ML102280585

Request for Additional Information Regarding Individual Plant Examination

ML102280585
Person / Time
Site:	Watts Bar
Issue date:	08/12/2010
From:	Bajestani M Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC ME3334
Download: ML102280585 (53)

Text

Tennessee Valley Authority, Post Office Box 2000, Spring City, Tennessee 37381-2000 August 12, 2010 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Unit 2 NRC Docket No. 50-391

Subject:

WATTS BAR NUCLEAR PLANT (WBN) UNIT 2 - REQUEST FOR ADDITIONAL INFORMATION (RAI) REGARDING INDIVIDUAL PLANT EXAMINATION (TAC NO. ME3334)

Reference:

1. TVA letter dated February 09, 2010, 'Watts Bar Nuclear Plant (WBN) -

Probabilistic Risk Assessment Individual Plant Examination Summary Report" (ML100491535)

2. NRC letter dated June 23, 2010, "Watts Bar Nuclear Plant, Unit 2 -

Supplemental Request for Additional Information Regarding Individual Plant Examination (TAC NO. ME 3334)" [ML101680072]

The purpose of this letter is to provide responses to the NRC RAI regarding TVA's Probabilistic Risk Assessment (PRA) Individual Plant Evaluation (IPE) Summary Report for WBN Unit 2, which was submitted to the NRC on February 9, 2010 (Reference 1). Enclosure 1 provides TVA's responses to the NRC's RAIs as stated in Reference 2.

The new commitments are shown in Enclosure 2. I declare under penalty of perjury that the foregoing is true and correct. Executed on the 1 2 m day of August, 2010.

If you have any questions, please contact me at (423) 365-2351.

Sincerely, Masouda s ni Watts Bar ni 2 Vice President Enclosure'

1. Responses to Written NRC RAIs

2. List of Commitments

U.S. Nuclear Regulatory Commission Page 2 August 12, 2010 cc (Enclosures):

U. S. Nuclear Regulatory Commission Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, Georgia 30303-1257 NRC Resident Inspector Unit 2 Watts Bar Nuclear Plant 1260 Nuclear Plant Road Spring City, Tennessee 37381

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

1. NRC Request With regardto parameteruncertainties,the PRA standardrequires,at a minimum, quantificationof a core damage frequency/largeearly release frequency (CDF/LERF) point estimate using the mean values of the basic events (HLR-QU-A). For Capability Category Ill, a propagationof the uncertaintyintervals is required, which takes into account the state of knowledge correlation. For model uncertainties(HLR-QU-E), the PRA standardonly requiresthe identification of sources of model uncertaintyand relatedassumptions as well as where the PRA model is affected.

The scope of finding and observation (F&O) 3-6 appears to go beyond the minimum requirements of the PRA standard,but the sources of model uncertainty are not clearly identified. Provide a list of the sources of model uncertainty, and identify where the PRA model is affected (e.g., introduction of a new basic event, changes to basic event probabilities,change in success criteria,and introduction of a new initiating event (IE)).

TVA Response Peer Review Team Clarification:

F&O 3-6 originated from Supporting Requirement (SR) Quantification (QU)-A3 which requires that the state of knowledge correlation be accounted for in the quantification when it is significant. An example of a case where the state of knowledge correlation is important is in Interfacing System Loss of Coolant Accident (ISLOCA) sequences where the state of knowledge correlation between valve failures can affect the results. Since the peer review team determined that the ISLOCA analysis did not account for the state of knowledge correlation, the peer review team graded SR QU-A3 as Capability Category I and generated F&O 3-6 to document this issue.

SR QU-E3 requires the Probabilistic Risk Assessment (PRA) analyst to estimate the uncertainty intervals associated with parameter uncertainties. The peer review team judged that the use of the Multiple Greek Letter (MGL) method for the common cause analysis (which does not include uncertainty intervals for the common cause factors), the use of pre-calculated common cause failure basic events in support system IE fault trees without assigned uncertainty parameters, and the failure to consider uncertainty of the dependent Human Reliability Analysis (HRA) events was not sufficient to meet the requirements of SR QU-E3. Therefore, although a parametric uncertainty calculation was performed that would normally meet the requirement for Capability Category Ill, the exclusion of potentially significant basic events from that analysis was not judged to be sufficient to meet Capability Category II or III for SR QU-E3. Because the issues identified under SR QU-A3 and QU-E3 were related, they were combined into a single F&O.

TVA Response:

Sources of model uncertainty were identified and characterized for the WBN PRA.

The following list of topics that were covered.

- Grid Reliability and Loss of Offsite Power (LOOP) Models

- Support System Initiating Event (SSIE) Modeling

- IE Frequency Uncertainty EI-I

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

- Accident Sequence Uncertainty

- Systems Modeling Uncertainty

- Equipment Survivability and Heating, Ventilation & Air Conditioning (HVAC)

- Human Reliability

- Data

- Success Criteria and Thermal Hydraulics

- General Modeling Issues The above list includes all relevant issues considered in Table A-1 of EPRI-TR-1 016737 and provided a vehicle for identifying and characterizing WBN plant specific modeling uncertainties.

The characterization of modeling uncertainties was also reviewed by the Peer Review team. The team concluded in the Peer Review Report, "RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Watts Bar Nuclear Power Plant Probabilistic Risk Assessment," that "The qualitative assessment of sources of modeling uncertainty for the Level 1 model is very comprehensive and well documented to support future applications."

Attachment 1 provides an example of the characterization of model uncertainties associated with IE modeling and support system IE modeling. Resolution of finding related to accounting for the state of knowledge correlation and parameter uncertainties is in progress.

2. NRC Request The NRC staff position in RG 1.200 is that the PRA model represents the as-designed, as-built, and/or as-operatedplant.An accuraterepresentationof the plant is essential when attempting to construct a model that satisfies each of the technical elements in the standard.Identify the assumptions made relative to the as-built and as-operatedplant that could significantly impact the results and identify the resulting impacts, given these assumptions (Reference F&O 7-11, supportingrequirement (SR) IFPP-A4).

TVA Response When not specifically otherwise stated (e.g., specific system modeling in dual unit configuration), the development of the WBN Unit 2 PRA model is based on the assumption that Unit 2 will be identical to Unit 1. In the internal flooding (IF) assessment, such an assumption is not consistent with the requirements of the PRA standard. The Internal Flooding Analysis has been therefore supported by four dedicated walkdowns to confirm that the information retrieved through existing documentation was accurate and would be reflective of the as-built/as-operated status of the plant for WBN Unit 1 and as-built status for WBN Unit 2. The identification of potential differences between WBN Unit 1 and WBN Unit 2 were explicitly included in the walkdown scope. All differences between the units were identified and documented in the walkdown report. Attachment 2 provides the structure of the room-by-room tables. Interim situations due to the still incomplete El-2

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter status of Unit 2 (i.e., curbs being removed, equipment temporarily removed or not yet installed, doors kept open by construction equipment) were also identified and documented in the same walkdown reports (under walkdown notes). The analysis assumed that these identified interim situations will be rectified before operation of Unit 2 commences. As committed in February 9, 2010 letter (Reference 1), "Prior to fuel load, it will be confirmed that the Unit 2 Probabilistic Risk Assessment model matches the as-built, as-operated plant." The inability to rectify the interim situations could alter the flood propagation paths and the currently assumed PRA-related equipment that is impacted. This could result in changes to the estimated plant risk for WBN Unit 2. Epistemic uncertainties associated with the plant partitioning section of the flood analysis due to the incomplete status of Unit 2 were identified and specifically addressed in the WBN analysis. The pipe measurements performed during the third walkdown explicitly focused on both units. Walkdowns were performed by the PRA team with the assistance of Unit 2 personnel to better understand the differences between the two units and to get assurance of the realism of the assumption that interim situation would be rectified.

3. NRC Request Regarding all F&Os describing a resolution wherein changes have already been made (e.g. -F&Os 1-7, 3-13. 3-18, etc.), provide a description of the actualresolution and how, in practice, these changes were actually executed, along with an actual description of the change.

TVA Response The following is a list of F&Os that have been fully or partially addressed and a description of the resolution. This list also includes F&Os that have been resolved since TVA's Probabilistic Risk Assessment (PRA) Individual Plant Evaluation (IPE)

Summary Report for WBN Unit 2, which was submitted to the NRC on February 9, 2010 (Reference 1).

F&O 1 Battery Depletion & Direct Current (DC) Support System In the peer reviewed model, battery depletion was addressed in the model with an EQU gate containing all of Loss of Offsite Power (LOOP) lEs. The battery depletion gate is then applied into the model as a failure of the 125 Volt (V) DC vital battery boards. This logic incorrectly truncated the run failures of the Turbine-Driven (TD)

Auxiliary Feedwater (AFW) pump and flow path.

Subsequent to the peer review, the battery depletion logic was revised and a basic event with a probability of 1.0 was ANDed with LOOP lEs under the battery depletion gate. Figure 3-1 displays the revised modeling for battery depletion. The revised model was requantified, and cutsets were reviewed to confirm that the delayed TD-AFW pump failures and battery failures were properly modeled.

El-3

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter To support the ongoing resolution of the second portion of this finding regarding the battery board dependencies, the 125V DC system models and loss of 125V DC battery board support system IE trees were reviewed. In the loss of battery board support system IE trees, the battery board failures are correctly modeled. Loss of a 125V DC board would result in loss of that train and results in an IE (e.g, BUSFROBD_2361 DIE). After review of the 125V DC board system tops, it is recommended that the failure of battery board basic events (e.g.,

BUSFROBD_2361-D) be moved above the battery board gate and battery charger E1-4

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter gate to correctly model dependency of loss of a given board. Currently in the model loss of a 125V DC battery board is only failing the battery (i.e., charger is still available). Full resolution of this finding will include revising the 125V DC system top to correctly model board failure.

F&O 1 UncertaintyIntervals in Database While building the model and updating failure data information in the type code table uncertainty intervals were stored in the same location within the table. When an updated type code table was added into the model, it would overwrite information within a given field. On several occasions uncertainty data was left in a given field and was now tied to a type code or basic event.

After the peer review, the CAFTA database file was reviewed and revised to remove all extraneous uncertainty intervals and ensure correct uncertainty intervals are assigned to each type code and basic event. Full resolution of this finding will include a full review of the database after all model changes to address findings are complete.

F&O 1 Common Cause & AFW Type Codes (Related to RAI 13)

The loss of Component Cooling Water System (CCS) IE fault trees contain a pump fails to run common cause group with normally running and standby pumps. In the peer-reviewed model, the IE common cause probability was quantified using the CAFTA common cause tool which incorrectly calculated the IE frequency. The WBN model was reviewed and revised to address this finding. All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model. The common cause failure probabilities were then calculated by hand using the higher probability (IE basic event probability) as the independent failure rate. Basic events were then manually added into the model for common cause failures. The common cause calculation and basic event name was then documented in its corresponding system notebook. See response to RAI

1. 13 and RAI #7 for more detail on resolution of this F&O.

The type code assignment for the TD-AFW has been updated, and the exposure time on the TD-AFW has been updated to match mission time of the AFW system (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). See response to RAI #13 for more detail on resolution of this F&O. Full resolution of this finding will include updating the type codes for the Motor-Driven (MD) AFW pumps.

F&O 1 SSIE Common Cause & AFW Pump Common Cause (Relatedto RAI 9)

To address this finding one common cause group was created for the Essential Raw Cooling Water (ERCW) pumps failing to run (all 8 pumps in the same group). This probability was calculated by hand and manually added into the ERCW IE trees. All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model. The systems impacted by the resolution of this finding were the ERCW and CCS IE trees.

The second part of the F&O related to the AFW pumps. To address the second concern of the F&O, common cause failure modes were reviewed for the TD-AFW El-5

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter and the MD-AFW pumps. See response to RAI #9 for more detail on resolution of this F&O.

F&O 2 Data Screening (Related to RAI 12)

The Data Analysis Notebook was reviewed and updated to address F&O 3-1. The phrase "failures that would not have impacted any PRA success criteria" was intended to mean that all functional failures of equipment modeled in the PRA were counted as failure events when evaluating the plant-specific data. Consistent with current PRA practice, all partial failures were also counted as functional failures and included in the Bayesian updating process.

Subsequent to the peer review, Component Deficiency Evaluation (CDE) report 723 (unavailability with no actual failure) was reclassified as a non-failure; CDE reports 650 and 651 (single unavailability event counted as two start failures) were counted as a single event; and CDE reports 790 and 791 (unavailability counted as failures) were reclassified as non-failures as this event was accounted for in the unavailability.

See response to RAI #12 for more detail on resolution of this F&O. Full resolution of this finding will include updating the database to address CDEs 650 and 651.

F&O 2 Human ErrorProbability(HEP)Lower Limit (Relatedto RAI 11)

To address this finding, the recovery rule file was reviewed and revised to limit the joint probability of each combination of human actions to be no less than 1.OE-05 and the HRA Notebook was updated to reflect this. No independent or combined dependent HEP value currently exceeds the 1.OE-05 recommended lower limit. See response to RAI #11 for more detail on resolution of this F&O.

F&O 3 System Successes (Related to RAI 15)

In addition to the "One-Top" model developed for CDF analysis, individual event tree sequence models were developed to analyze each accident progression sequence.

These sequence models included both event tree top event failures and successes.

All Unit 1 sequences were evaluated during the initial quantification to review and check the model logic and consistency with systems and success criteria. Sequence review is continuing as model changes are made.

F&O 4 SSIE Common Cause (Related to RAI 7)

The WBN model was reviewed and revised to address this finding. All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model. The common cause failure probabilities were then calculated by hand using the higher probability (IE basic event probability) as the independent failure rate. Basic events were then manually added into the model for common cause failures. The support system IE trees impacted by the resolution of this finding were the loss of ERCW and the loss of CCS. See response to RAI #7 for more detail on this review.

El-6

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter F&O 5 Plant Damage States (Related to RAI 17)

To address the finding, the documentation and model were corrected. All Anticipated Transient Without Scram (ATWS), general transient, and very Small Loss of Coolant Accident (SLOCA) sequences without Condensate Storage Tank (CST) refill were re-binned as a dry steam generator (SG) secondary side. Similarly, all Steam Generator Tube Rupture (SGTR) CD sequences with failure of CST refill were re-binned as a large bypass.

An assumption was not added to address Large Loss of Coolant Accident (LLOCA) sequences having a secondary side inventory. Because the break flow for a LLOCA is sufficient to remove the decay heat via the break size, the secondary side inventory of the SGs would not be used to remove decay heat. See response to RAI #17 for more detail on addressing this F&O.

F&O 7 RCP Seal LOCA MLOCA (Related to RAI 18)

To address this F&O, an analysis of the 480 gpm per pump leak, using the correct elevation of the RCP seal for the WBN Reactor Coolant Pump (RCP) Model 93A pump, was performed using the MAAP4 computer code after the peer review. The analysis shows the RCS pressure is less than 400 psig at the time of reactor vessel failure. Therefore, the PRA modeling of this accident scenario in the WBN Unit 2 Individual Plant Examination (IPE) analysis correctly predicts that this is a low pressure sequence. The WBN model was reviewed against generic guidance on the treatment of direct containment heating (DCH), and it was concluded that the modeling used in the WBN Level 2 PRA is considered to be appropriate and consistent with current industry practices. Refer to the response to RAI #18 for more detail on this review and the 480 gpm seal LOCA assessment.

F&O 7 SG Safety Relief Valve Cycling During a SGTR A qualitative assessment was performed to assess the impact of F&O 7-20 on the LERF results. Evaluating SG safety relief valve cycling (as opposed to a stuck open SG safety relief valve) during a SGTR IE credits holdup of fission products. The potential impact of crediting the holdup of fission products would reduce the LERF frequency.

From the WBN Unit 2 results, the contribution to LERF from a SGTR event is less than 1%. Given the low SGTR contribution to LERF, crediting SG safety relief valve cycling would have a limited impact on LERF results and the risk profile of the plant.

4. NRC Request The generalpurposes of the IPE, as noted in NRC Generic Letter (GL) 88-20, is for the applicant/licenseeto:

1. Develop an appreciationfor severe accident behavior

2. Understandthe most likely severe accident sequences

3. Gain a more quantitative understanding of the overall probabilities of core damage and fission product releases.

El-7

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

4. If necessary, reduce the overall probabilities of core damage and fission product releases by modifying, where appropriate,hardwareand procedures that would help prevent or mitigate severe accidents.

With regardto fission product release, the PRA standardonly analyzes large early release. It appears from TVA 's submittal that all potential releases (large and small early, large and small late) were evaluated. However, the nature of the evaluation of releasesis unclear,as well as whether any peer review was performed on such an evaluation. Consequently, the staff finds it is difficult to determine if the four purposes of the GL were adequately addressed.Describe how these purposes were achieved, in that the results of the analysis are technically adequate. In that regard,what method was used to analyze these severe accidents (beyond LERF)? How was the technicaladequacy of this analysis evaluated since the peer review does not go beyond LERF?

TVA Response Peer Review Team Clarification:

Since the purpose of the peer review was to assess the technical adequacy of the PRA relative to the requirements of Parts 2 and 3 of the ASME/ANS PRA Standard, the peer review team did not review or assess the technical adequacy of those elements of the Level 2 analysis beyond those required to calculate the LERF.

TVA Response:

The WBN Level 2 PRA was performed using the methodology developed for a Pressurized Water Reactors Owners Group (PWROG) simplified Level 2 PRA model. The peer review team reviewed this WBN Level 2 analysis against the LERF Analysis (LE) High Level Requirements (HLRs) and SRs and concluded that the methodology was generally acceptable as a LERF assessment, with exceptions and clarifications described in their report. A comparison of the RA-Sb-2009 PRA Standard for LE and the January 2010 Draft Revision 1 of the ANSI/ANS/ASME-58.24-20xx Level 2 PRA Standard shows many similarities. The containment challenges to be considered in Table 3.5-8 of the Level 2 Standard and Table 2-2.8-9 of RA-Sb-2009 are similar for ice condenser plants except for the explicit containment failure modes considered in the Level 2 Standard. The WBN Level 2 PRA addresses these additional late failure modes. In addition, the potential for containment failure due to hydrogen events (deflagrations and transition to detonation) and the impact of hydrogen igniters was analyzed in detail for both early and late containment challenges. The WBN Level 2 analysis also considers possible post-core damage operator actions that are directed from the WBN Severe Accident Management Guidance (SAMG).

Therefore, there is reasonable confidence that the Level 2 PRA is of sufficient technical quality for identifying vulnerabilities per GL-88-20. No vulnerabilities for either design features or procedures (including SAMG) for either early (LERF) or late containment challenges were identified from the PRA Level 2 analysis.

El-8

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

5. NRC Request The PRA standardrequires that the operatingsystems be evaluated to determine if failure will result in an IE. It is not clear from F&O 4-14 what systems were omitted from this review (e.g., loss of component cooling water). In particular,failure of support systems can be risk significant. Provide the list of systems that were systematically evaluated for the determinationof lEs. Additionally, provide the justification for system screening.

TVA Response The Failure Modes and Effects Analysis (FMEA) was performed for the WBN PRA.

The FMEA list included but is not limited to the following support systems; loss of cooling water, loss of air, and loss of AC power. Peer Review F&O 4-14 recommended that this list should include all normally running systems at power.

The current FMEA was developed by identifying all PRA support systems credited in the PRA model. Systems were screened out as possible lEs if loss of the given system during power operation conditions would not lead to an immediate or delayed reactor trip (manual or automatic).

Attachment 3 contains the list of systems that were systematically evaluated and documents the screening. Please note that loss of various plant HVAC systems were considered and addressed outside of the FMEA. TVA is in the process of expanding the FMEA to include all normally operating plant systems.

6. NRC Request The F&O problem statement is difficult to understand in F&O 4-3 without additional information. Provide a more comprehensive descriptionof the problem statement associated with this F&O. In addition, provide the results of the recalculationand identify the extent to which the IE frequency changedand its impact on the final results (e.g., different contributors to CDF or LERF).

TVA Response

Background:

NUREG/CR-6928 contains a frequency for total loss of condenser and a general transient frequency. To maintain the same IE grouping as was previously used in the WBN Unit 1 PRA model, the general transient and loss of condenser frequencies needed to be broken down into subgroups. For example, the NUREG/CR-6928 general transient IE was separated into a reactor trip, turbine trip, core power excursion, etc.

Section 8.3 of NUREG/CR-6928 states that the "data period used to quantify the IE frequencies ranges from 1988-2002 to 1998-2002, depending upon the frequency and whether a trend exists." A list of available industry lEs identified by Licensee El-9

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Event Report (LER) number and categorized consistent with the method used in NUREG/CR-5750 (see Table 2-1 of NUREG/CR-5750) were used to subgroup initiator types. The list of LERs and event categorization was provided to TVA from Idaho National Laboratory. This list was the source data for NUREG/CR-6928.

Since the NUREG does not provide specific guidance on the data window for each initiator type, two studies were performed. The first was to review general transient events and loss of condenser events in the 1998-2002 data window and the second was to review all available LERs.

From the WBN IE Analysis, Table 5-4 contains a list of General Transient events (Q) identified by LER number and their categorization for the 1998-2002 data window.

Table 5-5 contains a list of General Transient events (Q) identified by LER number and their categorization for the 1987 to March 2008 data window. Table 5-6 contains the list of Total Loss of Condenser Heat Sink events in the 1998-2002 data window and Table 5-7 contains a list of Total Loss of Condenser Heat Sink for the 1987 to March 2008 data window. Copies of these tables are provided with this response.

Copies of these referenced tables can be found in Attachment 4.

In the WBN IE analysis, the General Transient value and Total Loss of Condenser Heat Sink value was fractionally broken down to subcategories and quantified using a multiplication factor. The multiplication factor is the number of industry events for the WBN IE category divided by the total number of industry general transient events. To obtain a larger sample of events, all available data (1997-March 2008) was used to evaluate the General Transient fractional frequency and Total Loss of Condenser Heat Sink fractional frequency.

The resolution of this finding is still in progress.

Comparisons:

The following tables compare the calculated frequency for the General Transient and Total Loss of Heat Sink frequencies using both available data windows.

Recalculation and quantification of the WBN model has not been performed at this time to address this F&O. From the comparisons of the total frequencies in Table 1 and Table 2, the impact of using the different time window will have minimal impact on the model results and the risk profile of the model.

EI-10

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 1: General Transient Data Window - AllData Available Data Window - 1998 to 2002 Data Initiating Event Description Numberof Fraction Fraction Number Fraction Frciofrato Fraction Intiainof Total of Prior of of Total of Prior Industry ofvTotal oFPrioy Industry Events Frequency IndustryEvents* Events Frequency Events*

CORE POWER CRPWR17 0.97% 7.27E-03 CPEX EXCURSION 1 0.44% 3.28E-03 EXCESSIVE MAIN 93 5.30% 3.98E-02 EXMFW FEEDWATER 9 3.93% 2.95E-02 INADVERTENT SAFETY 24 1.37% 1.03E-02 ISI INJECTION 0 0.00% 0.00E+00 LOSS OF 1 OR MORE LRCP RCPS/PRIMARY FLOW 11 4.80% 3.61 E-02 INADVERTENT CLOSURE OF ONE 46 2.62% 1.97E-02 MSIV MSIV 4 1.75% 1.31 E-02 PARTIAL LOSS OF MAIN 350 19.93% 1.50E-01 PLMFW FEIEDWATER 41 17.90% 1.34E-01 STEAM GENERATOR PORV/SAFETY FAILS 2 0.11% 8.55E-04 MSVO OPEN 0 0.00% 0.OOE+00 REACTOR TRIP RECTRTRP647 36.85% 2.77E-01 RTIE INITIATING EVENT 98 42.79% 3.21 E-01 TURBINE TRIP TUBIETRP482 27.45% 2.06E-01 TTIE INITIATING EVENT 62 27.07% 2.03E-01 Total** 98.46% 7.39E-01 98.69% 7.41 E-01

• Reference Table 5-5 of Attachment 4

• • Reference Prior Data for General Transients Table 5-2 (Source: NUREG/CR-6928),

note that the fraction of loss of vital AC I&C events is removed from the total frequency since it is addressed in the loss of vital AC IE.

EI-Il

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 2: Total Loss of Heat Sink Data Window - All Available Data Data Window - 1998 to 2002 Initiating Description Number Number Event D i Fraction Fraction of Nb Fraction Fraction of Eetof of Industry of Total Evns Prior Feuny Industry of Total Events Prior Frequency Events* Events Frequency Events*

LOSS OF CONDENSER 28 8 VACUUM____

TUR TURBINE BYPASS21 81.08% 6.58E-02 75.00% 6.08E-02 LOCV UNAVAILABLE INADVERTENT IMADLSRE IMSIV 7 18.92% 1.53E-02 3 25.00% 2.03E-02 CLOSURE OF ALL MSIVS Total 100.00% 8.11E-02 100.00% 8.11E-02

• Reference Table 5-7 of Attachment 4

7. NRC Request When using a fault tree approachto calculate an IE frequency, care must be taken to recognize that the calculationis for a frequency as opposed to a probability (such as not used in SR IE-C9). It appears from F&O 4-7, that a probabilitywas calculated instead of a frequency. Describe in more detail the issue raisedby the F&O and how it was resolved. In addition, indicate how the results and potential contributorsare affected by modifying these common cause failure (CCF) events (Reference F&O 4-7, SR IE-C9/10/15).

TVA Response SSIEs for WBN were developed under the guidance of the EPRI Support System Initiating Event: Identification and Quantification Guideline (TR 1013490). The technique for modeling the extended mission time for SSIE trees was to model the initiator basic event with a mission time of 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br />. The mission time for a secondary failure was consistent with the time that is used in the post-accident fault tree. Each SSIE tree top logic generates a per reactor year frequency. To achieve this logic, the SSIE tree was ANDed by the Plant Availability Factor and the initiator basic event. The initiator basic event should be set at an initiator type in CAFTA and was assigned a 1 event per year frequency. For common cause groups containing initiating basic events (mission time of 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br />) and secondary failures (mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), the independent failure rate used for the group to calculate the common cause failure rate should be the IE basic event probability.

The loss of CCS IE trees contain a pump fails to run common cause group with normally running and standby pumps. In the peer-reviewed model, the IE common cause probability was quantified using the CAFTA common cause tool. The CAFTA common cause tool was incorrectly quantifying the probability of the IE. The CAFTA common cause tool is not the appropriate tool for any common cause group with different independent failure probabilities.

E1-12

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter The WBN model was reviewed and revised to address this finding. All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model. The common cause failure probabilities were then calculated by hand using the higher probability (IE basic event probability) as the independent failure rate. Basic events were then manually added into the model for common cause failures. The common cause calculation and basic event name was then documented in its corresponding system notebook.

The only systems impacted by the resolution of this finding were the ERCW and CCS IE trees. All remaining support system IE trees did not have common cause groups with different independent failure probabilities. Addressing this finding increased the IE frequency for the Total Loss of ERCW IE tree and the Total Loss of CCS event tree. Total Loss of CCS frequency increased by over an order of magnitude and the Total Loss of ERCW frequency increases by a factor of 5. The common cause failure of all pumps to run IE is the dominant contributor to the loss of each system.

8. NRC Request F&O 5-1 is concerned with the "mission time" used for the room heatup calculation.

Room heatup calculationsand the time to failure of the equipment in the room from overheating can have a significant impact on the results. The staff finds confusing that this F&O has been related to SR SC-A5, which -is concerned with the accident sequence mission time; that is, the time at which the plant is assumed to reach a stable state (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). The peer review finding is better relatedto requirements AS-B3, SY-A 18, and SY-A22. Provide the basis for this finding under SR SC-A5. In addition, provide the assumptionsand technicalbasis for the room heatup calculations.

TVA Response Peer Review Team Clarification:

The most appropriate SR reference for F&O 5-1 may actually be SY-A 11 since the room heatup calculations are used to determine if cooling equipment is required to support system operation. However, the F&O was identified by the reviewer for the SC element and was therefore documented as part of the Success Criteria (SC) assessment. Since the grading of SR SC-A5 was not reduced and the grading of System Analysis (SY)-A 11 would also not have been impacted based on the preponderance of evidence principal (NEI 05-04, Revision 2, Section 4.6), the assignment of the SR reference did not impact the review results.

EI-13

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter TVA Response:

A review of WBN HVAC requirements was performed by reviewing design documents developed by TVA evaluating temperature conditions associated with lost or degraded HVAC equipment and comparing the resulting temperature response against qualification information presented in the Environmental Data drawings developed in support of the WBN 1 OCFR50.49 Electrical Equipment Qualification (EQ) Program. Calculations for the following areas were used to identify the maximum area temperatures.

- 6.9 kV and 480 V Board Room

- 480 V Transformer and 125 V Battery Rooms

- Auxiliary Building EL 713.0 General Floor Area

- RHR Pump Room

- ERCW Intake Pumping Station

- Diesel Generator (DG) 480V Board Room The following assumptions and technical bases were used in the evaluation of room heatup:

- The TVA design calculations used included a variety of assumptions regarding HVAC operation. Assumptions included degraded HVAC performance, partial loss of available HVAC, unanticipated operation of HVAC equipment, as well as the loss of all HVAC. The evaluations were based on the loss of all HVAC except where specific failures were analyzed by TVA that resulted in more limiting conditions.

- No operator action was considered unless otherwise noted.

- The time required for the equipment in the room to operate was 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> unless otherwise noted. Twenty-four hours is the time period of interest for the PRA analysis.

- Minor short term temperature excursions above the EQ temperature were determined to be acceptable based on temperatures remaining well below the mild environment upper temperature limit for the very short time involved (less than four hours).

- Outside air temperatures and boundary conditions were specified in the calculations used in developing this evaluation. The calculations used were developed for a variety of purposes. Some were design basis calculations and some were prepared specifically for use in PRA analyses. Some of the analyses described in the calculations were performed at the design maximum temperature, others had peak temperatures at the design maximum but incorporated diurnal effects, and in limited cases the analyses were performed using normal maximum conditions. In all cases, the temperature profiles used were appropriate for use in PRA evaluations where realistic conditions can be used.

- Areas that remain below the EQ temperature for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without operator action are screened out.

- Engineering judgment can be used to screen out areas that exceed their EQ temperature by a nominal amount (i.e., 2 degrees).

- Component operability for 10CFR50 Appendix R evaluations show electrical equipment in WBN will operate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 140'F without failure due to environmental conditions.

EI-14

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

- The control room was screened out based on proceduralized operator actions.

- Any area which cannot be screened was considered unavailable upon a loss of HVAC.

9. NRC Request Division of common cause groups for equipment in the same system may underestimate the impact of common cause and consequently underestimatethe risk and incorrectly identify potential contributors. Provide a description of the in-progress resolution for F&O 1-8, and indicate whether the risk estimation andpotential contributorswere affected. If affected, describe the change in the results. If not affected, explain the basis for no change in the results.

TVA Response The first part of the peer finding disagreed with the common cause group assignments for ERCW pumps failing to run in the loss of ERCW IE trees. The ERCW system contains 8 pumps with 4 normally operating. In the peer reviewed model, a common cause group was assigned for the 4 normally operating pumps (given a mission time of 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br />) and a separate common cause group was assigned for the 4 standby pumps (given a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

To address this finding, one common cause group was created for the ERCW pumps failing to run (all 8 pumps in the same group). This probability was calculated by hand and manually added into the ERCW IE trees. Addressing this finding increased the IE frequency for the Total Loss of ERCW IE tree. Total Loss of ERCW frequency increases by a factor of 5. The common cause failure~of all pumps to run IE is the dominate contributor to the loss of ERCW.

All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model. The systems impacted by the resolution of this finding were the ERCW and CCS IE trees. This model update is also described in the response to RAI #7.

The second part of the F&O related to the AFW pumps. To address the second concern of the F&O, common cause failure modes were reviewed for the TD-AFW and the MD-AFW pumps. The WBN MD-AFW pumps are a fixed speed 9 stage centrifugal pump with a capacity of 500 gpm. The WBN TD-AFW pumps are a variable speed 6 stage centrifugal pump with a capacity of 790 gpm. Although the pumps are manufactured by the same company, they are judged to be different designs; therefore, no common failure mode is modeled due to the design of the pumps.

Another potential common failure mode for AFW pumps is steam binding due to discharge check valve back leakage. The WBN AFW pumps do not share a common discharge header. The TD-AFW pump provides flow to each SG and is connected to the MD-AFW pump discharge line before the containment penetration.

For SGs 1 and 4, two check valves from TD-AFW pump discharge to the SG and Feedwater line prevent steam from binding the TD pump. For SGs 1 and 4, one check valve from MD-AFW pump discharges to the SG and Feedwater line prevents EI-15

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter steam from binding the MD pump. For SGs 2 and 3, there are two additional shared check valves between the MD-AFW and TD-AFW discharge lines and the SG and Feedwater line. Given the AFW pumps do not share a common discharge header, and the number of check valves that have to fail and experience reverse leakage, the common cause contribution due to steam binding of the AFW pumps is judged to be insignificant.

10. NRC Request Understandingthe dependencies can help determine potential vulnerabilities associatedwith the plant, particularlythose associatedwith initiationand actuation.

Failure to model the actuationsignal following loss of station power (LOSP)may cause some subtle, but significant dependencies to be missed. Identify those sequences potentially affected by this incomplete modeling of dependencies and their overall impact on the final results. Provide a description of the in-progress resolution for F&O 1-4 and how the results were impacted. If not impacted, explain the basis.

TVA Response Sequences involving the LOOP that require the DG to start and load are potentially affected by this incomplete modeling of dependencies. The LOOP lEs accounts for 45.9% of the CDF for WBN Unit 2.

Failures of the actuation signals from Reactor Protection System (RPS) and Engineering Safety Features Actuation (ESFAS) are included in the model; however the loading relays for the DG load sequencer were not modeled. The relay failures are bounded by pump failures. From NUREG-6928, the failure rate of standby motor driven pumps to start is 5.25E-3 per demand; while the failure rate of relays to operate on demand is 2.48E-5 per demand. Therefore, the loading relays can be excluded from pump start failures because the relay failure rate is more than two orders of magnitude less than the start failure rate for the pump. Additionally, failures of DC control power to the loading relays would be dominated by failures of the DC bus (4.34E-7 per hour x 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> = 1.04E-5) which is also more than two orders of magnitude less than the start failure rate for the pump. Therefore, the impact on CDF for these dependencies is anticipated to be small.

Modeling of these relays is in progress, and currently no insights can be shared on the progress of resolving this F&O.

11. NRC Request Regarding F&O 2-28, multiple human failure events (HFEs)in a single cutset can result in erroneously truncatingthe cutset. For example, three HFEs with human errorprobabilities(HEPs) of IE-3 will result, at least, a combined HEP of IE-9. The standardrequires application of a threshold, because a combined HEP of IE-9 implies a state of knowledge regarding human performance beyond the uncertainties.In addition, it can result in erroneous truncationof cutsets. Provide an EI-16

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter explanation of why a threshold value (1 E-5) for a lower limit was not appliedto cutsets with multiple HFEs. Also, indicate what cutsets were potentially missed if a threshold value were applied (Reference F&O 2-28, SR HR-D5).

TVA Response HRA dependency analysis was performed on the WBN Unit 1 CDF and LERF cutset files. The results of the analysis were used to generate a list of combination events that includes the probability of each combination event identified and the HFEs in each combination event. This information was incorporated in the WBN quantification recovery rule file. After final quantification, application of the recovery rules removed all of the HFE combinations identified during the HRA dependency analysis, replaced them with the applicable HRA combination basic event in the cutsets where they appear, and recalculated CDF and LERF. To ensure that multiple HFEs in a single cutset were not erroneously truncated, all HEPs were initially set to 1.0 during the dependency analysis to determine the list of combination events.

After quantification in the peer reviewed model, it was recognized that several of the combination event probabilities determined from this analysis were less than 1.OE-

05. Section 5.3.3.6 of NUREG-1 792 (Good Practices for Implementing Human Reliability Analysis [HRA], April 2005) states: "The total combined probability of all the HFEs in the same accident sequence/cutset should not be less than a justified value. It is suggested that the value not be below -0.00001 (1.OOE-05) since it is typically hard to defend that other dependent failure modes that are not usually treated (e.g., random events such as a heart attack) cannot occur. Depending on the independent HFE values, the combined probability may need to be higher."

A sensitivity analysis was performed to determine the impact on CDF of placing a minimum probability value for the combination events. The results of the analysis are summarized in the table below. There was approximately a one percent increase in CDF without flooding and no change in CDF when the lower limit was less than 1.OE-05. There was no impact on CDF due to IF and no impact on LERF without flooding or LERF with flooding. Please note that this sensitivity study was performed on the peer reviewed model (Unit 1 CDF). The results do not reflect the model changes that were incorporated to address peer review findings.

Table F-I: Dependency Analysis Sensitivity Results Case Lower Limit for CDF Combination Events Base Base 2.73E-05 1 1.OE-06 2.73E-05 2 5.OE-06 2.73E-05 3 1.OE-05 2.77E-05 Subsequent to the peer review, the recovery rule file was revised to limit the joint probability of each combination to be no less than 1.OE-05 and was updated to reflect this. No independent or combined dependent HEP value is currently lower EI-17

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter than the 1.OE-05 recommended lower limit. With the combined HEP value of no less than 1.OE-05, there are no potentially missed cutsets in the CDF model.

12. NRC Request Generally, when identifying events as failures in a PRA, partialoperation of a component is considered a failure. That is, a partiallyopened valve, a partially operatingpump, etc. are considered failures. It appears from the following statement, "failuresthat would not have impacted any PRA success criteria," that this current PRA practice was not followed. Explain what is meant by "failuresthat would not have impacted any PRA success criteria," and provide the basis for why these failures are determined not to be applicable (i.e., why they are not included as possible failures (Reference F&O 2-3, SR DA-C4)).

TVA Response The phrase "failures that would not have impacted any PRA success criteria" was intended to mean that all functional failures of equipment modeled in the PRA were counted as failure events when evaluating the plant-specific data. Consistent with current PRA practice, all partial failures were also counted as functional failures and included in the Bayesian updating process.

Subsequent to the peer review, CDE report 723 (unavailability with no actual failure) was reclassified as a non-failure, and CDE reports 790 and 791 (unavailability counted as failures) were reclassified as non-failures as this event was accounted for in the unavailability. Full resolution of this F&O 2-3 will include updating the database to address CDEs 650 and 651.

13. NRC Request SR DA-D1 states that, for CapabilityCategory I, one must "useplant-specific parameterestimates for events modeling the unique design or operationalfeatures if available, or use generic information modified as discussedin DA-D2." It is unclear how F&O 1-7 relates to SR DA-DI since the F&O relates to the calculation of CCF probabilities,type codes assignment for basic events, and a mission time for a basic event. Pleaseprovide the basis for this finding under SR DA-D1. Provide an explanation of why the hand calculation and CAFTA calculation do not match.

Further,if the hand calculation is more appropriate,indicate the impact on the final results given that hand calculationsare used, the type codes are corrected,and the correctmission time is used.

TVA Response F&O 1-7 was applied to supporting requirement Data Analysis (DA)-D1 because the calculated parameter estimates for the identified basic events may not have been realistic and could be non-conservative. DA-D2 provides guidance if neither plant-specific data nor generic parameter estimates is available. For examples identified EI-18

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter in the F&O 1-7 generic common cause data and generic/plant-specific (Bayesian updated), AFW failure rates were available.

As discussed in the response to RAI 7, the loss of CCS IE fault trees contain a pump fails to run common cause group with normally running and standby pumps. In the peer-reviewed model, the IE common cause probability was quantified using the CAFTA common cause tool which incorrectly calculated the IE frequency. As a result of this part of F&O 1-7, the WBN model was reviewed and revised to address this finding. All common cause groups with different independent failure probabilities that used the CAFTA common cause tool were removed from the model, and the potential loss of CCS was reevaluated.

The total loss of CCS in Unit 1 or Unit 2 can occur due to various CCF combinations of CCS pumps failing to run and CCS heat exchanger (HE) failures due to either rupture or plugging. A total loss of CCS in Unit 1 or Unit 2 due to pump and HE common cause failures is represented by a single basic event in the CCSTL1 and CCSTL2 fault trees. The annual frequency of this event occurring was determined by systematically identifying all of the possible CCF combinations that contribute to a total loss of CCS in Unit 1. The frequency for each CCF combination was then calculated by hand using the annual failure higher frequency as the independent failure rate. For example, the frequency of the combination that includes failure of all five pumps was determined using the following equation:

Q"" =jflX7X9XeXQ, where, Q5(5) = CCF of all five components in a group size of 5

,8,y, 8, and Eare the applicable Multiple Greek Letter method parameters Qt = the independent failure rate for CCS pump fails to run multiplied by 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> to determine the annual frequency Basic events were then added into the model for loss of CCS due to CCF was revised to document the calculations and modeling changes. The calculated annual frequency of this event was also used for Unit 2 as the likelihood of this event is identical in both units.

The type code assignment for the TD-AFW have been updated and the exposure time on the TD-AFW has been updated to match mission time of the AFW system (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

14. NRC Request Inappropriatetruncation can result in significant accidentsequences being erroneously eliminated; SRs QU-B3/LE-E4 provide the requirements for acceptable truncation. Provide the technicalbases for using the same truncation limit for LERF; El-19

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter that is, provide the change in LERF if a lower truncationlimit was issued. If the change in LERF is greaterthan 5 percent, identify what sequences were eliminated (Reference F&O 3-1).

TVA Response TVA will respond to this Request for Additional Information by October 29, 2010.

15. NRC Request By not including system successes, inappropriatecutsets can be generated.In turn, this can mask the real contributorsto plant risk. Provide the technicaljustification for not accounting for system successes and provide the justification for the identified significant contributorsgiven systems successes were not included in the evaluation of the accident sequences (Reference F&O 3-3, SR QU-B6).

TVA Response In addition to the "One-Top" model developed for CDF analysis, individual event tree sequence models were developed to analyze each accident progression sequence.

These sequence models included both event tree top event failures and successes.

The WBN top logic was developed to allow event tree sequences to be quantified separately. Sequence cutset results include removal of mutually exclusive events and recovery factors applied to appropriate cutsets after quantification resulting in individual cutset values below the truncation limit. Some sequences required a lower truncation to produce results. All Unit 1 sequences were evaluated during the initial quantification to review and check the model logic and consistency with systems and success criteria.

The top sequences from the event trees for sequences that cumulatively contribute more than 95% of the internal event (without IF) CDF were reviewed for consistency with the one-top model.

16. NRC Request A PRA is a complex model wherein a small errorcan lead to a gross misrepresentationof the plant risk profile and its contributors.As such the PRA standardrequires a review of a sample of significant accident sequences/cutsets sufficient to determine whether the logic of the cutset or sequence is correct. It is unclearfrom F&O 3-15 the extent to which a review of the cutsets was performed.

Describe the internalreview that was performed and the results of the review (e.g.,

what inappropriatecutsets were identified). In addition, if an internal review was not performed, provide the technicalbases explaining how the reasonablenessof the cutsets was determined and that the cutsets reflect the risk of the plant.

EI-20

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter TVA Response Various techniques were used to perform cutset reviews. The basic events in the cutsets were qualitatively or intuitively reviewed to ensure that a cutset makes physical sense. The cutsets were also quantitatively reviewed to ensure that the cutset probability or frequency was correct. Software tools were used to trace cutsets through the event sequences and the system models to ensure model accuracy. Cutset reviews were performed at the system level, accident sequence level, and CDF level. As model changes are incorporated the cutsets results are continually reviewed.

CDF Cutset Review The CDF cutset review was performed with the cutset from the CDF level quantification. The top 100 CDF cutsets were reviewed collectively by the PRA team and are presented in the Quantification Notebook. A cutset review was performed for all IE groupings. If cutsets were identified as not accurately reflecting the plant response to the IE, a modification was made to the overall model and the quantification was repeated. This process was repeated until the cutsets accurately depicted plant response to the proposed initiator. As a precursor to the CDF cutset review, a system level cutset review was performed to ensure that accurate models were incorporated into the plant-level model. If the system-level result was not accurate, then changes were incorporated at the system level.

Accident Sequence Cutset Review A separate partition was developed within the plant-level fault tree model to include all of the sequence fault tree modules. Sequence modules were developed for each initiator and each sequence that follows a path to a core damage state. The sequence level fault tree modules were quantified individually to yield accident sequence cutsets. The accident sequence review process consisted of reviewing the cutsets generated for each accident sequence. If the cutsets were incorrect and did not accurately reflect failures within the given sequence, a modification was made to the model logic. This process was repeated until the cutsets accurately depicted the failures for a given sequence.

Non-Significant Cutset Review Two types of non-significant cutset reviews were performed: First, cutsets were randomly selected from the CDF level quantification results file. These cutsets were below the dominant cutsets previously reviewed. Second, the cutset result file for each sequence was reviewed to ensure that the event sequence was modeled correctly. These cutsets were from the quantification results for all accident sequences. Many of these cutsets were below the cutoff limit used for the CDF level quantification. In both cases, the review process involved identifying the correctness of the sequence of events in the cutset.

EI-21

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

17. NRC Request ForF&O 5-13, it appearsin the resolution that the concern raisedwas addressed (e.g., CAFTA model revised); however, it is not clearif the revision appropriately addressedthe concern. Describe the actual resolution implemented and how it addressedthe issue raisedby the F&O. In addition, state if any results were impacted by this issue.

TVA Response In the Level 2 results provided to the Peer Review Team, core damage (CD) accident sequences with failure of CST refill were incorrectly labeled with a wet SG secondary side inventory. When in fact, sequences with a failure of CST refill would not have secondary side water inventory at the time of core damage.

The documentation and model were corrected based on F&O 5-13. All ATWS, general transient, and very SLOCA sequences without CST refill were re-binned as a dry SG secondary side. Similarly, all SGTR CD sequences with failure of CST refill were re-binned as a large bypass.

An assumption was not added to address LLOCA sequences having a secondary side inventory. Because the break flow for a LLOCA is sufficient to remove the decay heat via the break size, the secondary side inventory of the SGs would not be used to remove decay heat.

A quantitative comparison of the quantification results based on the re-binning and the original results cannot be done because all PRA model changes made to address Peer Review F&Os were done simultaneously. However, a qualitative assessment expects that the impacts on LERF are minimal. This is because the accident progressions, with or without secondary side water inventory in the SG, can still progress to a large release. The availability-of inventory in the SG affects the phenomena that occur after core damage and before the Level 2 endstate.

18. NRC Request The peer review in F&O 7-19 appropriatelynoted that a medium loss-of-coolant accident (LOCA) is generally considerednot large enough to result in low pressure that is sufficient to alleviate a direct containmentheating (DCH) concern. Provide justification for the classificationof the 480-gpm pump seal LOCA as a low-pressure (i.e., medium LOCA) as opposed to a high-pressurescenario. This description should include a discussion of the relationshipof this event to DCH and a justification of why this does not challenge the containment (Reference SR LE-B2).

EI-22

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter TVA Response In the documentation provided to the Peer Review Team, the RCS pressure following a 480 gpm/pump RCP seal LOCA was not documented. Therefore, the peer reviewer could not compare the RCS pressure at reactor vessel failure for a 480 gpm/pump LOCA to those plant conditions which result in binning as a low pressure sequence with respect to post-CD accident phenomena, such as DCH.

The Level 2 analysis divides the CD sequences into high and low pressure sequences, using the accumulator setpoint (600 psig) as the partition between the pressures. This is consistent with current industry practice.

To specifically address this F&O, an analysis of the 480 gpm per pump leak, using the correct elevation of the RCP seal for the WBN RCP Model 93A pump, was performed using the MAAP4 computer code after the Peer Review. The analysis shows the RCS pressure is less than 400 psig at the time of reactor vessel failure.

Therefore, the PRA modeling of this accident scenario in the WBN Unit 2 IPE analysis correctly predicts that this is a low pressure sequence.

Guidance on DCH is contained in NUREG/CR-6338 for large dry and subatmospheric PWR containment plants and NUREG/CR-6427 for ice condenser containment plants. These reports use an RCS pressure of 200 psig as the cutoff below which DCH is considered physically impossible. At pressures between 200 and 600 psig, the report considers DCH to be possible but not likely. More recently, a generic PWROG model developed for the PWROG suggests grouping large LOCAs, medium LOCAs, and all RCP pump seal LOCAs greater than 200 gpm into a low pressure bin for treatment in the LERF/Level 2 assessment and quantification.

Additionally, the EPRI Severe Accident Management Technical Basis Report (EPRI-TR-1 01869, Appendix S.4 of Volume II) describes the WBN Unit 2 reactor cavity as

.reduced potential for direct entrainment and an increased potential for retaining a considerable amount of debris and the steps and standoff regions away from the main gas flow." Therefore, considerably less debris than that assumed in the NUREG/CR assessments for WBN Unit 2 may be available to participate in a DCH event, especially for low pressure sequences (< 600 psig) necessary to challenge containment due to DCH. Therefore, the modeling used in the WBN Level 2 PRA is considered to be appropriate and consistent with current industry practices.

19. NRC Request HAPRZ is noted as a key operatoraction, which implies that it could have a significant impact on the results (e.g., the actual LERF and its contributors).At this point in the accident, there have been both equipment and operatorfailures and it is not apparentwhat has occurredto improve the operator'sunderstandingand ability to take control of the accident. Provide the basis for the estimated 4.4E-4 HEP and provide an explanation of why the operator,for this HFE, is less likely to fail with a probabilitythat is two orders of magnitude below the probabilityfor HAOB1. In addition,provide an explanation of the effect on the calculatedLERF and identification of the significant contributorsif a much higher HEP value E1-23

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter (approximately IE-2) were used. Provide a description of the in-progressresolution for F&O 5-8.

TVA Response Basic event HAPRZ represents operator action to open the pressurizer PORVs to depressurize the RCS and prevent a thermally induced SGTR. Completion of this action requires the operator to operate the appropriate switches on the front panel inside the Main Control Room (MCR). There is over an hour of time available for recovery from an error of commission and multiple opportunities to recover. Basic event HAOB1 represents operator action to establish RCS feed and bleed. This requires multiple actions in a shorter timeframe than what is available for basic event HAPRZ and less opportunity to recover from an error. These factors result in a higher error probability for HAOB1.

The resolution to this finding to perform the reasonableness of HAPRZ and its impact on preventing high pressure accident scenario on the Level 2 results is still in progress.

20. NRC Request A pipe break of less than 2 to 3 inches is not the appropriatebasis for screening.

Floodingthat can negatively impact equipment can occur from this size pipe break depending on the location of the break, inventory, the size of the flood area, the location of the equipment, the flood type, etc. Provide the technical basis for excluding pipe breaks less than 3 inches (Reference F&O 7-4, SR IFSO-A 1).

TVA Response A pipe size of less than 3 inches was not used as a criterion to screen out flood sources. Breaks in small bore pipes were considered if the size was within the range for which pipe break frequency is provided in EPRI-TR-1013141 (Pipe Rupture Frequencies for Internal Flooding PRAs, Revision 1, March 2006). Breaks in small bore pipes were also considered if it were expected that the break would result in a plant trip or immediate shutdown. While for some systems this resulted in focusing the analysis mainly on piping greater than 2 inches in diameter, for other systems (such as the fire protection system and the service water system, both RCW and ERCW) there is no lower limit on the pipe size. For those systems where a lower limit was used in the screening process for flooding scenarios, EPRI-TR-1013141 was used as a reference to support the statement that available data "demonstrates that while a little less than one-half of all failures are in piping less than 2 inches in size, about 97% of those failures are small leaks (<<50 gpm). Breaks this size typically represent a minor localized spray impact."

Consistent with this position, screening based on pipe sizes was only used for flood or major flood events, and not for spray events. Rooms (i.e., switchgear rooms) where a spray event would result in spray-induced equipment failures either had no unanalyzed piping or otherwise all piping was explicitly considered independently from the size of the piping.

E1-24

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-57 of the WBN IF-PRA (an extract of the table for three representative rooms is provided in Attachment 5) notebook provides the rationale for screening out potential flood sources in each room/flood area. For example, a demineralized water pipe of a 1 inch nominal size in room 772.0-A7 was screened out based on the line size from flooding consideration (and without providing further discussion) because there are no PRA-related components in the room, thus no spray events that could impact plant risk was envisioned. On the other hand, spill rates of a pipe of 1.5 inch nominal size in room 772.0-A4, even if under the lower threshold in EPRI-TR-1013141, was not considered capable of producing a flood or major flood event and was screened out for these failure modes. This pipe size was screened out from further evaluation only after a detailed consideration on potential spray effects on the batteries located in the same room was provided. Guidance on how to interpret the information provided in the qualitative screening tables is provided in the documentation.

Given the above discussion, no changes were performed to the WBN IF-PRA to address F&O 7-4. This F&O was perceived as an issue with the large amount of IF documentation and retained as a suggestion for documentation enhancement in future revisions of the WBN IF analysis.

21. NRC Request Identifying the characteristicsof the flood release and the capacityof the sources is fundamental to performing an acceptable flooding analysis. Understandingthe type of flood (e.g., leak, rupture, spray), its potential flow rate, and its capacityis fundamental in identifying the flood scenariosand ultimately the internal flood contributionto the CDF.Justify why it was not necessary to understandthe characteristicsof the release and the capacity of the source (Reference F&O 7-12, SR IFSO-A5).

TVA Response The information necessary to categorize the potential flood scenario associated to each of the analyzed potential flood sources is available throughout the WBN IF-PRA notebook. The information for each source was not repeated in multiple locations, to minimize the potential for inconsistencies. The type of flood event expected from each source is provided in the qualitative screening tables. In Table 4-57 of the WBN IF-PRA notebook (an extract of the table for three representative rooms is provided in Attachment 2) for example, each flood source that needs to be addressed is indicated as a flood (F), a spray (S) or a high energy line break (H). If a flood source is retained for its potential to induce an IE without any of the indirect flood effect, the notation "Non-IF" was used. The overall capacity associated to a source is normally dependant on the system; a mapping between systems and their maximum flood capacities was provided in Tables 4-8 and 4-9 (extracts for these tables are provided in Attachment 6). These tables are then linked with the qualitative screening tables through the system number identifier, thus providing an overall capacity for each of the analyzed potential flood source.

EI-25

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter The operating temperature and pressure conditions for each of the sources discussed in the analysis are available in the walkdown summary tables, which were documented in Appendix A of the WBN IF-PRA notebook. The information in the walkdown tables provided the detailed description of the section of the system being discussed; the associated P&ID and mechanical drawing providing information on the physical arrangement of the piping. Flow rates are provided in the discussion associated with the propagation path for each of the areas that has been evaluated.

The propagation path for each area was developed using a bounding estimate of the maximum flow rate for the limiting source identified in the flood area. While the first approximation is consistent with the generic flow rate categories (spray, flood and major flood) provided in the EPRI draft Guidelines for Internal Flooding Probabilistic Risk Assessment (IFPRAs), a more detailed analysis was performed when a flood source was determined to be risk-significant. As an example, the propagation path associated with room 772.0-A9 provides a more refined calculation of the flow rate for the involved flood sources. Precise flow rates become significant when the time for propagation is of interest (i.e., when HRA considerations are made). However, the flow rate does not have any significant impact on the propagation path itself, that needs to follow the flood till its (realistic) ultimate accumulation point, regardless of the involved timing. This approach is deemed to be consistent with the intent of the ASME/ANS Standard, which specifically states that "An Internal Flood PRA need not be performed at a uniform level of detail. The analysesperformed for screened physical analysis units may be performed at a lower completeness level than analyses performed for flood areas,flood sources, and/or flood scenarios which are not screened out. An iterative process is also common in InternalFlood PRA.

Those physical analysis units that representthe higher risk contributorsmay be analyzed repeatedly, each time incorporatingadditionaldetail for specific aspects of the analysis (e.g., flood source and propagationmodeling, credit for drains or mitigation, refinements to the Internal Flood PRA plant response model, the HRA, etc.). At any stage the additionaldetail may allow for the screening of a physical analysis unit."

Given the above discussion, no changes were performed to the WBN IF-PRA to address F&O 7-12. This F&O was perceived as an issue with the large amount of IF documentation and was retained as a suggestion for documentation enhancement in future revisions of the WBN IF analysis.

22. NRC Request F&O 7-15 does not appearto address the PRA standardSR IFSO-B3, which requires that the sources of model uncertainty and related assumptions associated with the internalflood sources be documented. The concern from the peer review does not seem to align with the identified SR from the standard.Identify the F&O finding relative to appropriateSR in the standard,describe its potentialimpact on the results, and describe how the actual resolution for addressingthis issue.

TVA Response Peer Review Team Clarification:

EI-26

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter The basis for assigning F&O 7-15 to SR IFSO-B3 is contained in the Basis for Significance and Possible Resolution. The concern is that the assumptions related to system alignments and normal flow rates used in the characterization of flood sources were not documented. Since the concern was documentation of assumptions that could affect the characterization of flood sources under SR IFSO-A5 and not the methodology used for source characterization, the F&O was written under SR IFSO-B3.

TVA Response:

As far as the specific requirement associated with IFSO-B3 is concerned, stochastic and model (epistemic) uncertainties are discussed throughout the document, not only in the quantification section. A qualitative discussion on the uncertainties is more often reported in these sections rather than in the final quantification portion.

Such sections are:

4.1.1.14 Epistemic uncertainties associated with plant partitioning 4.1.2.1 Epistemic uncertainties associated with component vulnerabilities 4.2.1.30 Epistemic uncertainties associated with source identification 4.4.5 Epistemic uncertainties associated with flood scenarios 5.2.4 Stochastic uncertainties associated with IEF calculations 5.2.5 Epistemic uncertainties associated with IE phase 5.4.3 Epistemic uncertainties associated with flood scenarios (HRA specific)

Where appropriate, each of the sections refers to one of the sensitivity cases that addressed the specific uncertainty; otherwise, the uncertainties are discussed qualitatively in the above-mentioned sections.

Error factors for the stochastic uncertainties are then propagated into the model.

23. NRC Request The major purpose/objective of GL 88-20 is to "performa systematic examinationto identify any plant specific vulnerabilitiesto severe accidents." The PRA, as defined by the standard,provides an excellent systematic approach.HLR-IFSN-A requires development of the potential internalflood scenarios. The SRs provide a systematic structure for the development of the propagationpaths by evaluating the individual flood sources, flood areas, andplant features. A zone-to-zone approachdoes not meet these requirementsand, more importantly, would likely fail to identify plant weaknesses relative to internalfloods. Based on the approach and the resolution used, justify the bases for no potential weaknesses in plant design and operation from internal floods (Reference F&O 7-1, SR IFSN-A 1).

TVA Response The WBN IF-PRA did not follow a zone-to-zone approach to identify potential flood sources and their impact on plant operation. Rather, in a more systematic process, each flood source in each of the flood areas was individually addressed through E 1-27

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter multiple level of screening and refinement of the information necessary to evaluate the impact, based on the expected risk importance of the source.

The following walkthrough of the process is offered to support the above statement,

1. In the walkdown reports, all potential sources associated with fluid systems, tanks and components were identified for all the rooms of the plant. Some of the identified sources in Appendix A flood sources were retained and some were screened out later because of insufficient inventory, or because they are not active during at-power operation.

2. In the qualitative screening task, all those sources associated with systems considered as potential flood initiators were individually addressed for their potential of inducing an IE, for their potential of resulting in a flood with the capability to propagate into other flood areas, and also for their capability to induce spray effects. This is explicitly documented in Table 4-57 of the WBN IF-PRA notebook (an extract of the table for three representative rooms is provided in Attachment 2) on a source-by-source basis.

3. A single propagation path for each flood area was developed using bounding information on the flow rate and inventory associated with the limiting source in the room. The development of propagation path on a zone-by-zone basis is not a limitation in the scope of the analysis because the physical propagation path would not likely change with different flood sources in the same room. The propagation path is associated with physical characteristics of each room (i.e.,

curbs, doors, floor and wall penetrations). These characteristics do not change with the change of the sources within the room. The potential difference in the maximum elevation that water can reach in the final accumulation point may indeed change with the source, mainly on the basis of the source being limited (e.g., a tank) or not limited (e.g., the river). This is addressed in the WBN IF analysis by evaluating the maximum elevation in the final accumulation point (for the Auxiliary Building) for multiple potential systems that normally share not only the same water source but also the upper portion of the propagation path down to the passive sump. The components being affected by each potential flood source was mapped with a consistent calculation set for the maximum elevation in the area of accumulation. Potential differences associated with flow rates and timing, as discussed in the response to Question 21, are only significant when HRA considerations are done. Therefore, on a first approximation, the differences should not be necessary to identify an extremely precise flow rate and timing for all the flood sources in a room. The propagation path needs to be evaluated for all sources to identify all impacted components and to perform an informed qualitative screening.

4. When a generic propagation path is identified, which is, for the discussion above, valid for all sources in a room, a qualitative screening process is performed for each source in the room (see qualitative screening Table 4-57 [an extract of the table for three representative rooms is provided in Attachment 2]

of the WBN IF-PRA notebook). The screening criteria associated with this task are consistent with the screening criteria for flood areas, flood sources and flood scenarios presented in the ASME/ANS PRA Standard.

E 1-28

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

5. After the qualitative screening process, grouping of potential flood sources is performed. The grouping was based on both the direct effects of the flood event (i.e., functional impact due to loss of a fluid system) and the indirect/spatial impact of each flood source. This grouping was not performed on a zone-by-zone basis, but on a source-by-source basis, as needed to better represent the direct/functional impacts.

6. Once flood scenarios were defined, refinements in the estimation of flow rates were performed for those scenarios where flood-specific HRA were deemed necessary to more realistically describe the scenario.

In conclusion, the organization of the qualitative screening tables in the documentation focused on a source-by-source basis. Rational and intentional shaded levels of details were covered in the analysis based on the risk significance of each source.

Given the above discussion, no changes were performed to the WBN IF-PRA to address F&O 7-1. This F&O was perceived as an issue with the massive IF documentation and was retained as a suggestion for documentation enhancement in future revisions of the WBN IF analysis.

24. NRC Request F&O 7-5 finding is related to Capability Category II for SR-IFEV-A2. It is not clear whether CapabilityCategory I was met for this SR. Identify whether Capability Category I was met and the basis for using that categoryrelative to the purpose of the GL.

TVA Response Capability Category I for SR-IFEV-A2 is documented as met in Appendix B.12 of the peer review report document, which is deemed consistent with the expectation of GL-88-20.

25. NRC Request The concern raisedin F&O 7-9 is not clear. The basis given in the F&O is SRs IFSN-A9 and IFQU-A5. However, these SRs (IFSN-A9 and IFQU-A5) require the analyst to perform calculationsfor flood rate, time to reach the susceptible equipment, and the structuralcapacity of systems. structures,and components (SSCs). The analyst is also requiredto perform any human reliabilityanalysis on internalflood HFEs in accordance with 2-2.5. The relationship of these two SRs to the concern raisedin the F&O is not clear. Further,the staff finds that the actual issue raisedin the F&O is not clear. Provide a detailed description of the issue identified by the peer review, describe how the issue is relatedto both IFSN-A9 and IFQU-A5, and describe the actual resolution being pursued.

E1-29

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter TVA Response Peer Review Team Clarification:

The concern in F&O 7-9 is that the level of detail in the analysis of flooding recovery events was not sufficient. For example, a single recovery event is used for AFW system floods in a number of flooding compartments with a range in piping sizes from 4 inches to 12 inches. The analysis has assigned a single bounding response time for all of these flooding events. Consideration of the HR supporting requirements as referenced in IFQU-A5 would require consideration of accident sequence specific timing and scenario specific performance shaping factors (PSFs).

By combining a number of different break sizes in different areas into a single HFE, the accident sequence specific nature of the recovery event is not evident.

Consideration of event-specific timing as required by the standard might result in assignment of lower HEPs to flooding events in some areas. This, in turn, could affect the assessment of the significance of specific flood scenarios.

TVA Response:

As discussed in the response to Question 21, the level of details associated to the analysis is not uniform (as the ASME/ANS PRA Standard suggests) and is commensurate with the relative importance of the contribution to the overall risk profile. The concern raised by F&O 7-9 is specifically addressed by the definition of a sensitivity case aimed at evaluating the impact of the epistemic uncertainties induced by mapping multiple potential flood scenarios to a single representative HEP evaluated with a set of bounding parameters such as timing and flow rates. The epistemic uncertainties entered by the adopted approach were discussed in Section 5.4.2 of the WBN IF-PRA notebook, and the associated sensitivity case number 4 is discussed in Section 5.6.2.2.1 with the relative results summarized in Table 5-27 (also reproduced here below).

Table 5-27: Sensitivity Case 4 Results Unit 1 Unit Z Riskhiiusulu All Flood All Floo0 All FICOO B a All FlOOd HEP = 0.00 Base case HEP .00 HEP - D. ase case HEP - 1.00 CDF 3.64V-C5 3.59E-05 5.51E-05 ,.23E-5 3.28E.05 4.72E-05 LERF 2.66-C 2.'95E.0 3.53E-06 2.59E-06 2.S2E-06 3.21E-02 The sensitivity case is performed by either setting all the flood-specific HEP to 0.00 or to 1.00 and evaluating the impact on the overall CDF and LERF for both units.

It should be noted that the flood scenarios that have the most significant contributions to the overall risk (i.e., flood events induced by fire protection system and RCW line breaks in the electrical equipment room of the Auxiliary Building) did not credit operator actions to mitigate their impact on the overall CDF and LERF.

The possibility of detecting, isolating and mitigating the event was investigated. The significance of the epistemic uncertainties associated with the concern raised through F&O 7-9 is therefore considered not able to significantly bias the result of the WBN PRA. For the above discussion, no changes were made to the WBN IF-PRA to address F&O 7-9.

EI-30

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

26. NRC Request The effects of an internal flood create new conditions in the plant that will affect SSC

.availability. The PRA standardappropriatelynotes additionalperformance shaping factors such as additionalworkload, timing, crew availability,which would affect operator(controlroom) performance. Justify why main control room operatoractions are not impacted (e.g., no dependence) from an internal flood. In addition,provide the effect on the calculatedHEP given that the operatorperformance is affected by the internalflood and identify how the results would be impacted (Reference F&O 7-6, SR IFQU-A6).

TVA Response Actions outside the control room are recognized as being more significantly impacted by flood events. This was addressed by disregarding all field HFEs associated with flood events that required access to flood areas included in a flood scenario.

It is recognized that additional flood related PSF may impact even control room based actions. This was not addressed in the WBN IF-PRA, To evaluate the impact of flood-induced PSFs on control room based action for the overall CDF and LERF, a sensitivity case was performed.

All human actions (this table includes human actions performed inside and outside the Control Room) were reviewed and appropriately screened out using the following criteria.

a. MCR action vs. local action 4 all local actions were disregarded since they are already addressed in the baseline model.

b. Action associated with specific lEs (e.g., LOCA, ATWS, LOOP or generic) 4 all MCR based actions associated with IEs that cannot be induced by a flood event (e.g., large LOCA) were left with their nominal HEPs.

c. Critical timing 4 all MCR based actions with more than one hour of time available were left with their nominal HEPs. This is consistent with the guidance provided in the EPRI guideline on IF-PRAs.

As a result of the above described screening, a reduced set of 21 HFEs was identified as being performed from MCR, being associated with lEs that may be impacted from flood events, and having a characteristic time of less than one hour.

All these HFEs were modified and addressed as a sensitivity to determine the potential impact of PSFs on the associated HFEs and the overall CDF and LERF.

The sensitivity case was performed by raising the associated HEPs by one order of magnitude for all IF IlEs currently modeled in the WBN PRA. When individual HEP was involved in dependency combinations, the associated combination was also increased by one order of magnitude.

EI-31

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter The overall WBN PRA model has been requantified. The results from the sensitivity case are summarized in the following Table 1.

Table 1 - Summary of results of the Flood-related MCR HEP sensitivity.

Total Flood-only Base Sensitivity A Base Sensitivity A CDF 3.28E- 3.52E-05 +7% 3.73E-06 6.17E-06 +65%

05 LERF 2.62E- 2.73E-06 +4% 4.51 E-07 5.65E-07 +25%

06 1 1 1 1 The sensitivity case was considered to be conservative because of the unified treatment of the HEPs on all the modeled flood-induced scenarios. The recognized limitation in the analysis of the WBN IF-PRA shows a significant increase in the flood-only CDF and LERF. The impacts on the overall risk profile of the plant were shown to be less significant than the "flood-only" impacts.

27. NRC Request It is not clear how the peer review could indicate that SR IFQU-A 10 was met when F&O 7-8 clearly states that the peer reviewer could find no evidence that the LERF analysis included internalfloods. Further,in orderto understandhow and ensure that a more quantitativeunderstandingof the overall probabilityof fission product releases was achieved, it is important that the PRA model addresses the potential contributors(e.g., internalflood). Provide a more complete description of how IF contributesto the LERF sequences (e.g., the development of event trees, event sequences, timing, etc.).

TVA Response Peer Review Team Clarification:

The concern in F&O 7-8 is the level of detail of the documentation regarding the impact of flooding scenarios on LERF. F&O 7-8 originated from SR IFQU-B1 because the issue was documentation rather than the technical methods used to link flooding events to the LERF model. As stated in the basis for assessment of SR IFQU-A10, "[t]he impact of flooding events on the LERF modeling is included by the linking model. However, no documented assessment of the flooding scenarios and how they map to LERF is provided." Therefore, it was the assessment of the peer review team based on a review of the model that the impact of flooding on the LERF sequences was appropriately accounted for in the linked fault tree structure and IFQU-A1O was met. However, the level of documentation was insufficient to support model maintenance and peer review, and therefore SR IFQU-B1 was not met.

E1-32

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter TVA Response:

The IF impact is essentially superimposed on the base-line (i.e., no flood) PRA model and relies on the event trees and associated sequences already developed for the no-flood PRA base-line model. Flood-specific results are provided for both units.

These results included both CDF and LERF. Major contributors to the flood only portion of CDF and LERF for both units are provided at the end of this response for the aforementioned table and the Figures 5-13 and 5-15 associated with LERF results. Because of the way the WBN IF-PRA is modeled, a specific flooding event tree is not used; a utility code injects flood-specific lEs and associated logic directly within the one-top linked fault tree model. WBN IF-PRA defines each flood scenario analyzed by defining the direct impact and the set of indirect impacts (more details on the indirect impacts, such as the specific failed components). The flooding logic was mapped to existing initiators that follow the general transient event tree.

Specific sequences were then dictated by the specific direct and indirect failures and evolved into common plant damage states that were binned accordingly with the

,methodology and the criteria specified in the WBN PRA Level 2. IF initiators (i.e.,

GTRAN initiators) were binned either in Bin 1 or Bin 2. The modeling structure takes into account that some accident sequences may be common to both bins; these events are grouped with the most conservative bin via the model structure. The LERF values were based on the model containing IF. Specific event sequences (i.e.,

CDF cut sets) were discussed in the WBN PRA Quantification notebook and were not replicated in the IF-PRA notebook.

Given the above discussion, no changes were performed to the WBN IF-PRA to address F&O 7-8. This F&O was perceived as an issue with the documentation and was retained as a suggestion for documentation enhancement in future revisions of the WBN IF analysis.

EI-33

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 5.20: Base Case Best Estimate Results I nit CDF LERF total Iood ony  % IOtal Ioo-b0MY I Init IQF-3I I 47'2F416 1,% R)*-4A1 4 9AW-fl 1 17%

Lnft 2 328E-05 3.73E-06 11% 2.62E-06 4.51E-07 17%

I.%FLIHP

• %WFLPF'PAB757A2 (4.4%)

(1.3%)

%OFL.HPFPAB757A24 (3.3%)

%O6F:LI-PFPAB757A5 (1.7%)

%OFHPFPAB772A10 (12%)

%OFILI-PFPAB772A7(1.3%)

tOF-PFPABF (4.5%)

%OFLRCW757AI 7 (3.0%)

%OFLRCW757A9 (3.9%)

%OFLRCW772AM (32.7%)

%OFLRCW772A9 (32.7%)

%OFLrCWABW (2.5%)

%OFLTBMF (2.6%)

Ogher (3.8%)

Figure 5-13: Unit I Flood-Initiator LERF Breakdown EI-34

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter

%OLIP 1%OFLHPFPAB757A2 (4.5%)

(1.3%)

U-PFPA8757A24 (3.4%)

%OFL-PFPAB757A5 (1.7%)

%0FLHPFPAB772A7 (1.3%)

%OFLHPFPABF (4.6%)

%OFLRCW757AI7 (4.%)

%LRCW*757A9 (4.%)

%OFLRCW772AS (33.3%)

%OFLRCW772A9 (33.3%)

%OFLRCWABMF (2.6%)

%OFLTBMF (2.6%)

Other (2-2%)

Figure 5.15: Unit 2 Flood.In itiator LERF Breakdown EI-35

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 1:

Table 5-3: Characterization of Model Uncertainties Associated with Initiating Event Modeling Area of Uncertainty Model Alternative Impact Events Selected Minimize grouping. Include Large number of alternative Unknown, but expected to be small.

many transient and LOCA data windows valid. Longer categories, windows may have greater Data Window from 01/2003 statistical validity.

to 03/31/2008.

Methodology NUREG/CR-6928 Bayesian Use Gamma Method for Small impact. Both approaches are update of limited events, update. considered consensus approaches.

LOCA IEF Uses NUREG 1829 Alternate sources include Selected approach is realistic.

NUREG 1829 provides most NUREG/CR-6928 comprehensive reference on LOCA NUREG/CR-5750 IEF.

Bayesian Update Several transients' frequency Use generic data. Should be small impact for most updated. initiating events. Primary impact of Bayesian update is related to LOMFW.

WBN 1=WBN 2 IE data for WBN 2 is the 1. Use generic data. Unknown.

same as WBN 1. 2. Use early plant life data.

SGTR Unit 2 SG is In-600 design. A) Use In 600 SGTR May be significant. In-600 increases Unit 1 has In 690 SG tubes experience (see WCAP-15955 risk of SGTR of WBN 2 over WBN 1.

for SG IEF. WBN uses or other reference). Some impact may be mitigated by generic experience, improved inspection and chemistry.

WBN 2 SG tubes are new and near pristine (minimal flaws expected).

Impact of alternate material mainly expected in later years of WBN 2 operation.

Consequential PORV PORV challenges based on A) Provide realistic estimate Overestimates PORV challenges, challenge MAAP analyses using based on nominal Initial particularly for WBN 2.

composite model with uprate Conditions and typical power level of WBN1. control system performance.

SLB models Use NUREG/CR-5750 data. Evaluate actual events IEF appears too high, however, included in document to ensure current estimate appear bounding.

they represent intended lEs.

Reactor Trip / Turbine WBN Frequency based on A) Look at RT/TT frequencies Optimistic for WBN Unit 2 as plant has Trip Bayesian update to generic for earlier industry plant no operating history and may be experience, operation. subject to "startup" events and "bathtub" reliability.

E1-36

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 5-2: Characterization of Model Uncertainties Associated with SSIE Modeling Area of Uncertainty Model Alternative Impact Events Selected CCS, EP, ERCW A) Point Estimate Models. Realistic model. Includes key support systems. Better treat as dependencies.

Events Selected CCS, EP, ERCW A) Add PCA SSIE Fault Two effects possible: (1) Treatment of PCA as independent IE may impact Tree. treatment of dependencies. (2) Use of generic data may overstate risk as WBN Impact expected to be small as PCA has considerable redundancy.

SSIE Frequency Establish IEF based on fault A) Point estimate. Realistic model. Includes key support tree model. systems. Better treats dependencies.

Methodology Followed EPRI Guidelines A) Point Estimate Model. Current industry practice (but not yet with consideration of findings consensus) model.

of WCAP-16872-NP.

CCS spurious SRV Not considered a contributor A) Consider explicitly in tree. Low risk impact.

opening to CCSIE failure due to slowness of event and availability of alarms.

CCS,EP,ERCW Not credited. A) Credit recoveries. Low risk impact. Conservative operator recoveries modeling practice.

EPS-Common Cause Not Considered. A) Include CCF model. Unknown. May be significant for specific applications.

CCS, ERCW-Common Considered in model. A) Use bounding CCF Increase frequency of initiator. ERCW cause values. impact RCP seal cooling. Significance will be based on comparison of these lEs with plant experience and generic data.

ERCW operator Operator action to clear A) Not credit Action. Frequent and timely action is actions screens considered. expected. Prevents failure. Ignoring B) Reduce credit for action. action would overstate risk. Failure rate may be sensitive to value assigned to this operator action.

Consider sensitivity study on ERCW failure rate.

E1-37

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 2: - Example of Walkdown summary table Room number and description Drawing: Architecturaldrawing depicting the room Free floor area (tt)

Flood indicators: Any flood indicatorlocated in the room that could provide information about a flood event to the operatoris provided here Notes and

References:

Notes about the rooms, with supportingreferences, are provided in this field.

Walkdown notes:

Notes from the IF-PRA walkdown packages have been reported in this field. References to specific picturesare reportedhere.

Doors in room:

IDoor ID From Room To Room Door Type Door Size Curb Gap Doors present in the room are listedin this section; the opening direction of the dooris capturedby the combination of fields 'From room" and 'To room". Curbindicatesthe presence of a curb in the immediate proximity of the door.

Drains in room:

SDrain~ie information on drains and draitn sizes locatedin the room and potentiallycredited in the IF-PRA is reportedin this field.

Floor penetrations in room:

Type To Room Size Threshold Penetration on the floor of a room (e#g., gratings,staitwells) is listed in this field. The pre&ence of a threshold that would allow some water accumulation before propagation is also listed. The room where the penetrationis leading to is indicated.Notice that ceiling indicationsare not provided since a floor penetration for the upper room is the ceiling penetration for the room underneath.

Wall penetrations in room:

Type From Room To Room Elevation D sons Penetrationsthrough the wall of a room are provided in this field (doors are not included)- The elevation field provides indicationof the elevation from the floor of the wall penetration.

Components in room:

D Description Elevatoon in Feet Flevation in Inches Flood Vulnerability Spray Vulnerability Notes S PRA-related components located in the room are listed. Notes from the walkdowns and references to specific pictures are also recorded in the Notes field. The Safety Class (SC) is investigatedonly for those active and vulnerable PRA-related components located in any room that could be impacted by an HELB event (see Table 5-14 for the list of rooms involved in the HELB analysis).

EI-38

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 3:

Table 4-2. Failure Modes and Effects Analysis of Watts Bar Units 1 & 2 Key Systems Effect on Safety System(s) IE Applicable System/Subsystem Failure Mode or Key Plant Equipment Category Unit Comments Offsite Grid 500-kV Line Discontinuity/Loss of Turbine Trip Turbine Unit 1 & Results in a generator trip on load rejection and fast Power from Reactor Trip Trip Unit 2 transfer to 161-kV line. Loss of the 500-kV line is not a (TTIE) dual unit Initiating event 161-kV Line Discontinuity/Loss of Loss of Power to 6.9-kV Shutdown Boards Not an IE Does not cause a plant trip of offsite power to safety Power from equipment.

Both 161-kV and 500-kV Discontinuity/Loss of Reactor Coolant Pump (RCP)Condensate Loss of Unit 1 & Results in a plant trip. Equipment listed is unavailable.

Lines Power from Main Condenser Circulation Water, Secondary Offsite Unit 2 Equipment normally operating and powered from Component Cooling Water Power emergency buses must restart. Loss of both 161-kV lines (LOOP) and both 500-kV lines would result in a dual unit Initiating event.

Nonemergency AC Power Unit Station Service Discontinuity/Loss of Subset of the Equipment Impacted by a Loss of Unit 1 & Loss of these electric power systems is bounded by the Transformer Power from Loss of Both 161 -kV and 500-kV Lines Offsite Unit 2 loss of offsite power event for both frequency of CSST Power occurrence and impact.

RCP Buses (LOOP) Loss of individual boards results in a loss of 6.9-kV Unit Boards balance-of-plant (BOP) equipment but does not usually 6.9-kV Common Boards result in a plant trip. Losses that result in a plant trip are 480V Common Boards included in trips resulting from equipment loss.

Loss of Nonemergeny AC power is not a dual unit Initiating event, but loss of both 161-KV and 500-KV lines is a dual unit initiating event. A loss of Offsite Power event is modeled as a dual unit initiating event.

Emergency AC Power CSST Discontinuity/Loss of Loss of Normal Source to 6.9-kV Shutdown Board Not an IE Loss of a single train may require the opposite train of a 6.9-kV Shutdown Boards Power from Battery Chargers for 250V and 125V DC Power normally operating system to start; e.g., CVCS. Loss of 480V Shutdown Boards Control Air System Compressors an emergency power board will results in a controlled VaErous Motor-Driven Pumps: shutdown.

ERCW, CCS, AF-W, CVCS, Safety Injection, RHR, CSS, HPFP, etc.

E1-39

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit 1 & 2 Key Systems Effect on Safety System(s) IE Applicable System/Subsystem Failure Mode or Key Plant Equipment Category Unit Comments 125V Vital DC Power Main Steam Isolation Valves Reactor trip - turbine trip due to MSIVs, feedwater control, Main Feed Regulating Valves and bypass valves failing closed, resulting in loss of Steam Generators 2 and 4 feedwater and low-low steam generator water level.

Main Feed Regulating Bypass Valves Primary PORV Steam Generator 2 PORV Loss of Reactor Trip Breaker Control Power Vital Steam Dump Valves Battery Discontinuity/Loss of AFW Motor-Driven Pump 1A-A Board I Battery Board I Power from Breaker Control Power for CCP 1A-A (LVBB1) Unit 1 Main Steam Isolation Valves Reactor trip - turbine trip due to MSIVs, feedwater control, Main Feed Regulating Valves and bypass valves failing closed, resulting in loss of Steam Generators 1 and 3 feedwater and low-low steam generator water level.

Main Feed Regulating Bypass Valves Primary PORV Steam Generator 3 PORV Loss of Reactor Trip Breaker Control Power Vital Steam Dump Valves Battery Discontinuity/Loss of AFW Motor-Driven Pump 1B-B Board II Battery Board II Power from Breaker Control Power to CCP 1B-B (LVBB2) Unit 1 Main Steam Isolation Valves Reactor trip - turbine trip due to MSIVs, feedwater control, Main Feed Regulating Valves and bypass valves failing closed, resulting in loss of Steam Generators 2 and 4 feedwater and low-low steam generator water level.

Main Feed Regulating Bypass Valves Primary PORV Steam Generator 2 PORV Loss of Reactor Trip Breaker Control Power Vital Steam Dump Valves Battery Discontinuity/Loss of AFW Motor-Driven Pump 2A-A Board III Battery Board III Power from Breaker Control Power for CCP 2A-A (LVBB3) Unit 2 El-40

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit I & 2 Key Systems Effect on Safety System(s) Applicable System/Subsystem Failure Mode or Key Plant Equipment IE Category Unit Comments 125V Vital DC Power (co t.)

Main Steam Isolation Valves Reactor trip - turbine trip due to MSIVs, feedwater Main Feed Regulating Valves control, and bypass valves failing closed, resulting in Steam Generators 1 and 3 loss of feedwater and low-low steam generator water Main Feed Regulating Bypass Valves level.

Primary PORV Steam Generator 3 PORV Reactor Trip Breaker Control Power Loss of Vital Steam Dump Valves Battery Discontinuity/Loss of AFW Motor-Driven Pump 1B-B Board IV Battery Board IV Power from Breaker Control Power to CCP 1B-B (LVBB4) Unit 2 120V Vital AC Steam Generator Level Control Reactor trip assumed due to steam generator level Main Feed Pumps Go to Minimum Speed changes.

Auxiliary Control Air Dryer A Loss of 120V RPS and SSPS Room Cooling Train A AC vial AFW Train A Actuation Instrument Discontinuity/Loss of RHR Heat Exchanger 1A-A Outlet Valve Board 1-1 Board 1-1 Power from MFWP Auxiliary Relay Panel (Ul LDAAC) Unit 1 SSPS Train B Reactor trip assumed due to steam generator level Auxiliary Control Air Dryer B Loss of 120V changes.

RPS and SSPS Room Cooling Train B AC vital AFW Train B Actuation Instrument Discontinuity/Loss of RHR Heat Exchanger 1B-B Outlet Valve Board 1-11 Board 1-11 Power from MFWP Auxiliary Relay Panel (Ul LDBAC) Unit 1 Reactor trip assumed due to steam generator low-low Loss of 120V level resulting from reduction of feedwater flow from Steam Generator 3 Feed Flow Demand Signal AC vital steam generator 3 feed flow demand failing low.

AFW TDP Flow Controller Instrument Discontinuity/Loss of TDAFWP Steam Generators 3 and 4 Level Control Board 1-111 Board 1-111 Power from SSPS Train A (Ul LDCAC) Unit 1 Reactor trip assumed due to steam generator low-low Loss of 120V level resulting from reduction of feedwater flow from AC vital steam generator 4 feed flow demand failing low.

Steam Generator 4 Feed Flow Demand Signal Instrument Discontinuity/Loss of SSPS Train B Board l-IV Board l-IV Power from MFWP Auxiliary Relay Panel (Ul LDDAC) Unit 1 E1-41

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit 1 & 2 Key Systems Effect on Safety System(s) IE Applicable Failure Mode or Key Plant Equipment Category Unit Comments 120V Vital AC (con't.)

Steam Generator Level Control Reactor trip assumed due to steam generator level Main Feed Pumps Go to Minimum Speed changes.

Auxiliary Control Air Dryer A Loss of 120V RPS and SSPS Room Cooling Train A AC vital AFW Train A Actuation Instrument Discontinuity/Loss of RHR Heat Exchanger 1A-A Outlet Valve Board 2-1 Board 2-1 Power from MFWP Auxiliary Relay Panel (U2 LDAAC) Unit 2 SSPS Train B Reactor trip assumed due to steam generator level Auxiliary Control Air Dryer B Loss of 120V changes.

RPS and SSPS Room Cooling Train B AC vital AFW Train B Actuation Instrument Discontinuity/Loss of RHR Heat Exchanger 1B-B Outlet Valve Board 2-11 Board 2-11 Power from MFWP Auxiliary Relay Panel (U2 LDBAC) Unit 2 Loss of 120V Reactor trip assumed due to steam generator low-low Steam Generator 3 Feed Flow Demand Signal AC vital level resulting from reduction of feedwater flow from AFW TDP Flow Controller Instrument steam generator 3 feed flow demand failing low.

Discontinuity/Loss of TDAFWP Steam Generators 3 and 4 Level Control Board 2-111 Board 2-111 Power from SSPS Train A (U2 LDCAC) Unit 2 Loss of 120V Reactor trip assumed due to steam generator low-low AC vital level resulting from reduction of feedwater flow from Steam Generator 4 Feed Flow Demand Signal Instrument steam generator 4 feed flow demand failing low.

Discontinuity/Loss of SSPS Train B Board 2-IV Board 2-IV Power from MFWP Auxiliary Relay Panel (U2 LDDAC) Unit 2 Spurious signal causes an inadvertent safety injection.

Spurious actuation of individual systems is also possible.

Fault Leading to ISI Loss of one train will lead to an orderly shutdown per Inadvertent Safety Actuation for CCS, MSIV, Main Turbine Trip, AFW, (Inadvertent Technical Specifications.

Function/System Reactor Trip, CVCS, Safety Injection, RHR, CSS, Safety Unit 1 and Inadvertent Safety Injection is not a dual unit initiating SSPS Actuation EGTS, Containment Isolation, and Air Return Fans Injection) Unit 2 event.

E 1-42

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit 1 & 2 Key Systems Effect on Safety System(s) Applicable System/Subsystem Failure Mode or Key Plant Equipment IE Category Unit Comments Loss results in a failure of the condensate system and Total Loss of feedwater pumps and a plant trip.

All Main Loss of Cooling Condensate System Pumps Unit 1 & Unit 2, Feedwater Unit 1 & Total Loss of Main Feedwater is not a dual unit initiating Raw Cooling Water Function from Main Feedwater Pumps Unit 1 & Unit 2, (TLMFW) Unit 2 event.

Reactor trip assumed due to closure of the main steam isolation valves (MSIV) and/or failing feedwater regulation valves resulting in a decreased level in the Total Loss of steam generator.

Plant Control Air System (Non- Inadequate System MSIV Unit 1 & Unit 2, Compressed Unit 1 & Loss of Plant Compressed Air is a dual unit initiating essential) Pressure or Capacity Feedwater regulation Valves 1 & Unit 2, Air (TLPCA) Unit 2 event.

EGTS - - Standby system actuated on loss of control air. Failure Essential Air (Auxiliary Inadequate System Steam Generator PORVs Not an IE of this system considered subsequent to failure of control Control Air) Pressure or Capacity Steam Generator Level Control Valves for AFW air.

Alternate Cooling to Centrifugal Charging Pump 1 Loss of this train will result in a controlled shutdown due A-A Cooler to loss of cooling to the RCP Motor Coolers.

Diesel Generators 1A Not an IE Auxiliary Control Air Compressors RCP Motor Coolers 1 and 3 Containment Spray Heat Exchangers AFW Backup Water Source Essential Raw Cooling CCS Lube Oil Cooler 1A Alternate Water Loss of Cooling Room Coolers for 1A:

Train 1A-A Function from CSS, CVCS, RHR, Safety Injection, CCS/AFW Unit 1 Plant trip assumed due to loss of cooling to the A CCS Loss of ERCW Heat Exchanger (or 1A CCS train).

CCS Heat Exchangers A Header 1B-B Diesel Generators 1B (AEBEX)

Auxiliary Control Air Compressors RCP Motor Coolers 2 and 4 Containment Spray Heat Exchangers Essential Raw Cooling AFW Backup Water Source Water Loss of Cooling Room Coolers for I B:

Train I B-B Function from CSS, CVCS, RHR, Safety Injection, CCS/AFW E1.-43

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit 1 & 2 Key Systems Effect on Safety System(s) IE Applicable System/Subsystem Failure Mode or Key Plant Equipment Category Unit Comments CCS Heat Exchanger B Plant trip assumed due to loss of cooling to the C Alternate Cooling to Centrifugal Charging Pump 2 A-A CCS Heat Exchanger (or 2A CCS train).

Cooler Diesel Generators 2A Auxiliary Control Air Compressors RCP Motor Coolers 1 and 3 Loss of Containment Spray Heat Exchangers ERCW Essential Raw Cooling AFW Backup Water Source Header Water CCS Lube Oil Cooler 2A Alternate 1A-A Loss of Cooling Room Coolers for 2A: (AABEX) Unit 2 Train 2A-A Function from CSS, CVCS, RHR, Safety Injection, CCS/AFW CCS Heat Exchangers C Diesel Generators 2B Not an IE Auxiliary Control Air Compressors RCP Motor Coolers 2 and 4 Essential Raw Cooling Containment Spray Heat Exchangers Water AFW Backup Water Source Loss of Cooling Room Coolers for 2B: Loss of this train will result in a controlled shutdown Train 2B-B Function from CSS, CVCS, RHR, Safety Injection, CCS/AFW due to loss of cooling to the RCP Motor Coolers.

Plant trip assumed.

Loss of all Essential Raw Cooling Water is a dual unit Essential Raw Cooling Loss of Cooling Unit 1 & Unit initiating event.

Water System Function from All Equipment Supplied by ERCW Trains A and B ERCWTL 2 This event is applicable only with concurrent Refueling Water Storage Loss of Flow Source Not an IE requirement for ECCS systems and therefore is not a Tank from Primary water source for Safety Injection, RHR, CVCS separate initiator.

Normal Cooling to CCP 1A-A Pump Oil Coolers RCP Bearing Oil Coolers RCP Thermal Barrier Coolers Loss of Pump Oil Coolers for Train 1A: CCS Component Cooling CVCS, CSS, Safety Injection Train A Loss of CCS Water Loss of Cooling Spent Fuel Pit Heat Exchangers (CCSA) Train 1A Train 1A Function from Train 1A RHR Heat Exchangers (CCSA) Manual trip to protect RCPs.

Component Cooling Pump Oil Coolers for Train B Unit 1 and Unit 2:

Water Loss of Cooling CVCS, CSS, Safety Injection Not an IE Train B Function from Train 1B & 2B RHR Heat Exchangers Not a separate initiator.

EI-44

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 4-2. Failure Modes and Effects Analysis of Watts Bar Unit 1 & 2 Key Systems Effect on Safety System(s) IE Applicable System/Subsystem Failure Mode or Key Plant Equipment Category Unit Comments Normal Cooling to CCP 2A-A Pump Oil Coolers RCP Bearing Oil Coolers RCP Thermal Barrier Coolers Pump Oil Coolers for Train 2A: Loss of Component Cooling CVCS, CSS, Safety Injection CCS Water Loss of Cooling Spent Fuel Pit Heat Exchangers Train 1A Train 2A Function from Train 2A RHR Heat Exchangers (CCSA2) Unit 2 Manual trip to protect RCPs.

Manual trip to protect RCPs.

Loss of all Component Cooling Water is a dual unit initiating event. Please note that since Train 2A has no impact on Unit 1 and Train 1A has no impact on Unit 2, two separate support system initiating event trees were developed.

UlCCSTL is a Unit 1 initiating event due to a loss of Total loss CCS train 1A and B. U2_CCSTL is a Unit 2 initiating Loss of all Component Loss of Cooling All Equipment Supplied by Component Cooling Water of CCS Unit 1 & event due to a loss of CCS Train 2A and B.

Cooling Water Function from Trains 1A, 2A, and B (CCSTL) Unit 2 EI-45

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 4:

Table 5-4: General Transients LER Review Results - 1998 to 2002 WBN IE Name Category Description Number of Events MSVO QG10 Inadvertent Open/Close: 1 Safety/Relief Valve 0 MSIV QL5 Partial Closure of MSIVs 4 PLMFW QP2 Partial Loss of Feedwater Flow 41 EXMFW QP5 Excessive Main Feedwater Flow 9 LRCP QR2 Loss of Primary Flow (RPS Trip) 11 CPEX QR4 Core Power Excursion (RPS Trip) 1 QR5 Turbine Trip 56 TTIE QP3 Total Loss of Condensate Flow 0 QC5 Loss of Nonsafety-Related Bus 6 QRO RCS High Pressure (RPS Trip) 3 QR1 RCS Low Pressure (RPS Trip) 1 QR3 Reactivity Control Imbalance 15 QR6 Manual Reactor Trip 29 QR7 Other Reactor Trip (Valid RPS Trip) 5 RTIE QR8 Spurious Reactor Trip 26 QG9 Primary System Leak 0 QK4 Steam or Feed Leakage 0 QL6 Condenser Leakage 1 QP4 Partial Loss of Condensate Flow 2 Loss of Non-Vital Cooling Water (includes Circulating QL4 Water) 16 ISI QR9 Spurious Engineering Safety Feature Actuation 0 Loss of Vital AC Instrument Boards* QC4 Loss of ac Instrumentation and Control 3 Total 229

• LDAAC, LDBAC, LDCAC, and LDDAC E1-46

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 5-5: General Transients LER Review Results - All data (1987 - March 2008)

Number Events of WBN IE Name Category Description MSVO QG10 Inadvertent Open/Close: 1 Safety/Relief Valve 2 MSIV QL5 Partial Closure of MSIVs 46 PLMFW QP2 Partial Loss of Feedwater Flow 350 EXMFW QP5 Excessive Main Feedwater Flow 93 LRCP QR2 Loss of Primary Flow (RPS Trip) 68 CPEX QR4 Core Power Excursion (RPS Trip) 17 QR5 Turbine Trip 419 TTIE QP3 Total Loss of Condensate Flow 16 QC5 Loss of Nonsafety-Related Bus 47 QRO RCS High Pressure (RPS Trip) 11 QR1 RCS Low Pressure (RPS Trip) 11 QR3 Reactivity Control Imbalance 114 QR6 Manual Reactor Trip 111 QR7 Other Reactor Trip (Valid RPS Trip) 84 RTIE QR8 Spurious Reactor Trip 208 QG9 Primary System Leak 2 QK4 Steam or Feed Leakage 4 QL6 Condenser Leakage 8 QP4 Partial Loss of Condensate Flow 34 Loss of Non-Vital Cooling Water (includes Circulating QL4 Water) 60 ISI QR9 Spurious Engineering Safety Feature Actuation 24 Loss of Vital AC Instrument Boards* QC4 Loss of ac Instrumentation and Control 27 1 Total 1756

• LDAAC, LDBAC, LDCAC, and LDDAC Table 5-6: Total Loss of Condenser Heat Sink LER Review Results - 1998 to 2002 WBN IE Number of Name Category Description Events IMSIV Li Inadvertent Closure of All MSIVs 3 LOCV L2 Loss of Condenser Vacuum 8 L3 Turbine Bypass Unavailable 1 E1-47

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Table 5-7: Total Loss of Condenser Heat Sink LER Review Results - All data WBN IE Number of Name Category Description Events IMSIV Li Inadvertent Closure of All MSIVs 7 L2 Loss of Condenser Vacuum 28 LOCV L3 Turbine Bypass Unavailable 2 E1-48

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 5 Attachment 4 - Example of Qualitative screening table for 3 representative rooms in the Auxiliary Building Table 4-57: Qualitative Screening Assessment of Flooding Sources - Auxiliary Building Room PRA 1 Maximum (Flood area) equipment System # line size Screened Notes

[p.p. fig.] in room [inches]

See beginning of Section 4.4 for guidance on reading of this table.

A break in the RCW line in room 786.5-At will potentially impact RCW availability to the glycol chillers (see drawing 1-47W844-4, Reference 41). Glycol chillers will trip on low RCW pressure header (less than 30 psi local, see AOI-46, Section 2.3, Reference 266). LCO 3.6.11 (Reference 281) requires 24 8Yes availability of the ice bed, allowing for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to recover from ice bed unavailability. Loss of the glycol chillers is not expected to result in immediate loss of the ice bed (normal bed temperature for the 2.5 million pound of ice is 15"F, TIS limit is 27TF), thus not immediately requiring a unit shutdown. On this basis this event will not result in an immediate forced shutdown and it is therefore not explicitly modeled.

786.5-Al

[Figure 4-8] pNo 26 1-1/2 Yes No PRA components along the entire potential propagation path.

59 1 Yes No PRA components along the entire potential propagation path.

Loss of the glycol chillers is not expected to result in immediate loss of the ice bed (normal bed 61 6 Yes temperature for the 2.5 million pound of ice is 15'F, TIS limit is 27"F), thus not immediately requiring a unit shutdown. On this basis this event will not result in an immediate forced shutdown and it is therefore not explicitly modeled.

HPFP line in this room is connected to a dry header (WBN-OSG-4099 page B-6-11). Multiple 26 1-1 Yes failureslmisalignments are required for a flood scenario to be initiated. This potential source is screened from further considerations.

772.0-A4

[NIA] Pipe associated with eyewash is routed on the wall opposite of the battery. Line is immediately routed in the wall so that only few inches (approximately 6" as measured during walkdown) of the line are exposed. In the unlikely event of a spray affecting the battery, no IE is expected during at-power operation.

26 4 No Potentially infinite source. Propagation path includes PRA components.

772.0-A7 No FO 59 1 Yes Line size below size cutoff (see Assumption #16).

E 1-49

Enclosure 1 Response to NRC Request for Additional Information Regarding IPE in June 23, 2010 Letter Attachment 6 Attachment 3 - Extracts of tables 4-8 and 4-9 Table 4-8: Summary of Flood Sources not Further Analyzed System OperatinglnStandby Inventory Notes SystemOperatingStadby (gal)

Auxiliary Boiler System Not active at-power ABS flanged ,closed in the Auxiliary Building Combustille 0)1:Systemjs Addressed in fire PRA Service Water System Not enough inventory'to generate slgnifilcant flood concerns Water Treatment System Operating Infinite Only located iin non-vital area of the plant Air Conditioning Systems Operating Not 'enough inventory to generate signiffcant flood concerns Sampiling and Water Insufficient inventory for a flooding source Qual*t Systems Table 4-9: Summa of Flood Sources Analyzed in IF-PRA System System Operating! Inventory Comments Reactor triplshutdown

1. Standby (gal)

I Main Steam and Ancillary Steam Operating Treated in Steam Une break outside Systems baseline PRA containment will induce a as SLBOC reactor trip.

2/3 Main Feedwater and Condensate Operating Treated in Secondary line breaks systems baseline PRA outside containment will as TLMFW induce a reactor trip with loss of main feedwater.

3a Auxiliary Feedwater System Standby 395,000 Break in the Auxiliary Feedwater line will not induce an automatic reactor trip. LCO-3.7.6 allows for up to 7 days to restore CST level above 200,000 gal, provided that ERCW is available as a backup.

EI-50

Enclosure 2 List of Commitments

1. TVA will respond to NRC RAI 14 by October 29, 2010.

2. Prior to fuel load, full resolution of F&O 1-5 in NRC RAI 3 will include revising the 125V DC system top to correctly model board failure.

3. Prior to fuel load, full resolution of F&O 1-6 in NRC RAI 3 will include a full review of the database after all model changes to address findings are complete.

4. Prior to fuel load, full resolution of RAI 12 will include updating the database to address CDE 650 and CDE 651.

5. Prior to fuel load, full resolution of F&O 1-7 will include updating the type codes for the MD-AFW pumps.

6. Prior to fuel load, there will be full resolution of F&O 4-3.

E2-1