ML041910423

Response to Request for Additional Information (RAI) Regarding Severe Accident Mitigation Alternatives for Browns Ferry, Units 1, 2, and 3

ML041910423
Person / Time
Site:	Browns Ferry
Issue date:	07/07/2004
From:	Burzynski M Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC MC1768, TAC MC1769, TAC MC1770
Download: ML041910423 (100)

Text

Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402-2801 Jul, 7, 2004 10 CFR 54 10 CFR 51 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Stop: OWFN P1-35 Washington, D.C. 20555-0001 Gentlemen:

In the Matter of ) Docket Nos. 50-259 Tennessee Valley Authority 50-260 50-296 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION (RAI) REGARDING SEVERE ACCIDENT MITIGATION ALTERNATIVES FOR BROWNS FERRY NUCLEAR PLANT (BFN), UNITS 1, 2, AND 3 (TAC NOS. MC1768, MC1769, AND MC1770)

By letter dated April 28, 2004, the Nuclear Regulatory Commission (NRC) requested additional information to complete its review of the Tennessee Valley Authority's (TVA) analysis of severe accident mitigation alternatives submitted in support of TVA's application to renew the operating licenses for BFN, Units 1, 2, and 3. Enclosed is TVA's response to the NRC staffs RAI.

This letter contains no new commitments.

If you have any questions, please contact Chuck Wilson, Project Manager for BFN License Renewal Environmental Review, at (423) 751-6153 or clwilsonetva.gov.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 7th day of July 2004.

Sincerely, Mark rzynski Manager Nuclear Licensing A irpzj %r--,/

f-(

Enclosure cc: See page 2 Prted an cdd pam

U.S. Nuclear Regulatory Commission Page 2 July 7, 2004 cc: Ms. Eva A. Brown, Project Manager U. S. Nuclear Regulatory Commission MS 08G9 One White Flint, North 11555 Rockville Pike Rockville, Maryland 20852-2738 Mr. William F. Burton, Senior Project Manager U.S. Nuclear Regulatory Commission MS011F1 Two White Flint, North 11545 Rockville Pike Rockville, Maryland 20852-2738 Mr. Stephen J. Cahill, Chief U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW, Suite 23T85 Atlanta, Georgia 30303-8931 Yoira K. Diaz-Sanabria, Project Manager U.S. Nuclear Regulatory Commission MS 011-Fl Two White Flint, North 11545 Rockville Pike Rockville, Maryland 20852-2738 Mr. Kahtan N. Jabbour, Senior Project Manager U.S. Nuclear Regulatory Commission MS 08G9 One White Flint, North 11555 Rockville Pike Rockville, Maryland 20852-2738 Dr. Michael Masnik, Environmental Project Manager (wiEnclosure)

U.S. Nuclear Regulatory Commission MS 011F1 Two White Flint, North 11545 Rockville Pike Rockville, Maryland 20852-2738 cc: Continued on page 3

U.S. Nuclear Regulatory Commission Page 3 July 7, 2004 cc: NRC Senior Resident Inspector Browns Ferry Nuclear Plant 10833 Shaw Road Athens, Alabama 35611-6970 NRC Unit 1 Restart Senior Resident Inspector Browns Ferry Nuclear Plant 10833 Shaw Road Athens, Alabama 35611-6970 State Health Officer Alabama Department of Public Health RSA Tower - Administration Suite 1552 P.O. Box 303017 Montgomery, Alabama 36130-3017 U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW, Suite 23T85 Atlanta, Georgia 30303-8931

ENCLOSURE TVA RESPONSES TO NRC REQUESTS FOR ADDITIONAL INFORMATION (RAIs)

REGARDING ANALYSIS OF SEVERE ACCIDENT MITIGATION ALTERNATIVES (SAMA) FOR BROWNS FERRY NUCLEAR PLANT (BFN) UNITS 1, 2, AND 3 RAI

1. The SAMA analysis is based on the most recent version of the BFN Units 2 and 3 Probabilistic Safety Assessments (PSAs) for internal events, i.e., August 2003, which is a modification to the Individual Plant Examination (IPE) submittal. Please provide the following information regarding this PSA model:

la. Discuss any internal and external peer reviews of the Level 1 PSA, containment performance analysis, and offsite consequence model used for the SAMA analysis (beyond the 1997 peer review of an earlier PSA model).

Response

There have been no formal external peer reviews of the Level 1 PSA, containment performance analysis or offsite consequence model since the 1997 peer review. However, each of these elements has received formal and systematic technical review as discussed below.

There was a self-assessment performed on the BFN PSA in June 2001. The self assessment concluded:

The Thermal Hydraulic Analysis, Data, and Containment Performance Facts and Observations have been resolved and those sub-elements with a grade 2 are now considered to be reclassified to a sub-element grade of 3. This reclassification and the resolution of the recommended enhancements will result in the upgrade of the PSA to fully support Grade 3 applications.

All recommendations of the self-assessment have been completed.

Although not documented as a formal calculation, the PSA and supporting documentation has been prepared, checked, and approved by qualified individuals under the TVA QA program.

The users of the BFN PSA provide an additional source of formal review. The PSA is actively used to support operations and engineering. SPP 3.1 (describing the TVA Nuclear Corrective Action Program) provides a formal structured process to document and track the resolution of any finding, deficiency, or potential enhancement that might be identified during the course of application of the PSA. If such a finding, deficiency, or opportunity for enhancement is encountered, then a Problem Evaluation Report (PER) is created. The significance of the issue underlying the PER is evaluated and each PER, with appropriate corrective action dates, is tracked until appropriately resolved. These PERs are explicitly addressed during the PSA update process.

The updates of the Level 1 and 2 portions of the PSA have involved the use of different contractors assisting TVA. This practice has provided an additional degree of independent review during the evolution of the PSA by allowing additional PSA experts to be involved.

1

The MAAP computer code was used to support the thermal hydraulic and containment response analyses for the BFN PSA. The original analyses were performed in support of the BFN IPE.

These analyses were reviewed and reevaluated by an independent contractor in support of the development of PSA models that reflect EPU conditions. These models provide the bases for the PSA models used in the evaluation of potential SAMAs. The reevaluation using MAAP was conducted, verified, and checked by individual subject area experts.

The Browns Ferry site consequence model was prepared and checked by individual subject area experts. The analysis is formally documented in a TVA calculation.

2

RAI lb. Provide a characterization of the findings of the most recent peer reviews, and the impact of any identified weaknesses on the SAMA identification and evaluation process. Specifically, discuss those elements in Table VII-1 that were given Certification Grades of 2. Provide the facts and observations (F&Os) that led to these grades and discuss the impact of any unresolved issues on the SAMA analysis.

Also, indicate whether any Grade 3 elements were contingent on resolving any F&Os.

Response

The plant response to the BFN BWROG Certification and internal TVA comments per BFPER970822RO are compiled in the following reference. The certification issues are the A and B facts and observations. Excerpts from this reference are included below.

"Tennessee Valley Authority, Browns Ferry Nuclear Plant, Probabilistic Safety Assessment, Certification and Per Resolution," Revision 1, prepared by Erin Engineering and Research, Inc.,

August 2003.

1bl Response In general, the peer certification performed in 1997 summarized its overall assessment with the following recommendations:

Areas Requiring Enhancement: Areas that are deemed sufficiently important to address in the model are:

1. Use of plant-specific data for system unavailabilities

2. Incorporation of common cause miscalibration of low pressure interlock 3 Additional containment features (e.g., external ring header, EPAs) and loading issues (e.g., high blowdown)

4. Re-assessment of the truncation value in view of the large "unaccounted for" frequency.

5. Incorporation of containment flood and RPV vent into the Level 2 along with a definition of LERF consistent with the PSA Application Guide.

The quantification process could be developed in a more documented fashion to facilitate independent review by operations personnel.

Areas Recommended For Enhancement: The documentation structure of the updated PSA could be re-thought to ensure that those elements of the PSA that are described in older, outdated documents are maintained current. Specifically, reliance on the documentation from the IPE or other models that are not in use and may be outdated should be avoided. This is judged one of the principal areas where enhancement could occur to ensure that PSA quality continues into the future.

3

The five issues noted above have all since been resolved in the BFN models used for the SAMA identification and evaluation. The history of the model updates is provided in the response to RAI 1c.

• Plant-specific data has since been developed and used for all system unavailabilities.

• The HRA Update includes an analysis of CS/LPCI miscalibration.

• The Level 2 analyses were revised to reflect the latest knowledge of containment phenomenology and loading issues. This includes an evaluation of the suppression pool temperature at which containment failure may be expected for high discharge rates as would be expected during ATWS scenarios.

• The truncation value used during event tree quantification has been reassessed and justified.

• Consideration of containment flooding and RPV venting has been incorporated into the Level 2 modeling. The BFN Level 2 update incorporates the latest EPG/SAG guidance as reflected in the BFN EOIs and SAMGs.

• The issues of documentation described in the areas recommended for enhancement do not effect the SAMA evaluations, nor does the definition of LERF.

Mb2 Response The elements that were given Certification Grades of 2 in the peer review process at the exit meeting are:

• Data Analysis

• Thermal Hydraulic Analysis

• Containment Performance Analysis (L2)

In addition to the initial plant responses to the Findings and Observations provided in Appendix A, the following general comments are offered about these three topics.

The data analysis was reworked and plant-specific data was added using Bayesian Techniques.

Information from the maintenance rule program supplied the raw data used. Common Cause Analysis was also updated with generic information from the INEEL database (NUREG/CR-5497) along with plant-specific data.

Thermal Hydraulic Analysis was reevaluated for all the success criteria used for system performance and operator action time windows by an independent contractor not involved in the initial evaluation.

Containment Performance Analysis was also reevaluated. MAAP runs were later performed for all the containment states in question by an independent contractor not involved in the initial evaluation.

1b3 Response This part of the response addresses the Findings and Observations that led to the three PSA Elements rated 2. The Findings and Observations rated A or B in the peer certification for the above three elements are provided in Appendix A.

4

1b4 Response The PSA element, "Maintenance and Update Process (MU)," was given a conditional certification grade of 3. This grade was conditional on two recommendations: (1) that the PSA update process be revised to require reevaluation of prior applications following a model update, and (2) that the update process be revised to meet the requirements of TVA procedure SEP 9.5.8 for future updates. No other PSA element grades were conditional on any changes.

The one Finding and Observation for this sub-element is as follows:

Procedure SEP-9.5.8 requires that the PSA models be evaluated for updating every second refueling cycle. There is no firm requirement for updating the PSA models.

Plant Response Procedure SEP-9.5.8 requires a documented update evaluation of the PSA model every other refueling for the lead unit at each TVA nuclear site. This procedure provides the format, scope, and update criteria for this evaluation. This would include an explanation of why an update was or was not performed.

This process has been followed. The referenced 2003 TVA document describes the responses to each PER generated in addition to the Findings and Observations from the BWROG peer certification.

5

RAI ic. Provide more specific information relative to the reasons for the over one order of magnitude reduction in the BFNP Unit 2 core damage frequency (CDI') from the IPE value to the value used in the SAMA analysis, including major modeling and hardware changes.

Response

Browns Ferry Unit 2 IPE/PRA The BFN Unit 2 Probabilistic Risk Assessment (PRA)/Individual Plant Examination (IPE)

Revision 0 report was submitted to the U.S. NRC in 1992 to meet the requirements set forth in Generic Letter No. 88-20. The models were based on plant design as of December 1991. The mean CDF from the IPE/PRA was found to be 4.8 x 10-5 per year.

The IPE/PRA models were updated in 1994 and the Revision 1 report was issued in August 1994. It incorporated design changes made to the plant as of May 31, 1993, including hardened wetwell vent installation. In addition, the initiating event frequencies and diesel generator failure rates were updated using plant-specific data. TVA made some refinements to the Revision 1 PRA model and the PRA was updated to the Rev. IA model. The mean CDF from the Revision IA PRA model for BFN Unit 2 was found to be 7.6 x 106 per year. Although the three units share many important safety systems, these systems were considered to support Unit 2, as appropriate. In other words, Units 1 and 3 were assumed to be in lay-up. For the discussion below, the 1994 revision of the IPE is referred to as the "Unit 2 Rev IA PRA."

Multi-Unit PRA The NRC was concerned with the potential safety implications of shared systems in various operating modes of the BFN units; e.g., all three units operating, and Units 1 and 2 operating with Unit 3 shutdown, etc. In response to this concern, TVA performed a Multi-Unit PRA which bounds the various combinations of units in operation. The bounding plant configuration was identified to be the one in which all three units are in operation. The models developed for the Unit 2 Rev IA PRA were used as the starting point for the Multi-Unit PRA. The baseline configuration date for the Multi-Unit PRA was also May 31, 1993. The final report for the BFN Multi-Unit PRA was issued in March 1995 (Reference 3). The mean CDF for Unit 2 based on the Multi-Unit PRA was found to 2.8 x IO-, per year. The following summarizes the features of the Multi-Unit PRA:

Initiating Events

1. A new initiating event, Loss of 500kV to a single unit, was defined to differentiate it from the existing Loss of 500kV. The former initiating event was considered a single unit event, whereas the latter initiator means the loss of 500kV to the plant-i.e., to all three units.

2. The loss of control bay ventilation was considered an initiating event for the Multi-Unit PRA and included the following:

• Loss of 593 ft Level (RPS and UPS MG set rooms) HVAC

• Loss of Auxiliary Instrument Room HVAC 6

• Loss of Battery Room HVAC

• Loss of Chilled Water

• Loss of Relay Room HVAC

3. The following support system initiators affected by multi-unit operations due to changes in system success criteria were:

• Loss of Plant Control Air

• Loss of Reactor Building Closed Cooling Water to All Unit 2 Loads

• Loss of Raw Cooling Water These initiators were evaluated using fault tree models.

4. The following initiating event frequencies were reevaluated for the Multi-Unit PRA based on the relevancy and correctness of event data for multiple unit operation:

• Turbine Building Flood

• Emergency Equipment Cooling Water Pump Room Flood

• Loss of 500-kV to a Single Unit

• Loss of 500-kV Grid to the plant Frontline and Support Event Trees Changes to the event tree models are summarized below:

1. Electric Power Support Event Tree (ELECT 12). The likelihood that the grid is lost following the separation of three units from the grid in a relatively short window of time was modeled in the event tree.

2. Actuation Signal Event Tree (SIGL). Two new top events CASG and ACM were added to this event tree representing the likelihood that a Unit 1/Unit 2 common accident signal is present and the likelihood that a unit (other than Unit 2) is experiencing an event, respectively.

3. Mechanical Support Event Tree (MESUPT). A new top event RBCIS was added to this event tree to differentiate whether nonessential loads were isolated, thereby impacting the EECW success criteria.

4. HVAC Event Tree (HVAC). This was a new event tree which models the impact of loss of control bay ventilation. Support systems to the control bay HVAC and certain operator recovery actions (such as opening room doors locally) were also modeled in this event tree.

5. Low Pressure Frontline System Event Tree (LPGTET). The event tree was revised to question all the RHRSW heat exchangers. This was necessary to address the new success criteria for the RHRSW for multi-unit operation.

7

System Analysis The success criteria of the following systems were impacted by multi-unit operation and were reevaluated:

• Electric Power System

• Control and Service Air System

• Raw Cooling Water System (RCW)

• Fire Protection System

• Reactor Building Closed Cooling Water System

• Control Bay Ventilation

• Control Rod Drive Hydraulic System

• Standby Coolant Supply System

• Residual Heat Removal Service Water System (RHRSW)

• Emergency Equipment Cooling Water System (EECW)

Success Criteria Success criteria were revised to reflect multi-unit operation as summarized below:

• Control and Service Air System requires three compressors in operation

• RCW System requires four of six pumps

• Degraded conditions in other unit impact operator action to isolate Reactor Building for Unit 2

• Additional standby coolant supply to RHR Loop I from RHRSW pumps BI and B2; Unit 3 RHR pumps 3A and 3C available to support Unit 2 suppression pool cooling

• At least two RHR pumps supplying cooling water to the associated heat exchanger

• If Unit 1 and 3 remain in operation and the diesels are not running, then three of four EECW pumps are required; if RCW is available, then 2 of 4 EECW pumps are required Component Failure and Common Cause Component failure rates and common cause failure factors for HVAC Chillers were developed.

Also, the conditional likelihood of the LOSP given multiple units trip offline was developed.

Human Action Analysis The following human error rates were developed in support of the modeling of the operator recovery actions considered for the Control Bay HVAC system:

• Recover Unit 1/2 Chiller

• Restore Cooling to the Relay Room

• Restore Cooling to the Elevation 593 Control Bay Area

• Restore Cooling to the Main Control Room 8

Unit 2/3 PRA In 1996, a reassessment of BFN Unit 2 PRA was performed to reflect the then current operational configuration of the BFN plant. Unit 1 was assumed to remain in extended lay-up with no fuel in its core. In addition, Unit 3 was modeled in the analysis as either operating at power or in an outage. This PRA is referred to as the Unit 2/3 PRA for the discussion below, and the PRA model reflected a condition that is bounded by the multi-unit configuration. The Revision 1 report for his study was issued in May 1996. The mean CDF for this Unit 2/3 PRA model was found to be 5.4 x IOb per year.

The starting point for the Unit 2/3 PRA model was the Unit 2 Rev IA and the Multi-Unit PRA models. As in the case of the Multi-Unit PRA, the Unit 2/3 PRA was developed through changes made to the system success criteria, changes in the initiating event frequencies, or changes in the plant model with respect to those in the Unit 2 Rev IA PRA. Therefore, changes implemented for the Multi-Unit PRA were also applicable to the Unit 2/3 PRA. However, some of the system success criteria, initiating event frequencies and changes to the plant model were different from those of the Multi-Unit PRA. The following summarizes the changes made to the Unit 2/3 PRA that were different from those discussed for the Multi-Unit PRA:

1. The loss of Control Bay HVAC initiator modeled in the Multi-Unit PRA was excluded from the Unit 2/3 PRA since its contribution to the total CDF was determined to have an insignificant impact on the total CDF.

2. In place of a single turbine building flood initiating event defined for the Unit 2 Rev 1 PRA, two turbine building flood initiating events were defined. The first initiating event (FLTB) involved a very large flood which fails the feedwater system, condensate system, RCW system, and the plant control air. The second turbine building flood initiating event (FLTB2) is less severe and fails only the feedwater and condensate systems. Only the operating equipment and systems associated with Units 2 and 3 were assumed to be capable of causing a flooding event.

3. The models for the battery board top events DE, DH and DG were refined to exclude contribution from simultaneous maintenance of battery boards 2 and 3 to the system unavailability. Such configuration is not allowed per technical specifications. Also included in the PRA was the modeling of the shifting of loads from battery board 2 or 3 to battery board I when battery board 2 or 3 is taken out of service for maintenance purposes.

4. The RBCCW pump and heat exchanger IC can be used by either Unit 2 or 3.

5. Unit 3 diesel generator 3ED was credited to support Unit 2 only in selected scenarios in which at least two other Unit 3 diesel generators are available to support Unit 3.

6. The availability of Unit 3 RHR pumps 3A and 3C to support Unit 2 suppression pool cooling is dependent on the status of Unit 3.

7. Credit was taken for transferring the suction of HPCI or RCIC from the suppression pool to the condensate storage tank (CST) and providing makeup to the CST, given failure of suppression pool cooling.

9

8. In the Multi-Unit PRA, and for transient conditions, success of RHRSW requires at least two pumps supplying cooling water to the associated heat exchangers. In the Unit 2/3 PRA, success of RHRSW requires one pump per unit (not on the same header) for transient conditions.

9. For EECW, two of four pumps not on the same end of a header were required for success.

10. Recovery of the main condenser was considered for scenarios in which the reactor vessel was initially isolated.

11. Local operation of the wetwell vent was considered for selected scenarios which included station blackout conditions.

12. Manual closing of 2-inch primary containment vent lines in accordance with emergency operating instructions was considered.

13. Operator error rates for the above operator actions were evaluated 10

PSA Rev 0 The BFN Unit 2/3 PRA was updated in 2000 and the Summary Report for this update was issued in March 2002. This PRA model is referred to as the BFN PSA Rev 0 model in the discussion below. The mean CDF for the PSA Rev. 0 model was found to be 1.3 x 10-6 per year for Unit 2 and 1.9 x 10-6 for Unit 3. The following summarizes the changes made to the Unit 2/3 PRA model:

1. Incorporate all applicable design changes at BFN through May 31, 1999. The most significant design change incorporated was the installation of digital feedwater control. The system fault tree models were updated, as appropriate. Changes in the Technical Specifications were also reflected in the system analyses.

2. Incorporate plant-specific data including the latest common cause failure information. The Maintenance Rule Program database at BFN provided all the plant experience for the component failure rate and maintenance unavailability update. For many important components, the planned and unplanned maintenance unavailabilities were developed and used in the update.

The common cause failure factors (MGL) for all major components were developed based on NUREG/CR-5497 and the associated database. This involved the screening of the common cause failure events in the database for applicability to BFN. Common cause modeling (with associated MGL factors) was performed for batteries and battery chargers.

3. Initiating event grouping and frequencies were updated based on NUREG/CR-5750. The initiating events relating to instrument tap failures were removed from the model. These initiating events were previously modeled to address certain licensing issues which are no longer considered because BFN has four reference legs for its instruments instead of two legs.

4. Loss of unit preferred power no longer results in the loss of feedwater. This initiating event was also deleted from the model. In addition, flood initiating event FLPH1 (EECW Pump Room flood resulting in the loss of one EECW and two RHRSW pumps) previously assumed to cause a reactor scram and was deleted from the model.

5. The human error probabilities (HEPs) for the existing operator actions were reevaluated using the enhanced version of the EPRI Cause-Based Decision Tree approach (EPRI TR-100259). The reevaluation was also performed to more fully reflect current Emergency Operating Instructions, plant-specific system time-windows, and sequence dependencies.

6. Model changes were made as a result of the resolution of outstanding BFN PSA Certification Facts and Observations Extended Power Uprate PSA In 2004, the Browns Ferry extended power uprate (EPU) was incorporated into the PSA model.

The summary reports for this revision of the PSA were issued in February 2004. The mean CDF was found to be 2.6 x 106 per year. The most significant design changes incorporated in this revision of the PSA were the EPU project and digital turbine electro-hydraulic control 11

(EHC) installation. The following changes were made to the PSA models when incorporating the EPU into the models:

1. Due to the increase in thermal power, the use of CRD system was not credited as an effective injection source when the vessel remains at high pressure and other high pressure injection sources have failed.

2. Because of the increase in thermal power some operator actions were reevaluated due to the change in the event sequence timing. Example of operator actions that were reevaluated were:

Operator inhibits ADS during ATWS with isolated/unisolated vessel Operator initiates SLCS with isolated/unisolated vessel

3. The component failure rates for selected components and initiating event frequencies were updated using data that included more recent plant-specific experience.

4. The common cause parameters of the MGL model were reevaluated by rescreening the data events from NUREG/CR-5497. Some generic MGL factors (i.e., not derived by event screening for plant applicability) were taken from the NUREG report.

Summary The Table below compares the chronology and the associated CDFs from the various revisions of the Browns Ferry Unit 2 IPE/PRA/PSA.

Table ic-i PRA Year Unit 2 Mean CDF (per year)

IPE Rev 0 1992 4.8 x 10-5 IPE Rev IA 1994 7.6 x 10-Multi-Unit PRA 1995 2.8 x 10--

Unit 2/3 PRA 1996 5.4 x 1i' Unit 2 PSA Rev 0 2002 1.3 x 10-6 EPU PSA 2004 2.6 x I0-'

12

RAI id.Section II of the Environmental Report (ER) presents the results of the consequence analysis in terms of release categories (fable 11-7).Section III (Tables 111-3 and III-

4) discusses and presents the results of the Level 1 analysis in terms of key plant damage states (KPDS). The basis for the KPDS is given to be the BFNP IPE. Please explain why the release categories have the same identifier as the key plant damage states, and provide more information concerning the mapping of key plant damage states to release categories.

Response

Release categories have the same identifier as the key plant damage states to provide clear traceability from one to the other. The release categories have a one-to-one relationship with the KPDSs.

Additional Clarification (provided via e-mail June 10, 2004 from Robert Palla):

Id: Explain in more detail (including providing a logic diagram or logic rules and/or examples using the dominant sequences) how the core damage sequences were assigned to the plant damage states. For example, how were the assignment of general transient initiated sequences to PDSs MIA, MKC, and MLC (all of which, according to Figure 4.6-1 of the IPE, are stated to have water to cool the core debris and drywell sprays available) determined? Also, please explain the determination of the contributors to PDS PIH which is described in Table III-5 as a SBO. Why don't LOSP initiated sequences contribute to this PDS?

Response

The plant damage state naming conventions are as described in Figure 4.3-1 of the BFN IPE report. These plant damage states define the entry conditions for the Level 2 analysis. The first character M refers to all plant damage states in which core uncovery occurs with the reactor vessel initially at high pressure and water on the drywell floor. The three plant damage states questioned here all have the first character M.

The second character of the plant damage state name describes the status of the containment at the time of core uncovery. The second letter, I, indicates that the containment is intact, K indicates that the containment is not isolated or fails early from events considered in the Level 1 model, and L refers to an expected late containment failure due to failure of containment cooling.

The third character of the plant damage state name refers to the combined status of four events:

water to core debris, drywell spray availability, suppression pool cooling availability, and whether the torus vent is available. For the condition A, water is available to the core debris, drywell sprays are available, suppression pool cooling is available, and the torus vent is not needed. For the condition C, water is available to the core debris, and drywell sprays are available but there is no suppression pool cooling and the torus vent is not available. When the containment is expected to fail late, it is assumed that neither suppression pool cooling nor the torus vent is available.

The PSA software RISKMANO assigns the proper plant damage state to each sequence based on logic rules defined by the analyst in terms of the specific initiating event name and the status of 13

top events along each individual sequence path. There are 37 such plant damage states considered in the Unit 2 BFN model. Since the rules are identical for Unit 3, only the Unit 2 rules are discussed here. For purposes of illustration, the following three PDSs mentioned in the RAI (i.e. MIA, MKC, and MLC) are discussed.

The three plant damage state assignment rules for the general transient tree are evaluated in order from top to bottom as follows:

SUCCESS NOCD=S MIA HPRESS*DWS=S*NOATWS*SPCOOL MKC ((RPS=F*-SL=S)+(CE=F+TOR=F)*RVD=F)*DWS=S MLC HPRESS*NOATWS*DWS=S Where the following logic macros are defined in terms of top events as follows:

HPRESS -INIT=IOTV*(-OF=S+RVD=F)

NOATWS RPS=S+SL=S SPCOOL SP=S+SPR=S The first rule found to be successful for the given sequence, defines the plant damage state to be assigned. If the sequence does not result in core damage (NOCD=S), then the end state assigned is SUCCESS.

In the above, an ATWS condition, resulting in high reactor vessel pressure, is said to exist if the reactor protection system fails and standby liquid control is not actuated (RPS=F*-SL=S). No ATWS condition exists when the reactor protection system is successful or the standby liquid control system is successful (RPS=S+SL=S). High pressure exists when there is not an ATWS, only if the initiator is not the inadvertent opening of two or more SRVs (-INIT=IOTV) and there is no manual control of feedwater or a failure of reactor depressurization (-OF=S+RVD=F). The assignment rule for each of the three plant damage states, therefore, requires a high pressure condition.

The M condition only holds if the reactor vessel is at high pressure and water has been injected to the drywell floor when core uncovery occurs. Water is injected to the drywell when DWS=S, as indicated in the logic for all three plant damage states.

For MIA, suppression pool cooling is said to be successful when it is initially available, or recovered in time (SP=S+SPR=S). Success of suppression pool cooling results in an intact containment. The success of drywell sprays ensures that water also reaches the core debris, fulfilling the conditions for A.

For MKC, either the ATWS condition leads to early failure of containment or the containment is not isolated early (CE=F). This fulfills condition K. Drywell sprays are working, which ensures water to the core debris, fulfilling the conditions for C.

For MLC, the assignment logic is similar to that for MIA except that no mention is made of suppression pool cooling (SPCOOL). Sequences with the same logic as that for MLC but with suppression pool cooling are assigned to MIA. Only similar sequences without suppression pool cooling fail to satisfy the rule for MIA and must evaluate assignment rules lower in the list. The 14

rule for MLC has an implied failure of suppression pool cooling which is assumed to result in late containment failure, fulfilling the conditions for L and C.

Per Figures II-1 and III-2 of the SAMA analysis report for Units 2 and 3 respectively, the plant damage states MIA, MKC, and MLC (row one of the tables) differ in that MIA refers to an intact containment, MKC to an un-isolated or failed early containment, and MLC is subject to late containment failure.

To illustrate this assignment to plant damage states further, we now discuss the highest frequency sequence to each of the three plant damage states for Unit 2.

For MIA, the highest frequency sequence begins with a loss of condenser heat sink (LOCHS).

MSIVs are assumed to close and feedwater and condensate are not available. RCIC and HPCI both fail and the operators fail to initiate reactor vessel depressurization, leaving the reactor at high pressure. Suppression pool cooling is available and aligned. Drywell spray also functions and the containment successfully isolates.

For MKC, the highest frequency sequence begins with a transient (TRAN). Reactor protection system fails and the operators fail to actuate standby liquid control. Pressure is therefore initially high, but the MSIVs remain open. Feedwater and condensate are assumed unavailable.

Suppression pool cooling is available and successfully aligned. Drywell sprays actuate successfully. A large primary containment isolation failure is assumed (i.e. early containment failure) because the MSIVs remain open.

For MLC, the highest frequency sequence is initiated by a transient also (TRAN). The main condenser fails, precluding turbine bypass control and continued feedwater. HPCI and RCIC both operate successfully. RHR heat exchangers A, B, C, and D all fail, as do the RHR cross-ties to Units 1 and 3. This precludes suppression pool cooling. The operators also fail to align the vent path. Drywell spray operates successfully.

A simplified event tree illustrating the assignment of sequences to these plant damage states is provided below.

15

I. HPRES GENERAL TRANSIENT I

NO ATWi j

_ I _ _ _ _

IJ SPCOOL I

NO EARLY CONT.

FAI L UREI DRYWELL SPRAY PDS IE NO YES YES NO FAILURE YES MIA ATWS NO NO NO FAILURE YES MLC

'NOT NO I DEVELOPED NOT DEVELOPED ATWS YES ASSUMED NO FAILURE YES FAILED I NO FAILURE YES MKC NO NOT DEVELOPED Table III-5 of the SAMA analysis report lists a typical sequence for plant damage state PiH as a "Loss of offsite power with no recovery and failure of all onsite AC power sources. HPCIIRCIC runs successfully until DC power source fails." Table III-5 is actually referring to the definition of key plant damage states in the BFN IPE and the corresponding definition of cases for which MAAP runs were made at that time.

In the updated models for BFN, the plant damage state assignment rules remain the same, but the contribution of sequences to these plant damage states has changed. In the Unit 2 model, the frequency of plant damage state PIH is only 1.44x10-12 per year. This total comes from one sequence. The one sequence is initiated by an inadvertent opening of two or more safety relief valves (i.e., IOTV initiator), the failure of two 250v DC buses (top events DH and DG) and the independent failure of the condensate system (top event CD). Suppression pool cooling and drywell spray are eventually failed and a release path through the drywell results with the reactor building being ineffective as a removal mechanism. This sequence resembles a station blackout, but is not. For the Unit 3 model, the frequency of PIH is zero (i.e., no sequences greater than Ix10- 2 are assigned to it).

Station blackout sequences without recovery for Unit 2 are instead mapped to plant damage state MEB in the BFN models used for identification and evaluation of SAMAs. Plant damage state MIB has success of drywell spray. This is possible even though the Unit 2 diesels are failed and offsite power is not recovered, because a Unit 2 shutdown board is powered via the cross-tie to Unit 3. The frequency assigned to plant damage state MIB is later evaluated along with plant damage state MIA per Figures III-1 and III-2. The consequence assessment for MIA was conservatively assumed to result in containment failure even though drywell sprays are working.

16

RAI le. The grouping of plant damage states into KPDS used in the Level 2 analysis is shown in Figures III-1 and 111-2. In a number of cases, plant damage states of a higher frequency are characterized by a KPDS of significantly lower frequency.

For example, NIG is characterized by NIH, PJA is characterized by PJH and MLC is characterized by PLF. Justify this characterization and discuss its impact on risk.

Response

The level 1 model quantification identifies Plant Damage States (PDSs) that will occur with some frequency. The frequency for each PDS is shown in Figures 1I1-1 and III-2 for Unit 2 and Unit 3, respectively. For the level 2 analysis, these PDSs are condensed into a reduced set of Key Plant Damage States (KPDSs). The frequency for each KPDS is provided in Tables III-3 and III-4 for Unit 2 and Unit 3, respectively, and is equal to the sum of the frequencies of all of the level 1 PDSs mapped to that KPDS. For example, the frequency associated with KPDS NIH is the sum of the frequencies for PDSs NIH, NIE, NIF, NIG, and OEF. In general, PDSs are mapped to a KPDS that is conservative based upon phenomenological parameters. A few PDSs, with very low relative frequencies (less than a few percent) are mapped to nonconservative KPDSs. The overall results of the selection of KPDSs, condensation of PDSs to KPDSs, and the use of conservative MAAP models for each KPDS results in a conservative overestimate of risk.

17

RAI if. Provide a breakdown of the population dose (person-rem per year within 50 miles) by containment release mode, such as containment isolation failure, early containment failure, late containment failure, and no containment failure.

Response

Table 11-7 of the SAMA analysis report provides the mean population dose within 50 miles for each release category. The release categories have a one-to-one relationship with the KPDSs.

The frequency for each KPDS is provided in Tables III-3 and III-4 of the SAMA analysis report for Unit 2 and 3, respectively.

The population dose person-rem per year for the above containment release modes for Unit 2 and Unit 3 are presented in the Tables below. Note that KPDSs MIA and OIA actually represent containment success; however, for the purpose of the SAMA, the containment is assumed to fail early for KPDS MIA, and late for KPDS OIA.

Table If-1 Unit 2 Ponulation Dose Per Year (Within 50 Miles)

Containment Release Mode KPDS Mean Frequency Population population (per year) Dose per year Dose (Person-rem (Person- per year) rem)

Containment Isolation Failure or Early Containment Failure NIH 7.57E+05 2.70E-08 2.05E-02 PIH 3.59E+06 3.18E-10 1.14E-03 PJH 2.02E+05 4.64E-08 9.37E-03 MKC 5.56E+06 1.10E-07 6.14E-01 Total 6.45E-01 Late Containment Failure PID l 6.96E+04 l 2.38E-10 1.65E-05 PLF 3.69E+05 3.01 E-07 1.11E-01 Total 1.11E-01 No Containment Failure OIA l 2.88E+06 l 4.78E-08 1.38E-01 MIA 3.56E+05 2.09E-06 7.44E-01 8.82E-01 Total 18

Table lf-2 Unit 3 Population Dose Per Year (Within 50Miles)

Containment Release Mode KPDS Mean Frequency Population population (per year) Dose per year Dose (Person-rem (Person- per year) rem)

Containment Isolation Failure or Early Containment Failure NIH 7.57E+05 1.20E-07 9.12E-02 PIH 3.59E+06 1.94E-10 6.96E-04 PJH 2.02E+05 4.64E-08 9.37E-03 MKC 5.56E+06 1.1 E-07 6.16E-01 Total 7.16E-01 Late Containment Failure PID 6.96E+04 2.21 E-10 1.54E-05 PLF 3.69E+05 4.23E-07 1.56E-01 Total 1.56E-01 No Containment Failure OIA 2.88E+06 4.95E-08 1.43E-01 MIA 3.56E+05 2.61 E-06 9.29E-01 1.07 Total 19

RAI 1g. Provide the contributions to CDF, large early release frequency (LERF), and KPDS from anticipated transient without scram (ATWS) and station blackout (SBO) events.

Response

The contributions to CDF, LERF, and each of the eight KPDSs from ATWS and SBO events are provided in the series of tables presented below.

Table lg-l Contributions to CDF, LERF, and KPDS from ATWS CDF LERF MIA MKC NIH OIA PID PIH PJH PLF Unit 2 2.30E-07 2.17E-07 8.71E-08 1.IOE-07 4.69E-10 1.75E-08 2.38E-10 9.25E-11 O.OOE+00 1.39E-08 Unit 3 2.33E-07 2.20E-07 8.98E-08 1.IOE-07 4.84E-10 1.81E-08 2.21E-10 1.06E-10 0.00E+00 1.43E-08 Table lg-2 Contributions to CDF, LERF, and KPDS from SBO CDF LERF MIA MKC NIH OIA PID PIH PH PLF Unit 2 3.66E-08 1.21E-10 3.54E-08 O.OOE+00 9.59E-10 0.00E+00 0.00E+00 O.OOE+00 O.OOE+O00 2.04E-10 Unit 3 3.88E-08 1.26E-10 3.76E-08 0.00E+00 1.03E-09 O.OOE+00 O.OOE+00 O.OOE+00 O.OOE+00 2.22E-10 20

RAI

2. To assure that the set of SAMAs evaluated in the ER addresses the major risk contributors for BFNP, please provide the following:

2a. Provide the quantitative results of importance analyses that show the relative contribution to risk from systems, equipment, and human actions. Include the importance of the operator failing to inhibit auto depressurization following an ATWS.

Response

The contributions from systems, equipment, and human actions to CDF are presented in the Unit 2 and Unit 3 summary reports (References 1 and 2, respectively). Important operator actions and systems, with respect to risk, were presented in Table 1-5 and Table 1-6 of the summary reports.

To identify potential SAMA candidates, the importance ranking from the summary reports and a review of the highest frequency CDF and LERF sequences from the Unit 2 and Unit 3 PRA models were utilized to identify groups of sequences contributing to CDF and LERF. These sequence groups are listed in Section V of the SAMA report. Ten groups were identified for both CDF and LERF. Tables 2a- 1, 2a-2, 2a-3 and 2a-4 provide a cross-reference between these groups and the system and operator actions identified in Table 1-5 and 1-6 of the Unit 2 and Unit 3 summary reports.

The importance of the operator failing to inhibit auto depressurization following an ATWS (i.e., Top Event OAD) was not listed in the Unit 2 or Unit 3 summary reports. The probabilistic importance or Top Event OAD is provided below.

Top Event OAD Probabilistic l Importance Unit 2 CDF Unit 3 CDF 6.8E-03 5.3E-03 Probabilistic importance is calculated as the frequency of all core damage scenarios involving the failure of Top Event OAD, divided by the total core damage frequency.

21

Table 2a-1 Unit 2 CDF Significant Groups - Cross-Referenced to Important Human Actions and Systems i Group Contributors to Unit 2 Core Damage Human Action S_st No. Description ORVD2 OLP4 [U32A OSP HPCI RCIC[FW/CNDJ DG JMS I RPS IRHR CRDl RHRSW I SLCS I CS 1 Failure of MFW/HPCI/RCIC short-term and x X X X failure of the operator to timely depressurize 2 Failure of MFW/HPCI/RCIC short-term and X x x x X _

hardware failures preventing timely depressurization. I 3 Station Blackout x x x = = = _

4 ATWS with failure to control pressure X (allowing an uncontrolled injection by low pressure systems) 5 ATWS with failure of the operator to Initiate SLC in a timely manner x 6 ATWS with hardware failure of SLC _ x X 7 Interfacing system LOCA 8 TW (successful operation of HPCI/RCIC for X X - _ X 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> but failure of suppression pool c~ooling) _ _ _ _ _ __ _ _ __ _ _ _ _ _ _ _ _ _

9 Other failures (operator action) of X X X _ -

suppression pool cooling I 10 Degraded electrical power conditions (e.g., - -

two Unit 1/2 or two Unit 3 diesel failures) IXI__ =

22

Table 2a-2 Unit 2 LERF Significant Groups - Cross-Referenced to Important Human Actions and Systems Group No. Human Action _ _ _ _ e Contributors to Unit 2 Large Early Release ORVD2 OLP4 U32A OSP HPCI RCIC 1FW/CND DG MS[ RPS RHR CRDl RHRSW II RHRSW } SLCS CS Descrition _ _ _ _ - -

• ATWS with failure of the operator to Initiate X SLC in a timely manner I II 2 Failure of MFW/HPCI/RCIC short-term and x X X X failure to depressurize (with failed containment) I I I 3 interfacIng system LOCA 4 AIWS with hardware failure of SLC _ l l X X 5 AWlS with failure to control pressure _

(allowing an uncontrolled injection by low pressure systems) _____

6 ATWS with failure to control low pressure X injection (following successful pressure

,ontrol) 7 ATWS with failure of suppression pool X X X x cooling I II 8 JATWS with RHR pump failure _ = _l_l X X =

9 Excessive LOCA __T l___I 10 LOCA with loss of level control X X 23

Table 2a-3 Unit 3 CDF Significant Groups - Cross-Referenced to Important Human Actions and Systems Group Contributors to Unit 3 Core Damage Human Action l Systems No. Description ORVD2 OLP2/3/4 lOSP U22 HPCI RCIC X[ FW/CND MS RHR RPS CS RHRSW II CRDJ RHRSW I SLCS 1 Failure of MFW/HPCI/RCIC short-term X _ -X X .. = C -

and failure of the operator to timely x depressurize 2 Failure of MFW/HPCI/RCIC short-erm X X X X X _

and hardware failures preventing timely depressurization.

3 Station Blackout x x x _

4 ATWS with failure to control pressure _X (allowing an uncontrolled injection by low pressure systems) 5 A1WS with failure of the operator to nitiate SLC In a timely manner x 6 ATWS with hardware failure of SLC _ _ _ __X _ x 7 Interfacing system LOCA __ ___

8 TW (successful operation of x x . - _ X _

HPCI/RCIC for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> but failure of SuDpreSsion pool cooling) 9 Other failures (operator action) of X X X - _

____ suppression pool cooling 10 Degraded electrical power conditions X _ _

(e.g., two Unit 1/2 or two Unit 3 diesel failures) 24

Table 2a4 Unit 3 LERF Significant Groups - Cross-Referenced to Important Human Actions and Systems Group Contributors to Unit 3 Large Early Human Action I-Systems No. Release: Description ORVD2 OLP2/3/4 OSPlU22 HPCI lRCIC lDGl FW/CND MS RHR RPS CSl RHRSW II CRD RHRSW I l SLCS 1 ATWS with failure of the operator to X Initiate SLC In a timely manner 2 Failure of MFW/HPCIURCIC short- X _ X X _ X _ _ _ -

temm and failure to depressurize (with failed containment) _ _

3 Interfacing system LOCA 4 ATWS with hardware failure of SLC == === X - X 5 ATWS with failure to control pressure X (allowing an uncontrolled injection by low pressure systems) 6 AiWS with failure to control low X pressure injection (following successful pressure control) 7 ATWS with failure of suppression X X _ _

pool cooling X 8 AThS with RHR pump failure = _ _ X X _

9 Excessive LOCA 10 LOCA with los of level control e X 25

References

1. Browns Ferry Nuclear Plant Probabilistic Safety Assessment, Unit 2 Summary Report, RI.

2. Browns Ferry Nuclear Plant Probabilistic Safety Assessment, Unit 3 Summary Report, RI.

26

RAI 2b. For each dominant contributor identified in 2a (above), provide a cross-reference to the SAMA(s) evaluated in the ER that address that contributor.

Response

The response to RAI 2a demonstrated how categories or groups of contributors to CDF and LERF were developed based on a review of the Unit 2 and Unit 3 PSA results. In the event that appropriate generic SAMAs did not address the plant-specific risk contributor, BFN specific SAMAs were developed based on these CDF and LERF scenario groups.

The scenario groups identified for CDF and LERF contributors are listed in Section V of the ER and are repeated in the table below. The table below also identifies the SAMA(s) evaluated in the ER that address the contributor groups.

Table 2b-1 No. Description of CDFILERF Categories Candidate SAMA Evaluation(s)

CDF I Failure of MFW/HPCI/RCIC short-term and failure of the operator to BOl, B02, B15 timely depressurize CDF 2 Failure of MFW/HPCI/RCIC short-term and hardware failures preventing B03, B15 timely depressurization.

CDF 3 Station Blackout B04, BI1, G12, G15 CDF 4 ATWS with failure to control pressure (allowing an uncontrolled injection B05 by low pressure systems)

CDF 5 ATWS with failure of the operator to initiate SLC in a timely manner B06 CDF 6 ATWS with hardware failure of SLC B07 CDF 7 Interfacing system LOCA B08A, B08B CDF 8 TW (successful operation of HPCI/RCIC for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> but failure of B09, G02, G06 suppression pool cooling)

CDF 9 Other failures (operator action) of suppression pool cooling B10 CDF 10 Degraded electrical power conditions (e.g., two Unit 1/2 or two Unit 3 B04, BI 1, G12, G15 diesel failures)

LERF I ATWS with failure of the operator to initiate SLC in a timely manner Same as CDF 5 LERF 2 Failure of MFW/HPCI/RCIC short-term and failure to depressurize (with Same as CDF I failed containment)

LERF 3 Interfacing system LOCA Same as CDF 7 LERF 4 ATWS with hardware failure of SLC Same as CDF 6 LERF 5 ATWS with failure to control pressure (allowing an uncontrolled injection Same as CDF 4

____by low pressure systems)

LERF 6 ATWS with failure to control low pressure injection (following successful B12 pressure control)

LERF 7 ATWS with failure of suppression pool cooling BlO, B13 LERF 8 ATWS with RHR pump failure G09, G17 LERF 9 Excessive LOCA B14 LERF 10 LOCA with loss of level control B12, G17 27

RAI 2c. In ER Section V.B, degraded electrical power conditions are identified as a major contributor to CDF. Likewise, in Section V.C, a loss of coolant accident (LOCA) with loss of level control is identified as a major contributor to LERF. Identify which SAMAs were evaluated to address these major contributors.

Response

Sections V.B and V.C listed the top 10 contributor categories to CDF and LERF, ranked by relative contribution. Degraded electrical power conditions and LOCA with loss of level control were ranked 10th to CDF and LERF, respectively.

Please refer to the response to RAI question 2b for the SAMAs evaluated to address these contributors.

28

RAI 2d. The list of BFNP-specific SAMAs is based on the review of the contributors to CDF and LERF from the Unit 2 and 3 PSAs. These PSAs assume that Unit 1 is not operating, and therefore, the list of potential SAMAs does not consider the potential impact of Unit 1 operation. The impact of Unit 1 operation would be expected to significantly change the importance of various contributors to risk and might add contributors that are not currently considered in the identification of BFNP-specific SAMA candidates. For example, the Multi-Unit PRA indicates that the top two sequences are initiated by an internal flood in the turbine building and by loss of raw cooling water. However, neither of these sequences are listed in Section V.B as important contributors to total CDF. Thus, SAMAs that address important risk contributors from multi-unit operation may have been overlooked. Please Identify the important contributors to each unit's CDF and LERF based on risk information that considers the impact of Unit 1 operation. Discuss whether consideration of the multi-unit risk information leads to identification of any additional SAMAs not included in the ER.

Response

The turbine building flood initiating event and its impact on the plant as modeled in the Multi-Unit PRA was overly conservative and had been revised. In the current PSA, two turbine building flood initiating events were defined in place of the single initiator. The first initiating event (FLTB) involves a very large flood that is severe enough to fail the feedwater system, condensate system, the Raw Cooling Water (RCW) system, and the plant control air. The second turbine building flood initiating event (FLTB2) is less severe and fails only the feedwater and condensate systems. Since only operating equipment and systems associated with units in operation could cause a flooding event, the frequencies of these initiators, given that Unit 1 is also operating, would be about 50 percent higher than the frequencies of the flooding initiating events used in the SAMA evaluation. Contributions to total CDF from the turbine building flood initiators remain small relative to other initiators. No additional SAMAs need to be considered based on the refinement of the turbine building flood initiating events.

With Unit 1 in operation, the success criteria changes for the RCW system by requiring more RCW pumps to provide flow to plant loads. Each unit has three pumps for regular service. The number of RCW pumps operating at any time in each unit depends on the intake culvert temperature. For three units operating at full power, the number of RCW pumps in operation can vary from as few as three pumps in the winter months to as many as eight pumps in the summer months. From the system analysis of the RCW, the contribution of RCW pump failures to the system unavailability and loss of RCW initiating event frequency is not dominant even with very conservative success criteria for the RCW pumps. Therefore, with Unit 1 in operation the expected increase in the loss of RCW initiating event frequency is not significant. No additional SAMAs pertaining to loss of RCW need to be considered.

The dominant contributor to CDF for the Multi-Unit PRA is the loss of offsite power. This initiating event contributes about 39 percent to the total CDF. SAMAs associated with degraded electrical power and Station Blackout (SBO) are listed in Table 2b-1.

29

RAI 2e. As discussed in Section VII of the ER, operation of Unit 1 is assumed to result in an increase in Unit 2 and 3 CDF by factors of 4 and 2 respectively. The rationale for increasing the mean CDF for Unit 2 is provided in Section VII.6 and is based on the ratio of the total CDF from the Multi-Unit PRA to the single unit PRA for Unit 2.

However, the rationale for increasing the Unit 3 CDF by a factor of two is not supported. Provide additional justification for using a factor of two increase in the Unit 3 CDF to account for the operation of Unit 1.

Response

As indicated in Section VII.B of the ER, the association of Unit 1 with Unit 2 is much closer than the association of Unit 1 with Unit 3. For example, Units 1 and 2 share four diesel generators, while Unit 3 has four diesel generators. The impact of Unit 1 operation on the CDF of Unit 3 is expected to be much less than the impact on the CDF of Unit 2.

Using the response to RAI question lc as a point of reference, it can be seen that the impact of Unit 3 restart upon Unit 2 CDF (Unit 2/3 PRA versus IPE Rev. 1A) is completely masked by other changes to the PSA, leading to the conclusion that the multi-unit effect between Units 2 and 3 is small. The most significant shared system is the electric power system. Thus, the multi-unit effect between Units 1 and 3 is expected to be similar to or smaller than the multi-unit effect between Units 2 and 3. A very conservative factor of two, based on engineering judgment, was selected to quantify the multi-unit effect between Unit 1 and Unit 3.

30

RAI

3. As mentioned in RAI 2e above, the operation of Unit 1 is accounted for by increasing the Unit 2 and 3 CDF by factors estimated from the Multi-Unit PRA.

These factors represent the estimated increase in Unit 2 and 3 total CDF due to changes in success criteria and system availability resulting from Unit 1 operation.

These increases (or even larger increases) would occur in some sequences but not in others. For example, from Table 1-1 of the Multi-Unit PRA, Unit 1 operation results in an increase in CDF of a factor of seven for loss of offsite power initiated sequences, a factor of five for internal flood initiated sequences, and a factor of 34 for support system failure initiated sequences. This could significantly affect not only the selection of candidate SAMAs (addressed in RAI 2.d) but also the calculated benefits for candidate SAMAs involving these scenarios. Please discuss the sequence-specific impact of Unit 1 operation on the benefit analyses of the candidate SAMAs, particularly for those SAMAs that involve sequences for which the impact of Unit 1 operation can be expected to be greater than the total CDF increase factors of four and two for Units 2 and 3, respectively:

Response

Section VII of the SAMA analysis report describes the technical bases to account for Unit 1 operation on the Unit 2 and Unit 3 CDF by referencing results from the Multiple-Unit PSA for BFN performed in 1995.

PLG, Inc., "Browns Ferry Multi-Unit Probabilistic Risk Assessment," prepared for Tennessee Valley Authority, PLG-1045, Volume 1, Main Report, March 1995. (An earlier version was dated January 1995.)

The bases for the factors of four and two used to represent the increase in CDF for Units 2 and 3 respectively to account Unit 1 operation are described in the response to RAI 2e.

This RAI refers to factors on CDF developed from Table 1-1 of the above Multi-Unit PSA reference which shows the following:

31

Table 3-1 Initiating Multi-Unit PRA Rev. 1A PRA Ratio Event Group CDF CDF Loss of Offsite 1.E-5 1.5E-6 7.3 Power Internal Floods 6.1E-6 L.1E-6 5.5 Support System 5.8E-6 1.7E-7 34.1 Failures I These entries are for the top three ranked sequence groups in Table 1-1. All other sequence group frequencies in Table 1-1 differ little between the Rev.IA and Multi-Unit PSAs. Specific initiating events do show greater differences in the contribution to CDF than the averages of four and two. SAMAs directed at reducing the CDF from these specific initiating events might conceivably reduce the CDF for three-unit operation more than estimated using the average factors of four and two for Units 2 and 3 respectively. On the other hand, SAMAs that address general plant response issues, such as emergency depressurization, would apply to a wide range of sequences from a variety of initiating events such that the average CDF factor is more applicable.

Briefly, it will be shown that for most sequences grouped by an initiating event, the increase in CDF caused by three-unit operation is still small enough that the absolute contribution to CDF is less than lxIO-7 per reactor year, and that such a small contribution can not be cost-effective.

For other initiators, where the absolute contribution to CDF is greater than 1x10- 7 and the difference between three-unit and single unit operation is more than a factor of four, it will be shown that the differences reported are unrealistically conservative.

The maximum cost avoidance for initiators which contribute only lxI -7 per reactor year to the CDF can be bounded by using the same methods as portrayed in section VI of the SAMA evaluation report. A sequence of lx1( 7 represents 3.8 percent of the Unit 2 baseline total CDF.

The evaluation for SAMA B18 indicates that a 3.8 percent reduction in Unit 2 CDF corresponds to an avoided cost of approximately $8k for Unit 2 at a 3 percent discount rate. This figure is comparable to the "Maximum Cost Avoidance (Base Case)" column in Table VIII-1 of the SAMA analysis report. The results are smaller than the cost of implementing procedural changes (the least expensive type of SAMA evaluated) suggesting that no SAMA that addresses these contributors alone can be cost-effective.

The Multi-Unit PRA referenced above quantifies higher CDF values when all three units are assumed to be in operation. These higher CDF values result from shared systems that potentially must respond to an initiating event. Among the shared systems are:

• Diesel generators

• Emergency equipment cooling water system (EECW)

• Residual heat removal service water system (RHRSW)

• Raw Cooling Water (RCW)

These systems can be particularly important for loss of offsite power scenarios, but their being shared between units does not appreciably affect sequences in which only one unit must respond.

32

Table 3-2 of this response compares the CDF contributions from individual initiators analyzed by both the Multi-Unit PRA assuming all three units are operating, and the Rev. 1A PRA with Units 1 and 3 assumed not to be operational. The initiators are ranked by the ratio of their contribution to the CDF for the two cases. Only the Multi-Unit PRA initiators which have an increase of more than IxI0 8 per reactor year (i.e., well below the 1x10-7 per reactor year contribution shown to be small above) are listed.

For most of the initiators in the Table 3-2, the ratio of the Multi-Unit PRA CDF for three-unit operation with that for the Unit 2 alone is less than four. Such an increase is adequately covered by the average CDF factors already applied (i.e., factor of four for Unit 1, a factor of four for Unit 2 and a factor of two for Unit 3) for the screening costs to account for three-unit operation.

The CDF contribution from the initiator Loss of Raw Cooling Water (LRCW) does differ substantially between the three-unit operating case analyzed with the Multi-Unit PRA and for the model where Unit 2 operates alone. As seen in Table 3-2, the ratio is a factor of 76.

Examination of the Multi-Unit PRA results for three units operating reveals that the key failures resulting in core damage due to a loss of RCW involve: failure of all four RHR pumps (ranked sequence 2 to CDF) or all four heat exchangers (sequence 6), or failure of two 250V DC control power sources for the 4kv SD boards 3EP and 3EC (sequence 10). In the Multi-Unit PRA with all three units operating, no credit was assumed for the RHR cross-tie between Units 2 and 3.

Substantial credit is given for this RHR cross-tie (i.e., operator action failure rate is 2.9x1 0-2) in the single unit PRA. In truth, the Multi-Unit PRA is conservative to not assume credit for the RHR cross-tie under the condition of a loss of all RCW. In addition to the four RHR pumps on Unit 2, there are an additional four RHR pumps on the unit to be cross-tied, and only two of the four have to work for the cross-tie to be successful. Based on the failure rates of the pumps and heat exchangers, the operator action to align the cross-tie is most limiting for success of the cross-tie between units of RHR. The factor of 76 increases on LRCW contribution to CDF caused by three-unit operation, suggested by the earlier multi-unit analysis, is highly conservative. A realistic assessment of the factor, accounting for the RHR cross-tie is likely to be closer to 2.0, and certainly no greater than a factor of four on the LRCW contribution only.

For this reason, the factor of four for Unit 2 and factor of two for Unit 3 adjustment factors for three-unit operation used in Table VIII-l is deemed appropriate and even conservative for LRCW scenarios.

The EECW pump room flood (FLPH1) has been deleted as an initiator since development of the Multi-Unit PRA. The reason for the deletion is that following such an occurrence there would be no automatic shut down of the plant, and no reason to manually shutdown.

The flood analyzed for the reactor building (FLRB 1) has a contribution to CDF ratio of 26.5, but this is only applied to a sequence frequency that is very small. Applying this factor to the EPU PSA baseline result of 3.59x10 9 for the larger result for Unit 3, the maximum CDF contribution is still less than lxI0-7 per reactor year. As has been shown, SAMAs that address these scenarios will not be cost-effective.

The initiator Loss of Offsite Power (LOSP) changes its contribution to the CDF by a factor of 7.3, between the three-unit operation, Multi-Unit PRA, and that for the single Unit 2 PRA. This factor is largely due to the omission of credit for recovery of electric power within six hours in the Multi-Unit PRA study. Realistically, substantial credit for recovery of electric power within six hours is expected. If this additional recovery action were to be credited in the Multi-Unit 33

PRA, the differences with the single unit model contribution to CDF would be much less, and certainly less than the factors of two and four assumed in the cost comparison. We therefore conclude that the factors of two and four used in the cost evaluation are appropriate, and likely overstate the affects of three-unit operation on the projected reductions in CDF.

Floods in the turbine building (FLTB and FLTB2) are what lead to a factor of 5.5 increase resulting from internal floods. However, since the development of the Multi-Unit PRA, the frequency of these floods has been revisited. The single large flood scenario has been divided into two scenarios. FLTB2 (a small flood) only affects feedwater and condensate for one unit.

The other units are assumed to have a response bounded by the initiating event category Inadvertent Scram. The large flood, FLTB, affects all three units through its impact on the RCW system and plant control air, but it now has a much lower frequency than estimated in 1995.

Experiential evidence has been reviewed to reduce the frequency of all turbine building floods, and in addition, a large portion of the current turbine building flood frequency is instead assigned to FLTB2, for small floods which have a less severe impact when compared to the large flood, FLTB. The result of these revisions is that the contribution to CDF from FLTB for Unit 2 (and for Unit 3) is now approximately a factor of 100 lower than estimated in 1995. Applying the factor 5.5 to the latest CDF contributions for Unit 2 or 3 for FLTB results in a small absolute contribution to CDF (i.e., less than lxl- 7 per reactor year). For small turbine building floods, FLTB2, the incremental effect on the nonflooded units is bounded by a 6 percent increase in the frequency of Inadvertent Scram. Applying the factor 5.5 results in a small absolute contribution to CDF (i.e., less than lxI0-7 per reactor year).

34

Table 3-2 Differences Between Initiator CDF Contributions from Three Unit and Single Unit ODeration Sorted by CDF Ratio Initiator Bounding E 1995 Unit CDF CDF SAMA SAMA Multi-Unit 2 CDF Difference Ratio Unit 2 Unit 3 CDF Loss of Raw Cooling Water 5.530E-06 7.24E-08 5.458E-06 76.38 6.77E-08 8.03E-08 (LRCW)

EECW Pump Room Flood (1 1.010E-07 2.71 E-09 9.829E-08 37.27 Deleted Deleted EECW and 2 RHRSW Pumps Lost (FLPH1)**

Flood in RB-1 (FLRBI) 5.670E-08 2.14E-09 5.456E-08 26.50 3.45E-09 3.59E-09 Loss of Offsite Power (LOSP) 1.080E-05 1.48E-06 9.320E-06 7.30 4.82E-07 1.05E-06 Large Flood in Turbine 5.970E-06 1.11 E-06 4.860E-06 5.38 1.62E-08 1.95E-08 Building (FLTB)

Small Flood in Turbine N/A N/A N/A N/A 7.53E-08 1.07E-07 Building (FLTB2)

Loss of 500kV to Plant 1.290E-07 0 1.290E-07 3.30 3.91 E-08 4.46E-08 (L500PA)

Loss of RBCCW (LRBCCW) 1.680E-07 0 1.680E-07 2.80 6.01 E-08 6.02E-08 Turbine Trip (TRAN) 7.000E-07 5.48E-07 1.520E-07 1.28 6.75E-07 7.05E-07 Loss of Plant Air (LOPA) 8.670E-08 7.52E-08 1.150E-08 1.15 5.17E-08 5.15E-08 Inadvertent SCRAM 2.150E-07 1.9E-07 2.500E-08 1.13 8.99E-08 9.42E-08 (ISCRAM)

Loss of Feedwater (LOFW) 5.71 OE-07 5.22E-07 4.900E-08 1.09 5.11 E-08 5.1 5E-08 Turbine Trip Without Bypass 4.360E-07 4.24E-07 1.200E-08 1.03 5.72E-07 5.67E-07 (TTWB)*

Loss of Condenser Vacuum 4.780E-07 4.68E-07 1.000E-08 1.02 5.72E-07 5.67E-07 (LOCV)*

Subsumed into (LOCHS) - Loss of condenser heat sink.

Deleted since event does not cause requirement for plant shutdown.

35

RAI

4. The SANMA analysis did not include an assessment of SAMAs for external events, or account for the potential reduction in external event risk from candidate SAMAs.

The BFNP IPE for external events (IPEEE) study has shown that the CDF due to internal fire initiated events is about 9.8x10 4 per year for Unit 2, and 7.4x1O4 per year for Unit 3, which are factors of 3.7 and 2.2 greater than the internal events CDF for Units 2 and 3, respectively. In addition, the risk analyses at other commercial nuclear power plants indicate that external events could be large contributors to CDF and the overall risk to the public. In this regard, the following additional information is needed:

4a. For candidate SAMA B16 it is indicated that no fire-related SAMAs were quantitatively evaluated since no modifications were required as a result of the IPEEE. NUREG-1742 lists two fire zones (Unit 2) and one fire zone (Unit 3) for which the CDF is greater than 1x10 4 per year and 11 additional zones (Units 2 and

3) with CDF contributions of more than lx10 7 per year. For each fire area, please explain what measures were taken to further reduce risk, and explain why these CDFs cannot be further reduced in a cost-effective manner.

Response

At BFN, no plant modifications were done in response to the IPEEE fire analysis.

The CDF values from the significant fire areas of BFN as listed in Table 3.3 of NUREG-1742, Volume 2, represent the results of a progressive screening analysis using the EPRI FIVE approach. In this methodology, fire areas/zones/compartments were screened out if, during any phase of the analysis, the fire induced CDF is < IE-06. That is, the fire area/zone/scenario is not evaluated any further. Due to the conservative nature of this evaluation, the CDF values listed in Table 3.3 of NUREG-1742, Volume 2, should be considered as upper-bounding values only.

The mean CDF due to fire-related initiating events in each of these fire areas is judged to be considerably lower than these values.

Some of the fire-induced CDF values in Table 3.3 of NUREG-1742, Volume 2, are associated with big fire areas in the plant (e.g., the reactor buildings of Unit 1 through Unit 3). In these fire areas the CDF values listed are equal to the sum of the CDF contributions from individual fire scenarios that were defined and analyzed for the fire areas.

The CDF value listed for the Unit 2 reactor building is the sum of the CDF values of many fire zones contained in the reactor building. Most of the fire zones/scenarios evaluated for the Unit 2 reactor building had CDF values of less than 1.OE-07 per year. Only the following fire scenarios had CDF values less than the screening CDF value of 1.OE-06 per year, but greater than IE-07 per year.

36

Fire Area Ignition Source Screening CDF (per year)

Fire Zone 2- Shutdown Board Room HVAC Compressor 2.63E-07 4- 593' Motor South and RHR Heat Exchanger Rooms Fire Zone 2- RCIC Auxiliary Control Panel 2-LPNL-025-0031 2.88E-07 5 -621' and 240V Lighting Transformer TL2A 7.17E-07 North Side of 639' Similarly, the value listed for the control room is the sum of all the fire scenarios postulated within the main control room as shown in the table below (Reference 1).

Control Fire Scenario CDF (per year)

Unsuppressed fire in a Critical Cabinet - Control 1.04E-07 Room Evacuation Suppressed fire in a Critical Cabinet 4.42E-08 Unsuppressed fire in a Non-Critical Cabinet - 5.14E-08 Control Room Evacuation _

It was assumed that all fires cause a plant trip, and that for the unsuppressed fire in a cabinet, evacuation of the control room is required. Core damage was conservatively assumed to occur if the operators failed to evacuate the control room. For critical cabinet fire scenarios, core damage was also assumed to occur if the remote shutdown capability is lost. There are five critical panels/cabinets and 45 noncritical panels/cabinets. This gives a total control room fire-induced CDF of 3.05E-06. However, the CDF for each individual control room fire scenario is less than the screening CDF value of L.OE-06 per year.

To address potential SAMAs affecting fire-initiated core damage sequences, the two highest frequency fire-initiated CDF sequences were analyzed (Unit 2 and Unit 3 MCR fires).

A SAMA for control room fire is a redundant remote shutdown panel. For the purpose of SAMA analysis, the above control room fire scenario CDF values are assumed to be the mean values. By implementing this SAMA the mean CDF is estimated to be reduced by 2.66E-07 per year. For this evaluation, it is assumed that the impact on the plant due to a fire in the control room is similar to that of the General Transient initiating event. The results are shown in the table below.

37

UNIT 2 AND UNIT 3 SAMA FOR CONTROL ROOM RESULTS MAAP Case Unit 2 Unit 3 MIA 1.89E-07 1.82E-07 MKC 2.92E-08 2.79E-08 NIH 6.91E-10 4.31E-10 OIA 1.91E-09 1.88E-09 PID 1.76E-11 1.68E-11 PIH 0.0 0.0 PJH 0.0 0.0 PLF 4.53E-08 5.41E-08 Reduction in Person-rem 0.252 0.246 SAMA Saving (3%) $32,906 $32,390 SAMA Saving (7%) $21,788 $21,418 The maximum cost avoidance for the impact of three-unit operation is about $328k/plant. This is much less than the total cost of redundant remote shutdown panels--one for each unit. The cost of this SAMA which essentially involves the reproduction of the MCR in fit, form, and function is estimated to be in excess of $5M/plant. Note that, the impact of uncertainty is not factored into the estimation of the cost avoidance since this has already been accounted for by assuming the screening CDF value as the mean CDF value.

Reference

1. Browns Ferry Nuclear Plant - Units 1, 2, and 3 - Partial Response to Request for Additional Information Regarding Browns Ferry Nuclear Plant Individual Plant Examination for External Events (TAC NOS. M83595, M83596, M83597),

November25, 1998.

38

RAI 4b. For candidate SAMA B17 it is indicated that no seismic-related SAMAs were quantitatively evaluated since all outliers as a result of the seismic IPEEE have been resolved. The conclusion from the IPEEE that no further modifications were necessary was not made on the basis of a cost benefit analysis and it cannot be concluded that none would be cost-effective if they were quantitatively evaluated.

Please discuss the results of the seismic IPEEE from the standpoint of potential SAMAs for the SSCs with the lowest seismic margins, and provide an assessment of whether any SAMAs to increase the seismic capacity of these limiting components would be cost beneficial. Also, confirm that the two transformers in the DG building that were identified in NUREG-1742 have been replaced. If not, please provide an explanation.

Response

The seismic IPEEE evaluation program at BFN was performed using EPRI Seismic Margin Assessment (SMA) methodology (Reference 2) that is considered acceptable by the NRC for addressing seismic concerns in the severe accident policy implementation (Reference 1). The SMA methodology was designed to demonstrate sufficient margin over the Safe Shutdown Earthquake (SSE) to ensure plant safety and to find any weak links that might limit the plant shutdown capacity to safely withstand a seismic event larger than the SSE. This approach defines and evaluates the capacity of those components required to bring the plant to a stable condition and maintain that condition for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The seismic IPEEE Review Level Earthquake (RLE) of BFN was defined to be 0.3g focused scope (Table 3.1 of Reference 1).

The BFN seismic IPEEE used the screening criteria in Reference 2 to screen out the seismically rugged structures, systems, and components (SSCs). Thus, the screened out SCCs have a High Confidence of Low Probability of Failure (HCLPF) capacity of at least 0.3g peak ground acceleration (PGA) and no further evaluations were performed for them. For the unscreened SSCs, BFN performed component-specific calculations to determine their HCLPF capacities.

The 4kv/480V transformers TDA (equipment number O-OXF-219-TDA) and TDB (equipment number 0-OXF-219-TDB) were determined to have the lowest HCLPF capacity of 0.26g which is slightly lower than the RLE of 0.3g. TVA had made a commitment to replace these two transformers as part of the long-term asbestos material removal program (Reference 3). The transformers are scheduled for replacement. Thus, upon replacement of the transformers, the BFN SSCs will have seismic HCLPF capacity of at least 0.3g PGA. This lower bound HCLPF capacity of 0.3g is limited by those screened-out seismically rugged SSCs. The actual HCLPF capacity of these screened-out SSCs could be significantly higher than 0.3g if component-specific evaluations were performed.

References:

1. NUREG-1404, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, Final Report, June 1991.

2. EPRI NP-6041-SL, A Methodology for Assessment of Nuclear Plant Seismic Margin (Revision 1) August 1991. Electric Power Research Institute.

39

3. Letter from Pedro Salas (TVA) to the U.S. Nuclear Regulatory Commission, Dockets 50-260 and 50-296, June 28, 1996, Browns Ferry Nuclear Plant Units 2 and 3 - Generic Letter (GL) 87-02, Supplement 1, Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46 and GL 88-20 Supplement 4, Individual Plant Examination of External Events (LPEEE) for Sever Accident Vulnerabilities - Submittal of Seismic Evaluation Reports (TAC Nos. M69432, M83596, and M83597) 40

RAI

5. As indicated in RAI 4, TVA has not accounted for any contributions to risk from external events. The fire CDF is almost a factor of four greater than the internal events CDF for Unit 2 and a factor of at least two greater than the internal events CDF for Unit 3, which suggests that the estimated benefit for the SAMAs should be increased by at least a factor of four and two, respectively, to account for external events. In order to determine if external events have been satisfactorily accounted for, please provide the following information:

5a. the current CDF for fire initiated events, and 5b. an assessment of the impact on the initial and the final screenings if the internal events risk-reduction estimates are increased by a factor that would bound the risk from fire and seismic events.

Response

As discussed in the response to RAI 4a, BFN does not calculate a CDF for fire-initiated events.

BFN addressed the fire portion of IPEEE by using the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology. FIVE provides a method to determine the availability of plant equipment by evaluating the combination of events that lead to fire damage and loss of a safe shutdown function. The objective of FIVE is to identify potential plant vulnerabilities from fires that could result in the loss of safe shutdown functions necessary to maintain reactivity, coolant inventory, and decay heat removal to prevent damage to the core. The FIVE method uses a series of screening steps to meet the objective. The process for a given location is terminated when the frequency of losing a safe shutdown function is less than IE-6/reactor year. The sum of these frequencies is not a CDF for fire-initiated events. To use the sum of these frequencies as a surrogate to CDF by fire initiated events is inappropriate.

A CDF from fire-initiated events can be calculated in a fire PRA. There is no NRC requirement to perform such an evaluation.

With respect to the request to assess the impact of increasing the internal events risk-reduction estimates to bound the risk from fire and seismic events, such an assessment is inappropriate.

Such an evaluation contains an implicit assumption that the SSCs important to the risk from internal events have equivalent importance to the risk from fire and seismic events. There is no basis for such an assumption. An assessment based on this assumption is likely to be misleading.

For example, SAMAs proposed to address a main control room (MCR) fire are quite different from SAMAs proposed to address station blackout.

41

RAI

6. The impact of uncertainty on the SAMIA evaluations was considered by increasing the benefits by a factor of three, which is approximately the ratio of the 9 5 th percentile CDF to the mean CDF. This same factor will not, however, apply to the specific accident sequences that are affected by the various candidate SAMAs. For example, the uncertainty in the ATNVS sequence would be expected to be significantly higher than the uncertainty in the total CDF. Please qualitatively discuss the appropriateness, conservatism, and non-conservatism of the use of a single value of three for the evaluation of the impact of uncertainty on the benefits of all candidate SAAIAs, and the effect of using a more appropriate, sequence-specific uncertainty factor on the results of the cost-benefit evaluation for each SAMA.

Response

The mean CDF used in the SAMA candidate evaluations is a best estimate that does account for uncertainty in the quantification inputs (i.e., initiating events, split fractions, failure rates, etc.).

The mean CDF used in the SAMA candidate evaluations is a best estimate that does account for uncertainty in the quantification inputs (i.e., initiating events, split fractions, failure rates, etc.).

The avoided cost of a SAMA calculated using the mean CDF is, in fact, the proper value to compare to the estimated implementation cost. Use of any CDF value above the mean is a conservative treatment.

In the case of the baseline CDF results, the 9 5 th percentile is approximately a factor of three higher than the best estimate mean value. Therefore, there is a five percent probability that the CDF is greater than three times the mean value. At the other tail of the distribution, the 5h percentile is a factor of five lower than the mean value, therefore there is also a 5 percent probability that the CDF is less than one fifth of the mean value.

Although it is true that the ratio of the 9 5 th percentile to the best estimate mean value will vary for different CDF sequences or sequence groups, the value of three used in the SAMA evaluations is a reasonable value to use for all cases. The SAMAs selected for evaluation will generally affect a large number of sequences, where there is no "dominant" sequence, but many small contributors. For sequences or sequence groups that may be expected to have broader uncertainty than the total CDF, one would expect an extension of the upper tail of the core damage distribution. The impact of this tail is accounted for in the calculated mean value, such that the ratio of the 9 5 th percentile to the mean is not likely to change dramatically.

It is very unlikely that the conclusions of the SAMA cost-benefit analysis would have been affected by a sequence-specific uncertainty analysis.

42

RAI

7. In evaluating the candidate SAMAs, the benefits and implementation costs are compared on a per site rather than per unit basis. Since the benefit is higher for Units 1 and 2, a SAMA which may not be cost-beneficial for all three units may still be cost-beneficial for Units 1 and 2. Similarly, it may be less expensive to implement a SAMA at Unit I than at the other units if it can be implemented as part of other planned modifications. Confirm whether any SAMAs that were not cost-beneficial on a per site basis might be cost-beneficial if: (a) only implemented at Unit 1, or (b) only implemented at Units 1 and 2.

Response

No SAMAs were determined to be cost-effective if implemented only for Unit 1 or for Units 1 and 2.

The avoided cost for each phase H SAMA, if implemented for Unit 1 and for Units 1 and 2, was compared to the implementation cost for a single unit and for two units, respectively. The avoided cost for each SAMA was maximized by using a three percent discount rate and the 95th percentile CDF, including the effects of a multi-unit site. The potential for reduced implementation costs at Unit 1 is addressed in the response to RAI question 13.

43

RAI

8. Please provide the following information concerning the MACCS2 analyses:

8a. The meteorological data used in the MACCS2 analysis was for the year 1980.

Explain why more recent data was not used. Confirm that the 1980 data set is representative for the BFNP site and justify its use.

Response

Meteorological data used in the SAMA analysis was taken from the site meteorological tower for the year 1980. Yearly rainfall for the years 1971 through 2003 were statistically analyzed and compared to the year 1980 rainfall which was wetter than average, but within one standard deviation of the average. Use of more recent data would not yield a more accurate prediction of weather expected for the term of license renewal. The correlation coefficient (r2 ) of the rainfall to year is only 0.05, indicating that there is no meaningful trend to the data.

Justification for the use of data from year 1980 is as follows:

• Rainfall data for the year 1980 has a very high data recovery rate, with less than 0.5%

bad data for which interpolation was required.

• Year 1980 was slightly wetter than average. Large numbers of early fatalities and injuries are normally associated with local rainfall. Therefore, use of the 1980 rainfall data is both representative and conservative.

• There is no meaningful trend for yearly total rainfall as a function of time.

• The meteorological data input into the MACCS2 model was recorded at the site.

44

RAI 8b. On Page E-405 of the ER it is stated that the current design basis core inventory is provided in Table II-3. However, the ER goes on to say that data from three distinct fuel types each representing extended power uprate (EPU) conditions are provided in the table. Clarify which condition and power level is represented in the table (current versus planned EPU). Confirm that the fission product inventory input to the MACCS2 code calculations represents the inventory for the highest burnup and fuel enrichment expected at BFNP during the renewal period.

Response

MACCS2 code calculations were performed for three fission product inventories. The three cases are denoted in the SAMA analysis report as "GE Uprated," "Framatome Commercial," and "Framatome Blended LEU." The fission product inventories were developed for an average bundle thermal power level of 5.28 MWth, representative of EPU. Core wide fission product inventories were generated at fuel exposure values provided in Table II-3 of the SAMA analysis report. The core wide fission product inventory, rather that the highest burnup fuel bundle inventory, is appropriate for events involving core wide fuel damage. Fuel enrichment values used to generate the fission product inventories were 4.6 w/o for GE Uprated, 4.5 w/o for Framatome Commercial, and 4.95 w/o for Framatome BLEU.

45

RAI 8c. Table VI1-3 was developed to answer past RAIs or refer the staff to those sections of the ER that address the past RAIs. The table entry for 5a suggests that a detailed evacuation analysis has not been performed. In addition to the delay time, list the other assumptions used for evacuation for each of the release categories/MAAP cases, including: time general emergency is declared, time of core melt (for each release), percent of population evacuated, and radial evacuation speed.

Response

The time for general emergency and several times relating to core melt are shown in the following table. The time for general emergency is referred to in MACCS2 as the warning time and is labeled as such. Core melt happens over a time period which starts at core uncovery, and can be considered complete when the core plate fails and the reactor vessel fails, which occur in quick succession.

Warning 1 Core Core Melt Events Core Plate Vessel Release MAAP Time Uncovered Failure Failure Category Model s s s s MKC MKCTT 600.0 1559.6 8361.5 8371.5 PIH PIHDEP _14400.0 30705.9 44477.8 44490.1 0IA OIA 994.3 8009.7 18166.5 18177.6 NIH NIH 600.0 23400.7 34350.1 34363.0 PLF PLF 14251.5 20080.8 34377.5 34389.1 MIA MLLF 2627.7 2627.7 11207.4 11220.4 PJH PJHNSP 600.0 1303.4 4917.2 4928.3 PID PID 600.0 1906.0 78428.7 78449.2 Table 8c-1. Warning and core melt times.

The analysis assumed that 95 percent of the population within 10 miles was evacuated radically at an average speed of 0.234 m/s (meters per second) after a two hour delay referenced to the alarm. This would mean, for instance, that for release category PJH that the evacuation would begin 7800 seconds after accident initiation. Evacuees were assumed to stop moving at a distance of 20 miles. The remaining 5% of the population was assumed to continue with normal activities.

46

RAI

9.Section IV.E of the ER describes the calculation of replacement power costs. A correction factor of 1190 MWe/910 MWe was applied to account for the size of the units relative to the "generic" reactor described in NUREG/BR-0184. However, it is not clear if the 1190 MWe is for the current plant rating or for the rating of the plant after the EPU. Clarify for which power level the replacement power costs were calculated.

Response

The projected electrical output from BFN for EPU conditions is 1248 MWe for Unit 1 and 1250 MWe for units 2 and 3. Using 1250 MWe for each of the three units and a discount rate of 3 percent, the calculated replacement power avoided cost increases 5 percent and the total avoided costs increase 1.6 percent for Unit 2 and 1.7 percent for Unit 3.

The avoided cost basis for each phase II SAMA was reviewed. The disposition of each SAMA was determined to be unaffected by the change in the power correction factor.

47

RAI

10. For the low cost alternative of a direct-drive diesel to power an AFW pump, TVA states that the maximum benefit is on the order of $100K/unit (see Table VIII-3, item 6c). The benefit does not include the impact of Unit 1 operation or the additional risk reduction in external events. If the impact of Unit 1 operation is included, as in the SAMA evaluations performed, it would make this modification cost-beneficial. Please discuss.

Response

The maximum benefit cited was based on the best estimate avoided cost of a motor-driven feedwater pump. A direct-drive diesel does not eliminate reliance upon electrical power. In addition, a diesel engine inside the reactor building poses considerable adverse risk from fire which outweighs its risk reduction potential. Therefore, this SAMA is judged to not be cost-effective.

The HPCI and RCIC turbine-driven pumps are located on the lowest elevation in the reactor building. Each system is flow-controlled by varying the output of the turbines via governor valves. The systems are dependent upon DC power. The torus room, the corner rooms, and the HPCI room are all within secondary containment, and have low combustible loadings.

The proposed SAMA involves either replacement of the HPCI and RCIC steam turbines with direct-drive diesel engines or addition of a direct-drive diesel engine to the existing power train.

A direct-drive diesel engine located in the basement of the reactor building would require supporting equipment to operate.

a. A control system, similar to that existing for HPCI and RCIC, would be necessary.

Such a control system would be dependent upon plant DC power.

b. The proposed SAMA would require air intake and exhaust ductwork and, depending upon the specific design, intake and exhaust fans, also dependent upon AC or DC power.

c. The exhaust ductwork would have to be vented outside the reactor building, posing a need for containment isolation valves and associated logic for operation. Note that the existing secondary containment isolation logic activates upon receipt of either a low water level or high drywell signal. Also note that, typically, containment isolation valves are designed to fail closed upon loss of power.

d. Area cooling would likely be required, creating a dependency upon EECW and AC power.

The torus room, corner rooms, and HPCI room currently have low combustible loadings.

Addition of diesel engines, associated tankage, and fuel supply piping would significantly increase the combustible loading in those locations jeopardizing separation of safe shutdown equipment located in adjoining fire zones.

48

RAI

11. For the Phase 2 SAMAs, the following information is needed to better understand the modification and/or the modeling assumptions:

11a. Candidate SAMA B01 is described as automating the opening of selected SRVs in response to the unavailability of high-pressure level control. The estimated cost to accomplish this is given as $1.5Ilunit. The installed automatic depressurization system (ADS) already accomplishes this function. Discuss how this SAMA would be different than the ADS and indicate why the cost is so high.

Response

Phase II SAMA BOI, Automate Depressurization, is intended to supplant operator action to initiate and control emergency depressurization in accordance with the Emergency Operating Instructions (EOIs). As such, the SAMA can be thought of as a "smart" ADS. Such a system would use existing relief valves, but would require many more input parameters than the existing ADS, and a programmable controller capable of emulating a licensed operator following the EOIs - thus the associated complexity and cost.

49

RAI 1ib. Candidate SAMAs B02 and B15 both address the unavailability of high-pressure injection, B02 adds a redundant train of a steam driven pump (which apparently still has the same long-term failure modes as the HPCI and RCIC) while B15 adds a motor-driven startup feedwater pump (which would still have AC power dependence). Indicate whether a diesel-driven pump would be more effective than either of the above two options evaluated. Provide justification to support the conclusion.

Response

Please refer to the response to question 10.

50

RAI 1ic. The evaluation of candidate SAMA B18 for internal flooding considers the impact of eliminating all flood-initiated events with very high cost flood barriers that would mitigate all flooding events. The PSA results provided in Section III indicate that 70 to 75 percent of the total internal flooding CDF is due to a small flood in the turbine building. In addition, the Multi-Unit PRA indicates that one flooding sequence has a frequency of 1.2xlO per year. Discuss the potential for an inexpensive SAMA to mitigate the risk of the dominant internal flood contributors to CDF.

Response

As indicated in the response to RAI 2.d, the turbine building flood initiating event and its impact on the plant as modeled in the Multi-Unit PRA was overly conservative. In the EPU PSA model, two turbine building flood initiating events (small and large flooding events) were defined and their contributions are shown in Section III of the ER. Both, the small and large turbine building floods are multi-unit initiators.

The distinction between a small and a large flood initiating event in the turbine building is the volume of water needed to fail the feedwater and condensate systems on the general floor area of the turbine building (265,000 gallons for the small flood) versus that needed to impact the feedwater, condensate, RCW, and the plant control air systems (400,000 gallons for the large flood).

No inexpensive SAMA to mitigate the risk of the "small" flood initiating event was identified.

51

RAI lid. The cost avoidance for SAMA G14 takes credit for only eliminating the failure of breakers that transfer nonemergency buses from the unit service transformer.

Indicate the importance of all 4 kV breakers. Indicate whether this SAMA would be cost-effective when all 4kV breakers are considered.

Response

The importance of all 4kV breakers associated with the Unit Boards, Shutdown Buses, and 4kV Shutdown boards was evaluated. The failure probability of these 4kV breakers to open or close on demand was set to 0.0. This bounds the potential impact of this SAMA.

The results for this analysis indicate about a 0.2 percent decrease in the Unit 2 calculated CDF (CDF All 4kV Bkr = 2.6185E-06 per year). For Unit 3, there is a 0.1 percent decrease in the calculated CDF (CDF All 4kV Bkr = 3.3550E-06 per year).

Results are provided in Tables 1id- I and 1ld-2 for Unit 2 and Unit 3, respectively, and the SAMA evaluation is summarized in Table 1ld-3.

This SAMA is not cost-effective when all 4kV breakers are considered.

Table 1ld-i UNIT 2 GENERIC SAMA NUMBER G14 RESULTS MAAP Case Baseline Case SAMA G14 Case MIA 2.09E-06 2.08E-06 MKC i.iOE-07 1.IIE-07 NIH 2.70E-08 2.70E-08 OIA 4.78E-08 4.79E-08 PID 2.38E-10 2.38E-10 PIH 3.18E-10 3.19E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 3.01E-07 Person-rem 1.64 1.64 Unit 2 Total Cost (3%) $259,002 $258,614 Unit 2 Total Cost (7%) $167,979 $167,738 SAMA G14 Saving (3%) $ 388 SAMA G14 Saving (7%) $ 241 52

Table I ld-2 UNIT 3 GENERIC SAMA NUMBER G14 RESULTS MAAP Case Baseline Case SAMA G14 Case MIA 2.61E-06 2.60E-06 MKC 1.1lE-07 1.1 E-07 NIH 1.20E-07 1.20E-07 OIA 4.95E-08 4.95E-08 PID 2.21E-10 2.21E-10 PIH 1.94E-10 1.94E-10 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.24E-07 Person-rem 1.95 1.95 Unit 3 Total Cost (3%) $318,839 $319,038 Unit 3 Total Cost (7%) $205,923 $206,052 SAMA G14 Saving (3%/0) $ 428 SAMA G14 Saving (7%) $ 267 53

Table 1Id-3 EVALUATION OF PHASE II SAMAs Candidate SAMA Title Estimated Cost Maximum Cost Screening Cost Screening Cost Screening Cost Cost SAMA (2016) Avoidance for Impact of Avoidance for Avoidance for Effective?

(Base Case) Uncertainty Impact of Impact of both Three-Unit Uncertainty and Operation Three-Unit Operation G14 Develop procedures to repair or replace $73K/unit $428/unit $1.3K/unit 4.0K/plant I 1.9K/plant N failed 4 kV breakers.

54

RAI

12. Discuss the potential benefit and implementation costs for the following SAMAs at BFNP.

12a. Provide a means for alternate safe shutdown makeup pump room (or equivalent room) cooling, either via the use of the fire protection system, or procedures to open doors and use portable fans.

Response

Most equipment in the reactor building at BFN is located in large open areas and do not require active cooling to maintain functionality. The system models for the RHR pumps do require that the pump area coolers (large units that force cooled air flow to the pump motors) are required.

Likewise, the models for the Core Spray pumps require the operation of area coolers that provide cooling to pumps in a loop. The suggested SAMA is interpreted as taking actions that would effectively remove the dependency of the RHR and CS pumps on active cooling.

SAMA G02 evaluated a potential plant modification that would have the same plant impact. The results of that evaluation are summarized in Tables VI-37 and VI-38 of the SAMA analysis report. The results from this case indicate about a 7.6 percent reduction in Unit 2 CDF (CDFne,=2.4230E-6). For Unit 3 there is a 9.1 percent reduction in CDF (CDFne,=3.0541E-6).

The maximum base case screen cost avoidance is determined to be $39,282. Using the bounding models representing the impact of the return to service of Unit 1 as well as uncertainty, the maximum cost avoidance screening value becomes $516k/plant.

Use of the fire protection system to provide cooling to the area coolers would require hardware changes as well as the development of procedures. For SAMA G12, the estimated cost of implementing a change to use the fire protection system to backup diesel generator cooling was estimated to be $1.5M for the plant. The necessary piping changes associated with providing cooling to the pump room area coolers is likely to be larger -- thus a lower bound on the implementation costs may be taken to be $1.5M/plant. Thus, the fire protection system is not considered to be a cost-effective means of providing pump room cooling.

Given the large, open nature of the area housing the pumps, the opening of doors alone is not considered sufficient to prevent local temperatures to remain acceptable given the loss of area coolers.

55

RAI 12b. Provide procedures for (a) bypassing major DC buses; (b) locally starting equipment.

Response

To bound the potential impact of this SAMA, the top events in the electrical power event trees representing the three major DC batteries were set to guaranteed success and all top events in the signal event tree (SIGL) were set to guaranteed success.

The results from this case indicate about a 2 percent reduction in Unit 2 CDF (CDFnew-=2.5696E-6). The end state frequencies are presented in Table 12b-1. For Unit 3 there is a 0.2 percent increase in the calculated CDF (CDFew=3.3688E-6) and the end state frequencies are presented in Table 12b-2. For Unit 3, the results are interpreted as indicating that the models are not sufficiently sensitive to the specific changes made to yield a meaningful measure.

The screening cost avoidance for impact of both uncertainty and three-unit operation is

$139k/plant (conservatively assuming that the Unit 3 cost avoided is as large as that determined for Unit 2). The estimated implementation cost is $73k per unit. It is concluded that this SAMA is not cost-effective.

Table 12b-1 UNIT 2 RAI 12 b RESULTS MAAP Case Baseline Case RAT 12 b Case MIA 2.09E-06 2.05E-06 MKC l.1OE-07 1.1 E-07 NIH 2.70E-08 2.52E-08 OIA 4.78E-08 4.50E-08 PID 2.38E-10 2.261E-10 PIH 3.10E-10 2.68E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 2.93E-07 Person-rem 1.64 1.62 Unit 2 Total Cost (3%) $259,002 $254,362 Unit 2 Total Cost (7%) $167,979 $165,020 SAMA G02 Saving (3%) $4,640 SAMA G02 Saving (7%) $2,959 56

Table 12b-2 UNIT 3 RAI 12b RESULTS MAAP Case Baseline Case RAI 12 b Case MIA 2.61E-06 2.59E-06 MKC 1.1E-07 1.12E-07 NIH 1.20E-07 1.52E-07 OLA 4.95E-08 4.59E-08 PID 2.21E-10 2.25E-10 PiH 1.94E-10 3.19E-10 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.22E-07 Person-rem 1.95 1.96 Unit 3 Total Cost (3%) $318,839 $319,885 Unit 3 Total Cost (7%/6) $205,923 $206,619 SAMA G02 Saving (3%) -$1,046 SAMA G02 Saving (7%) -$669 57

RAI 12c. Develop procedures to control feedwater flow without 125 VDC to prevent tripping of feedwater on high/low level.

Response

To bound the potential impact of this SAMA, the models representing the hardware portion of the feedwater system (top event FWH) and operator control of feedwater (top event OF) were modified. The feedwater hardware top event was modified to remove all dependencies on electric power. The top event representing operator control of feedwater was set to guaranteed success.

The results from this case indicate about a 0.1 percent reduction in Unit 2 CDF (CDFne,=2.621 1E-6). The end state frequencies are presented in Table 12c-1. For Unit 3, there is less than 0.1 percent reduction in CDF (CDFnew=3.3577E-6) and the end state frequencies are presented in Table 12c-2.

The screening cost avoidance for impact of both uncertainty and three-unit operation is

$6k/plant. The estimated implementation cost is $73k per unit. It is concluded that this SAMA is not cost-effective.

Table 12c-1 UNIT 2 RAI 12 c RESULTS MAAP Case Baseline Case RAI 12 c Case MIA 2.09E-06 2.09E-06 MKC 1.1OE-07 1.1 IE-07 NIH 2.70E-08 2.70E-08 OIA 4.78E-08 4.80E-08 PID 2.38E-10 2.42E-10 PIH 3.10E-10 3.23E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 3.01E-07 Person-rem 1.64 1.64 Unit 2 Total Cost (3%) $259,002 $258,815 Unit 2 Total Cost (7%) $167,979 $167,867 SAMA G02 Saving (3%) $187 SAMA G02 Saving (7%) $112 58

Table 12c-2 UNIT 3 RAI 12 c RESULTS MAAP Case Baseline Case RAI 12 c Case MIA 2.61E-06 2.61E-06 MKC 1.1 IE-07 1. 1 E-07 NIH 1.20E-07 1.20E-07 OIA 4.95E-08 4.97E-08 PID 2.21E-10 2.25E-10 PIH 1.94E-10 1.95E-10 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.23E-07 Person-rem 1.95 1.95 Unit 3 Total Cost (3%/6) $318,839 $318,638 Unit 3 Total Cost (7%/6) $205,923 $205,802 SAMA G02 Saving (3%) $201 SAMA G02 Saving (7%/6) $121 59

RAI 12d. Demonstrate RCIC operability following depressurization, i.e., develop procedures to stop reactor depressurization at required level.

Response

The PSAs for Unit 2 and Unit 3 both contain success sequences involving long-term operation of RCIC for level control. Long-term operator control of RCIC is represented by a specific top event in the event model: top event OHL. To bound the potential impact of improving procedures and training to improve long-term operation of RCIC, this top event was set to guaranteed success.

The results from this case indicate about a 0.3 percent reduction in Unit 2 CDF (CDFnew=2.6169E-6). The end state frequencies are presented in Table 12d-1. For Unit 3 there is a 0.3 percent reduction in CDF (CDFnew=3.3523E-6) and the end state frequencies are presented in Table 12d-2.

The screening cost avoidance for impact of both uncertainty and three-unit operation is

$18k/plant. The estimated implementation cost is $73k per unit. It is concluded that this SAMA is not cost-effective Table 12d-I UNIT 2 RAI 12 d RESULTS MAAP Case Baseline Case RAI 12 d Case MIA 2.09E-06 2.08E-06 MKC 1.10E-07 1.10E-07 NIH 2.70E-08 2.70E-08 OIA 4.78E-08 4.78E-08 PID 2.38E-10 2.38E-10 PIH 3.10E-10 3.18E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 3.01E-07 Person-rem 1.64 1.64 Unit 2 Total Cost (3%) $259,002 $258,430 Unit 2 Total Cost (7%) $167,979 $167,619 SAMA G02 Saving (3%) $572 SAMA G02 Saving (7%) $360 60

Table 12d-2 UNIT 3 RAI 12 d RESULTS MAAP Case Baseline Case RAI 12 d Case MIA 2.61E-06 2.60E-06 MKC 1.1 E-07 1.1 E-07 NIH 1.20E-07 1.20E-07 OIA 4.95E-08 4.95E-08 PID 2.21E-10 2.21E-10 PIH 1.94E-10 1.94E-10 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.23E-07 Person-rem 1.95 1.94 Unit 3 Total Cost (3%/6) $318,839 $318,174 Unit 3 Total Cost (7%/6) $205,923 $205,505 SAMA G02 Saving (3%) $665 SAMA G02 Saving (7%) $418 61

RAI 12e. Develop or enhance procedures to control containment venting within a narrow band of pressure.

Response

A bounding assessment to evaluate the impact of this SAMA was performed by modifying the model logic to permit continued operation of the core spray and RHR pumps when suppression pool cooling is failed. This is a conservative model of the suggested SAMA, assuming that controlled venting of the wetwell would not adversely affect core spray pump and RHR pump continued operation.

The results from this case indicate about a 3 percent increase in the calculated Unit 2 CDF (CDFnw=2.7043E-6). The new end state frequencies are presented in Table 12e-1. For Unit 3 there is a 1.7 percent increase in the calculated CDF (CDFnew=3.4176E-6) and the new end state frequencies are presented in Table 12e-2.

The SAMA evaluation yields negative net savings for all cases. The results are interpreted as indicating that the models are not sufficiently sensitive to the specific changes made to yield a meaningful measure. It is concluded that the postulated SAMA has negligible potential net value and is not cost-effective.

Table 12e-1 UNIT 2 RAI 12 e RESULTS MAAP Case Baseline Case RAI 12 e Case MIA 2.09E-06 2.18E-06 MKC 1.10E-07 1.10E-07 NIH 2.70E-08 1.30E-08 OIA 4.78E-08 4.78E-08 PID 2.38E-10 2.38E-10 PIH 3.10E-10 3.18E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 3.01E-07 Person-rem 1.64 1.66 Unit 2 Total Cost (3%) $259,002 264,740 Unit 2 Total Cost (7%) $167,979 $171,560 SAMA G02 Saving (3%) -$5738 SAMA G02 Saving (7%) -$3581 62

Table 12e-2 UNIT 3 RAI 12 e RESULTS MAAP Case Baseline Case RAI 12 e Case MIA 2.61E-06 2.77E-06 MKC 1.1 1E-07 1.1 lE-07 NIH 1.20E-07 1.38E-08 OIA 4.95E-08 4.95E-08 PID 2.21E-10 2.21E-10 PIH 1.94E-10 2.21E-10 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.3 1E-07 Person-rem 1.95 1.93 Unit 2 Total Cost (3%) $318,839 $320,332 Unit 2 Total Cost (7%) $205,923 $206,617 SAMA G02 Saving (3%/6) -$1,493 SAMA G02 Saving (7%) -$694 63

RAI 12f. Develop procedures to use a cross connect to the other unit's containment cooling service water (or equivalent at BFNP) as an alternate containment spray source.

Response

The safety-related containment cooling service water system at BFN is the Residual Heat Removal Service Water (RHRSW) system. The capability to use the RHRSW system for primary containment injection to any unit already exists at BFN and is proceduralized by the Severe Accident Management Guidelines (SAMGs).

64

RAI 12g. Develop procedures to align LPCI or Core Spray to the condensate storage tank on loss of suppression pool cooling.

Response

To bound the impact of this potential SAMA, the logic rules specifying "no core damage" were modified to include the combination of the CST and either LPCI or Core Spray as a viable long-term success combination.

The results from this case indicate about a 2 percent reduction in Unit 2 CDF (CDFn,,=2.5597E-6). The end state frequencies are presented in Table 12g-1. For Unit 3 there is a 3 percent reduction in CDF (CDFnew=3.2744E-6) and the end state frequencies are presented in Table 12g-2.

The screening cost avoidance for impact of both uncertainty and three unit operation is

$176k/plant. The estimated implementation cost is $73k per unit. It is concluded that this SAMA is not cost-effective.

Table 12g-1 UNIT 2 RAI 12 g RESULTS MAAP Case Baseline Case RAI 12 g Case MIA 2.09E-06 2.07E-06 MKC l.lOE-07 1.10E-07 NIH 2.70E-08 2.60E-08 OIA 4.78E-08 4.72E-08 PID 2.38E-10 2.38E-10 PIH 3.10E-10 2.62E-10 PJH 4.64E-08 4.64E-08 PLF 3.01E-07 2.55E-07 Person-rem 1.64 1.61 Unit 2 Total Cost (3%) $259,002 $253,406 Unit 2 Total Cost (7%) $167,979 $164,436 SAMA G02 Saving (3%) $5,596 SAMA G02 Saving (7%) $3,543 65

Table 12g-2 UNIT 3 RAI 12 g RESULTS MAAP Case Baseline Case RAI 12 g Case MIA 2.61E-06 2.74E-06 MKC 1.11E-07 1.1OE-07 NIH 1.20E-07 1.73E-10 OIA 4.95E-08 5.OOE-08 PID 2.21E-10 O.OOE+00 PIH 1.94E-10 O.OOE+00 PJH 4.64E-08 4.64E-08 PLF 4.23E-07 4.21E-07 Person-rem 1.95 1.90 Unit 3 Total Cost (3%) $318,839 $311,916 Unit 3 Total Cost (7%) $205,923 $201,543 SAMA G02 Saving (3%) $6,923 SAMA G02 Saving (7%) $4,380 66

RAI

13. Appendix F to the LRA contains TVA's plans and schedules for Unit 1 restart activities affecting the LRA. Several permanent modifications at Unit 1 are planned in order to make its licensing basis consistent with that for Units 2 and 3, e.g., fire protection, hardened vent, and ATWS. Given that these plant changes are still to be implemented, the modifications can be further refined to reflect insights from the updated PSAs. For example, the hardened vent could be implemented as a passive feature (e.g., using a rupture disk rather than a manual valve), thereby removing the reliance on operator actions to open the vent (which is the second most important operator action in the BFNP PSA). For each of the major modifications planned for Unit 1, please discuss how these modifications might be enhanced to further reduce risk at Unit 1. Discuss the associated costs and benefits of these enhancements.

Response

For each Unit 1 restart modification discussed in Appendix F of the License Renewal Application, SAMAs were reviewed to determine if any could reasonably be integrated with the planned modification such that Unit 1 risk could be reduced in a cost effective manner. In addition, for the hardened wetwell vent modification, the requested SAMA, venting via a rupture disk as opposed to valves, was evaluated. The analysis for each modification is discussed below.

F. 1 Main Steam Isolation Valve Alternate Leakage Treatment Seismic-induced failure of main steam piping or other piping that is connected to the main steam piping was not identified as an outlier in the IPEEE. Piping typically has a very high resistance to seismic-induced failure, even if it is not seismically-qualified. Consequently, there are no SAMAs pertaining to this modification.

F.2 Containment Atmosphere Dilution System Modifications The capability to supply pressurized nitrogen to the main steam relief valves is modeled in the PSA. Failure of this capability was not identified as a significant contributor to CDF. The scope of work for this modification does not include ADS logic circuitry (SAMA BOI) nor replacement of the SRVs with more reliable valves (SAMA B03). It is concluded that there are no SAMAs that would integrate into this Unit 1 restart activity in a cost-effective manner.

F.3 Fire Protection The BFN Fire Protection Program to ensure the capability to maintain safe shutdown during and after fires will be revised on Unit 1 to ensure compliance with 10CFR5O, Appendix R.

There are two SAMAs that involve Fire Protection System hardware. SAMA GIO involves use of the Fire Protection system as a backup source for the drywell spray system. However, this SAMA was determined to have zero cost avoidance.

SAMA G15 involves modification of the Fire Protection System such that it could serve as an alternative cooling water source for the diesel generators. Since the Unit 1/Unit 2 diesel generator building is currently required to support Unit 2 operation, it necessarily meets Appendix R requirements and is therefore not within scope of this Unit 1 restart activity. It is concluded that there are no SAMAs that would integrate into this Unit 1 restart activity in a cost-effective manner.

67

F.4 Environmental Oualification A key assumption of a PSA is that modeled equipment is qualified for the environment to which it is expected to be exposed. Applying the existing EQ program to Unit 1 simply brings that unit's EQ program up to the level that exists for Units 2 and 3. Consequently, there are no SAMAs pertaining to this modification.

F.5 Intergranular Stainless Steel Stress Corrosion Cracking LOCAs are relatively small contributors to CDF (5 percent or less). No SAMAs pertaining to decreasing the probability of a crack or break in primary system piping were evaluated.

F.6 Boiling Water Reactor Vessel and Internals Project Inspection and Flaw Evaluation Guidelines Implementation During the Unit 1 extended outage, the Boiling Water Reactor Vessel Internals Project (BWRVIP) was initiated to develop inspection and flaw evaluation guidelines. These guidelines will be implemented on Unit 1 during its restart.

Plant-specific SAMA B14 addresses inspection of the reactor pressure vessel (RPV) as a means to reduce the frequency of RPV rupture, modeled as the "excessive LOCA" initiator in the PSA.

Due to the industry-wide involvement in the BWRVIP, no additional improvements specific to BFN are deemed likely. Therefore, SAMA B14 is now considered to have a net cost avoidance of zero.

F.7 Anticipated Transients Without SCRAM Anticipated Transient Without SCRAM (ATWS) features that have been installed on Units 2 and 3 will be installed on Unit 1 to comply with 10CFR50.62. Those features, described in UFSAR Section 7.19, include the Standby Liquid Control (SLC) System, the Recirculation Pump Trip (RPT), and Alternate Rod Injection (ARI). Note that the SLC system already exists.

There are six SAMAs pertaining to ATWS. Two are procedure enhancements (B05 and B12),

two involve hardware changes to the SLC System (B06 and B07), and two (G09 and G13) involve hardware changes to increase suppression pool cooling during an ATWS.

A review of the scope of work for this Unit 1 restart activity and that of the associated SAMAs indicates that there is no overlap. Therefore, it is concluded that the SAMAs could not be integrated into this Unit 1 restart activity in a cost-effective manner.

F.8 Reactor Vessel Head Srav The reactor vessel head spray is not modeled in the PSA. Consequently, there are no SAMAs pertaining to this modification.

F.9 Hardened Wetwell Vent A SAMA, proposed by the USNRC as part of this RAI question, is to implement the hardened wetwell vent modification with a rupture disk rather than operator-controlled venting via valves.

The basis for the SAMA is to eliminate human error as a cause for hardened wetwell vent failure.

This SAMA has two significant deficiencies. First, modification of Unit 1 hardened wetwell vent to operate at a specific setpoint via a rupture disk would result in operational differences between the units with the resultant increase in human error rates for the emergency primary 68

containment venting task on Units 2 and 3. Second, primary containment venting via a rupture disk does not provide a means to control the wetwell venting as wetwell pressure would simply decrease as the containment depressurizes with no means to terminate the release. This condition poses a risk for loss of NPSH for ECCS pumps taking suction from the suppression pool. Additionally, the rate of radioactive releases cannot be controlled.

It is concluded that negative impacts of this SAMA outweigh the benefits and therefore this SAMA should not be implemented.

F.I0 Service Air and Demineralized Water Primary Containment Penetrations These two containment penetrations are not explicitly modeled in the PSA. Consequently, there are no SAMAs pertaining to this modification.

F.1 1 Auxiliarn Decay Heat Removal System The auxiliary decay heat removal system is not modeled in the PSA. Consequently, there are no SAMAs pertaining to this modification.

F.12 Maintenance Rule This item does not include hardware modifications or changes to emergency operating procedures. Consequently, there are no SAMAs pertaining to this program modification.

F. 13 Reactor Water Cleanup System Neither rupture of RWCU piping outside containment nor functional failure of RWCU system active components was identified as a significant contributor to risk. Consequently, there are no SAMAs pertaining to this modification.

69

Appendix A Resolution of Findings and Observations for Data, Thermal-Hydraulic and Level 2 Analysis 70

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element TH Subelement 4 High pressure injection adequacy is listed as accomplished by CRD.

Model appears to include CRD success in enhanced mode.

During the Certification visit, TVA performed MAAP calculations to demonstrate enhanced CRD success. The MAAP runs were not reviewed by the Certification Team.

(Also refer to related F&Os for AS-7, AS-9 and SY-26.)

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Provide technical basis for enhanced CRD success including:

• Initiation timing

• T&H calculation

• Timing required for operator action

• Operator interviews

• Training interpretation of procedures PLANT RESPONSE OR RESOLUTION The technical basis for initiation, the T&H calculation, and the timing for operator actions are established by MAAP analysis (see Thermal Hydraulic Analysis). Operator interview and training interpretations of procedures was not performed. However, HEPs reflect the current EOI guidance and timing.

71

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element TH Subelement 4 RCIC is listed as a success for small LOCA. This does not appear possible for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time because the small LOCA combined with RCIC operation will drop RPV steam pressure below that which RCIC can operate, well before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Reconsider RCIC success criteria; NUREG/CR-4550 is not considered an adequate technical basis.

PLANT RESPONSE OR RESOLUTION RCIC is no longer credited as a long-term success path for small LOCAs.

72

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element TH Subelement 8 The SBO evaluation for potential severe accidents is strongly dependent on the plant symptoms and plant conditions. The Certification Team was unable to find the deterministic calculations used to support SBO timing and accident sequence actions. The specific items of interest are the following for the entire 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of the SBO before core damage is assumed.

• The drywell temperature for the SBO with 36 gpm + 25 gpm leakage relative to depressurization requirement at 280'F.

• The suppression pool temperature relative to HCTL requirement for depressurization

• RPV water level

• The RPV water level instrument response

• The HPCI and RCIC room steam line temperatures relative to the isolation trip setpoints.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Assess and discuss the sequence effects on equipment operability for SBO response. Include the margin to avoid emergency depressurization due to HCTL or high DW/T.

PLANT RESPONSE OR RESOLUTION Note that the BFN station blackout evaluation demonstrated the adequacy of all the items of interest for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The question then is the plant response for the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Neither the drywell temperature nor the HCTL is expected to reach depressurization setpoints until 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The RPV water level instrumentation is expected to be available for the duration, with the operators controlling level using HPCI or RCIC in the first 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. No actions are required with respect to bypassing the high temperature trips for HPCI/RCIC during this 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> period.

73

FACT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element TH Subelement 12 Section 3.1.3 of the IPE does not appear to acknowledge containment vent as a containment heat removal method.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Update documentation to identify the success criteria and basis for containment heat removal methods.

PLANT RESPONSE OR RESOLUTION .

The original IPE documentation did not acknowledge containment vent as a containment heat removal method.

That is now documented in the Event Tree Notebook and the Pressure Suppression Pool Notebook.

74

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 4 Generic data is used for all component independent component failures, except for emergency diesel generators.

The lack of plant-specific operating information is seen as a major limitation on the acceptability of the PSA for applications.

LEVEL OFSIGNIFICANCE B (with caution - some applications may require updating component failure data until an overall update is accomplished)

POSSIBLE RESOLUTION Include plant-specific failure information from performance data collected for Maintenance Rule implementation in the next update of the PSA model(s).

PLANT RESPONSE OR RESOLUTION Plant-specific failure information was developed from Maintenance Rule data.

75

FACT/OBSERVATIONPREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 7 The availability of DC power to support accident response has been identified in some other PSAs as important.

The unavailability of multiple DC supplies due to potential common cause failure (CCF) has also been identified and highlighted by the NRC in NUREG-0666.

There does not appear to be a CCF of two DC power supplies included in the analysis.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION NUREG-0666 should be reviewed to assess the importance of the CCF. In addition, the CCF should be added to the model.

PLANT RESPONSE OR RESOLUTION DC CCF data from NUREG-0666 was reviewed, parameters developed and added to the model.

76

FACT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 8 AEODINEL DATA applied to BFN will likely lead to an increase in the CCF contribution for the EECW pumps and diesel generators.

The EECW treatment of 6 pumps may result in a substantial change depending on how the grouping of the identical pumps is performed.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Consider reassessment of the key CCF contributors using the latest AEOD/INEL common cause data (see attached excerpts -12 pages).

PLANT RESPONSE OR RESOLUTION The RHRSW and EECW pumps are a group of 12 pumps. Thus, the theoretical group size is 12. These were partitioned into two groups of eight RHRSW pumps and four EECW pumps. This partitioning is based on the fact the EECW pumps are normally operating and the RHRSW pumps are standby. A review of INEEIJAEOD CCF database was the basis for this partitioning. Note that if the RHRSW swing pumps are used to supply EECW, the CCF for RHRSW pumps is already accounted for.

77

FA CT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 10 The six RCW pump from U2/Ul are included in one CCF group, while the four RCW pumps from U3 are included in a separate CCF group.

This does not appear to be justified. The pumps, their service condition, maintenance, and operating environment all appear to be identified with no good reason for separating them into different groups.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Include RCW pumps in the same CCF group.

PLANT RESPONSE OR RESOLUTION Common cause is included in the model for failure of the RCW pumps to run. A single common cause group is defined including the operating Unit 1, Unit 2, and Unit 3 pumps. Failure of three of more RCW pumps is modeled as system failure, therefore common cause failures of any two pumps is modeled explicitly, and failure of any tree (or more) pumps is modeled as a single, global common cause event.

78

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 14 The common cause diesel evaluation for one sequence (LOSP 1934) included the following:

GAI = .09 GD2 = .09 GB4 = .16 GC4 = .4 DGC1 = .236 (Unit 3 CCF) 1.2E-4 The probability is reasonable; however, the MGL values for this model appear to be substantially lower than the most recent CCF from the NRC work at INEL (refer to earlier attached excerpts for Subelement DA-8).

PLG INEL P = R.,B=X if x > .03 y=.16 y=.78 8 =.4 8=.6 E = .2 E = 1.0 (inferred)

There is no technical basis presented that would support the use of new or different models for the Unit 3 diesels, i.e., for them being from a different population requiring separate CCF treatment.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Modify the MGL parameters used in the diesel generation assessment.

PLANT RESPONSE OR RESOLUTION The MGL parameters were modified based on screening the INEEL CCF database.

79

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element DA Subelement 19 The maintenance unavailabilities are based on generic data.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Update generic maintenance unavailabilities in the model to be plant-specific.

PLANT RESPONSE OR RESOLUTION The maintenance data was updated based on data from the maintenance rule.

80

FACT/OBSERVATIONREGARDIN7G PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 5 The use of CRD as a debris cooling source is not clear. The CRD flow rate is relatively low and is judged to be substantially below that needed for debris cooling.

The ability to ensure that CRD flow can enter the vessel via the CRD mechanisms is questionable as core melt progression proceeds. The CRD flow path for debris cooling injection should be identified in the nodal discussion of CRD success, along with the flow rate, and its technical basis.

Provide examples of differences in the accident progression based on CRD flow rate or remove CRD from the evaluation. MAAP or equivalent calculations to show the impact on release or timing.

LEVEL OF SIGNIFICANCE:

B POSSIBLE RESOLUTION Modify in-vessel recovery and debris cooling ex-vessel to eliminate or minimize credit for CRD unless there is a specific analysis to justify CRD flow through the FW line as adequate for either.

PLANT RESPONSE OR RESOLUTION The use of CRD as adequate for debris cooling either in-vessel or ex-vessel has been eliminated from the Level 2 model because of:

a) relatively low flow b) concern that the lines to the RPV may be blocked, clogged, or disrupted.

81

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 5 The time for in-vessel recovery in some cases is 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> or more (see p. 4.8-7 of IPE). However, there is limited basis for assuming this length of time is justified. Current T&H modeling capability cannot justify such times between core damage and the time when RPV breach cannot be prevented.

(See related F&O for L2-24.)

LEVEL OF SIGNIFICANCE:

B POSSIBLERESOLUTION Reevaluate the time allowed for in-vessel recovery.

PLANT RESPONSE OR RESOLUTION This is an area of substantial uncertainty. There is evidence from ORNL BWRSAR and MELCOR calculations that times of 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> could be supported. However, the MAAP models would, in general, calculate relatively short times (- 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) during which restoration of flow could terminate core melt progression in-vessel. The BFN evaluation now treats this area of potential large uncertainty by selecting a time of approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> as the time between core damage and the time when RPV breach due to core debris cannot be prevented by operator actions. This is consistent with MAAP evaluations and is supported by experimental evidence. Times out to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or more could be justified in the future, but are not considered at present.

82

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 7 RB to Torus Vacuum Breakers The elastomer used in the containment vacuum breaker check valve seal is not identified and the characteristics under high wetwell temperatures are not discussed. (The butterfly valves associated with this flow path are normally closed and they open on loss of air.)

During an SBO (and perhaps other severe accidents) the butterfly valves are likely to be open. If the seal could fail as a result of high wetwell temperatures, there could be a significant impact on the overall plant risk due to the large flow area associated with this failure path.

LEVEL OF SIGNIFICANCE:

B POSSIBLE RESOLUTION Determine the elastomer material in the vacuum breaker, its failure temperature, and other characteristics. Clarify the state of the butterfly valves during containment challenges. Incorporate these features in the CETs and the containment isolation failure assessment.

PLANT RESPONSE OR RESOLUTION The reactor building to torus Vacuum Breakers - i.e., the check valves and the butterfly AOVs have the following sealing material and failure temperatures:

Valve Material Seal Failure Temperature

• Check Valves None N/A

• Butterfly Valves Neoprene 4600 F The wetwell environment is generally well protected from high temperatures, i.e., the exceedingly high temperatures are present in the drywell during postulated core melt progression. A check of the severe accident code calculations from MAAP supports the relatively low temperatures in the wetwell airspace (approximately 300F to 400F). The wetwell airspace isolation capability includes the vacuum breaker-line with a check valve and a butterfly valve. As discussed in the Section 2A.6 of the updated Level 2 analysis, the check valve forms the primary isolation capability of the lines. The check valves do not have a temperature sensitive material at these wetwell temperatures. The Butterfly valves have a neoprene seal that NRC contractors have rated as having a failure temperature above 450F.

It is also noted that the Butterfly valves fail open for conditions such as SBO, LOOP, or loss of air scenarios.

Therefore, for these sequences the Butterfly valve seal material is irrelevant. For all other scenarios, the Butterfly valve seal is considered adequate for the modest temperatures it will encounter as long as the suppression pool is not bypassed. For cases with the suppression pool bypassed, the wetwell airspace temperatures remain low enough to consider the seals intact.

83

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 7 DW Sbrav Top Event 7 (DS)

The determination of DW spray initiation is difficult because it depends on containment parameters, sequence of events, timing, and operator response. Are these all accounted for in LI/L2 interface?

LEVEL OFSIGNIFICANCE:

B POSSIBLE RESOLUTION Review.

PLANT RESPONSE OR RESOLUTION The drywell spray initiation has been reevaluated to assess the sequence dependencies of the ability to procedurally initiate the drywell sprays. The results are as follows:

The BFN PSA update makes use of the latest EOIs which are based on the BWROG upgrades referred to as the EPG/SAG revised procedural guidance. In these latest E0Is, the initiation of DW sprays for conditions that could approach a severe accident has taken on a high priority. DW sprays are now initiated for the following conditions:

a) High Radiation SAMG-2 b) At RPV Breach determination (SAMG-1, Leg 1A)

In addition, continued DW spray operation is now allowed down to 0 psig in the containment instead of the 2 psig it had previously been limited to.

These features lead to an increased probability of successfiu drywell spray before RPV breach.

84

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 7 Interface Issues

• Define core damage: Transition between Level I and 2 appears to be unclear and not necessarily based on a consistent definition of core damage.

• Define In-vessel recovery: Criteria and technical basis not provided.

• Define basis for ATWS success criteria: Containment condition at end of Level I is not defined.

• Define Containment capability: Torus capability is not evaluated for hydrodynamic loads (see related F&Os for ST-7 and L2-19).

LEVEL OFSIGNIFICANCE:

B POSSIBLE RESOLUTION Ensure that there is a consistent set of definitions and transition points from Level I to Level 2.

PLANT RESPONSE OR RESOLUTION Core Damage Core damage is defined as the failure of adequate core cooling. The failure of adequate core cooling is defined as the rapid increase in fuel clad temperature due to heating and Zircaloy-water reactions that lead to sudden deterioration of fuel clad integrity. For the purposes of the Level 1 PSA, a surrogate has been developed that can be used as a first approximation to define the onset of core damage. The onset of core damage is defined as the time at which more than two-thirds of the active fuel becomes uncovered, without sufficient injection available to recover the water level and consequential cooling quickly, i.e., water level below one-third core height and falling plus calculated peak core temperatures from MAAP greater than 18000F.

In-Vessel Recovery Because of the large uncertainty in modeling in-vessel core melt progression, the probabilistic assessment uses a judgment of the time available during core melt progression during which the progression can be halted before RPV breach. The estimate of 40 min. to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is used for the time after core damage until a time when RPV breach cannot be prevented. This is judged to be conservative.

85

PLANT RESPONSE OR RESOLUTION (Conttd)

ATWS Success Criteria ATWS Success Criteria are based on satisfying a number of important criteria:

• RPV water level can be maintained sufficiently high to prevent core damage. This is treated as approximately 1/3 core height.

• RPV pressure can be maintained below Service Level C to prevent an induced LOCA and the failure of SLC as an adequate reactivity control measure.

• Torus hydrodynamic loads are adequate during the discharge of steam to the torus. A surrogate measure for these criteria is the use of a calculated bulk torus water temperature below 260'F. This is described in more detail in newly created Section 5.3.

Hydrodynamic Loads During scenarios with high power discharge rates to the pool (i.e., ATWS scenario with failure to control RPV level near TAF) containment failure due to dynamic loading is assumed as the suppression pool temperature exceeds 260'F.

The assumption that the combination of these parameters is interpreted as leading to containment failure is based upon the following issues (see Appendix A of the Initiating Event Notebook):

• Effective condensation in the suppression pool may not occur at elevated suppression pool temperatures resulting in rapid containment pressurization.

• Chugging loads may be unacceptable at these elevated temperatures.

• Dynamic loading may be further aggravated by high torus water levels and high torus temperatures.

• Drywell sprays from external sources may induce oscillation or chugging in containment in addition to increasing torus water level.

• Reactor water level indication may be inadequate and RPV flooding could be required which can induce substantially more severe loads on containment.

• Stuck open SRV discharge line vacuum breakers coupled with stuck open WW to DW vacuum breakers could result in direct and rapid containment pressurization.

• Operator actions beyond his experience in the control room and at the simulator may create confusion and induce operator errors.

The operator action timing will be constrained by the requirement to keep torus temperature below 2600 F when the Reactor is above decay heat levels, i.e., still producing substantial power and steam flow to the torus.

• Containment Capability: Torus capability under Hydrodynamic loads is to be included in model and in Section 5.3 as mentioned above.

86

4.

FACT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 8 There are features of the EQIs regarding containment flooding that do not appear to be reflected in the Level 2 evaluation:

1) Flooding would occur with external sources as quickly as feasible using LPCI from CST instead of suppression pool.

2) Injection to outside the RPV does not appear to be addressed.

3) Containment flooding could compromise the vapor suppression function and RPV debris discharge could occur at high or low pressure into a partially flooded containment (see related F&Os for L2-11 and L2-15).

4) RPV venting does not appear to be addressed.

5) Drywell vent cases appear to be treated as a late release. Given the rapid RHRSW injection capability, the drywell vent pressure or level could be reached at less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, making this an early release instead of a late release.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION The importance of including a LERF assessment as part of the PSA update has been identified previously; however, it is also important that potential contributors to the LERF are addressed.

PLANT RESPONSE OR RESOLUTION The EQ1s have been updated to the latest BWROG product, EPG/SAG. This product addresses a number of the important issues identified in the Certification F&O. These include:

• Limiting containment flooding to avoid compromising vapor suppression under certain degraded plant conditions.

• Limiting the use of RPV venting and delaying the timing of its use The BFN Level 2 update incorporates the latest EPG/SAG guidance as reflected in the BFN EQIs and SAMGs.

These revised procedures and guidance are then incorporated into the FC/FD node of the Level 2. Each of the items cited in the F&O are now addressed using the latest BFN EOIISAMG guidance.

87

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 11 A review of the Level 2 PSA indicated several areas where EQIs could be reflected more precisely in the model or the documentation:

• Possibly missing a containment failure mode related to flooding and loss of vapor suppression (see related F&Os for L2-8 and L2-15).

• RPV vent not accounted for.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Include EOI directions regarding containment flooding and associated RPV venting in the Level 2.

PLANT RESPONSE OR RESOLUTION The latest EOI/SAMGs are used in the updated Level 2. These guidance documents address the issues raised and they are now included directly in the Level 2 assessment.

88

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 11 The Level 2 assumes that the containment vent status has been predetermined in the Level I analysis. No operator action to open the vent is included in Level 2. It is judged that the HRA of vent opening cannot be treated solely in Level 1; it must be treated recognizing the symptoms (e.g., radiation and temperature) that occur in the core melt progression. Specifically, if radiation is present, it is judged that the venting HEP is increased from that compared with the case of no radiation present.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Incorporate split fractions in the Level 2 to account for increased reluctance of vent operation under high radiation conditions and high radiation that may affect assumed local actions.

PLANT RESPONSE OR RESOLUTION Containment Venting as part of a Level 2 analysis can have both positive and negative aspects:

• Early containment venting encountered at RPV breach due to high drywell pressure would result in release of fission products to the environment at the worst time -- and could be a LERF contributor. This probability will be included in the Level 2.

• Containment vent to provide containment heat removal is considered a long-term action and its success or failure should not influence LERF calculations.

Containment venting is the result of long-term accidents. These events do not lead to a LERF and are not included in the Level 2.

89

FA CT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 11 Condensate/LOCA How can the condensate system be assured to have sufficient inventory to have water available for debris cooling?

This impact should be reevaluated in terms of available inventory to provide effective debris cooling. This impact would need to be demonstrated via a MAAP or equivalent calculation in order to credit.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Remove credit for condensate debris cooling mechanism for LOCAs.

PLANT RESPONSE OR RESOLUTION Remove credit for condensate debris cooling mechanism for LOCAs.

In addition, debris cooling in-vessel or ex-vessel with the condensate system has not been credited in the updated Level 2 model.

90

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element: L2 Subelement: 14 The temperature tolerance of the containment (lower) access door seal has not been evaluated. If the seal leaks, a release path to the environment would be established rapidly after vessel melt-through, because the temperature in the drywell may be relatively high and the silicon or rubber seals tolerate typically 500'F.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Analyze the temperature tolerance of the containment access door, and since it is possible to leak after the vessel breach, take this release path into account.

PLANT RESPONSE OR RESOLUTION There are several conditions that may apply to the access door leak path. These include the following:

• RPV breach into a dry containment creates a situation that likely leads to drywell shell melt-through. Leakage through access door seals would represent a negligible perturbation to this sequence.

• RPV breach into a containment with water available to the debris. For this case, maintaining containment boundary requires maintaining the access door seals.

The BFN MAAP analysis indicated temperatures of 150 0 F after spray initiation. For cases with water injection into a failed vessel there were no BFN-specific evaluations. However, there is a case in the BWR Accident Scenario Templates that show temperatures also in the range of 150 0F if water is dumped to the RPV and drains out into the drywell after vessel failure.

91

FA CT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element: L2 Subelement: 15 Only quasi-static pressure increase in the containment is analyzed. Ex-vessel steam explosions are not considered, though they are possible. Flooding of the drywell is not considered apparently because it takes too much time. However, operators may start flooding before vessel melt through, thus causing possible steam spiking or in the worst case, if the containment water level is high enough, steam explosion (see related F&Os for L2-8 and L2-4 1).

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Address above in the containment capability assessment.

PLANT RESPONSE OR RESOLUTION Core melt progression events that involve rapid containment pressurization due to either:

• Steam explosion

• Rapid steam generation following RPV breach (particularly without vapor suppression)

These are addressed in the updated PSA as part of containment failure modes. (See Top Events CZ/CE and FC/FD as part of the containment event tree.)

92

FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 19 There may be an inconsistency between the Level 1 model and the assumed containment failure modes.

The definition of containment failure during an ATWS and its size and location should be identified. The attached discussion of ATWS-induced dynamic loads is included for your use in considering the BFN specific evaluation.

Attachment L2-19 provides some consideration regarding containment failure modes that may require consideration under ATWS conditions.

(See related F&Os for ST-7 and L2-7.)

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION The containment failure mode for failure to scram events is key to LERF assessment and should be assigned consistent with the TVA evaluation of ATWS. The containment failure probability may more appropriately be assigned a failure probability of 1.0 for the wetwell. This means drywell failure is - 0.0. The wetwell air space failure probability would be 0.5 and the ECCS ring header failure probability would be 0.5 due to dynamic loads.

PLANT RESPONSE OR RESOLUTION The recommended containment failure modes are now included in the PSA update model.

These failure modes are then input to the MAAP models and the CET evaluation to determine the release categories and frequencies.

93

FA CT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 20 Early Scrub and Early HI DW FAIL: this release is characterized in the IPE text as large and early. However, neither large or early are defined.

This release category (EARLY SCRUB) is 53% of total KRC (Key Release Category) frequency. This release category is said to have a number of conservatisms incorporated into the binning process. Therefore, there may be significant conservatisms affecting applications that are influencing these results.

• neglecting reactor building DF

• combining results from high and low RPV pressure cases LEVEL OFSTGNIFICANCE:

B POSSIBLE RESOLUTION To ensure applications are treated in a realistic manner, the conservatisms in the Level 2 binning should be removed.

PLANT RESPONSE OR RESOLUTION In general, scrubbed releases will not represent a High Radionuclide Release unless there are subsequent containment failures that cause bypass of the torus as a scrubbing path. These conditions are reevaluated in the PSA update to ensure that the scrubbing failure modes are not HIGH releases unless they are aggravated by additional, more severe failure modes.

The IPE release categories are redefined to result in clear definition of LERF.

94

FACT/OBSERVATIONREGARDING PSA TECHNICAL ELEMENTS OBSERVA7TON Element L2 Subelement 21 There appears to be substantial conservatisms built into the Release Groups defined in the Level 2. These Release Groups lump a substantial number of lower source term end states with the higher source term cases.

While this is conservative and adequate for the IPE, it is not appropriate for a realistic best estimate assessment for use in applications. Some of the conservatisms that are lumped into the assessment include:

• ATWS sequences always fail the drywell

• Small size leakage failures are binned to large size releases (P.4.9-5 of IPE)

• Wet cases are binned to large release category (P.4.9-5 of IPE)

• No credit is taken for reactor building DF (Bill Mims)

Potential non-conservatisms:

• ATWS cases have an in-vessel recovery allowed.

Other Issues

• Large is not defined or justified; so it could easily be that more appropriate definition of what falls into Large would lead to a reasonable partitioning. This would make it consistent with the PSA Applications Guide.

• The timing associated with SBO events that do not cause release for many hours appear to be treated as early releases.

LEVEL OFSIGNIFICANCE:

B POSSIBLE RESOLUTION Make Level 2 as realistic as possible within the state of the technology, particularly in the above areas.

PLANT RESPONSE OR RESOLUTION The Level 2 has been converted to a LERF-only assessment consistent with the NRC Regulatory Guide Requirements, NUREG/CR-6595, and the PSA Applications Guide.

95

FA CT/OBSER VA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 22 LERF does not appear to be defined. There is no reference to the BFN Emergency Action Levels (EALs). The assessment of the EALs and their implication regarding timing could not be found by the Certification Team.

LEVEL OFSIGNIFICANCE B

POSSIBLE RESOLUTION Include consistent LERF definition and document the basis for timing definition based on the EALs. Develop an EAL basis for assigning timing of releases. This should include consideration of TW and delayed SBO sequences and their timing relative to the EALs.

PLANT RESPONSE OR RESOLUTION Completed.

96

FACT/OBSERVA TION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION Element L2 Subelement 23 Timing The NLF KPDS (Key Plant Damage State) specifies that the timing is Late (L); however, there is no discussion of its interface with EALs and the timing is inconsistent with the definition of "EARLY" presented on P. 4.5-2 of the IPE.

Provide a consistent basis for the Level 2 end state definitions that will allow calculation of LERF consistent with the PSA Applications Guide.

(See related F&O for L2-22.)

LEVEL OF SIGNIFICANCE:

B POSSIBLE RESOLUTION Confirm protective actions specified in EALs are reflected in LERF timing.

PLANT RESPONSE OR RESOLUTION Completed.

97