CNL-20-044, License Amendment Request to Incorporate Tornado Missile Risk Evaluation Into the Licensing Basis

License Amendment Request to Incorporate Tornado Missile Risk Evaluation Into the Licensing Basis

ML20127H904
Person / Time
Site:	Browns Ferry
Issue date:	05/06/2020
From:	Jim Barstow Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CNL-20-044
Download: ML20127H904 (80)

Text

Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-20-044 May 6, 2020 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296

Subject:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis

Reference:

Nuclear Energy Institute Letter to NRC, Submittal of NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, dated September 21, 2017 (ML17268A023).

Pursuant to 10 CFR 50.90, Tennessee Valley Authority (TVA), hereby submits a License Amendment Request (LAR) for the Browns Ferry Nuclear Plant, Units 1, 2, and 3 (BFN), to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the BFN Updated Final Safety Analysis Report (UFSAR). The Reference letter transmitted the TMRE methodology to the NRC and is incorporated by reference into this LAR. TMRE is proposed as a methodology for complying with licensing basis requirements for tornado missile protection requirements, and TVA has concluded that prior NRC approval is required to adopt the use of the TMRE methodology at BFN. Included is the analysis supporting the conclusion that the licensing action involves a no significant hazards consideration determination. provides a description and assessment of the proposed change. Enclosure 2 provides a proposed markup of the Updated Final Safety Analysis Report with regard to this change. Enclosure 3 provides a description of the technical adequacy of TVAs probabilistic risk analysis.

TVA requests NRC approval of this License Amendment Request within 1 year of the date of this letter.

U.S. Nuclear Regulatory Commission CNL-20-044 Page 2 May 6, 2020 There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Kimberly D. Hulvey, Senior Manager, Fleet Licensing at 423-751-3275.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 6th day of May 2020.

Respectfully, James Barstow Vice President, Nuclear Regulatory Affairs and Support Services

Enclosures:

1. Evaluation of Proposed Change

2. UFSAR Marked Up Pages

3. PRA Technical Adequacy cc (Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant State Health Officer, Alabama Department of Public Health

Enclosure 1 Evaluation of Proposed Change

ENCLOSURE 1 Evaluation of the Proposed Change

Subject:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis TABLE OF CONTENTS TABLE OF CONTENTS ................................................................................................................ 1

1.

SUMMARY

DESCRIPTION ................................................................................................... 3

2. DETAILED DESCRIPTION .................................................................................................... 3 2.1. Background Information .................................................................................................. 3 2.2. Current Licensing Basis .................................................................................................. 4 2.3. Reason for the Proposed Change .................................................................................. 5 2.4. Description of the Proposed Change .............................................................................. 7

3. TECHNICAL EVALUATION ................................................................................................... 7 3.1. Tornado Missile Risk Evaluator Methodology ................................................................. 7 3.2. Traditional Engineering Considerations .......................................................................... 8 3.3. Risk Assessment .......................................................................................................... 11 3.3.1. High Winds Equipment List .............................................................................. 11 3.3.2. Target Walkdowns ........................................................................................... 12 3.3.3. Missile Walkdowns........................................................................................... 12 3.3.4. Tornado Hazard Frequency ............................................................................. 13 3.3.5. Target Evaluation ............................................................................................. 13 3.3.6. Model Development ......................................................................................... 17 3.3.7. Model Quantification ........................................................................................ 17 3.3.8. Results ............................................................................................................. 17 3.3.9. Sensitivities and Uncertainties ......................................................................... 18 3.3.10. Conclusions ..................................................................................................... 18 3.4. Technical Evaluation Conclusions ................................................................................ 18

4. REGULATORY EVALUATION ............................................................................................ 18 4.1. Applicable Regulatory Requirements/Criteria ............................................................... 18 CNL-20-044 E1-1 of 23

4.2. Precedents .................................................................................................................... 21 4.3. No Significant Hazards Consideration Analysis ............................................................ 21 4.4. Conclusions .................................................................................................................. 23

5. ENVIRONMENTAL CONSIDERATION ............................................................................... 23

6. REFERENCES .................................................................................................................... 23 CNL-20-044 E1-2 of 23

1.

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Tennessee Valley Authority (TVA), hereby submits a License Amendment Request (LAR) for the Browns Ferry Nuclear Plant (BFN), to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the BFN Updated Final Safety Analysis Report (UFSAR). The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute (NEI) as NEI 17-02, Revision 1 (Reference 6.1), and is incorporated by reference into this LAR. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

2. DETAILED DESCRIPTION 2.1. Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (Reference 6.2). The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed. The specific criteria for each nuclear power plant are contained in the individual plants specific licensing basis.

In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection. Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles. Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS methodology. The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile and was accepted for use by the NRC. In cases where some components were not in conformance with a plants licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required. Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis.

Nuclear Energy Institute (NEI) developed another risk-informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was CNL-20-044 E1-3 of 23

not provided and cannot be used to avoid providing tornado missile protection in the plant modification process.

2.2. Current Licensing Basis On July 7, 1966, TVA filed an application for permits to construct Browns Ferry Nuclear Plant Units 1 and 2. A review of this application was made by the Atomic Energy Commission (AEC)s regulatory staff and by the Advisory Committee on Reactor Safeguards (ACRS). Both concluded that the facility could be constructed without undue risk to the health and safety of the public. On May 10, 1967, Construction Permit Nos. CPPR-29 and CPPR-30 were issued for Units 1 and 2 respectively. Construction was started on May 17, 1967. After a similar review Construction Permit No. CPR-48 was issued for Unit 3 on July 31, 1968. Construction for Unit 3 began on August 1, 1968. TVAs Final Safety Analysis Report and a request for an operating license for all three units were submitted to the AEC on September 25, 1970, as Amendment 9 to the application. The Operating License was issued for Unit 1 on December 20, 1973, Unit 2 on June 28, 1974, and Unit 3 on July 2, 1976.

General Design Criteria During the construction permit licensing process, each of the three BFN units were evaluated against the then-current draft of the AEC Proposed General Design Criteria. Units 1 and 2 were evaluated against the 27 Criteria, while Unit 3 was evaluated against the 70 Criteria. Although neither version of these proposed criteria had been adopted as regulatory requirements, the design, material procurement, and fabrication of each reactor unit was responsive to the respective applicable criteria for a construction permit. Although the later criteria (AEC-70) did not wholly complement the earlier (AEC-27), and also contained many aspects which could have been modified or clarified before their formal adoption, the design bases of each unit of BFN were reevaluated (at the time of initial FSAR preparation) against the draft of the 70 criteria current at the time of operating license application.

Based on the understanding of the intent of the proposed criteria current at the time of operating license application, it was concluded that each unit of this plant conforms with the intent of the AEC General Design Criteria for Nuclear Power Plant Construction Permits.

Updated Final Safety Analysis Report (UFSAR)

The BFN current licensing basis (CLB) is documented in the BFN UFSAR and was established prior to the finalization of the General Design Criteria (GDC) and formal regulatory endorsed guidance such as Regulatory Guide 1.117, Tornado Design Classification (Reference 6.3).

The licensing basis was established and documented through meetings and correspondence with the Atomic Energy Commission.

The BFN CLB for tornados and tornado missiles pertinent to the RIS 2015-06 assessment are described in the BFN UFSAR, Sections 1.6, 1.7, 2.3, 5.2, 5.3, 9.3, 10.9, 10.23, 11.6, 12.1, 12.2, Appendix C, Appendix F, and Appendix I (Reference 6.4).

CLB for Tornado Protection Design As discussed in UFSAR Section 12.2 the design basis tornado has a tangential velocity of 300 miles per hour (mph) combined with a differential pressure of 3 pounds per square inch (psi) at a rate of 0.6 psi per second. Other than the enclosure over the spent fuel pool, a portion of the gaseous radwaste system stack and the Onsite Storage Facility (OSF) also known CNL-20-044 E1-4 of 23

as the Low Level Radioactive Waste Storage Facility (LLRWSF), BFN Class 1 structures (reactor building, diesel generator buildings, pumping station structure, offgas treatment building, and control bay) were designed in accordance with the described wind loads. Venting has been credited as applicable based on building designs. The enclosure over the spent fuel pool was not designed for tornado loads. The 600-foot gaseous radwaste system stack is designed for controlled failure if it should be damaged by a violent tornado. The upper portion is designed to fail first to limit the reach of the stack if it should be blown down. It would not strike the Diesel Generator or Reactor Building. The wind loads for the Onsite Storage Facility is 290 mph rotational at 150 feet and 70 mph translational.

CLB for Tornado Missile Protection Design Per UFSAR Section 10.9, 12.2 and Appendix I, the walls of the Reactor Building and Class 1 structures except the Intake Pumping Station were designed for the following CLB tornado missiles travelling 300 mph at impact.

2 inch x 4 inch x 12 foot board weighing 40 pounds/cu. Ft. end on crosstie, 7 inches x 9 inches x 8-1/2 feet weighting 50 pounds/ cu. Ft. end on compact car weighing 1800 pounds with an impact area of 20 square feet pieces of concrete 6-1/2 inches x 12 inches x 2 inches thick end on, as a result of the spalling effect from the concrete chimney postulated failure aircraft warning beacon from chimney The Diesel generator Building Doors were designed for the following CLB tornado missiles travelling 100 mph at impact.

100 pounds with circular impact area of 4-inch diameter 10 foot length of 2-inch std pipe impacting endwise 10 foot length of 1/2-inch std pipe impacting endwise The spent fuel pool credits GE APED-5696 (Reference 6.5) for tornado missile impact analysis.

The RHR service water pumps are deck-mounted on the intake structure in an accessible location so that maintenance may be performed under emergency conditions. The pumps are designed to operate in severe wind and weather such as during tornadoes. The Residual Heat Removal Service Water (RHRSW) pumps are widely dispersed and physically separated into groups of three on the intake deck to prevent common damage from one or more missiles.

2.3. Reason for the Proposed Change In response to RIS 2015-06, TVA performed design reviews and walkdowns at BFN to identify potential discrepancies with the BFN CLB related to tornado missile protection. Those walkdowns identified conditions where the plant configuration did not conform to the design and licensing bases. The non-conforming conditions were entered into the corrective action program and are summarized below.

CNL-20-044 E1-5 of 23

Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002, Enforcement Discretion for Tornado-generated Missile Protection Non-Compliance, (Reference 6.6) and DSS-ISG-2016-01 (Reference 6.7), with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status. The compensatory actions will remain in effect until the SSCs have been restored to full qualification.

As documented by the NRC in EGM 15-002, in general, tornado missile scenarios do not represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados.

The staffs study established that the Core Damage Frequency (CDF) associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

The non-conforming condition, and affected systems, identified by TVA during the design reviews and walk downs were documented in the following two Condition Reports (CRs) within the corrective action program.

a. CR 1288222: Emergency Diesel Generator Fuel Oil Vent Lines - Tornado Missile Strike During walk downs, portions of the Fuel Oil System located on the Diesel Generator Building roof were found to be susceptible to tornado-generated missile impacts. The fuel oil vent lines for the D, 3A, 3B, 3C and 3D Emergency Diesel Generators (EDGs) are exposed to the effects of a tornado generated missile. Damage to the exposed and unprotected portion of the D, 3A, 3B, 3C, and 3D EDG fuel oil vent lines by a tornado missile strike has the potential to crimp the vent line and render the vacuum prevention feature ineffective. The development of a vacuum in the fuel oil system would limit the ability of the fuel oil pumps to transfer fuel oil from the seven day tank to the day tank and restrict or eliminate the flow of fuel oil to the affected EDG. The affected EDG would then not be able to function due to lack of fuel oil.

b. CR 1306987: BFN-3-DOOR-260-0484 - Tornado Missile Vulnerability During walk downs, design basis and licensing basis reviews it was determined that BFN-3-DOOR-260-0484 (Door 484) is a standard commercial grade double leaf door that is not rated to withstand the impact of a tornado generated missile. There are numerous safety related electrical conduits, safety related Control Bay Chiller piping and other safety related and non-safety related mechanical and electrical features located in the 1C hallway.

The condition was discovered when an engineering evaluation of TMP determined that IPEEE results for Door 484 could not be credited as meeting regulatory requirements to be considered within the CLB.

Plant modifications to restore compliance with the CLB would have very limited safety benefit, but would require extensive resources and would divert those resources from more safety significant activities. Adoption of the TMRE methodology would revise the BFN CLB to restore the non-conforming conditions relative to tornado missile hazard. TVA has concluded that this change requires prior NRC review and approval, per 10 CFR 50.90. Utilization of risk insights to the allocation of NRC staff and industry resources is consistent with the NRC policy.

CNL-20-044 E1-6 of 23

2.4. Description of the Proposed Change TVA requests NRC approval to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the BFN UFSAR. The proposed change:

Revises the BFN UFSAR Section 12.2.8, Diesel Generator Building Units 1 and 2 (Class I) to document the use of the TMRE methodology to address tornado missile protection for the D, 3A, 3B, 3C, and 3D diesel generator fuel oil vent lines where they extend through the roof and do not have physical protection from potential tornado missiles. This LAR proposes to add a methodology to the BFN UFSAR, TMRE, to describe a method to determine whether protection from tornado-generated missiles is required.

Revises Appendix F section F.7.2, Control Bay, to document the use of the TMRE methodology to address tornado missile protection for Door 484. Control Bay Door 484 is an external door along the east side of the elevation 593 hallway. This LAR proposes to add a methodology to the BFN UFSAR, TMRE, to describe a method to determine whether protection from tornado-generated missiles is required.

The Nuclear Energy Institute (NEI) developed the Tornado Missile Risk Evaluator (TMRE) risk-informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed BFN UFSAR markups are provided in Enclosure 2. The TMRE methodology was transmitted to the NRC by NEI as NEI 17-02, Revision 1, on September 21, 2017, and is hereby incorporated by reference into this LAR.

3. TECHNICAL EVALUATION 3.1. Tornado Missile Risk Evaluator Methodology The NRCs policy statement on probabilistic risk assessment (PRA) encourages greater use of the PRA technique to improve safety decision-making and improve regulatory efficiency.

One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis (Reference 6.8), provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments and technical specification changes under 10 CFR50.90. TMRE is proposed as a PRA-based methodology for evaluating the risk impact of existing conditions where tornado missile protection is required in a licensees CLB, but the required protection was not provided. For conditions that meet the acceptance criteria, the BFN licensing basis would be revised.

TMRE is proposed as an alternative methodology for identifying whether certain SSCs must be protected from the effects of tornado missiles. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

CNL-20-044 E1-7 of 23

The TMRE methodology employs a simplified, conservative assessment of risks to core damage and large early release posed by tornado-generated missiles at nuclear plants. The guidance for use of the methodology is found in NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Rev. 1, which is incorporated by reference into this LAR. The guidance document provides a detailed approach to gathering the necessary information and translating the information into a PRA model. The risk assessment methods and acceptance criteria of the NRC RG 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

3.2. Traditional Engineering Considerations Two of the five key principles of risk-informed decision-making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins.

Those two considerations are discussed below with respect to the proposed change to the BFN licensing basis. The remaining principles will be discussed in section 4 of this LAR.

The proposed change is consistent with a defense-in-depth philosophy.

The proposed change is consistent with a defense-in-depth philosophy. Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

No new accidents or transients are introduced with the proposed change, and the facility is still well protected from tornado missiles.

The proposed change does not significantly impact the availability and reliability of SSCs that provide safety functions that prevent challenges from progressing to core damage.

The magnitude of the change is consistent with the guidance of Regulatory Guide 1.174.

None of the non-conforming conditions in the TMRE model only affect Large Early Release Frequency (LERF), which is an indication that there was no significant impact on prevention of containment failure.

The change does not significantly reduce the effectiveness of the emergency preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

Implementation of the proposed change does not require compensatory measures. The risk assessment associated with this LAR gave no credit to compensatory measures implemented in response to the non-conforming conditions.

No plant operating procedures will be changed to implement the proposed change.

CNL-20-044 E1-8 of 23

The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

The proposed change does not modify the redundancy, independence, or diversity described in the BFN UFSAR. The proposed change does not result in a disproportionate increase in risk.

The BFN UFSAR documents a tornado strike frequency of 1,433 years, which is an infrequent event, and which is unchanged by this LAR.

The proposed change has no impact on the assumptions in the BFN safety analyses presented in the UFSAR, Chapters 6 or 14.

The proposed change has no impact on the availability or reliability of SSCs that could either initiate or mitigate events, with the exception of tornado missile protection, which is thoroughly evaluated in this LAR.

Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile.

Critical equipment is stored in structures that would prevent it from being impacted by a tornado or tornado missile.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

The non-conforming conditions are physically distributed on the BFN site, so there is a low likelihood of multiple SSCs being impacted.

Independence of barriers is not degraded.

Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles, and the containment remains a robust tornado missile barrier.

The proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event.

Although the proposed change does slightly increase the frequency of core damage, that increase is very small and has no significant impact on the fission product barriers.

Defenses against human errors are preserved.

BFN has symptom-based abnormal operating procedures and emergency operating procedures that would be utilized in the event of a tornado adversely impacting safety- related equipment. The procedures provide guidance to operators for preservation of critical safety functions. The procedures include guidance in the event response not obtained, which provide alternative actions if equipment was damaged by tornadoes or other reasons.

CNL-20-044 E1-9 of 23

Implementation of the proposed change will not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado.

BFN has a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes post-tornado walkdowns for tornado missile vulnerable SSCs. It includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs.

Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserves the defense against human errors.

The intent of the plants design criteria is maintained.

This LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain not protected from tornado missiles. All other aspects of the plant design criteria are unaffected.

This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety.

The methodology cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the intent of the plants design criteria is maintained.

Protection of the identified SSCs would have assured they would not be damaged by design basis tornado missiles. In lieu of protection for the identified nonconforming SSCs, BFN has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and it is negligible. Therefore, the intent of the plants design criteria is maintained.

The proposed change maintains sufficient safety margins.

The vast majority of each system important to safety remains protected from tornado missiles, consistent with the CLB. The identified vulnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains both being impacted by tornado missiles is much lower than the likelihood of one train being impacted. The TMRE methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation. The number of potential missiles identified at BFN is less than the number of missiles assumed by the TMRE methodology. BFN has diverse and flexible coping strategies to restore critical safety functions in the event of a hypothetical loss of the primary functions. In some cases, non-safety related equipment could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment.

CNL-20-044 E1-10 of 23

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE), or alternatives approved by the NRC) continue to be met. The proposed change is not in conflict with approved codes and standards relevant to the SSCs.

The safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change. The requirements credited in the accident analyses will remain the same.

Therefore, the proposed change maintains sufficient safety margins and continues to protect public health and safety.

3.3. Risk Assessment The TMRE methodology is used to estimate the quantitative risk associated with tornado-generated missiles associated with discrepancies with the BFN CLB related to tornado missile protection. It makes use of the BFN internal events PRA model, which was used to estimate the risk associated with the passage of a tornado over the BFN site.

The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific SSC (target) will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strikes on the core damage and large early release frequencies.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the number of potential missiles and the size and location of the target SSC being evaluated. The site-specific frequency of a tornado striking the BFN site is also used in the TMRE.

The outcome of the probabilistic element is an estimation of an increase in CDF and LERF associated with not protecting certain SSCs from tornado missiles.

3.3.1. High Winds Equipment List The High Winds Equipment List (HWEL) was developed using NEI 17-02. The HWEL identifies potential vulnerable components that needed to be walked down. The following was considered in the update of the HWEL.

The non-conformance items were added to the list.

Items screened based on being in Category I structures were reviewed for the presence of potential missile paths.

The TMRE model uses the loss of offsite power (LOOP) sequences with no offsite power recovery, therefore PRA logic and components that do not support mitigating a LOOP can be screened.

Operator actions were assessed based on the TMRE Methodology. Internal events PRA data were used to perform the assessment of the operator actions. An engineering review was performed for the TMRE operator action assessment. All operator actions were reviewed for their location and timing. Operator actions that occur outside the main control room (MCR) and CNL-20-044 E1-11 of 23

have a less than 1-hour completion time were failed in both the compliant and degraded TMRE models.

3.3.2. Target Walkdowns The walkdowns considered the following:

1. Locate and identify the SSC; verify that the SSC is located where it is documented to be.

Note any support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers.

2. Document and describe barriers that could prevent or limit exposure of the SSC to tornado missiles; photograph any barriers that could prevent tornado missiles from impacting the SSC. This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

3. Identify directions from which tornado missiles could strike the target.

4. Determine and/or verify the dimensions of the target SSCs, including any subcomponents or support systems. Missile exposure area can be limited when missiles are blocked by barriers.

5. Determine the proximity and potential correlation to other target SSCs. For the purpose of the TMRE, correlated targets are SSCs that can be struck by the same tornado missile.

6. Note any nearby large inventories of potential tornado missiles.

7. Proximity of non-Category I structures to exposed target SSCs should be documented.

A non-Category I structure may collapse or tip-over and cause damage to an SSC.

8. Identify vent paths for tanks that may be exposed to atmospheric pressure changes.

3.3.3. Missile Walkdowns Missiles were estimated in a 2,500-foot radius around the center of the reactor building.

Structural and non-structural missiles are considered. The estimated missiles based within the 2,500 ft radius is summarized in the following table with a total missile estimate of 161,374.

This missile count is bounded by and justifies the use of the generic missile count from the TMRE guidance which is 240,000.

BFN Total Missile Estimate Buildings Inside Buildings Outside Cars Trees Protected Area Protected Area 52,782 37,771 2,001 68,820 Overall Total 161,374 CNL-20-044 E1-12 of 23

3.3.4. Tornado Hazard Frequency The guidance in NEI 17-02, Revision 1, and data in NUREG/CR-4461, Revision 2, were used to determine the tornado initiating event frequencies for the BFN TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort.

NUREG/CR-4461 provides tornado strike data for BFN with wind speeds associated with varying frequencies per year. For the purposes of the TMRE, the Fujita prime scale (F) is used to classify tornadoes; this scale is somewhat different from the original Fujita Scale and the Enhanced Fujita Scale. Using this data, a site-specific tornado hazard curve was developed, and the frequency of all tornadoes considered in the TMRE (F2 through F6) was calculated.

Because F probabilities are not directly available, they are derived from site specific Fujita scale data available in Table 6-1 of NUREG/CR-4461.

By solving the trend line equation for the tornado initiating event frequency, exceedance frequencies for the upper ranges of each F category, F2 through F6, were calculated and are listed in the following table. These frequencies were used for the new tornado initiators in the TMRE.

TMRE Tornado Initiators Exceedance F Category mph mph + 35.667 / -21.06 ex (frequency/yr)

Frequency F2 135 170.667 -8.104 3.02E-04 1.08E-03 F3 168 203.667 -9.671 6.31E-05 2.39E-04 F4 209 244.667 -11.618 9.01E-06 5.41E-05 F5 277 312.667 -14.846 3.57E-07 8.65E-06 F6 300 335.667 -15.939 1.20E-07 3.57E-07 3.3.5. Target Evaluation The EEFPs are calculated for each SSC vulnerable to a missile strike. Each SSC will have a separate EEFP for tornado category F2 through F6. How to calculate the EEFP is shown below and the specific EEFP results are shown in Section 4 for each SSC.

EEFP is defined as:

EEFP = (MIP) x (# of Missiles) x (Target Exposed Area) x (Fragility)

where, MIP - Missile Impact Probability per missile, per exposed target area, per tornado intensity, and exposed target height. Values from Table 5-1 in NEI 17-02.

1. of Missiles - number of damaging missiles, using the generic distribution from NEI 17-02 Table 5-1.

Target Exposed Area - SSC area determined using documentation or walkdowns, calculated for each specific SSC.

Fragility - For the purposes of the TMRE, it is assumed to be 1.0 (i.e., always failed if hit by a tornado missile).

CNL-20-044 E1-13 of 23

The Unit 3 diesel generator (DG) fuel oil vent stacks were declared a non-conforming condition due to their vulnerability to crimping from a missile hit. The EEFP was calculated for the vent stacks using the methods described in NEI 17-02. All four stacks are located on the roof of the DG building at elevation 595, which is 30 ft above plant grade (EL 565). DGs 3A and 3B stacks are approximately 5 ft apart, and DGs 3C and 3D are approximately 8 ft apart. Conservatively, the 3A and 3B were correlated.

The table below shows the calculated EEFPs for the Unit 3 DGs. The Missile Impact Parameter (MIP) for targets greater than 30 ft above grade was used due to the fuel oil vent stacks being on the DG building roof. From Table 5-2 in NEI 17-02, Category F was used for the missile inventory impacts for a pipe less than 10 inches in diameter.

DGs 3A and 3B Calculated EEFP Area = 40 ft2 Category F Missiles = 50%

F Category MIP # Missiles EEFP F2 5.80E-11 155,000 2.88E-04 F3 2.00E-10 155,000 9.92E-04 F4 3.40E-10 205,000 2.23E-03 F5 8.70E-10 240,000 6.68E-03 F6 1.30E-09 240,000 9.98E-03 DGs 3C and 3D Calculated EEFP Area = 6.4 ft2 Category F Missiles = 50%

F Category MIP # Missiles EEFP F2 5.80E-11 155,000 1.80E-04 F3 2.00E-10 155,000 6.20E-04 F4 3.40E-10 205,000 1.39E-03 F5 8.70E-10 240,000 4.18E-03 F6 1.30E-09 240,000 6.24E-03 The Unit 0 D DG fuel oil vent stack was declared a non-conforming condition due to its vulnerability to crimping from a missile hit. The EEFP was calculated for the vent stack using the methods described in NEI 17-02. The stack is located on the roof of the DG building at elevation 595 ft, which is 30 ft above plant grade (EL 565). The stack is roughly 75% shielded by category 1 structures; therefore, the total area is multiplied by 25%.

The following table shows the calculated EEFP for the Unit 0 DG. The MIP for targets greater than 30 ft above grade was used due to the fuel oil vent stacks being on the DG building roof.

From Table 5-2 in NEI 17-02, Category F was used for the missile inventory impacts for a pipe less than 10 inches in diameter.

CNL-20-044 E1-14 of 23

DG D Calculated EEFP Area = 1.595 ft2 Category F Missiles = 50%

F Category MIP # Missiles EEFP F2 5.80E-11 155,000 7.17E-06 F3 2.00E-10 155,000 2.47E-05 F4 3.40E-10 205,000 5.56E-05 F5 8.70E-10 240,000 1.67E-04 F6 1.30E-09 240,000 2.49E-04 The door 484 at the Unit 3 end of the EL 593 Control Building 1C hallway was declared a non-conforming condition due to its vulnerability to tornado missiles impacting various cabling and conduits. The EEFP was calculated for the door 484 vulnerability using the methods described in NEI 17-02.

The table below shows the calculated EEFPs for the door 484. The MIP for targets less than 30 ft above grade was used due to the bottom of the door not being 30 ft above grade. This is conservative considering majority of the door is greater than 30 ft above grade. From Table 5-2 in NEI 17-02, Category J was used for non-robust target.

Door 484 Calculated EEFP Area = 42 ft2 Category J Missiles = 100%

F Category MIP # Missiles EEFP F2 1.10E-10 155,000 9.11E-04 F3 3.60E-10 155,000 2.99E-03 F4 6.30E-10 205,000 6.80E-03 F5 1.60E-09 240,000 2.02E-02 F6 2.40E-09 240,000 3.12E-02 When applying TMRE, any walls that are less than 18 inches thick or roofs that are less than 12 inches thick are considered susceptible to missile penetration. Therefore, any walls that are less than 18 inches thick or roofs that are less than 12 inches thick need to be identified and dispositioned per TMRE guidelines.

The walls in the Unit 3 DG exhaust fan rooms are 18 inches thick. Missile effects are not incorporated into the model, due to the Unit 3 DGs already being affected by missiles hitting the fuel oil vent stacks. Also, as stated in the BFN UFSAR; The north, south and east walls of the Unit 3 mechanical equipment room above EL 597.6 are not included because even if there is a loss of air conditioning equipment due to tornado missiles, acceptable temperatures can be maintained in the 4kV shutdown board rooms 3KA, B, C and D and the bus tie board room CNL-20-044 E1-15 of 23

for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Beyond that time, Plant Procedures (0-AOI-100-7 and 0-OI-31) will be followed.

This statement also supports not accounting for missile strikes through these walls. The PRA uses a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> normally, so if acceptable temperatures can be maintained for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, that is well beyond the mission time of the PRA. No changes were made to the PRA model under these circumstances for TMRE.

The walls along elevation 583 ft of the Unit 1/Unit 2 DG building taper from roughly 16 inches to 8 inches at elevation 595 ft. The DG air intake plenum rooms are on the other side of the wall.

The air intake plenum rooms do not contain any equipment important to the PRA; therefore, no changes were made to the PRA model under these circumstances for TMRE.

The walls around the RHRSW pumps are less than 18 inches thick. The RHRSW pumps are modeled in the internal events PRA; therefore, tornado missile effects are included in both the conforming and degraded PRA models for TMRE.

The table below shows the calculated EEFPs for the RHRSW walls. The Missile Impact Parameter (MIP) for targets less than 30 ft above grade was used due to the walls affected being on EL 572 ft. The A and D pumps have a different area because there are two walls with an 18 inch thickness (the side wall and the front wall). The B and C pumps only have one wall with an 18 inch thickness. From Table 5-2 in NEI 17-02, Category H was used for a concrete roof, reinforced, at least 8 inches thick.

RHRSW Wall - A and D Pumps Calculated EEFP Area = 705.5 ft2 Category H Missiles = 1%

F Category MIP # Missiles EEFP F2 1.10E-10 155,000 1.53E-04 F3 3.60E-10 155,000 5.03E-04 F4 6.30E-10 205,000 1.14E-03 F5 1.60E-09 240,000 3.39E-03 F6 2.40E-09 240,000 5.25E-03 RHRSW Wall - B and C Pumps Calculated EEFP Area = 413 ft2 Category H Missiles = 1%

F Category MIP # Missiles EEFP F2 1.10E-10 155,000 8.96E-05 F3 3.60E-10 155,000 2.94E-04 F4 6.30E-10 205,000 6.69E-04 F5 1.60E-09 240,000 1.98E-03 F6 2.40E-09 240,000 3.07E-03 CNL-20-044 E1-16 of 23

3.3.6. Model Development The BFN TMRE model makes use of the BFN internal events Probabilistic Risk Assessment (PRA) model, modified to include an estimate of the risk associated with the passage of a tornado over the BFN site. The TMRE methodology as described in NEI 17-02 was used for the development of the BFN TMRE model.

BFN original peer reviews were held in 2009 on internal events and internal flooding. This review resulted in a total 125 Findings and Observations (F&Os) for the three unit model for both internal events and internal flooding. All findings from these assessments have been dispositioned. A closure review was held in June 2018 for the remaining open F&Os. After the closure review, ten Internal Events F&Os were considered open and will be incorporated in the next model revisions. A focus scope peer review was held in June 2018 for the Internal Flooding model. Only seven F&Os are considered open and will be incorporated in the next model revisions. Revision 8 of the BFN PRA model incorporated all the changes for the closed F&Os and TVA has concluded that the 17 open F&Os do not impact the results of the risk evaluation. The PRA model is technically sound and is Regulatory Guide 1.200 compliant.

De minimis criteria is not utilized in the development of the PRA TMRE model.

3.3.7. Model Quantification Both the conforming and the degraded models were run at a truncation level of 1E-12 for CDF and 1E-13 for LERF.

3.3.8. Results The following table shows the CDF and LERF results for both the compliant and degraded TMRE models.

CDF and LERF Results Compliant model Degraded model Delta ()

U1 CDF 4.270E-06 4.272E-06 1.766E-09 U2 CDF 3.330E-06 3.331E-06 4.931E-10 U3 CDF 6.041E-06 6.045E-06 3.310E-09 U1 LERF 8.783E-07 8.790E-07 6.470E-10 U2 LERF 7.979E-07 7.979E-07 1.256E-11 U3 LERF 8.019E-07 8.022E-07 3.806E-10 Per Regulatory Guide 1.174, the change in CDF and LERF can be considered very small (less than 1E-06 for CDF and 1E-07 for LERF).

There are unit differences that result in different CDF and LERF values. These differences are discussed in the system notebooks and the Quantification Notebook. Unit 2 results are not as affected by the degraded condition as it is not as heavily reliant on the components that would be failed by a tornado missile. Some of the differences that affect this evaluation include:

CNL-20-044 E1-17 of 23

Battery Board 1 impacts control power for the 4KV shutdown board 3EA. The 4KV shutdown board 3EA impacts primarily Unit 3 components with a minor impact on Unit 1 components as well. Unit 2 uses other boards and is not as heavily reliant on battery board 1 or 4KV shutdown board 3EA.

A tornado missile can affect the 480V Diesel Auxiliary Board 3EA. Because the 480V Diesel Auxiliary Boards for Unit 1 and Unit 2 are not affected by a tornado missile, the risk associated with Unit 3 is higher.

The HPCI Discharge Valve 2-FCV-073-0034 affects Unit 2 but because of the low frequency of occurrence of a tornado and the low probability of the valve being impacted by a missile, the impact is small.

3.3.9. Sensitivities and Uncertainties The CDF and LERF for Units 1, 2 and 3 are all below the 1E-07 and 1E-08 thresholds per NEI 17-02. Therefore, no sensitivities were required.

3.3.10. Conclusions The TMRE guidance provided in NEI 17-02 was followed without exception and no deviations were applied.

The total change in risk associated with tornado missile damage to non-conforming conditions identified results in a risk increase of 1.766E-09 (Unit 1), 4.931E-10 (Unit 2) and 3.310E-09 (Unit 3) per year CDF and 6.470E-10 (Unit 1), 1.256E-11 (Unit 2), and 3.806E-10 (Unit 3) per year LERF. The tornado risk changes for accepting BFN non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

3.4. Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at BFN for certain SSCs that are not fully protected from the effects of tornado missiles. The proposed change would revise the UFSAR to make TMRE part of the BFN licensing basis for conformance to tornado missile protection requirements. Future discovery of existing tornado missile protection non-conforming conditions will continue to be evaluated using the corrective action program.

The TMRE Methodology could be used to resolve those non-conforming conditions by revising the CLB under 10 CFR 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met.

Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE Methodology. The TMRE Guidance, provided in NEI 17-02, Revision 1, was followed without exception and no deviations were applied.

4. REGULATORY EVALUATION 4.1. Applicable Regulatory Requirements/Criteria During the construction permit licensing process, each of the three units of this plant were evaluated against the then-current draft of the AEC Proposed General Design Criteria. Units 1 and 2 were evaluated against the 27 Criteria, while Unit 3 was evaluated against the 70 Criteria.

Although neither version of these proposed criteria had been adopted as regulatory requirements, the design, material procurement, and fabrication of each reactor unit was CNL-20-044 E1-18 of 23

responsive to the respective applicable criteria for a construction permit. Although the later criteria (AEC-70) did not wholly complement the earlier (AEC-27), and also contained many aspects which could have been modified or clarified before their formal adoption, the design bases of each unit of this plant were reevaluated (at the time of initial FSAR preparation) against the draft of the 70 criteria current at the time of operating license application.

Based on the understanding of the intent of the proposed criteria current at the time of operating license application, it was concluded that each unit of this plant conforms with the intent of the AEC General Design Criteria for Nuclear Power Plant Construction Permits.

The NRCs current requirements that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated missiles, so as not to adversely impact the health and safety of the public can be found in 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, Design Bases for Protection against Natural Phenomena, and GDC 4, Environmental and Dynamic Effects Design Bases.

The current BFN tornado licensing basis was established prior to the issuance of associated regulatory endorsed guidance such as Regulatory Guide 1.117, Tornado Design Classification, which was originally issued June 1976. The regulatory endorsed guidance that has been issued subsequent to the issuance of the BFN operating licenses fall within the NRC backfit rule. BFN has not voluntarily committed to comply with the regulatory endorsed guidance that has been issued subsequent to the issuance of the BFN operating licenses. The BFN licensing basis already includes the use of probabilistic analysis to address some specific SSCs that do not have physical protection from the effects of tornadoes.

This LAR utilizes a risk-informed change process consistent with the guidelines of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decision on Plant-Specific Changes to the Licensing Basis. As discussed in RG 1.174, in implementing risk-informed decision-making, licensing basis changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense-in-depth). While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

The proposed change continues to meet current regulations including tornado missile protection requirements. No exemptions are requested or required to implement this LAR upon approval by the NRC. Standard Review Plan section 3.5.1.4 permits relaxation of deterministic criteria if it can be demonstrated that the frequency of damage to unprotected safety-related features is sufficiently small. Regulatory Guide1.174 establishes criteria, approved by the NRC, to quantify the sufficiently small frequency of damage. Application of the TMRE methodology to the unprotected features at BFN demonstrates that the RG 1.174 criteria are met.

2. The proposed change is consistent with a defense-in-depth philosophy. This is discussed in Section 3.2 of this enclosure.

3. The proposed change maintains sufficient safety margins. This is discussed in Section 3.2 of this enclosure.

CNL-20-044 E1-19 of 23

4. When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

The NRCs policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

RG 1.174 provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments under 10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit. RG 1.174 describes an acceptable method for the licensee and NRC staff to use in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

RG 1.174 also makes use of the NRCs Safety Goal Policy Statement. One key principle in risk-informed regulation is that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement.

The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of RG 1.174 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Application of the TMRE methodology to the unprotected features at BFN demonstrates that the RG 1.174, section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

NEI 17-02, Section 8, describes post license amendment configuration change control.

TVA Design Control programs meet 10 CFR 50 Appendix B and evaluate configuration changes affecting the plant.

The risk evaluation supporting this change was performed using the BFN Internal Events model. RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. TMRE PRA Evaluation Response BFN-0-18-007, provides documentation that the PRA evaluation is of sufficient quality to support the proposed change.

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met.

CNL-20-044 E1-20 of 23

4.2. Precedents Licensee submittals to adopt the TMRE methodology were preceded by three pilot submittals:

NRC Letter to Entergy Operations, Inc., Grand Gulf Nuclear Station, Unit 1 - Issuance of Amendment No. 220 Related to Request to Incorporate the Tornado Missile Risk Evaluator into Licensing Basis (EPID L-2019-LLA-0017), dated June 18, 2019 (ML19123A014).

NRC Letter to Duke Energy Progress, LLC, Shearon Harris Nuclear Power Plant, Unit 1

- Issuance of Amendment to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Nonconformances (EPID L-2017-LLA-0355), dated March 29, 2019 (ML18347A385).

NRC Letter to Southern Nuclear Operating Company, Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Nonconformances (EPID L-2017-LLA-0350), dated January 11, 2019 (ML18304A394).

4.3. No Significant Hazards Consideration Analysis Pursuant to 10 CFR 50.90, Tennessee Valley Authority (TVA), hereby submits a License Amendment Request (LAR) for the Browns Ferry Nuclear (BFN) Plant, Units 1, 2 and 3, to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the BFN Updated Final Safety Analysis Report (UFSAR). TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required.

TVA has evaluated whether a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1) Will operation of the facility in accordance with this proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment is to incorporate the TMRE methodology into the BFN UFSAR. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment does not involve an increase in the probability of an accident previously evaluated. The relevant accident previously evaluated is a Design Basis Tornado impacting the BFN site. The probability of a Design Basis Tornado is driven by external factors and is not affected by the proposed amendment. There are no changes required to any of the previously evaluated accidents in the UFSAR.

The proposed amendment does not involve a significant increase in the consequences of a Design Basis Tornado. TMRE is a risk-informed methodology for determining whether certain safety-related features, which are currently not protected from CNL-20-044 E1-21 of 23

tornado-generated missiles, require such protection. The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis. The TMRE calculations performed by TVA meet the acceptance criteria of RG 1.174, which therefore confirms that the proposed amendment does not involve a significant increase in the consequences of an accident previously evaluated.

2) Will operation of the facility in accordance with this proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment is to incorporate the TMRE methodology into the BFN UFSAR. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment will involve no physical changes to the existing plant, so no new malfunctions could create the possibility of a new or different kind of accident. The proposed amendment makes no changes to conditions external to the plant that could create the possibility of a new or different kind of accident. The proposed change will not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The existing Updated Final Safety Analysis Report accident analysis will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, the proposed amendment will not create the possibility of a new or different kind of accident than those previously evaluated.

3) Will operation of the facility in accordance with this proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment is to incorporate the TMRE methodology into the BFN UFSAR. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided and cannot be used to avoid providing tornado missile protection in the plant modification process.

The change does not exceed or alter any controlling numerical value for a parameter established in the UFSAR or elsewhere in the BFN licensing basis related to design basis or safety limits. The change does not impact any UFSAR Chapter 6 or 14 Safety Analyses, and those analyses remain valid. The change does not reduce diversity or redundancy as required by regulation or credited in the UFSAR. The change does not reduce defense-in-depth as described in the UFSAR.

CNL-20-044 E1-22 of 23

Therefore, the changes associated with this license amendment request do not involve a significant reduction in the margin of safety.

4.4. Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES 6.1 NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Rev. 1, September 21, 2017 (ADAMS Accession No. ML17268A036).

6.2 Regulatory Issue Summary 2015-06, Tornado Missile Protection (RIS), on June 10, 2015 (ADAMS Accession No. ML15020A419).

6.3 Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978.

6.4 Browns Ferry Nuclear Plant, Updated Final Safety Analysis Report through Amendment 26.

6.5 General Electric Report APED-5695, Tornado Protection for the Spent Fuel Storage Pool, November 1968.

6.6 Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado Missile Protection Noncompliance (ADAMS Accession No. ML15111A269).

6.7 Interim Staff Guidance DSS-ISG-2016-01, Revision 1, Clarification of Licensee Actions in Receipt of Enforcement Discretion per Enforcement Guidance Memorandum EGM 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance.

6.8 Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis, Revision 2, May 2011.

6.9 NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Revision 2, July 1981.

CNL-20-044 E1-23 of 23

Enclosure 2 UFSAR Marked Up Pages

The concrete walls are capable of resisting the spectrum of postulated tornado-generated missiles as described in paragraph 12.2.2.9.2 except for walls less than 18-inches thick above El. 583.5'. A probabilistic analysis of these walls and the Diesel Generator Exhaust Stacks shows that the frequency of occurrence of tornado-generated missile strike is less than or equal to 1.0 x 10-7 per year which meets the NUREG-0800 U.S. NRC Standard Review Plan acceptance criteria of 1.0 x 10-7 per year. The analysis demonstrated that tornado-generated missile strikes are not credible events. These conclusions have been documented in the closure of CAQR BFP890327.

Several walls less than 18-inches thick are not included in the probability calculation. The east side of the units 1 and 2 and the west side of unit 3 air intake and exhaust plenum are not considered as probable targets of a missile hit because of protection provided by the taller reactor building.

The Unit 1 and 2 diesel generator (DG) fuel oil vent lines A, B, and C are enclosed in the Unit 1 and 2 Control Bay Chiller concrete enclosure and are shielded from potential tornado missile strikes. The Unit 1 and 2 DG fuel oil vent line D and the Unit 3 DG fuel oil vent lines 3A, 3B, 3C, and 3D extend through the roof of the DG building. The section above the roof for these 5 fuel oil vent lines does not have physical tornado missile protection. These DG fuel oil vent lines were analyzed utilizing the Tornado Missile Risk Evaluator (TMRE) Methodology in accordance with NEI 17-02, TMRE Industry Guidance Document and it was concluded the change in CDF and LERF can be considered very small. TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles and demonstrating compliance with tornado missile protection requirements if the importance to safety is sufficiently low.

Therefore, it is concluded that the integrity of system 82 and its associated components can be maintained.

12.2.8.2 Access Doors 12.2.8.2.1 Description The doors are closures for the four 8 feet high x 9 feet 6 inches wide openings and one 8 feet high x 11 feet 6 inches wide opening in the Diesel-Generator Building. The four doors provide access to the diesel generator units, and the one door provides access to the CO2 room.

Doors at the rear of rooms for the diesel generator units and the CO2 room connect to the pipe and electrical tunnel.

12.2-71 CNL-20-044 E2-1 of 2

sources to enable temporary occupancy, whereas the control bay proper is shielded for long-term occupancy.

The control bay is approximately 400 feet long and vertically is separated into three floors at elevations 617, 606, and 593 feet. The upper floor contains the normal control room complex for all three units, the middle floor contains cable spreading rooms and rooms for mechanical HVAC equipment, and the bottom floor contains rooms for electrical and instrumentation equipment. Room separation on all three floors is accomplished by masonry walls and metal doors.

The control bay has been designed to provide an environment protected from tornado missiles and differential pressures, except for door 484. Control Bay Door 484 is an external door along the east side of the elevation 593 hallway. The elevation 593 hallway contains safety related electrical and mechanical features. Control Bay Door 484 does not provide physical protection from tornado missiles. Control Bay Door 484 has been evaluated utilizing the Tornado Missile Risk Evaluator (TMRE) Methodology in accordance with NEI 17-02, TMRE Industry Guidance Document, and it was concluded the change in CDF and LERF can be considered very small. TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles and demonstrating compliance with tornado missile protection requirements if the importance to safety is sufficiently low. With respect to incidents arising from causes within the control bay which might necessitate evacuation by operators, facilities have been provided in the Reactor Building to enable operators to safely shut down all units to either the hot (MODE 3) or cold (MODE 4) shutdown condition.

F.7.3 Spent Fuel Storage Facilities The spent fuel storage facilities are shared only for Units 1 and 2, and the sharing feature is only a transfer canal which connects the two storage pools. Watertight gates are provided at each end of the transfer canal.

An incident arising from a fuel handling accident from an open reactor or from the storage pools influences the entire three-unit refueling floor. This zone of the secondary containment would be isolated and placed on the Standby Gas Treatment System. Units which might be in operation would not be directly affected by such an incident and would not necessarily have to shut down.

F.0-16 CNL-20-044 E2-2 of 2

Enclosure 3 Probabilistic Risk Assessment Technical Adequacy

Enclosure 3

1. Technical Adequacy Overview The analysis of the Browns Ferry PRA technical adequacy follows the guidance provided in Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, (Reference 1). The guidance in RG 1.200 indicates the following steps should be followed to perform this evaluation:

1) Identify the parts of the Probabilistic Risk Assessment (PRA) used to support the application.

a) SSCs, operational characteristics affected by the application and how these are implemented in the PRA model.

b) A definition of the acceptance guideline used for the application.

2) Identify the scope of risk contributors addressed by the PRA model.

a) If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3) Summarize the risk assessment methodology used to assess the risk of the application.

a) Include how the PRA model was modified to appropriately model the risk impact of the change request.

4) Demonstrate the Technical Adequacy of the PRA.

a) Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

b) Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

c) Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide. Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

d) Identify key assumptions and approximations relevant to the results used in the decision-making process.

Steps 1 through 3 are covered in the main body of this analysis. The purpose of this attachment is to address the requirements identified in Step 4 above. Each of these steps (plant changes not yet incorporated into the PRA model, relevant peer review findings, consistency with applicable PRA standards, and the identification of key assumptions) are discussed in the following sections.

The risk assessment performed for the TMRE is based on the current Level 1 and LERF PRA model, including Internal Flooding.

A discussion of the TVA model update process, model history, peer reviews performed on the Browns Ferry models, the results of those peer reviews are documented in the BFN Summary document (Reference 3).

CNL-20-044 E3-1 of 50

Enclosure 3

2. PRA Model History and Peer Review Summary This analysis uses the Browns Ferry Model of Record (MOR) Rev. 9 which represents the current as-built, as-operated plant and associated risk profile for internal events (with internal flooding) challenges. The BFN PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, common cause events, and inter-unit impacts. The PRA model quantification process is based on event tree / fault tree linking which is a well-known methodology employed throughout the industry.

3. PRA Modeling Process TVA employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all TVA nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews (Reference 12). The following information describes this approach as it applies to the TVA PRA.

3.1. PRA Maintenance and Update The TVA risk management process ensures that the applicable PRA models reflect the as-built and as-operated plants. This process is defined in the TVA probabilistic risk assessment program, which consists of a governing procedure (Reference 12) and a subordinate implementation procedure (Reference 13). The procedures delineate the responsibilities and guidelines for updating the PRA models at TVA nuclear generation sites. The overall TVA PRA program defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (for example, due to changes in the plant, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA models accurately reflect the as-built, as-operated plant, the following activities are routinely performed (Reference 12):

Design changes and procedure changes are reviewed for their impact on the PRA model.

Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every five years, or sooner if estimated cumulative impact of plant configuration changes exceed the threshold of +/-25% of CDF or LERF.

In addition to these activities, TVA risk management procedures provide the guidance for risk management maintenance activities. This guidance includes (Reference 12 and 13):

Documentation of the PRA model, PRA products, and bases documents.

The approach for controlling electronic storage of risk management products including PRA update information, PRA models, and PRA applications.

Guidelines for updating PRA models for TVA nuclear generation sites.

Procedural requirements for PRA documentation of the MOR and PRA applications.

The MOR is composed of 1) PRA computer model and supporting documentation, 2) MAAP model and supporting documentation, and 3) other Supporting Computer Evaluation Tools (for example, UNCERT, SYSIMP, EPRI HRA Calculator). The purpose of the PRA MOR is to provide a prescriptive method for quality, configuration, and documentation control. PRA applications and evaluations are referenced to a MOR and therefore the pedigree of PRA applications and evaluations is traceable and verifiable. After September 2008 all PRA CNL-20-044 E3-2 of 50

Enclosure 3 notebooks modified are converted to desirable calculations. The NEDP-2 calculation process requires calculations to be prepared and independently checked and approved. NEDP-2 states Verification is required for calculations associated with the safety-related and quality-related NPG structures, systems, components and equipment, and others in accordance with the requirements of NEDP-5, Design Document Reviews. Verification is not typically required for Study Calculations, which are generally the type of calculations performed to support the PRA.

NEDP-26 also specifies the requirements for independent review and periodic self-assessments of the model (Reference 12).

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated into the PRA model, relevant peer review findings, and consistency with applicable PRA Standards) will be discussed in turn in this section.

3.2. Pending Plant Changes Not Included in the Current Model of Record A PRA updating requirements evaluation (update tracking database) is created for all issues that are identified that could impact the PRA model. The database includes the identification of those plant changes that could impact the PRA model.

A review of the identified items and the current MOR indicates that there are no plant changes that have not yet been incorporated into the PRA model that would affect this application.

4. Conformance with ASME/ANS PRA Standard BFN original peer reviews were held in 2009 on internal events and internal flooding. This review resulted in a total 125 Findings and Observations (F&Os) for the three unit model for both internal events and internal flooding. All findings from these assessments have been dispositioned. A closure review was held in June 2018 for the remaining open F&Os in accordance with Appendix X to NEI 07-12. After the closure review, ten Internal Events F&Os were considered open and will be incorporated in the next model revisions. A focus scope peer review was held in June 2018 for the Internal Flooding model and only seven F&Os are considered open and will be incorporated in the next model revisions. Of these 17 open F&Os, none impact the results of this evaluation as shown in the tables below. Revision 9 updated the model to correct errors identified in the logic, to incorporate the completion of the Emergency High Pressure Makeup (EHPM) and Supplemental Diesel Generator (SDG) modification and to update the human reliability analysis. The PRA model is technically sound and is Regulatory Guide 1.200 compliant (Reference 1). For a complete list of F&Os still open see PRA Evaluation BFN-0-18-143 (Reference 11).

CNL-20-044 E3-3 of 50

Enclosure 3 F&O 1-17 Reviewed DA.01. The source of demands is not discussed. Based upon discussions with the PRA staff, exposure is collected directly from plant data systems and is therefore actual component exposure. However, post-maintenance testing demands are also included in these numbers and are not removed.

Associated BASIS FOR SIGNIFICANCE (SRs)

DA-C6 Post-maintenance testing must be excluded from the exposure data per the SR.

POSSIBLE RESOLUTION Develop a means of identifying the post-maintenance related exposure and remove them from the data calculations.

PLANT RESPONSE As mentioned in the DA Notebook, the only demands that are included in the data analysis update of failure rates are those that come directly from PEDs, from the IST database or from the system engineer directly. The IST database gives just those successful demands that occur for each test (i.e. no post maintenance demands included). PEDs/ the system engineer gives the actual number of demands the component observes which could potentially include post maintenance demands, however a sensitivity was performed (BFN-0-15-079) which shows that the model is not sensitive PMTs.

Closure Review STATUS Open BASIS BFN uses an automatic demand counter to populate the data. As such this would include all related surveillance, maintenance and operational demands. Because the system may count additional demands for PMTs BFN has estimated these additional demands and performed sensitivities to support the impact on the failure rates. Although the sensitivities may justify a minimal impact, it does not meet the SR (DA-C6).

DA-C6 remains Not Met.

Impact on TMRE Based on the sensitivities performed, this open F&O has minimal impact on failure rates. There is no impact of this finding on the TMRE since it would be applied to both the compliant and degraded cases and, therefore, doesnt have an impact on the change in risk.

CNL-20-044 E3-4 of 50

Enclosure 3 F&O 1-33 There is no discussion of the review of the LERF contributors (ASME/ANS RA-Sa2009 Table 2-2.8-9) for reasonableness per the review of the QU Notebook and LE.01.

Associated BASIS FOR SIGNIFICANCE (SRs)

LE-F2 A review of the reasonableness of the results of the analysis of the contributors to LERF is required per the SR.

POSSIBLE RESOLUTION Perform and document a review of the reasonableness of the contributors to LERF.

PLANT RESPONSE The review of the CDF and LERF cutsets was performed and documented in Attachment D and E of the Quantification Notebook. Section 6.3.2.3 of the Quantification notebook specifies the types of things that were looked at when reviewing the cutsets. The Top 100 cutsets, a sample of 100 cutsets from the middle and the last 100 cutsets were all reviewed and showed no signs of inconsistencies in logic.

Closure Review STATUS Open BASIS The current documentation provides a listing of addressed phenomena and failures postulated to lead to LERF in Table A.1-2. How the BFN model maps to these postulated events is provided in Table 11. The model mapping is again provided in the QU notebook in Table 6.3-11.

The frequency results are tabular in the QU notebook and there is a comparison of absolute frequency to similar designs. However, there is no documented review of the results to determine if the LERF results are reasonable and that the identified contributors (categories) are consistent with expectations. A pointer to the summary document was provided but the requested information was not found at that location.

SR LE-F2 was previously Not Met and remains Not Met.

Impact on TMRE This is a documentation issue. Reasonableness check of results ensures the actual results obtained align with expected results. Therefore, there is no impact on the TMRE.

CNL-20-044 E3-5 of 50

Enclosure 3 F&O 2-31 For SPC and LPCI, the LPCI injection valves and SPC return valves are required to reposition when swapping RHR modes, but this is not included in the model. The RHR system notebook indicates that these valves need to close for the opposite function. However, in one location in the notebook it is indicated that flow can be split between LPCI and SPC.

Associated BASIS FOR SIGNIFICANCE (SRs)

SY-A5 All active components should be included in the failure modes of a system.

SY-A13 POSSIBLE RESOLUTION Add failure mode to the fault trees and clarify documentation PLANT RESPONSE The injection valves do need to change position for split LPCI/SPC flow; two valves would have to fail to modulate or close in either path to fail either system. An operator interview was conducted to address this issue. The common cause failure probability of two MOVs to close is less than 1E-5.

The RHR pump start failure probability is approximately 1.4E-3. The failure of two MOVs to close is less than 2 orders of magnitude lower than another failure that would fail the system in a similar manner.

Therefore, failure to close (or modulate) either the LPCI or SPC injection path can be neglected. The RHR system notebook was modified to reflect this and the operator interview was added.

Closure Review STATUS Open BASIS The model includes other valve realignments and common cause. It is unclear why this specific change would warrant a unique modeling approach. The absence of this failure mode could alter the importance calculations for the identified components and impact the ability to determine MSPI characteristics. It would be expected that these valves would need to be included since it does involve a physical change in state.

SY-A5 remains Met.

SY-A13 remains Met.

Impact on TMRE There is no impact of this finding on the TMRE since it would be applied to both the compliant and degraded cases and, therefore, doesnt have an impact on the change in risk.

CNL-20-044 E3-6 of 50

Enclosure 3 F&O 3-12 There is no evidence of an analysis for sequences that go beyond the 24-hour period to evaluate the appropriate treatment relative to the CC II/III requirements for SC-A5.

Associated BASIS FOR SIGNIFICANCE (SRs)

SC-A5 A CC II/III for SC-A5 requires that options other than assuming sequences in which a stable state has not been reached in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> goes to core damage.

POSSIBLE RESOLUTION Perform and document an analysis of sequences that do not achieve a stable state in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to determine which of the options presented in the SR would be a most appropriate disposition for that sequence. Then change the PRA model accordingly.

PLANT RESPONSE Basis for Safe and Stable for HFA_0085ALIGNCST - During a single unit accident, refill of the CST inventory is credited in the model (HFA_0085ALIGNCST) by refilling from the nonaccident units CST.

During a multi-unit accident, it is assumed that the TSC would direct the operators to provide additional inventory to the CSTs from an outside source given the CST depletion would not occur for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This assumption is not documented in the current model.

It is already considered in the cognitive analysis for HFA_0085ALIGNCST and the assumption that the TSC would direct operators to provide additional inventory to the CSTs is documented in the HRA Notebook. The alarm response procedures 1(2,3)ARP-9-6B provides a list of alternative sources including: 1) Hotwell or Radwaste transfer to CST, 2) Demin or another CST transfer to the affected CST, and 3) CST Crosstie. The TSC and OSC would determine and perform the appropriate actions based on conditions at the plant and the choices identified in ARP.

Closure Review STATUS Open BASIS Additional discussion of the bases for "safe and stable" has been added.

However there is no discussion whether any sequences were identified that require a mission time beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to reach safe and stable.

Note that Table 6-1 of SC.1 contains several statements implies that sequences may not safe be and stable at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and a bounding PDS may be assigned. This instruction in Table 6-1 is consistent with SC-A5 Cat I.

SC-A5 remains met at Cat I.

Impact on TMRE This is a documentation issue, with a possible impact on the mission time for a few sequences, for which bounding PDS have been assigned.

Therefore, there is no impact on TMRE.

CNL-20-044 E3-7 of 50

Enclosure 3 F&O 4-18 Some operator actions assume that the execution failure probability (Pe) is 0.0 including:

HFA_0_ADSINHIBIT, HFA_0_ATWSLEVEL, HFA_0024RCWINTAKE, HFA_0027INTAKE, HFA_0IR2_LPI, HFA_1063SLCINJECT, HFA_0024IFISOL Example 1: Several operator actions for ATWS scenarios (e.g.,

HFA_1063SLCINJECT: Failure to SLC in response to an ATWS event) assume the execution failure probability (Pe) is 0.0.

Example 2: Operator action HFA_0024RCWINTAKE (Failure to clear debris at intake before reactor scram) assumes an execution error of 0.0 based on the following: 'Cleaning traveling screens does not relate to a series of manual actions, but to an effort among several operators. It is assumed that, if the action is initiated within 1 hr., it will be successful.'

The same rationale is provided for no execution error in HFA_0027INTAKE.

Associated BASIS FOR SIGNIFICANCE (SRs)

HR-G2 Execution failure is a required part of the HEP calculation, and the argument for ignoring execution failure is not necessarily compelling, especially for maintaining level (HFA_0_ATWSLEVEL). Some of the actions for which Pe is not considered are important to the overall results.

POSSIBLE RESOLUTION Include Pe in the quantification of HFA_1063SLCINJECT, HFA_0_ADSINHIBIT, HFA_0_ATWSLEVEL, HFA_0024RCWINTAKE and HFA_0027INTAKE. Insure that execution errors are considered appropriately in other HEPs, as well.

CNL-20-044 E3-8 of 50

Enclosure 3 PLANT RESPONSE

• Execution error has not been included for ADS inhibit (HFA_0_ADSINHIBIT). This is modeled only for ATWS in the PRA. There is a single step to implement this action, errors of omission are integral to the cognitive error to omit the action. Errors of commission are neglected because the action to inhibit ADS is unique (no transition to any EOI Appendix is required, and there are several places in the EOI that call for inhibiting ADS), and because it is routinely performed for every reactor scram, graphically distinct and performed after SLC.

• Execution error was added for SLC. This is a time critical operator action, and the EOI specifies the appropriate steps required in EOI-Appendix 3A. While the actions are simple, these require transition between procedures for the execution, so it is appropriate to include execution errors.

• HFA_0_ATWSLEVEL -Execution errors are included for this event. NO CHANGE.

• HFA_0024RCWINTAKE - Execution error set to zero and it deemed not necessary to add detail for this activity. Clearing traveling screens does not relate to a series of manual actions, but to an effort among several operators, so errors of execution are in parallel and considered unlikely. It is assumed that, if the action is initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, it will be successful (i.e. only the cognitive error is included). The RCW system is supplied river water from the CCW conduits of each unit through fine mesh strainers that include a dP alarm. Pumps are run periodically to avoid fouling.

• HFA_0027INTAKE - Basic event is not in the model. NO CHANGE

• HFA_0IR2_LPI -Execution errors are included for this event. NO CHANGE.

• HFA_0024IFISOL - This event is not used in the PRA model. NO CHANGE.

Closure Review STATUS Partially Closed BASIS Execution failure probability has been added to some HFEs but not others. HFA_0024RCWINTAKE involves physically cleaning the intake screens within time to prevent a plant trip or equipment overheating.

Assuming the execution failure probability is zero is inappropriate.

HR-G2 remains Met.

Impact on TMRE TMRE changes are not affected by HEPs as the changes will be in both the compliant and degraded cases. Additionally, minimal or no impact on the PRA results is expected.

CNL-20-044 E3-9 of 50

Enclosure 3 F&O 4-25 There are many operator actions that use screening values; see Table 8 of the HRA. None of these actions appear to use any information to base the time available and the times to operator cues and perform the actions are not documented.

Associated BASIS FOR SIGNIFICANCE (SRs)

HR-F2 Without any real timing information, it is not possible to estimate, even HR-G4 at a screening level, the probability of operator failure or success.

HR-G5 POSSIBLE RESOLUTION Provide timing information for all operator actions, including those HEPs estimated by using screening values.

PLANT RESPONSE Clarification on the basis for the timing has been added to the HRA notebook.

Closure Review STATUS Open BASIS BFN-0-16-031 list several HFEs with clarification of the timing information. These are not the HFEs listed in Table 8 as referenced in the F&O, nor is there any discussion why these events were selected.

NDN-000-999-2007-0032 Assumption 10 assumes that screened HFEs all have a delay time of 24h. This is not consistent with several of the event descriptions, which imply the timing would need to be less than 24h for success (some screened events list times of 15m or less in the description).

HR-F2 remains Not Met (F&O 4-25)

HR-G4 remains Not Met (F&O 4-25)

HR-G5 remains Not Met (F&O 4-25)

Impact on TMRE TMRE changes are not affected by HEPs as the changes will be in both the compliant and degraded cases. Additionally, minimal or no impact on the PRA results is expected.

CNL-20-044 E3-10 of 50

Enclosure 3 F&O 4-42 Table 3 of the data notebook says that EDG boundaries included the output breakers, but the EDG system notebook and the model have them as separate events. NUREG/CR-6928 lists breakers as WITHIN the boundary of the EDG.

Associated BASIS FOR SIGNIFICANCE (SRs)

SY-A8 Apparent inconsistency in data and component boundary definitions.

POSSIBLE RESOLUTION Resolve discrepancy.

PLANT RESPONSE The EDG output breakers 1818, 1822, 1812, 1816, 1838, 1842, 1832, and 1836 have been included within the boundary of the EDG. The output breakers are no longer explicitly modeled. The EDG system notebook and table 4 have been updated to reflect this change.

Closure Review STATUS Open BASIS The system notebook did indicate that the failure of output circuit breakers was included within the EDG boundary. However, the CAFTA model still had separate events for breaker failure with probability included (CBKFC0BKR_211A_022).

SY-A8 remains Met.

Impact on TMRE There is no impact from this finding on the TMRE since it would be applied to both the compliant and de- graded cases and, therefore, doesnt have an impact on the change in risk.

CNL-20-044 E3-11 of 50

Enclosure 3 F&O 6-10 CCF for Battery Chargers is not included in the Initiating Event Fault Tree for loss of 2 DC buses, other than for the standby chargers (not in the yearly failure rate logic).

Associated BASIS FOR SIGNIFICANCE (SRs)

IE-C8 Can affect the loss of DC initiating events by a factor of 10, depending on how CCF is calculated.

POSSIBLE RESOLUTION Include CCF under the yearly failure rate logic or as a top event for all loss of DC initiating events.

PLANT RESPONSE The IE Notebook lists an Assumption about why inclusion of common cause is not included for support system initiators. Inclusion of common cause into the support system initiator development would produce overly conservative initiator frequencies as mentioned in the previous response.

In order to obtain a more realistic model TVA decided to leave out the common cause events for initiator development. Inclusion of the common cause for support system initiator development will be reevaluated and incorporated as required following completion of the evaluation.

Closure Review STATUS Open BASIS An assumption in IE.01 states that inclusion of common cause failures in the initiating event tree would yield inappropriate/conservatively high frequencies. This is counter to current guidance in EPRI TR1016741. An update to IE.01 should be prepared following the EPRI process which allows for appropriate screening of events and other adjustments.

IE-C8 remains Not Met (see F&O 6-10).

Impact on TMRE There is no impact from this finding on the TMRE since it would be applied to both the compliant and de- graded cases and, therefore, doesnt have an impact on the change in risk.

CNL-20-044 E3-12 of 50

Enclosure 3 F&O 6-30 Dependencies between operator actions appear to be non-conservatively applied. Mainly, the Zero Dependence (ZD) between actions is commonly applied, simply when one of the actions takes longer than 60 minutes. What appears to be the mistake is applying the last event tree node in the Dependency Event Tree. In this tree, if the stress of either HFE is moderate or high, the upper leg of the event tree is used. So for combo 2, the HRA assumes ZD, while the event tree would designate Low Dependency.

Associated BASIS FOR SIGNIFICANCE (SRs)

QU-C2 Systematic error affecting around 1/2 of the combo events, including HR-G7 combo 18.

POSSIBLE RESOLUTION Correct dependency analysis in the HRA.

PLANT RESPONSE

• The basis for ZD between early depressurization HFA_0001HPRVD1, and failure to align suppression pool cooling is significant differences, cues and timing. Early depressurization is associated with failure to maintain RPV level, while failure to align SPC (nonATWS/IORV) is associated with SP temperature. MAAP analysis demonstrates that operators have 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to start suppression pool cooling to avoid exceeding 190F and thus eventually impacting HPI systems taking suction from the SP. Since HPCI and RCIC take suction from the CST initially, it would take several hours to deplete the CST prior to any swapping suction to the SP. Early SPC failure was included in the model under late failure for HPI since early failure would result in high SP temperature that may preclude late swap over of suctions for HPI.

• The basis for the User Defined dependency levels has been added to the HRA calculation in Appendix E.

Closure Review STATUS Open CNL-20-044 E3-13 of 50

Enclosure 3 BASIS The stated resolution addresses only some specific HFEs, however during discussion it was identified that the dependency analyses were completely redone. The actual process used to identify and process dependencies in general is not described, only that the "EPRI recommended" method is used. More detail is needed. HRA NB Section 6.3.3 points to the Quantification and Quantification NB points back to HRA NB. The use of automated tools is mentioned but the actual tools and how they are used is not discussed.

There is and assumption (in HRA and Quant) that HFEs with screening HEPs of 0.1 or greater are treated as independent.

Discussions with the analyst indicated this is not how they are treated.

In the Quantification NB it states that the base quantification uses a seed value of 0.15 for all HEPs. In section 6.3.1.9 its states that a sensitivity is using 1.0 as the seed value and references the HRA calc.

It is not clear how the dependent HFEs are identified.

QU-C2 remains Not Met (F&O 6-30)

HR-G7 remains Not Met (F&O 6-30) performed using 1.0 as the seed value and references the HRA calc. It is not clear how the dependent HFEs are identified.

QU-C2 remains Not Met (F&O 6-30)

HR-G7 remains Not Met (F&O 6-30)

Impact on TMRE TMRE changes are not affected by HEPs as the changes will be in both the compliant and degraded cases. Additionally, minimal or no impact on the PRA results is expected.

CNL-20-044 E3-14 of 50

Enclosure 3 F&O 6-50 Some of the MOVs credited in the ISLOCA Fault Tree are not tested to close against full DP. These MOVs are not originally included in the design as RCS isolation valves. Examples include 74-55 and 74-66 (note: this is not a complete list, but 2 of 4 valves reviewed were not in the MOVATs 89-10 program).

Associated BASIS FOR SIGNIFICANCE (SRs)

IE-C11 MOVs closing for ISLOCA are risk significant, with a RAW of greater than SY-A22 2.

POSSIBLE RESOLUTION Do not credit MOVs in the ISLOCA without verification the valves will close against full DP of RCS pressure.

PLANT RESPONSE Assumption was added to the ISLOCA Notebook. Depressurization is not modeled in the ISLOCA initiator before valve closure. The probability of this failing to occur is only 5.077E-02. The fact that all ISLOCA events go directly to core damage without any mitigation actions is more than adequate to make up for not modeling the low probability of SRV failure.

Closure Review STATUS Open BASIS A review of the ET representation identifies operator mitigation actions are included in the ET. This was also found to be the case when the ISLOCA modeling in the CAFTA model was reviewed (for example, gate U1_VRLOCA_002 includes gate U1_ISLV55_2 dealing with isolation).

SY-A22 remains met at Cat II. The current model does not match the basis for resolution. Therefore, the F&O is not resolved.

IE-C11 remains Met.

Impact on TMRE There is no impact from this finding on the TMRE since it would be applied to both the compliant and de- graded cases and, therefore, doesnt have an impact on the change in risk.

CNL-20-044 E3-15 of 50

Enclosure 3 F&O IFSN-A8-01 It was stated that no credit was taken for the removal of water via the drain system, with the exception that spray events (<=100 gpm). No scenarios were modeled that included backflow through drain lines.

Although this is reasonable based on the layout of the large open areas in the Reactor Building and Turbine Building, no discussion of the elimination of backflow was provided in the documentation.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFSN-A8 Not provided POSSIBLE RESOLUTION Expand discussion in the internal flood notebook that explains how drain backflow was treated in the internal flood model. Include enough detail to justify screening.

1) What screening criteria was used?

2) How is the drain system configured?

a. Are there separate drain systems in each building? (i.e. - RB, TB, CB, etc.)

b. Can a drain line become blocked downstream?

c. Where does the water end up? (Sump on lower level?, Holding tank?,

Outside?)

3) Include general references that can be validated by the reviewer.

(such as the system description and/or drawings used to support the assumptions for screening)

4) Is screening conservative? Why?

This does not need to be a large effort but a statement that any of the rooms within a building already show water propagating to the bottom elevation of that building does not provide enough detail to demonstrate that the drain impacts were sufficiently assessed for screening.

PLANT RESPONSE In the BFN Internal Flooding Analysis, it was determined that the only place that drain backflow could occur and potentially cause any issues would be in the lowest elevations of each building. The affect from this occurrence is already accounted for in each of the flooding scenarios as they all propagate to the lowest elevation. The drain lines are not connected for each building so water could not propagate from one building to another. The upper elevation drainage systems were not analyzed as a potential backflow situation as the drains are relatively small compared to the open hatches and stairwells that would cause the water to propagate to the lowest elevations. In addition, the areas in which the water would be susceptible to drainage are large rooms where the water would have to significantly fill in order to even reach a drain.

Section 6.1.3 of the Internal Flooding Notebook explains that we screened drainage backflow from the analysis and why.

CNL-20-044 E3-16 of 50

Enclosure 3 Closure Review STATUS Open BASIS No formal closure review has been performed Impact on TMRE This is a documentation issue. Therefore, there is no impact on the TMRE.

CNL-20-044 E3-17 of 50

Enclosure 3 F&O IFSN-A9-01 No specific flow rate calculations were performed. Flow rates were modeled to be the maximum flow rate for a given break category. For example, all flood events were assumed to result in a break flow of 2,000 gpm. This results in very conservative times to component failure. It could result in incorrect ranking of the risk importance of the flooding scenarios.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFSN-A9 Not provided POSSIBLE RESOLUTION As a minimum, perform calculations to estimate the actual flow rates of modeled breaks for the most risk significant scenarios.

PLANT RESPONSE The BFN Internal Flooding Analysis conservatively assumed that the flows out of the pipe breaks were at the top end of each of the generic flow rate values. This was done to assure that we properly addressed the importance of each scenario. The pipe break frequencies are given for the range of flows and the frequency does not change whether the top end flow rate or a lower flow rate is used unless it changes which range of flows you are using. The only time you would be concerned with the flow rate would be when you are performing an operator action to prevent water accumulation within a room. The BFN Internal Flooding analysis did not credit any of these types of operator actions except for in the reactor building 519 elevation.

The flow rates that could cause this elevation to flood could be from any water source in the Reactor Building so the highest flow rate possible for both the flood scenario and the major flood scenario was used in calculating timing for the HRA action. This gives the smallest possible timeframe with which to perform the action and ensures that the results are conservative and risk insights are reasonable.

Closure Review STATUS Open BASIS No formal closure review has been performed.

Impact on TMRE TMRE changes are not affected by HEPs as the changes will be in both the compliant and degraded cases. Additionally, minimal or no impact on the PRA results is expected.

CNL-20-044 E3-18 of 50

Enclosure 3 F&O IFSN-A10- Spray events in the RB general areas (multiple elevations) are assumed 01 to result in a manual trip and are analyzed. Larger flooding events are not considered an initiating event unless operators fail to isolate the flood prior to reaching the level of equipment damage (5') at the 519' elevation. This appears to be an inconsistency between the spray and flood events. Although less frequent than spray events, flood events in these areas could in total be a significant contributor to CDF.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFSN-A10 Not provided IFEV-A1 POSSIBLE RESOLUTION Develop some initiating event that model floods in the general areas of the RB, along with successful isolation of the flood prior to equipment damage on the 519' elevation of the RB. Based on the results, determine whether, or not the entire group of these scenarios should be included in the IF model.

PLANT RESPONSE When analyzing the spray events, it was assumed that for every spray scenario the operators would manually scram the reactor. This is a conservative assumption as the operators may not need to shutdown the plant. By analyzing every spray scenario with a manual scram we were able to see what the impact from a spray scenario would be to the plant.

The flooding scenarios on the other hand, were not analyzed as during a Reactor Building flood scenario all of the water would propagate down to the 519 elevation of the Reactor Building. If the operators are successful in isolating the pipe rupture prior to reaching 5 feet in the 519 elevation, the plant would not necessarily be tripped. While it is true that some equipment might be lost which is similar to that seen for the spray events, the flooding analysis viewed the equipment impact separately from the flooding scenario as the flood has been terminated. Therefore the impact from the equipment being lost would be characterized by the internal events PRA model.

Each of the Reactor Building flooding scenarios that are successfully mitigated by the HRA action for the 519 elevation submergence will be reviewed to determine whether a potential scenario would exist or not.

In addition the Spray Scenarios will be reviewed to determine if those are potential scenarios or not as well and the results will be documented within the Internal Flooding Notebook.

Closure Review STATUS Open BASIS No formal closure review has been performed CNL-20-044 E3-19 of 50

Enclosure 3 Impact on TMRE This issue impacts potential flood initiating events, but the scenario response would be characterized by scenarios already modeled. TMRE changes are not affected by changes in Internal Flooding analysis due to the changes being in both the compliant and degraded cases.

CNL-20-044 E3-20 of 50

Enclosure 3 F&O IFSN-A10- Only a 2000 gpm flood initiating event was modeled in the Unit 1 SD 02 Board Room A. Spray events were not modeled. Given that there are no drains nor indication that room (and an informal analysis) there is a possibility that a spray event of 100 gpm could also result in similar consequences.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFSN-A10 Not provided POSSIBLE RESOLUTION Perform a calculation at 100 gpm to determine whether or not a spray scenario is, in fact, a valid initiating event in this area. If so, include spray events in that area in the model.

PLANT RESPONSE Each room was looked at for potential spray effects, including the 4KV Shutdown Board Room A. This Spray scenario is in the model as U1-621-R02_025_S with a contribution of 1.54E-10 to CDF which constitutes 0.002% of the Internal Flooding CDF for Unit 1. This spray scenario will be reviewed to ensure that it is treated appropriately within the model and any changes will be documented in the next revision of the internal flooding notebook.

Closure Review STATUS Open BASIS No formal closure review has been performed Impact on TMRE This issue impacts potential flood initiating events, but the scenario response would be characterized by scenarios already modeled. TMRE changes are not affected by changes in Internal Flooding analysis due to the changes being in both the compliant and degraded cases.

CNL-20-044 E3-21 of 50

Enclosure 3 F&O IFEV-A1-01 For spray events in the general areas of the RB, all the possible spray frequencies were added to obtain on combined frequency for one event.

The impact of this spray event was the combined impact of all the possible spray events on that elevation.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFEV-A1 Not provided IFEV-A2 POSSIBLE RESOLUTION Separate out spray events in these areas to provide a better picture of which spray sources and which impacted equipment are the more significant contributor.

PLANT RESPONSE For the general areas of the Reactor Building all spray scenarios were determined to occur at the same time and all equipment affected by a certain system piping were all failed. Because this is such a big room, this modeling approach was too conservative. Each of the spray scenarios within the general area of the Reactor Building will be reviewed to determine which components can be failed by what portions of piping and new scenarios will be developed to ensure that only the pipe ruptures that affect a component are used to fail a particular component.

Closure Review STATUS Open BASIS No formal closure review has been performed Impact on TMRE This issue impacts potential flood initiating events, but the scenario response would be characterized by scenarios already modeled. TMRE changes are not affected by changes in Internal Flooding analysis due to the changes being in both the compliant and degraded cases.

CNL-20-044 E3-22 of 50

Enclosure 3 F&O IFQU-A6-01 The HRA assessment needs to incorporate several items:

a) cues and indicators need to be documented in the first mitigation HRA (HFA_0_519FLOOD) b) with a), indicators should be assessed for flood damage c) PSFs need to be altered for general worst case in environment (radiation, etc.). This is because the flood mitigation actions are general and are not specific in place or time.

d) Why is the belief in the adequacy of instruction set to no? For non mitigation post initiator HRA's :

a) Needs to discuss blocked path for each scenario Associated BASIS FOR SIGNIFICANCE (SRs)

IFQU-A6 Not provided POSSIBLE RESOLUTION Incorporate the missing pieces to the mitigation HRA's.

a) cues and indicators for the first mitigation HRA (HFA_0_519FLOOD) b) with a), indicators should be assessed for flood damage c) Alter PSFs for general worst case in environment (radiation, etc.)

d) Alter or add some discussion on why the Belief in Adequacy is set to "No" For non-mitigation post initiator HRA's :

a) Discuss or incorporate blocked path for each scenario CNL-20-044 E3-23 of 50

Enclosure 3 PLANT RESPONSE The HRA Assessment on HFA_0_519FLOOD was done generically as the only indication would be the Alarm coming in saying that there is water building up in the 519 elevation. The operator would be sent out to see if the alarm was valid and then try and isolate the pipe rupture. The Cues and Indicators will be updated to reflect the Alarm Indication. The flooding detectors are designed to get wet and would not be damaged by a flood. In addition there are multiple flooding detectors within the 519 elevation so if any of the detectors work, the operators would still be able to mitigate the flood. The belief in adequacy of instruction was set to No as the operators would most likely question whether there is an actual flood within the Reactor Building. The operators would still comply with the procedure and perform the action as stated. There is a timing aspect included that is to assess whether the flood actually occurred. The PSFs were reviewed to assess whether an operator would experience any adverse situation outside of what it would experience through everyday work. Because the flood and associated mitigation accident would occur prior to reactor trip, the shaping factors were consistent with a normal workload within the Reactor Building. Lighting would not be affected by the flood, heat/humidity would be normal for the areas that would be traversed. All of the areas within BFN are radiation areas so there is no increased stress from radiation, to isolate the pipe would be a simple action, and the stress was expected to be low as there is plenty of time to perform the action and it is expected that the action to close a couple of valves would not increase the stress on the operator.

Each of the HRAs will be reviewed to determine what the impact would be from a blocked path and this will be documented within the internal flooding notebook.

Closure Review STATUS Open BASIS No formal closure review has been performed Impact on TMRE TMRE changes are not affected by HEPs as the changes will be in both the compliant and degraded cases. Additionally, minimal or no impact on the PRA results is expected.

CNL-20-044 E3-24 of 50

Enclosure 3 F&O IFQU-A9-01 No modeling of direct effects due to a flooding event were identified. The rational was, that for large flooding events in the RB, only those floods that resulted in flood levels reaching 5' in the 519' elevation were modeled. For those events, the required SSCs have failed due the indirect effects of the flooding.

Therefore, the direct effects of the flooding need not be considered. It is our contention that floods in the RB that are successfully isolated before damage occurs to components on the 519' elevation should be included as initiators. These events will still result in damage to SSCs and direct failure to part of the breached system.

Associated BASIS FOR SIGNIFICANCE (SRs)

IFQU-A9 Not provided POSSIBLE RESOLUTION Include floods on the RB elevations at 565' and above, even with successful isolation prior to equipment damage on the 519' elevation. For those events, model the direct failure of the breached system.

PLANT RESPONSE This F&O is similar to F&O IFSN-A10-01. As mentioned in the response for that F&O, an operator may not need to scram the reactor for a loss of a component affected by a flooding event. Each of the Reactor Building flooding scenarios that are successfully mitigated by the HRA action for the 519 elevation submergence will be reviewed to determine whether a potential scenario would exist or not.

Closure Review STATUS Open BASIS No formal closure review has been performed This issue impacts potential flood initiating events, but the scenario Impact on TMRE response would be characterized by scenarios already modeled. TMRE changes are not affected by changes in Internal Flooding analysis due to the changes being in both the compliant and degraded cases.

CNL-20-044 E3-25 of 50

Enclosure 3

5. PRA Model History The following information is gleaned from the corresponding revision of the BFN PRA Summary Document (Reference 3).

1. Rev. 0 - Initial CAFTA model issued after August 2009 peer review.

2. Rev. 1 - Initiating events were updated to include current generic data, recent plant events and multi-unit initiators. Fire initiators that fail offsite power were added to the model to assess the Diesel Generator Allowed Outage Time Extension. Some logic errors and type code errors were also corrected that were identified from the Revision 0 to Revision 1 model.

3. Rev. 2 - Initiators %VR and %VS were added for all units. The human error probability for HFA_0085ALIGNCST was re-evaluated based on an additional MAAP run performed. A design change was incorporated into the model that requires three air compressors to supply the entire plant instead of all four. Some logic errors were also corrected that were identified from the Revision 1 to Revision 2 model.

4. Rev. 3 - The Fire initiators used to assess the Diesel Generator Allowed Outage Time Extension were removed from Revision 3 of the model. Some logic errors and type code errors were also corrected that were identified from the Revision 2 to Revision 3 model.

5. Rev. 4 - Changes were made from the Revision 3 to Revision 4 model to support increased unavailability for infrequent maintenance performed on the Emergency Diesel Generators and corrections to logic errors and type code errors found.

6. Rev. 5 - The major change in this update was to revise the data, and mutually exclusive logic. Changes were made in the Revision 5 model to correct errors in the logic noted during review following the issuing of the Revision 4 documentation and to support increased unavailability for infrequent maintenance being performed on the Emergency Diesel Generators. The data in the PRA model was updated for plant specific failures and successes through January 1, 2012. There were no changes in the Accident Analysis, Success Criteria, Internal Flooding, or LERF Analysis, from Revision 4 to Revision 5.

The initiating event analysis has been updated to include initiating event data through January 1, 2012 to include current industry generic data, recent plant events and multi-unit initiators.

Changes were made in the Revision 5 model to correct errors in the logic noted during review following the issuing of the Revision 4 documentation.

The unreliability, unavailability, and common cause data analyses were updated.

The unreliability (or failure rate) data are based on generic industry data that has undergone Bayesian updating with plant specific data. Plant specific data for the period 1/1/2003 to 1/1/2012 was evaluated and used as input to the Bayesian analysis. Plant maintenance unavailability data is based on the same time period as the failure data, 1/1/2003 to 1/1/2012. Generic industry data from NUREG/CR- 6928 was used for components for which no plant specific data was available.

CNL-20-044 E3-26 of 50

Enclosure 3

7. Rev. 6 - A model update was performed to merge the Internal Events PRA and the Fire PRA into a single model, to improve the event tree logic, to resolve issues for AC and DC power.

A brief overview of these changes is included in the bullets shown below:

Event Tree changes to credit RCIC for IOOV scenarios Event Tree changes to separate the DHR functional top logic in a more logical manner (HWV and DWV, Drywell Sprays)

Event Tree changes to incorporate ASDC for the Fire PRA Event Tree changes to incorporate the HPMU for the Fire PRA Logic fault tree changes to address NPSH w/o CAP Correct the logic for DC chargers (OR gate is now used between the batteries and chargers to address charger trips due to voltage swings caused by inrush current of large loads.

Logic fault tree changes to address overload and load shed logic Logic changes to address preferred pump logic (PPL)

Logic changes to address diesel paralleling logic Logic changes to address conditional LOOP logic for MUI Limited enhancement for LOOP recovery Develop recoveries for MSL BOC instrumentation Updated RCW logic

8. Rev. 7 - A model update was performed to correct errors identified in the logic, to incorporate DCNs that were issued following the issuance of the Revision 6 MOR. A brief overview of these changes is included in the bullets shown below:

Model changes were made to correct errors in logic noted during a review following the issuance of the Revision 6 MOR.

Sequences ATWS-026 and ATWS-027 were appropriately binned and added to the model.

Minor HRA changes to address timing issues.

Added logic to credit low pressure signal for MSIV isolation during MSBOC.

Added common cause groups per new MSIV logic.

Corrected pre-initiator HFEs to F&O suggested means.

Gate name changes to correctly map unit specific logic.

Test and maintenance events were added to the model.

Numerous BE description updates to accurately reflect the logic.

Added new AOVs and check valves per DCNs.

Removed LLOCA sequences that were no longer in the Event Trees and Top Events.

Updated mutually exclusive gates accordingly.

9. Rev. 8 - the Internal Flooding analysis was updated in its entirety to resolve open F&Os. A brief overview of these changes is included in the bullets shown below:

The internal flood analysis was updated in its entirety to resolve open F&Os. The analysis was updated to document walk-downs, incorporates the latest failure data, add new operator actions, and reassessed the consequences of the new flood initiators. The model now includes over 1000 internal flood initiators. This update generated significant changes in the internal flood results and risk profiles.

CNL-20-044 E3-27 of 50

Enclosure 3 The HRA has been updated and the dependency analysis recovery file was regenerated.

5.1. TMRE Considerations The NEI TMRE guidance document (Reference 2) lays out a road map of certain SRs that which particular sections in the guidance document provides the information to meet those SRs.

A systematic review was performed of the SRs relative to the TMRE model development and is shown in the table below with notes on the BFN TMRE model regarding those certain SRs.

TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR The initiating event analysis shall provide a IE-A reasonably complete identification of initiating events.

Tornado initiating TMRE process 4.3, 6.2 The initiating events events will be should ensure caused by extreme winds consistent with the that the initiating that were considered in the intervals defined in events caused by TMRE were tornadoes.

the TMRE process. extreme winds Only tornados will produce TMRE considers all that give rise to tornado missiles. The tornadoes will significant TMRE process was result in a LOOP. accident followed as described in Tornado initiating sequences and NEI 17-02.

event frequencies accurately IE-A1 will be based on capture the a hazard curve additional risk of that uses site the unprotected specific data SSCs (that provided in Table should be 6.1 of NUREG protected per the 4461 [IE- C1]. CLB) are identified and used for this application.

CNL-20-044 E3-28 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR For multi-unit sites 6.2 Multi-unit initiators were with shared considered in the TMRE systems, INCLUDE per NEI 17-02.

multi-unit site initiators (e.g.,

IE-A10 multi-unit LOOP events or total loss of service water) that may impact the model.

The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements IE-B for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF DO NOT 6.2 Multi-unit initiators were SUBSUME considered in the TMRE multi-unit initiating per NEI 17-02.

events if they impact mitigation capability. Two unit sites should IE-B5 consider proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

CNL-20-044 E3-29 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR The initiating event The tornado IEFs analysis shall should be based estimate the on a hazard annual frequency curve that uses IE-C of each initiating site- specific event or initiating data, such as event group. found in NUREG-4461.

Tornado initiating 4.1 The TMRE process was event frequencies followed per NEI 17-02.

will be based on a hazard curve that IE-C1 uses site specific data provided in Table 6.1 of NUREG 4461 Do not credit Same comment 6.1, Appendix Offsite power recovery IE-C3 recovery of offsite as AS-A10 A was not credited.

power.

CHARACTERIZE 4.3 The TMRE process was the uncertainty in followed as described. As the tornado mentioned, NUREG 4461, initiating event Tornado Climatology data frequencies and includes uncertainty.

PROVIDE mean Additionally, the R-IE-C15 values for use in squared value is provided the quantification of to help characterize the the PRA results. uncertainty of the BFN NUREG 4461, data initiating event best fit includes interpolated/extrapolated uncertainty. frequencies.

Utilize the accident sequences (typically LOOP) provided in the internal events AS-A model and adjust as necessary to consider the consequences of a tornado event.

CNL-20-044 E3-30 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Modify the internal 6.1, 6.3, 6.4, The TMRE process was events accident 6.5 followed as described. The sequences in transient LOSP accident compliance with sequence event tree from this SR the internal events model that was utilized considers the consequences of a tornado event. Certain AS-A1 exposed SSCs are not credited in accordance with the TMRE process, such as the shutdown diesel and the air compressors. Operator actions are adjusted as necessary according to the TMRE process.

Review the FPIE 6.1, 6.3, 6.4, The TMRE process was success criteria 6.5 followed as described.

and modify the Certain exposed SSCs are associated system not credited in accordance AS-A3 models as with the TMRE process.

necessary to account for the tornado event and its consequences.

Review the FPIE 6.4 The TMRE process was success criteria followed as described.

and modify the Operator actions are associated adjusted as necessary AS-A4 operator actions as according to the TMRE necessary to process.

account for the tornado event and its consequences.

CNL-20-044 E3-31 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Modify the FPIE 6.1, 6.3, 6.4, The TMRE process was accident sequence 6.5 followed as described. The model in a manner transient LOSP accident that is consistent sequence event tree from with the plant- the internal events model specific: system that was utilized considers design, EOPs, the consequences of a abnormal tornado event. Certain procedures, and exposed SSCs are not plant transient credited in accordance response. Account with the TMRE process.

AS-A5 for system Operator actions are functions that, as a adjusted as necessary consequence of according to the TMRE the tornado event, process.

will not be operable or potentially degraded, and operator actions that will not be possible or impeded.

CNL-20-044 E3-32 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Capability In constructing 6.3, 7.2.3, The TMRE process was Category I. In the accident Appendix A followed as described.

modifying the sequence Active components not in accident sequence models, support Cat I structures are not models, INCLUDE, system modeling, credited in accordance for each tornado etc. realistic with the TMRE process.

initiating event, criteria or INDIVIDUAL assumptions EVENTS IN THE should be used, ACCIDENT unless a SEQUENCE conservative SUFFICIENT TO approach can be BOUND SYSTEM justified. Use of OPERATION, conservative TIMING, AND assumptions in OPERATOR the base model ACTIONS can distort the NECESSARY FOR results and may KEY SAFETY not be AS-A10 FUNCTIONS. conservative for delta CDF/LERF calculation. While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

Dependencies that can impact the ability of the AS-B mitigating systems to operate and function shall be addressed.

CNL-20-044 E3-33 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR For each tornado 6.1, 6.3, 6.5, The TMRE process was event, IDENTIFY 6.6 followed as described.

mitigating systems Impacts on mitigating impacted by the systems were included for occurrence of the all modeled tornado initiator and the initiating events.

extent of the impact. INCLUDE AS-B1 the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

IDENTIFY the 5.6, 6.3, 6.4, The TMRE process was phenomenological 6.6 followed as described.

conditions created Unique weather by the accident phenomena such as progression. Also intense rain could be an high winds and issue during tornado rains after the initiating events for tornado event structures that are not could result in designed to withstand the AS-B3 hazardous winds. Active components conditions (e.g. in non-Cat I structures debris and were not credited in structural accordance with the TMRE instabilities) for process.

actions outside the Operator actions that control room. require travel through non-Cat I structures or areas are not credited.

CNL-20-044 E3-34 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Review FPIE time 6.1 The TMRE process was phased followed as described.

dependencies to Time phased identify model dependencies were changes needed to reviewed and no model address all the changes were identified for concurrent system the TMRE model.

AS-B7 functions failed by the tornado event; e.g. LOOP, instrument air, fire protection etc. Do not model offsite recovery.

The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA SC-A shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

Consider impact on 6.1 Multi-unit initiators were both units for the considered in the TMRE same tornado per NEI 17-02.

SC-A4 including the mitigating systems that are shared.

CNL-20-044 E3-35 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR The systems analysis shall provide a reasonably complete treatment of the causes of SY-A system failure and unavailability modes represented in the initiating events analysis and sequence definition Capability Section 3 The TMRE process was Category II. followed as described.

Walkdowns Walkdowns were focusing on targets performed focusing on vulnerable to targets vulnerable to tornado missiles tornado missiles. The will be performed. walkdowns also surveyed Walkdown will the plant for the missile SY-A4 include a missile inventory. Pathways for inventory and a operator actions outside review of pathways the control room were available to the discussed with the site operators for ex- personnel; however control room operator actions that actions. require travel through non-Cat I structures or outside areas are not credited.

New basic events 6.3, 6.5, 6.6 The TMRE process was will be added to followed as described.

address all the New basic events and failure modes of flags were added to the system targets address all the failure exposed to tornado modes of the safety missiles; safety- related and nonsafety SY-A11 related and non- related system targets safety related. exposed to tornado The exclusions of missiles in accordance SY- A15 do not with the TMRE process.

apply for SSCs impacted by tornado missiles.

CNL-20-044 E3-36 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR DO NOT INCLUDE 5.2 The TMRE process was in a system model followed as described.

component failures that would be beneficial to system operation, unless omission would distort the results.

For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be SY-A12 shown this is true for all missiles at all speeds.

Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

Consider the 6.5 The TMRE process was targets potential to followed as described.

cause a flow Targets with the potential diversion when to cause a flow diversion struck by a tornado when struck by a tornado SY-A13 missile. missile were considered.

Beyond steam breaks around main steam lines, no additional flow diversions were required to be modeled.

CNL-20-044 E3-37 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Missile targets will 6.5 The TMRE process was be assessed for all followed as described.

failure modes - SSCs were assessed for some new failure all failure modes.

modes may be identified that are SY-A14 not in the FPIE model.

The exclusions of SY- A15 do not apply for SSCs impacted by tornado missiles.

The failure of The failure by 6.5 The TMRE process was SSCs due to tornado missiles followed as described. The tornado missiles should be failure by tornado missiles shall not use the included in the was included in the model exclusions of SY- model for all for all unprotected targets A15. unprotected that are supposed to be targets that are protected according to the supposed to be CLB and any unprotected protected targets that are not in the according to the CLB but are in the PRA CLB and any model.

unprotected targets that are not in the CLB but are in the PRA model. This SY-A15 is to facilitate sensitivity studies regarding possible correlation of tornado missile damage across systems. It is not expected that the number of basic events added to the model for this analysis will be so large that this screening is necessary.

CNL-20-044 E3-38 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Certain post 6.4 The TMRE process was initiator HFEs will followed as described.

SY-A17 be modified to account for the tornado event.

The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for SY-B quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Capability Same comment 7.2.3 The TMRE process was Category I. BASE as AS-A10 followed as described. The support system systems analysis from the modeling on the internal events was the use of foundation for the TMRE CONSERVATIVE model. Credit given to SUCCESS available PRA SSCs was CRITERIA AND in accordance with the SY-B7 TIMING. TMRE process Sensitivity studies will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

CNL-20-044 E3-39 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Consider spatial 5.6 The TMRE process was relationships followed as described.

between Correlation was components to considered where the identify correlated same missile can impact SY-B8 failures. Where the targets that are in close same missile can proximity to each other.

impact targets that are in close proximity to each other.

Statistical The industry Appendix There are no deviations correlation of indicated in B.4.4 taken from the TMRE tornado missile earlier guidance document.

damage between discussions that redundant and information is spatially separated available to show components is that statistical NOT required. correlation of tornado missile damage for specially separated components is SY-B14 insignificant. Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

CNL-20-044 E3-40 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR INCLUDE new 6.4 The TMRE process was operator interface followed as described. No dependencies new operator interface SY-B15 across systems or dependencies across trains related to systems or trains were the tornado event, identified in the TMRE if applicable. model development.

A systematic review of the relevant procedures shall be used to identify HR-E the set of operator responses required for each of the tornado accident sequences Operators will be 6.4 The TMRE process was interviewed (if followed as described.

necessary) to Operator interviews for the assess the need credited actions were HR-E3 for changes to performed during the operator actions development of the for the tornado internal events model that initiating events. the TMRE model is based on.

CNL-20-044 E3-41 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Operators talk- 6.4 The TMRE process throughs or was followed as simulator described. Operator observations will interviews/talk- throughs be conducted (if for the credited actions necessary) to were performed during the assess the need development of the for changes to internal events model that operator actions the TMRE model is based for the tornado on.

initiating events.

[Note: this applies HR-E4 to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self- consistent process that addresses the plant-specific and HR-G scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

CNL-20-044 E3-42 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Operators will be 6.4 The TMRE process was interviewed and followed as described.

simulator Operator interviews/talk-observations throughs for the credited conducted (if actions were performed necessary) to during the development of assess the need the internal events model for changes to that the TMRE model is operator action based on.

timing as a result of the tornado event.

HR-G5 [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

For new operator 6.4 The TMRE process was action followed as described. No dependencies new combinations were identified as part of created or credited.

QU-C1, ASSESS the HR-G7 degree of dependence, and calculate a joint human error probability that reflects the dependence.

CNL-20-044 E3-43 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Recovery actions (at the cut set or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and feasible for those HR-H scenarios to which they are applied.

Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

Do not credit 6.4 The TMRE process was recovery actions to followed as described.

restore functions, Recovery actions to systems, or restore functions, systems, components or components were not HR- unless an explicit credited.

H1/H2 basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Each parameter shall be clearly defined in terms of the logic model, DA-A basic event boundary, and the model used to evaluate event probability.

CNL-20-044 E3-44 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Develop new basic 6.3, 6.5, 6.6 The TMRE process was events for tornado followed as described.

missile targets (all New basic events and failure modes) in flags were added to accordance with address all the failure DA-A1 this SR. modes of the safety related and nonsafety related system targets exposed to tornado missiles in accordance with the TMRE process.

The level 1 quantification shall quantify core QU-A damage frequency and shall support the quantification of LERF.

Do not credit 6.4 The TMRE process was recovery actions to followed as described.

restore functions, Recovery actions to systems, or restore functions, systems, components or components were not unless an explicit credited.

QU-A5 basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Model quantification shall determine that all QU-C identified dependencies are addressed appropriately.

CNL-20-044 E3-45 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Identify new 6.4 The TMRE process was operator action followed as described. No dependencies new combinations were created as a result created or credited.

of the changes to QU-C1 the internal events PRA model or failures associated with tornado events.

The quantification results shall be reviewed, and significant contributors to CDF (and LERF),

such as initiating events, accident sequences, and basic events QU-D (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

Review 7.3 The TMRE process was nonsignificant followed as described.

cutset or Cutsets were reviewed QU-D5 sequences to including significant and determine the non-significant cutsets to sequences are ensure the sequences are valid valid.

Review BE 7.3 The TMRE process was importance to followed as described. BE QU-D7 make sure they importances were make logical reviewed to ensure they sense. make logical sense.

CNL-20-044 E3-46 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Uncertainties in the PRA results shall be characterized.

Sources of model uncertainty and QU-E related assumptions shall be identified, and their potential impact on the results understood.

Identify sources of 7.1 The TMRE process was uncertainty related Also see followed as described.

QU-E1 to MIP and Appendices A missiles and B for bases.

Identify Section 6 The TMRE process was assumptions made followed as described.

that are different QU-E2 than those in the internal events model Identify how the 7.1, Appendix The TMRE process was model uncertainty A followed as described.

is affected by QU-E4 assumptions related to MIP and missiles The accident 7.1, 7.3 The TMRE process was progression followed as described.

analysis shall include LE-C identification of those sequences that would result in a large early release.

CNL-20-044 E3-47 of 50

Enclosure 3 TMRE - ASME PRA NRC Comments NEI 17-02 BFN TMRE Comments Standard Supporting (No comments Section Requirements Requiring if blank) Addressing Self-Assessment SR Do not credit Same comment 6.3, 7.2.3, The TMRE process was recovery of offsite as AS-A10 Appendix A followed as described.

power. Do not credit recovery actions to restore functions, systems, or LE-C3 components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

CNL-20-044 E3-48 of 50

Enclosure 3 Changes made Section 8 The TMRE process was for application of followed as described.

the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for each HLR. The Multiple documentation SRs should be sufficient to understand basis and facilitate review.

Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY- C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the change to the plants licensing basis.

CNL-20-044 E3-49 of 50

Enclosure 3

6. Conclusions on PRA Technical Adequacy The BFN PRA model is sufficiently robust and suitable for use in risk informed processes such as the TMRE. The peer reviews that have been conducted and the closure of findings from those reviews demonstrate that the underlying internal events PRA have been performed in a technically acceptable manner. Any open findings are dispositioned and documented for closure. The assumptions and approximations used in development of the PRA have also been reviewed and are appropriate for their application. Procedures are in place for controlling and updating the models and for assuring that the model represents the as-built, as-operated plant.

The conclusion, therefore, is that the BFN PRA model is acceptable to be used as the basis for risk-informed applications including the TMRE.

7. References

1. Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, March 2009.

2. NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, September 2017.

3. BFN Calculation NDN-000-999-2010-0001, BFN Probabilistic Risk Assessment - Summary Document, Revision 9.

4. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes To The Licensing Basis, January 2018.

5. NUREG/CR-4461, Tornado Climatology of the Contiguous United States, February 2007.

6. BROWNS FERRY UNITS 1,2,3 PRA Peer Review Report - Using ASME PRA Standard Requirements, Prepared by the Boiling Water Reactor Owners Group, August 2009.

7. Internal Flood PRA Peer Review for Browns Ferry Nuclear Plant, Prepared by ABS Consulting, R-2205685-1797, October 2009.

8. BFN Calculation NDN-000-999-2007-0041, QU - BFN Probabilistic Risk Assessment -

Quantification, Revision 10.

9. BFN Request for UFSAR Change - BFEP-CEB-89002, Revision 5, December 1989 (B22891211004).

10. BFN Calculation NDN-000-999-2007-0032, BFN Probabilistic Risk Assessment - Human Reliability Analysis, Revision 8.

11. BFN-0-18-143. BFN F&O Closure Review and Focus Scope Peer Review Reports.

B45181206001.

12. NEDP-26 Rev. 11, Probabilistic Risk Assessment.

13. NPG-SPP-09.11 R3, Probabilistic Risk Assessment Program.

14. NEDP-2 Rev. 20, Design Calculation Process Control.

15. SL-013478, BFN Tornado Vulnerability Summary Report, Revision 1.

CNL-20-044 E3-50 of 50