CNL-20-002, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (TS-BFN-529)

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (TS-BFN-529)

ML20199M373
Person / Time
Site:	Browns Ferry
Issue date:	07/17/2020
From:	Jim Barstow Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CNL-20-002
Download: ML20199M373 (92)

Text

Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-20-002 July 17, 2020 10 CFR 50.69 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296

Subject:

Browns Ferry Nuclear Plant, Units 1, 2, and 3, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (TS-BFN-529)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.69 and 10 CFR 50.90, Tennessee Valley Authority (TVA) is requesting an amendment to the Renewed Facility Operating Licenses (RFOL) of Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3.

The proposed amendment would modify the BFN licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations, Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed, or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The Probabilistic Risk Assessment (PRA) models described within this Licensing Amendment Request (LAR) are the same as those described within the TVA submittal of the BFN LAR dated March 27, 2020, for TSTF-425 (ADAMS Accession Number ML20087P262), with the same routine maintenance updates applied. TVA requests that the Nuclear Regulatory Commission (NRC) conduct their review of the PRA technical adequacy details for this application in coordination with the review of the application currently in-process. This would

U.S. Nuclear Regulatory Commission CNL-20-002 Page 2 July 17, 2020 reduce the number of TVA and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action, as the details of the PRA models in each LAR are complete which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other. to this letter provides the basis for the proposed changes to the BFN, Units 1, 2, and 3 RFOLs. The categorization process being implemented through this change is consistent with NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0 dated July 2005, which was endorsed by the NRC in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1 dated May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met. to this letter provides the existing BFN, Units 1, 2 and 3 RFOLs marked-up to show the proposed changes respectively. Enclosure 3 to this letter provides the proposed changes in a re-typed version in the BFN, Units 1, 2, and 3 RFOLs respectively.

TVA has determined that there are no significant hazard considerations associated with the proposed change and that the change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9).

TVA requests approval of the proposed license amendment within one year from the date of this submittal with implementation within 90 days.

In accordance with 10 CFR 50.91, a copy of this application with attachments is being provided to the Alabama State Department of Public Health.

There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Gordon R. Williams, Senior Manager, Fleet Licensing (Acting) at 423-751-2687.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 17th day of July 2020.

Respectfully, James Barstow Vice President, Nuclear Regulatory Affairs & Support Services Enclosures cc: See Page 3

U.S. Nuclear Regulatory Commission CNL-20-002 Page 3 July 17, 2020

Enclosures:

1. Evaluation of the Proposed Change

2. BFN Units 1, 2, and 3 Operating License Markup Pages

3. BFN Units 1, 2, and 3 Operating License Re-Typed Pages cc (Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant Alabama State Department of Public Health

Enclosure 1 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT, UNIT 1, 2, and 3 EVALUATION OF PROPOSED CHANGE

Subject:

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (TS-BFN-529) 1.0

SUMMARY

DESCRIPTION ................................................................................................3 2.0 DETAILED DESCRIPTION.................................................................................................3 2.1 CURRENT REGULATORY REQUIREMENTS ...........................................................3 2.2 REASON FOR PROPOSED CHANGE.......................................................................3

2.3 DESCRIPTION

OF THE PROPOSED CHANGE ........................................................4

3.0 TECHNICAL EVALUATION

...............................................................................................5 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(B)(2)(I)) ...................6 3.1.1 Overall Categorization Process .................................................................6 3.1.2 Passive Categorization Process ..............................................................10 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(B)(2)(II)) .......................... 11 3.2.1 Internal Events and Internal Flooding .....................................................11 3.2.2 Fire Hazards ..............................................................................................11 3.2.3 Seismic Hazards .......................................................................................12 3.2.4 Other External Hazards ............................................................................12 3.2.5 Low Power & Shutdown ...........................................................................12 3.2.6 PRA Maintenance and Updates................................................................12 3.2.7 PRA Uncertainty Evaluations ...................................................................13 3.2.8 PRA Model Uncertainty ............................................................................14 3.2.9 Conduct of Probabilistic Risk Assessment............................................. 14 3.2.10 Treatment of FLEX Equipment by the PRA ............................................. 15 3.2.11 Treatment of Interfacing Systems............................................................15 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(B)(2)(III)) ................................ 17 3.4 RISK EVALUATIONS (10 CFR 50.69(B)(2)(IV)).......................................................19 3.5 FEEDBACK AND ADJUSTMENT PROCESS ..........................................................19

4.0 REGULATORY EVALUATION

.........................................................................................20 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA .................................. 20 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS ................................. 21

4.3 CONCLUSION

S .......................................................................................................22

5.0 ENVIRONMENTAL CONSIDERATION

............................................................................22

6.0 REFERENCES

.................................................................................................................22 CNL-20-002 Page E1 1 of 25

Enclosure 1 LIST OF ATTACHMENTS : List of Categorization Prerequisites : PRA Models Used in Categorization : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items : External Hazards Screening : Progressive Screening Approach for Addressing External Hazards : Disposition of Key Assumptions/Sources of Uncertainty CNL-20-002 Page E1 2 of 25

Enclosure 1 1.0

SUMMARY

DESCRIPTION The proposed amendment modifies the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance (LSS), alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance (HSS), requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

2.0 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. The Structures, Systems and Components (SSCs) necessary to defend against the DBEs are defined as safety-related, and these SSCs are the subject of many regulatory requirements, herein referred to as special treatments, designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations.

The distinction between treatment and special treatment is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms safety-related and basic component are defined in the regulations, while important to safety, used principally in the general design criteria (GDC) of Appendix A to 10 CFR Part 50, is not explicitly defined.

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, CNL-20-002 Page E1 3 of 25

Enclosure 1 including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of LSS, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of HSS, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow TVA to improve focus on equipment that has safety significance resulting in improved plant safety.

2.3 DESCRIPTION

OF THE PROPOSED CHANGE TVA proposes the addition of the following condition to the renewed facility operating licenses (RFOLs) of Browns Ferry Nuclear (BFN) Plant, Units 1, 2, and 3 to document the NRC's approval of the use of 10 CFR 50.69.

(XX) Adoption of 10 CFR 50.69, Risk-Informed Categorization and treatment of structures, systems and components for nuclear power plants (1) TVA is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA)

CNL-20-002 Page E1 4 of 25

Enclosure 1 models to evaluate risk associated with internal events, including internal flooding, internal fire, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the Individual Plant Examination of External Events (IPEEE) Screening Assessment for External Hazards, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; and internal fires and seismic hazards are evaluated with BFN specific PRA models, as specified in License Amendment No. [XXX].

(2) TVA shall complete the numbered items listed in Attachment 1, List of Categorization Prerequisites, of TVA letter [ML Number], dated [DATE], prior to implementation. All issues identified in the attachment will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

(3) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a shutdown defense-in-depth approach to a shutdown probabilistic risk assessment approach).

Enclosure 2 to this letter provides the existing BFN Units 1, 2 and 3 RFOLs marked-up to show the proposed change. Enclosure 3 to this letter provides the proposed change in a re-typed version in the BFN Units 1, 2, and 3 RFOLs.

3.0 TECHNICAL EVALUATION

10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under § 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific PRA, margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet § 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation CNL-20-002 Page E1 5 of 25

Enclosure 1 mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements are addressed in the following sections.

The PRA models described within this Licensing Amendment Request (LAR) are the same as those described within the TVA submittal of the LAR dated March 27, 2020 for TSTF-425 (ADAMS Accession Number ML20087P262), with the same routine maintenance updates applied. TVA requests that the NRC conduct their review of the PRA technical adequacy details for this application in coordination with the review of the application currently in-process. This would reduce the number of TVA and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action (RLA), as the details of the PRA models in each LAR are complete which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

3.1.1 Overall Categorization Process TVA will implement the risk categorization process in accordance with NEI 00-04, Revision 0, as endorsed by Regulatory Guide (RG) 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance (Reference 2). NEI 00-04 (Reference 1), Section 1.5 states, Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant. A separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The process to categorize each system will be consistent with the guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by RG 1.201. RG 1.201 states that the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv).

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible and as long as they are all completed they may even be performed in parallel. Note that NEI 00-04 only requires Item 3 to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires Item 4 to be completed for safety related active components/functions categorized as LSS by all other elements.

1. PRA-based evaluations (i.e., internal events, internal flooding, fire PRA and seismic PRA models)

2. Non-PRA approaches (i.e., other external events screening, and shutdown assessment)

3. Seven qualitative criteria in Section 9.2 of NEI 00-04

4. The defense-in-depth assessment

5. The passive categorization methodology CNL-20-002 Page E1 6 of 25

Enclosure 1 Categorization of SSCs (Systems, Structures or Components) will be completed per the NEI 00-04 process, as endorsed by Regulatory Guide (RG) 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., HSS or LSS) that is presented to the Integrated Decision-making Panel (IDP). Note: the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 3-1 below. The safety significance determination of each element, identified above, is independent of each other and therefore the sequence of the elements does not affect the resulting preliminary categorization of each component or function. Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final RISC category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Table 3-1 summarizes these IDP limitations from NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in the Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

Table 3-1: Categorization Evaluation Summary Categorization Drives IDP Change Element Step - NEI 00-04 Evaluation Level Associated HSS to LSS Section Functions Internal Events Base Case - Not Allowed Yes Section 5.1 Fire, Seismic and Other External Allowable No Risk (PRA Events Base Case Component Modeled)

PRA Sensitivity Allowable No Studies Integral PRA Assessment - Not Allowed Yes Section 5.6 Fire, Seismic and Other External Component Not Allowed No Risk (Non-PRA Hazards -

modeled)

Shutdown -

Function/Component Not Allowed No Section 5.5 Core Damage -

Function/Component Not Allowed Yes Defense-in- Section 6.1 Depth Containment -

Component Not Allowed Yes Section 6.2 CNL-20-002 Page E1 7 of 25

Enclosure 1 Categorization Drives IDP Change Element Step - NEI 00-04 Evaluation Level Associated HSS to LSS Section Functions Qualitative Considerations -

Function Allowable1 N/A Criteria Section 9.2 Passive - Section Passive Segment/Component Not Allowed No 4

Notes:

1 The assessments of the qualitative considerations are agreed upon by the IDP in accordance with Section 9.2 of the guidance. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration; however the final assessments of the seven considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e., all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (e.g., Internal events PRA or Integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization, which can result in some components mapped to HSS functions being treated as LSS; Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with a HSS function, but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g., Passive, Non-PRA-modeled hazards - see Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped. Therefore, if a HSS component is mapped to a LSS function, that component will remain HSS. If an LSS component is mapped to an HSS function, that component may be driven HSS based on Table 3-1 above, or may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

• The IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

CNL-20-002 Page E1 8 of 25

Enclosure 1

• The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

• The decision criteria for the IDP for categorizing SSCs as HSS or LSS pursuant to

§ 50.69(f)(1) will be documented in TVA procedures. Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. However, a simple majority of the panel is sufficient for final decisions regarding classification of HSS and LSS.

• Passive characterization will be performed using the processes described in Section 3.1.2 of this evaluation. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

• An unreliability factor of three will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of three was chosen as it is representative of the typical error factor of basic events used in the PRA model.

• NEI 00-04 Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5, but does not require this for SSCs determined to be HSS from non-PRA-based deterministic assessments in Section 5. This requirement is further clarified in the Vogtle Safety Evaluation Report (Reference 4) which states if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.

• Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The IDP must intervene to assign any of these HSS Function components to LSS.

• With regard to the criteria that considers whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, TVA will not take credit for alternate means unless the alternate means are proceduralized and included in Operator training.

The risk analysis to be implemented for each hazard is described below:

• Internal Event Risks: Internal events including internal flooding PRA model version Rev. 9, Nov 2019 submitted to NRC on March 27, 2020 for TSTF-425 (Reference 18).

• Fire Risks: Fire PRA model version Rev. 6, Nov 2019 submitted to NRC on March 27, 2020 for TSTF-425 (Reference 18).

CNL-20-002 Page E1 9 of 25

Enclosure 1

• Seismic Risks: Seismic PRA model version Rev. 1, Nov 2019, submitted to NRC on March 27, 2020 for TSTF-425 (Reference 18).

• Other External Risks (e.g., tornados, external floods): Using the IPEEE screening process as approved by NRC SER dated June 22, 2000 (Units 1, 2 & 3) (Reference 17), and June 28, 2007 (Unit 1) (Reference 15).

• Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, Guidance for Industry Actions to Assess Shutdown Management (Reference 3), which provides guidance for assessing and enhancing safety during shutdown operations (Reference 35 §3.2.3).

A change to the categorization process that is outside the bounds specified above (e.g., a change from the shutdown defense-in-depth approach to a shutdown PRA model) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements.

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs

9. Results of periodic reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members analyses, as applicable 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology contained in Reference 5 (ADAMS Accession Number ML090930246) consistent with the related Safety Evaluation (SE) issued by the Office of Nuclear Reactor Regulation.

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence CNL-20-002 Page E1 10 of 25

Enclosure 1 evaluation is performed. It additionally applies deterministic considerations (e.g., DID, safety margins) in determining safety significance. Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final SE for Vogtle dated December 17, 2014 (Reference 4). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. The passive categorization process is intended to apply the same risk-informed process accepted by the NRC in the ANO2-R&R-004 for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N-660 and N-662 as published in Regulatory Guide 1.147, Revision 15 (Reference 29). Both code cases employ a similar risk-informed safety classification of SSCs in order to change the repair/ replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned high safety-significant, HSS, for passive categorization which will result in HSS for its risk-informed safety classification and cannot be changed by the IDP.

Therefore, this methodology and scope for passive categorization is acceptable and appropriate for use at BFN for 10 CFR 50.69 SSC categorization.

3.1.3 Technical Adequacy Evaluation (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate the quality and level of detail of the processes used in categorization of SSCs are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in the TSTF-425 application dated, March 27, 2020, (Reference 18) with routine maintenance updates applied.

3.1.4 Internal Events and Internal Flooding The Browns Ferry categorization process for the internal events and flooding hazard will use the plant-specific PRA models. The TVA risk management process (References 19 and 20) ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the Browns Ferry units. Attachment 2 of this enclosure identifies the applicable internal events and internal flooding PRA models.

3.1.5 Fire Hazards The Browns Ferry categorization process for fire hazards will use a peer reviewed plant-specific Fire PRA (FPRA) model. The internal FPRA model was developed consistent with NUREG/CR-6850 and NFPA-805, and thus only utilizes methods previously accepted by the NRC. The TVA risk management process ensures that the PRA model used in this CNL-20-002 Page E1 11 of 25

Enclosure 1 application reflects the as-built and as-operated plant for each of the Browns Ferry units. at the end of this enclosure identifies the applicable FPRA model.

3.1.6 Seismic Hazards The Browns Ferry categorization process for seismic hazards will use a peer reviewed (i.e., against Code Case 1) (Reference 34) plant-specific Seismic PRA (SPRA) model. The TVA risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the Browns Ferry units. Industry standard methods were utilized in the development of the seismic hazards for the SPRA. Updates to seismic hazard curves will be reflected in the PRA used for the categorization in accordance with the PRA model maintenance process. Attachment 2 at the end of this enclosure identifies the applicable Seismic PRA model.

3.1.7 Other External Hazards All other external hazards were screened for applicability to Browns Ferry Units 1, 2, and 3 per a plant-specific evaluation in accordance with GL 88-20 (Reference 6) and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Attachment 4 provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards. A review was performed of IPEEE documentation to ascertain if any screened scenario credited a unique SSC that if unavailable would result in the scenario not being screened. No SSCs were explicitly credited to allow a scenario to screen.

Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, any credited components meeting that criteria would be considered HSS. Screened hazards are considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

3.1.8 Low Power & Shutdown Consistent with NEI 00-04, the Browns Ferry categorization process will use the shutdown safety management plan described in NUMARC 91-06 for evaluation of safety significance related to low power and shutdown conditions. The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function (KSF). The KSF defined in NUMARC 91-06 are evaluated for categorization of SSCs.

SSCs that meet either of the two criteria (i.e., considered part of a primary shutdown safety system or a failure would initiate an event during shutdown conditions) described in Section 5.5 of NEI 00-04 will be considered preliminary HSS.

3.1.9 PRA Maintenance and Updates The TVA risk management process (References 20 and 21) ensures that the applicable PRA model(s) used in this application continues to reflect the as-built and as-operated plant for each of the Browns Ferry units. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operational experience), for assessing the risk impact of unincorporated changes, and CNL-20-002 Page E1 12 of 25

Enclosure 1 for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every other operating cycle. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, TVA will implement a process (Reference 22) that addresses the requirements in NEI 00-04, Section 11, Program Documentation and Change Control. The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

3.1.10 PRA Uncertainty Evaluations Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in Section 8 of NEI 00-04 and in the prescribed sensitivity studies discussed in Section 5.

In the overall risk sensitivity studies, TVA will utilize a factor of three to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle (Reference 4). Consistent with the NEI 00-04 guidance, TVA will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in all identified PRA models for all systems that have been categorized are increased by a factor of three. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study. Processes such as System Health Reports, the Corrective Action Program and the Maintenance Rule Program are sources of information for performance monitoring.

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 (Reference 8) and Section 3.1.1 of EPRI TR-1016737 (Reference 9). The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the Browns Ferry PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application.

Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

CNL-20-002 Page E1 13 of 25

Enclosure 1 Key Browns Ferry PRA model specific assumptions and sources of uncertainty for this application were identified and dispositioned in Attachment 6. The conclusion of this review is that no additional sensitivity analyses are required to address Browns Ferry PRA model specific assumptions or sources of uncertainty.

3.1.11 PRA Model Uncertainty Paragraphs (c)(1)(i) and (ii) of 10 CFR 50.69 require that a licensees PRA be of sufficient quality and level of detail to support the SSC categorization process, and that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

Section 5 of NEI 00-04 provides guidance for performing sensitivity studies for each PRA model to address the uncertainty associated with those models. Specifically, Sections 5.1 and 5.3 provide guidance for such sensitivities for the internal events PRA and SPRA, respectively.

The sensitivity studies are performed to ensure that assumptions and sources of uncertainty (e.g., human error, common cause failure, and maintenance probabilities) do not mask importance of components.

Browns Ferry identifies RG 1.174, Revision 3 as an applicable regulatory guidance. Regulatory Guide 1.174, Revision 3, cites NUREG-1855, Revision 1, as related guidance. In Section B of RG 1.174, Revision 3, the guidance acknowledges specific revisions of NUREG-1855 to include changes associated with expanding the discussion of uncertainties. TVA used NUREG-1855, Revision 0 to determine the key assumptions and sources of uncertainty. This approach applies to all the PRA models, as the seismic and fire models build off the Full-Power Internal Events model (FPIE). This is the same process described in the response to the Sequoyah 50.69 RAI-04.a (Reference 45). All of the key assumptions and sources of uncertainty identified using this process are shown and dispositioned in Attachment 6, only the FPRA resulted in areas that are key to the application The SPRA was built upon the FPIE. There were no additional key assumptions or key sources of uncertainty identified for the SPRA model. The SPRA identified assumptions and sources of uncertainty related to the seismic hazard development, fragility analyses, and plant response model; however, these assumptions and sources of uncertainty were not characterized as key in the BFN Quantification, Uncertainty and Sensitivity Notebook (Reference 39). Only those assumptions and sources of uncertainty as they apply to the 50.69 categorization and having a potential significant impact on the risk importance measures that are used to determine safety-significance of an SSC are judged to be key.

In the response to Sequoyah 50.69 RAI-04.a (Reference 45), a comparison of the NUREG-1855 Rev. 0 and Rev. 1 processes was made. Sequoyah followed NUREG-1855 Rev. 0 to identify key assumptions and sources of uncertainty. This is the case with Browns Ferry, as well. As further noted in the response to Sequoyah 50.69 RAI-04.a (Reference 45), following the guidance shown in NUREG-1855 Rev. 0 is consistent with the guidance in NUREG-1855 Rev. 1. This approach was applied to all Browns Ferry PRA models.

3.1.12 Conduct of Probabilistic Risk Assessment TVA Fleet procedure, Conduct of Probabilistic Risk Assessment Engineering, (Reference 20) prescribes the process to ensure the PRA models represent the as-built, as-operated plant configurations in support of integrated decision-making and maintaining a high sensitivity for CNL-20-002 Page E1 14 of 25

Enclosure 1 reactor safety in all activities, actions and responses. The requirement for both permanent and temporary changes to the plant design or operation is assessed by PRA Engineers that monitor changes to the plant design and operating procedures for impact on the PRA model. The PRA Engineer is responsible for ensuring that design changes that impact the PRA model are appropriately incorporated into the PRA model. Changes in PRA inputs or discovery of new information are required to be evaluated to determine whether such information warrants PRA update (including the cumulative effect of all previously evaluated model changes that are yet to be included in the Model of Record (MOR). Potential and implemented plant configurations changes that do not meet the threshold for immediate update are required to be tracked in the PRA Model Open Items Database. A PRA update may be performed without incorporating all changes; however unincorporated changes must not significantly impact the model. Any errors found in the site PRA program between periodic updates are documented by initiating a Condition Report and entered into the TVA corrective action program (CAP). A living model, which contains all model modifications that have been evaluated but not yet incorporated into the MOR is required to be maintained so that all future model modifications can be evaluated for cumulative impact on CDF and Large Release Early Frequency (LERF).

The BFN living PRA model was reviewed for model modifications evaluated since the MOR was issued. None of the pending changes meet the criteria for a non-scheduled PRA update and none meet the criteria for a model upgrade.

The following information is similar to Watts Bar 50.69 RAI-05b (Reference 33). TVAs categorization process follows the guidance specified in NEI 00-04. Table 5-2 of NEI 00-04 describes the sensitivity studies to be performed, which exercise key areas of uncertainty in the PRA. In addition, Section 12.1 of NEI 00-04 describes the process to reassess the SSC categorization following a PRA model update. Furthermore, TVA procedure NEDP-26 (Reference 19), Probabilistic Risk Assessment, requires that all model modifications that have been evaluated, but not yet incorporated into the MOR, be included in a living model. Any plant specific key assumptions/sources of uncertainty that might change because of updates to the PRA would be governed by NEDP-26. Therefore, if a change to a key assumption/source of uncertainty were identified that results in a significant change to the PRA model results, the model (in accordance with the TVA procedure) would be updated to address that assumption/source of uncertainty to support the categorization process.

3.1.13 Treatment of FLEX Equipment by the PRA The BFN PRA models do not credit portable FLEX equipment for core damage or release mitigation. There is, however, a permanently installed cart that holds a nitrogen bottle for use of opening an air-operated drywell vent valve given the loss of supply air. This FLEX equipment is only credited by the SPRA. TVA reserves the right to credit FLEX equipment in future PRA models in accordance with PRA standards.

3.1.14 Treatment of Interfacing Systems Section 69(c)(v) of 10 CFR 50 requires that the categorization be performed for entire system and structures - not for selected components within a system or structure.

CNL-20-002 Page E1 15 of 25

Enclosure 1 NEI 00-04, Section 7.1 states:

Due to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC or part thereof should be assigned the highest risk significance for any function that the SSC or part thereof supports.

Section 4 of NEI 00-04 also states that a candidate LSS SSC that supports an interfacing system will remain uncategorized until the interfacing system is considered. It further concludes therefore the SSC will remain uncategorized and continue to receive its current level of treatment requirements.

NEI 00-04 Section 4 provides the following example that highlights the categorization process that involve SSCs that support interfacing systems: cooling water piping on a ventilation system cooler is designated as part of the ventilation system. The impact of failure of the SSC on the ventilation system can be considered, but the impact of failure of the SSC on the cooling water system cannot be fully assessed until that system is considered as part of the future categorization process. Therefore, the SSC will remain uncategorized and continue to receive its current level of treatment requirements.

TVA will perform the categorization of any functions/SSCs that serve as an interface between two or more systems in accordance with its Fleet (Browns Ferry, Sequoyah, Watts Bar) categorization procedures.

If an interface component is found to be HSS for the system being categorized, then it will be categorized RISC-1 or RISC-2 (and will not receive alternative treatments) even if it supports other systems.

In most cases, interface components that support uncategorized interfacing systems (and are LSS for the system being categorized) will be uncategorized and will not receive alternative treatment prior to completing the categorization of all systems that they support.

One of the initial steps in the TVA system categorization procedure is to develop a list of system functions. If the system includes components that support functions of other systems, then support functions are created to identify the supported systems (e.g., provide support for system xx) as needed.

Support functions are not categorized. These functions identify system components that cannot be fully categorized until the categorization of other systems is completed. Additional support functions are added as required during the component mapping process, where the focus is on individual component functions. Interface components that support other system functions will be identified by this process.

In some cases, impacts that an interfacing component could have on an interfacing system can be fully determined and the interface component can be categorized (and alternative treatment implemented) without categorizing the entire interfacing system.

In this event, an assessment of interface component risk associated with uncategorized systems will be limited to:

1. Cases where an interface component failure cannot prevent performance of interface system functions, or CNL-20-002 Page E1 16 of 25

Enclosure 1

2. The risk is limited to passive failures assessed as low safety-significant following the passive categorization process for the applicable pressure boundary segments.

In either case, the component can be assessed without performing a full interface system categorization because adequate interface system function knowledge is available to perform the functional assessment and passive risk assessment. Categorizing the entire interfacing system would produce the same functional assessment and passive risk significance for the component. Therefore, TVA considers this approach to be consistent with the intent of 10 CFR 50.69(c)(1 )(v) and NEI 00-04 guidance (Reference 46). This approach was approved by NRC for Calvert Cliffs and discussed in the Calvert Cliffs 50.69 Safety Evaluation, ML19330D909 (Reference 47).

3.2 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 have been assessed against RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results or Risk-Informed Activities, (Reference 7) consistent with NRC RIS 2007-06. An exception to this is the Seismic model which was assessed against the PRA Standard Code Case 1 (Reference 34).

The internal events and internal flooding PRA models were subject to a self-assessment (Reference 37) and a full-scope peer review conducted as indicated in the following table.

Date Type of Review Guidance Model of Record AUG Internal Events (Full RG 1.200 R2 2009 FPIE Draft Rev. 0 Scope) NEI 05-04 R3 (Ref. 24)

OCT Internal Flooding RG 1.200 R2 2009 FPIE Draft Rev. 0 (Focused Scope) NEI 05-04 R3 (Ref. 26)

AUG Internal Events 2009 RG 1.200 R2 2015 FPIE Rev. 6 (Focused Scope) NEI 05-04 R3 (Ref. 36)

SEP Internal Flooding RG 1.200 R2 2018 Focused Scope Peer FPIE Rev. 8 NEI 05-04 R3 Ref. 27) Review NOV Internal Events 2009 RG 1.200 R2 2018 F&O Resolution FPIE Rev. 8 NEI 05-04 R3 (Ref. 25) Review The Fire PRA model was subject to a self-assessment and a full-scope peer review as indicated below.

Date Type of Review Guidance Model of Record MAY RG 1.200 R2 2012 Fire (Full Scope) FPRA Draft Rev. 0 NEI 07-12 R1 (Ref. 28)

JUN RG 1.200 R2 2015 Fire (Focused Scope) FPRA Rev. 5 NEI 07-12 R1 (Ref. 41)

CNL-20-002 Page E1 17 of 25

Enclosure 1 The Seismic PRA model (SPRA) was subject to a self-assessment and a full-scope peer review conducted as indicated below.

Date Type of Review Guidance Model of Record NEI 12-13 MAY ASME/ANS RA-2019 Seismic (Full Scope) SPRA Rev. 0 Sb-2013, Code (Ref. 30)

Case 1 (Ref. 14)

Seismic PRA NOV Independent NEI 12-13 2019 SPRA Rev. 0 Assessment (F&O Appendix X (Ref. 31)

Closure)

A finding closure review (Independent Assessment) was conducted on the identified PRA models in November 2018 for Internal Events and November 2019 for Seismic Hazards.

Closed findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os)

(Reference 11) as accepted by NRC in the letter dated May 3, 2017 (ML17079A427)

(Reference 15). The results of these reviews (References 25 and 31) have been documented and are available for NRC audit. provides a summary of the remaining findings and open items, including:

• Open items and disposition from the Browns Ferry RG 1.200 self-assessment.

• Open findings and disposition of the Browns Ferry peer reviews.

• Identification of and basis for any sensitivity analysis needed to address open findings.

The attachment identified above demonstrate that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

The FPIE Independent Assessment (IA) (Reference 25) team was provided descriptions of how each finding level Facts & Observations (F&O) was resolved, and also whether the resolution constituted an upgrade or not. The resolved F&Os were determined to not be upgrades. The IAT followed the Appendix X guidance in the F&O closure review.

The teams assessment of whether the resolution constituted a PRA upgrade or maintenance update is based on consensus of the Independent Assessment team. The changes made to the PRA were considered by the team to not constitute a PRA upgrade and did not make use of a new method.

The IA F&O Closure Report provides the closure evaluation for each F&O. Confirmation of modeling changes or associated documents are noted in the acceptance evaluation column.

The Model of Record (MOR) has been updated to reflect the F&O closure information. TVA is proposing a license condition that requires the MOR to be updated with the F&O resolutions from the closed F&Os prior to system categorization, see Attachment 1 of the LAR for a list of License Conditions.

CNL-20-002 Page E1 18 of 25

Enclosure 1 All five IA team members participated on-site at TVA; therefore, there were no remote reviewers. TVA provided the IA team with information for 48 F&Os. The MOR has been updated to reflect the F&O closures. The IA team reviewed each F&O to ensure the resolution used to close the F&O met the requirements of each associated ASME/ANS RA-Sa-2009 Supporting Requirement at Capability Category II. At the completion of the IA, ten F&Os were judged to remain open and are summarized in Attachment 3.

The Seismic IA F&O Closure Report provides the closure evaluation for each F&O.

Confirmation of modeling changes or associated documents are noted in the acceptance evaluation column. The MOR has been updated to reflect the F&O closure information. The IA team reviewed each F&O to ensure the resolution used to close the F&O met the requirements of each associated ASME/ANS RA-Sa-2009 Supporting Requirement at Capability Category II. At the completion of the IA, no F&Os were judged to remain open.

3.3 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The Browns Ferry 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the NEI guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of §50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to CDF and LERF. The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, and human errors). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

Similar to the response to Watts Bar 50.69 RAI-07 (Reference 32), the integration of risk importance measures across all hazards (i.e., internal events, internal flooding, seismic and fire) is considered. As indicated previously, the process to categorize each system will be consistent with the endorsed guidance in NEI 00-04. The approach described in Section 1.5 of the guidance regarding integrated importance assessment states In order to facilitate an overall assessment of the risk significant SSCs, an integrated computation is performed using the available importance measures. This integrated importance measure essentially creates a weighted-average importance based on the importance measures and the risk contributed by each hazard (e.g., internal events, internal flooding, seismic and fire). Therefore, a one-top model will not be used to assess the importance of an SSC, instead a weighted-average using the importance measures and corresponding CDF/LERF from each hazard will be used as described in NEI 00-04. This process is justified because the importance evaluations are performed in accordance with NEI 00-04 which are determined on a component basis. Some components in the internal events model may not be explicitly modeled in the fire or seismic models due to it being subsumed in a super-component (as described in NEI 00-04) or because it was screened out of the analysis. For those that were screened out, the importance measure would be taken as non-risk significant (0 for Fussell-Vesely or 1 for Risk Achievement Worth).

For the components that are included under a super-component, the super component risk importance would instead be considered to determine risk significance.

3.4 FEEDBACK AND ADJUSTMENT PROCESS If significant changes to the plant risk profile are identified, or if it is identified that a RISC-3 or RISC-4 SSC can (or actually did) prevent a safety significant function from being satisfied, an CNL-20-002 Page E1 19 of 25

Enclosure 1 immediate evaluation and review will be performed prior to the normally scheduled periodic review. Otherwise, the assessment of potential equipment performance changes and new technical information will be performed during the normally scheduled periodic review cycle.

Scheduled periodic reviews once every other operational cycle (e.g., four years)

(Reference 1 §12.1) will evaluate new insights resulting from available risk information (i.e., PRA model or other analysis used in the categorization) changes, design changes, operational changes, and SSC performance (Reference 22). If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process will be updated. This review will include:

• A review of plant modifications since the last review that could impact the SSC categorization.

• A review of plant specific operating experience that could impact the SSC categorization.

• A review of the impact of the updated risk information on the categorization process results.

• A review of the importance measures used for screening in the categorization process.

• An update of the risk sensitivity study performed for the categorization.

In addition to the normally scheduled periodic reviews, if a PRA model or other risk information is upgraded, a review of the SSC categorization will be performed. Note: In accordance with the TVA PRA configuration control, an upgrade to the PRA model will require a peer review (Reference 19 §3.3.3C).

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

• The regulations in Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.

• NRC Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006.

• Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3, January 2018.

• Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance.

CNL-20-002 Page E1 20 of 25

Enclosure 1 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS TVA proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of 10 CFR, Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

TVA has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of Structures, Systems and Components (SSCs) subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensure the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC. Under the proposed change, no additional plant equipment will be installed.

CNL-20-002 Page E1 21 of 25

Enclosure 1 Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin. The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, Nuclear Energy Institute, July 2005.

CNL-20-002 Page E1 22 of 25

Enclosure 1

2. NRC Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006

3. NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, December 1991

4. NRC letter to Southern Nuclear Operating Company, Issuance of Amendments Re: Use of 10 CFR 50.69 (TAC Nos. ME9472 and ME94473), dated December 17, 2014, (ADAMS Accession Number ML14237A034)

5. SER Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems (TAC NO. MD5250) (ADAMS Accession Number ML090930246), April 22, 2009

6. Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, USNRC, June 1991

7. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009

8. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, dated March 2017

9. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

10. ASME/ANS RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009

11. NEI Letter to NRC, Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os), dated February 21, 2017, (ADAMS Accession Numbers ML17086A450 and ML17086A451)

12. NRC Letter to Mr. Greg Krueger (NEI), U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os), dated May 3, 2017, (ADAMS Accession Number ML17079A427).

13. Not Used

14. NEI 12-13, External Hazards PRA Peer Review Process Guidelines, Revision 0, Nuclear Energy Institute, August 2012, (ADAMS Accession Number ML12240A027)

15. NRC Letter to Mr. Biff Bradley (NEI), U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, External Hazards PRA Peer Review Process Guidelines, Dated August 2012, dated November 16, 2012, (ADAMS Accession Number ML12321A280)

16. TVA Letter to NRC, Browns Ferry Nuclear Plant, Unit 1 - Closeout of Generic Letter 88-20, Supplement 4, Concerning Individual Plant Examination of External Events for Severe Accidents, dated June 28, 2007, (ADAMS Accession Number ML071790196)

CNL-20-002 Page E1 23 of 25

Enclosure 1

17. IPEEE Units 1, 2 & 3, Browns Ferry Units 1, 2 and 3, Individual Plant Examination of External Events (IPEEE) and Related Generic Safety Issues, Issuance of Staff Evaluation, dated June 22, 2000, (ADAMS Accession Number ML003725976)

18. TVA Letter to NRC, CNL-20-003, Application for Technical Specifications Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements (TSTF-425) to a Licensee Controlled Program (BFN-TS-516),

(ADAMS Accession Number ML20087P262)

19. NEDP-26 Probabilistic Risk Assessment, NPG Standard Department Procedure, Revision 12

20. NPG-SPP-09.0.4 Conduct of Probabilistic Risk Assessment Engineering, NPG Standard Programs and Processes, Revision 3

21. NPG-SPP-09.11 Probabilistic Risk Assessment Program, NPG Standard Programs and Processes, Revision 4

22. NPG-SPP-09.40 10CFR 50.69 Program, Draft

23. BFN-0-19-101, PRA Evaluation Response, Other External Hazards

24. B45 200127 001 (BFN-0-20-006), BFN Internal Events Peer Review Report, August 2009

25. B45 200127 002 (BFN-0-20-007), BFN Internal Events Independent Assessment F&O Closure Report, November 2018

26. B45 200129 002 (BFN-0-20-010), BFN Internal Flooding Peer Review, October 2009

27. B45 200129 003 (BFN-0-20-011), Focused Scope Peer Review of the Browns Ferry Nuclear Power Plant (BFN) Internal Flood PRA Model Against the ASME PRA Standard Requirements, October 2018

28. B45 200129 004 (BFN-0-20-012) BFN Fire PRA Peer Review, dated June 2015

29. Regulatory Guide 1.147, Revision 15, Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1, (ADAMS Accession Number ML072070409)

30. B45 200129 006 (BFN-0-20-014) BFN Seismic Peer Review, June 2019

31. B45 200129 007 (BFN-0-20-015) BFN Seismic PRA Independent Assessment F&O Closure Report, November 2019

32. TVA Letter to NRC, CNL-19-065, Partial Response to NRC Request for Additional Information Regarding Watts Bar Nuclear Plant, Units 1 and 2, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, (ADAMS Accession Number ML19196A362)

33. TVA Letter to NRC, CNL-19-069, Final Response to NRC Request for Additional Information Regarding Watts Bar Nuclear Plant, Units 1 and 2, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, (ADAMS Accession Number ML19210D430)

34. ASME/ANS RA-Sb-2013 Case 1, Case for ASME/ANS RA-Sb-2013, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, November 22, 2017

35. NPG-SPP-07.2.11, Shutdown Risk Management, Revision 13

36. B45 151204 002, Browns Ferry Nuclear Units 1, 2, 3 PRA Focused Scope Peer Review Final Report, August 2015 CNL-20-002 Page E1 24 of 25

Enclosure 1

37. BFN-0-18-050, PRA Self-Assessment of FPIE F&O Resolutions for Upgrade/Update

38. Not Used

39. MDN-000-999-2019-000268, BFN Seismic PRA Quantification, Sensitivity and Uncertainty Notebook, Revision 1

40. NPG-SPP-09.40.3, 10 CFR 50.69 Risk Informed Categorization for Structures, Systems, and Components

41. Jensen-Hughes BFN-FPRA-FSPR-RPT-01, Browns Ferry Nuclear Plant Focused-Scope Peer Review, June 2015

42. NDN-000-999-2010-001, R9 BFN Probabilistic Risk Assessment - Summary Document

43. Not Used

44. NDN-000-999-2012-00016 R2, Uncertainty and Sensitivity Analysis [Fire PRA]

45. TVA Letter to NRC, CNL-19-002, Response to Request for Additional Information Regarding Application to Modify Sequoyah Nuclear Plants Units 1 and 2, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors March 21, 2019 (ADAMS Accession No. ML19081A065)

46. Calvert Cliffs Letter to NRC, Response to Request for Additional Information Regarding the Application to adopt 10 CFR 50.69, Risk-Informed categorization and treatment of structures, systems, and components for nuclear power reactors. dated July 1, 2019, (ADAMS Accession No. ML19183A012)

47. NRC letter to Calvert Cliffs, Calvert Cliffs Nuclear Power Plant, Units 1 and 2 - Issuance of Amendments Nos. 332 and 310 RE: Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (ADAMS Accession No. ML19330D909)

CNL-20-002 Page E1 25 of 25

Attachment 1: List of Categorization Prerequisites The PRA model to be used for categorization credits the following modifications to achieve an overall Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) consistent with NRC Regulatory Guide 1.174 risk limits. Use of the categorization process on a plant system will only occur after the modifications are completed.

TVA will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

• Integrated Decision-Making Panel (IDP) member qualification requirements

• Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary High Safety Significant (HSS) or Low Safety Significant (LSS) based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2). Any component supporting an HSS function is categorized as preliminary HSS.

Components supporting, an LSS function are categorized as preliminary LSS.

• Component safety significance assessment. Safety significance of active components is assessed through a combination of Probabilistic Risk Assessment (PRA) and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

• Assessment of defense-in-depth (DID) and safety margin. Safety-related components that are categorized as preliminary LSS are evaluated for their role in providing DID and safety margin and, if appropriate, upgraded to HSS.

• Review by the IDP. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

• Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to CDF and LERF and meets the acceptance guidelines of Regulatory Guide 1.174.

• Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

• Documentation requirements per Section 3.1.1 of the enclosure.

• As documented in the F&O Closure Report, all changes initiated by the F&O resolutions were confirmed by the Integrated Assessment Team to have been incorporated into the living model and associated documentation. TVA shall verify the Model of Record (MOR) has been updated with pertinent information to the 50.69 application prior to system categorization.

• TVA shall close all open F&Os listed in Attachment 3 and incorporate changes into the MOR prior to system categorization.

CNL-20-002 Page A1 1 of 1

Attachment 2: PRA Models Used in Categorization Model/Date U1 U2 U3 MOR Date CDF/yr LERF/yr CDF/yr LERF/yr CDF/yr LERF/yr FPIE NOV 4.07E-06 8.64E-07 3.28E-06 7.95E-07 5.99E-06 7.98E-07 w/Internal 2019 Flooding Rev 9 (Ref. 42 Table 13)

Internal NOV 3.48E-05 5.44E-06 4.25E-05 5.50E-06 3.28E-05 4.52E-06 Fire 2019 Rev 6 (Ref. 43)

Seismic NOV 6.30E-06 3.00E-06 6.40E-06 3.10E-06 7.13E-06 3.31E-06 Rev 1 2019 (Ref. 44)

Total: 4.52E-05 9.30E-06 5.22E-05 9.40E-06 4.95E-05 8.63E-06 Notes: The Quantification Notebook revision was used in this table as opposed to the model revision.

All of the document numbers correspond to the BFN Fire PRA post-transition model.

CNL-20-002 Page A2 1 of 1

Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Open IE with Internal Flood PRA Open F&Os Internal Events with Internal Flooding F&O Closure Report (Reference 25)

Fire PRA F&O Peer Review Report (Reference 28)

Seismic PRA F&O Closure Report (Reference 31)

Internal Events Open Finding Level F&Os F&O 117 Reviewed DA.01. The source of demands is not discussed. Based upon discussions with the PRA staff, exposure is collected directly from plant data systems and is therefore actual component exposure. However, post-maintenance testing demands are also included in these numbers and are not removed.

Associated (SRs) DA-C6 Basis for Post-maintenance testing must be excluded from the exposure data per the SR.

Significance Possible Resolution Develop a means of identifying the post-maintenance related exposure and remove them from the data calculations.

Plant Response As mentioned in the DA Notebook, the only demands that are included in the data analysis update of failure rates are those that come directly from PEDs, from the IST database or from the system engineer directly. The IST database gives just those successful demands that occur for each test (i.e., no post maintenance demands included). PEDs/

the system engineer gives the actual number of demands the component observes which could potentially include post maintenance demands, however a sensitivity was performed (BFN015079) which shows that the model is not sensitive PMTs.

Closure Review Open Status Basis BFN uses an automatic demand counter to populate the data. As such this would include all related surveillance, maintenance and operational demands. Because the system may count additional demands for PMTs BFN has estimated these additional demands and performed sensitivities to support the impact on the failure rates. Although the sensitivities may justify a minimal impact, it does not meet the SR (DAC6). DAC6 remains Not Met.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

F&O 133 There is no discussion of the review of the LERF contributors (ASME/ANS RASa-2009 Table 22.89) for reasonableness per the review of the QU Notebook and LE.01.

CNL-20-002 Page A3 1 of 32

Associated (SRs) LE-F2 Basis for A review of the reasonableness of the results of the analysis of the contributors to LERF is required per the SR.

Significance Possible Resolution Perform and document a review of the reasonableness of the contributors to LERF.

Plant Response The review of the CDF and LERF cutsets was performed and documented in Attachment D and E of the Quantification Notebook. Section 6.3.2.3 of the Quantification notebook specifies the types of things that were looked at when reviewing the cutsets. The Top 100 cutsets, a sample of 100 cutsets from the middle and the last 100 cutsets were all reviewed and showed no signs of inconsistencies in logic.

Closure Review Open Status Basis The current documentation provides a listing of addressed phenomena and failures postulated to lead to LERF in Table A.12. How the BFN model maps to these postulated events is provided in Table 11. The model mapping is again provided in the QU notebook in Table 6.3-11. The frequency results are tabular in the QU notebook and there is a comparison of absolute frequency to similar designs. However, there is no documented review of the results to determine if the LERF results are reasonable and that the identified contributors (categories) are consistent with expectations. A pointer to the summary document was provided but the requested information was not found at that location. SR LEF2 was previously Not Met and remains Not Met.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 2 of 32

F&O 2-31 For SPC and LPCI, the LPCI injection valves and SPC return valves are required to reposition when swapping RHR modes, but this is not included in the model. The RHR system notebook indicates that these valves need to close for the opposite function. However in one location in the notebook it is indicated that flow can be split between LPCI and SPC.

Associated (SRs) SY-A5 SY-A13 Basis for All active components should be included in the failure modes of a system.

Significance Possible Resolution Add failure mode to the fault trees and clarify documentation The injection valves do need to change position for split LPCI/SPC flow; two valves would have to fail to modulate or close Plant Response in either path to fail either system. An operator interview was conducted to address this issue. The common cause failure probability of two MOVs to close is less than 1E5.

The RHR pump start failure probability is approximately 1.4E3. The failure of two MOVs to close is less than 2 orders of magnitude lower than another failure that would fail the system in a similar manner. Therefore, failure to close (or modulate) either the LPCI or SPC injection path can be neglected. The RHR system notebook was modified to reflect this and the operator interview was added.

Closure Review Open Status Basis Basis The model includes other valve realignments and common cause. It is unclear why this specific change would warrant a unique modeling approach. The absence of this failure mode could alter the importance calculations for the identified components and impact the ability to determine MSPI characteristics. It would be expected that these valves would need to be included since it does involve a physical change in state. SYA5 remains Met.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 3 of 32

F&O 3-12 There is no evidence of an analysis for sequences that go beyond the 24-hour period to evaluate the appropriate treatment relative to the CC II/III requirements for SCA5.

Associated (SRs) SC-A5 Basis for A CC II/III for SC-A5 requires that options other than assuming sequences in which a stable state has not been reached Significance in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> goes to core damage.

Possible Resolution Perform and document an analysis of sequences that do not achieve a stable state in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to determine which of the options presented in the SR would be a most appropriate disposition for that sequence. Then change the PRA model accordingly.

Basis for Safe and Stable for HFA_0085ALIGNCST During a single unit accident, refill of the CST inventory is Plant Response credited in the model (HFA_0085ALIGNCST) by refilling from the nonaccident units CST. During a multiunit accident, it is assumed that the TSC would direct the operators to provide additional inventory to the CSTs from an outside source given the CST depletion would not occur for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This assumption is not documented in the current model.

It is already considered in the cognitive analysis for HFA_0085ALIGNCST and the assumption that the TSC would direct operators to provide additional inventory to the CSTs is documented in the Human Reliability Analysis (HRA)

Notebook. The alarm response procedures 1(2,3)ARP96B provides a list of alternative sources including: 1) Hotwell or Radwaste transfer to CST, 2) Demin or another CST transfer to the affected CST, and 3) CST Crosstie. The TSC and OSC would determine and perform the appropriate actions based on conditions at the plant and the choices identified in ARP.

Closure Review Open Status Basis Basis for Safe and Stable for HFA_0085ALIGNCST During a single unit accident, refill of the CST inventory is credited in the model (HFA_0085ALIGNCST) by refilling from the nonaccident units CST. During a multiunit accident, it is assumed that the TSC would direct the operators to provide additional inventory to the CSTs from an outside source given the CST depletion would not occur for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This assumption is not documented in the current model.

It is already considered in the cognitive analysis for HFA_0085ALIGNCST and the assumption that the TSC would direct operators to provide additional inventory to the CSTs is documented in the HRA Notebook. The alarm response procedures 1(2,3)ARP96B provides a list of alternative sources including: 1) Hotwell or Radwaste transfer to CST, 2)

Demin or another CST transfer to the affected CST, and 3) CST Crosstie. The TSC and OSC would determine and perform the appropriate actions based on conditions at the plant and the choices identified in ARP.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 4 of 32

F&O 4-18 Some operator actions assume that the execution failure probability (Pe) is 0.0 including:

HFA_0_ADSINHIBIT, HFA_0_ATWSLEVEL, HFA_0024RCWINTAKE, HFA_0027INTAKE, HFA_0IR2_LPI, HFA_1063SLCINJECT, HFA_0024IFISOL Example 1: Several operator actions for ATWS scenarios (e.g., HFA_1063SLCINJECT: Failure to SLC in response to an ATWS event) assume the execution failure probability (Pe) is 0.0.

Example 2: Operator action HFA_0024RCWINTAKE (Failure to clear debris at intake before reactor scram) assumes an execution error of 0.0 based on the following: 'Cleaning traveling screens does not relate to a series of manual actions, but to an effort among several operators. It is assumed that, if the action is initiated within 1 hr., it will be successful.' The same rationale is provided for no execution error in HFA_0027INTAKE.

Associated (SRs) HR-G2 Basis for Execution failure is a required part of the HEP calculation, and the argument for ignoring execution failure is not Significance necessarily compelling, especially for maintaining level (HFA_0_ATWSLEVEL). Some of the actions for which Pe is not considered are important to the overall results.

Possible Resolution Include Pe in the quantification of HFA_1063SLCINJECT, HFA_0_ADSINHIBIT, HFA_0_ATWSLEVEL, HFA_0024RCWINTAKE and HFA_0027INTAKE. Insure that execution errors are considered appropriately in other HEPs, as well.

• Execution error has not been included for ADS inhibit (HFA_0_ADSINHIBIT). This is modeled only for ATWS in the Plant Response PRA. There is a single step to implement this action, errors of omission are integral to the cognitive error to omit the action. Errors of commission are neglected because the action to inhibit ADS is unique (no transition to any EOI Appendix is required, and there are several places in the EOI that call for inhibiting ADS), and because it is routinely performed for every reactor scram, graphically distinct and performed after SLC.

• Execution error was added for SLC. This is a time critical operator action, and the EOI specifies the appropriate steps required in EOIAppendix 3A. While the actions are simple, these require transition between procedures for the execution, so it is appropriate to include execution errors.

• HFA_0_ATWSLEVEL Execution errors are included for this event. NO CHANGE.

• HFA_0024RCWINTAKE Execution error set to zero and it deemed not necessary to add detail for this activity.

Clearing traveling screens does not relate to a series of manual actions, but to an effort among several operators, so errors of execution are in parallel and considered unlikely. It is assumed that, if the action is initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, it will be successful (i.e. only the cognitive error is included). The RCW system is supplied river water from the CCW conduits of each unit through fine mesh strainers that include a dP alarm. Pumps are run periodically to avoid fouling.

• HFA_0027INTAKE Basic event is not in the model. NO CHANGE

• HFA_0IR2_LPI Execution errors are included for this event. NO CHANGE.

• HFA_0024IFISOL This event is not used in the PRA model. NO CHANGE.

CNL-20-002 Page A3 5 of 32

Closure Review Partially Closed Status Basis Execution failure probability has been added to some HFEs but not others. HFA_0024RCWINTAKE involves physically cleaning the intake screens within time to prevent a plant trip or equipment overheating. Assuming the execution failure probability is zero is inappropriate.

HRG2 remains Met.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 6 of 32

F&O 4-25 There are many operator actions that use screening values; see Table 8 of the HRA. None of these actions appear to use any information to base the time available and the times to operator cues and perform the actions are not documented.

Associated (SRs) HR-F2 HR-G4 HR-G5 Basis for Without any real timing information, it is not possible to estimate, even at a screening level, the probability of operator Significance failure or success.

Possible Resolution Provide timing information for all operator actions, including those HEPs estimated by using screening values.

Plant Response Clarification on the basis for the timing has been added to the HRA notebook.

Closure Review Open Status Basis BFN016031 list several HFEs with clarification of the timing information. These are not the HFEs listed in Table 8 as referenced in the F&O, nor is there any discussion why these events were selected.

NDN00099920070032 Assumption 10 assumes that screened HFEs all have a delay time of 24h. This is not consistent with several of the event descriptions, which imply the timing would need to be less than 24h for success (some screened events list times of 15m or less in the description).

HRF2 remains Not Met (F&O 425)

HRG4 remains Not Met (F&O 425)

HRG5 remains Not Met (F&O 425)

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 7 of 32

F&O 4-42 Table 3 of the data notebook says that EDG boundaries included the output breakers, but the EDG system notebook and the model have them as separate events. NUREG/CR6928 lists breakers as WITHIN the boundary of the EDG.

Associated (SRs) Sy-A8 Basis for Apparent inconsistency in data and component boundary definitions.

Significance Possible Resolution Resolve discrepancy.

The EDG output breakers 1818, 1822, 1812, 1816, 1838, 1842, 1832, and 1836 have been included within the Plant Response boundary of the EDG. The output breakers are no longer explicitly modeled. The EDG system notebook and table 4 have been updated to reflect this change.

Closure Review Open Status Basis The system notebook did indicate that the failure of output circuit breakers was included within the EDG boundary.

However, the CAFTA model still had separate events for breaker failure with probability included (CBKFC0BKR_211A_022).

SYA8 remains Met.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 8 of 32

F&O 6-10 CCF for Battery Chargers is not included in the Initiating event Fault Tree for loss of 2 DC buses, other than for the standby chargers (not in the yearly failure rate logic).

Associated (SRs) IE-C8 Basis for Can affect the loss of DC initiating events by a factor of 10, depending on how CCF is calculated.

Significance Possible Resolution Include CCF under the yearly failure rate logic or as a top event for all loss of DC initiating events.

The IE Notebook lists an assumption about why inclusion of common cause is not included for support system initiators.

Plant Response Inclusion of common cause into the support system initiator development would produce overly conservative initiator frequencies as mentioned in the previous response. In order to obtain a more realistic model TVA decided to leave out the common cause events for initiator development. Inclusion of the common cause for support system initiator development will be reevaluated and incorporated as required following completion of the evaluation.

Closure Review Open Status Basis An assumption in IE.01 states that inclusion of common cause failures in the initiating event tree would yield inappropriate/conservatively high frequencies. This is counter to current guidance in EPRI TR1016741. An update to IE.01 should be prepared following the EPRI process which allows for appropriate screening of events and other adjustments.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 9 of 32

F&O 6-30 Dependencies between operator actions appear to be nonconservatively applied. Mainly, the Zero Dependence (ZD) between actions is commonly applied, simply when one of the actions takes longer than 60 minutes. What appears to be the mistake is applying the last event tree node in the Dependency Event Tree. In this tree, if the stress of either HFE is moderate or high, the upper leg of the event tree is used. So for combo 2, the HRA assumes ZD, while the event tree would designate Low Dependency.

Associated (SRs) QU-C2 HR-G7 Basis For Systematic error affecting around 1/2 of the combo events, including combo 18.

Significance Possible Resolution Correct dependency analysis in the HRA.

Plant Response

• The basis for ZD between early depressurization HFA_0001HPRVD1, and failure to align suppression pool cooling is significant differences, cues, and timing. Early depressurization is associated with failure to maintain RPV level, while failure to align SPC (nonATWS/IORV) is associated with SP temperature. MAAP analysis demonstrates that operators have 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to start suppression pool cooling to avoid exceeding 190F and thus, eventually impacting HPI systems taking suction from the SP. Since HPCI and RCIC take suction from the CST initially, it would take several hours to deplete the CST prior to any swapping suction to the SP. Early SPC failure was included in the model under late failure for HPI since early failure would result in high SP temperature that may preclude late swap over of suctions for HPI.

• The basis for the User Defined dependency levels has been added to the HRA calculation in Appendix E.

Closure Review Open Status Basis The stated resolution addresses only addresses some specific HFEs, however during discussion it was identified that the dependency analyses were completely redone. The actual process used to identify and process dependencies in general is not described, only that the "EPRI recommended" method is used. More detail is needed. HRA NB Section 6.3.3 points to the Quantification and Quantification NB points back to HRA NB. The use of automated tools is mentioned but the actual tools and how they are used is not discussed. There is and assumption (in HRA and Quant) that HFEs with screening HEPs of 0.1 or greater are treated as independent. Discussions with the analyst indicated this is not how they are treated.

In the Quantification NB it states that the base quantification use a seed value of 0.15 for all HEPs. In section 6.3.1.9 its states that a sensitivity is performed using 1.0 as the seed value and references the HRA calc. It is not clear how the dependent HFEs are identified.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 10 of 32

F&O 6-50 Some of the MOVs credited in the Interfacing Systems Loss of Coolant Accident (ISLOCA) Fault Tree are not tested to close against full DP. These MOVs are not originally included in the design as RCS isolation valves.

Examples include 7455 and 7466 (note: this is not a complete list, but 2 of 4 valves reviewed were not in the MOVATs 8910 program).

Associated (SRs) IE-C11 SY-A22 Basis For MOVs closing for ISLOCA are risk significant, with a RAW of greater than 2.

Significance Possible Resolution Do not credit MOVs in the ISLOCA without verification the valves will close against full DP of RCS pressure.

Plant Response Assumption was added to the ISLOCA Notebook. Depressurization is not modeled in the ISLOCA initiator before valve closure. The probability of this failing to occur is only 5.077E02. The fact that all ISLOCA events go directly to core damage without any mitigation actions is more than adequate to make up for not modeling the low probability of SRV failure.

Closure Review Open Status Basis A review of the ET representation identifies operator mitigation actions are included in the ET. This was also found to be the case when the ISLOCA modeling in the CAFTA model was reviewed (for example, gate U1_VRLOCA_002 includes gate U1_ISLV55_2 dealing with isolation).

SYA22 remains met at Cat II. The current model does not match the basis for resolution.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 11 of 32

F&O IFSN-A8-01 It was stated that no credit was taken for the removal of water via the drain system, with the exception that spray events that are (<=100 gpm). No scenarios were modeled that included backflow through drain lines.

Although, this is reasonable based on the layout of the large open areas in the Reactor Building and Turbine Building, no discussion of the elimination of backflow was provided in the documentation.

Associated (SRs) IFSN-A*

Basis For Not provided Significance Possible Resolution Expand discussion in the internal flood notebook that explains how drain backflow was treated in the internal flood model. Include enough detail to justify screening.

1) What screening criteria was used?

2) How is the drain system configured?

a. Are there separate drain systems in each building? (i.e. RB, TB, CB, etc.)

b. Can a drain line become blocked downstream?

c. Where does the water end up? (Sump on lower level?, Holding tank?, Outside?)

3) Include general references that can be validated by the reviewer. (Such as the system description and/or drawings used to support the assumptions for screening)

4) Is screening conservative? Why?

This does not need to be a large effort but a statement that any of the rooms within a building already show water propagating to the bottom elevation of that building does not provide enough detail to demonstrate that the drain impacts were sufficiently assessed for screening.

Plant Response In the BFN Internal Flooding Analysis, it was determined that the only place that drain backflow could occur and potentially cause any issues would be in the lowest elevations of each building. The affect from this occurrence is already accounted for in each of the flooding scenarios as they all propagate to the lowest elevation. The drain lines are not connected for each building, so water could not propagate from one building to another. The upper elevation drainage systems were not analyzed as a potential backflow situation as the drains are relatively small compared to the open hatches and stairwells that would cause the water to propagate to the lowest elevations. In addition, the areas in which the water would be susceptible to drainage are large rooms where the water would have to significantly fill in order to even reach a drain.

Section 6.1.3 of the Internal Flooding Notebook explains that we screened drainage backflow from the analysis and why.

Closure Review Open Status Basis No formal closure review has been performed CNL-20-002 Page A3 12 of 32

Impact on 50.69 Application TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 13 of 32

F&O IFSN-A9-01 No specific flow rate calculations were performed. Flow rates were modeled to be the maximum flow rate for a given break category. For example, all flood events were assumed to result in a break flow of 2,000 gpm.

This results in very conservative times to component failure. It could result in incorrect ranking of the risk importance of the flooding scenarios.

Associated (SRs) IFSN-A9 Basis For Not provided Significance Possible Resolution As a minimum, perform calculations to estimate the actual flow rates of modeled breaks for the most risk significant scenarios.

Plant Response The BFN Internal Flooding Analysis conservatively assumed that the flows out of the pipe breaks were at the top end of each of the generic flow rate values. This was done to assure that we properly addressed the importance of each scenario. The pipe break frequencies are given for the range of flows and the frequency does not change whether the top end flow rate or a lower flow rate is used unless it changes which range of flows you are using. The only time you would be concerned with the flow rate would be when you are performing an operator action to prevent water accumulation within a room. The BFN Internal Flooding analysis did not credit any of these types of operator actions except for in the reactor building 519 elevation. The flow rates that could cause this elevation to flood could be from any water source in the Reactor Building so the highest flow rate possible for both the flood scenario and the major flood scenario was used in calculating timing for the HRA action. This gives the smallest possible timeframe with which to perform the action and ensures that the results are conservative and risk insights are reasonable.

Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 14 of 32

F&O IFSN-A10-01 Spray events in the RB general areas (multiple elevations) are assumed to result in a manual trip and are analyzed. Larger flooding events are not considered an initiating event unless operators fail to isolate the flood prior to reaching the level of equipment damage (5') at the 519' elevation. This appears to be an inconsistency between the spray and flood events. Although less frequent than spray events, flood events in these areas could in total be a significant contributor to CDF.

Associated (SRs) IFSN-A10 IFEV-A1 Basis For Not provided Significance Possible Resolution Develop some initiating event that model floods in the general areas of the RB, along with successful isolation of the flood prior to equipment damage on the 519' elevation of the RB. Based on the results, determine whether, or not the entire group of these scenarios should be included in the IF model.

Plant Response When analyzing the spray events, it was assumed that for every spray scenario the operators would manually scram the reactor. This is a conservative assumption as the operators may not need to shutdown the plant. By analyzing every spray scenario with a manual scram we were able to see what the impact from a spray scenario would be to the plant. The flooding scenarios on the other hand, were not analyzed as during a Reactor Building flood scenario all of the water would propagate down to the 519 elevation of the Reactor Building. If the operators are successful in isolating the pipe rupture prior to reaching 5 in the 519 elevation, the plant would not necessarily be tripped. While it is true that some equipment might be lost which is similar to that seen for the spray events, the flooding analysis viewed the equipment impact separately from the flooding scenario as the flood has been terminated. Therefore the impact from the equipment being lost would be characterized by the internal events PRA model.

Each of the Reactor Building flooding scenarios that are successfully mitigated by the HRA action for the 519 elevation submergence will be reviewed to determine whether a potential scenario would exist or not. In addition the Spray Scenarios will be reviewed to determine if those are potential scenarios or not as well and the results will be documented within the Internal Flooding Notebook.

Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 15 of 32

F&O IFSN-A10-02 Only a 2000 gpm flood initiating event was modeled in the Unit 1 SD Board Room A. Spray events were not modeled. Given that there are no drains nor indication in that room (and based on an informal analysis) there is a possibility that a spray event of 100 gpm could also result in similar consequences as the 2000 gpm flood event.

Associated (SRs) IFSN-A10 Basis For Not provided Significance Possible Resolution Perform a calculation at 100 gpm to determine whether or not a spray scenario is, in fact, a valid initiating event in this area. If so, include spray events in that area in the model.

Plant Response Each room was looked at for potential spray effects, including the 4KV Shutdown Board Room A. This spray scenario is in the model as U1-621-R02_025_S with a contribution of 1.54E-10 to CDF which constitutes 0.002% of the Internal Flooding CDF for Unit 1. This spray scenario will be reviewed to ensure that it is treated appropriately within the model and any changes will be documented in the next revision of the internal flooding notebook.

Closure Review Not subjected to a closure review.

Status Basis No formal closure review has been performed Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 16 of 32

F&O IFEV-A1-01 For spray events in the general areas of the RB, all the possible spray frequencies were added to obtain a combined frequency for one event. The impact of this spray event was the combined impact of all the possible spray events on that elevation.

Associated (SRs) IFEV-A1 IFEV-A2 Basis For Not provided Significance Possible Resolution Separate out spray events in these areas to provide a better picture of which spray sources and which impacted equipment are the more significant contributor.

Plant Response For the general areas of the Reactor Building all spray scenarios were determined to occur at the same time and all equipment affected by a certain system piping were all failed. Because this is such a big room, this modeling approach was too conservative. Each of the spray scenarios within the general area of the Reactor Building will be reviewed to determine which components can be failed by what portions of piping and new scenarios will be developed to ensure that only the pipe ruptures that affect a component are used to fail a particular component.

Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 17 of 32

F&O IFQU-A6-01 The HRA assessment needs to incorporate several items:

a) Cues and indicators need to be documented in the first mitigation HRA (HFA_0_519FLOOD) b) With a), indicators should be assessed for flood damage c) PSFs need to be altered for general worst case in environment (radiation, etc.). This is because the flood mitigation actions are general and are not specific in place or time.

d) Why is the belief in the adequacy of instruction set to no?

For nonmitigation post initiator HRA's :

a) Needs to discuss blocked path for each scenario Associated (SRs) IFQU-A6 Basis For Not provided Significance Possible Resolution Incorporate the missing pieces to the mitigation HRA's.

a) Cues and indicators for the first mitigation HRA (HFA_0_519FLOOD) b) With a), indicators should be assessed for flood damage c) Alter PSFs for general worst case in environment (radiation, etc.)

d) Alter or add some discussion on why the Belief in Adequacy is set to "No" For nonmitigation post initiator HRA's :

a) Discuss or incorporate blocked path for each scenario Plant Response The HRA Assessment on HFA_0_519FLOOD was done generically as the only indication would be the Alarm coming in saying that there is water building up in the 519 elevation. The operator would be sent out to see if the alarm was valid and then try and isolate the pipe rupture. The Cues and Indicators will be updated to reflect the Alarm Indication. The flooding detectors are designed to get wet and would not be damaged by a flood. In addition there are multiple flooding detectors within the 519 elevation so if any of the detectors work, the operators would still be able to mitigate the flood. The belief in adequacy of instruction was set to No as the operators would most likely question whether there is an actual flood within the Reactor Building. The operators would still comply with the procedure and perform the action as stated. There is a timing aspect included that is to assess whether the flood actually occurred. The PSFs were reviewed to assess whether an operator would experience any adverse situation outside of what it would experience through everyday work. Because the flood and associated mitigation accident would occur prior to reactor trip, the shaping factors were consistent with a normal workload within the Reactor Building. Lighting would not be affected by the flood, heat/humidity would be normal for the areas that would be traversed. All of the areas within BFN are radiation areas so there is no increased stress from radiation, to isolate the pipe would be a simple action, and the stress was expected to be low as there is plenty of time to perform the action and it is expected that the action to close a couple of valves would not increase the stress on the operator.

Each of the HRAs will be reviewed to determine what the impact would be from a blocked path and this will be documented within the internal flooding notebook.

Closure Review Open Status CNL-20-002 Page A3 18 of 32

Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 19 of 32

F&O IFQU-A9-01 No modeling of direct effects due to a flooding event were identified. The rationale was, that for large flooding events in the RB, only those floods that resulted in flood levels reaching 5' in the 519' elevation were modeled. For those events, the required SSCs have failed due the indirect effects of the flooding.

Therefore, the direct effects of the flooding need not be considered. It is our contention that floods in the RB that are successfully isolated before damage occurs to components on the 519' elevation should be included as initiators. These events will still result in damage to SSCs and direct failure to part of the breached system.

Associated (SRs) IFQU-A9 Basis For Not provided Significance Possible Resolution Include floods on the RB elevations at 565' and above, even with successful isolation prior to equipment damage on the 519' elevation. For those events, model the direct failure of the breached system' Plant Response This F&O is similar to F&O IFSN-A10-01. As mentioned in the response for that F&O, an operator may not need to scram the reactor for a loss of a component affected by a flooding event. Each of the Reactor Building flooding scenarios that are successfully mitigated by the HRA action for the 519 elevation submergence will be reviewed to determine whether a potential scenario would exist or not.

Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 20 of 32

Associated (SRs) CF-A1 Basis For There is conflicting documentation due to the recent application of new guidance. The Significance current treatment is conservative and it is not expected that revising the treatment will result in a significant change in risk results. However, the potential exists for issues with long term configuration control with potentially conflicting guidance.

Possible Resolution Given the potential for future confusion and misapplication, it is recommended that 3-phase ac hot shorts and dc compound motor proper polarity hot shorts be excluded in the cable selection calculation on a complete basis, and that the methodology in the cable selection calculation be updated to reflect this treatment. It is also recommended that other specific failure modes used in implementing NUREG/CR-7150 Vol. 2 methodology in EDQ0009992012000110 (e.g., ground fault equivalent hot shorts) be addressed in the Cable Selection calculation EDN0009992012000056.

Plant Response Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 21 of 32

Fire PRA Open Finding Level F&Os F&O 2-38 The existing BFN procedures are based on the existing Self Induced Station Blackout (SISBO) strategy and the current fire model is based on an as yet to be defined non-SISBO strategy for which there are no procedures yet in place.

(This F&O originated from SR HRA-A2)

Associated (SRs) FQ-D1 HRA-A2 Basis For Analysis does not reflect the as-built as-operated plant Significance Possible Resolution When non-SISBO procedures are available, incorporate any new fire specific safe shutdown actions called out in the plant fire response procedures.

Plant Response Since the peer review, the BFN FPRA team has worked closely with the 805 transition team to match the FPRA recovery actions with those actions proposed and credited by the 805 transition team for the 805 RISK analysis. The FPRA team is only crediting those recovery actions that have been shown to sufficiently reduce CDF. A feasibility study has been performed to demonstrate that the credited actions can be performed in the available time.

The TVA Fire PRA Post-Fire Human Reliability Analysis event timing information was obtained from two sources.

The total time available was obtained from MAAP analysis. The cognitive and execution times were obtained both from a PRA practitioner who had previous knowledge of the IE HRA, and from operator. Timing information is documented in the HRA calculator files and in the operator interview forms. The operator interview forms instructed the operators to consider the assumed worst case conditions for performing the action with regard to workload, additional procedures, response time during fire conditions, travel time impacted by fire conditions, etc.

The FPRA credited actions have been developed to the extent possible to make the HRA represent those proposed actions. The final fire procedures are not available to complete and verify the fire HRA. The FPRA model therefore assumes that these actions will be in the final procedures as currently proposed. The FPRA recovery actions will be reevaluated when the fire procedures are approved and ready to be implemented in the post 805 transition.

This F&O is considered open until the procedures are finalized.

Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 22 of 32

F&O 2-39 Scoping as well as detailed (non-scoping) HRA analyses in some instances have no documentation of some or all of the following: applicable procedure(s), timing, cues, performance shaping factors and availability /

adequacy of manpower. For one example, the main control room abandonment HRA is incomplete from the perspective that 1) the diagnosis related to making the decision to abandon control room appears to be unrealistically low (5E-4 with recovery), and 2) control of LPCI requires swapping the discharge from suppression pool cooling to injection, however, now diagnosis HEP is included for this action. (This F&O originated from SR HRA-B3)

Associated (SRs) HR-G3 HR-G4 HR-G5 FQ-D1 HRA-B3 HRA-C1 Basis for Systematic issue Significance Possible Resolution Complete the definition of HFEs including: applicable procedure(s), timing, cues, performance shaping factors and availability / adequacy of manpower.

Plant Response The TVA Fire PRA Post-Fire Human Reliability Analysis includes the significant non-MCR abandonment HFEs. The HFEs have been defined and analyzed to the extent possible utilizing currently available, but draft, procedures, timing, cues and performance shaping factors, including availability/adequacy of manpower. When the fire procedures have been completed, approved and adopted, verification must be made to ensure the fire HRA still sufficiently matches the final procedures.

The main control room abandonment HRA has been expanded significantly since the peer review and the two specific F&O statements no longer apply. The concerns represented by these findings have been addressed. New abandonment HFEs have been developed and include detailed procedures, timing, cues and performance shaping factors, including availability/adequacy of manpower. As for the non-MCR actions (including the swapping of LPCI from suppression pool cooling to injection), when the fire procedures have been completed, approved and adopted, verification must be made to ensure the fire HRAs still sufficiently match the final procedures.

This F&O is considered open until the procedures are finalized. (Refer to BFN NFPA 805 LAR Attachment S, Table S--, Item 33).

Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 23 of 32

F&O 2-50 The modeling of the human actions in the FPRA includes the consideration of instruments that are credited as cues. There are several instances that were noted where the listing of possible instrument cues includes many individual devices. This modeling is treated as multiple inputs to a single AND gate, as an example. As modeled, the availability of any single instrument even if the majority of the other instruments are failed, would not disable the human action. This treatment is made without any consideration of or confirmation that operator guidance is available to allow them to discern which instrument is the known valid (not failed) instrument.

(This F&O originated from SR HRA-C1)

Associated (SRs) HRA-C1 Basis for The treatment as modeled could conceal instances where instrumentation failures have a material impact on the HEP.

Significance Failure to address this situation could cause the analysis to apply invalid credit.

Possible Resolution A justification for the current modeling treatment needs to be provided. Such a justification would need to address he manner by which an operator would be able to discern which instrument should be used and/or how they would recognize the need for action even if the majority of the available instrument might indication that no action is required.

In the absence of such a justification, a modification to the logic structure would be required.

Plant Response The TVA Fire PRA Post-Fire Human Reliability Analysis includes a discussion on the treatment of the instrumentation.

Every routed instrument train that was credited by an HFE was included in the modeling. The redundant instruments are still ANDed together and an assumption is made that the fire procedures will include the impacted instrumentation for fires in the respective area. Therefore, as long as one instrument is available and the operators know, from the applicable fire procedure, which instrument that is, that instrument can be credited even though the redundant instruments are impacted by the fire.

This F&O is resolved to extent possible with the current state of the 805 project. The instrumentation cannot be listed in the fire procedures until the procedures are developed. Once the fire procedures are complete, approved and accepted, verification must be made to ensure the operator can determine from the fire procedure which instruments are free of fire damage for the applicable fire scenarios and those instruments are properly credited in the FPRA model.

This F&O is considered open until the procedures are finalized. (Refer to BFN NFPA 805 LAR Attachment S, Table S-3, Item 33).

Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 24 of 32

F&O 4-12 As documented in Section 6.2 of Component Selection report, a review of the fire emergency procedures (FEPs) or similar fire-related instructions was not conducted since the BFN fire safe shutdown strategies will be updated as part of the NSCA. The FPRA therefore does not consider modifications of existing internal events accident sequences that will require modification based on unique aspects of the plant fire response procedures. This approach does not reflect the as-built as operated plant.

(This F&O originated from SR PRM-B5)

Associated (SRs) AS-A1 AS-A5 AS-A9 PRM-B5 Basis for N/A Significance Possible Resolution Consider modifications of existing internal events accident sequences that will require modification based on unique aspects of the plant fire response procedures when it is available.

Plant Response The TVA Fire PRA Post-Fire Human Reliability Analysis includes a review of the EOIs for all three units. The fire procedures when complete will be reviewed for infeasible operator actions. If undesired operator actions are identified, either the procedure will be modified to eliminate the potential action or the potential action will be modeled and its risk significance determined. This review will include the main control room abandonment procedures. If modifications to the existing internal events accident sequences require modification based on unique aspects of the plant fire response procedures after the procedures are approved, the Fire PRA Component Selection will be updated to reflect the required changes. This F&O is considered open until the procedures are finalized. The fire HRA will be updated upon completion of procedure updates, modifications and training. (Refer to BFN NFPA 805 LAR Attachment S, Table S-3, Item 33).

Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on SFCP TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 25 of 32

F&O 4-17 In considering whether there are possible new scenarios not addressed in the Internal Events PRA that should be considered for the Fire PRA resulting in additional equipment that needs to be included in the Fire PRA, Section 6.2 states that the following was performed with the observations documented. (1) Considered sequences screened out of the Internal Events PRA that may become relevant to the Fire PRA and need to be implemented in the Fire PRA Model. A review was conducted for such scenarios, originally eliminated from the Internal Events PRA, to determine if the analyst needs to add components to the Fire PRA Component List, as well as, model those components (and failure modes) in new sequences in the Fire PRA Model; (2) Considered the possible effects of spurious operations that may result in new accident sequences and associated components of interest that should be addressed in the Fire PRA and go beyond considerations in the Internal Events PRA. Typically, these new sequences arise as a result of spurious events that cause a LOCA: e.g., spurious opening of safety relief valves, adversely affect plant pressure control: (e.g., safety relief valve events,) allow overfill situations: (e.g., reactor vessel overfill that if unmitigated could subsequently fail credited safe shutdown equipment, such as HPCI or RCIC pumps, or introduce other new scenarios that may not be addressed in the Internal Events PRA;) and (3) A review of the fire emergency procedures (FEPs) or similar fire-related instructions was not conducted since the BFN fire safe shutdown strategies will updated as part of the NSCA.

To the extent that the associated human actions and their effects will be explicitly included in the Fire PRA Model, new sequences and corresponding components may need to be included in the Fire PRA. It should be recognized that some of the human actions from these potentially new sequences may have to be addressed in the Fire PRA. Examples are: The Internal Events PRA likely will not have addressed main control room abandonment scenarios where fire-specific operator actions and equipment sets are relied upon; fire specific manual actions designed to preclude or overcome spurious operations will likely not have been addressed in the Internal Events PRA. Other procedural actions may address a degraded barrier, or deal with a breaker coordination problem, among others; fire specific manual actions may cause intentional failure of a safe shutdown function or a subset of that functional response. For example, a proceduralized action may be to trip a power supply thereby disabling (failing) certain equipment in the plant. The effect of this action should be implemented in the Fire PRA Model by acknowledging the affected components in the Fire PRA Component List and noting the success of the proceduralized human action as a failure mode of that component in the Fire PRA Model (including any new resulting accident sequences as appropriate).

Table 9 of the CS notebook provides this review for new accident sequences. However, Table 9 does not provide much information. It lists the following considerations: spurious opening of one or more safety relief valves, spurious closure of all MSIVs, loss of condenser vacuum, loss of feedwater, and turbine bypass unavailable. The expectation would be to document the entire review to accomplish the above steps, such as (examples only) 1) examining all MSO scenarios for potentially new accident sequences (e.g., overfill as an initiating event); 2) fire-induced floods, from causes such as: a.) system relief valves opening due to system over pressurization that result from spurious operations (not the SRVs, but relief valves designed to protecting from system overpressure), b.) spurious opening of system drain valves, or c.) water hammer; examples are: i) fire water system actuates and isolation valve spuriously closes, ii) keep fill pump for injection system fails, pump outlet piping drains and pump starts, iii) drain valve spuriously opens on pump outlet piping, draining the piping and pump receives signal to start, etc. d.) fire-specific ISLOCA leakage sources; 3) loss of power to the control room annunciator tile boards. (This F&O originated from SR PRM-B5)

Associated (SRs) AS-A5 CNL-20-002 Page A3 26 of 32

PRM-B5 Basis for Insufficient documentation Significance Possible Resolution Document a review of any new accident sequences, including timing considerations not in the internal events, including a review of fire emergency procedures.

Plant Response A review was conducted of 1) screened initiating events from the internal events PRA model documentation, and

2) MSO impacts on plant safe shutdown and on the potential for new initiating events. The results of this review are documented in the Component Selection report. The review included an evaluation of generic and plant specific MSO scenarios to identify the potential for any unique failure impacts. No new sequences were identified which were not already included in the Fire PRA model, or adequately addressed by system logic models as modified for the Fire PRA.

A review of fire emergency procedures will be performed after procedure development is complete Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 27 of 32

F&O 4-21 The review of EOIs and annunciator response procedures for instruments applicable to undesired operator actions is documented in Section 5.6.1 and 5.6.2 of HRA notebook, and Attachment F.

However, fire emergency procedures and control room abandonment procedures were not reviewed, since these procedures employ the SISBO approach. Therefore, review is not for the as-built as operated plant.

(This F&O originated from SR ES-C2)

Associated (SRs) ES-C2 FQ-D1 HRA-A3 Basis for Incomplete analysis Significance Possible Resolution N/A Plant Response The TVA Fire PRA Post-Fire Human Reliability Analysis includes a review of the EOIs for all three units. The fire procedures when complete will be reviewed for infeasible operator actions. If undesired operator actions are identified, either the procedure will be modified to eliminate the potential action or the potential action will be modeled and its risk significance determined. This review will include the main control room abandonment procedures. This F&O is considered open until the procedures are finalized. The fire HRA will be updated upon completion of procedure updates, modifications and training. (Refer to BFN NFPA 805 LAR Attachment S, Table S-3, Item 33).

Closure Review Open Status Basis Cannot be closed out until after the FPRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 28 of 32

F&O 9-4 All of the recovery actions were not included in the dependency analysis.

Associated (SRs) HR-H3 FQ-A3 FQ-D1 HRA-D2 Basis for Incomplete dependency analysis.

Significance Possible Resolution Ensure all recovery actions are included in the final dependency analysis.

Plant Response All of the recovery actions used by the Fire PRA have been included in the dependency analysis. The dependency analysis is documented in the TVA Fire PRA Post-Fire Human Reliability Analysis. Since the peer review, the BFN FPRA team has worked closely with the 805 transition team to match the FPRA recovery actions with those actions proposed and credited by the 805 transition team for the 805 Risk analysis. The FPRA team is only crediting those recovery actions that have been shown to sufficiently reduce CDF. The FPRA credited actions have been developed to the extent possible to make the HRA represent those proposed actions. The final fire procedures are not available to complete and verify the fire HRA. The FPRA model therefore assumes that these actions will be in the final procedures as currently proposed. Before the FPRA recovery actions can be considered complete, they will have to be reevaluated when the fire procedures are approved and ready to be implemented in the post 805 transition. (Refer to BFN NFPA 805 LAR Attachment S, Table S-3, Item 33).

This F&O is considered open until the procedures are finalized. The fire HRA will be updated upon completion of procedure updates, modifications and training. (Refer to BFN NFPA 805 LAR Attachment S, Table S-3, Item 33).

Closure Review Open Status Basis Cannot be closed out until after the PRA had been updated following completion of the NFPA 805 modifications and completion of the post-transition safe shutdown procedures Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 29 of 32

F&O PRM-B9-01 This F&O supersedes and incorporates the issues identified in F&O 9-2 from Table A7 of the BFN Fire Probabilistic Risk Assessment Summary Document, calculation #NDN0009992012000096.

The wording from 9-2 is: "The new Safe Shutdown Injection Pump is currently modeled as a single event with a probability of 0.1. This system is still in the conceptual phase. This F&O is written as a placeholder to model the system in detail at some future date." The purpose of this F&O is to ensure that the as-built of the Emergency High Pressure Makeup (EHPM) System clearly documents the following in order to fully comply with standard ASME-RA-S-2009 (latest revision).

• Key safety functions satisfied by the system

• Success criteria for the system

• Ensure the as-built modification does not introduce any new initiating events

• during any plant mode of operation

• Phenomenological effects on the system

• System dependencies such as cooling, electrical, etc.

• Time dependencies such as water volume depletion

• Key assumptions

• Any unit cross connects and their effect on success criteria , accident progression and new initiating events

• Review any relevant plant experience to ensure potential for new initiators is addressed and any precursor for an initiating event is addressed Potential for common cause failures Associated (SRs) PRM-B7, PRM-B8, IE-A1, IE-A2, IE-A3, IE-A5, IE-A6, IE-A7, IE-A9, IE-A10, AS-A2, AS-A3, AS-A4, AS-B1, AS-B2, AS-B3, AS-B6, AS-B7, AS-C3, AS-SC-A2, SC-A3, SC-A4, SC-C2, LE-C6 Basis For Ensure complete documentation so that the as modeled fire PRA aligns with the as built and as-operated plant and is Significance compliant with the ASME standard.

Possible Resolution Follow established processes for a new system and ensure the system notebook documents items listed above as well as listing components in the component selection notebook and follow appropriate protocols.

Plant Response N/A Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 30 of 32

F&O CF-A1-01 The revised methodology for CFMLA, documented in Section 6.0 of EDQ0009992012000110, is consistent with the latest industry guidance in NUREG/CR-7150, Vol. 2. A review of likelihood values assigned in Appendix C of EDQ0009992012000110 identified some anomalies for specific circuit configurations related to Design Change Notice (DCN 71214), which is described in EDQ0009992012000110, Attachment 2. This DCN electrically reconfigures the control circuit for Unit 1, 2, and 3 RHR System valves to resolve spurious operation of these valves.

1-FCV-074-0060, 1-FCV-074-0071, 1-FCV-074-0074, 2-FCV-074-0057, 2-FCV-074-0060, 2-FCV-074-0071, 2-FCV-074-0074, 3-FCV-074-0057, 3-FCV-074-0060, 3-FCV-074-0074 Based on Attachment 2 of EDQ0009992012000110, DCN 71214 is intended to prevent spurious operation of the components except at cable endpoints, which are identified in Attachment 2. The spurious operation probabilities assigned in Appendix C of EDQ0009992012000110 for these valves are assigned a value of zero except for areas of the endpoints, where a spurious operation value is provided. Several issues were identified:

1) Panel Wiring - The spurious operation value of 1.30E-02 is provided, which corresponds to single break circuits, ungrounded ac, thermoplastic insulated cable spurious operation probability for inter-cable hot shorts (Table 8-1 NUREG/CR-7150, Vol. 2). However, the failure mode of concern does not appear to account for the electrical panels where the cables terminate. NUREG/CR-7150 Volume 2, Section 7.4 provides the following guidance for panel wiring.

There are no test data for evaluating the likelihood of hot short-induced spurious operations for panel wiring. A hot short in the panel wirings conductor bundles within a cabinet could behave similarly to any of the failure modes of an electrical cable (i.e., intra-cable, inter-cable, or GFEHS) depending upon the proximity of the conductors to the fire and the tightness of their bundles. The conditional probability of hot short-induced spurious operation most likely is affected by the configuration and tightness of the conductor bundles, along with the proximity of source and target cables.

Considering the lack of applicable test data and the potential risk importance of panel wiring, the PRA panel recommends using aggregate values in the tables in Sections 4 and 5.

The aggregate value for Table 8-1 of NUREG/CR-7150, Vol. 2 for Ungrounded ac, thermoplastic insulated cable spurious operation probability for MOVs is 0.39. Therefore, by applying value for inter-cable hot shorts exclusively in a fire area, it may not account for the higher spurious operation probability for the panel wiring.

2) Alignment with Modification - In addition, based upon discussion with TVA and PRA project staff, it appears that the values proposed in Appendix C of EDQ0009992012000110, Revision 7, were based on routing of the spurious operation target cable in conduit, (based on modification descriptions provided in Attachment 2 of EDQ0009992012000110). The proposed treatment was that the cable in conduit routed in endpoint fire areas would be subject to spurious operation (i.e., not provided with shielded, braided protection). Based on a 5/14/15 conference call, the modification was going to provide shielded braided cable for the entire route of the target cable, except at the specific terminal locations and not be subject to spurious operation, except at the terminal endpoints (i.e., the potential spurious operation of the target cable in conduit was not part of the proposed design). Therefore, the CFMLA modeling described in Appendix C of EDQ0009992012000110 did not appear to match the proposed modification.

CNL-20-002 Page A3 31 of 32

While it is expected that checks and balances in the plant modification process could refine the CFMLA following completion of the modification, the current treatment of the proposed modification does not appear to align with the modification or industry guidance.

Associated (SRs) CF-A1 Basis For Failure to accurately represent the modification could potentially result in mischaracterization of the fire risk associated Significance with spurious operation of the valves and the modification. Use of the inter-cable spurious operation values instead of the aggregate values per the guidance in NUREG/CR-7150 could under-estimate the risk of spurious operation of the valves for fires that impact the cable endpoints. Update the treatment of spurious operation of these valves to align with the modification scope.

Possible Resolution Review the treatment of spurious operations of panel wiring and update the treatment per NUREG/CR-7150, Volume 2, if the risk significance of the scenarios warrants this treatment (per SR CF-A1). Note that these modifications have not yet been implemented in the Fire PRA results per Note 2 of Appendix E of EDQ0009992012000110. Alternatively, additional design measures could be implemented to reduce the vulnerability of the panel wiring to hot short induced spurious operation.

Plant Response N/A Closure Review Open Status Basis Not subjected to a closure review.

Impact on 50.69 TVA proposes a license condition to resolve this issue and have it closed in accordance with an Independent Application Assessment prior to categorization (See attachment 1). Therefore, there would be no impact on the application.

CNL-20-002 Page A3 32 of 32

Attachment 4: External Hazards Screening Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

There are no airports within five miles of the site. The Athens-Decatur Airport is about 10 miles east of the plant. The nearest commercial airport is located in Aircraft Impact Y C2 Huntsville about 25 miles from the site.

The likelihood of an aircraft crash that potentially results in significant damage is negligible.

The absence of steep slopes in the terrain of the Browns Ferry site precludes the occurrence of an Avalanche Y C3 avalanche. Accordingly, an avalanche is not a probable event given the natural topography.

Raw water systems are chemically treated during peak clam spawning periods to ensure clam control.

Biological Event Y C5 Chemical injection of corrosion inhibitors is implemented where required.

Chemical treatment systems are also designed to reduce tube fouling and improve heat transfer.

The Browns Ferry nuclear plant site is Coastal Erosion Y C5 not in proximity to any ocean or large body of water. This eliminates coastal erosion as a potential threat.

CNL-20-002 Page A4 1 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Drought is accounted for in the design basis of the plant such that the long term effects do not adversely impact the UHS Drought Y C5 safety function capability. This meets the requirements of Regulatory Guide 1.27 section B. This is a slow developing event.

External floods defined as the most severe reasonable possible flood were analyzed to include excessive rainfall, storms, wind waves and potential dam failures.

Safety related structures, systems and components have been designed to withstand and maintain cold shutdown in the event of a probable maximum flood as required by reg. guide 1.59.

External Flooding Y C1 The external flooding hazard at BFN was recently evaluated as a result of the post-Fukushima 50.54(f) Request for Information. The flood hazard reevaluation report (FHRR) was submitted to NRC for review on March 12, 2015. The results indicate that flooding from all hazards, except local intense precipitation (LIP), are bounded by the current licensing basis (CLB) and do not pose a challenge to the plant. The FHRR included commitments describing CNL-20-002 Page A4 2 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) required actions to provide BFN protection against the re-evaluated LIP hazard. Flooding from local intense precipitation was subsequently evaluated in Focused Evaluation, and concluded that no safety related SSCs are impacted. The actions required for the LIP protection strategy are determined to be feasible.

Snowfall is not a factor in determining maximum flood levels due to snowfall levels being relatively light for this area.

The maximum wind speed for the Browns Ferry design basis tornado is 300 mph. All class I structures and components have been designed to maintain integrity when exposed to a 300 mph tornado.

PS1 Structures and components that cannot Extreme Wind or Y withstand tornado loads were found not Tornado PS4 to perform any safety-related function nor disable the safety function of safety-related structures, systems and components.

The high winds hazard to core damage frequency is less than 10-6 per year.

Metal siding panels part of secondary containment designed as relief panels CNL-20-002 Page A4 3 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) are permitted to blow off during a design basis tornado.

The CCW pumps are vulnerable to individual missile damage, but failure of all 9 is assumed impossible. Only 1 pump is needed to dissipate heat loads for all three units. No specific SSCs are identified whose failure results in unscreened scenarios Aircraft, sea and land vehicle accidents may increase in the presence of dense Fog Y C4 fog. This event is subsumed within the rates for Transportation Accidents.

External forest fires at the site boundary could potentially result in loss of offsite power, forced isolation of plant ventilation and control room evacuation.

The LOOP initiator in the internal events PRA bounds the LOOP potential as an C4 external event.

Forest or Range Fire Y C3 If a fire event required evacuation of the control room, this would not invalidate the ability to shutdown the plant safely from the remote shutdown panel.

In accordance with TVA policy, vegetation has to be removed from CNL-20-002 Page A4 4 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) safety-related structures as not to present a fire hazard.

Weather-related LOOP initiating event analyzed in the internal events model Frost Y C4 encompasses extreme weather affecting plant operations. Frost is subsumed within the frequency of this initiator.

Storm conditions including hailstorms Hail Y C4 are treated in the weather related LOOP initiator from the internal events analysis.

Extreme temperature swing effects are limited to reducing the capacity of the ultimate heat sink and loss of offsite power. General design criteria 24 C1 High Summer stipulates that a loss of all offsite power Y

Temperature does not prevent the reactor protection C4 system from functioning.

See Drought for effects on the Ultimate Heat Sink.

Probable maximum flood levels assessed in the external flooding High Tide, Lake Level, Y C4 analysis qualifies the plants ability to or River Stage handle increased reservoir levels and achieve safe shutdown.

CNL-20-002 Page A4 5 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

See External Flooding Analysis.

A hurricane is not a naturally occurring event at Browns Ferry given this is a river site, not an ocean site. The C3 resulting storm surge with associated Hurricane Y high winds is equivalent to the probable C4 maximum flood with wave run-up.

See External Flooding, High Winds/Tornado.

Formation of ice cover on the Tennessee River is not a viable initiating event as this is a humid temperate climate.

C1 Changing river levels (natural Ice Cover Y phenomena) have also been analyzed C3 and concluded to not impact safety-related structures from maintaining their safety function in accordance with GDC-2.

There are twelve industrial facilities listed in table 2.2-8 of the FSAR within 5 to 10 Industrial or Military miles of the plant. The nearest military Y C3 Facility Accident facility is the Redstone Arsenal 25 miles east of the plant. There are no industrial or military facilities located within a 5-mile radius of BFNP where stored CNL-20-002 Page A4 6 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) chemicals could cause a potential plant hazard.

Internal flooding is modeled specifically Internal Flooding N N/A and included in the internal events PRA model.

Internal Fire N N/A BFN has an internal fire PRA.

The slopes at the Browns Ferry nuclear plant were investigated and do not indicate instabilities or the potential for a landslide. There is no major elevation Landslide Y C3 relief near the BFN site. There are also no events on record of a landslide occurring at this site. A landslide is not a credible initiating event given this topography.

According to NUREG-1407, the primary impact of lightning is loss of offsite Lightning Y C4 power. The initiating event frequency of the LOOP initiator bounds this analysis.

CNL-20-002 Page A4 7 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Low levels in the Wheeler Reservoir and low inflow have already been factored in Low Lake Level or as the most severe natural phenomena Y C1 River Stage expected in accordance with GDC-2 and found to not impact the safety function capability of the UHS.

Freezing is rare in this humid temperate climate and the effects of low winter temperature would be slow moving. Low C1 Low Winter and high river reservoir levels have been Y

Temperature analyzed to conclude that safety-related C5 structures, systems and components are still within safe shutdown capability given either extreme.

The probability of a meteorite and/or satellite impact is less than 10-9 Meteorite or Satellite according to NUREG-5042 Supplement Y PS4 Impact 2 and is excluded based on its low occurrence probability. No specific SSCs are identified whose failure results in unscreened scenarios.

Transport of chemicals by pipeline were considered and analyzed according to the methods illustrated in Regulatory Pipeline Accident Y C3 Guide 1.78. For chemicals transported near the site by pipeline within a 5-mile radius, no hazard to control room habitability was found.

CNL-20-002 Page A4 8 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Onsite chemicals were considered using the approach shown in Regulatory Guide 1.78. It was concluded that no chemicals stored onsite effect main Release of Chemicals Y PS2 control room habitability. This was due in Onsite Storage to the fact that these chemicals are stored in small quantities, are solids, are liquids with low vapor pressure, or the operators would have sufficient time to don protective equipment if released.

The most limiting flow rate postulated from any site related accident, including River Diversion Y C1 river diversion, is 100 cfs. This flow rate is above the minimum 80 cfs needed to meet the accident and shutdown requirements of the plant.

Sand or dust storms are not a factor Sand or Dust Storm Y C3 based on geography of the immediate area.

CNL-20-002 Page A4 9 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

The Browns Ferry site elevation is over 9 feet above the maximum pool levels.

The largest amplitude of seiche recorded on lakes, reservoirs or ponds in the area Seiche Y C3 was 0.14 feet. This elevation difference precludes the potential for a seiche.

There is also no recorded occurrence of a landslide causing a seiche in the Tennessee reservoir system. A seiche event poses no hazard.

Seismic Activity N N/A BFN has a Seismic PRA.

Snowfall does not occur in significant amounts and accumulation only lasts a few days given the humid temperate climate. Therefore, no potential hazard exists from snowfall.

Snow Y C3 Alternately, occurrence of the severe natural phenomena do not pose undue challenge to the safe shutdown capability of safety-related structures, systems and components in accordance with GDC-2.

CNL-20-002 Page A4 10 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Section 2.5.4 of the FSAR concludes Soil Shrink-Swell that the underlying bedrock of the site Y C1 Consolidation boundary is such that the foundation of all plant structures is adequate.

The Browns Ferry nuclear plant is located several hundred miles away from Storm Surge Y C3 any large bodies of water. The potential for a storm surge of significant magnitude is negligible.

The worst case accidents analyzed revealed that a barge carrying chemicals listed in section 10.12.5.3 of the FSAR would be the most limiting. On release, the concentration in the control room would pose a potential threat to the Toxic Gas Y PS2 control room operators. The chemicals released were determined to be detected by smell giving operators enough time to place on protective equipment.

See Transportation Accidents.

CNL-20-002 Page A4 11 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Barge - Table 2.2-10 of the FSAR lists hazardous river traffic that passes BFN.

This allows BFN to meet the 1975 SRP and Regulatory Guide 1.91 acceptance criteria since the distances and locations of nearby industrial, military and transportation facilities, the nature and extent of activities conducted at the facilities, and the products and materials stored, transported or used at the facilities is provided.

Potential accidents due to river transport identifies no vulnerabilities and conforms PS2 to the design basis. Section 10.12.5.3 of Transportation Y the FSAR concludes that of the Accident PS4 chemicals transported by the site by pipeline, barge, rail or road within a C3 5-mile radius, only chlorine traveling by barge could present a hazard to control room personnel. The probability of this chlorine exceeding the concentration limits in Regulatory Guide 1.78 is less than 1.0E-6 events per year. At that value, chlorine release can be excluded from consideration. No specific SSCs are identified whose failure results in unscreened scenarios. If a coal barge were to sink in the channel, flow to the Intake Pumping Station would not be blocked.

CNL-20-002 Page A4 12 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Railroad - There are no railroads that enter the site boundary. The closest railroad tracks are listed in section 2.2.3 and 10.12.5.3 of the FSAR. Description of the locations and distances of transportation facilities in the vicinity of the plant meets the acceptance criteria of the 1975 SRP and is therefore satisfied by the description above.

Highway - There are no highways which penetrate the site boundary. The nearest principal highways are listed in section 2.2.3 of the FSAR. Description of the locations and distances of transportation facilities in the vicinity of the plant meets the acceptance criteria of the 1975 SRP and is therefore satisfied by the description above.

Aircraft - See Aircraft Impact.

BFN is not an ocean site. This treatment is not applicable to Browns Ferry based Tsunami Y C3 on lack of proximity to sea or large bodies of water.

The positioning of the low pressure Turbine-Generated turbines ensures that no turbine Y PS1 Missiles generated missiles will damage safety related systems, structures, and components.

CNL-20-002 Page A4 13 of 14

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

The probability of a turbine generator failure leading to the ejection of missiles is designed to be less than 1E-04 per year. No specific SSCs are identified whose failure results in unscreened scenarios.

No hazard from volcanoes is present for Volcanic Activity Y C3 Browns Ferry given the location of the site away from active volcanoes.

Wave producing effects are caused by storm surges, high winds and external flooding.

Waves Y C4 See Storm Surge, High Winds, Seiche and External Flooding.

Note a - See Attachment 5 for descriptions of the screening criteria.

CNL-20-002 Page A4 14 of 14

Attachment 5: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments NUREG/CR-2300 and Initial Preliminary C1. Event damage potential is < events for ASME/ANS Standard Screening which plant is designed.

RA-Sa-2009 C2. Event has lower mean frequency and no NUREG/CR-2300 and worse consequences than other events ASME/ANS Standard analyzed. RA-Sa-2009 NUREG/CR-2300 and C3. Event cannot occur close enough to the ASME/ANS Standard plant to affect it.

RA-Sa-2009 NUREG/CR-2300 and Not used to screen. Used C4. Event is included in the definition of ASME/ANS Standard only to include within another event.

RA-Sa-2009 another event.

C5. Event develops slowly, allowing adequate ASME/ANS Standard time to eliminate or mitigate the threat.

Progressive PS1. Design basis hazard cannot cause a ASME/ANS Standard Screening core damage accident. RA-Sa-2009 PS2. Design basis for the event meets the NUREG-1407 and criteria in the NRC 1975 Standard Review ASME/ANS Standard Plan (SRP). RA-Sa-2009 CNL-20-002 Page A5 1 of 2

Event Analysis Criterion Source Comments PS3. Design basis event mean frequency is NUREG-1407 as modified in

< 1E-5/y and the mean conditional core ASME/ANS Standard damage probability is < 0.1. RA-Sa-2009 NUREG-1407 and PS4. Bounding mean CDF is < 1E-6/y. ASME/ANS Standard RA-Sa-2009 Screening not successful. PRA needs to meet NUREG-1407 and Detailed PRA requirements in the ASME/ANS PRA ASME/ANS Standard Standard. RA-Sa-2009 CNL-20-002 Page A5 2 of 2

Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Instrument air is assumed This assumption may This assumption could result in to fail for the Reactor conservatively increase the fire LSS components conservatively Building (fire areas 1, 2, 3) risk estimates. The risk being assigned a HSS based on soldered piping importance of this modeling classification.

being in the area. The approach was assessed via location of the soldered sensitivity analysis piping at BFN has not been determined for specific fire compartments (Ref. 44 Table 1).

Fires causing Interfacing This assumption will result in It is typical of many PRAs, and Systems Loss of Coolant risk overestimations. consistent with the BFN internal Accident (ISLOCA) events events PRA model, and is not are assumed to lead expected to dominate the risk directly to core damage, if results. Note that the assumption not isolated. that ISLOCAs lead directly to core damage eliminate the need to assess the effects of ISLOCA-induced flooding.

Properly sized and This is a source of uncertainty. If This assumption is expected to coordinated electrical this assumption is not met, the conservatively result in more protective devices are occurrence of secondary fires SSCs assigned an HSS assumed to function in could lead to an underestimated classification.

accordance with their evaluation of the fire risk in the design tripping plant.

characteristics, thereby preventing initiation of secondary fires through circuit faults created by the initiating fire. For further coordination discussion see Section 7.1.

All cables are assumed to This assumption introduces This assumption is expected to have thermoplastic insulation conservatism into the results as conservatively result in more unless otherwise stated. some cable insulation types SSCs assigned an HSS This assumption is based on may have a lower failure classification.

guidance from NUREG 6850 probability than what was concerning fire assumed.

compartments with a mix of thermoplastic and thermoset cables. Few fire compartments at BFN have only thermoset cables. This study is covered in the CNL-20-002 Page A6 1 of 3

Assumption/ Uncertainty Discussion Disposition Scoping Fire Modeling Report. The information for insulation material for cables is stored and maintained in the BFN CAT database.

Interfacing System Loss of This assumption will result in This assumption is expected to Coolant Accidents risk overestimations. However, conservatively result in more (ISLOCAs), including MSOs it is typical of many PRAs, is SSCs assigned an HSS that could result in consistent with the BFN internal classification.

ISLOCAs, are assumed to events PRA model, and is not have the same expected to dominate the risk consequences in both the results. Note that the internal event PRA and the assumption that ISLOCAs lead Fire PRA. ISLOCAs are directly to core damage assumed to lead directly to eliminate the need to assess the core damage and large effects of ISLOCA-induced early release, and are flooding.

modeled under the ISLOCA top. Technical Justification:

Consistent treatment between the Internal Events PRA and the Fire PRA.

With respect to core damage and large early release, there is no difference between an ISLOCA occurring due to an event. Note that there is no need to address flooding concerns associated with these events (because they are assumed to lead directly to core damage and large early release) internal initiating event or an internal fire initiating Due to the complexity of This assumption introduces This assumption is expected to determining cable insulation conservatism into the results as conservatively result in more type at BFNP, the insulation some cable insulation types SSCs assigned an HSS type listed in Appendix C may have a lower failure classification.

may be listed as unknown. probability than what was Where insulation type is assumed.

listed as unknown, the larger conditional probability between target cable configuration 1 (Thermoset)

CNL-20-002 Page A6 2 of 3

Assumption/ Uncertainty Discussion Disposition and target cable configuration 2 (Thermoplastic) was conservatively selected and used for the spurious operation probability.

Technical Justification:

Notes in the CAT software

[Reference 11] would have to be analyzed for each cable to identify insulation material. Using the larger failure probability of thermoset or thermoplastic is the more efficient method and is conservative.

CNL-20-002 Page A6 3 of 3

Enclosure 2 BFN Units 1, 2, and 3 Operating License Markups CNL-20-002

Insert 1 (XX) Adoption of 10 CFR 50.69, Risk-Informed Categorization and treatment of structures, systems and components for nuclear power plants (1) TVA is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the Individual Plant Examination of External Events (IPEEE) Screening Assessment for External Hazards, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; Internal fires and seismic hazards are evaluated with BFN specific PRA models; as specified in License Amendment No. [XXX].

(2) TVA shall complete the numbered items listed in Attachment 1, List of Categorization Prerequisites, of TVA letter [ML Number], dated [DATE], prior to implementation. All issues identified in the attachment will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA- Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

(3) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a shutdown defense in depth approach to a shutdown probabilistic risk assessment approach).

Insert 1

-6f-(23) Maximum Extended Load Line Limit Analysis Plus (MELLLA+) Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analyses using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d), shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license. Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

E. The UFSAR supplement, as revised, describes certain future activities to be complete prior to the period of extended operation. TVA shall complete these activities no later than December 20, 2013, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

F. All capsules in the reactor vessel that are removed and tested must meet the test procedures and reporting requirements of the most recent NRC-approved version of the Boiling Water Reactor Vessels and Internals Project (BWRVIP) Integrated Surveillance Program (ISP) appropriate for the configuration of the specimens in the capsule. Any changes to the BWRVIP ISP capsule withdrawal schedule, including spare capsules, must be approved by the NRC prior to implementation. All capsules placed in storage BFN-UNIT 1 Renewed License No. DPR-33 Amendment No. 310

Insert 1

-6f-(23) Maximum Extended Load Line Limit Analysis Plus (MELLLA+) Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analyses using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d), shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license. Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

E. The UFSAR supplement, as revised, describes certain future activities to be completed prior to the period of extended operation. TVA shall complete these activities no later than June 28, 2014, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

F. All capsules in the reactor vessel that are removed and tested must meet the test procedures and reporting requirements of the most recent NRC-approved version of the Boiling Water Reactor Vessels and Internals Project (BWRVIP) Integrated Surveillance Program (ISP) appropriate for the configuration of the specimens in the capsule. Any changes to the BWRVIP ISP capsule withdrawal schedule, including spare capsules, must be approved by the NRC prior to implementation. All capsules placed in storage BFN-UNIT 2 Renewed License No. DPR-52 Amendment 333

-6f-(16) Radiological Consequences Analyses Using Alternative Source Terms TVA shall perform facility and licensing basis modifications to resolve the non-conforming/degraded condition associated with the Alternate Leakage Treatment pathway such that the current licensing basis dose calculations (approved in License Amendment Nos. 251/282 (Unit 1), 290/308 (Unit 2) and 249/267 (Unit 3)) would remain valid.

These facility and licensing basis modifications shall be complete prior to initial power ascension above 3458.

(17) Prior to extending the frequency for the Integral Leakage Rate Testing described in TS 5.5.12, the licensee shall implement the modifications, that are modeled in the Fire PRA and described in Table S-2, Plant Modifications Committed, of Tennessee Valley Authority letter CNL-18-100, dated October 18, 2018; as supplemented by letter CNL-19-027, dated February 13, 2019.

(18) Maximum Extended Load Line Limit Analysis Plus (MELLLA+) Special Consideration The licensee shall not operate the facility within the MELLLA+

operating domain more than a 10°F reduction in feedwater Insert 1 temperature below the design feedwater temperature.

Maximum Extended Load Line Limit Analysis Plus (MELLLA+)

Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analyses using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

I D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d),

shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license.

Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

E. The UFSAR supplement, as revised, describes certain future activities to be completed prior to the period of extended operation. TVA shall complete these activities no later than July 2, 2016, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

BFN-UNIT 3 Renewed License No. DPR-68 Amendment 293

Enclosure 3 BFN Units 1, 2, and 3 Operating License Re-Typed Pages CNL-20-002

-6f-The license condition described above shall expire: (1) upon satisfaction of the requirements in items (g) and (h), provided that a visual inspection of the steam dryer does not reveal any new unacceptable flaw(s) or unacceptable flaw growth that is due to fatigue, and; (2) upon satisfaction of the requirements specified in item (i).

(19) Neutron Absorber Monitoring Program The licensee shall, at least once every ten years, withdraw a neutron absorber coupon from the spent fuel pool and perform Boron-10 (B-10) areal density measurement on the coupon. Based on the results of the B-10 areal density measurement, the licensee shall perform any technical evaluations that may be necessary and take appropriate actions using relevant regulatory and licensing processes.

(20) Radiological Consequences Analyses Using Alternative Source Term TVA shall perform facility and licensing basis modifications to resolve the non-conforming/degraded condition associated with the Alternate Leakage Treatment pathway such that the current licensing basis dose calculations (approved in License Amendment Nos. 251/282 (Unit 1), 290/308 (Unit 2) and 249/267 (Unit 3)) would remain valid. These facility and licensing basis modifications shall be complete prior to initial power ascension above 3458 MWt.

(21) Prior to extending the frequency for the Integral Leakage Rate Testing described in TS 5.5.12, the licensee shall implement the modifications, that are modeled in the Fire PRA and described in Table S-2, Plant Modifications Committed, of Tennessee Valley Authority letter CNL-18-100, dated October 18, 2018, as supplemented by letter CNL-19-027, dated February 13, 2019.

(22) Maximum Extended Load Line Limit Analysis Plus (MELLLA+) Special Consideration The licensee shall not operate the facility within the MELLLA+ operating domain with more than a 10°F reduction in feedwater temperature below the design feedwater temperature.

(23) Maximum Extended Load Line Limit Analysis (MELLLA+) Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analysis using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

(24) Adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Plant (1) TVA is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for BFN-UNIT 1 Renewed License No. DPR-33 Amendment No. ___

-6g-Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the Individual Plant Examination of External Events (IPEEE) Screening Assessment for External Hazards, and a screening of other external hazards updated using the external hazards screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; and internal fires and seismic hazards are evaluated with BFN specific PRA models, as specified in License Amendment No. [XXX].

(2) TVA shall complete the numbered items listed in Attachment 1, List of Categorization Prerequisites, of TVA letter [ML Number], dated [DATE], prior to implementation. All issues identified in the attachment will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

(3) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a shutdown defense- in-depth approach to a shutdown probabilistic risk assessment approach).

D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d), shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license. Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

E. The UFSAR supplement, as revised, describes certain future activities to be completed prior to the period of extended operation. TVA shall complete these activities no later than December 20, 2013, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

BFN-UNIT 1 Renewed License No. DPR-33 Amendment No. ___

-6f-(23) Maximum Extended Load Line Analysis Plus (MELLLA+) Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analyses using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

(24) Adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Plants (1) TVA is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC3, and RISC- 4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; and internal fires and seismic hazards are evaluated with BFN specified PRA models, as specified in License Amendment No. [XXX].

(2) TVA shall complete the numbered items listed in Attachment 1, List of Categorization Prerequisites, of TVA letter [ML Number], dated [DATE], prior to implementation. All issues identified in the attachment will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process; (3) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a shutdown defense-in- depth approach to a shutdown probabilistic risk assessment approach).

D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d), shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license. Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

BFN-UNIT 2 Renewed License No. DPR-52 Amendment ___

-6f-(16) Radiological Consequences Analyses Using Alternative Source Terms TVA shall perform facility and licensing basis modifications to resolve the non-conforming/degraded condition associated with the Alternate Leakage Treatment pathway such that the current licensing basis dose calculations (approved in License Amendment Nos. 251/282 (Unit 1), 290/308 (Unit 2) and 249/267 (Unit 3)) would remain valid. These facility and licensing basis modifications shall be complete prior to initial power ascension above 3458 MWt.

(17) Prior to extending the frequency for the Integral Leakage Rate Testing described in TS 5.5.12, the licensee shall implement the modifications, that are modeled in the Fire PRA and described in Table S-2, Plant Modifications Committed, of Tennessee Valley Authority letter CNL-18-100, dated October 18, 2018, as supplemented by letter CNL-19-027, dated February 13, 2019.

(18) Maximum Extended Load Line Limit Analysis Plus (MELLLA+) Special Consideration The licensee shall not operate the facility within the MELLLA+ operating domain with more than a 10F reduction in feedwater temperature below the design feedwater temperature.

(19) Maximum Extended Load Line Limit Analysis Plus (MELLLA+)

Implementation Prior to the first implementation of MELLLA+, TVA shall perform reload safety analysis using codes that have been corrected for the errors described in TVA letter CNL-19-125, dated December 19, 2019.

(20) Adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Plants (1) TVA is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using:

Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, and a screening of other external hazards updated using BFN-UNIT 3 Renewed License No. DPR-68 Amendment ___

-6g-the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; and internal fires and seismic hazards are evaluated with BFN specific PRA models, as specified in License Amendment No. [XXX].

(2) TVA shall complete the numbered items listed in Attachment 1, List of Categorization Prerequisites, of TVA letter [ML Number], dated

[DATE], prior to implementation. All issues identified in the attachment will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2),

and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

(3) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a shutdown defense-in-depth approach to a shutdown probabilistic risk assessment approach).

D. The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21(d),

shall be included in the next scheduled update to the UFSAR required by 10 CFR 50.71(e)(4) following the issuance of this renewed operating license.

Until that update is complete, TVA may make changes to the programs and activities described in the supplement without prior Commission approval, provided that TVA evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

E. The UFSAR supplement, as revised, describes certain future activities to be completed prior to the period of extended operation. TVA shall complete these activities no later than July 2, 2016, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

F. All capsules in the reactor vessel that are removed and tested must meet the test procedures and reporting requirements of the most recent NRC-approved version of the Boiling Water Reactor Vessels and Internals Project (BWRVIP)

Integrated Surveillance Program (ISP) appropriate for the configuration of the BFN-UNIT 3 Renewed License No. DPR-68 Amendment ___