significance. sources that are capable of damaging targets and the risk has been quantified.

Additionally, a severity factor has been utilized to identify the probability of fires that are capable of damaging targets within the full ZOI of the 98th percentile fire scenario.

These two scenarios represent two-points in the fire heat release rate probability distribution. For ignition sources such as pumps, which contain oil, the 98th fire damage state assumed a 100% oil spill. To further refine the results of the modeling, the pumps which contain oil were also modeled with the 98th percentile electrical fires and using a 10% oil spill. This is further discussed in Section 5.1 of the Scoping Fire Modeling Scenario Report.

Credit for automatic or manual fire suppression has been updated to require area specific evaluation to determine time to target damage for manual suppression credit and time to suppression system actuation for automatic fire suppression credit. This change involves inclusion of a limited target set to reflect damage, beyond the initiator, that is expected to occur prior to suppression activity. Implementation of this approach for automatic fire suppression credit is being included in TVA Calculation MDQ0009992012000101, BFN Units 1, 2,

& 3 Detailed Fire Modeling Report, Revision 2. Credit for manual fire suppression is included in the scoping fire modeling report where analysis has been performed to identify target damage timing and related target damage sets.

Based on the approach detailed above and in the report Non-Propagating Fire 195

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Scenarios, non-severe fire scenarios were included for all ignition sources with risk-significant 98th percentile fire scenarios.

The impact from the non-severe fire scenarios for ignition sources with non-risk significant fire scenarios should not have a large impact on the PRA analysis.

Therefore, non-severe fire scenarios were not considered during the PRA analysis for ignition sources with non-risk significant fire scenarios.

9-1 Resolved Finding The PRM notebook identifies three high level Basis for Significance To address this F&O, the following system F&O Resolved - No changes which were not directly related to fire The documentation of these changes is not notebooks have been updated: Impact on CILRT induced damage that lead to model changes: sufficient to facilitate PRA applications, Condensate System (for Condensate Flood- Interval Extension.

1) new success criteria for the EECW upgrades, and peer review, particularly with Up)

2) new success criteria for RCW respect to SY-A2, SY-A3, SY-A4 and SY-A5. Raw Cooling water (RCW) System

3) credit for rapid vessel flood-up by Condensate Possible Resolution Emergency Essential Cooling water For EECW the PRM notebook states that the (EECW) System success criteria was improved, but there are no The PRM notebook indicates these changes additional details provided. Per discussions with will likely be adopted into the internal events TVA Calculation NDN-000-002-2007-0008, TVA personnel, the improved success criteria are model. If this is the case, these changes canSY.01 - BFN Probabilistic Risk documented in the EECW system notebook; be documented in the respective system Assessment - Condensate System however, this was not clear from the PRM notebooks. Revision 1) describes the condensate flood notebook. To support SY-A2 and SY-A3 develop up function that has been added for the fire The RCW the success criteria was changed from documentation which shows that pertinent PRA model.

the internal events which modeled the seasonal information was collected and reviewed to TVA Calculation NDN-000-024-2007-0019, influence (5, 8 or 12 pumps required depending ensure that the systems analysis SY.13 - BFN Probabilistic Risk on season) on the success criteria to one that is appropriately reflects the as-built and as- Assessment - Raw Cooling Water System based only a yearly average (8 out of 12 pumps operated systems. Perform formal Revision 1 provide documentation of the required). A calculation reference is provided for interviews with knowledgeable individuals to RCW system success criteria.

the yearly average, but there is no support SY-A4.

TVA Calculation NDN-000-067-2007-0013, documentation or discussion about why a yearly For EECW, it appears this documentation SY.06 - BFN Probabilistic Risk average is appropriate as opposed to one which change has already been incorporated into Assessment - Emergency Equipment contains a seasonal influence (SY-A5). There is the EECW system notebook, if so, clarify Cooling Water Revision 3 documents the no documentation of any other data being used the discussion in the PRM notebook to new success criteria for the EECW system.

to develop the new success criteria (SY-A2, SY- indicate this is the case.

A3). And there is no documentation of For the RCW success criteria, develop walkdowns or interviews with knowledgeable documentation on the use of a yearly plant personnel (SY-A4). average vice seasonal success criteria to The documentation of rapid vessel flood-up by support SY-A5. Per discussions with TVA Condensate has significantly more details than personal, the rapid flood-up mode using the other two changes, but none of the condensate is not in the system notebook, information is referenced. The notebook states but this mode may be removed from the that the flood-up calculation was obtained from model in the future.

the BFN TH engineer but it is not clear what this calculation supports nor is the calculation 196

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 referenced. It is also stated the lineup and process was verified with a BFN operator. It is not clear if this was a formal interview (SY-A4) and no details are provided on the procedures which were looked at to determine the lineup and process (SY-A2, SY-A3). The Condensate SNB contains a minor edit which refers to flood up, but otherwise the rapid flood up mode does not appear to be documented in the SNB.

(This F&O originated from the SRs discussed above) 9-2 Open Finding The new Safe Shutdown Injection Pump is Basis for Significance TVA Calculation NDN-000-NA-2012-000090 No Impact on CILRT currently modeled as a single event with a The Safe Shutdown Injection Pump needs has been initiated to document the alternate Interval Extension.

probability of 0.1. This system is still in the to be modeled in detail to meet SY-A7 (and high-pressure injection pump. This The evaluation used conceptual phase. This F&O is written as a notebook will remain in draft form until the the FPRA model that others) placeholder to model the system in detail at system is installed and operational. This is will represent BFN at some future date. (This F&O originated from SR Possible Resolution a new system (non-safety related) for the time this ILRT SY-A3, SY-A4, SY-A7, SY-A14, SY-A17, PRM- Model the new Safe Shutdown Injection Browns Ferry (an independent system for application is B9, PRM-C1) Pump according to the requirements in SY- each unit) and will provide a means for applied. Therefore, A7 and others. providing reactor inventory over a wide the HFEs that will be range of pressures at a flow-rate at or above in place will no the capability of RCIC. The following longer be a strategy attributes are built into the S&L (Sargent & employed by BFN for Lundy) design modification.100% Capacity fire hazards.

electric motor-driven pump per unit Piping, Valves and Instrumentation for the Although BFN following procedures that will be put in place upon Makeup supply from the condensate transition to NFPA storage tank (CST) header through a duplex 805 are not yet strainer finalized, Backup Capability to Refill the CST with corresponding HFEs Raw Water and HEPs have been developed for the Pump discharge to the Feedwater System FPRA based on injection line realistic proposed actions, including Full-flow return test line to the CST credit for logical AND Electrical Distribution Supply of routed redundant instrumentation Control Power trains.

On-Site 4.16 kV Power Supply (Unit Board)

Fukushima Diesel-Generator 4.16 kV Power Supply 197

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Switchgear (Distribution Board)

Transformer - 480 VAC, 208V/120V Remote (MCR) and Local Operation This new system will be installed for each unit. Logic has been built to reflect the draft design criteria. The model includes pump failure to start/run, failure of the injection motor operated and check valves, failure of the power supply, failure of the water supply, and unavailability due to test and maintenance. The notebook will be finalized after the system is operational.

9-4 Open Finding All of the recovery actions were not included in Basis for Significance All of the recovery actions used by the Fire No Impact on CILRT the dependency analysis. (This F&O originated Incomplete dependency analysis. PRA have been included in the dependency Interval Extension.

from SR HR-H3, FQ-A3, FQ-D1, HRA-D2) analysis, The dependency analysis is The evaluation used Possible Resolution documented in TVA Calculation the FPRA model that Ensure all recovery actions are included in NDN0009992012000011, TVA Fire PRA - will represent BFN at the final dependency analysis. Task 7.12 Post-Fire Human Reliability the time this ILRT Analysis, Revision 3. application is Since the peer review, the BFN FPRA team applied.

has worked closely with the 805 transition team to match the FPRA recovery actions with those actions proposed and credited by the 805 transition team for the 805 Risk analysis. The FPRA team is only crediting those recovery actions that have been shown to sufficiently reduce CDF. The FPRA credited actions have been developed to the extent possible to make these HRAs represent those proposed actions. The final fire procedures are not available to complete and verify the fire HRAs. The FPRA model therefore assumes that these actions will be in the final procedures as currently proposed. Before the FPRA recovery actions can be considered complete, they will have to be re-evaluated when the fire procedures are approved and ready to be implemented in the post 805 transition. (Refer to Attachment S, Table S-3, Item 33).

Sections 5.1.3 and 5.1.4 of the fire HRA calculation include discussion on how this F&O was addressed. Data used in the Fire PRA is provided in Table 5 and Table 5a.

198

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 Additional discussion was placed in section 5.7. The recovery actions are also included in the HRA calculator database that is delineated in Attachment D of the fire HRA calculation.

This F&O is considered open until the procedures are finalized. The fire HRA will be updated upon completion of procedure updates, modifications and training. (Refer to Attachment S, Table S-3, Item 33).

9-5 Resolved Finding A truncation study is provided in the Basis for Significance The truncation limit for quantification F&O Resolved - No Quantification notebook which shows Potentially missing significant CDF documented in TVA Calculation Impact on CILRT convergence at a truncation of 1E-05 for CCDPs. contributors due to choice of truncation limit NDN0009992012000012, TVA Fire PRA - Interval Extension.

There are a large number of high CCDP Task 7.14 Fire Risk Quantification, scenarios that appear to be dominating the Possible Resolution Revision 3. The truncation is set low results and potentially causing a false Revise the truncation study in a manner that enough such that dependencies associated convergence at 1E-05 thereby causing the generates cutsets for all scenarios. with significant cutsets or accident truncation limit to be set too high. For U3, there sequences are not eliminated. For the BFN are 2652 scenarios, 1897 of which provide no FPRA convergence is considered sufficient contribution to CDF because they generate no when successive reductions in truncation cutsets at a 1E-05 truncation. These scenarios value of one decade result in decreasing have the potential to contribute significantly to the changes in CDF or LERF, and the final overall CDF if quantified at a lower truncation. change is less than 5%.

As an example a U3 scenario (26-A.132-H2REC, fire zone=26-A.001-CAB,AF) was quantified at a range of truncation limits :

Trunc CDF [Reference /yr]

1E-05 0 1E-06 1.2E-07 1E-07 2.8E-07 1E-08 4.1E-07 5E-09 4.3E-07 1E-09 <--- Qrecover failed A CDF contribution of 4.3E-07/yr is not insignificant especially given that there are 1897 scenarios generate no cutsets at the 1E-05 truncation.

(This F&O originated from SR FQ-B1) 10-1 Resolved Finding The Fire PRA HRA is adequately documented in Basis for Significance TVA Calculation NDN0009992012000011, F&O Resolved - No the Post-Fire Human Reliability Analysis Documentation issue TVA Fire PRA -Task 7.12 Post-Fire Human Impact on CILRT Notebook. Reliability Analysis, Revision 3 documents Interval Extension.

Possible Resolution the dependency analysis performed for the Dependency analysis is described in the HRA Add dependency analysis output from HRA BFN Fire PRA. The Fire HRA Notebook 199

B45 170314 001 Browns Ferry CILRT Extension BFN-0-17-026 calc in full detail, but the dependency analysis Calculator to the HRA Calc. was revised to expand the discussion on the output from HRA Calculator is missing from the performance of the dependency analysis.

HRA Calc. Attachment F, Recovery Rule File (This F&O originated from SR HRA-E1) Development Procedure, was changed to a more detailed procedure with verification steps and documentation requirements. The output files were listed. The data files used in the dependency analysis are tracked with the fire HRA notebook to allow a reproduction of the dependency analysis if necessary.

This F&O resolution is delineated in section 5.9 of the calculation. It is also addressed by including a file with all of the required and generated files needed to document the dependency analysis for the last model quantification.

3-14 Resolved UAM The 'GE-Hitachi' methodology for assigning Basis for Significance The BFN Fire PRA no longer makes use of F&O Resolved - No probabilities for fires propagating outside The probability of fire propagating outside the 'GE-Hitachi' methodology for assigning Impact on CILRT cabinets was applied. At the time of the review, the electrical cabinet of origin is based on probabilities for fires propagating outside Interval Extension.

this method is not reviewed by the industry. All Draft Report for BWR Owner's Group on cabinets. All cabinet fires are assumed to other empirical models are based on guidance in Fire Propagation in Electrical Cabinets and be capable of propagating outside the NUREG/CR-6850, which provides the technical DC Hot Shorts (dated July 2011). This study cabinets, and electrical cabinet fire justification for their use. has since been updated and industry review scenarios follow the guidance in The scenarios were analyzed for fires damaging process has not been completed. NUREG/CR-6850. The scoping fire the closest target. The severity factor modeling report has been updated to Possible Resolution remove all discussions of the GE-Hitachi computations take into account probability of fire propagating outside the electrical cabinet of Consider either (1) removing the credit for method.

origin based on a study that has not been fire propagation outside electrical cabinets, subjected to industry review. (2) using the probability value of the latest version of the study after it is reviewed and (This F&O originated from SR FSS-D6) accepted or (3) conduct a sensitivity study to establish the impact of this probability value on the final results.

200