0CAN041904, License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

ML19119A090
Person / Time
Site:	Arkansas Nuclear
Issue date:	04/29/2019
From:	Gaston R Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
0CAN041904
Download: ML19119A090 (176)

Text

10 CFR 50.90 0CAN041904 April 29, 2019 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

SUBJECT:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis Arkansas Nuclear One, Units 1 and 2 NRC Docket Nos. 50-313 and 50-368 Renewed Facility Operating License Nos. DPR-51 and NPF-6 Pursuant to 10 CFR 50.90, Entergy Operations, Inc. (Entergy) hereby requests a change to the license basis documents for Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) to use the Tornado Missile Risk Evaluator (TMRE) methodology as the licensing basis to qualify several components that have been identified as not conforming to the unit specific current licensing basis. The enclosure concludes that the proposed amendment does not involve a significant hazards consideration.

The TMRE methodology was transmitted to the Nuclear Regulatory Commission (NRC) by the Nuclear Energy Institute (NEI) as NEI Technical Report 17-02, Revision 1, on September 21, 2017 (Reference 1). NEI established a Pilot Plant NRC review for the TMRE methodology through which Revisions 1A and 1B of NEI 17-02 (References 2 and 3) were submitted to the NRC in licensees responses to the NRCs request for additional information.

The NRC issued Regulatory Issue Summary (RIS) 2015-06, "Tornado Missile Protection" (Reference 4), to, in part, remind licensees of the need to conform to a plants current, site-specific licensing basis for tornado-generated missile protection. In response to RIS 2015-06, walkdowns were performed of ANO-1 and ANO-2 to identify potential vulnerabilities with the current licensing basis (CLB) for tornado missile protection. Plant configurations in both units for which structures, systems, and components (SSCs) should be protected from tornado-generated missiles based on the CLB were identified.

The NRC provided information in Enforcement Guidance Memorandum (EGM) 15-002 (Reference 5) with respect to exercising enforcement discretion when an operating power reactor licensee does not comply with a plants current site-specific licensing basis for tornado-generated missile protection. The NRC would exercise this enforcement discretion only when a licensee implements initial compensatory measures to provide additional protection, Entergy Operations, Inc.

1340 Echelon Parkway Jackson, MS 39213 Tel 601-368-5138 Ron Gaston Director, Nuclear Licensing

0CAN041904 Page 2 of 3 followed by more comprehensive, long-term compensatory measures implemented within 60 days of discovery of a non-complying SSC. The NRC issued Revision 1 of EGM 15-002 (Reference 6) to provide guidance for a licensee to request an extension of the enforcement discretion expiration date, if appropriately justified. The nonconforming SSCs identified at ANO-1 and ANO-2 were entered into the sites corrective action program and the enforcement discretion allowed by EGM 15-002 was applied.

On March 19, 2018, ANO submitted a request to extend the enforcement discretion provided in EGM 15-002 for tornado-generated missile protection non-conformances identified in response to RIS 2015-06, "Tornado Missile Protection" (Reference 7). The NRC approved the requested extension on April 12, 2018 (Reference 8), which extended the expiration date for the period of enforcement for ANO-1 and ANO-2 to June 10, 2020.

Approval of the proposed amendment is requested by May 1, 2020. This date supports the expiration date for the period of enforcement. Once approved, the amendment shall be implemented within 30 days.

No new regulatory commitments are included in this amendment request.

In accordance with 10 CFR 50.91, Entergy is notifying the State of Arkansas of this amendment request by transmitting a copy of this letter and enclosure to the designated State Official.

If there are any questions or if additional information is needed, please contact Tim Arnold at 479-858-7826.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on April 29, 2019.

Sincerely, ORIGINAL SIGNED BY RON GASTON Ron Gaston RG/dbb

Enclosure:

Evaluation of the Proposed Change Attachments to

Enclosure:

1.

Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

2.

Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

3.

ANOs Review of Pilot Plant RAIs

4.

Safety Analysis Report Page Markups

5.

Retyped Safety Analysis Report Pages

0CAN041904 Page 3 of 3

REFERENCES:

1.

NEI Technical Report 17-02, [Rev. 1], dated September 2017 (ML17268A033 and ML17268A036)

2.

NEI Technical Report 17-02 [Rev. 1A] included in Vogtle Electric Generating Plant - Unit 1 and 2 Tornado Missile Risk Evaluator SNC Response to NRC Request for Additional Information, dated July 26, 2018 (ML18207A876)

3.

NEI Technical Report 17-02 [Rev. 1B] included in Shearon Harris Nuclear Power Plant, Unit 1 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis -

Supplement and Request for Additional Information Response, dated September 19, 2018 (ML18262A328)

4.

NRC Regulatory Issue Summary 2015-06, "Tornado Missile Protection,"

dated June 10, 2015 (ML15020A419)

5.

NRC memorandum, "Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," dated June 10, 2015 (ML15111A269)

6.

NRC memorandum, "Enforcement Guidance Memorandum 15-002, Revision 1: Enforcement Discretion for Tornado-Generated Missile Protection Non-Compliance," dated February 7, 2017 (ML16355A286)

7.

Entergy letter to the NRC dated March 19. 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generate Missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06,'Tornado Missile Protection'" (0CAN031802)

(ML18078B016)

8.

NRC letter to Arkansas Nuclear One dated April 12, 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generated missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CNA041801)

(ML18094A739) cc:

NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Mr. Bernard R. Bevill Arkansas Department of Health Radiation Control Section 4815 West Markham Street Slot #30 Little Rock, AR 72205

Enclosure to 0CAN041904 Evaluation of the Proposed Change

Enclosure to 0CAN041904 Page 1 of 47 EVALUATION OF THE PROPOSED CHANGE 1.0

SUMMARY

DESCRIPTION The proposed amendment would modify the Safety Analysis Reports (SARs) associated with Arkansas Nuclear One, Unit 1 (ANO-1) Renewed Facility Operating License DPR-51 and Arkansas Nuclear One, Unit 2 (ANO-2) Renewed Facility Operating License NPF-6 to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology. The TMRE methodology was transmitted to the Nuclear Regulatory Commission (NRC) by the Nuclear Energy Institute (NEI) as NEI Technical Report 17-02, Revision 1, on September 21, 2017 (Reference 1). NEI established a Pilot Plant NRC review for the TMRE methodology through which Revisions 1A and 1B of NEI 17-02 (References 2 and 3) were submitted to the NRC in licensees responses to the NRCs request for additional information. TMRE is a proposed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles and provides guidance for resolving discrepancies against the current licensing basis (CLB) requirements.

The methodology assists in determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where adequate tornado missile protection is not currently provided and cannot be used to avoid providing tornado missile protection in the plant modification process. The requested change does not involve a significant hazards consideration.

The proposed amendment would modify ANO-1 SAR Section 5.1.5, "Wind and Tornado Loads,"

and ANO-2 SAR Section 3.5.4, "Barrier Design Procedures."

ANO-1 SAR Section 5.1.5 currently states:

Design wind loads are based on ASCE Paper 3269, "Wind Forces on Structures."

A.

"Design" Wind Load (except tornado) is in accordance with the following tabulated values determined from ASCE 3269 paper for a basic wind velocity of 67 mph, 1.1 gust factor, and 1.3 shape factor:

Height Above Design Pressure Ground (Feet)

PSF 0-30 20 30-50 20 50-100 26 100-150 26 B.

Tornado. Class 1 structures are analyzed for tornado loading (not coincident with accident or earthquake) on the following basis:

1.

Differential bursting pressure between the inside and the outside of the structures - three psi positive pressure.

Enclosure to 0CAN041904 Page 2 of 47

2.

Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors.

The provisions for gust factors and variations of wind velocity with height do not apply.

3.

Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6. Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures.

Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings and it is highly improbable that they will be pierced by tornado missiles. Further analysis also indicates that, in the unlikely event these penetrations are impinged by tornado missiles, the incident will not cause a LOCA or prevent a safe shutdown of the plant. The spent fuel pool walls are inherently resistant to missiles. A discussion on the enclosure over the new and spent fuel pool storage facilities is included in Section 5.3.2. Investigations of previous tornadoes demonstrate that no funneling effect of the tornado winds is to be expected between the Unit 1 and Unit 2 containment structures.

The possibility of the generation of secondary missiles within the structure from tornado missiles was analyzed. The 3-inch diameter pipe, as described in Section 5.2.1.2.6 was considered as potentially damaging due to its high density. However, based on results of U. S. Army Corps of Engineers investigation (5), only 13 inches of concrete thickness is required to prevent spalling of 3,000 psi concrete from an impact by the 3-inch diameter pipe missile. Since 18 inches is the minimum exterior wall and slab thickness provided for Class 1 structures, the safety related equipment and systems will not be affected by secondary missiles.

Intervening SSCs, including large equipment and structural members, may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

Enclosure to 0CAN041904 Page 3 of 47 Entergy Operations, Inc. (Entergy) proposes to add the following to ANO-1 SAR Section 5.1.5:

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH-4A and 4B chillers (reference CR-ANO-1-2017-3702).

ANO-2 SAR Section 3.5.4 currently states, in part:

The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

Entergy proposes to add the following to ANO-2 SAR Section 3.5.4:

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Enclosure to 0CAN041904 Page 4 of 47 Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

2.0 DETAILED DESCRIPTION 2.1 Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (Reference 4). The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed. The specific criteria for each nuclear power plant are contained in the individual plants specific licensing basis.

In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection.

Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles. Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS methodology. The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile, and was accepted for use by the NRC. In cases where some components were not in conformance with a plants licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required. Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis.

The Nuclear Energy Institute (NEI) developed the TMRE methodology, which is an alternative risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Enclosure to 0CAN041904 Page 5 of 47 2.2 Current Licensing Basis 2.2.1 ANO-1 Licensing Basis ANO-1 General Design Criteria The ANO-1 construction permit was issued in December 1968. ANO was aware of the proposed Atomic Energy Commission (AEC) General Design Criteria (GDC); however, ANO-1 received the construction permit prior to issuance of the GDC. Although ANO-1 was not governed by the GDC, ANO-1 SAR, Section 1.4.2, includes a discussion of how ANO-1 meets the intent of GDC 2.

The ANO-1 general design strategy for meeting the intent of the draft GDC 2, "Design Bases for Protection Against Natural Phenomena," was to provide protection of safety related equipment against natural phenomenon by housing safety-related equipment in seismically qualified Class I structures. These structures then provide protection against natural phenomenon such as rain, wind, differential pressure and tornado missiles (reference SAR Section 1.4.2). SAR Section 5.1.2.1.1 identifies the following structures as being Class 1:

Reactor building (including steel liner, prestressing system penetrations, air locks, interior structures, and shielding elements directly related to nuclear safety)

Auxiliary building housing the engineered safeguards systems, control room, spent fuel pool (excluding liner plate), diesel generators, and radioactive materials.

Portions of the intake structure housing service water pumps Supports for Seismic Class 1 system components Emergency reservoir and pipelines Emergency diesel fuel storage vault Post-Accident Sampling System Building ANO-1 meets the intent of draft GDC 4, Environmental and Missile Design Basis, for tornado-generated missiles through structural design and physical location of components, which includes redundant train separation (reference SAR Section 1.4.4).

ANO-1 Safety Evaluation Report The NRC staff issued the original Safety Evaluation Report (SER) to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from the original SER include:

Section 3.3, Wind and Tornado Design The sustained design wind speed used for the design of essential plant structures was 67 mph. Wind pressure, shape factors, gust factors, and variation of winds with height were determined in accordance with the American Society of Civil Engineers paper ASCE 3269, "Wind Forces on Structures."

Enclosure to 0CAN041904 Page 6 of 47 Tornado design loading consisted of a differential pressure equal to 3 psi occurring in three seconds, followed by a calm for two seconds and a repressurization, and a lateral force caused by a funnel of wind having a peripheral tangential velocity of 300 mph and forward progression of 60 mph.

We conclude that the design of the facility to the above wind and tornado loads is acceptable.

Section 3.5, Missile Protection The design of essential structures and vital components considered the effects of a spectrum of tornado-borne missiles and internally generated missiles associated with component overspeed failures and missiles that could originate from high energy system ruptures. There will be no loss of function of seismic Category I structures or components as a result of missile action.

All seismic Category I structures are designed to withstand the effects of the following spectrum of tornado-borne missiles: a 4-inch x 12-inch by 12-foot long wooden plank traveling end-on at 300 mph; an automobile weighing two tons traveling through the air 25 feet above the ground at 50 mph and striking the structure with a contact area of 20 square feet; and a missile equivalent to a 3-inch diameter schedule 40 pipe, 10 feet long, traveling end-on at 100 mph and striking the structure anywhere over its full height.

Essential components contained in seismic Category I structures are inherently protected from tornado-borne missiles by virtue of being in a tornado resistant structure. The main steam and reactor building purge line penetrations are not located within a tornado resistant structure or protected by missile shielding, but have been designed to withstand tornado winds and pressure drop loadings. We have reviewed the applicants missile impact analysis for these penetrations (main steam line and purge lines) and conclude that missile impacts on these penetrations would not cause a LOCA or prevent safe plant shutdown.

We conclude that the missile protection provided for ANO-1 is acceptable.

ANO-1 CLB for Tornado and Tornado Missile Protection Design Per the ANO-1 SAR, Section 5.1.2.1, Seismic Class 1 SSCs are defined as those SSCs which could cause uncontrolled release of radioactivity upon failure or those essential for safe shutdown reactor shutdown and the immediate and long-term operation following a loss of coolant accident (LOCA). These structures include the Reactor Building, the Auxiliary Building (housing engineered safeguards systems, Control Room, spent fuel pool (SFP), emergency diesel generators (EDGs), and radioactive materials), portions of the Intake Structure (housing Service Water pumps and support features), the emergency diesel fuel oil storage vault, and the post-accident sampling system building. As discussed in SAR Section 5.1.5, Class 1 structures were analyzed for tornado loading (not coincident with accident or earthquake) on the following basis:

Differential bursting pressure between the inside and the outside of the structures -

three psi positive pressure.

Enclosure to 0CAN041904 Page 7 of 47 Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph.

The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category 1 structures were designed considering a uniform pressure resulting from the 300 mph wind velocity. The applicable portions of wind design methods described in ASCE paper 3269, "Wind Forces on Structures," are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, SFP, EDG rooms, etc., are inherently tornado protected by virtue of being housed in tornado resistant structures. The SFP walls are inherently resistant to missiles. The main steam line and containment purge line reactor building penetrations are not located within a tornado resistant structure or protected by a missile shield. In accordance with the SAR, these penetrations will withstand tornado winds and pressure drop loadings, and it is considered highly improbable that these penetrations will be pierced by tornado missiles. Further analysis also indicates that, in the unlikely event these penetrations are impinged by tornado missiles, the incident will not cause a LOCA or prevent a safe shutdown of the plant.

Per Section 5.1.5 of the ANO-1 SAR, Class 1 structures were designed, except as noted below, for the following CLB tornado missiles:

A 4-inch thick by 12-inch wide by 12-foot long wood plank traveling end-on at a velocity of 300 mph.

An airborne 4,000-pound passenger automobile traveling at a velocity of 50 mph, not more than 25 feet above the ground.

A 3-inch diameter schedule 40 pipe, 10 feet long, traveling end-on at 100 mph, sticking anywhere over the full height of the structure was also considered.

The possibility of the generation of secondary missiles within structures from tornado missiles was analyzed. The 3-inch diameter pipe, as described above, was considered as potentially damaging due to its high density. However, based on results of U.S. Army Corps of Engineers investigation, only 13 inches of concrete thickness is required to prevent spalling of 3,000 psi concrete from an impact by the 3-inch diameter pipe missile. Since 18 inches is the minimum exterior wall and slab thickness provided for Class 1 structures, the safety related equipment and systems will not be affected by secondary missiles.

Vertical missiles are not considered in the CLB.

2.2.2 ANO-2 Licensing Basis ANO-2 General Design Criteria ANO-2 was originally designed to comply with the 70 "Proposed General Design Criteria for Nuclear Power Plant Construction Permits," published in July 1967. Nevertheless, Sections 3.1.1 through 3.1.6 of the ANO-2 SAR provide a comparison with the AEC GDC published as Appendix A to 10 CFR 50 in 1971, illustrating how the intent of each GDC (as published in 1971) is met.

Enclosure to 0CAN041904 Page 8 of 47 ANO-2 meets the intent GDC 2 by housing safety-related equipment in Seismic Category 1 structures, which are designed for the most severe local wind phenomena and tornado effects which can be expected to occur at the site (reference SAR Section 3.3). Seismic Category 1 structures, which are considered tornado resistant enclosures, and the associated protected equipment include:

ANO-2 SAR Table 3.3-1 Tornado Wind Protected Components and Tornado Resistant Enclosures Protected Components Tornado Resistant Enclosure Reactor Coolant System Containment Reactor Protective System and Engineered Safety Features Inside Containment Containment Control Room Auxiliary Building Various Electrical, Instrumentation and Control Equipment Required for Safe Shutdown Containment and Auxiliary Building Shutdown Cooling System Auxiliary Building Reactor Coolant Pressure Control Equipment Auxiliary Building Boron Addition Equipment Auxiliary Building Spent Fuel Pool Fuel Pool Wall Emergency Diesel Generators Diesel Generator Rooms in Auxiliary Building Diesel Fuel Oil System Underground Vault Service Water Pumps Intake Structure Emergency Feedwater Pumps Auxiliary Building Safety Injection System Auxiliary Building ANO-2 meets the intent of GDC 4 through conservative design methods, segregated routing of piping, missile shield walls, and engineered hangers and pipe restraints, all of which are used to accommodate dynamic effects of postulated accidents. These same features as well as the strength of the auxiliary building, containment and intake structure protect the safety-related equipment from missiles which might be generated either within or outside the plant (reference SAR Section 3.1.1).

ANO-2 Safety Evaluation Report The NRC staff issued the original ANO-2 SER to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from the original SER include:

Enclosure to 0CAN041904 Page 9 of 47 ANO-2 SER Section 3.3, Wind and Tornado Design Criteria All seismic Category I structures exposed to wind forces are being designed to withstand the effects of the design wind. The design wind specified has a velocity of 80 miles per hour based on a recurrence interval of 100 years.

The procedures used to transform the wind velocity into pressure loadings on structures and the associated vertical distribution of wind pressures and gust factors are in accordance with American Society of Civil Engineers Paper No. 3269, "Wind Forces on Structures."

All seismic Category I structures exposed to tornado forces and needed for the safe shutdown of the plant are designed to resist a tornado with a 300 mile per hour tangential wind velocity and a 60 miles per hour translational wind velocity. The atmospheric pressure drop associated with the design tornado is three pounds per square inch in three seconds. An appropriate spectrum of tornado-generated missiles is also postulated as will be discussed in Section 3.5 of this report.

The procedures used to transform tornado wind velocity into pressure loadings are similar to those used for the design wind loadings. The pressure drop associated with the design tornado is treated as a static uniform load applied on vertical and horizontal projected areas of the structures.

Tornado missile effects were determined using procedures to be discussed in Section 3.5 of this report. The total effect of the design tornado on seismic Category I structures was determined by the appropriate combination of the individual effects of the tornado wind pressure, pressure drop and tornado associated missiles. Tornado-generated loads were then combined with other applicable loads as will be discussed in Section 3.8 of this report. Structures are arranged on the plant site and protected in such manner that collapse of structures not designed for tornadoes will not affect safety-related structures and systems.

The criteria used and the procedures utilized to account for loading on seismic Category I structures and components induced by the design wind and tornado specified for the plant provide a conservative basis for engineering design and assure that such environmental forces are adequately represented.

The use of these procedures provides reasonable assurance that, in the event of wind or a tornado, the structural integrity of all seismic Category I structures will not be impaired and consequently, seismic Category I systems and components located within these structures will be adequately protected. Conformance with these criteria is an acceptable basis for satisfying the requirements of General Design Criteria 2.

ANO-2 SER Section 3.5, Missile Protection Criteria The plant seismic Category I structures, systems and components are shielded from, or are designed for, various postulated missiles. Missiles considered include tornado generated missiles and various postulated missiles generated within the plant.

Enclosure to 0CAN041904 Page 10 of 47 Adequate information has been provided indicating the structures, shields and barriers that are designed to resist the effects of missiles. The missiles applicable to each of these structures, shields and barriers are also adequately identified and their characteristics defined.

The analysis of structures, shields and barriers to determine the effects of missile impact was accomplished in two steps. In the first step, the potential damage that could be done by the missile in the immediate vicinity of impact was investigated. This was accomplished by estimating the depth of penetration of the missile into the impacted structures. Furthermore, secondary missiles are prevented by fixing the target thickness well above that determined for penetrations. In the second step of the analysis, the overall structural response of the target when impacted by a missile was determined using established methods of impactive analysis. The equivalent loads of missile impact, whether the missile is environmentally generated or accidently generated within the plant, were combined with other applicable loads as is discussed in Section 3.8 of this report.

The design procedures used to determine the effects and loading on seismic Category I structures by design basis missiles selected for the plant provide a conservative basis for engineering design to assure adequate protection from the effects of missile impacts.

The use of these criteria for protection from postulated missiles provides reasonable assurance that resulting loads and effects will not impair the structural integrity of seismic Category I structures, or result in any loss of function of safety-related systems and components contained in such structures. We have concluded that conformance with these criteria is an acceptable basis for satisfying the applicable requirements of General Design Criteria 2 and 4.

ANO-2 SER Section 3.5.1, Tornado Missile Protection Our review for tornado missile protection was based on General Design Criteria 2 and 4.

We found that all safety-related equipment necessary for a cold shutdown was adequately protected from tornado missiles with the exception of the underground diesel fuel lines leading from the emergency diesel fuel oil tank vault to the diesel generator room and the sluice gate within the emergency cooling pond intake structure.

The applicant subsequently provided additional protective covering over the diesel fuel lines in addition to the previous three-foot soil cover, and provided further protective features in the design of the emergency cooling pond intake structure.

We therefore conclude that the Arkansas Nuclear One - Unit 2 facility is adequately protected against tornado missiles and is acceptable.

ANO-2 SAR Per Section 3.3, "Wind and Tornado Loadings," of the ANO-2 SAR, Class 1 structures were designed for the most severe local wind phenomena and tornado effects which can be expected to occur at the site. These structures include: the Containment Building, the Auxiliary Building, the SFP wall, the EDG rooms within the Auxiliary Building, the diesel fuel oil underground vault, and the Intake Structure.

Enclosure to 0CAN041904 Page 11 of 47 As reflected in Section 3.3.2, "Tornado Loadings," of the ANO-2 SAR, tornado-protected Class 1 structures were analyzed for tornado loadings not coincident with any unrelated accident condition or earthquake. For Class 1 structures designed to withstand tornadoes and tornado generated missiles, the following parameters were applied in combinations to produce the most critical conditions.

The dynamic wind pressure is caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward procession of 60 mph. The tornado resistant design of the ANO units was completed prior to the issuance of Regulatory Guide (RG) 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants." As a result, the radius of maximum rotational speed is not significant to the ANO design, and Class 1 structures were designed considering a uniform pressure resulting from the 300 mph wind velocity. The applicable portions of wind design methods described in ASCE Paper No. 3269 were used, particularly for shape factors. The provisions for gust factors and variation of wind velocity with height were not applied.

The structure interior bursting pressure is taken as rising 1 psi/sec for three seconds followed by a 2-second calm, then decreasing at 1 psi/sec for three seconds. This cycle accounted for reduced pressure in the eye of a passing tornado. All fully enclosed Class 1 structures were designed to withstand the full 3 psi pressure differential.

Tornado-generated missiles will not cause loss of containment integrity, penetrate the Control Room boundary, or cause loss of integrity to the SFP. SSCs were designed such that tornado missiles will not cause loss of function to any system required for hot shutdown of the reactor from the Control Room even assuming the failure of a single active component, and will not cause loss of function of any system required for cold shutdown.

Section 3.3.2.1 of the ANO-2 SAR considers three types of tornado missiles. Each type was considered to act independently, with only one type occurring at any one time. The three types of missiles are as follows:

A wood plank, 4-inches x 12-inches in cross section, weighing 108 pounds, traveling end-on at a speed of 300 mph and striking the structures at any elevation.

A steel pipe, schedule 40, 3-inches in diameter x 10-feet long, weighing 75.8 pounds, traveling end-on at 100 mph and striking the structure at any elevation.

An automobile of 4,000-pound weight, striking the structure at 50 mph on a contact area of 20 square feet, any portion of the impact area being not more than 25 feet above grade.

Section 3.3.2.3 of the ANO-2 SAR states that failure of Class 2 structures is not expected to affect the ability of Class 1 structure to perform their functions based on the following:

Tornado missiles that may be formed by the failure of Class 2 structures will not exceed the force of those postulated and described above, against which Class 1 structures were designed.

Enclosure to 0CAN041904 Page 12 of 47 An investigation of the structural frame of the Class 2 Turbine Building in the vicinity of the Auxiliary Building revealed the Turbine Building will not collapse when subjected to tornado loadings, assuming that one-third of the exterior metal siding would be exposed to the full tornado load. The structural steel framing enclosing the Auxiliary Building SFP area has also been checked for the same conditions, with the same results. This condition is commonly observed in tornado damage. The fasteners are known to be much weaker in shear and in pull out than the continuous sheet acting as a catenary.

Therefore, in the event of a tornado, the fasteners on the two ends of the sheet can be expected to fail and the sheathing assumed to remain balanced and restrained by the central portion of the panel against the girts.

Missile barriers capable of withstanding tornado-generated missiles and designed to provide protection from identified missiles are outlined below (reference ANO-2 SAR, Table 3.5-1).

Protected Components Missile Barrier Reactor Coolant System and other protected equipment and systems inside containment Prestressed concrete containment, primary and secondary shields, reinforced concrete and refueling cavity wall, internal structures and beams, movable missile shield Control Room Components Enclosure by reinforced concrete auxiliary building walls and slabs Safety injection, spray, boron addition, cooling water, ventilation, electrical instrumentation and control and other protected equipment in auxiliary building Reinforced concrete auxiliary building.

Separation of safety-related trains and enclosure by auxiliary building internal structure, walls and slabs.

Spent Fuel Pool SFP wall. Heavy structural auxiliary building components are designed such that missile impact will not cause them to fall into the fuel pool.

Emergency Diesel Generators Separation and enclosure by reinforced concrete auxiliary building walls and slabs.

Diesel Fuel Oil System Separation and enclosure by reinforced concrete vault partially underground.

Service Water Pumps Separation and enclosure by reinforced concrete intake structure walls and slabs.

Auxiliary Feedwater Pumps Separation and enclosure by reinforced concrete Auxiliary Building walls and slabs Category 1 Electrical Cables Reinforced concrete cover Condensate Storage Tank (T41B)

Pipe Trenches and Valve Pits Reinforced concrete cover Condensate Storage Tank T41B Reinforce concrete wall

Enclosure to 0CAN041904 Page 13 of 47 Protection from tornado-generated horizontal and vertical missiles was considered for the following components: Intake Structure Exhaust Fans and Air Intake, EDG Rooms Air Intake and Exhaust Fans, EDG Combustion Air Intake, Service Water Piping between Emergency Cooling Pond (ECP) and Intake Structure / Auxiliary Building (3-feet of earth), ECP Sluice Gate, and EDG Fuel Storage Tanks. Otherwise, only horizontal missiles were considered.

2.3 Reason for the Proposed Change In response to RIS 2015-06, Entergy performed walk downs at ANO to identify potential discrepancies with the ANO CLB related to tornado-generated missile protection. As part of the walk downs SSCs were identified as being nonconforming. The nonconforming SSCs were entered into the corrective action program. The conditions that satisfied reporting criteria of 10 CFR 50.72 and/or 10 CFR 50.73 were reported to the NRC as outlined in ANOs request to extend enforcement discretion (Reference 7) provided in EGM 15-002, which was subsequently approved by the NRC (Reference 8).

Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance" (References 5 and 6), and DSS-ISG-2016-01, "Clarification of Licensee Actions in Receipt of Enforcement Discretion per Enforcement Guidance Memorandum EGM 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance'" (Reference 9), with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status.

Compensatory actions will remain in effect until the SSCs have been restored to full qualification.

Several non-conformances have been resolved by plant modifications at significant cost. Those not resolved by plant modifications are addressed through the proposed application of TMRE and discussed below.

As documented by the NRC in EGM 15-002, in general, tornado missile scenarios do not represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados.

The staffs study established that the Core Damage Frequency (CDF) associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

Tables 1 and 2 (ANO-1 and ANO-2, respectively) outline the non-conformances that are planned for resolution via this amendment request.

Enclosure to 0CAN041904 Page 14 of 47 Table 1 ANO-1 Nonconforming (Safety-Related) SSC Vulnerabilities Item Vulnerability Description General Location 1

Three small fire damper openings (FD-0135-02-0009 (22-inches x 22-inches), FD-0135-02-0022 (16-inches x 18-inches), and FD-0141-02-0011 (14-inches x 12-inches))

in the south wall of the Controlled Access point (commonly referred to as CA-1) are vulnerable to a northern bound missile. Green train safety-related electrical raceways could be impacted. (CR-ANO-1-2016-2752)

Controlled Access, Elevation (EL.) 386 2

Unprotected conduits in the demineralizer area (Room 73) on the east side of the hallway near Column Line 5.9 were identified as nonconforming. (CR-ANO-1-2017-1171)

Room 73 (Unit 1 Bowling Alley, EL. 354) 3 A cable tray opening in the reinforced concrete wall 3-S-23 was identified between Rooms 103 and 104.

(CR-ANO-1-2017-1171)

Room 104 (Electrical Equipment Room, EL 368) 4 P-7A Emergency Feed Water (EFW) Pump Steam Supply Line could be impacted by a 3-inch diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph. (CR-ANO-1-2015-3940) (Note 1)

Above EL. 404' Note 1:

The P-7A EFW Pump Steam Supply Line vulnerability was identified in NRCs confirmatory action letter to ANO dated June 17, 2016 (0CNA061604, ML16169A193). The 4-inch steam supply line (above elevation 404') to the EFW turbine driven pump (P-7A) is vulnerable to a tornado missile strike. ANO has defined three possible tornado missiles (reference ANO-1 SAR Section 5.2.1.2.6 "Wind and Tornado Loads"). At the 404' elevation only the 3" diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph (147 ft/sec) is considered credible. There is no specific analysis of the effect of a missile of this size hitting the 4-inch schedule 40 EFW steam supply piping; therefore, P-7A is considered Operable but Degraded and Nonconforming. This lack of documentation is not under enforcement discretion; however, it is included in TMRE to document its design and licensing basis.

In addition to the above, several ANO-1 nonconforming conditions were safety-related features that had previously been evaluated to have a negligible impact on the RG 1.200 compliant ANO-1 Internal Events Probabilistic Risk Assessment (PRA) and, therefore, are not explicitly modeled. Because the TMRE Methodology uses the Internal Events PRA, the hypothetical impact of a tornado missile on those features also has a negligible impact on the risk associated with tornado missile protection. Non-conforming features in this category are listed below.

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-2752)

Small bore service water piping (HCD-65-2" and HCD-66-2") to VCH-4A and 4B pumps (reference CR-ANO-1-2017-3702)

Enclosure to 0CAN041904 Page 15 of 47 Table 2 ANO-2 Nonconforming (Safety-Related) SSC Vulnerabilities Item Vulnerability Description General Location 1

2K-4A EDG could be impacted by a tornado-generated missile vulnerability associated with Conduit EC1373 which contains safety-related cables that run between Switchgear Cabinet 2A-308 and the Diesel Generator No. 1 Meter and Relay Cabinets (2E11 and 2E12). (CR-ANO-2-2017-1555)

Room 2136 (Unit 2 Controlled Access Area) and Room 2145 (Fire Brigade Area, EL 386).

2 2P-7A, EFW Pump Steam Supply Line could be impacted by a 3-inch diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph. (CR-ANO 2015-4851) (Note 1)

EL. 404 3

Diesel Exhaust Stacks - The EDGs, 2K-4A and 2K-4B, exhaust pipes are vulnerable to tornado missiles. The entire vulnerable segment of piping is nonconforming. (CR-ANO-C-2018-02260) (Note 2)

Auxiliary Building Roof Note 1:

The 2P-7A EFW Pump Steam Supply Line vulnerability was identified in NRCs confirmatory action letter to ANO dated June 17, 2016 (0CNA061604, ML16169A193). ANO-2 FSAR, Table 3.5-6, "Tornado Missile Characteristics,"

defines three tornado missiles. At the 404' elevation only the 3" diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph (147 ft./sec) tornado missile is considered credible. There is no specific analysis of the effect of a missile of this size hitting the 4"schedule 40 EFW steam supply piping; therefore, 2P-7A is considered Operable but Degraded and Nonconforming.

This lack of documentation is not under enforcement discretion; however, is included in TMRE to document its design and licensing basis.

Note 2:

The ANO-2 EDG Exhaust Stack structural support system was recently analyzed for the licensing basis tornado missiles using reduced operability wind and missile velocities of 230 mph (versus design base wind loads of 300 mph) and reduced safety factors for steel members and concrete anchors were utilized to demonstrate the ANO-2 EDG Exhaust Stacks are functional. The EDG Exhaust Stacks are classified as Operable but Degraded and Nonconforming due to the evaluation being performed at reduced wind and missile velocities. This condition is not under enforcement discretion; however, it is included in TMRE as a non-conformance.

ANO-2 nonconforming conditions are explicitly modeled in the ANO-2 Internal Events PRA.

Enclosure to 0CAN041904 Page 16 of 47 2.4 Description of the Proposed Change Entergy requests NRC approval to incorporate the TMRE methodology into the ANO-1 and ANO-2 SARs. Entergy proposes to add the TRME methodology to the both units SARs to reflect it as the analysis method used to demonstrate that protection from tornado-generated missiles is acceptable for the defined areas. The proposed change supports the following:

Change ANO-1 SAR Section ANO-2 SAR Section Describe ANOs use of TMRE for SSCs as an NRC accepted method and state that it can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

5.1.5, Wind and Tornado Loads 3.5.4, Barrier Design Procedures Add a new listing of Safety-Related SSCs that do not require protection from tornado-generated missiles based on Tornado Missile Risk Evaluator Methodology (TMRE).

5.1.5, Wind and Tornado Loads 3.5.4, Barrier Design Procedures The ANO SAR markups are included in Attachment 4 and clean copies included in to this Enclosure.

To assist in the NRCs review of the proposed change, Attachment 2 of this Enclosure addresses each NRC Request for Additional Information (RAI) as requested of each pilot plant.

3.0 TECHNICAL EVALUATION

3.1 Tornado Missile Risk Evaluator Methodology The NRCs policy statement on PRA encourages greater use of the PRA technique to improve safety decision-making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments and technical specification changes under 10 CFR 50.90. TMRE is proposed as a PRA-based methodology for evaluating the risk impact of existing conditions where tornado missile protection is required in a licensees CLB, but the required protection was not provided. For conditions that meet the acceptance criteria, the ANO-1 and ANO-2 licensing bases would be revised.

GDC 2 requires that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions.

GDC 4 requires that SSC important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes. RG 1.117, "Tornado Design Classification," Revision 1, describes a

Enclosure to 0CAN041904 Page 17 of 47 method acceptable to the NRC staff for identifying those SSCs of lightwater-cooled reactors that should be protected from the effects of the Design Basis Tornado, including tornado missiles, and remain functional. TMRE is proposed as an alternative methodology for identifying whether certain SSCs must be protected from the effects of a tornado-generated missile. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The TMRE methodology employs a simplified, conservative assessment of risks to core damage and large early release posed by tornado-generated missiles at nuclear plants. The guidance for use of the methodology is found in NEI 17-02, "Tornado Missile Risk Evaluator Industry Guidance Document" (References 1, 2, and 3). The guidance document provides a detailed approach to gathering the necessary information and translating the information into a PRA model. The risk assessment methods and acceptance criteria of the NRC RG 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

3.2 Traditional Engineering Considerations Two of the five key principles of risk-informed decision making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins.

These two considerations are discussed below with respect to the proposed change to the ANO-1 and ANO-2 licensing bases.

The proposed change is consistent with a defense-in-depth philosophy Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

An evaluation of the seven considerations related to the defense-in-depth considerations contained in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," (Reference 11) is provided below.

The responses are applicable to both ANO-1 and ANO-2 unless otherwise noted.

1.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

No new accidents or transients are introduced with the proposed change, and the facility remains sufficiently protected from tornado-generated missiles.

The proposed change does not significantly impact the availability and reliability of SSCs that provide safety functions which prevent challenges from progressing to core damage. The magnitude of the change is consistent with the guidance of RG 1.174.

Enclosure to 0CAN041904 Page 18 of 47 None of the nonconforming conditions in the TMRE model only affect the Large Early Release Frequency (LERF), which is an indication that there was no significant impact on prevention of containment failure.

The change does not significantly reduce the effectiveness of the emergency preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

2.

Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided.

Implementation of the proposed change does not require compensatory measures.

The risk assessment associated with this amendment request gave no credit to compensatory measures implemented in response to the nonconforming conditions.

No plant operating procedures are being changed to implement the proposed amendment. However, some documents will require revision to remove compensatory measures currently being credited while enforcement discretion is in effect.

The proposed change does not rely upon proceduralized operator actions required to be performed within one hour of a tornado passing.

3.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

The proposed change does not modify the redundancy, independence, or diversity described in ANO-1 or ANO-2 SAR. The proposed change does not result in a disproportionate increase in risk.

ANO-1 SAR Section 2.3.3.3.4 and ANO-2 SAR Section 2.3.1.3.5 document the frequency of tornados in the vicinity of the plants, which is an infrequent event and which is unaffected by this amendment request.

The proposed change does not impact the assumptions in the ANO accident analyses presented in the unit specific SAR.

The proposed change does not impact the availability or reliability of SSCs that could either initiate or mitigate accidents, with the exception of tornado missile protection, which is thoroughly evaluated in this amendment request.

Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile.

Critical equipment is stored in redundant structures that would prevent the loss of minimal equipment which may be needed to respond to a tornado event.

Conservatively, permanently installed and portable FLEX equipment are not modeled in the PRA.

Enclosure to 0CAN041904 Page 19 of 47

4.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

ANO-1 In general, the nonconforming conditions are physically distributed about the ANO-1 site minimizing the likelihood of multiple SSCs being impacted. In addition, there is a low likelihood that counterpart equipment (i.e., similar or redundant components) would be impacted.

Nonconforming conduits in the ANO-1 demineralizer area if impacted by a tornado-generated missile could affect both trains of service water (SW).

Assuming all cabling is impacted, the Green train SW pump could be disabled along with one or more SW loop cross-tie valves which are physically located (and protected from tornado events) in the Intake Structure. This could require an Operator to manually manipulate one of the four cross-tie valves locally (at the Intake Structure, which is tornado protected) in order to separate the Red train SW loop from the Green train loop which was lost (depending on which SW pumps were in service at event initiation). The ANO-1 operating staff includes three non-licensed Operators, two licensed Reactor Operators (ROs), two licensed Senior Reactor Operators (SROs), and a Shift Technical Assistant (STA).

One non-license Operator is assumed to be available to align SW suction to any required EFW pump suction. One of the remaining two non-licensed operators would be available, if needed, to manipulate a SW cross-tie valve at the Intake Structure. It is qualitatively estimated that this evolution would take approximately 20-25 minutes, accounting for identification of the need for the action, transit time, and valve manipulation time. Operator cues are supported by low SW pressure indications (assuming only one pump is supplying both loops if the loops are cross-tied). To separate the SW loops from the Control Room, only one valve needs to remain available. While the tornado is the common-cause of the failure, TMRE PRA analysis demonstrates that the SW system will remain functional and the change in risk associated with a potential tornado-generated missile in this area is low. Apart from the potential impact of a tornado-generated missile, the plant design and operation (i.e., activities such as maintenance, testing, inspection, and qualifications) of the SW system are not impacted by the proposed change.

Both trains of EFW may also be impacted by a tornado-generated missile in the ANO-1 demineralizer area. The loss of DC Control Power could prevent capability of motor-driven EFW pump P-7B auto-start or start from the Control Room. In addition, the flow isolation valve (CV-2627) to Steam Generator (SG) "A" from steam-driven EFW pump P-7A could fail open. However, this path can be isolated from the Control Room if necessary using an in-series isolation valve. The TMRE PRA analysis demonstrates that the EFW system will remain functional with minimal change in risk associated with a potential tornado-generated missile.

Because a main steam line or main feedwater line break accident are not assumed coincident with a tornado event, the steam-driven EFW pump and both SGs are assumed to remain available for decay heat removal. The plant design and operation (i.e., activities such as maintenance, testing, inspection, and qualifications) of the EFW system is not impacted by the proposed change.

Enclosure to 0CAN041904 Page 20 of 47 Because both the ANO-1 SW and EFW systems remain functional from a TMRE PRA perspective, sufficient equipment is expected to remain available when considering the cumulative impact of tornado-generated missiles such that no common-cause failure will result in the complete loss of either system.

ANO-2 For ANO-2, the nonconforming conditions are physically distributed about the site minimizing the likelihood of multiple SSCs being impacted. In addition, there is a low likelihood that counterpart equipment (i.e., similar or redundant components) would be impacted. With the aforementioned physical distribution of the nonconforming conditions, sufficient equipment is expected to remain available when considering the cumulative impact of tornado-generated missiles such that no common-cause failure will result in the complete loss of any system.

5.

Independence of barriers is not degraded.

Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles in either unit, and the containment building of each unit remains a robust tornado missile barrier.

The proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers and does not introduce a new event.

Although the proposed change does slightly increase the frequency of core damage, that increase is very small and has no significant impact on the fission product barriers.

6.

Defenses against human errors are preserved.

ANO has symptom-based abnormal operating procedures and emergency operating procedures that would be utilized in the event of a tornado adversely impacting safety related equipment. The procedures provide guidance to operators for preservation of critical safety functions. The procedures include guidance in the event "response not obtained," which provide alternative actions if equipment was damaged by tornadoes or other reasons.

Implementation of the proposed change does not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado.

Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserve the defense against human errors.

Both ANO units have a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes post-tornado walkdowns for tornado missile vulnerable SSCs. It includes a reference to COPD-038 that describes the potential vulnerabilities to tornado-generated missiles and recovery actions to be considered that reduce the impact of a tornado

Enclosure to 0CAN041904 Page 21 of 47 missile affecting the identified SSCs. Following approval of this amendment request, documents will be revised as necessary as part of implementation of the TMRE methodology.

7.

The intent of the plants design criteria is maintained.

This LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain vulnerable to tornado missiles. All other aspects of the plant design criteria are unaffected.

This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety.

The methodology cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the intent of the plants design criteria is maintained.

Identified SSCs would be reasonably assured to avoid damage if physically protected from design basis tornado missiles. In lieu of protection for the identified nonconforming SSCs, ANO-1 and ANO-2 have analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequential effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and is considered negligible.

Therefore, the intent of the plants design criteria is maintained.

The proposed change maintains sufficient safety margins The vast majority of each system important to safety remains protected from tornado missiles, consistent with the CLB. The identified vulnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains both being impacted by tornado missiles is much lower than the likelihood of a one train being impacted. The TMRE methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation. The number of potential missiles identified at ANO is less than the number of missiles assumed by the TMRE methodology. ANO has diverse and flexible coping strategies (FLEX) to restore critical safety functions in the event of a hypothetical loss of the primary functions. In some cases, non-safety related equipment, such as FLEX equipment, could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment.

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved by the NRC) continue to be met in accordance with the CLB of each unit. The proposed change is not in conflict with approved codes and standards relevant to the SSCs.

The safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change. The requirements credited in the accident analyses remain the same.

Therefore, the proposed change maintains sufficient safety margins and continues to protect public health and safety.

Enclosure to 0CAN041904 Page 22 of 47 3.3 Risk Assessment The TMRE methodology is used to estimate the quantitative risk associated with tornado-generated missiles associated with discrepancies with the ANO-1 and ANO-2 CLB related to tornado missile protection. The ANO-1 and ANO-2 internal events PRA models were utilized to estimate the risk associated with the passage of a tornado over ANO-1 and ANO-2.

The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific SSC (target) will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strikes on the CDFs and LERFs.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the number of potential missiles and the size and location of the target SSC being evaluated. The site-specific frequency of a tornado striking ANO-1 and ANO-2 is also used in the TMRE.

The outcome of the probabilistic element is an estimation of an increase in CDF and LERF associated with not protecting certain SSCs from tornado missiles.

3.3.1 High Wind Equipment List The ANO-1 and ANO-2 TMRE high winds equipment list (HWEL), which was created using industry guidance NEI 17-02, is a listing of the SSCs modeled in the internal events PRA model and credited for mitigating a tornado-induced loss of offsite power (LOOP). This list includes equipment associated with passive SSCs not explicitly included in the PRA model but that could impact functionality of equipment that is modeled in the PRA. Screening criteria were applied to the initial list to exclude or include equipment in the HWEL. The final HWEL contains SSCs that will be evaluated as part of the TMRE process. The following considerations were included in the development and update of the HWEL, consistent with the NEI 17-02 methodology:

The TMRE model uses the LOOP sequences with no offsite power recovery. The TMRE model was created from the internal events CDF and LERF PRA model of record for each unit. In each of these models the top gate was removed for accident initiator sequences that cannot be affected by high winds. The initiating events which cannot be affected by a tornado were set to FALSE and include reactor vessel rupture, very large LOCA for ANO-1, large LOCA, medium LOCA, small LOCA, SG tube rupture (SGTR),

reactor coolant pump (RCP) seal LOCA, and inadvertent opening of a safety relief valve for ANO-2.

A basic events (BE) report was created from the TRME model that was developed. Basic events that are not directly related to equipment, such as common cause failures, testing/

maintenance, flags, pre-initiators, and probability events, were removed from the HWEL.

Because SSCs located in Category I structures have the potential to be struck by tornado-generated missiles entering the structure through openings in the exterior, only SSCs that are located below grade (EL. 354-0) in Category I structures are screened

Enclosure to 0CAN041904 Page 23 of 47 out. It is assumed that rooms located below grade in Category I structures do not have penetrations that result in missile vulnerabilities. In addition, all SSCs located within the reactor building are screened from the HWEL. The random failure probabilities for the SSCs that were screened out were retained.

Components that require offsite power which are explicitly modeled in the PRA were screened from the HWEL. Piping and instrumentation drawings were reviewed for each mechanical SSC that was not screened out to locate support system SSCs and those within the system flow path that should be added to the HWEL. While SSCs that are located below the 354-foot elevation and those located in the reactor building are considered protected from tornado missiles, electrical or control cables that support these SSCs that could be affected by tornado-generated missiles are included in the HWEL.

SSCs located outside Class I structures that can be impacted directly by the high wind hazard or wind-borne missiles and may lead to failure of PRA equipment, were retained in the initial HWEL.

Operator actions were assessed based on the NEI 17-02 methodology. Internal events PRA data was used to perform the assessment of operator actions.

Operator interviews for the credited operator actions were performed during the development of the internal events model which the TMRE model is based on. In addition, an SRO was interviewed during TMRE development for insights related to tornado events.

ANO-1 The main insights were that the auxiliary operators would take shelter in safe areas, if possible, in Seismic Class 1 structures, and that operators have multiple paths in the Turbine Building (TB) by which access may be gained to the Auxiliary Building and to areas where ex-control room actions may be required. However, high priority actions at the diesel fuel storage building (DSB) to ensure a fuel supply to the EDGs are required. While there are two pathways to the DSB, the normal access may be damaged or blocked as a result of tornado debris and the secondary access requires support from security to access. Therefore, these actions are assumed to fail following a high wind event.

Access to the Main Steam Isolation Valve area is also limited from either an unprotected building or outdoors. If a gag were needed on a Main Steam Safety Valve, the feasibility of the action, as well as the accessibility of the area, are challenged in the high winds event; therefore, the action is assumed to fail following a high wind event.

Other actions are located in the Auxiliary Building which may be accessed via multiple pathways. Therefore, any impact on the failure probability of long-term operator actions within the Auxiliary Building by the effects of a tornado impacting ANO-1 is negligible.

Enclosure to 0CAN041904 Page 24 of 47 ANO-2 The main insights were that the auxiliary operators would take shelter in safe areas, if possible, in Seismic Class 1 structures, and that operators have multiple paths in the TB by which access may be gained to the Auxiliary Building and to areas where ex-control room actions may be required. In addition, for those areas that may have limited access, sufficient time exists before performance of the task would be needed. Considering the multi-access paths and timing of the needed actions, an operator is able to perform needed tasks with negligible impact.

3.3.2 Target Walkdowns Using the guidance contained in NEI 17-02, the scope of the walkdowns considered the following, as applicable:

Location and identification of the SSC to verify that the SSC is located as documented.

Support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers were also noted.

Barriers that could prevent or limit exposure of the SSC to tornado missiles were documented. This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

Horizontal and/or vertical directions from which tornado-generated missiles could strike the target.

Dimensions of the target SSCs, including any subcomponents or support systems, were verified and documented. Missile paths may limit target areas when missiles are blocked by barriers.

Proximity and potential correlation to other target SSCs were determined. Correlated targets are SSCs that can be struck by the same tornado missile.

Nearby large inventories of potential tornado missiles were noted.

Proximity of non-Class I structures to exposed target SSCs were documented. A non-Class I structure may collapse or tip-over and cause damage to an SSC.

Vent paths for tanks that may be exposed to atmospheric pressure changes were identified.

Because of the large, open nature of the ANO buildings in conjunction with the limited capacity of potential flood sources that could affect non-conforming SSCs, no additional flooding effects not already included in the direct effects of missile impacts would be expected.

The potential for the ANO-2 diesel exhaust stacks to be perforated and impair the ability of running diesels was examined. Given the 30-foot distance between the ANO-2 diesel exhaust and intake along with the vertical distance and buoyancy of the hot exhaust gas, it is considered incredible that failure of one diesel exhaust stack would impact the opposite train diesel intake.

Enclosure to 0CAN041904 Page 25 of 47 3.3.3 Missile Walkdowns The missile walkdown was performed in accordance with Section 3.4 of NEI 17-02. Personnel who performed the tornado missile walkdown were familiar with this section of NEI 17-02 as well as Section 4.3 of EPRI 3002008092, "Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants."

The walkdown area is defined by a 2500 feet radius from the center point between the two reactor buildings. To support the walkdowns the plant was divided into 38 zones. The potential missiles for each zone were determined.

Consistent with the guidance provided in NEI 17-02, Revision 1B, additional outage missiles were not considered as part of the TMRE walkdown. Not explicitly considering outage-related missiles is an acceptable approach as outage durations are short and at multi-unit sites such as ANO, the outages are staggered such that only one unit is in an outage at a time.

Additionally, scaffolding parts/accessories provide the majority of additional missiles during an outage. These scaffolding pieces are normally stored onsite and are already included in the missile count from a different plant area. Other equipment (machinery, trailers, and vehicles) will result in a small percentage increase as compared to the missile count of 240,000 that was used in the TMRE analyses. The total missile count at ANO is 196,498. Since this is bounded by the generic value of 240,000 provided in NEI 17-02, Revision 1, the missile count of 240,000 was conservatively utilized in calculating EEFPs. Any additional outage missiles at ANO which are not already included in the count for another area are expected to be bounded by the generic missile count of 240,000. The missile count is summarized in Table 3.

Table 3 TMRE Tornado Missile Count Summary Zone Total Number of Zonal Missiles (Trees, NonStructural and Structural) 1 199 2

242 3

2,218 4

25,595 5

131 6

208 7

1,693 8

431 9

7,438 10 10,551 11 449 12 3,534 13 7,610

Enclosure to 0CAN041904 Page 26 of 47 Zone Total Number of Zonal Missiles (Trees, NonStructural and Structural) 14 7,242 15 4,606 16 3,243 17 617 18 17,662 19 1,608 20 1,560 21 16,806 22 15,753 23 4,617 24 50 25 856 26 347 27 292 28 489 29 2,531 30 2,416 31 5,927 32 4,262 33 11,201 34 222 35 1,632 36 5,614 37 164 38 23,393 Fencing 3,089 Total Number of Missiles on Site (Trees, NonStructural and Structural) 196,498 3.3.4 Tornado Hazard Frequency The guidance in NEI 17-02, Revision 1 and NUREG/CR-4461, "Tornado Climatology of the Contiguous United States" (Reference 10), was used to determine the tornado initiating events for ANO. The result was site-specific tornado frequencies for each relevant tornado category.

NUREG/CR-4461 tornado strike data for ANO is provided with wind speeds associated with varying frequencies per year. NUREG/CR-4461 does not provide values for F-scale (Fujita prime); therefore, F probabilities were derived from the site-specific Fujita scale data. The

Enclosure to 0CAN041904 Page 27 of 47 Fujita Scale Data from NUREG/CR-4461 was used as opposed to the Enhanced Fujita Scale data which results in higher and, therefore, more conservative strike frequencies. From this data, a site-specific tornado frequency curve (hazard curve) was developed, and the frequency of tornadoes considered in the TMRE (F2 through F6) was calculated.

The tornado initiating event frequencies were determined using the methodology described in NEI 17-02, Revision 1. The F-scale wind speed estimates for tornados of frequency 1.00E-05/yr, 1.00E-06/yr, and 1.00E-07/yr were determined from a review of NUREG/CR-4461 (Reference 10). A trend line was established and the resulting equation was used to calculate a frequency for tornado wind speeds from 40 mph to 300 mph.

Using the F-scale tornado intensity mph ranges, exceedance frequencies were determined for each tornado intensity F2 through F6. Subsequently, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequency.

The method used and described above is in accordance with the revised guidance in NEI 17-02, Revision 1B, Sections 4.3 through 4.6.

Using the trend line equation, exceedance probabilities for the upper ranges of each F category, F2 through F6, was calculated resulting in the following tornado initiating event frequencies.

Table 4 ANO Plant Specific Initiating Event Frequency Fujita Prime Frequency Per Year F2 6.69-04 F3 1.53E-04 F4 3.58E-05 F5 5.98E-06 F6 2.64E-07 3.3.5 Target Evaluation The failure probability of vulnerable SSCs is calculated using the EEFP methodology documented in NEI 17-02, Revision 1B (Reference 3). In accordance with NEI 17-02, Section 5.0 (Reference 3), for every applicable SSC, five (5) EEFP values will be calculated, one each for tornado categories F2 through F6.

The list of potentially vulnerable targets to tornado missiles that are modeled in the PRA are identified and characterized. These targets have been added to the TMRE model. The failure probability of the targets is calculated using the EEFP. The EEFP is the conditional probability that an exposed target is hit and failed by a tornado missile, given a tornado of a certain magnitude. For a single target, five EEFP values were calculated; one each for tornado categories F2 through F6.

Enclosure to 0CAN041904 Page 28 of 47 The EEFP can be calculated using the following equation:

EEFP = (MIP) x (Number of Missiles) x (Target Exposed Area) x Fragility Where:

Missile Impact Parameters (MIP) is the probability of a tornado missile hit on a target, per target square area, per missile, per tornado. Generic MIP values are provided in Table 5-1 of NEI 17-02 (Reference 3).

Number of Missiles is the number of damaging missiles. The generic values recommended in Table 5-1 and 5-2 of NEI 17-02 (Reference 3) are used.

Target Exposed Area is determined for each specific target.

Fragility is the conditional probability of the target failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0.

The generic missile count of 240,000 was conservatively utilized in estimating EEFPs. Table 5 provides the number of missiles for tornado categories F2 through F`6 based on missile of 240,000 with number of missiles increasing from F2 to F6.

The calculation of the EEFPs results for the non-conforming SSCs is provided in Table 6 (ANO-1) and Table 7 (ANO-2).

Table 5 Number of Missiles for EEFP Calculation (Common to Both Units)

Tornado Category Number of Missiles based on Missile Count of 240,000 F2 155,000 F3 155,000 F4 205,000 F5 240,000 F6 240,000

Enclosure to 0CAN041904 Page 29 of 47 Table 6 ANO-1 Summary of EEFPs Based on Tornado Category (Non-Conforming SSCs)

Target Description Area (Sq. ft.)

Elev.

>30 Robust Description Robust Missile %

Missile Count Intensity Scale MIP EEFP Base EEFP Compliant Fire Damper Openings F2-0141-02-011 F2-0135-02-0009 F2-0135-02-0022 (128-A)

(CR-ANO-1-2016-2752) 1175.21 (Base) 1168.68 (Compliant)

Y Non-Robust Category J 100%

155000 F2 5.80E-11 1.06E-02 1.05E-02 100%

155000 F3 2.00E-10 3.64E-02 3.62E-02 100%

205000 F4 3.40E-10 8.19E-02 8.15E-02 100%

240000 F5 8.70E-10 2.45E-01 2.44E-01 100%

240000 F6 1.30E-09 3.67E-01 3.65E-01 Conduits and Cable Trays (73-A)

(CR-ANO-1-2017-1171) 27.0 N

Non-Robust Category J 100%

155000 F2 1.40E-10 5.86E-04 0

100%

155000 F3 4.60E-10 1.93E-03 0

100%

205000 F4 7.90E-10 4.37E-03 0

100%

240000 F5 2.00E-09 1.30E-02 0

100%

240000 F6 3.10E-09 2.01E-02 0

Conduits and Cable Trays (73-B)

(CR-ANO-1-2017-1171) 9.0 N

Non-Robust Category J 100%

155000 F2 1.40E-10 1.95E-04 0

100%

155000 F3 4.60E-10 6.42E-04 0

100%

205000 F4 7.90E-10 1.46E-03 0

100%

240000 F5 2.00E-09 4.32E-03 0

100%

240000 F6 3.10E-09 6.70E-03 0

Conduits and Cable Trays (73-C)

(CR-ANO-1-2017-1171) 15.39 N

Non-Robust Category J 100%

155000 F2 1.40E-10 3.34E.04 0

100%

155000 F3 4.60E-10 1.10E-03 0

100%

205000 F4 7.90E-10 2.49E-03 0

100%

240000 F5 2.00E-09 7.39E-03 0

100%

240000 F6 3.10E-09 1.15E-02 0

Conduits and Cable Trays (73-D)

(CR-ANO-1-2017-1171) 40.50 N

Non-Robust Category J 100%

155000 F2 1.40E-10 8.79E-04 0

100%

155000 F3 4.60E-10 2.89E-03 0

100%

205000 F4 7.90E-10 6.56E-03 0

100%

240000 F5 2.00E-09 1.94E-02 0

100%

240000 F6 3.10E-09 3.01E-02 0

Blockout FB-103-4-0008 (104-EL)

(CR-ANO-1-2017-1171) 29.87 (Base) 21.75 (Compliant)

N Non-Robust Category J 100%

155000 F2 1.40E-10 6.48E-04 4.72E-04 100%

155000 F3 4.60E-10 2.13E-03 1.55E-03 100%

205000 F4 7.90E-10 4.84E-03 3.52E-03 100%

240000 F5 2.00E-09 1.43E-02 1.04E-02 100%

240000 F6 3.10E-09 2.22E-02 1.62E-02 EFW Steam Piping (170-EFW)

(CR-ANO-1-2015-3940) 81.03 Y

Robust Category F 50%

77500 F2 5.80E-11 3.64E-04 0

50%

77500 F3 2.00E-10 1.26E-03 0

50%

102500 F4 3.40E-10 2.82E-03 0

50%

120000 F5 8.70E-10 8.46E-03 0

50%

120000 F6 1.30E-9 1.26E-02 0

F - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3))

J - Not Robust Failure mode N/A (NEI 17-02, Table B-13 (Reference 3))

Enclosure to 0CAN041904 Page 30 of 47 Table 7 ANO-2 Summary of EEFPs Based on Tornado Category (Non-Conforming SSCs)

Target Description Area (Sq. ft.)

Elev.

>30 Robust Description Robust Missile %

Missile Count Intensity Scale MIP EEFP Base EEFP Compliant Conduit EC1373 in Room 2136 (CR-ANO-2-2017-1555) 10.8 Y

Non-Robust Category J 100%

155000 F2 5.80E-11 9.74E-05 0

100%

155000 F3 2.00E-10 3.36E-04 0

100%

205000 F4 3.40E-10 7.55E-04 0

100%

240000 F5 8.70E-10 2.26E-03 0

100%

240000 F6 1.30E-09 3.38E-03 0

Steam Supply to EFW from Main Steam Header #1 (2155-EFW-1)

(CR-ANO-2-2015-4851) 34.9 Y

Robust Category F 50%

77500 F2 5.80E-11 1.57E-04 0

50%

77500 F3 2.00E-10 5.41E-04 0

50%

102500 F4 3.40E-10 1.22E-03 0

50%

120000 F5 8.70E-10 3.65E-03 0

50%

120000 F6 1.30E-09 5.45E-03 0

Steam Supply to EFW from Main Steam Header #1 (2155-EFW-2)

(CR-ANO-2-2015-4851) 55.7 Y

Robust Category F 50%

77500 F2 5.80E-11 2.50E-04 0

50%

77500 F3 2.00E-10 8.64E-04 0

50%

102500 F4 3.40E-10 1.94E-03 0

50%

120000 F5 8.70E-10 5.82E-03 0

50%

120000 F6 1.30E-09 8.69E-03 0

Common EFW Steam Supply Piping (2155-EFW-3)

(CR-ANO-2-2015-4851) 27.0 Y

Robust Category F 50%

77500 F2 5.80E-11 1.21E-04 0

50%

77500 F3 2.00E-10 4.18E-04 0

50%

102500 F4 3.40E-10 9.39E-04 0

50%

120000 F5 8.70E-10 2.81E-03 0

50%

120000 F6 1.30E-09 4.20E-03 0

2K-4A Exhaust Stack (2K-4A Exhaust)

(CR-ANO-C-2018-02230) 244.46 Y

Robust Category E 35%

54250 F2 5.80E-11 7.69E-04 0

35%

54250 F3 2.00E-10 2.65E-03 0

35%

71750 F4 3.40E-10 5.96E-03 0

35%

84000 F5 8.70E-10 1.79E-02 0

35%

84000 F6 1.30E-09 2.67E-02 0

2K-4B Exhaust Stack (2K-4B Exhaust)

(CR-ANO-C-2018-02230) 244.46 Y

Robust Category E 35%

54250 F2 5.80E-11 7.69E-04 0

35%

54250 F3 2.00E-10 2.65E-03 0

35%

71750 F4 3.40E-10 5.96E-03 0

35%

84000 F5 8.70E-10 1.79E-02 0

35%

84000 F6 1.30E-09 2.67E-02 0

E - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3))

F - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3))

J - Not Robust Failure mode N/A (NEI 17-02, Table B-13 (Reference 3))

Enclosure to 0CAN041904 Page 31 of 47 3.3.6 Model Development The TMRE model was developed using the current unit specific internal events models. The method described below was used for model development for both ANO-1 and ANO-2.

The first step in developing a TMRE model is the establishment of the accident sequence logic that is reasonably expected to represent the tornado initiating events in the TMRE PRA. Since one of the basic assumptions of the TMRE method is that a tornado event that creates tornado missiles will, at a minimum, cause a LOOP and reactor trip, the transient event sequence logic initiated by a LOOP event (%TSW (ANO-1) / %T3 (ANO-2)) is considered the most representative logic for TMRE. The remaining initiating events were reviewed to confirm that a tornado could not cause the initiating event or the impact of the initiating event is represented in the %T3SW / %T3 initiated transient sequence logic. It was determined that the LOOP accident sequence adequately represents the plant response to the tornado.

The second step in developing the TMRE model was eliminating the unnecessary logic associated with the non-representative initiating events. The fault trees developed include only one initiator, Loss of Offsite Power (%T3SW / %T3).

Post initiator human failure events (HFEs) (i.e., operator actions) were screened based on NEI 17-02 guidance as the third step in the TMRE model development process. As described in the unit specific Human Reliability Analysis (HRA) for the TMRE PRA Model, HFEs performed in non-Category 1 structures and within one hour of the tornado strike are assumed to be failed (TRUE).

Step four in TMRE model development included the addition of failures of SSCs that can be struck and damaged by a tornado missile as new BEs in the TRME PRA fault tree. This was performed using the FRANX software to associate the BEs affected to the failure of the equipment in each correlation group within each room or area.

For each potentially vulnerable SSC identified in the EEFP, a BE for each of the tornado-induced failures identified was added to the fault tree logic using the FRANX software. The tornado-induced failure events were added under an OR gate along with the existing basic event representing random failure of the SSC.

3.3.7 Model Quantification Results The TMRE model was quantified with tornado hazard frequencies identified in Table 4. The CDF is truncated at 1E-12/yr for ANO-1 and 1E-11 for ANO-2 and the LERF is truncated at 1E-11/yr for ANO-1 and 1E-13 for ANO-2.

The CDF and LERF for the degraded and compliant cases are in Table 8 (ANO-1) and Table 9 (ANO-2).

Table 8 ANO-1 Quantification Results CDF / year LERF / year Degraded 9.78E-06 2.46E-06 Compliant 9.19E-06 2.41E-06 Delta 5.9E-07 5.1E-08

Enclosure to 0CAN041904 Page 32 of 47 Table 9 ANO-2 Quantification Results CDF / year LERF / year Degraded 1.12E-05 6.24E-07 Compliant 1.11E-05 6.18E-07 Delta 1.0E-07 6.0E-09 Per RG 1.174 (Reference 11), a risk-informed amendment request includes an evaluation of the change in risk (e.g., CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations: The Compliant Case (configuration with the plant built per the required design/licensing bases) and the Degraded Case (current plant configuration, including potential non-conformances for tornado missile protection).

The CDF and LERF are simply calculated as follows:

CDF = CDFDegraded - CDFCompliant LERF = LERFDegraded - LERFCompliant The TMRE results for ANO-1 are 5.9E-07 per year CDF and 5.1E-08 per year LERF.

The TMRE results for ANO-2 are 1.0E-07 per year CDF and 6.0E-9 per year LERF.

3.3.8 Tornado Intensity Contribution The ANO-1 tornado initiating event contribution is provided in Table 10 for the degraded and compliant model result.

Table 10 ANO-1 Tornado Initiating Event CDF and LERF Contribution Initiating Event CDF Contribution

% CDF Contribution CDF Contribution

% CDF Contribution Initiator Description Compliant Degraded

%A1-T-F2 4.20E-06 45.65%

4.38E-06 44.79%

F2 tornado

%A1-T-F3 2.51E-06 27.28%

2.68E-06 27.41%

F3 tornado

%A1-T-F4 1.39E-06 15.11%

1.50E-06 15.34%

F4 tornado

%A1-T-F5 1.02E-06 11.09%

1.13E-06 11.56%

F5 tornado

%A1-T-F6 7.96E-08 0.87%

8.88E-08 0.91%

F6 tornado

Enclosure to 0CAN041904 Page 33 of 47 Initiating Event LERF Contribution

% LERF Contribution LERF Contribution

% LERF Contribution Initiator Description Compliant Degraded

%A1-T-F2 9.54E-07 39.56%

9.62E-07 39.07%

F2 tornado

%A1-T-F3 7.28E-07 30.19%

7.39E-07 30.01%

F3 tornado

%A1-T-F4 4.16E-07 17.25%

4.27E-07 17.34%

F4 tornado

%A1-T-F5 2.89E-07 11.99%

3.08E-07 12.51%

F5 tornado

%A1-T-F6 2.43E-08 1.01%

2.62E-08 1.06%

F6 tornado The ANO-2 tornado initiating event contribution is provided in Table 11 for the degraded and compliant model result.

Table 11 ANO-2 Initiating Event CDF and LERF Contribution Initiating Event CDF Frequency

% CDF Contribution CDF Frequency

% CDF Contribution Initiator Description Compliant Degraded

%A2-T-F2 6.82E-06 61.69%

6.90E-06 61.48%

F2 tornado

%A2-T-F3 3.21E-06 29.03%

3.27E-06 29.14%

F3 tornado

%A2-T-F4 1.63E-07 1.47%

1.66E-07 1.48%

F4 tornado

%A2-T-F5 8.10E-07 7.33%

8.32E-07 7.41%

F5 tornado

%A2-T-F6 5.27E-08 0.48%

5.43E-08 0.48%

F6 tornado Initiating Event LERF Frequency

% LERF Contribution LERF Frequency

% LERF Contribution Initiator Description Compliant Degraded

%A2-T-F2 3.38E-07 54.67%

3.40E-07 54.44%

F2 Tornado

%A2-T-F3 1.99E-07 32.19%

2.02E-07 32.35%

F3 Tornado

%A2-T-F4 1.13E-08 1.83%

1.14E-08 1.83%

F4 Tornado

%A2-T-F5 6.54E-08 10.58%

6.65E-08 10.65%

F5 Tornado

%A2-T-F6 4.51E-09 0.73%

4.59E-09 0.73%

F6 Tornado 3.3.9 Sensitivities ANO-1 Section 7 of NEI 17-02 identifies two generic sensitivity studies that should be performed and documented. The first is relevant if the CDF or LERF between the compliant and the degraded case exceed 1.0E-7/yr or 1.0E-8/yr, respectively. As indicated above, the risk increase associated with not providing missile protection to preclude damage to non-conforming SSCs is 5.9E-07/yr CDF and 5.1E-08/yr LERF, which meets this criterion. Therefore, the TMRE Missile Distribution Sensitivity identified in Section 7.2.1 of NEI 17-02, Revision 1B, was

Enclosure to 0CAN041904 Page 34 of 47 performed. In addition, the sensitivity for compliant case conservatism described in NEI 17-02, Revision 1B, Section 7.2.2, was performed. Three additional sensitivities were performed as described below.

ANO-1 TMRE Missile Distribution Sensitivity This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to the missile distribution at the licensees site, as compared to the missile distribution for the EPRI NP-768 Plant A simulations.

As described in Section 7.2.1 of NEI 17-02, this sensitivity analysis only applies to tornado missile BEs for tornado categories F4, F5, and F6. BEs for F2 and F3 tornado missile failures are not considered in this sensitivity. The sensitivity was performed by first identifying the SSCs with a tornado missile failure BE risk achievement worth (RAW) > 2 for tornado categories F4, F5, and F6. In order to determine the target BE RAWs, the F4, F5, and F6 RAWs are combined using the following equation:

RAWTotal = 1 + (RAWF4 - 1) + (RAWF5 - 1) + (RAWF6 - 1)

As described in Section 7.2.1 of NEI 17-02, the MIP sensitivity is performed for highly exposed SSCs with tornado missile failure BE RAWs > 2. Highly exposed SSCs are defined as:

Located outside of a Category I structure Not protected from horizontal missiles Having an elevation less than 30 above grade Also as described in Section 7.2.1 of the NEI 17-02, a greater multiplier may be required for highly exposed SSCs. The missile distribution for highly exposed SSCs was determined as part of additional walkdowns and the multipliers are determined. The MIP multipliers and calculated EEFPs for the highly exposed SSCs are included in the EEFP report.

The BE failure probabilities for events with RAW greater than two were multiplied by 2.75.

A missile distribution sensitivity is performed for highly exposed SSCs. Based on the missile inventory walkdown report, the number of missiles near the highly exposed SSCs are counted.

A multiplier is applied to the MIP values for those highly exposed SSCs depending on the number of missiles near the SSC. The BE failure probabilities for highly exposed SSCs are taken from the EEFP report. CDF and LERF were recalculated. The sensitivity results are presented below. The sensitivity shows that the CDF and LERF would be approximately 70%

and 90% higher, respectively, if a uniform missile distribution had been used, rather than the zonal distribution recommended in NEI 17-02 and used in the base analysis. Also, the CDF would be approximately 124% higher, and the LERF would be approximately 430% higher.

ANO-1 TMRE Missile Distribution Sensitivity Results CDF (/yr)

LERF (/yr)

Degraded 1.56E-05 4.52E-06 Compliant 1.69E-05 4.79E-06 Delta 1.30E-06 2.70E-07

Enclosure to 0CAN041904 Page 35 of 47 Although the results of these sensitivity cases are slightly above the Region III guidelines of RG 1.174, the increase is dominated by conservative assumptions in the modeling. Specifically, for vulnerabilities affected by the sensitivity, it is assumed that a single missile could fail all SSCs in an impacted area. That assumption was made to simplify evaluation of cable routing which would be very labor intensive. It is expected that a detailed evaluation of the cable routing would allow fewer correlated failures and, as a result, a lower risk increase. These results would be similar to the single event cutset sensitivity discussed below.

ANO-1 Compliant Case Sensitivity The second sensitivity recommended by NEI 17-02 is the compliant case sensitivity. This sensitivity evaluates the impact of conservative assumptions in the compliant case that could impact the results. Specifically, this sensitivity is added to ensure that conservatisms in the compliant case do not mask changes in risk for non-conformances.

As described in Section 7.2.2 of NEI 17-02, the top 90% cutsets of the compliant case are reviewed for potential conservatisms. All TMRE BEs that are in the top 90% are identified as potentially over conservative due to the inherent conservatism built into the NEI 17-02 process as well as simplifying assumptions made as part of EEFP calculations. To evaluate the impact of the compliant case conservatism, the compliant TMRE BEs are removed from both the degraded and compliant case, and the CDF and LERF are recalculated. This is done by modifying the recovery rule file, which sets these compliant TMRE BEs to false. The sensitivity shows that the CDF would be 38% lower if all compliant vulnerabilities were removed from the TMRE model. Also, the LERF would be 79% lower if all compliant vulnerabilities were removed. The CDF and LERF are within the acceptance criteria in this sensitivity.

ANO-1 Compliant Case Sensitivity Results CDF (/yr)

LERF (/yr)

Degraded 2.47E-06 8.70E-08 Compliant 2.11E-06 7.64E-08 Delta 3.6E-07 1.1E-08 ANO-1 Plant Grade Sensitivity In order to evaluate the uncertainty in the missile impact parameter between near ground and elevated targets, an additional sensitivity is performed using the near grade MIP value for all vulnerable targets. The EEFPs for this sensitivity are calculated in the EEFP report.

The sensitivity shows that the CDF and LERF would be approximately 60% higher, if all targets had been considered near ground, rather than elevated, as used in the base analysis. Also, the CDF would be approximately 55% higher, and the LERF would be approximately 195%

higher. Despite the increase, the CDF and LERF are still well within the acceptance criteria in this sensitivity.

Enclosure to 0CAN041904 Page 36 of 47 ANO-1 Plant Grade Sensitivity Results CDF (/yr)

LERF (/yr)

Degraded 1.55E-05 3.94E-06 Compliant 1.46E-05 3.79E-06 Delta 9.0E-07 1.5E-07 ANO-1 Single Event Cutset Sensitivity The base CDF cutset results contain several single order cutsets (i.e. initiating event and one BE). The most important of the events include tornado failures for the Room 129 (Control Room), Room 98 (Corridor) and Room 97 (Cable Spreading Room). This sensitivity evaluates the uncertainty that a single missile strike may not damage enough equipment in those rooms to result in core damage.

This sensitivity assumes implementation of a modification that will ensure availability of a protected train when missiles fail equipment in rooms 129, 98, and 97. The sensitivity was performed by adding a BE representing a modification for each room to cutsets containing the rooms tornado failures (failure probability = 0.1). The sensitivity shows that the CDF would be approximately 40% lower and the LERF would be approximately 90% lower if the plant was modified to ensure availability of a protected train when missiles fail equipment in rooms 129, 98, and 97. Also, the CDF results are approximately 4% higher and LERF is approximately 19% lower.

ANO-1Single Event Cutset Sensitivity Results CDF (/yr)

LERF (/yr)

Degraded 6.03E-06 7.33E-07 Compliant 5.43E-06 7.74E-07 Delta 6E-07 4.1E-08 ANO-1 HFE Sensitivity This sensitivity evaluates the potential impact of operator actions that occur more than one hour after the tornado and require transit outside Category 1 structures. All HFEs except (EDG-HFC-FO-DG1FO, EDG-HFC-FO-DG2FO, EDG-HFC-FO-DGFO2, EDG-HFC-FO-FOASX, and PCS-HFC-FO-MSGAG) were removed from the base model. A sensitivity is performed assuming that these long-term (greater than one-hour) events also fail. The HFEs were removed from the fault tree model using the flag file, A1 TMRE HRA Flags.caf, from the TMRE HRA report.

These longer-term actions (greater than one hour) human error probabilities were not impacted by the tornado event; CDF and LERF were the same as the base scenario.

Enclosure to 0CAN041904 Page 37 of 47 ANO-2 NEI 17-02 identifies two generic sensitivity studies that should be performed and documented.

The first is relevant if the CDF or LERF between the compliant and the degraded case exceed 1.0E-7/yr or 1.0E-8/yr, respectively. As indicated in the results above the CDF is equal to the criteria, so the sensitivities are performed for ANO-2. Two additional sensitivities were performed as described below.

ANO-2 TMRE Missile Distribution Sensitivity This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to the missile distribution at the licensees site, as compared to the missile distribution for the EPRI NP-768 Plant A simulations.

As described in Section 7 of NEI 17-02, this sensitivity analysis only applies to tornado missile BEs for tornado categories F4, F5, and F6. BEs for F2 and F3 tornado missile failures are not considered in this sensitivity. The sensitivity was performed by first identifying the SSCs with a tornado missile failure BE RAW > 2 for tornado categories F4, F5, and F6. In order to determine the target BE RAWs, the F4, F5, and F6 RAWs are combined using the following equation:

RAWTotal = 1 + (RAWF4 - 1) + (RAWF5 - 1) + (RAWF6 - 1)

As described in Section 7.2.1 of the NEI 17-02, a greater multiplier may be required for highly exposed SSCs. The missile distribution for highly exposed SSCs was determined as part of additional walkdowns, summarized in the Missile Inventory Report, and the multipliers are determined. The MIP multipliers and calculated EEFPs for the highly exposed SSCs are shown in the EEFP report.

The BE failure probabilities for BEs with RAWs greater than two were multiplied by 2.75. The BE failure probabilities for highly exposed SSCs are taken from the EEFP report. CDF and LERF were recalculated. The sensitivity results are presented below.

ANO-2 Results for TMRE Missile Distribution Sensitivity CDF (/yr)

LERF (/yr)

Degraded 1.27E-05 7.70E-07 Compliant 1.25E-05 7.59E-07 Delta 2.0E-07 1.1E-08 ANO-2 Compliant Case Sensitivity The second sensitivity recommended by NEI 17-02 is the compliant case sensitivity. This sensitivity evaluates the impact of conservative assumptions in the compliant case that could impact the results. Specifically, this sensitivity is added to ensure that conservatisms in the compliant case do not mask changes in risk for non-conformances.

Enclosure to 0CAN041904 Page 38 of 47 As described in Section 7.2.2 of NEI 17-02, the top 90% cutsets of the compliant case are reviewed for potential conservatisms. All TMRE BEs that are in the top 90% are identified as potentially over conservative due to the inherent conservatism built into the NEI 17-02 process as well as simplifying assumptions made as part of EEFP calculations. In order to evaluate the impact of the compliant case conservatism, the BEs representing failures of components that are compliant with missile protection are removed from both the degraded and compliant case, and the CDF and LERF are recalculated. This is done by modifying the recovery rule file, which sets these compliant TMRE BEs to false.

The sensitivity shows that the CDF would be 60% higher if all compliant vulnerabilities were removed from the TMRE model. Also, the LERF would be 17% lower if all compliant vulnerabilities were removed. The CDF and LERF are within the acceptance criteria in this sensitivity.

ANO-2 Results for Compliant Case Conservatism Sensitivity CDF (/yr)

LERF (/yr)

Degraded 4.89E-06 1.49E-07 Compliant 4.73E-06 1.44E-07 Delta 1.6E-07 5.0E-09 ANO-2 Plant Grade Sensitivity In order to evaluate the uncertainty in the missile impact parameter between near ground and elevated targets, an additional sensitivity is performed using the near grade MIP value for all vulnerable targets. The EEFPs for this sensitivity are calculated in the EEFP report. The sensitivity is performed by replacing the EEFP values for each tornado missile BE with the values provided in the EEFP report.

The sensitivity shows that the CDF and LERF would be approximately 20% and 30% higher, respectively if all targets had been considered near ground, rather than elevated, as used in the base analysis. Also, the CDF would be approximately 300% higher, and the LERF would be approximately 1000% higher. Regardless, the CDF and LERF remain well within the acceptance criteria in this sensitivity.

ANO-2 Results for Plant Grade Sensitivity CDF (/yr)

LERF (/yr)

Degraded 1.34E-05 8.10E-07 Compliant 1.30E-05 7.49E-07 Delta 4.0E-07 6.1E-08

Enclosure to 0CAN041904 Page 39 of 47 ANO-2 Single Event Cutset Sensitivity The base Level 1 cutset results contain several single order cutsets (i.e., initiating event and one BE). The most important of the events include tornado failures for the Cable Spreading Room on El. 372 (Room 2098), the Health Physics Corridor (Room 2122), U2 Control Room (Room 2118), and the part of Electrical Raceway Room 2104 above El. 376-10. This sensitivity evaluates the uncertainty that a single missile strike may not damage enough equipment in those rooms to result in core damage.

The sensitivity CDF frequencies are approximately 40% lower than the base results and the CDF is approximately 70% higher than the base. The sensitivity LERF results are approximately 55% lower than the base results and the LERF is identical to the base case.

ANO-2 Single Order Cutset Sensitivity Results CDF (/yr)

LERF (/yr)

Compliant 6.58E-06 2.74E-07 Degraded 6.75E-06 2.80E-07 Delta 1.7E-07 6.0E-09 ANO-2 HFE Sensitivity This sensitivity was not performed for ANO-2 because ANO-2 did not credit any operator actions outside of Category I buildings that occur more than one hour after the tornado.

3.3.10 Conclusions The TMRE guidance provided in NEI 17-02 was followed without exception and no deviations were applied.

The total change in risk associated with tornado missile damage to ANO-1 non-conforming conditions identified in Section 3.3.7, Model Quantification Results, is a risk increase of 5.9E-07 per year CDF and 5.1E-08 per year LERF. The tornado risk change for accepting ANO-1 non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

The total change in risk associated with tornado missile damage to ANO-2 non-conforming conditions identified in Section 3.3.7, Model Quantification Results, is a risk increase of 1.0E-07 per year CDF and 6.0E-09 per year LERF. The tornado risk change for accepting ANO-2 non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

3.4 Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at ANO for certain SSCs that are not fully protected from the effects of tornado missiles. The proposed change would revise the ANO-1 and ANO-2 SARs to make TMRE part of the unit specific licensing basis for conformance to 10 CFR 50, GDC 2 and 4. Future discovery of existing tornado missile

Enclosure to 0CAN041904 Page 40 of 47 protection non-conforming conditions will continue to be evaluated using the corrective action program. The TMRE methodology could be used to resolve those non-conforming conditions by revising the CLB under 10 CFR 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met. Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE methodology. The TMRE guidance, provided in NEI 17-02, Revision 1B, was followed without exception and no deviations were applied.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria The NRC requires that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated missiles, so as not to adversely impact the health and safety of the public in accordance with the requirements of 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, "Design Bases for Protection against Natural Phenomena," and GDC 4, "Environmental and Dynamic Effects Design Bases."

In addition to the above, methods acceptable to the NRC to comply with the aforementioned regulations are described in Regulatory Guides (RG) 1.117, Tornado Design Classification, Revision 1, and NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP), Section 3.5.1.4, "Missiles Generated by Natural Phenomena," and Section 3.5.2, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," Revision 2, July 1981.

SRP Sections 3.5.1.4 and 3.5.2, contain the current acceptance criteria governing tornado missile protection. These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to RG 1.117, lists the types of SSCs that should be protected from design basis tornadoes. In addition to the physical design methods, SRP Section 3.5.1.4 permits the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.

To use this probabilistic criterion, the Nuclear Energy Institute (NEI) developed the Tornado Missile Risk Evaluator (TMRE) methodology, NEI 17-02, Revision 1, which was transmitted to the NRC staff in September 2017 (Reference 1). As part of the NRCs review of pilot plant applications using the TMRE methodology, Revisions 1A and 1B were submitted to the NRC (References 2 and 3). NEI 17-02 contains guidance for application of the methodology and the technical basis for its acceptability. This LAR requests NRC approval for use of the TMRE methodology in lieu of the deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of SRP Section 3.5.1.4.

This LAR utilizes a risk-informed change process consistent with the guidelines of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk Informed Decision on Plant-Specific Changes to the Licensing Basis." As discussed in RG 1.174, in implementing risk-informed decision-making, licensing basis changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering

Enclosure to 0CAN041904 Page 41 of 47 decisions (e.g., defense-in-depth). While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

The proposed change continues to meet the intent of 10 CFR 50, Appendix A, GDC 2 and 4.

Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) were not licensed to the 10 CFR 50, Appendix A, GDC and were licensed prior to the issuance of RG 1.117.

Both units were originally designed to comply with the 70 "Proposed General Design Criteria for Nuclear Power Plant Construction Permits," published in July 1967.

However, the ANO-1 and ANO-2 Safety Analysis Reports (SARs) provide a comparison with the Atomic Energy Commission (AEC) GDC published as Appendix A to 10 CFR 50 in 1971.

The licensing basis for Criterion 2 described in ANO-1 SAR, Section 1.4.2, states, in part:

Systems and components identified in Criterion I have been designed to performance standards that will enable the facility to withstand, without loss of capability to protect the public, the forces or effects that might be imposed by natural phenomena.

Additionally, combinations of severe loadings have been considered. The designs are based upon the most severe natural phenomena recorded for the site, with an appropriate safety margin to account for uncertainties in the historical data, or upon the most severe conditions that are susceptible to synthetic analyses.

ANO-1 meets the intent of draft GDC 4, "Environmental and Missile Design Basis," for tornado-generated missiles though structural design and physical location of components, which includes redundant train separation (reference SAR Section 1.4.4).

ANO-1 SAR Sections 2.3, 5.1, and 5.2 contain detailed information related to wind and tornado design characteristics.

The licensing basis for Criterion 2, described in ANO-2 SAR Section 3.1.1, states, in part:

Design bases for other natural phenomena are established in Sections 2.3, Meteorology; 2.4, Hydrologic Engineering; 3.3, Wind and Tornado Loadings; 3.4, Water Level (Flood) Design; and parts of 3.5, Missile Protection. The application and combination of these bases with accident related plant process conditions are discussed in Chapter 15. Each system description evaluates functional performance under the appropriate natural phenomena conditions.

ANO-2 meets the intent of GDC 4 through conservative design methods, segregated routing of piping, missile shield walls, and engineered hangers and pipe restraints, all of which are used to accommodate dynamic effects of postulated accidents. These same features as well as the strength of the auxiliary building, containment and intake structure protect the safety-related equipment from missiles which might be generated either within or outside the plant (reference SAR Section 3.1.1).

Enclosure to 0CAN041904 Page 42 of 47 ANO-2 SAR Sections 3.3 and 3.3.2 contain detailed information related to wind and tornado design characteristics.

The SSCs important to safety are designed either to withstand the effects of natural phenomena without loss of the capability to perform their safety functions, or are designed such that their response or failure will be in a safe condition. Those SSCs vital to the shutdown capability of the reactor are designed to withstand the maximum probable natural phenomena at the site, determined from recorded data for the site vicinity, with appropriate margin to account for uncertainties in historical data.

Appropriate combinations of structural loadings from normal, accident, and natural phenomena are considered in the plant design.

No exemptions are requested or required to implement this amendment request upon approval by the NRC. SRP Section 3.5.1.4 permits relaxation of deterministic criteria if it can be demonstrated that the frequency of damage to unprotected safety-related features is sufficiently small. RG 1.174 establishes criteria, approved by the NRC, to quantify the "sufficiently small" frequency of damage. Application of the TMRE methodology to the unprotected features at ANO-1 and ANO-2 demonstrates that the RG 1.174 criteria are met.

2.

The proposed change is consistent with a defense-in-depth philosophy.

This is discussed in Section 3.2 of this enclosure.

3.

The proposed change maintains sufficient safety margins.

This is discussed in Section 3.2 of this enclosure.

4.

When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

The NRCs policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

RG 1.174 provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments under 10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit. RG1.174 describes an acceptable method for the licensee and NRC staff to use in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

RG 1.174 also makes use of the NRCs Safety Goal Policy Statement. One key principle in risk-informed regulation is that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement.

The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of RG 1.174 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Enclosure to 0CAN041904 Page 43 of 47 Application of the TMRE methodology to the unprotected features at ANO demonstrates that the RG 1.174, Section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5.

The impact of the proposed change should be monitored using performance measurement strategies.

NEI 17-02, Section 8, describes post license amendment configuration change control.

Entergy Operations, Inc. (Entergy) Design Control programs that meet 10 CFR 50 Appendix B will ensure that subsequent configuration changes are evaluated for their impact on the TMRE risk basis for accepting identified nonconforming conditions.

Entergy has confirmed that sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program. Temporary additional missiles from construction activities have been addressed in the TMRE analysis. Permanent changes that increase the site missile burden within the 2500 feet missile radius established for TMRE shall be included in the TMRE analysis.

The process includes provisions for monitoring issues affecting the PRA model (e.g.,

due to changes in the plant, errors, or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files. The process also includes re-evaluating the tornado-missile risk of nonconforming SSCs previously calculated to ensure the continued validity of the results.

The risk evaluation supporting this change was performed using the ANO unit specific Internal Events model. RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or in the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decision-making for light-water reactors. Calculations ENTGANO169-RPT-012, "ANO-1 PRA Model Development and Quantification," and ENTGANO169-RPT-013, "Unit 2 PRA Model Development and Quantification," provide documentation that the PRA evaluation is of sufficient quality to support the proposed change (see Attachments 1 and 2 to this Enclosure).

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met.

4.2 Precedent This amendment request is based on the NRC-approved LAR for Vogtle Electric Generating Plant, Units 1 and 2 dated January 11, 2019 (ML18304A394), and LARs submitted by Shearon Harris Nuclear Power Plant, Unit 1 dated October 19, 2017 (ML17292B648), and by Grand Gulf Nuclear Station, Unit 1 dated November 3, 2017 (ML17307A440). These three plants were chosen as Pilot plants to facilitate NRC review of the application of the TMRE methodology.

Enclosure to 0CAN041904 Page 44 of 47 4.3 No Significant Hazards Consideration Analysis Entergy Operations, Inc. (Entergy) has evaluated the proposed changes to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration.

Entergy proposes a change to the Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) unit-specific Safety Analysis Reports (SARs). The change would permit the use of the Tornado Missile Risk Evaluator (TMRE) methodology to demonstrate that identified nonconforming structures, systems and components in each unit do not require protection from tornado-generated missiles.

Basis for no significant hazards consideration determination: As required by 10 CFR 50.91(a),

Entergy analysis of the issue of no significant hazards consideration is presented below:

1.

Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming structures, systems, and components (SSCs) on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment does not involve an increase in the probability of an accident previously evaluated. The relevant accident previously evaluated is a Design Basis tornado impacting the ANO site. The probability of a Design Basis tornado is driven by external factors and is not affected by the proposed amendment. There are no changes required to any of the previously evaluated accidents in the SAR.

The proposed amendment does not involve a significant increase in the consequences of a Design Basis tornado. TMRE is a risk-informed methodology for determining whether certain safety-related features that are currently not protected from tornado-generated missiles require such protection. The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis."

The TMRE calculations performed by Entergy meet the acceptance criteria of RG 1.174.

Therefore, this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Enclosure to 0CAN041904 Page 45 of 47

2.

Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming SSCs on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment involves no physical changes to the existing plants; therefore, no new malfunctions could create the possibility of a new or different kind of accident. The proposed amendment makes no changes to conditions external to the plants that could create the possibility of a new or different kind of accident. The proposed change does not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The existing unit-specific SAR accident analyses will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, this change does not create the possibility of a new or different kind of accident from an accident previously evaluated.

3.

Does the proposed change involve a significant reduction in a margin of safety?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming SSCs on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The change does not exceed or alter any controlling numerical value for a parameter established in the ANO-1 or ANO-2 SAR or elsewhere in the ANO unit-specific licensing basis related to design basis or safety limits. The change does not impact any unit specific accident analyses, and those analyses remain valid. The change does not reduce diversity or redundancy as required by regulation or credited in the unit-specific SAR. The change does not reduce defense-in-depth as described in the unit-specific SAR.

Therefore, this change does not involve a significant reduction in a margin of safety.

Based upon the reasoning presented above, Entergy concludes that the requested change involves no significant hazards consideration, as set forth in 10 CFR 50.92(c), Issuance of Amendment.

Enclosure to 0CAN041904 Page 46 of 47 4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR Part 20, and would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

6.0 REFERENCES

1.

NEI Technical Report 17-02, [Rev. 1], dated September 2017 (ML17268A033 and ML17268A036).

2.

NEI Technical Report 17-02 [Rev. 1A] (ML18207A876) included in Vogtle Electric Generating Plant - Unit 1 and 2 Tornado Missile Risk Evaluator SNC Response to NRC Request for Additional Information, dated July 26, 2018.

3.

NEI Technical Report 17-02 [Rev. 1B] (ML18262A328) included in Shearon Harris Nuclear Power Plant, Unit 1 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement and Request for Additional Information Response, dated September 19, 2018.

4.

NRC Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015 (ML15020A419).

5.

NRC memorandum, "Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," dated June 10, 2015 (ML15111A269).

6.

NRC memorandum, "Enforcement Guidance Memorandum 15-002, Revision 1:

Enforcement Discretion for Tornado-Generated Missile Protection Non-Compliance,"

dated February 7, 2017 (ML16355A286).

7.

Entergy letter to the NRC dated March 19. 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance memorandum 15-002 for Tornado-Generate Missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CAN031802) (ML18078B016).

Enclosure to 0CAN041904 Page 47 of 47

8.

NRC letter to Arkansas Nuclear One dated April 12, 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generated missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CNA041801)

(ML18094A739).

9.

NRC Interim Staff Guidance DSS-ISG-2016-01, Revision 1, "Clarification of Licensee Actions in Receipt of Enforcement Discretion Per Enforcement Guidance Memorandum EGM 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance,'" dated November 2017 (ML17128A344).

10.

NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2, US Nuclear Regulatory Commission, February 2007.

11.

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant Specific Changes to the Licensing Basis," Revision 3, January 2018 ATTACHMENTS

1.

Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

2.

Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

3.

ANOs Review of Pilot Plant RAIs

4.

Safety Analysis Report Page Markups

5.

Retyped Safety Analysis Report Pages

Enclosure Attachment 1 to 0CAN041904 Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

Enclosure Attachment 1 to 0CAN041904 Page 1 of 34 ANO-1 Technical Adequacy

1. Overview The purpose of this attachment is to document the technical adequacy of the Arkansas Nuclear One, Unit 1 (ANO-1) Probabilistic Risk Assessment (PRA) model to support use of the Tornado Missile Risk Evaluator (TMRE) for evaluation of tornado missiles. The attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for the Arkansas Nuclear One Unit 1(ANO-1) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard Reference 6.4 as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" (Reference 6.1), at an appropriate capability category to support the ANO-1 TMRE program. This enclosure provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

Section 2 addresses the need for the PRA model to represent the as-built, as-operated

plant, Section 3 discusses permanent plant changes that have an impact on those systems, structures, and components (SSCs) modeled in the PRA but have not been incorporated in the baseline PRA model.

Section 4 demonstrates that the ANO-1 PRA has been performed consistent with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Rev. 2. The peer review that has been conducted and the resolution of findings from those reviews are discussed in this section. The unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, Nuclear Energy Institute (NEI) 17-02 are also discussed in this section.

The conclusions on the technical adequacy of the ANO-1 PRA are provided in Section 5.

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2. Basis to Conclude that the PRA Model Represents the As-Built, As-Operated Plant The ANO-1 PRA models are controlled in accordance with Entergy procedure EN-DC-151 Reference 6.3) which is consistent with the requirements provided in the ASME/ANS PRA Standard. Entergy procedures and guidelines define the process to be followed to implement scheduled and interim PRA model updates and to control the PRA model files. In addition, the procedure also defines the process for identifying, tracking and implementing model changes, and for identifying and tracking model improvements or potential issues that may affect the model. Model changes that are identified are tracked via model change requests (MCRs),

which are entered in the Entergy MCR database.

Periodic PRA model updates are typically performed at least once every four years, with the option of extending the frequency for up to two years, such that the total update period does not exceed six years. Extensions are justified showing that the PRA model continues to adequately represent the as-built, as-operated plant and need to be approved by management.

Enclosure Attachment 1 to 0CAN041904 Page 2 of 34 The ANO-1 PRA model 5p01 was completed in 2016. The model follows the guidelines of RG 1.200 to demonstrate PRA technical adequacy. Sections 3 and 4 discuss the requirements in RG 1.200 to demonstrate PRA technical adequacy, as applicable to the current ANO-1 internal events model.

3. Identification of Permanent Plant Changes Not Incorporated in the PRA Model Per the Entergy Engineering Change Process (EN-DC-115), the responsible engineer for an Engineering Change (EC) notifies the PRA engineer if the EC potentially impacts the PRA model. The PRA engineer ensures that the potential PRA model change is entered into the MCR database. Potential model changes associated with ECs not yet implemented remain in the MCR database and are tracked until closure (i.e., cancelled, resolved, or implemented).

Per the Entergy PRA Maintenance and Update procedure (EN-DC-151), the responsible owner for an emergency operating procedure (EOP) change notifies the PRA engineer of a change, and the PRA engineer determines if the EOP change potential impacts the PRA model. If so, the PRA engineer ensures that the potential PRA model change is entered into the MCR database. During periodic PRA model updates, the PRA engineer performs a review of any other EOP changes as well as changes to Abnormal Operating Procedures (AOPs) and other operating procedures referenced in the PRA model to identify changes that may impact the model. An MCR is created for any change that may potentially impact the PRA model.

Therefore, the MCR database is used to capture and track plant changes that may potentially impact the PRA model, and can be used to identify such plant changes that are not yet implemented in the PRA model. Review of the MCR database for ANO-1 identified several plant changes not yet implemented which may potentially impact the PRA. These are listed in Table 11, along with a discussion of why the change does not impact the PRA results used to support the TMRE.

4. Conformance with ASME/ANS PRA Standard The following sections describe the conformance and capability of the ANO-1 PRA against the ASME/ANS PRA Standard.

4.1 Peer Review Facts and Observations (F&Os)

The ANO-1 PRA model has undergone several peer reviews and self-assessments which document the model quality and identify any areas with potential for improvement. The following assessments have been performed and documented for the ANO-1 model:

An industry peer review of the ANO-1 PSA model Revision 2p2 was conducted by the Babcock and Wilcox Owners Group in 2002 (Reference 6.5). The peer review concluded that there were several areas where the ANO-1 model needed improvement. The ANO-1 PSA model updates Rev 3p0 completed in August 2006 addressed the significant Finding-level F&Os from this peer review.

In preparation for ANO-1 to transition to the National Fire Protection Association (NFPA) 805 standard, a gap assessment of the ANO-1 PSA 3p0 internal events PRA model was completed in 2007 (Reference 6.6). The gaps impacting the fire PRA were closed to meet the NFPA transition schedule. The ANO-1 Internal Events PSA model was updated (Rev 4p0 finished in 2009) to meet the RG 1.200, Revision 1, standards.

Enclosure Attachment 1 to 0CAN041904 Page 3 of 34 A peer review of the Rev 4p02 ANO-1 PSA Model was performed in August 2009 and documented in Reference 6.2. This peer review documented eighty-six (86) new F&Os including forty-four (44) Findings and forty-one (41) Suggestions and. The conclusion of the review was that the ANO-1 PRA met the ASME PRA standard at Capability Category II or better for approximately 79% of the Standard SRs.

The ANO-1 internal events model revision 5p0 was completed in 2015 and follows the guidelines of RG 1.200, Rev. 2 (Reference 6.1). This is the current PRA model. The remaining open Findings related to the internal events PRA model are documented in the MCR database and are presented in Section 4.2.

4.2 Consistency with Applicable PRA Standards As discussed above the ANO-1 internal events PRA model was updated in 2015. Per Entergy procedure EN-DC-151, all Entergy PRA models are required to meet current industry standards for PRA model development and documentation. Specifically, the Entergy procedure requires to attempt to meet the ASME/ANS PRA standard (Reference 6.4) Capability Category II of all SRs. Current Entergy PRA documentation includes an individual self-assessment that documents how each high-level requirement (HLR) and SR are met.

The latest full-scope peer review for ANO-1 was conducted in July 2009 using RG 1.200 Rev 1.

Since then, model revision 5p0 was completed which ensured all the significant F&Os from the peer review were addressed properly. All the F&Os are captured and documented in the MCR database. A search of ANO-1 MCRs related to peer review F&Os was performed and 45 open MCRs were found. Seventeen (17) were Findings related to either the internal event or internal flooding models. Some of the F&O MCRs are resolved as part of the Revision 5p0 update, but have not been closed. Finding-level F&O MCRs that have not been resolved in the internal event model are listed in Table 10, along with the impact on the application for the internal events.

A summary of the assessment against each of the eight (internal flooding is not included) technical elements (i.e. high-level requirements,) of ASME/ANS RA-Sa-2009 is provided in Tables 1 through 8 of this attachment. Table 9 lists those SRs from the PRA Standard that have been identified in the TMRE Guidance Document as being applicable to the TMRE PRA.

A systematic review of these SRs relative to the ANO-1 TMRE model development was performed and documented in the "Additional ANO-1 TMRE Comments" column of Table 9.

5. Conclusions on PRA Technical Adequacy The information presented herein demonstrates that the ANO-1 PRA technical adequacy and capability evaluations, as well as the maintenance and update processes, conform to the ASME/ANS PRA Standard, which satisfies the guidance of RG 1.200.

Therefore, the ANO-1 internal events PRA model technical capability evaluations described in this report provide a robust basis for concluding that the ANO-1 PRA models are suitable for use in risk-informed applications including the TMRE.

Enclosure Attachment 1 to 0CAN041904 Page 4 of 34

6. References 6.1 Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," USNRC, March 2009.

6.2 "ANO-1 RG 1.200 PRA Peer Review Report Using ASME PRA Standard Requirements,"

August 2009.

6.3 EN-DC-151, Entergy Nuclear Management Manual, "PSA Maintenance and Upgrade,"

Revision 6.

6.4 ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, 2009.

6.5 38-1290272-00, "Arkansas Nuclear One - 1 Probabilistic Risk Assessment Peer Review Report," October 2002.

6.6 CEXI2007-00013, "Arkansas Nuclear One Unit 1 PSA RG 1.200 App. B / ASME PSA Standard "Gap" Assessment," June 2007 6.7 ENTGANO150-REPT-002, "Arkansas Nuclear One Unit 2 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, April 2017.

Enclosure Attachment 1 to 0CAN041904 Page 5 of 34 Table 1 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Initiating Events (IE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-IE-A IE-A1 ALL X

X IE-A2 ALL X

IE-A3 ALL X

IE-A4 I/II X

IE-A5 I/II X

IE-A6 I/II X

IE-A7 ALL X

IE-A8 I/II X

IE-A9 I/II X

IE-A10 ALL X

HLR-IE-B IE-B1 ALL X

IE-B2 ALL X

IE-B3 I/II X

IE-B4 ALL X

IE-B5 ALL X

HLR-IE-C IE-C1 ALL X

X IE-C2 ALL X

IE-C3 ALL X

X IE-C4 ALL X

IE-C5 I/II X

IE-C6 ALL X

IE-C7 I

ALL X

IE-C8 ALL X

IE-C9 ALL X

IE-C10 ALL X

IE-C11 ALL X

IE-C12 ALL X

IE-C13 I/II X

IE-C14 I/II X

IE-C15 ALL X

X)

HLR-IE-D IE-D1 ALL X

IE-D2 ALL X

IE-D3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 6 of 34 Table 2 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Accident Sequences (AS), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-AS-A AS-A1 ALL X

X AS-A2 ALL X

AS-A3 ALL X

X AS-A4 ALL X

X AS-A5 ALL X

X AS-A6 ALL X

AS-A7 III X

AS-A8 ALL X

AS-A9 I/II X

AS-A10 ALL X

X AS-A11 ALL X

HLR-AS-B AS-B1 ALL X

X AS-B2 ALL X

AS-B3 ALL X

X AS-B4 X

AS-B5 ALL X

AS-B6 ALL X

AS-B7 ALL X

X HLR-AS-C AS-C1 ALL X

AS-C2 ALL X

AS-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 7 of 34 Table 3 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Success Criteria (SC), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-SC-A SC-A1 ALL X

SC-A2 II/III X

SC-A3 ALL X

SC-A4 ALL X

SC-A5 I/II ALL X

SC-A6 ALL X

HLR-SC-B SC-B1 I/II X

SC-B2 II/III X

X SC-B3 ALL X

SC-B4 ALL X

SC-B5 ALL X

HLR-SC-C SC-C1 ALL X

SC-C2 ALL X

SC-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 8 of 34 Table 4 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-SY-A SY-A1 ALL X

SY-A2 ALL X

SY-A3 ALL X

SY-A4 II/III X

X SY-A5 ALL X

SY-A6 ALL X

SY-A7 III X

SY-A8 ALL X

SY-A9 ALL X

SY-A10 ALL X

X SY-A11 ALL X

X SY-A12 ALL X

SY-A13 ALL X

X SY-A14 ALL X

X SY-A15 ALL X

X SY-A16 I/II X

X SY-A17 ALL X

X SY-A18 ALL X

SY-A19 ALL X

SY-A20 ALL X

SY-A21 ALL X

SY-A22 I

X SY-A23 ALL X

SY-A24 ALL X

HLAR-SY-B SY-B1 II/III X

SY-B2 I/II X

SY-B3 ALL X

SY-B4 ALL X

SY-B5 ALL X

SY-B6 ALL X

SY-B7 II X

X SY-B8 ALL X

X

Enclosure Attachment 1 to 0CAN041904 Page 9 of 34 Table 4 (continued)

ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLAR-SY-B (continued)

SY-B9 ALL X

SY-B10 II/III X

SY-B11 ALL X

SY-B12 ALL X

SY-B13 ALL X

SY-B14 ALL X

X SY-B15 ALL X

X HLR-SY-C SY-C1 ALL X

SY-C2 ALL X

SY-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 10 of 34 Table 5 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Human Reliability (HR)), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-HR-A HR-A1 ALL X

HR-A2 ALL X

HR-A3 ALL X

HLR-HR-B HR-B1 X

HR-B2 X

HLR-HR-C HR-C1 ALL X

HR-C2 I

X HR-C3 ALL X

HLR-HR-D HR-D1 ALL X

HR-D2 III X

HR-D3 II/III X

HR-D4 ALL X

HR-D5 ALL X

HR-D6 ALL X

HR-D7 I/II X

HLR-HR-E HR-E1 ALL X

HR-E2 ALL X

HR-E3 II/III X

X HR-E4 II/III X

X HLR-HR-F HR-F1 III X

HR-F2 II X

HLR-HR-G HR-G1 III X

HR-G2 ALL X

HR-G3 II/III X

HR-G4 II X

HR-G5 II X

X HR-G6 ALL X

HR-G7 ALL X

X HR-G8 ALL X

HLR-HR-H HR-H1 III X

X HR-H2 ALL X

X HR-H3 ALL X

HLR-HR-I HR-I1 ALL X

HR-I2 ALL X

HR-I3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 11 of 34 Table 6 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-DA-A DA-A1 ALL X

X DA-A2 ALL X

DA-A3 ALL X

DA-A4 ALL X

HLR-DA-B DA-B1 II X

DA-B2 I/II X

HLR-DA-C DA-C1 ALL X

DA-C2 ALL X

DA-C3 ALL X

DA-C4 ALL X

DA-C5 ALL X

DA-C6 ALL X

DA-C7 II/III X

DA-C8 II/III X

DA-C9 I/II X

DA-C10 I

X DA-C11 ALL X

DA-C12 ALL X

DA-C13 I

X DA-C14 ALL X

DA-C15 X

DA-C16 ALL X

HLR-DA-D DA-D1 III X

DA-D2 X

DA-D3 III X

DA-D4 II/III X

DA-D5 II X

DA-D6 II X

DA-D6a X

DA-D7 III X

HLR-DA-E DA-E1 ALL X

DA-E2 ALL X

DA-E3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 12 of 34 Table 7 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-QU-A QU-A1 ALL X

QU-A2 ALL X

QU-A3 I

X QU-A4 ALL X

QU-A5 ALL X

X HLR-QU-B QU-B1 ALL X

QU-B2 ALL X

QU-B3 ALL X

QU-B4 ALL X

QU-B5 ALL X

QU-B6 ALL X

QU-B7 ALL X

QU-B8 ALL X

QU-B9 ALL X

QU-B10 ALL X

HLR-QU-C QU-C1 ALL X

QU-C2 ALL X

QU-C3 ALL X

HLR-QU-D QU-D1 ALL X

QU-D2 ALL X

QU-D3 ALL X

QU-D4 I

X QU-D5 ALL X

X QU-D6 I

X QU-D7 ALL X

X HLR-QU-E QU-E1 ALL X

X QU-E2 ALL X

X QU-E3 III X

QU-E4 ALL X

X HLR-QU-F QU-F1 ALL X

QU-F2 ALL X

QU-F3 II/III X

QU-F4 ALL X

QU-F5 ALL X

QU-F6 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 13 of 34 Table 8 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-LE-A LE-A1 ALL X

LE-A2 ALL X

LE-A3 ALL X

LE-A4 ALL X

LE-A5 ALL X

HLR-LE-B LE-B1 II X

LE-B2 II X

LE-B3 ALL X

HLR-LE-C LE-C1 I

X LE-C2 I

X LE-C3 I

X X

LE-C4 I

X LE-C5 I

X LE-C6 ALL X

LE-C7 ALL X

LE-C8 ALL X

LE-C9 I

X LE-C10 I

X LE-C11 I

X LE-C12 I

X LE-C13 I

X HLR-LE-D LE-D1 I

X LE-D2 I

X LE-D3 I

X LE-D4 I

X LE-D5 I

X LE-D6 I

X LE-D7 I

X HLR-LE-E LE-E1 ALL X

LE-E2 II X

LE-E3 II X

LE-E4 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 14 of 34 Table 8 (continued)

ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-LE-F LE-F1 II/III X

LE-F2 ALL X

LE-F3 ALL X

HLR-LE-G LE-G1 ALL X

LE-G2 ALL X

LE-G3 I

X LE-G4 ALL X

LE-G5 ALL X

LE-G6 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 15 of 34 Table 9 ANO-1 Supporting Requirements (SRs) with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments IE-A The initiating event analysis shall provide a reasonably complete identification of initiating events.

IE-A1 Tornado initiating events will be consistent with the intervals defined in the TMRE process. TMRE considers all tornadoes will result in a LOOP. Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 [IE-C1].

TMRE process should ensure that the initiating events caused by extreme winds that give rise to significant accident sequences and accurately capture the additional risk of the unprotected SSCs (that should be protected per the CLB) are identified and used for this application.

4.3, 6.2 The only initiating events caused by extreme winds that are considered in TMRE were tornados. Only tornados will produce tornado missiles. The TMRE process was followed.

IE-A10 For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g., multi-unit LOOP events or total loss of service water) that may impact the model.

6.2 IE-B The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

Enclosure Attachment 1 to 0CAN041904 Page 16 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments IE-B5 DO NOT SUBSUME multi-unit initiating events if they impact mitigation capability. Two unit sites should consider proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

6.2 IE-C The initiating event analysis shall estimate the annual frequency of each initiating event or initiating event group.

The tornado IEFs should be based on a hazard curve that uses site-specific data, such as found in NUREG-4461.

IE-C1 Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 4.1 The TMRE process was followed as described. No additional comments.

IE-C3 Do not credit recovery of offsite power.

Same comment as AS-A10 6.1, Appendix A The TMRE process was followed as described. Offsite power recovery was not credited.

IE-C15 CHARACTERIZE the uncertainty in the tornado initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results. NUREG 4461, Tornado Climatology, data includes uncertainty.

4.3 The TMRE process was followed as described. As mentioned, NUREG 4461, Tornado Climatology, data includes uncertainty.

Additionally, the R-squared value is provided to help characterize the uncertainty of the ANO-1 initiating event best fit interpolated/extrapolated frequencies.

Table 9

Enclosure Attachment 1 to 0CAN041904 Page 17 of 34 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments AS-A Utilize the accident sequences (typically LOOP) provided in the internal events model and adjust as necessary to consider the consequences of a tornado event.

AS-A1 Modify the internal events accident sequences in compliance with this SR 6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was utilized considering the consequences of a tornado event.

SSCs are not credited in accordance with the TMRE process.

Operator actions are adjusted as necessary according to the TMRE process.

AS-A3 Review the FPIE success criteria and modify the associated system models as necessary to account for the tornado event and its consequences.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. SSCs are not credited in accordance with the TMRE process.

AS-A4 Review the FPIE success criteria and modify the associated operator actions as necessary to account for the tornado event and its consequences.

6.4 The TMRE process was followed as described. Operator actions are adjusted as necessary according to the TMRE process.

Enclosure Attachment 1 to 0CAN041904 Page 18 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments AS-A5 Modify the FPIE accident sequence model in a manner that is consistent with the plant-specific: system design, EOPs, abnormal procedures, and plant transient response. Account for system functions that, as a consequence of the tornado event, will not be operable or potentially degraded, and operator actions that will not be possible or impeded.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was utilized considering the consequences of a tornado event.

Certain exposed SSCs are not credited in accordance with the TMRE process. Operator actions are adjusted as necessary according to the TMRE process.

AS-A10 Capability Category I. In modifying the accident sequence models, INCLUDE, for each tornado initiating event, INDIVIDUAL EVENTS IN THE ACCIDENT SEQUENCE SUFFICIENT TO BOUND SYSTEM OPERATION, TIMING, AND OPERATOR ACTIONS NECESSARY FOR KEY SAFETY FUNCTIONS.

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative approach can be justified. Use of conservative assumptions in the base model can distort the results and may not be conservative for delta CDF/LERF calculation. While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

6.3, 7.2.3, Appendix A The TMRE process was followed as described. Active components not in Cat I structures are not credited in accordance with the TMRE process. This conservative assumption can distort the delta CDF/LERF.

Enclosure Attachment 1 to 0CAN041904 Page 19 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments AS-B Dependencies that can impact the ability of the mitigating systems to operate and function shall be addressed.

AS-B1 For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact. INCLUDE the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

6.1, 6.3, 6.5, 6.6 The TMRE process was followed as described. Impacts on mitigating systems were included for all modeled tornado initiating events.

AS-B3 IDENTIFY the phenomenological conditions created by the accident progression. Consider concurrent impacts related to tornado missiles (e.g., the possibility of multiple missile strikes in a given sequence.

Also high winds and rains after the tornado event could result in hazardous conditions (e.g. debris and structural instabilities) for actions outside the control room.

5.6, 6.3, 6.4, 6.6 The TMRE process was followed as described. Unique weather phenomena such as intense rain could be an issue during tornado initiating events for structures that are not designed to withstand the winds. Except as noted above (AS-A10) active components in non-Cat I structures were not credited in accordance with the TMRE process. Operator actions that require travel through non-Cat I structures or areas are not credited.

Enclosure Attachment 1 to 0CAN041904 Page 20 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments AS-B7 Review FPIE time phased dependencies to identify model changes needed to address all the concurrent system functions failed by the tornado event; e.g.

LOOP, instrument air, fire protectionetc. Do not model offsite recovery.

6.1 The TMRE process was followed as described. Time phased dependencies were reviewed and no model changes were identified for the TMRE model.

SC-A The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

SC-A4 Consider impact on both units for the same tornado including the mitigating systems that are shared.

6.1 Shared components were included in the model.

SY-A The systems analysis shall provide a reasonably complete treatment of the causes of system failure and unavailability modes represented in the initiating events analysis and sequence definition

Enclosure Attachment 1 to 0CAN041904 Page 21 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments SY-A The systems analysis shall provide a reasonably complete treatment of the causes of system failure and unavailability modes represented in the initiating events analysis and sequence definition Section 3 The TMRE process was followed as described. Walkdowns were performed focusing on targets vulnerable to tornado missiles. The results were recorded in the walkdown report. The walkdowns also surveyed the plant for the missile inventory. Pathways for operator x-control room actions were discussed with the site personnel; however, operator actions that require travel through non-Cat I structures or areas are not credited.

SY-A11 New basic events will be added to address all the failure modes of the system targets exposed to tornado missiles; safety related and non-safety related. The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

6.3, 6.5, 6.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related system targets exposed to tornado missiles in accordance with the TMRE process.

SY-A12 DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be shown this is true for all missiles at all speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

5.2 The TMRE process was followed as described. No additional comment for the TMRE model.

Enclosure Attachment 1 to 0CAN041904 Page 22 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments SY-A13 Consider the targets potential to cause a flow diversion when struck by a tornado missile.

8.5 The TMRE process was followed as described. Targets potential to cause a flow diversion when struck by a tornado missile were considered. Beyond steam breaks around main steam lines, no additional flow diversions were required to be modeled.

SY-A14 Missile targets will be assessed for all failure modes - some new failure modes may be identified that are not in the FPIE model.

The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

6.5 The TMRE process was followed as described. SSCs were assessed for all failure modes.

SY-A15 The failure of SSCs due to tornado missiles shall not use the exclusions of SY-A15.

The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model. This is to facilitate sensitivity studies regarding possible correlation of tornado missile damage across systems. It is not expected that the number of basic events added to the model for this analysis will be so large that this screening is necessary.

6.5 The TMRE process was followed as described. The failure by tornado missiles was included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model.

Enclosure Attachment 1 to 0CAN041904 Page 23 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments SY-A17 Certain post initiator HFEs will be modified to account for the tornado event.

4.4 The TMRE process was followed as described.

SY-B The thermal/hydraulic,structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

SY-B7 Capability Category I. BASE support system modeling on the use of CONSERVATIVE SUCCESS CRITERIA AND TIMING. Sensitivity studies will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

Same comment as AS-A10 5.2.3 The TMRE process was followed as described. The systems analysis from the internal events was the foundation for the TMRE model. Credit given to available PRA SSCs was in accordance with the TMRE process.

SY-B8 Consider spatial relationships between components to identify correlated failures. Where the same missile can impact targets that are in close proximity to each other.

5.6 The TMRE process was followed as described. Correlation was considered where the same missile can impact targets that are in close proximity to each other.

Enclosure Attachment 1 to 0CAN041904 Page 24 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments SY-B14 Statistical correlation of tornado missile damage between redundant and spatially separated components is NOT required.

The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile damage for specially separated components is insignificant.

Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

Appendix B.4.4 There are no deviations taken from the TMRE guidance document.

SY-B15 INCLUDE new operator interface dependencies across systems or trains related to the tornado event.

6.4 The TMRE process was followed as described. No new operator interface dependencies across systems or trains were identified in the TMRE model development.

HR-E A systematic review of the relevant procedures shall be used to identify the set of operator responses required for each of the tornado accident sequences

Enclosure Attachment 1 to 0CAN041904 Page 25 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments HR-E3 Operators will be interviewed (if necessary) to assess the need for changes to operator actions for the tornado initiating events.

6.4 The TMRE process was followed as described. Operator interviews for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

Furthermore, during the TMRE development an ANO-1 SRO was consulted for further considerations.

HR-E4 Operators talk-throughs or simulator observations will be conducted (if necessary) to assess the need for changes to operator actions for the tornado [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

6.4 The TMRE process was followed as described. Operator interviews/ talk throughs for the credited actions were performed during the development of the model that the TMRE model is based on.

HR-G The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

Enclosure Attachment 1 to 0CAN041904 Page 26 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments HR-G5 Operators will be interviewed and simulator observations conducted (if necessary) to assess the need for changes to operator action timing as a result of the tornado event. [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

6.4 The TMRE process was followed as described. Operator interviews / talk throughs for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

HR-G7 Dependencies will be recalculated when the model is quantified or modified by inspecting cutsets.

6.4 The TMRE process was followed as described. No new combinations were created or credited.

HR-G7 Dependencies will be recalculated when the model is quantified or modified by inspecting cutsets.

HR-G7 Dependencies will be recalculated when the model is quantified or modified by inspecting cutsets.

6.4 The TMRE process was followed as described. No new combinations were created or credited.

DA-A Each parameter shall be clearly defined in terms of the logic model, basic event boundary, and the model used to evaluate event probability.

Enclosure Attachment 1 to 0CAN041904 Page 27 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments DA-A1 Develop new basic events for tornado missile targets (all failure modes) in accordance with this SR.

8.3, 8.5, 8.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related and non-safety related system targets exposed to tornado missiles in accordance with the TMRE process.

QU-A The level 1 quantification shall quantify core damage frequency and shall support the quantification of LERF.

QU-A5 Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

6.4 The TMRE process was followed as described. Recovery actions to restore functions, systems, or components were not credited.

QU-C Model quantification shall determine that all identified dependencies are addressed appropriately.

QU-C1 Identify new operator action dependencies created as a result of the changes to the internal events PRA model or failures associated with tornado events.

6.4 The TMRE process was followed as described. No new operator actions or combinations were created or credited.

Enclosure Attachment 1 to 0CAN041904 Page 28 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments QU-D The quantification results shall be reviewed, and significant contributors to CDF (and LERF),

such as initiating events, accident sequences, and basic events (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

QU-D5 Review nonsignificant cutset or sequences to determine the sequences are valid 7.3 The TMRE process was followed as described. Cutsets were reviewed including significant and non-significant cutsets to ensure the sequences are valid.

QU-D7 Review BE importance to make sure they make logical sense.

7.3 The TMRE process was followed as described. BE importances were reviewed to ensure they make logical sense.

QU-E Uncertainties in the PRA results shall be characterized. Sources of model uncertainty and related assumptions shall be identified, and their potential impact on the results understood.

QU-E1 Identify sources of uncertainty related to MIP and missiles 7.1, Also see Appendices A and B for bases.

The TMRE process was followed as described.

Enclosure Attachment 1 to 0CAN041904 Page 29 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments QU-E2 Identify assumptions made that are different than those in the internal events model Section 6 The TMRE process was followed as described.

QU-E4 Identify how the model uncertainty is affected by assumptions related to MIP and missiles 7.1, Appendix A The TMRE process was followed as described. Assumptions related to MIP and missiles unique to ANO-1 are described in an Entergy report.

LE-C The accident progression analysis shall include identification of those sequences that would result in a large early release.

7.1, 7.3 The TMRE process was followed as described. No additional comments.

LE-C3 Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Same comment as AS-A10 6.3, 7.2.3, Appendix A The TMRE process was followed as described. No additional comments.

Enclosure Attachment 1 to 0CAN041904 Page 30 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-1 TMRE comments Multiple SRs Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in Various documentation SRs for each HLR. The documentation should be sufficient to understand basis and facilitate review. Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Section 8 The TMRE process was followed as described. No additional comments.

Enclosure Attachment 1 to 0CAN041904 Page 31 of 34 Table 10 Listing of Open Findings against the ANO-1 Internal Events MCR Number MCR Grade Applicable SR Finding/Observation Current Status and Importance to application A1-3893 C

IE-D1 RG1.200 Peer Review Finding Some basic events (e.g., XMP119BBAF) applied in the calculation of IE frequencies developed for plant-specific fault trees have used calculation method 3 in CAFTA. The use of calculation method 3 (1-e-t) produces a probability (always < 1) rather than a frequency which can be greater than 1. Calculation method 1 (t) in CAFTA should be used for those basic events whose result is intended to be a frequency of failure, not a probability of failure.

A discussion of the use of this calculation method is not provided, although, during discussion of this issue, the PRA staff indicated that the limitations of the selected approach were understood.

Provide a description of the approach taken for calculation of the basic event values within support system initiating event fault trees, and include the limitations of the approach.

The calculation type was corrected during the Rev. 5 model update. Therefore, no impact on TMRE.

A1-3897 C

IE-C8 RG1.200 Peer Review Finding Section 5.3 of PRA-A1-01-001S06, Revision 2 identifies those initiating events that are quantified by means of a plant specific fault tree.

Appendices C, D, E, and F provide additional detail on each of the 4 modeled initiating events.

Per Appendices E and F, the PSA logic model is used as the starting point for the IE model; however, a number of modeling simplifications are made as identified in Appendix C. These simplifications may cause the model to fall out of compliance with the SY requirements.

Use the system fault tree with necessary data (exposure time) changes to evaluate IEs.

The initiating event trees were extensively revised during the Rev. 5 model update.

Therefore, no impact on TMRE is expected.

Note 1 - Open internal flooding and fire PRA findings are not included.

Enclosure Attachment 1 to 0CAN041904 Page 32 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 MCR Number EC or Procedure Description of Change Impact on TMRE Application A1-3050 EC-3069 Currently ANO-1 recirc lines for BWST through SFP purification loop are not seismically qualified. EC-3069 incorporates two valves CV-1438 and CV-1441 into line that will get a close signal on ESAS channel 1 and 2 respectively. If a seismic event occurs, operations will be required to close these valves per the procedure. The current estimation is that it will take the operations approximately 30 minutes to take the action to close the valves.

The potential modification is intended for seismic considerations, and therefore is expected to have no impact on the TMRE applications.

A1-4837 EC-41875 The NFPA-805 circuit modification described in EC-41875 prevents spurious operation of the valves following fire impact to the associated circuits regardless of where the cable is damaged. However, the Fire PRA (FPRA) was only adjusted to remove the fire impact to the valves in fire zone 129-F. The impact in other fire zones and fire areas has not been removed from the FPRA.

The circuits being modified are for air-operated valves (AOVs) CV-1052, CV-4400, CV-7401, CV-7402, CV-7403, and CV-7404 as well as motor-operated valves (MOVs) CV-1053, CV-4446, CV-5611, and CV-5612.

The modifications have been incorporated in the fire PRA model, but the MCR is not yet closed. Therefore, this plant change has been incorporated, but as it is related to FPRA, has no impact on the TMRE application.

A1-4862 EC-44500 During the FPRA model revision (re-baseline) for the NFPA-805 amendment request responses to requests for additional information (RAIs), update the random failure probability for the new DC supplies to bound the modification described in EC-44500. Also update the random failure probabilities assumed for the new Auxiliary Feedwater (AFW) pump if necessary to reflect that modification.

The modification and updated data has been incorporated in the FPRA model, but the MCR is not yet closed. Therefore, this plant change has been incorporated, but as it is related to FPRA, has no impact on the TMRE application.

Enclosure Attachment 1 to 0CAN041904 Page 33 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 (continued)

MCR Number EC or Procedure Description of Change Impact on TMRE Application A1-4933 SDS-008 OP-1202.008 OP-1203.048 B5b actions/equipment can potentially be credited in the model to provide an alternate feedwater and Refueling Water Tank (RWT) / Borated Water Storage Tank (BWST) makeup from the B5b portable fire pump. By having an additional pump to EFW/AFW for long term scenarios can provide some benefit for those scenarios.

Also, procedure SDS-008 Change 002 contains the following statement that could add additional actions in the PRA: IF Unit 2 has AC power, THEN consider performing Security Event (OP-1203.048), Attachment G, Cross-Tying 4160 V Buses Between Units.

Blackout Procedure OP-1202.008 Rev. 15 provides a reference to OP-1203.048 for supplying power from Unit 2 to Unit 1 via 2A9.

Once procedure OP-1203.048 is reviewed, there may be additional actions that can provide enhancement to the PRA model.

This modification involves use of equipment that is stored in non-Cat 1 structures and vulnerable to tornado missiles. However, implementation of the mod would potentially lower CDF/LERF for both the compliant and degraded TMRE cases. Since the equipment is vulnerable in both cases, delta CDF and LERF is unlikely to change from the current base case.

A1-5051 EC 44044 and child ECs EC 44044 and child ECs 46389, 46390, and 46391 make up the electrical portion of ANO-1s Beyond-Design Basis External Event (BDBEE) plan. The scope of this project includes installing new breakers into the existing Load Center B-5 and Motor Control Centers B-55, B-61, and B-65, and the permanent raceway, cables, and termination panels required to use them during a BDBEE. Portable diesel generators will be stored outside of the protected area (Ref. EC-44045 ANO Flex Storage Building) at separate locations to assure availability of at least one post BDBEE. A portable generator will be moved into a position at the common Post Accident Sampling System (PASS) building on the west side of the Auxiliary Building between the ANO-1 BWST and the ANO-2 RWT. Once at this location it will be connected to the permanently installed infrastructure previously described.

This modification involves use of equipment that is stored in non-Cat 1 structures and vulnerable to tornado missiles. However, implementation of the mod would lower CDF/LERF for both the compliant and degraded TMRE cases. Since the equipment is vulnerable in both cases, delta CDF and LERF is unlikely to change from the current base case.

Enclosure Attachment 1 to 0CAN041904 Page 34 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 (continued)

MCR Number EC or Procedure Description of Change Impact on TMRE Application A1-5821 OP-1106.006 Reviewing procedure OP-1106.006 Rev. 100 (dated 1/5/2017), a change was made in Section 8.3 for EFW pump suction transfer to transfer to Service Water (SW) instead of the Condensate Storage Tank (CST). This change removes the allowance to transfer to the CST. This change was based on the SW supply being judged as the preferred for transfer vice CST T-41 since it is the safety-related water supply and it is currently unknown when vortexing might occur when aligned to the CST. However, the current revision (dated 4/6/2016) of procedure OP-1203.012K Rev. 48, still maintains the CST T-41 as an option with CST T-41B empty when EFW pump P7A/P7B suction pressure is low, but references OP-1106.006 that does not credit T-41 in the EFW pump suction transfer section. The qualified CST (QCST) T-41B, CST T-41, and SW are credited in the PRA to provide flow to EFW.

This modification would have no impact on the TMRE analysis because the CSTs are failed in both the compliant and degraded cases.

Enclosure Attachment 2 to 0CAN041904 Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

Enclosure Attachment 2 to 0CAN041904 Page 1 of 56 ANO-2 Technical Adequacy 1.0 Overview This Attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for Arkansas Nuclear One, Unit 2 (ANO-2) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard (Reference 6.1) as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," (Reference 6.1) at an appropriate capability category to support the ANO-2 Tornado Missile Risk Evaluator (TMRE) program. This enclosure provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

Section 2.0 addresses the need for the PRA model to represent the as-built, as-operated

plant, Section 3.0 discusses permanent plant changes that have an impact on those systems, structures, and components (SSCs) modeled in the PRA but have not been incorporated in the baseline PRA model.

Section 4.0 demonstrates that the ANO-2 PRA has been performed consistent with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Revision 2. The peer review that has been conducted and the resolution of findings from those reviews are discussed in this section. The unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, NEI 17-02 are also discussed in this section.

The conclusions on the technical adequacy of the ANO-2 PRA are provided in Section 5.0.

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2.0 Basis to Conclude that the PRA Model Represents the As-Built, As-Operated Plant The ANO-2 PRA models are controlled in accordance with Entergy procedures consistent with the requirements provided in the ASME/ANS PRA Standard. Entergy procedures and guidelines define the process to be followed to implement scheduled and interim PRA model updates and to control the PRA model files. In addition, the procedure also defines the process for identifying, tracking and implementing model changes, and for identifying and tracking model improvements or potential issues that may affect the model. Model changes that are identified are tracked via model change requests (MCRs), which are entered in the Entergy MCR database.

Periodic PRA model updates are typically performed at least once every four years, with the option of extending the frequency for up to two years, such that the total update period does not exceed six years. Extensions are justified showing that the PRA model continues to adequately represent the as-built, as-operated plant and need to be approved by management.

Enclosure Attachment 2 to 0CAN041904 Page 2 of 56 The ANO-2 PRA model 5p00 was completed in 2016. The internal flood model upgrade was developed in 2016 and unresolved F&Os are currently being addressed. Both models follow the guidelines of RG 1.200. Section 3.0 discusses the requirements in RG 1.200 to demonstrate PRA technical adequacy, as applicable to the current ANO-2 internal events and internal flooding models.

3.0 Identification of Permanent Plant Changes Not Incorporated in the PRA Model Per the Entergy Engineering Change Process (EN-DC-115), the responsible engineer for an Engineering Change (EC) notifies the PRA engineer if the EC potentially impacts the PRA model. The PRA engineer ensures that the potential PRA model change is entered into the MCR database. Potential model changes associated with ECs not yet implemented remain in the MCR database and are tracked until closure (i.e., cancelled, resolved, or implemented).

Per the Entergy PRA Maintenance and Update procedure (EN-DC-151), the responsible owner for an emergency operating procedure (EOP) change notifies the PRA engineer of a change, and the PRA engineer determines if the EOP change potential impacts the PRA model. If so, the PRA engineer ensures that the potential PRA model change is entered into the MCR database. During periodic PRA model updates, the PRA engineer performs a review of any other EOP changes as well as changes to Abnormal Operating Procedures (AOPs) and other operating procedures referenced in the PRA model to identify changes that may impact the model. An MCR is created for any change that may potentially impact the PRA model.

Therefore, the MCR database is used to capture and track plant changes that may potentially impact the PRA model, and can be used to identify such plant changes that are not yet implemented in the PRA model. Review of the MCR database for ANO-2 identified several plant changes not yet implemented which may potentially impact the PRA. These are listed in Table 11, along with a discussion of why the change does not impact the PRA results used to support the TMRE.

The current ANO-2 Internal Events model (5p02, Reference 6.4) is based on the plant configuration as of April 2013 and plant-specific data through April 2013. It was a periodic model update of the previous revision of the model (4p02, Reference 6.3).

4.0 Conformance with ASME/ANS PRA Standard The following sections describe the conformance and capability of the ANO-2 PRA against the ASME/ANS PRA Standard.

4.1 Peer Review Facts and Observations (F&Os)

The ANO-2 PRA model has undergone several peer reviews and self-assessments which document the model quality and identify any areas with potential for improvement. The following assessments for PRA quality have been performed and documented for the ANO-2 model:

An industry peer review of the ANO-2 PSA model Revision 3p0 was conducted by the Combustion Engineering Owners Group (CEOG) in 2002 (Reference 6.6). The peer review concluded that there were several areas where the ANO-2 model needed improvement. The ANO-2 PSA model updates Rev 3p01, 3p02, 4p00, and 4p01 (4p01 completed in October 2006) addressed the Finding-level F&Os from this peer review.

Enclosure Attachment 2 to 0CAN041904 Page 3 of 56 In preparation for ANO-2s transition to National Fire Protection Association (NFPA) 805 standard, a gap assessment of the ANO-2 PSA 4p01 internal events PRA model was completed. The gaps impacting the fire PRA were closed to meet the NFPA transition schedule. The ANO-2 Internal Events PSA model was updated (Rev 4p02 finished December 2008) to meet the RG 1.200 Revision 1 standards.

In July 2008, a peer review of the Rev 4p02 ANO-2 PSA Model was performed and documented in LTR-RAM-II-08-020 (Reference 6.6). This peer review documented fifty-nine (59) new F&Os including thirty-three (33) Findings and twenty-six (26)

Suggestions. Most of the findings pertained to documentation issues. The conclusion of the review was that the ANO-2 PRA substantially met the ASME PRA standard at Capability Category (CC) II or better.

In September 2017, a self-assessment of all ANO-2 PRA models (internal events, external and shutdown) was performed. Several gaps were identified and are being tracked in the Entergys Paperless Condition Reporting System (PCRS).

The ANO-2 internal events model revision 5p00 was completed in 2016. This is the current PRA model as stated above. The peer review findings and their resolutions as well as the remaining unresolved findings related to the internal events PRA model are documented in the MCR database and are presented in Table 10.

The current ANO-2 internal flooding model was completed in 2016, and a focused scope peer review was completed in February 2017 against the current ASME/ANS PRA standard and RG 1.200. The results are detailed in report ENTGANO150-REPT-002 (ENERCON report)

(Reference 6.9). Internal flooding initiating accident sequences are not relevant to the TMRE analysis and, therefore, internal flooding F&Os from the 2017 are not addressed further.

4.2 Consistency with Applicable PRA Standards The ANO-2 PRA model revision 5p00 meets the ASME/ANS PRA standard (Reference 6.7)

CC II of the SRs. Current Entergy PRA documentation includes an individual self-assessment that documents how each high-level requirement (HLR) and SR are met. A gap in documentation related to this individual self-assessment was identified and documented in MCR A2-5585 (missing table from Success Criteria, Accident Sequence and System Analysis packages). This documentation issue is expected to be resolved as part of the model update.

The latest full-scope peer review for ANO-2 was conducted in July 2008 using RG 1.200 Rev 1.

Since then, model Revision 5p00 was completed which ensured all the significant F&Os from the peer review were addressed. All the F&Os are captured and documented in the MCR database. A search of ANO-2 MCRs related to the peer review F&Os was performed.

Finding-level F&O MCRs related to the internal event and internal flooding model are listed in Table 10, along with their disposition/resolution if resolved and the impact on the application.

A summary of the assessment against each of the eight technical elements (i.e., high-level requirements) of ASME/ANS RA-Sb-2005 is provided in Tables 1 through 8 of this attachment.

Table 9 lists those SRs from the PRA Standard that have been identified in the TMRE Guidance Document as being applicable to the TMRE PRA. A systematic review of these SRs relative to the ANO-2 TMRE model development was performed and documented in the "Additional ANO-2 TMRE Comments" column of Table 9. These SRs are from a later version of the Standard, ASME/ANS RA-Sa-2009 (Reference 6.7).

Enclosure Attachment 2 to 0CAN041904 Page 4 of 56 The peer review generated 59 F&Os: 33 Findings and 26 Suggestions. All of these F&Os are listed in Table 10, below; each was assigned an MCR. The status of each MCR is also documented in this table. All of the F&Os are considered closed with the exception of six suggestions and five findings which have been deferred to the next update. The five findings are related to LERF supporting requirements. All meet CC I or higher. Their impact with regard to TMRE is addressed in the MCR Status column.

5.0 Conclusions on PRA Technical Adequacy The information presented herein demonstrates that the ANO-2 PRA technical adequacy and capability evaluations, as well as the maintenance and update processes conform to the ASME/ANS PRA Standard, which satisfies the guidance of RG 1.200, Revision 1. Per Entergy letter 2CAN061406 (Reference 6.10), response to PRA RAI 20 explains that, after a detailed review was performed, the changes in the SR requirements between ASME RA-Sb-2005 and ASME/ANS RA-SA-2009, and changes between RG 1.200, Revision 1 and 2, do not invalidate the ANO-2 peer review or change any of the findings and observations.

Therefore, the ANO-2 internal events PRA model technical capability evaluations described in this report provide a robust basis for concluding that the ANO-2 PRA models are suitable for use in risk-informed applications including the TMRE.

6.0 References 6.1 ASME/ANS RA-Sb-2005, "Addenda to ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, New York, NY, December 2005.

6.2 Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

USNRC, January 2007.

6.3 PRA-A2-01-003, Revision 1, "ANO-2 PSA Level-1 Model 4p02 Summary Report,"

Entergy Operations, Inc., May 2, 2008.

6.4 PRA-ANO2-01, Revision 0, "ANO2 PSA - Summary Report for Model 5p00," Entergy Operations, Inc., July 10, 2015.

6.5 NEI 05-04, Revision 1 (Draft), "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events)," Nuclear Energy Institute, November 2007.

6.6 LTR-RAM-II-08-020, Letter from David Finnicum (Westinghouse) to Bradford Grimmel (Westinghouse), "RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements For The Arkansas Nuclear One, Unit 2 Probabilistic Risk Assessment, Final Deliverable," July 30, 2008.

6.7 ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, 2009

Enclosure Attachment 2 to 0CAN041904 Page 5 of 56 6.8 PSA-ANO2-01-PPCR, "Plant and Procedure Change Review (PPCR)", Revision 0, November 2016.

6.9 ENTGANO150-REPT-002, "Arkansas Nuclear One Unit 2 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, April 2017.

6.10 Entergy letter 2CAN061406, "Response to Request for Additional Information Adoption of National Fire Protection Association Standard NFPA-805, Arkansas Nuclear One, Unit 2, Docket No. 50-368, License No. NPF-6," June 2014.

Enclosure Attachment 2 to 0CAN041904 Page 6 of 56 Table 1 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Initiating Events (IE), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-IE-A IE-A1 ALL X

X IE-A2 ALL X

IE-A3 ALL X

IE-A3a II X

IE-A4 II X

IE-A5 ALL X

IE-A6 II X

IE-A7 II X

IE-A8 X

IE-A9 X

IA-10 ALL X

IE-A6 II X

HLR-IE-B IE-B1 ALL X

IE-B2 ALL X

IE-B3 II X

IE-B4 ALL X

IE-B5 ALL X

HLR-IE-C IE-C1 ALL X

X IE-C1a ALL X

IEC1b ALL X

X (IE-C3)

IE-C2 ALL X

IE-C3 X

IE-C4 ALL X

IE-C5 I/II X

IE-C6 ALL X

IE-C7 ALL X

IE-C8 ALL X

IE-C9 ALL X

IE-C10 X

IE-C11 I/II X

IE-C12 X

IE-C13 ALL X

X (IE-C15)

HLR-IE-D IE-D1 X

IE-D2 ALL X

IE-D3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 7 of 56 Table 2 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Accident Sequences (AS), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-AS-A AS-A1 ALL X

X AS-A2 ALL X

AS-A3 ALL X

X AS-A4 X

X AS-A5 X

X AS-A6 ALL X

AS-A7 III X

AS-A8 ALL X

AS-A9 III X

AS-A10 X

X HLR-AS-B AS-B1 X

X AS-B2 X

AS-B3 X

X AS-B4 X

AS-B5 ALL X

AS-Ba ALL X

AS-B6 X

X (AS-B7)

HLR-AS-C AS-C1 ALL X

AS-C2 X

AS-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 8 of 56 Table 3 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Success Criteria (SC), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-SC-A SC-A1 ALL X

SC-A2 II/III X

SC-A3 ALL X

SC-A4 ALL X

SC-A4a ALL X

SC-A5 II/III X

SC-A6 ALL X

HLR-SC-B SC-B1 II X

SC-B2 II/III X

X SC-B3 ALL X

SC-B4 ALL X

SC-B5 ALL X

HLR-SC-C SC-C1 ALL X

SC-C2 ALL X

SC-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 9 of 56 Table 4 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-SY-A SY-A1 ALL X

SY-A2 ALL X

SY-A3 ALL X

SY-A4 X

X SY-A5 ALL X

SY-A6 ALL X

SY-A7 I/II X

SY-A8 X

SY-A9 X

SY-A10 ALL X

SY-A11 ALL X

X (SY-A10)

SY-A12 ALL X

X (SY-A11)

SY-A12a ALL X

SY-A12b ALL X

X (SY-A13)

SY-A13 ALL X

X (SY-A14)

SY-A14 ALL X

X (SY-A15)

SY-A15 I/II X

X (SY-A16)

SY-A16 ALL X

X (SY-A17)

SY-A17 ALL X

SY-A18 ALL X

SY-A18a ALL X

SY-A19 ALL X

SY-A20 II X

SY-A21 ALL X

SY-A22 ALL X

HLR-SY-B SY-B1 II/III X

SY-B2 I/II X

SY-B3 ALL X

SY-B4 ALL X

SY-B5 ALL X

SY-B6 ALL X

SY-B7 II X

X SY-B8 X

X SY-B9 X

Enclosure Attachment 2 to 0CAN041904 Page 10 of 56 Table 4 (Continued)

ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-SY-B (continued)

SY-B10 ALL X

SY-B11 II/III X

SY-B12 ALL X

SY-B13 ALL X

SY-B14 ALL X

SY-B15 ALL X

X (SY-B14)

SY-B16 ALL X

X (SY-B15)

HLR-SY-C SY-C1 ALL X

SY-C2 ALL X

SY-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 11 of 56 Table 5 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Human Reliability (HR), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-HR-A HR-A1 ALL X

HR-A2 ALL X

HR-A3 ALL X

HLR-HR-B HR-B1 II/III X

HR-B2 ALL X

HLR-HR-C HR-C1 ALL X

HR-C2 I

X HR-C3 ALL X

HLR-HR-D HR-D1 ALL X

HR-D2 II X

HR-D3 I

X HR-D4 ALL X

HR-D5 ALL X

HR-D6 X

HR-D7 II/III X

HLR-HR-E HR-E1 ALL X

HR-E2 ALL X

HR-E3 II/III X

X HR-E4 II/III X

X HLR-HR-F HR-F1 III X

HR-F2 III X

HLR-HR-G HR-G1 III X

HR-G2 ALL X

HR-G3 II/III X

HR-G4 III X

HR-G5 III X

X HR-G6 X

HR-G7 ALL X

X HR-G8 X

HR-G9 X

HLR-HR-H HR-H1 II X

X HR-H2 ALL X

X HR-H3 ALL X

HLR-HR-I HR-I1 ALL X

HR-I2 ALL X

HR-I3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 12 of 56 Table 6 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Data Analysis (DA), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-DA-A DA-A1 ALL X

X DA-A1a X

DA-A3 ALL X

DA-A4 ALL X

HLR-DA-B DA-B1 II X

DA-B2 II X

HLR-DA-C DA-C1 ALL X

DA-C2 ALL X

DA-C3 ALL X

DA-C4 ALL X

DA-C5 ALL X

DA-C6 ALL X

DA-C7 II/III X

DA-C8 X

DA-C9 III X

DA-C10 I

X DA-C11 ALL X

DA-C11a ALL X

DA-C12 I

X DA-C13 ALL X

DA-C14 ALL X

DA-C15 X

HLR-DA-D DA-D1 III X

DA-D2 X

DA-D3 III X

DA-D4 II/III X

DA-D5 II X

DA-D6 II X

DA-D6a X

DA-D7 III X

HLR-DA-E DA-E1 ALL X

DA-E2 ALL X

DA-E3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 13 of 56 Table 7 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Quantification (QU), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-QU-A QU-A1 ALL X

QU-A2a ALL X

QU-A2b II X

QU-A3 ALL X

QU-A4 ALL X

X (QU-A5)

HLR-QU-B QU-B1 ALL X

QU-B2 ALL X

QU-B3 ALL X

QU-B4 ALL X

QU-B5 ALL X

QU-B6 ALL X

QU-B7a ALL X

QU-B7b ALL X

QU-B8 ALL X

QU-B9 ALL X

HLR-QU-C QU-C1 ALL X

QU-C2 ALL X

QU-C3 ALL X

HLR-QU-D QU-D1a ALL X

QU-D1b ALL X

QU-D1c ALL X

QU-D3 I

X QU-D4 ALL X

X (QU-D5)

QU-D5a II/III X

QU-D5b ALL X

X (QU-D7)

HLR-QU-E QU-E1 ALL X

X QU-E2 ALL X

X QU-E3 II X

QU-E4 II X

X HLR-QU-F QU-F1 ALL X

QU-F2 ALL X

QU-F3 II/III X

QU-F4 X

QU-F5 ALL X

QU-F6 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 14 of 56 Table 8 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE),

ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-LE-A LE-A1 ALL X

LE-A2 ALL X

LE-A3 ALL X

LE-A4 ALL X

LE-A5 ALL X

LE-A1 ALL X

HLR-LE-B LE-B1 II X

LE-B2 II X

LE-B3 ALL X

HLR-LE-C LE-C1 II X

LE-C2a II/III X

LE-C2b I

X X (LE-C3)

LE-C3 II X

LE-C4 II X

LE-C5 ALL X

LE-C6 ALL X

LE-C7 ALL X

LE-C8a I

X LE-C8b X

LE-C9a I

X LE-C9b I

X LE-C10 I

X HLR-LE-D LE-D1a II X

LE-D1b I

X LE-D2 X

LE-D3 I

X LE-D4 II X

LE-D5 II X

LE-D6 I

X HLR-LE-E LE-E1 ALL X

LE-E2 II X

LE-E3 II X

LE-E4 X

Enclosure Attachment 2 to 0CAN041904 Page 15 of 56 Table 8 (continued)

ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE),

ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 HLR SR Capability Category Met Not Met N/A SR TMRE Clarification I

II III HLR-LE-F LE-F1a II/III X

LE-Fb ALL X

LE-F2 II X

LE-F3 ALL X

HLR-LE-G LE-G1 ALL X

LE-G2 ALL X

LE-G3 II/III X

LE-G4 ALL X

LE-G5 ALL X

LE-G6 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 16 of 56 Table 9 ANO-2 Supporting Requirements (SRs) with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments IE-A The initiating event analysis shall provide a reasonably complete identification of initiating events.

IE-A1 Tornado initiating events will be consistent with the intervals defined in the TMRE process. TMRE considers all tornadoes will result in a LOOP. Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 [IE-C1].

TMRE process should ensure that the initiating events caused by extreme winds that give rise to significant accident sequences and accurately capture the additional risk of the unprotected SSCs (that should be protected per the CLB) are identified and used for this application.

4.3, 6.2 The only initiating events caused by extreme winds that are considered in TMRE were tornados. Only tornados will produce tornado missiles. The TMRE process was followed as described.

IE-A10 For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g., multi-unit LOOP events or total loss of service water) that may impact the model.

6.2 IE-B The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

Enclosure Attachment 2 to 0CAN041904 Page 17 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments IE-B5 DO NOT SUBSUME multi-unit initiating events if they impact mitigation capability. Two unit sites should consider proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

6.2 IE-C The initiating event analysis shall estimate the annual frequency of each initiating event or initiating event group.

The tornado IEFs should be based on a hazard curve that uses site-specific data, such as found in NUREG-4461.

IE-C1 Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 4.1 The TMRE process was followed as described. No additional comments.

IE-C3 Do not credit recovery of offsite power.

Same comment as AS-A10 6.1, Appendix A The TMRE process was followed as described. Offsite power recovery was not credited.

IE-C15 CHARACTERIZE the uncertainty in the tornado initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results. NUREG 4461, Tornado Climatology, data includes uncertainty.

4.3 The TMRE process was followed as described. As mentioned, NUREG 4461, Tornado Climatology, data includes uncertainty.

Additionally, the R-squared value is provided to help characterize the uncertainty of the ANO-2 initiating event best fit interpolated /

extrapolated frequencies.

Enclosure Attachment 2 to 0CAN041904 Page 18 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments AS-A Utilize the accident sequences (typically LOOP) provided in the internal events model and adjust as necessary to consider the consequences of a tornado event.

AS-A1 Modify the internal events accident sequences in compliance with this SR 6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was utilized considering the consequences of a tornado event.

SSCs are not credited in accordance with the TMRE process.

Operator actions are adjusted as necessary according to the TMRE process.

AS-A3 Review the FPIE success criteria and modify the associated system models as necessary to account for the tornado event and its consequences.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. SSCs are not credited in accordance with the TMRE process.

AS-A4 Review the FPIE success criteria and modify the associated operator actions as necessary to account for the tornado event and its consequences.

6.4 The TMRE process was followed as described. Operator actions are adjusted as necessary according to the TMRE process.

Enclosure Attachment 2 to 0CAN041904 Page 19 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments AS-A5 Modify the FPIE accident sequence model in a manner that is consistent with the plant-specific system design, EOPs, abnormal procedures, and plant transient response. Account for system functions that, as a consequence of the tornado event, will not be operable or potentially degraded, and operator actions that will not be possible or impeded.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was utilized consideriing the consequences of a tornado event.

Certain exposed SSCs are not credited in accordance with the TMRE process. Operator actions are adjusted as necessary according to the TMRE process.

AS-A10 Capability Category I. In modifying the accident sequence models, INCLUDE, for each tornado initiating event, INDIVIDUAL EVENTS IN THE ACCIDENT SEQUENCE SUFFICIENT TO BOUND SYSTEM OPERATION, TIMING, AND OPERATOR ACTIONS NECESSARY FOR KEY SAFETY FUNCTIONS.

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative approach can be justified. Use of conservative assumptions in the base model can distort the results and may not be conservative for delta CDF/LERF calculation. While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

6.3, 7.2.3, Appendix A The TMRE process was followed as described. Active components not in Cat I structures are not credited in accordance with the TMRE process.

This conservative assumption can distort the delta CDF/LERF. A specific sensitivity was performed to address that possibility.

Enclosure Attachment 2 to 0CAN041904 Page 20 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments AS-B Dependencies that can impact the ability of the mitigating systems to operate and function shall be addressed.

AS-B1 For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact. INCLUDE the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

6.1, 6.3, 6.5, 6.6 The TMRE process was followed as described. Impacts on mitigating systems were included for all modeled tornado initiating events.

AS-B3 IDENTIFY the phenomenological conditions created by the accident progression. Consider concurrent impacts related to tornado missiles (e.g., the possibility of multiple missile strikes in a given sequence.

Also high winds and rains after the tornado event could result in hazardous conditions (e.g. debris and structural instabilities) for actions outside the control room.

5.6, 6.3, 6.4, 6.6 The TMRE process was followed as described. Unique weather phenomena such as intense rain could be an issue during tornado initiating events for structures that are not designed to withstand the winds. Except as noted above (AS-A10) active components in non-Cat I structures were not credited in accordance with the TMRE process. Operator actions that require travel through non-Cat I structures or areas are not credited.

Enclosure Attachment 2 to 0CAN041904 Page 21 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments AS-B Review FPIE time phased dependencies to identify model changes needed to address all the concurrent system functions failed by the tornado event; e.g. LOOP, instrument air, fire protectionetc.

Do not model offsite recovery.

6.1 The TMRE process was followed as described. Time phased dependencies were reviewed and no model changes were identified for the TMRE model.

SC-A The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

SC-A4 Consider impact on both units for the same tornado including the mitigating systems that are shared.

6.1 Shared components were included in the model.

SY-A The systems analysis shall provide a reasonably complete treatment of the causes of system failure and unavailability modes represented in the initiating events analysis and sequence definition.

Enclosure Attachment 2 to 0CAN041904 Page 22 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments SY-A4 Capability Category II. Walkdowns focusing on targets vulnerable to tornado missiles will be performed.

Walkdown will include a missile inventory and a review of pathways available to the operators for ex-control room actions.

Section 3 The TMRE process was followed as described. Walkdowns were performed focusing on targets vulnerable to tornado missiles. The results were recorded in the walkdown report. The walkdowns also surveyed the plant for the missile inventory. Pathways for operator x-control room actions were discussed with the site personnel; however, operator actions that require travel through non-Cat I structures or areas are not credited.

SY-A11 New basic events will be added to address all the failure modes of the system targets exposed to tornado missiles; safety related and non-safety related. The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

6.3, 6.5, 6.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related system targets exposed to tornado missiles in accordance with the TMRE process.

Enclosure Attachment 2 to 0CAN041904 Page 23 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments SY-A12 DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be shown this is true for all missiles at all speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

5.2 The TMRE process was followed as described. No additional comment for the TMRE model.

SY-A13 Consider the targets potential to cause a flow diversion when struck by a tornado missile.

8.5 The TMRE process was followed as described. Targets potential to cause a flow diversion when struck by a tornado missile were considered. Beyond steam breaks around main steam lines, no additional flow diversions were required to be modeled.

SY-A14 Missile targets will be assessed for all failure modes - some new failure modes may be identified that are not in the FPIE model. The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

6.5 The TMRE process was followed as described. SSCs were assessed for all failure modes.

Enclosure Attachment 2 to 0CAN041904 Page 24 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments SY-A15 The failure of SSCs due to tornado missiles shall not use the exclusions of SY-A15.

The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model. This is to facilitate sensitivity studies regarding possible correlation of tornado missile damage across systems.

It is not expected that the number of basic events added to the model for this analysis will be so large that this screening is necessary.

6.5 The TMRE process was followed as described. The failure by tornado missiles was included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model.

SY-A17 Certain post initiator HFEs will be modified to account for the tornado event.

4.4 The TMRE process was followed as described.

SY-B The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Enclosure Attachment 2 to 0CAN041904 Page 25 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments SY-B7 Capability Category I. BASE support system modeling on the use of CONSERVATIVE SUCCESS CRITERIA AND TIMING.

Sensitivity studies will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

Same comment as AS-A10 5.2.3 The TMRE process was followed as described. The systems analysis from the internal events was the foundation for the TMRE model.

Credit given to available PRA SSCs was in accordance with the TMRE process.

SY-B8 Consider spatial relationships between components to identify correlated failures. Where the same missile can impact targets that are in close proximity to each other.

5.6 The TMRE process was followed as described. Correlation was considered where the same missile can impact targets that are in close proximity to each other.

SY-B14 Statistical correlation of tornado missile damage between redundant and spatially separated components is NOT required.

The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile damage for specially separated components is insignificant.

Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

Appendix B.4.4 There are no deviations taken from the TMRE guidance document.

SY-B15 INCLUDE new operator interface dependencies across systems or trains related to the tornado event.

6.4 The TMRE process was followed as described. No new operator interface dependencies across systems or trains were identified in the TMRE model development.

Enclosure Attachment 2 to 0CAN041904 Page 26 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments HR-E A systematic review of the relevant procedures shall be used to identify the set of operator responses required for each of the tornado accident sequences HR-E3 Operators will be interviewed (if necessary) to assess the need for changes to operator actions for the tornado initiating events.

6.4 The TMRE process was followed as described. Operator interviews for the credited actions were performed during the development of the internal events model that the TMRE model is based on. Furthermore, during the TMRE development an ANO-2 SRO was consulted for further considerations.

HR-E4 Operators talk-throughs or simulator observations will be conducted (if necessary) to assess the need for changes to operator actions for the tornado [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone].

6.4 The TMRE process was followed as described. Operator interviews/ talk throughs for the credited actions were performed during the development of the model that the TMRE model is based on.

Enclosure Attachment 2 to 0CAN041904 Page 27 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments HR-G The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

HR-G5 Operators will be interviewed and simulator observations conducted (if necessary) to assess the need for changes to operator action timing as a result of the tornado event.

[Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

6.4 The TMRE process was followed as described. Operator interviews / talk throughs for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

HR-G7 Dependencies will be recalculated when the model is quantified or modified by inspecting cutsets.

6.4 The TMRE process was followed as described. No new combinations were created or credited.

Enclosure Attachment 2 to 0CAN041904 Page 28 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments HR-H Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and feasible for those scenarios to which they are applied. Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

HR-H1/H2 Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

6.4 The TMRE process was followed as described. Recovery actions to restore functions, systems, or components were not credited.

DA-A Each parameter shall be clearly defined in terms of the logic model, basic event boundary, and the model used to evaluate event probability.

DA-A1 Develop new basic events for tornado missile targets (all failure modes) in accordance with this SR.

8.3, 8.5, 8.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related and non-safety related system targets exposed to tornado missiles in accordance with the TMRE process.

Enclosure Attachment 2 to 0CAN041904 Page 29 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments QU-A The level 1 quantification shall quantify core damage frequency and shall support the quantification of LERF.

QU-A5 Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

6.4 The TMRE process was followed as described. Recovery actions to restore functions, systems, or components were not credited.

QU-C Model quantification shall determine that all identified dependencies are addressed appropriately.

QU-C1 Identify new operator action dependencies created as a result of the changes to the internal events PRA model or failures associated with tornado events.

6.4 The TMRE process was followed as described. No new operator actions or combinations were created or credited.

QU-D The quantification results shall be reviewed, and significant contributors to CDF (and LERF),

such as initiating events, accident sequences, and basic events (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

Enclosure Attachment 2 to 0CAN041904 Page 30 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments QU-D5 Review nonsignificant cutset or sequences to determine the sequences are valid 7.3 The TMRE process was followed as described. Cutsets were reviewed including significant and non-significant cutsets to ensure the sequences are valid.

QU-D7 Review BE importance to make sure they make logical sense.

7.3 The TMRE process was followed as described. BE importances were reviewed to ensure they make logical sense.

QU-E Uncertainties in the PRA results shall be characterized. Sources of model uncertainty and related assumptions shall be identified, and their potential impact on the results understood.

QU-E1 Identify sources of uncertainty related to MIP and missiles 7.1, Also see Appendices A and B for bases.

The TMRE process was followed as described.

QU-E2 Identify assumptions made that are different than those in the internal events model Section 6 The TMRE process was followed as described.

QU-E4 Identify how the model uncertainty is affected by assumptions related to MIP and missiles 7.1, Appendix A The TMRE process was followed as described. Assumptions related to MIP and missiles unique to ANO-2 are described in an Entergy report.

LE-C The accident progression analysis shall include identification of those sequences that would result in a large early release.

7.1, 7.3 The TMRE process was followed as described. No additional comments.

Enclosure Attachment 2 to 0CAN041904 Page 31 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments (No comments if blank)

NEI 17-02 Section Addressing SR Additional ANO-2 TMRE comments LE-C3 Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Same comment as AS-A10 6.3, 7.2.3, Appendix A The TMRE process was followed as described. No additional comments.

Multiple SRs Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for each HLR. The documentation should be sufficient to understand basis and facilitate review. Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Section 8 The TMRE process was followed as described. No additional comments.

Enclosure Attachment 2 to 0CAN041904 Page 32 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3093 Resolved IE-C3 RG 1.200 Peer Review F&O IE-C3-01, Finding Issue: ANO2 explicitly calculated the total reactor critical years as total reactor critical hours divided by 8766 hours0.101 days <br />2.435 hours <br />0.0145 weeks <br />0.00334 months <br /> per year and used this to calculate the Initiating Events Frequencies (IEFs). However, there is no evidence that ANO2 adjusted these IEFs to reflect average plant availability. This is, in essence, equivalent to assuming that the plant operates at full power all year. ANO2 needs to adjust their initiating event frequencies to account for average plant availability.

Adjust the initiating event frequencies to account for the average plant availability.

Data sheets were set up to automatically adjust for capacity factor. Documented in IE Notebook This issue was resolved and therefore has no impact on TMRE.

A2-3094 Resolved IE-C10 RG 1.200 Peer Review F&O IE-C10-01, Finding No comparison of results to generic data sources was provided with a discussion and explanation of the differences. This is a requirement to meet IE C-10 and is important to assessing the validity of the initiating event frequency results. The ISLOCA IEF needs to be reviewed, compared and understood. This IEF value is very low.

Table 13 of PSA-ANO2-01-IE compares the IE frequencies to generic values.

This documentation issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 33 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3094 (continued)

Compare the results to the generic values in NUREG/CR-5750 and NUREG/CR-6928, and provide and explain any significant differences.

A2-3095 Resolved IE-C12 LE-D3 RG1.200 Peer Review F&O IE-C12-01, Also affects SR LE-D3, Finding Some of the components in the ISLOCA fault tree model appear to have incorrect mission times. The Low Pressure Safety Injection (LPSI)

Motor Operated Valve (MOV), e.g.

2CV5017 rupture, has a mission time of 36 hrs. However, the mission time should probably be 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> because the MOV rupture is not likely to be annunciated in the control room as assumed. Therefore, it could potentially be in an undetected failed state for an extended period. The same comment may apply to the second check valve. It could be potentially in an undetected failed state for an extended period.

Reconsider and change the mission times for the time the downstream valves can be in an undetected state.

In addition to the comment in this MCR, the peer review team mentioned that the failure rate should be based on Large Internal Leakage rather than Large External Leakage.

Therefore, the probability of Type Code MVG V 2 is changed from 1.0E-09/hour to 3.0E-09/hour and the probability of Type Code CVG V 2 is changed from 2.0E-09/hour to 3.0E-08/hour.

Based on a review of the ISLOCA events, the mission times for several events were changed from 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to 18 months.

In addition, the initiator events were changed to EQU gates with new events tied to the Type Code file.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 34 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3096 Resolved IE-D1 RG1.200 Peer Review F&O IE-D1-01, Finding Some of the documentation is not adequate to meet this requirement.

The following items should be addressed:

(1) What is the basis for the 80/20 split between reactor trip and turbine trip events? (Assumption 8, Section 2.2 and Section 5.1 page 19).

(2) Where is the documentation for the small and medium break sizes that are used in the model? The lower limit for the large LOCA break size has a reference (see Table 2).

(3) Appendix C contains calculations for loss of feedwater/condensate (T2).

Page 48 contains the Bayesian update for this event. Recommend explaining how these are used in the PRA model and which is used in the base model. The value in Table 7 appears to be from the Bayesian update which is inconsistent with the discussion in Section 5.3.1.

(4) Table 7: Its not clear where the frequencies for T500KV and TST3 come from. This should be explained.

(1) The updated data split reactor trip and turbine trip events using RADS database.

(2) The success criteria notebook provides documentation of the small and medium LOCA equivalent break size (3) The value based on IEFT Appendix C is different from the number based on actuarial calculation. Compensator BE to adjust the IEFT estimation is used to equalize the IEFT result with the actuarial calculation. Provided discussion on this.

(4) %T500 is documented in LOSP notebook draft ECH-NE-12-00099.

The update for %T500 includes data up to 2011. %TST3 (Startup Transformer 3 fails as an Initiating Event) is documented in the updated IE notebook draft.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 35 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3096 (continued)

(5) The RR file with the quantification information contains frequencies for the following events that are not in the IE documentation: T3SD, T3SW, TSDCA, TSDCAML, TSDCB, TSDCBML, TSDCISO, V5+, and VS+.

(6) Loss of Lake Dardanelle IE - need to document the change from 2E-04/yr to 1E-05/yr - it should be explained how the IE frequency for this event was reduced to 1E-05/yr.

Provide documentation for the above six items.

(5) T3SD, T3SW, TSDCA, TSDCAML, TSDCB, TSDCBML, TSDCISO are not in the mitigating model so this is out of scope. V5+

and VS+ are documented in the updated IE Notebook. All events except T3SW are part of the Shutdown PSA for ANO-2. T3SW is documented in PSA-ANO2-01-IE-01 (6) See MCR A2-4697.

A2-3099 Resolved AS-A4 RG1.200 Peer Review F&O AS-A4-01, Finding Even though some operator actions required to achieve the identified success criteria are mentioned in portions of the initiating event analyses, these operator actions are not consistently identified and documented. Entergy should explicitly identify all operator actions needed to achieve the success criteria for each of the key safety functions defined for the modeled initiating events.

Operator actions were included in the Success Criteria and Accident Sequence notebooks This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 36 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3100 Resolved AS-A5 RG1.200 Peer Review F&O AS-A5-01, Finding There is no reference to the System design, Emergency Operating Procedures (EOPs), or abnormal procedures in the accident sequence notebook. It would be helpful if the EOP or abnormal procedure used for each accident sequence was noted.

Add a table showing the EOPs or abnormal procedures used for each accident sequence.

EOPs and AOPs are documented in related tables in the Success Criteria Notebook This issue was resolved and therefore has no impact on TMRE.

A2-3101 Resolved AS-A10 RG1.200 Peer Review F&O AS-A10-01, Finding The operation actions are not specified in either the accident sequence detailed description or the event tree. An example would be a detailed discussion of the once through cooling and the operator actions required.

Specify the operator actions in either the accident sequence detailed description Operator actions were included in the Success Criteria and Accident Sequence notebooks. Detailed discussions regarding operator actions are found in the HRA notebook.

This issue was resolved and therefore has no impact on TMRE.

A2-3102 Resolved AS-B1 RG1.200 Peer Review F&O AS-B1-01, Finding The special initiators do not address the impact of these initiators on the mitigating systems.

A table was added to the Accident Sequence notebook to address the issue.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 37 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3102 (continued)

Proposed resolution as depicted in ILRT extension RAI to NRC:

ANO-2 uses a linked fault tree approach where the initiating events are placed in the tree with the appropriate system model. A table will be added to the accident sequence report to show how the IE fails both the front line and support systems. This finding will not impact any applications.

A2-3103 Resolved AS-B2 RG1.200 Peer Review F&O AS-B2-01, Finding he dependencies are not addressed in the Accident Sequence notebook.

This is especially true of operator actions and how the failure of an operator action would affect subsequent operator actions.

The Event Trees and discussion address required systems. Operator actions and dependencies are included in the HRA notebook.

System dependencies are documented in the systems notebooks.

This issue was resolved and therefore has no impact on TMRE.

A2-3104 Resolved AS-B3 RG1.200 Peer Review F&O AS-B3-01, Finding No assumption or statement is made that plant equipment will perform in the environment for which it was designed. There also was no evidence that equipment not specified in the SAR for accident mitigation but still credited in the PRA were reviewed for environmental affects.

A2-3104 Resolved

Enclosure Attachment 2 to 0CAN041904 Page 38 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3104 (continued)

This could be an assumption that the equipment meets the environmental qualification. Equipment that is not environmentally qualified need to be analyzed on the impact they have on the applicable accident sequence.

A2-3105 Resolved AS-B6 RG1.200 Peer Review F&O AS-B6-01, Finding This SR was not met because there was no discussion of the following: changes in environmental conditions, shifting of the Condensate Storage Tanks (CSTs),

and operator actions. Questions were raised in that ANO2 uses 40 minutes as the time that the Reactor Coolant Pump (RCP) can run without Component Cooling Water (CCW) cooling. The industry practice (WCAP-16175) uses 20 minutes. This difference should be analyzed and resolved.

Discuss the following: changes in environmental conditions, shifting of the CSTs, and operator actions.

20 minutes instead of 40 minutes has been used for RCP running without CCW cooling in AS and SC notebook.

20 Minutes has been used in the PRA, updated in the HRA spreadsheets and documented in the AS and SC notebooks.

Environmental issue was discussed in system documentation.

This issue was resolved and therefore has no impact on TMRE.

A2-3107 Resolved AS-C2 RG1.200 Peer Review F&O AS-C2-01, Finding The documentation does not show that the items in this SR have been addressed.

Address all the items in this SR in the assumption section.

All the items in the SR were incorporated in the Accident Sequence documentation.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 39 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3116 Resolved SY-A4 RG1.200 Peer Review F&O SY-A4-01, Finding Walkdowns will need to be performed in order to support National Fire Protection Association (NFPA) 805 Fire PRA and Flooding initiator. This SR can be accomplished during this process.

Fire PRA walkdowns for NFPA-805 are documented in ANO Calculation CALC-08-E-0016-01, Appendix D.

While this walkdown documents some spatial and environmental impacts due to a fire in the area, the documentation for internal events is somewhat different. MCR A2-3119 addresses the documentation of walkdowns and operator interviews for internal events.

This issue was resolved and therefore has no impact on TMRE.

A2-3118 Resolved SY-A8 RG1.200 Peer Review F&O SY-A8-01, Finding The EDG air start system is included in the component boundary of the EDG for failure rate and common cause but is still modeled in the fault tree with non-zero probabilities.

The diesel generator air start system is considered part of the emergency diesel generator component boundary as discussed in NUREG/CR-6928 and Echelon Calculation PRA-ES-01-003.

Therefore, the diesel air start basic events will be set to a probability of 0.0 in the ANO-2 database. The events will be retained in the model for EOOS purposes.

This issue was resolved and therefore has no impact on TMRE.

A2-3119 Resolved SY-B8 RG1.200 Peer Review F&O SY-B8-01, Finding No documentation of spatial and environmental hazards assessment was found.

System walkdowns and interviews were performed during the ANO-2 PRA Model 5p00 update and documented in the system notebooks. All PRA systems that are normally accessible were physically walked down to assess both special and environmental hazards.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 40 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3119 (continued)

Resolved SY-B8 LKB Comments 9/4/2014 - MCRs A2-2462 and A2-2466 is Resolved to this MCR due to similar PSA Gap Analysis finding. Ensure that any additional issues from MCR A2-2462 and A2-2466 are addressed as part of this MCR.

MCR A2-5337 documents the plan to walkdown systems located inside containment.

For each walked down system, an interview was also conducted with the responsible system engineer to discuss the state of each system.

This issue was resolved and therefore has no impact on TMRE.

A2-3121 Unresolved SY-B15 RG1.200 Peer Review F&O SY-B15-01, Finding There was no indication in any of the three systems reviewed that an assessment was completed to determine if the SSCs will be required to operate in conditions beyond their environmental qualifications.

A discussion of how the system will respond in harsh environments has been added in the Rev 6 model documentation.

In order to address the generic review/comment, this discussion was expanded to state the following:

The internal flooding analysis performed walkdowns of the steam and water lines in the plant, and identified the PRA credited equipment in each room that was potentially susceptible to flooding, spray, and a steam environment due to a pipe break in the room. The internal flood analysis includes scenarios that model these impacts specifically, so they are not duplicated in the internal events PRA. Refer to the ANO-2 internal flood analysis for additional details.

A2-3121

Enclosure Attachment 2 to 0CAN041904 Page 41 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3121 (continued)

The ability of the system equipment to continue to operate following a loss of HVAC in the areas where system equipment is installed is addressed by either by modeling a loss of HVAC as a failure of the impacted equipment, or justifying the basis for why the equipment is reasonably expected to continue to operate with HVAC. The original bases for why a loss of HVAC does not fail the equipment in the system is documented in Section #.2.2, if applicable. The success criteria notebook may revise these assumptions if additional room heat-up analyses are performed which provide additional insights into the impact of a loss of HVAC on the system equipment A2-3124 Resolved HR-C2 RG1.200 Peer Review F&O HR-C2-01, Finding CC-I was assessed to be met, but there is no direct evidence that ANO2 evaluated plant-specific or generic operating experience to check for other pre-initiators. Documentation of a review of plant specific information or industry Licensee Event Reports (LERs) from other similar plants and incorporating this information into the HRA assessment is required to receive a CC-II/III rating.

A review of ANO-2 Condition Reports was performed. The resulting search yielded 39 condition reports. The review of these CRs showed most of the events involved instruments that were slightly out of calibration. Other events resulted in equipment that remained Operable and thus would not be PSA Applicable. The CR review spreadsheet is included in App I of PSA-ANO2-01-HR.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 42 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3124 (continued)

Resolved HR-C2 Incorporate an assessment of the plant-specific or generic operating experience information into the HRA assessment.

A2-3125 Resolved HR-D3 RG1.200 Peer Review F&O HR-D3-01, Finding Not assessed consistent with CC II since the evaluation does not provide an assessment of the quality of the procedures or the quality of the human-machine interface.

Provide an assessment of the quality of the procedures and the human-machine interaction. If this has been done, provide the documentation.

A review of quality of ANO-2 procedures was performed. A review of Condition Reports identified two condition reports associated with procedure quality.

CR-ANO-C-2009-00716 and CR-ANO-C2010--01876 were written to correct issues with procedure quality.

CR-ANO-C-2009-00716 is based on an INPO Area for Improvement and includes more than 200 corrective actions that have been completed.

CR-ANO-C-2010-01876 provides 4 recommendations from an INPO Assist Visit that resulted in an additional 31 corrective actions.

Text was added to the HRA Notebook regarding general procedure quality. A discussion was also added to the section on Quantification Using the Cause-Based Approach to highlight that it does consider specific aspects of the quality of the procedures (in decision trees e-g) and human-machine interface (in decision trees a-d).

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 43 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3126 Resolved HR-D6 RG1.200 Peer Review F&O HR-D6-01, Finding ANO2 uses the HRA Toolbox for quantifying their pre-initiator HEPs.

For the pre-initiator HEPs, ANO2 basically uses the ASEP approach and treats the ASEP Basic HEPs as means with the associated error factors. However, as defined on page xv of NUREG/CR-4772, the ASEP BHEP values are medians for a log-normal distribution. Thus, the treatment of the BHEP values for the pre-initiators is mathematically incorrect.

A conversion formula was added to the bottom of each of the individual hfe_a events and to the a_template templates in the HRA Toolbox so that future pre-accident HRAs will have the conversion from medians to means.

The median to mean conversion is shown in cell I64 and the mean probability is shown in cell F64. In addition, cell AH41 was changed to equal F64 to provide the mean value to the hfe_summary.xls.

The values are changed in PRA-A2-01-003S03, Revision 2.

This issue was resolved and therefore has no impact on TMRE.

A2-3127 Resolved HR-G6 RG1.200 Peer Review F&O HR-G6-01, Finding This SR requires a check of consistency of the post-initiator HEP quantification. This requires a review of the HFEs and their final HEPs relative to each other to check their reasonableness. There is no evidence that this consistency check has been done. If done this should be documented, if not done this should be completed.

HRA events were reviewed for consistency and was documented in the HRA notebook.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 44 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3127 (continued)

This can be addressed by adding an explicit process for reviewing the HEPs for internal consistency with respect to scenario, context, procedures and timing.

Specifically this can evaluate the HEPs with respect to certain expected patterns such as increasing HEPs with decreasing time available, increasing HEPs with increasing stress levels, and increasing HEPs with increasing complexity of the procedures for accomplishing the desired successful outcome. A statement that such an evaluation was performed and, where there were deviations from the expected patterns and either provides a basis for the deviation or what was done to correct it.

A2-3128 Resolved HR-G9 RG1.200 Peer Review F&O HR-G9-01, Finding This requires the use of means values. NUREG-1278 contains median values that do not appear to be converted to means before being used in the ANO2 PRA. For example, spread sheet used for HRA at ANO2.

The execution errors in hfe_cp.xls are shown in cells CC16:CC61. These values are medians. To convert to means, the median values were moved to cells CE16:CE61. The error factors from NUREG/CR-1278 were added in cells CF16:CF61.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 45 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3128 (continued)

Cells CC16:CC61 are changed to

=CE??*EXP(POWER(1/1.645*LN(K6 1),2)/2) where ?? is the associated median value in the accompanying CE cell. This change was made in all hfe_cp worksheets including cp_template, in the HRA Toolbox, which will ensure that future procedural operator actions will be calculated based on means rather than medians. The values are changed in PRA-A2-01-003S03, Revision 2 A2-3129 Resolved DA-A1a RG1.200 Peer Review F&O DA-A1a-01, Finding Boundary developed for EDG starting air was outlined in PRA-ES-01-003 included the start air system inside the component boundary. The CAFTA model had the starting air modeled with Basic Events (BEs) set greater than zero, effectively placing the starting air outside the component boundary. See F&O SY-A8-01 for details.

Starting air basic events were set to 0.0 in basic event file but left in model to allow EOOS modeling if needed.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 46 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3130 Resolved DA-C10 RG1.200 Peer Review F&O DA-C10-01, Finding CAT I given based on information listed in Procedure PRA-A2-01-003S05 does not address decomposing the component failure mode into sub-elements (or causes) that are fully tested, then using tests that exercise specific sub-elements in their evaluation.

May be over-counting demands and run-hours for component boundaries that are not tested during evolution.

Need to review component boundaries and tests counted in data collection to ensure that one sub-element does not have many more successes than another.

Update procedure CE-P-05.07 with process details that ensure the requirements described in CAT II/III are met.

Documented in the Data Analysis Notebook. Data provided addresses the component boundaries and re-testing.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 47 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3131 Unresolved DA-C12 RG1.200 Peer Review F&O DA-C12-01, Finding Procedure PRA-A2-01-003S05 addresses evaluating maintenance outage as a function of plant status.

CAT I given since there is no evidence of INTERVIEW the plant maintenance and operations staff to generate estimates of ranges in the unavailable time per maintenance act for components, trains, or systems for which the unavailabilities are significant basis events. As a suggestion, need to include interviews and shared equipment between ANO1 and ANO2 (i.e., air compressors) in procedure PRA-A2-01-003S05 Need to document interviews in order to meet Category II/III.

Update procedure CE-P-05.07 with process to perform interviews with plant maintenance and operations staff to generate estimates of ranges in the unavailable time per maintenance act for components, trains, or systems for which the unavailabilities are significant basis events. Document interviews.

Actual plant data were obtained for most risk significant unavailability terms in the model. The other risk significant terms used estimates that were provided by the PRA staff and the Maintenance Rule Coordinator.

See Section 1.4 and Table 7 of PSA-ANO2-01-DA, Revision 1.

Procedure CE-P-05.07 has been superseded by fleet procedure EN-DC-151. In addition, engineering guide EN-NE-G-007 includes guidance to obtain and document data from plant personnel.

This is a documentation issue and has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 48 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3133 Resolved IF-A1 RG1.200 Peer Review F&O IF-A1-01, Finding, Applicable to all IF SRs.

At the time of the peer review, the ANO2 IF analyses had not been completed to the point that it could be reviewed. Entergy intends to use the same IF methodology for all three of their PWRs with the Waterford-3 plant being the lead plant. The Waterford-3 IF analysis had been completed.

Entergy requested that the peer review team review the IF methodology for Waterford to confirm that the methodology met the standard. Entergy needs to complete the ANO2 IF analyses using the Waterford-3 methodology. Entergy will need to specifically address dual unit issues for ANO1 and ANO2.

An internal flood analysis update was completed and met standard requirements. The analysis incorporates updated walkdowns and quantifies scenarios that were screened out in previous revisions.

This issue was resolved and therefore has no impact on TMRE.

A2-3134 Resolved IF-C2c RG1.200 Peer Review F&O IF-C2c-01, Finding Equipment height off floor appears to be not recorded for most of the equipment on the walk down sheets.

For example, flood area TB-15-250 walkdown sheet on page 460 only 3 of 26 items listed include a height.

Flooding documentation forms have input for height above floor, but only filled them in for cases where the components might be susceptible to inundation from flood sources.

Therefore, no additional information needed.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 49 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3134 (continued)

Spatial location in the area (for example height off floor) and any flooding mitigative features (e.g.,

shielding, flood or spray capability ratings) is not recorded for most of the PRA components listed on the walkdown sheets. Therefore, for a particular flood height in a room, it is not clear whether or not a component is affected. Complete the walkdown sheets.

A2-3135 Resolved IF-C3 RG1.200 Peer Review F&O IF-C3-01, Finding The walk down sheets identify the components located inside the flood area. This SR requires that components in a flood area be identified and include whether the component is susceptible to failure by submergence or spray. The walkdown sheets are formatted to allow recording whether or not the component is vulnerable to spray.

Only several walkdown sheets have the column filled out for vulnerability to spray. It is not clear whether blanks indicate not susceptible to spray or not.

Flooding documentation forms have input for height above floor, but only filled them in for cases where the components might be susceptible to inundation from flood sources.

Therefore, no additional information needed.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 50 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3137 Unresolved IF-D6 RG1.200 Peer Review F&O IF-D6-01, Finding Operator error contributions to flooding are discussed at a very high level. However, basically the only floods considered were catastrophic failures. The flood scenario frequencies were quantified using generic pipe rupture data and plant-specific pipe length. The generic flood frequency sources do not include floods caused by human actions during maintenance. While the operator induced floods may be less severe than the catastrophic pipe failure floods, the frequencies will be higher so should be considered explicitly.

A2-3137 Unresolved A2-3142 Resolved QU-F4 RG1.200 Peer Review F&O QU-F4-01, Finding Selection process for determining important assumptions and sources of uncertainty was not delineated.

LKB Comment 9/8/2014 - MCR A2-2464 is closed to this MCR.

Ensure that the issues from MCR A2-2464 are addressed when closing this MCR.

Appendix 1 of the Sensitivity and Uncertainty includes a review of the sources of uncertainty using EPRI 1016737.

This issue was resolved and therefore has no impact on TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 51 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3144 Unresolved LE-D1b RG1.200 Peer Review F&O LE-D1b-01, Finding There is no evidence of an evaluation of the impact of the accident progression conditions on containment seals, penetrations, etc. The model this is based on is related to NUREG/CR-6595 so consistency with NUREG/CR-6595 meets CC-I, but there is no discussion of the accident progression conditions on these elements. Provide a discussion or assessment of the accident progression conditions on the containment conditions noted in the SR.

The LERF model and documentation is being updated as part of the Rev 6 update to include impact of accident progression conditions on containment seals, penetrations, etc.

Minimal or no impact on the results since assumptions are conservative.

As noted in Table 8, SR LE-D1b (LE-D2 in ASME/ANS RA-Sb-2013 and Table 9) is met to CC I.

The ANO-02 LERF model is based on NUREG/CR-6595 which meets CC-I. Table 9 does not identify any specific TMRE comments for LE-D2.

This Unresolved F&O does not impact the PRA quality and has no impact on the TMRE analysis.

A2-3145 Unresolved LE-D6 RG1.200 Peer Review F&O LE-D6-01, Finding Containment isolation is addressed by top event (question) 3. This is based on a calc that is noted not to have been maintained up to date. Since it has not been maintained up-to-date, there is no confidence that the analysis represents a realistic assessment; therefore, this does not meet CC II.

The containment isolation calc needs to be updated or demonstrated (confirmed) to be up to date. This should include an assessment of the containment penetrations to provide an assessment of the total number of penetrations required to provide a realistic evaluation of containment isolation reliability.

Containment isolation model is currently being updated as part of the Rev 6 model update Minimal or no impact on the results.

The LERF documentation and system notebooks and model are being updated as part of the Rev 6 model revision.

As noted in Table 8, SR LE-D6 (LE-D7 in ASME/ANS RA-Sb-2013 and Table 9) is met to CC I.

The ANO-02 LERF model is based on NUREG/CR-6595 which meets CC-I. Table 9 does not identify any specific TMRE comments for LE-D7. Therefore, this open item has no impact on the TMRE analysis.

Enclosure Attachment 2 to 0CAN041904 Page 52 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3147 Resolved LE-E4 RG1.200 Peer Review F&O LE-E4-01, Finding Although the majority of the SR requirements in these three top high level requirements are met, there is no indication that dependencies between multiple HFEs have been addressed. The Level 1 assessment completed an evaluation of the dependencies between human actions in the model. A similar analysis should be completed for the human actions in the Level 2 analyses and between the Level 2 and Level 1 analyses to ensure all HEP dependencies are identified and addressed appropriately.

Fixed recovery file for LERF to deal with potentially dependent HEP combinations. About 5 new HEP dependency combinations were identified and entered in the HRA tool box using the method of iterative review of the top 100 cutsets.

Assumption 35 was added to the LERF notebook that states the following:

"Assumption: HRA dependencies among Level 1 and Level 2 human failure events and among multiple Level 2 human failure events does not require additional modeling.

Justification: The Level-1 and Level-2 operator actions were assumed to be independent, because they are performed by different plant personnel and at different plant conditions and are separated by time. Dependencies between Level-2 operator actions were also assumed to be independent of each other.

A2-3147

Enclosure Attachment 2 to 0CAN041904 Page 53 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Number Status Applicable SR(s)

Finding/Observation Disposition Importance to Application A2-3147 (continued)

Most of the Level 2 operator actions are included in the split fraction for various Level 2 phenomena; these phenomenological events are conservatively modeled based on the uncertainty of post-core damage activities. Those that are explicitly modeled were judged to be independent, because they address unique plant conditions or phenomena. The dependence between operator actions is included in the uncertainty of the Level 2 split fractions."

A2-3148 Unresolved LE-F1b RG1.200 Peer Review F&O LE-F1b-01, Finding There is no documented evidence that ANO2 compared their LERF results to the results of other similar plants to confirm the reasonableness of the results with respect to relative contribution and frequency and ranking of contributors.

Minimal or no impact on the results. This is a documentation issue only. This Unresolved F&O does not impact TMRE.

Enclosure Attachment 2 to 0CAN041904 Page 54 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 MCR Number EC or Procedure Description of Change Impact on TMRE Application A2-4934 OP-2202.008 B5b actions/equipment can potentially be credited in the model to provide an alternate feedwater and Refueling Water Tank / Borated Water Storage Tank (RWT/BWST) makeup from the B5b portable fire pump. By having an additional pump to Emergency Feedwater / Auxiliary Feedwater (EFW/AFW) for long term scenarios can provide some benefit for those scenarios.

Also procedure SDS-007, Change 002, contains the following statement that could add additional actions in the PRA: IF Unit 1 has AC power, THEN consider performing Security Event (OP-1203.048), Attachment G, Cross-Tying 4160 V Busses Between Units.

Blackout Procedure 2202.008, Rev. 12, provides a reference to OP-1203.048 for supplying power from Unit 1 to Unit 2 via 2A9. Once procedure OP-1203.048 is reviewed, there may be additional actions that can provide enhancement to the PRA model. For crediting B5b equipment/procedures, reference to the security procedure, Security Event (OP-1203.048).

This modification involves use of equipment that is stored in non-Cat 1 structures and vulnerable to tornado missiles. However, implementation of the modification would potentially lower CDF/LERF for both the compliant and degraded TMRE cases. Since the equipment is vulnerable in both cases, delta CDF and LERF is unlikely to change from the current base case.

A2-5242 EC-35406 Event occurred documented in CR-ANO-1-2009-0225 where reactor was tripped due to air intrusion into the Intermediate Cooling Water (ICW) system as a result of a blown gasket on the Service Air (SA) compressor C-3A.

Resulted in a loss of cooling water to Control Rod Drive motors. Root Cause Evaluation determined original system design was inadequate in the Unit 1 SA compressors. This change will result in the removal of Unit 1 Compressors C-2A, C-2B, C-3A and C-3B. This change impacts the Unit 2 Instrument Air (IA) via the cross-tie with Unit 1. Incorporate the changes from these MCRs in the Unit 2 model.

The ICW pumps as well as the service and instrument air compressors rely on offsite power which is assumed lost for the TMRE models. Therefore, this item would have no impact on the TMRE application.

A2-5410 EC-58330 &

58331 EC-58330 and EC-58331 are proposed to replace the existing IA compressors with more robust compressors. Check valves (2IA-1A, 2IA-1B) will be removed in these ECs since there will be internal check valves (2IA-401A/B) that are already included which are modeled.

The service and instrument air compressors rely on offsite power which is assumed lost for the TRE models. Therefore, this item would have no impact on the TMRE application.

Enclosure Attachment 2 to 0CAN041904 Page 55 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 (continued)

MCR Number EC or Procedure Description of Change Impact on TMRE Application A2-5773 EC-54590 Associated with Diverse and Flexible Coping Strategies (FLEX), and applying RG 1.76, Rev. 1, to the qualified condensate storage tank (QCST), BWST, and RWT for FLEX strategy. This EC calculates the duration of time the QCST/BWST/RWT are available post the initiation of a beyond-design-basis-external-event. The time available can be used by the success criteria calculation to determine when/how to credit these strategies.

This modification has to the potential to lower the TMRE CDF/LERF results. While these tanks may survive global wind and tornado missile forces credit for the actions within one hour is not allowed. Use of the equipment beyond one hour requires the initial success of equipment for which the equipment would be used. Because the PRA model does not include such time phasing, modelling of these items is not possible and, therefore, this item would have no impact on the TMRE application.

A2-5774 EC-28690 ANO2 Auxiliary Building High Energy Line Break (HELB) analysis. This analysis can be used in the PRA to identify which PRA modeled equipment is potentially susceptible to HELB environments, and can potentially help justify crediting equipment operation in these environments or making sure that equipment that are susceptible to these environments are not credited without justification under accident scenarios that could create the HELB environment.

This modification is intended for HELB accident sequences and therefore is expected to have no impact on the TMRE applications.

A2-5829 EC-58247 NFPA 805 Common Feedwater (CFW) Unit 2 Piping. In order to mitigate a loss of EFW during a plant fire, two separate CFW pumps that provide condensate independent of the existing EFW/AFW systems are installed at ANO. The CFW design installs a CFW system, capable of providing an alternate source of condensate to the steam generators of either unit in the event of certain fire scenarios.

The CFW system includes two (2) electric AC motor-driven pumps that meet the Unit 2 minimum performance requirements for the existing EFW pump 2P-7B.

CFW system requires offsite power and, therefore, cannot be credited in the TMRE model. Therefore this modification would have no impact on the TMRE application.

Enclosure Attachment 2 to 0CAN041904 Page 56 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 (continued)

MCR Number EC or Procedure Description of Change Impact on TMRE Application A2-5936 EC-72499 Unit 2 Low Pressure Safety Injection (LPSI) system pump 2P-60B (500 HP)

Allis-Chalmers motors inboard or drive end bearing is damaged and replaced with a Siemens motor (450 HP).

Per the engineering change, the new LPSI pump meets all the associated design criterion required. The difference in model number and rated horsepower do not affect thee PRA success criteria. This modification has no impact on the TMRE application.

A2-6020 OP-2104.039 High Pressure Safety Injection (HPSI) System Operation: When HPSI pump 2P-89C (swing HPSI pump) is aligned to the red train, manual valve 2SI-66 in the HPSI mini-flow recirc line should be locked open and 2SI-67 should be closed. And, when HPSI pump 2P-89C is aligned to the green train, manual valve 2SI-66 should be closed and 2SI-67 should be open. The current model does not account for the green train alignment; the model should be revised to address this issue.

The PRA model assumes that the HPSI pumps would require minimum flow recirculation only for small loss of coolant accident (LOCA) events during the initial period of the event when Reactor Coolant System (RCS) pressure is greater than shutoff head of the pumps. Tornado events do not result in small LOCA events, therefore, this item would have no impact on the TMRE application.

Enclosure Attachment 3 to 0CAN041904 ANOs Review of Pilot Plant RAIs

Enclosure Attachment 3 to 0CAN041904 Page 1 of 26 ANOs Review of Pilot Plant RAIs Table 1 provides a matrix of the NRCs Request for Additional Information (RAIs) by RAI number as requested of each pilot plant and for communication purposes the corresponding item number Entergy Operations, Inc. (Entergy), has assigned to each. If N/A is assigned as the Arkansas Nuclear One (ANO) Item number, the pilot RAI has been reviewed and determined to be not applicable to ANO. Following the table, Entergy has provided the original text from only one of the applicable pilot RAIs, including pilot plant specific information, and Entergys response to assist in the NRCs review.

Table 1 - RAI Matrix ANOs Item #

Vogtle Harris GGNS RAI Subject 1

1 1

1 Containment Building 2

2 2

2 Missile Hit Probabilities (MIP) for Elevated Targets 3

3 3

3 Process for Determining Near-Ground and Elevated Targets; Hit Probabilities 4

N/A 4a 4

Other Initiating Event 5

4 4b 5

Secondary Effects 6

5a 5a 6a Construction-Related / Temporary Missiles 7

5b 5b 6b Outage-Related Missiles 8

5c 5c 6c Building Missile Count 9

6 6

7 Missile Types and Robust Targets 10 7

11 N/A De Minimis Penetrations 11 8

8 8

Vertical and Directional Missiles 12 9

9 9

Structures, Systems, and Components (SSCs) Important to Safety 13 10 N/A 12 Defense-in-Depth 14 11 10 13 Safety Margin N/A N/A N/A 10 Grand Gulf Nuclear Station (GGNS)

Plant Specific Defense-in-Depth 15 12 11 14 Regulatory Guide (RG) 1.174 Acceptance Guidelines

Enclosure Attachment 3 to 0CAN041904 Page 2 of 26 Table 1 - RAI Matrix ANOs Item #

Vogtle Harris GGNS RAI Subject N/A N/A N/A N/A GGNS Plant Specific Use of Diverse and Flexible Coping Strategies (FLEX)

FLEX was not credited in ANO Tornado Missile Risk Evaluator (TMRE) Probabilistic Risk Assessment (PRA) 16 13 12 15 TRME Implementation 17 14 13 16 SSC Failure Modes 18 15 14 17 Operator Actions 19 16 15 18 Exceedance Probabilities N/A 17 N/A N/A Vogtle Plant Specific Failure of SSCs in Non-Category 1 Structures.

N/A 18 N/A N/A Vogtle Generation III Westinghouse shutdown seals ANO does not have Westinghouse shutdown seals N/A N/A N/A 19 GGNS Plant Specific Inconsistency in Information related to vulnerable SSCs N/A N/A N/A N/A GGNS Plant Specific Facts and Observations (F&Os) question is N/A; however FLEX portion of question applies FLEX was not credited at ANO N/A N/A N/A 21 GGNS Plant Specific F&Os N/A N/A N/A 22 GGNS Plant Specific F&Os N/A N/A N/A 23 GGNS Plant Specific Loss of Offsite Power (LOOP) initiators 20 19 16 24 Sensitivity Analysis 21 20 17 25 Uncertainties with Missile Impact Distribution 22 21 N/A 28 Key Assumptions N/A N/A N/A 26a GGNS Plant Specific Truncation N/A N/A N/A 26b GGNS Plant Specific Inconsistent Information Related to Compliant Case Quantification

Enclosure Attachment 3 to 0CAN041904 Page 3 of 26 Table 1 - RAI Matrix ANOs Item #

Vogtle Harris GGNS RAI Subject N/A N/A N/A 26c GGNS Plant Specific CST Dominant Contributor N/A N/A N/A 27 GGNS Plant Specific Sensitivity /

Basic Event Failure Probability Item 1 - Containment Building Request:

Section B.2.3, Selection of Target Missile Hit Probabilities (P) For Developing MIP [Missile Hit Probabilities], of Nuclear Energy Institute (NEI) topical report NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, September 2017, which contains the TMRE methodology (ADAMS Accession No. ML17268A023), states, in part:

Choosing the most conservative target MIP from NP-768 [Electric Power Research Institute, Topical Report EPRI NP-768, Tornado Missile Risk Analysis, May 1978.

https://www.epri.com/#/pages/product/NP-768/] (Target 4) would lead to overly conservative results for many targets at a NPP [nuclear power plant]. Therefore, the normalized tornado missile impact probability from All Targets in NP-768 (from Table 3-15) is proposed for use in the TMRE. This results in a MIP that is based on the combined hits on all modeled surfaces in NP-768, Plant A.

The derivation of the MIP includes the containment building (Target 1). As stated in NEI 17-02, Revision 1, Section B.2.3, in part:

[t]he containment building is surrounded by other buildings so only the upper part of the containment is exposed to tornado missiles.

Additionally, the elevation of the exposed upper part of the containment is different from the elevation of other targets included in the calculation of near ground missiles.

Due to the overall height and the large surface area of the containment building, many missiles may be unable to reach upper portions of the containment building, which reduces the overall density of missile strikes and could become unrepresentative of other shorter plant buildings.

Section 3.2.3.2, Missile Impact and Damage Probability Estimates, of the Electric Power Research Institute (EPRI) topical report NP-768, Tornado Missile Risk Analysis, May 1978, states, in part:

[t]he individual target contributions to the total hit probability is generally greater for the larger targets but least for the containment structure (7.65 x 10-10, Table 3-8) which is shielded from impact for the first 60 feet [(ft.)] above ground elevation.

Enclosure Attachment 3 to 0CAN041904 Page 4 of 26 Justify including Target 1 (containment building) of Plant A in EPRI NP-768 in computing the average MIP for targets less than 30 ft. above grade, given that the containment building is shielded by other buildings and is not impacted by near ground missiles. Discuss how inclusion of Plant A containment building in computation of the average MIP for targets less than 30 ft.

above grade impacts this application.

Entergys Response:

The need to explicitly address the issue identified in this series of RAIs has been obviated by the change in MIP values provided in Revision 1B of NEI 17-02. In that revision, the containment building was removed from the calculation of near-ground MIP values presented in Table 5-1. These revised MIP values were used in the external equipment failure probability (EEFP) calculations.

Item 2 - Missile Impact Parameter for Elevated Targets Request:

Section B.4, MIP Values for Use in the TMRE, of NEI 17-02, Revision 1, provides two sets of MIP values, one for elevated targets and one for near ground targets. The demarcation between near ground and elevated targets is 30 ft. above the primary missile source for a target. For targets near the ground, the MIP appears to be derived using the target areas listed in Table B-2 of NEI 17-02, Revision 1, which generally excludes the area of the roof (with an exception for Target 6, which includes the area of the roof). For the elevated MIP value, the area used to derive the MIP includes all the areas listed in Table B-1 of NEI 17-02, Revision 1, which includes roof areas.

a.

The EPRI topical report NP-768 Plant A targets vary in height from 20 to 230 ft. With the exception of the Target 1 (containment building), the buildings range in height from 20 to 80 ft. The weighted average (weighted by the wall area) height of all targets is 94 ft. The weighted average (weighted by the wall area) height of the targets is 56 ft. if Target 1 is excluded.

Provide the basis for the 30 ft. demarcation between near ground and elevated targets, given that EPRI NP-768 Plant A buildings range in height from 20 to 230 ft.

b.

The MIPs calculated for elevated targets in Section B.4 are about 54 percent of the MIPs calculated for near ground targets. This percentage seems to reflect the assumptions with respect to areas included in calculation of MIPs for elevated and near ground targets. The difference in area appears to be the only factor that determined the difference between MIPs for elevated and near ground targets. One of the sensitivity analyses in Appendix E of NEI 17-02, Revision 1, examines the impact of target elevation on target hit probabilities.

Revision 1 of NEI 17-02 states that the results of this sensitivity analysis show that in general as target elevation increases, hit probability decreases.

Describe the relationship between the numerical results shown in Appendix E and address whether the Appendix E results are generally consistent with the ratio of elevated to near ground MIPs calculated in Appendix B, Bases for MIP and Missile Inventories. If Appendix E numerical results are not consistent with the ratio calculated in Appendix B, provide a justification.

Enclosure Attachment 3 to 0CAN041904 Page 5 of 26 Entergys Response:

a.

The need to explicitly address the issue identified in this series of RAIs has been obviated by the use of Revision 1B of NEI 17-02. In that revision, Section B.3.4 was added to provide the bases for the 30-foot demarcation.

b.

The need to explicitly address the issue identified in this series of RAIs has been obviated by the use of Revision 1B of NEI 17-02. In that revision, Section B.3.4 was added to provide the bases for the 30-foot demarcation.

Item 3 - Process for Determining Near Ground and Elevated Targets and Hit Probabilities Request:

Section 5, Evaluate Target and Missile Characteristics, of NEI 17-02, Revision 1, states, in part, that:

[t]he <30 ft. MIP value can be used in cases where it is difficult to determine if the target is

>30 ft. above all missile sources.

Table 5-1 in NEI 17-02, Revision 1, refers to targets that are 30 ft. above or below grade, and Note 2 to the table explains:

[t]he term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

The above discussions in Sections 5 and 5.1 of NEI 17-02, Revision 1, seem to provide different guidance regarding how to determine elevated targets (for which the MIP values are different).

The U.S. Nuclear Regulatory Commission (NRC) staff notes that missiles may exist at elevations above some nominal plant grade or that targets exist at elevations that are above and below the nominal plant grade.

a.

Describe the process that Grand Gulf Nuclear Station (GGNS) has used for determining near ground and elevated targets considering various elevations of targets and missiles.

The description should include how this process ensures proper consideration of missile source applicability for each target relative to the demarcation height.

b.

The hit frequency in EPRI NP-768 is a function of the insertion height of the missiles. In EPRI NP-768, the missiles were assumed inserted from heights ranging from 5 to 50 ft.,

except for cars, which were assumed inserted from 5 to 10 ft.

Address whether the range of cited insertion heights underestimates the hit probabilities.

Enclosure Attachment 3 to 0CAN041904 Page 6 of 26 Entergys Response:

a.

The reference elevation for the ANO site was established as 354 feet. For convenience, the missile walkdowns within the 2500 foot radius were segregated into 38 zones. The total number of missiles in each zone along with the average elevation in each zone were noted as part of the site missile inventory analysis. The average elevation of nearly all the zones was at or near 354 feet. Only four of the zones had an average elevation above 360 feet and those zones contained a total of only 13,378 potential missiles or less than 7%

of the total missile population. Furthermore, those four areas were located at the outer edge of the 2500 foot radius thereby necessitating that any potential missiles in these zones travel farther than the majority of missiles to impact plant components. Given the relative flatness of the site and that the vast majority of missiles are located in areas at or near the reference elevation, the use of the 354-foot reference elevation is considered appropriate.

b.

The TMRE guidance does not require that individual licensees validate missile injection heights based on the data provided in Section B.3.4 of NEI 17-02. Since the NP-768 missile insertion heights are bounded by the sampled data, which is representative of nuclear plant sites in the U.S., it is not required that any individual plant perform this analysis.

Item 4 -Another Initiating Event Request:

Section 3.3.1 of the submittal states, in part, that PRA logic and components that do not support mitigating a [LOOP (loss of offsite power)] can be screened since the TMRE model uses non-recoverable LOOP sequences. Section 6.1, Event Tree/Fault Tree Selection, of NEI 17-02, Revision 1, states that in addition to LOOP event trees, other internal initiating events should also be reviewed to ensure that either (1) a tornado event cannot cause another initiating event or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. It was not clear whether the review discussed in Section 6.1 of NEI 17-02 was performed by Entergy Operations, Inc. (the licensee) to support this submittal. For example, the standby service water cooling tower (SSW CT) fans are an identified vulnerability which, according to Section 3.3.9 of the Enclosure to the submittal, are important in that they support the operation of the emergency diesel generators and the

[emergency core cooling] ECCS systems. The SSW CT fans do not appear to have been reviewed as initiators or as support system losses that need to be included in the sequences.

The walkdowns also appear to have been performed with a focus on the LOOP mitigation and other initiators or support system failures do not appear to have been considered during the walkdowns.

Describe whether a review was performed to ensure that a tornado event cannot cause another initiating event or the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. Provide the results of this review including a discussion of any potential impact on and from walkdowns.

Enclosure Attachment 3 to 0CAN041904 Page 7 of 26 Entergys Response:

The transient tree for ANO-1 and ANO-2 is used to model all transient events such as loss of service water, reactor trip, loss of offsite power, and transient induced consequential events such as anticipated transient without scram, reactor coolant pump seal failure or induced steam generator tube rupture. Therefore, regardless of the immediate cause of the reactor trip signal, the effect of all equipment failures is considered by the logic model. Equipment failed as a result of tornado-induced missiles is added to the CAFTA logic model with the failure probability determined in the EEFP calculations.

Item 5 - Secondary Effects Request:

NEI 17-02, Revision 1, Section 3.2.3, SSC Failure Modes, references consequential failures and describes treatment of identified and documented cases to be addressed in Section 6, Develop TMRE PRA Model, of NEI 17-02, Revision 1. Specifically, the first bullet in Section 3.2.3 characterizes tanks and piping as passive components.

Section 3.2.3 does not appear to include guidance on consideration of secondary effects. Such effects include consideration for fluid-filled tanks and pipes, combustion motor intake effects (loss of oxygen from inert gas tank rupture or exhaust re-direction scenarios), and other potential secondary effects to the SSCs function.

Describe how secondary effects that may result from failure of non-conforming conditions were considered for identification of the initiating events and failure modes in the licensees TMRE development.

Entergys Response:

Section 3.2.3 of NEI 17-02 was updated in Revision 1A to describe secondary effects that should be noted during the walkdown. Section 6.1 was revised and Section 6.5.2 was added to NEI 17-02 in Revision 1B to require evaluation of the secondary effects of tornado missile impacts on nonconforming SSCs.

Because of the large, open nature of the ANO buildings in conjunction with the limited capacity of potential flood sources that could affect non-conforming SSCs, no additional flooding effects not already included in the direct effects of missile impacts would be expected.

The potential for the ANO-2 diesel exhaust stacks to be perforated and impair the ability of running diesels was examined. Given the 30-foot distance between the ANO-2 diesel exhaust and intake along with the vertical distance and buoyancy of the hot exhaust gas, it is considered incredible that failure of one diesel exhaust stack would impact the opposite train diesel intake.

Enclosure Attachment 3 to 0CAN041904 Page 8 of 26 Item 6 - Construction-Related / Temporary Missiles Request:

Section 3.4.3, Temporary Missiles, of NEI 17-02, Revision 1, states that the expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas information in Sections 3.4.2, Non-Structural Missile Inventory, and 3.4.4, Structural Missiles, along with design and construction information. The section states that the basis and assumptions used for the estimated number of post-construction missiles will be documented. The November 3, 2017 license amendment request (LAR)

(ADAMS Accession No. ML17307A440), does not appear to provide a basis for the adequacy of missile counts for post-construction site.

Section 3.4.3 of NEI 17-02, Revision 1, states the total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles. The NEI guidance further states that the basis and assumptions used to determine the conservative construction missile estimate should be documented. The LAR does not appear to provide a basis for the adequacy of construction-related missile counts.

Describe and justify the approach that will be used for the classification of the construction-related missiles in GGNSs future implementation of the TMRE methodology.

Entergys Response:

In future applications of the TMRE methodology, it is unlikely that the number of missiles included in the ANO TMRE calculations will change significantly because ANO is not currently planning any large-scale construction projects. If a proposed construction activity would cause the site missile inventory to increase above the missile count used in the TMRE analysis, an assessment is needed to verify the higher missile count still meets the risk metric thresholds in Section 7.3 or prior NRC approval would be required. Non-permanent construction-related missiles would be considered during plant changes that trigger a TMRE evaluation, and would either be included in the primary analysis or will be analyzed through a sensitivity study.

The ANO missile walkdown was performed in accordance with Section 3.4 of NEI 17-02, Revision 1B. To support the walkdowns the plant was divided into 38 zones and the potential missile count for each zone was determined. The estimate of the number of potential tornado-generated missiles at ANO is 196,498. This estimate includes an estimate of the number of missiles that will be added as part of the London North substation along with non-permanent construction-related missiles associated with the project and identified during the walkdowns.

Non-permanent construction-related missiles will be considered if additional non-conforming SSCs are identified, and will either be included in the primary analysis or will be analyzed through a sensitivity analysis per NEI 17-02, as a matter of process.

Enclosure Attachment 3 to 0CAN041904 Page 9 of 26 Item 7 - Outage-Related Missiles Request:

Section 3.4.3 of NEI 17-02, Revision 1, states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site.

It does not appear that GGNS has considered additional equipment (such as outage conditions) in estimating the number of missiles.

Clarify whether plant specific outage-related missiles were considered in the total number of missiles used for GGNS TMRE implementation. Provide a justification if those missiles are not considered in estimating the total number of missiles at the site.

Entergys Response:

Consistent with the guidance provided in NEI 17-02, Revision 1B, additional outage missiles were not considered as part of the TMRE walkdown. Not explicitly considering outage-related missiles is an acceptable approach as outage durations are short and at multi-unit sites such as ANO, the outages are staggered such that only one unit is in an outage at a time.

Additionally, scaffolding parts/accessories provide the majority of additional missiles during an outage. These scaffolding pieces are normally stored onsite and are already included in the missile count from a different plant area. Other equipment (machinery, trailers, and vehicles) would result in a small percentage increase as compared to the missile count of 240,000 that was used in the TMRE analyses. The total missile count at ANO is 196,498. Since this is bounded by the generic value of 240,000 provided in NEI 17-02, Revision 1, the missile count of 240,000 was conservatively utilized in calculating EEFPs. Any additional outage missiles at ANO, which are not already included in the count for another area, are expected to be bounded by the generic missile count of 240,000.

Item 8 - Building Missile Count Request:

Section 3.4, Tornado Missile Identification and Classification, of NEI 17-02, Revision 1, provides guidance for verifying the number of missiles resulting from the deconstruction of various types of buildings through the TMRE walkdown.

The guidance does not appear to involve walkdowns to count the potential missiles a non-Category I building contains inside the structure or to count missiles that would be generated by the deconstruction of the structure itself. The guidance should ensure that the missile inventories from building deconstruction are not under predicted for a specific plant.

i.

For each type of building addressed in NEI 17-02, Revision 1, explain how plant specific missile count considers building contents (i.e., materials that are not part of the building itself but available to become missiles if the building is hit).

Enclosure Attachment 3 to 0CAN041904 Page 10 of 26 ii. For those types of buildings where the NEI 17-02, Revision 1, methodology was applied, verify that the overall estimate of non-structural missiles within buildings is representative or bounding.

Entergys Response:

i.

As detailed in Section 3.4.4 of NEI 17-02, Revision 1B, building contents are included in Tables 3-3 through 3-8 and validation of sitespecific building contents is not required by individual licensees.

ii.

As detailed in Section 3.4.4 of NEI 17-02, Revision 1B, building contents are included in Tables 3-3 through 3-8 and validation of sitespecific building contents is not required by individual licensees.

Item 9 - Missile Types and Robust Targets Request:

Sections 5.2, Missile Inventories, and 5.2.1, Missile Inventory Example, of NEI 17-02, Revision 1, explain that a bounding inventory of missiles was developed from a survey of five plants along with a generic distribution of missile types. These sections explain that the missile types and target robustness categories are used to determine if a target fails. Section 5.2 explains that in using the TMRE approach, the missiles at a specific plant should be counted to ensure that the missile inventory at the plant is bounded by the inventory used in the TMRE methodology based on the survey. Finally, Section B.6, Missiles Affecting Robust Targets, of NEI 17-01, Revision 1, states that the number of missiles used in the Exposed Equipment Failure Probability (EEFP) calculation can be adjusted to account for the population of missiles that can damage an SSC and provides the percentage of the total missile inventory for each type of robust target. These percentages appear to depend on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, B-16, and B-17.

The sections of NEI 17-02, Revision 1, cited above do not appear to provide guidance for adjusting the relative contribution of each missile type based on plant-specific information. A skewed distribution of missile types at a specific plant site could have an impact on the risk results of the TMRE PRA, because certain missiles (from certain missile robustness categories) can fail a greater number of SSCs than missiles from lesser robustness categories.

Describe how any future use of the TMRE guidance for adjusting the number of missiles for robust targets at GGNS will be performed to ensure GGNS evaluation will ensure that the contribution of each missile type to the overall missile population in NEI 17-02, Revision 1, is representative of the contribution of each missile type to the overall missile population GGNS.

Entergys Response:

Justification for the technical adequacy of the NEI 17-02 methodology has been added to Revision 1B. Any future use of the TMRE guidance for adjusting the number of missiles for robust targets at ANO would be performed in accordance with that guidance, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants. This will provide reasonable assurance that the contribution of each missile type to the overall missile population is adequate for the risk evaluation.

Enclosure Attachment 3 to 0CAN041904 Page 11 of 26 Item 10 - De Minimis Penetrations Request:

Section 3.1, Vulnerable SSC Walkdown Preparation, of NEI 17-02, Revision 1, states that SSCs that are potentially exposed to tornado missiles through a De Minimis penetration can be screened. Section 1.5, Definitions, of NEI 17-02, Revision 1, defines a De Minimis penetration to be:

[a]ny penetration in a tornado-generated missile resistant reinforced concrete wall or other tornado-generated missile resistant structure that is less than 10 square feet.

a.

For any exposed penetrations found during TMRE walkdowns, clarify whether any penetration was screened based on the above criteria.

b.

For any current or future penetrations screened, provide justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g., single penetration area and/or combined penetration area), and for excluding De Minimis penetrations from the risk analysis.

Entergys Response:

a.

No penetrations at ANO were screened based on any "De Minimis" criteria.

b.

Any future use of the TMRE guidance will be performed in accordance with NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants. However, it is not anticipated that any "De Minimis" criteria will be employed.

Item 11 - Vertical and Directional Missiles Request:

Section 5.3, Target Exposed Area, of NEI 17-02, Revision 1, provides the method for calculating the area of an SSC that is exposed to being struck by a tornado missile for various types of SSCs and how their target exposed area should be calculated for the EEFP. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) are susceptible to potential missiles in the vertical direction that could result in additional exposed area. The GGNS licensing basis defines parameters for missile velocities in both horizontal and vertical directions in the GGNS UFSAR, Table 3.5.1-6, Tornado Missiles Considered in the GGNS Design.

Section 3.3.2, Target Walkdowns, of the Enclosure to the submittal provides the scope of TMRE walkdowns. The third bullet of Section 3.3.2 includes identifications of directions from which tornado missiles could strike the target in the scope of walkdowns. It does not appear to differentiate between horizontal and vertical missiles consistent with the GGNS licensing basis.

Enclosure Attachment 3 to 0CAN041904 Page 12 of 26 Considering that tornado missiles could strike from all directions, describe how the above bulleted item in Section 3.3.2 of the Enclosure to the submittal was performed and how vertical missiles and directional aspects are included in the GGNS TMRE.

Entergys Response:

Missiles were considered capable of striking from all directions. Vertical missiles were included except in situations where the target was shielded from vertical missiles. Target shielding was considered as presented in Section 5.3.2 of NEI 17-02.

Item 12 - SSCs Important to Safety Request:

One of the key principles in RG 1.174, Revision 2 states that the proposed change meets the current regulations unless it is explicitly related to a requested exemption.

Section 2.2, Current Licensing Basis (CLB), of the Enclosure to the submittal states that GGNS was designed to meet General Design Criterion (GDC) 2, Design bases for protection against natural phenomena, and GDC 4, Environmental and dynamic effects design bases, in Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR). GDC 2 states that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 states that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

Section 4.1, Applicable Regulatory Requirements/Criteria, of the Enclosure to the submittal states that Section 3.5.1.4, Missiles Generated by Tornadoes and Extreme Winds, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants (SRP), allows for a probabilistic basis for relaxation of deterministic criteria for tornado missile protection of SSCs. The submittal further states that RG 1.174 establishes criteria to quantify the sufficiently small frequency of damage discussed in the SRP. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines.

Address how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornados or other external events without loss of capability to perform their safety function.

Entergys Response:

Use of the proposed methodology will continue to provide reasonable assurance of the protection of public health and safety and the environment as described in either the ANO-1 and ANO-2 Safety Analysis Report (SAR) without loss of the tornado safe shutdown capability.

Enclosure Attachment 3 to 0CAN041904 Page 13 of 26 Use of the proposed methodology will not result in an increase in the likelihood of a tornado.

The design basis tornado frequency is driven by external factors and is not affected by use of this methodology. Further, use of this methodology does not increase the consequences of a tornado. Use of the methodology does not alter any input assumptions or the results of the accident analysis. Use of the methodology results in a more realistic assessment of the very low likelihood of unacceptable consequences from a tornado event. Use of the methodology results in no physical changes to the facility; therefore, no new types of malfunctions or accidents are created. The types of accidents, accident precursors, failure mechanisms and accident initiators already evaluated in the ANO-1 or ANO-2 SAR remain unaltered. Finally, use of the methodology does not reduce the margin of safety in the ANO-1 or ANO-2 SAR. Use of the methodology does not exceed or alter any controlling numerical value for a parameter established in the ANO-1 or ANO-2 SAR Chapter 6 and 14/15 accident analyses (analyses remain valid). Use of the methodology does not reduce redundancy or diversity of safety systems, nor does it reduce defense-in-depth as described in the ANO-1 or ANO-2 SAR.

Item 13 - Defense-in-Depth Request:

Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states that the engineering evaluation should evaluate whether the impact of the proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy.

Section 3.2.1, Defense-in-Depth, of Enclosure 1 to the LAR discusses the licensees assessment of defense-in-depth considerations for this application. The assessment does not appear to fully address all seven defense-in-depth considerations discussed in regulatory position 2.1.1.

Provide an evaluation of the impact of the proposed changes, individually and cumulatively, on the following defense-in-depth considerations contained in RG 1.174:

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

The intent of the plants design criteria is maintained.

Entergys Response:

The proposed change does not modify the redundancy, independence, or diversity of systems described in the ANO-1 or ANO-2 SAR. Challenges to the systems, considering the frequency, consequence, and uncertainties of events, are evaluated in the LAR. The availability and reliability of SSCs that can either initiate or mitigate events is not changed, except for the tornado missile protection of the SSCs listed and thoroughly evaluated in the LAR. Equipment credited for Diverse and Flexible Coping Strategies (FLEX) is available both onsite and offsite.

This equipment could be utilized if needed to mitigate the impact of a tornado missile. The equipment is stored in structures that ensure availability in the case of a tornado or tornado missile.

Enclosure Attachment 3 to 0CAN041904 Page 14 of 26 The non-conforming conditions described in the LAR are spatially distributed about the ANO site with differing orientation and elevation. Any combination of non-conforming conditions that could realistically be struck by the same missile are correlated within the analysis and evaluated as such.

The LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety. The LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain not protected from tornado missiles. All other aspects of the plant design criteria are unaffected. Additionally, the methodology utilized in the LAR cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. The methodology only applies to legacy plant issues. Protection of the identified non-conforming SSCs would assure that SSCs would not be damaged by design basis tornado missiles. In lieu of protection for the identified non-conforming SSCs, ANO has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequential effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known and is considered negligible. Therefore, the intent of the plants design criteria is maintained.

Item 14 - Safety Margin Request:

Regulatory Position 2.1.2 in RG 1.17 4, Revision 2, discusses safety margin as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states, in part, that with sufficient safety margin, the safety analysis acceptance criteria in the licensing basis (e.g., final safety analysis report, supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Section 7.5, "Defense-in-Depth and Safety Margin," of NEI 17-02, Revision 1, calls for a discussion of defense-in-depth reflecting the actual design, construction, and operational practices of the plant. It explains that engineering evaluation should be performed to assess whether the proposed licensing basis change maintains safety margin and identify conservatisms in the risk assessment to show that safety margin is maintained.

Section 3.2, "Traditional Engineering Considerations, "of the enclosure to the LAR discusses defense in depth and safety margin and states "safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change" but provides no basis for that statement.

Section 2.3, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states that tornado missile failures do not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, and/or 1-inch steel plate. The guidance requires no analysis for evaluating the risk of non-conforming conditions that are protected as described in Section 2.3 of NEI 17-02, Revision 1, and implies that no protection against the tornado-generated missiles is needed for those SSCs. Revision 1 of NEI 17-02 provides similar guidance in Sections 5 and 6.5 as well.

Enclosure Attachment 3 to 0CAN041904 Page 15 of 26

a.

Describe the basis for the conclusion that the safety analysis acceptance criteria in the licensee's safety analysis are unaffected by the proposed change.

b.

Discuss any non-conforming conditions that were (or if identified in the future, will be) screened from HNP TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Revision 1. For those non-conforming conditions, demonstrate that the safety analysis acceptance criteria in the licensing basis are met or that proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Entergys Response:

a.

The safety analysis acceptance criteria in the ANO-1 and ANO-2 SAR described in Chapters 6 and 14/15 are not affected by the change, as those events do not assume a tornado coincident with a design basis accident, except to the extent that the tornado has the potential to initiate any of the design basis accidents. The objective for protection from tornado as an external event is to place the reactor in a safe and stable shutdown condition during or following a tornado. Special considerations such as single failure criteria are not required. The ANO TMRE analyses document that only a very small fraction of available SSCs which could be used to accomplish the objective are not protected from the effects of tornado missiles, and the remaining unaffected components provide reasonable assurance the objective would be achieved. In the event exposed components of one train of safety related equipment is affected by a tornado missile, there is reasonable assurance that opposite train equipment would be available to provide the safety function. In addition to the equipment credited in the safety analysis described in the SAR, on-site and near-site FLEX equipment is also available, which provides further assurance that the objective would be achieved. These factors provide reasonable assurance that the safety analysis acceptance criteria in the licensees accident analyses are not impacted by the proposed change.

b.

The analyses performed for the ANO TMRE did not use criteria in NEI 17-02, Revision 1, Section 2.3, to screen non-conforming conditions from further analysis. However, NEI 17-02, Section B.6.3, was revised in Revision 1B to add justification for screening. Any future application of NEI 17-02, Revision 1B, will be consistent with any terms and conditions established in the NRC safety evaluation for the pilot plants.

Item 15 - RG 1.174 Acceptance Guidelines Request:

Vogtle Plant-Specific RAI Regulatory Position 2.4 in RG 1.174, Revision 2, discusses the risk acceptance guidelines.

Section 7.3, Comparison to Risk Metric Thresholds, of NEI 17-02, Revision 1, indicates that the delta risk between the compliant case and the degraded case PRA results should be evaluated against the very small change in risk acceptance guidelines given in RG 1.174, Revision 2 (change in CDF of smaller than 10-6 per year and change in LERF of smaller than 10-7 per year), and states, in part, that:

[i]t is possible that some licensees may exceed these thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR.

Enclosure Attachment 3 to 0CAN041904 Page 16 of 26 Section 2.5, Quantify Risk, Perform Sensitivity Analyses, and Compare to Thresholds, of NEI 17-02, Revision 1, states, in part, that:

[i]f CDF or LERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate.

And

[i]f further reductions to CDF and LERF are not possible [by refining the analysis], the licensee will need to decide whether physical modifications should be made and to which SSCs.

Section 7.3 of NEI 17-02, Revision 1, appears to allow providing more information about defense-in-depth if the change-in-risk thresholds of RG 1.174 are exceeded, whereas Section 2.5 appears to allow analysis refinement and plant modification if the thresholds are exceeded.

Describe the licensees approach if performance-monitoring programs indicate that the risk acceptance guidelines for very small change-in-risk in RG 1.174, Revision 2, are exceeded.

Clarify whether any additional refinements beyond the guidance in NEI 17-02, Revision 1, will be made if acceptance guidelines are exceeded.

Entergys Response:

Sections 8.1 and 8.2 of NEI 17-02, Revision 1B, are significant revisions from the guidance provided in Revision 1. These revisions provide clarity to the guidance for future performance monitoring. If performance monitoring programs indicate that the risk acceptance guidelines for very small change in risk as defined in RG 1.174, Revision 2, are exceeded, then any subsequent TMRE evaluations at ANO would be performed in accordance with the guidance of NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants.

Item 16 - TRME Implementation Request:

Regulatory Position 3, Element 3: Define Implementation and Monitoring Program, in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. Section 8.1, Plant Configuration Changes, of NEI 17-02, Revision 1, states that design control programs meeting 10 CFR Part 50 Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, will ensure subsequent plant configuration changes are evaluated for their impact on non-conforming SSC risk using TMRE. Section 8.1 also states, in part, that:

[l]icensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Enclosure Attachment 3 to 0CAN041904 Page 17 of 26 Section 4.1, Applicable Regulatory Requirements/Criteria, of the Enclosure to the submittal states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. Permanent changes that increase the site missile burden within the 2500-ft.

missile radius established for TMRE should be reviewed for impact on the TMRE analysis.

a.

Describe the mechanism(s) and approach(es) that will be followed by the licensee to determine whether a particular change to the facility is significant for evaluation of the impact to the TMRE basis.

b.

Describe the licensees mechanisms that assure temporary and permanent changes to site missile sources will be evaluated.

c Describe the process(es) that ensure changes that could affect GGNS TMRE results (e.g.,

plant design changes, changes made to the licensees base internal events PRA model and new information about the tornado hazard at the plant) are considered in future implementation of the licensees TMRE.

d.

Describe, with justification, the treatment of the currently identified non-conforming conditions in future uses of the licensees TMRE PRA model.

e.

Describe, with justification, how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decision making (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals).

Entergys Response:

a.

Changes to previous non-conforming SSCs that would increase the target EEFP (e.g.,

affect the target exposed area by increasing the exposed exhaust pipe height, affect a robust missile percentage by changing pipe material or thickness) are not allowed under TMRE. Only changes that result in increased site missile burden require a TMRE analysis update.

Entergy Engineering Design procedures require the impact of design changes to be considered by various organizations, including the impact on plant risk. The new Standard Design Process IP-ENG-001 has been implemented at ANO. Individuals performing design change activities in accordance with that procedure are responsible for completing an impact review where PRA is a stakeholder. Impact reviews verify that affected items (procedures, equipment, programs, etc.) and interfaces have been identified. The design change Responsible Engineer is responsible for ensuring key stakeholder/impact review comments have been appropriately incorporated into the Engineering Change. A design change that affects the parameters of TMRE would have to be evaluated with TMRE prior to being implemented.

b.

The new Standard Design Process IP-ENG-001 assures that permanent changes to site missile sources will be evaluated for PRA model impacts. In accordance with Section 8.1 of NEI 17-02, Revision 1B, permanent changes that increase the site missile burden within the 2500 ft missile radius shall be included in the TMRE analysis. These changes would be captured in reviews by impacted departments. Stakeholders from other departments, areas, or programs are included in reviews of the impacts and this list includes PRA.

Enclosure Attachment 3 to 0CAN041904 Page 18 of 26

c.

The process used to update the TMRE analysis will be in accordance with NEI 17-02, Revision 1B. Entergy Risk Informed Engineering Procedures will be updated accordingly as part of the amendment implementation process.

d.

Targets that are treated as non-conforming in the initial application of the TMRE will continue to be considered non-conforming in future revisions of the TMRE model. There may be exceptions in the following cases where the targets:

Have been physically protected in such a way that they would no longer be considered non-conforming at the time of the revision and can be removed from the TMRE analysis, or Were conservatively treated as non-conforming in the initial analysis, but had not been identified as non-conforming during discovery walkdowns, or Would not otherwise be considered non-conforming at the time of the revision because engineering calculations have demonstrated conformance.

e.

For the purpose of decision-making related to those SSCs, the change in risk calculated from the TMRE is intended to be an estimate that reasonably bounds the risk from tornado missiles due to non-conforming SSCs. Once incorporated into the license, the TMRE may continue to be used to evaluate additional non-conforming SSCs in accordance with NEI 17-02, Revision 1B, guidance. Any further use of the TMRE model is beyond the scope of the industry guidance as documented in Section 8.1 of NEI 17-02, Revision 1B.

Item 17 - SSC Failure Modes Request:

Regulatory Position 2.3.2 in RG 1.174, Revision 2, states that the level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. This Regulatory Position further states that the characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated.

Section 6.5, Target Impact Probability Basic Events, of NEI 17-02, Revision 1, states, in part, that:

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models Section 6.5 then provides four relevant examples (i.e., flow diversion and/or leaks, tank vent failures, valve position transfer - spurious actuations, and ventilation damper failures). The section does not provide guidance about when and to what extent such failure modes should be considered.

Describe how the potential failure modes stated in Section 6.5 of NEI 17-02, Revision 1, were considered by the licensee during the TMRE walkdown, identified, and included in the licensees TMRE PRA model used to support this application.

Enclosure Attachment 3 to 0CAN041904 Page 19 of 26 Entergys Response:

Section 6.5 of NEI 17-02 has been revised to address SSC failures caused by tornado missile strikes. Section 6.5.1 in NEI 17-02, Revision 1B, addresses SSC functional failures and Section 6.5.2 addresses secondary effects.

Section 6.5.1 clarifies that the TMRE PRA model should consider the functional failures of SSCs that are struck by tornado missiles. The bulleted list of examples in NEI 17-02, Revision 1B, has been edited to remove the example implying that spurious equipment operation should be modeled, as this was not the intent of the example.

These revisions to the guidance document obviate the need for a plant-specific response to this RAI.

Item 18 - Operator Actions Request:

Section 3.3, Ex-Control Room Action Feasibility, of NEI 17-02, Revision 1, states that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure (in a location for which the operator must travel outside a Category I structure), but can be considered in the PRA after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Guidance in this section states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted.

Discuss, with justification, the assessments performed to ensure that environmental conditions will not affect operator actions that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the licensees TMRE PRA model used to support this application.

Entergys Response:

ANO-1 The ANO-1 Human Reliability Analysis identifies 5 basic events (EDG-HFC-FO-DG1FO, EDG-HFC-FO-DG2FO, EDG-HFC-FO-DGFO2, EDG-HFC-FO-FOASX, and PCS-HFC-FO-MSGAG) that are longer-term actions performed outside Category I structures. As noted in NEI 17-02, "It is not expected that longer term action (greater than one hour) human error probabilities will be noticeably impacted by the tornado event." Therefore, for the base case, the PRA model was quantified with the human error probability (HEP) for each of these events at nominal values. Additionally, a sensitivity analysis was performed with all five events set to TRUE. No change in either CDF or LERF was identified by the sensitivity analysis.

Other longer-term operator actions are performed inside Category I structures. Operators were interviewed to identify pathways from where the operators shelter during a tornado to the areas where the actions are performed. The operators identified multiple, diverse pathways to all rooms inside Category I structures where actions are required. Therefore, it is concluded that any impact on the failure probability of the long-term operator actions by the effects of a tornado impacting ANO-1 is negligible.

Enclosure Attachment 3 to 0CAN041904 Page 20 of 26 ANO-2 The ANO-2 Human Reliability Analysis identified no longer-term actions performed outside Category I structures.

For longer-term operator actions which are performed inside Category I structures, operators were interviewed to identify pathways from where the operators shelter during a tornado to the areas where the actions are performed. The operators identified multiple, diverse pathways to all rooms inside Category I structures where actions are required. Therefore, it is concluded that any impact on the failure probability of the long-term operator actions by the effects of a tornado impacting ANO-2 is negligible.

Item 19 - Exceedance Probabilities Request:

Section 4.6, Calculate Exceedance Probabilities, of NEI 17-02, Revision 1, states that exceedance probabilities should be generated for the upper ranges for each F [Fujita prime]

category, F2 through F6, using the trendline equation. The figure provided in Section 4.6 suggests that the largest exceedance probability for each F category, which corresponds to the lowest tornado speed for each F category, is used.

Describe how the exceedance probabilities influence on the initiating event frequencies were determined using the guidance in Section 4.6 of NEI 17-02, Revision 1 in the TMRE methodology.

Entergys Response:

The tornado initiating event frequencies were determined using the methodology described in NEI 17-02, Revision 1. The F'-scale wind speed estimates for tornados of frequency 1.00E-05/yr, 1.00E-06/yr, and 1.00E-07/yr were determined from a review of NUREG/CR-4461, Revision 2. A trend line was established and the resulting equation was used to calculate a frequency for tornado wind speeds from 40 MPH to 300 MPH.

Using the F-scale tornado intensity MPH ranges, exceedance frequencies were determined for each tornado intensity F2 through F6. Subsequently, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequency.

The method used and described above is in accordance with the revised guidance in NEI 17-02, Revision 1B, Sections 4.3 through 4.6.

Enclosure Attachment 3 to 0CAN041904 Page 21 of 26 Item 20 - Sensitivity Analysis Request:

Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This Regulatory Position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

Section 7.2, Sensitivity Analysis, of NEI 17-02, Revision 1, address the steps that should be taken if the change in CDF and LERF from the sensitivity analyses exceed 10-6 per year and 10-7 per year, respectively.

a.

Describe the GGNS process if change-in-risk estimates from sensitivity analyses exceed the RG 1.174, Revision 2, acceptance guidelines for very small change in risk in implementation of TMRE methodology.

b.

Describe how the importance measures are determined from the TMRE PRA model in the context of the binning approach for the tornado categories employed in the model.

Describe whether and how the same basic events, which were discretized by binning during the development of the TMRE PRA model, are combined to develop representative importance measures. For same basic events that are not combined, provide a justification that includes discussion of any impact on the results.

c.

Identify the non-conforming conditions and vulnerabilities that met all the characteristics of a highly exposed SSC per Section 7.2.1, TMRE Sensitivities, of NEI 17-02, Revision 1.

The discussions in Section 7.2 of NEI 17-02, Revision 1, do not address whether sensitivity analyses will be aggregated in future implementations of the TMRE methodology. For example, it is unclear whether the licensee will combine the sensitivity analyses related to any future open PRA facts and observations (F&Os), sensitivities that address compliant case conservatism and TMRE sensitivity analyses.

d.

Describe, with justification, whether sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1, will be aggregated in future implementation of the TMRE methodology.

The discussion in Section 7.2.3, Compliant Case Conservatisms, and Section A.2.1.3, Non-Category I Structures and Exposed Non-Safety Related SSCs, of NEI 17-02, Revision 1, recognizes that the TMRE PRA could produce non-conservative change-in-risk results if conservatively assumed failures in the Compliant Case mask change-in-risk. Accordingly, Section 7.2.3 of NEI 17-02, Revision 1, states, in part, that:

Enclosure Attachment 3 to 0CAN041904 Page 22 of 26

[the] licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failure (opposed to offsite power recovery or operator actions) that could impact results.

Section 7.2.3 of NEI 17-02, Revision 1, also explains that the licensee should perform sensitivity studies associated with these conservatisms as directed in Appendix D of the TMRE guideline for PRA standard supporting requirements (SRs) AS-A10, LE-C3, and SY-B7 to address equipment failures in the compliant case that may be masking change-in-risk but does not provide guidance on how such a sensitivity can be performed.

Section 3.3.10 Sensitivities and Uncertainties, of the Enclosure to the submittal describes a sensitivity assessment performed to ensure conservative modeling treatments in the compliant case do not affect the risk assessment conclusions.

e.

Describe any future sensitivity analysis that will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case of the TMRE PRA model.

Modeling operator actions, could contribute to underestimating the change-in-risk calculation associated with non-conforming SSCs. Appendix D, Technical Basis for TMRE Methodology, of NEI 17-02, Revision 1, does not appear to address the concern described above could also apply to conservative human reliability analysis modeling (e.g., SR HR-G3 and HR-G7).

f.

Describe how GGNS will address the potential impact of TMRE assumptions related to certain human error probabilities within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the accident on the compliant case.

Entergys Response:

ANO-1

a.

Currently, the ANO-1 sensitivity results exceed the very small risk change thresholds for one of the two required sensitivity analyses required by NEI 17-02, Revision 1B. For the TMRE missile distribution sensitivity, the CDF and LERF values of 1.3E-06 per year and 2.7E-07 per year, respectively, slightly exceed the very small risk threshold definitions.

The reason for the increase is the conservative modelling assumptions incorporated to simplify evaluations of cable routing. Specifically, for vulnerabilities affected by the sensitivity, it is assumed that a single missile could fail all SSCs in an impacted area. It is expected that a detailed evaluation of the cable routing would allow fewer correlated failures and, as a result, a lower risk increase. Additionally, correlation of SSCs impacted by tornado missiles was treated conservatively. For example, a missile impacting a row of large conduits end-on was assumed to fail all of the conduits and no kinetic reduction of the missiles was considered. Any reduction in these modelling conservatisms would reduce the increase in risk shown in the sensitivity analysis. Furthermore, much of the risk increase is caused by the multiplier applied to targets in the bowling alley area of the turbine building. This area is located below a concrete floor and between the Category 1 auxiliary building and an 18-inch thick reinforced concrete wall. As a result, it is not likely that a tornado could increase the distribution of missiles in that area. Therefore, it is concluded that the increase in risk shown by the sensitivity study is much larger than would be expected and the overall conclusions of the TMRE evaluation are valid.

Enclosure Attachment 3 to 0CAN041904 Page 23 of 26

b.

The importance measures for the TMRE model are determined as detailed in Section 7.2.1 of NEI 17-01, Revision 1B.

c.

The following ANO-1 SSCs meet the characteristics of highly exposed as specified in Section 7.2.1 of NEI 17-02, Revision 1. None of these highly exposed SSCs are considered non-conformances.

SSC Component Type 197-EC-01 Consisting of conduits:

EC1254 EC1255 EC1256 Correlation Group Conduit EC1056 Conduit Conduit EC1054 Conduit Conduit EJ1004 Conduit EFW pump P-7A Exhaust pipe Fuel oil storage tanksT-57A and B Vent pipes (correlated)

ANO-2

a.

Currently, the ANO-2 TMRE evaluations have determined that the sensitivity results have not exceeded the very small risk change thresholds.

NEI 17-02, Revision 1A, Section 7.3, was revised to document that if the results of a sensitivity study exceed the acceptance guidelines, NRC approval is required.

b.

Importance measures used to perform the required sensitivity analyses were determined as described in Section 7.2 1 of NEI 17-02, Revision 1B.

c.

The following ANO-2 SSCs meet the characteristics of highly exposed as specified in Section 7.2.1 of NEI 17-02, Revision 1. None of these highly exposed SSCs are considered non-conformances.

Enclosure Attachment 3 to 0CAN041904 Page 24 of 26 SSC Component Type 2200-A Consisting of conduits:

EJ1013 EJ1032 EJ2009 EJ2038 EJ3001 EJ4001 EJ4016 Correlation Group Fuel oil day tank 2T-30A vent Vent pipe Fuel oil day tank 2T-30B vent Vent pipe Fuel oil storage tanks 2T-57A and B Vent pipes (correlated)

ANO-1 and ANO-2

d.

Revision 1B to NEI 17-02 has obviated the need to address the issue identified in this RAI.

e.

Revision 1B to NEI 17-02 has obviated the need to address the issue identified in this RAI.

Entergy will follow the guidance in Section 7.2.3 of NEI 17-02, Revision 1B, if such sensitivity analyses are required in the future.

f.

Short term operator actions (defined as occurring within one hour of the tornado event) that require transit or execution outside Category I structures are also assumed to fail in the TMRE method. These are reasonable assumptions and generally consistent with current high wind PRAs. NEI 17-02, Section A.2.1.2, has been updated to provide some considerations for this treatment. Therefore, no evaluation is required to assess the potential impact of the one-hour operator action on the compliant case risk.

Item 21 - Uncertainties with Missile Impact Distribution Request:

Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Enclosure Attachment 3 to 0CAN041904 Page 25 of 26 The discussion in Section A.7, Zonal vs. Uniform (Z vs U) Sensitivity, of Appendix A, Technical Basis for TMRE Methodology, to NEI 17-02, Revision 1, recognizes differences between zonal and uniform missile distributions without justification. Targets were categorized in Appendix A to separate intuitive from non-intuitive trends and an adjustment factor is proposed to account for zonal distribution of missiles.

Describe, with justification, how uncertainties associated with the impact of the missile distribution on the licensees target hit probability are handled in the GGNS TMRE methodology.

Entergys Response:

NEI 17-02, Section 7.2.1 was revised in Revision 1A and further revised in Revision 1B. The current ANO TMRE analyses were performed in accordance with the revised guidance. In the future, the uncertainties associated with the missile distribution will be managed in accordance with NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluation.

Item 22 - Key Assumptions Request:

Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014), states, in part, that:

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Further, Section 4.2, Licensee Submittal Documentation, of RG 1.200, Revision 2, states, in part, that:

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

RG 1.200, Revision 2, defines the terms key assumption and key source of uncertainty in Section 3.3.2, Assessment of Assumptions and Approximations.

Section 5.0, Key Assumptions and Approximations, of Enclosure 3 to the LAR states, in part, that assumptions and approximations are reviewed and assessed during the risk assessment to determine the impact on the TMRE risk assessment as required by the NEI 17-02 guidance.

The submittal does not describe the key assumptions and key sources of uncertainties were identified in VEGP internal events PRA model and how those assumptions and uncertainties were addressed.

a.

Describe the key assumptions and key sources of uncertainties in VEGP internal events PRA that may impact this application.

b.

Describe how each key assumption and key source of uncertainty was dispositioned for this application.

Enclosure Attachment 3 to 0CAN041904 Page 26 of 26 Entergys Response:

The current ANO-1 and ANO-2 PRA internal events model do not identify plant-specific key assumptions. While a list of generic key sources of uncertainty are identified, no plant-specific key sources of uncertainty are identified. Action to identify the key assumptions and sources of uncertainty, along with any potential impact on the TMRE application in the PRA model of record, is being tracked via a Condition Report.

Enclosure Attachment 4 to 0CAN041904 Safety Analysis Report Page Markups (2 pages)

ARKANSAS NUCLEAR ONE Unit 1 Amendment No.

5.1-15

2.

Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

3.

Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH-4A and 4B pumps (reference CR-ANO-1-2017-3702).

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures. Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings

ARKANSAS NUCLEAR ONE Unit 2 Amendment No.

3.5-14 C. For missiles which are generated by release of stored strain energy, the strain energy is equated to kinetic energy in determining missile velocity. The ultimate stress of the material is used resulting in a large amount of energy than would be present at fracture. Losses due to heating, friction, and the relaxation of the material are ignored.

3.5.3.3 Tornado Missiles Appropriate parameters identifying the characteristics of tornado generated missiles are given in Table 3.5-6.

3.5.4 BARRIER DESIGN PROCEDURES The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

3.5.4.1 Reinforced Concrete Targets Missile resistant concrete barriers and structures were designed to withstand and absorb missile impact loads without being fully penetrated in order to prevent damage to protected components.

The design procedures and calculations used to predict local damage in the impact area included estimating the depth of penetration, minimum thickness required to prevent perforation, and minimum thickness required to preclude spalling. Table 3.5-7 shows results of calculations performed for the selected missiles discussed in Section 3.5.3. The penetration and perforation formulae assumed that the missile strikes the target normal to the surface, and the axis of the missile was assumed parallel to the line of flight. These assumptions resulted in a conservative estimate of local damage to the target.

Enclosure Attachment 5 to 0CAN041904 Retyped Safety Analysis Report Pages (2 pages)

ARKANSAS NUCLEAR ONE Unit 1 Amendment No.

5.1-15

2.

Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

3.

Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH-4A and 4B pumps (reference CR-ANO-1-2017-3702).

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures. Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings

ARKANSAS NUCLEAR ONE Unit 2 Amendment No.

3.5-14 C. For missiles which are generated by release of stored strain energy, the strain energy is equated to kinetic energy in determining missile velocity. The ultimate stress of the material is used resulting in a large amount of energy than would be present at fracture. Losses due to heating, friction, and the relaxation of the material are ignored.

3.5.3.3 Tornado Missiles Appropriate parameters identifying the characteristics of tornado generated missiles are given in Table 3.5-6.

3.5.4 BARRIER DESIGN PROCEDURES The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

3.5.4.1 Reinforced Concrete Targets Missile resistant concrete barriers and structures were designed to withstand and absorb missile impact loads without being fully penetrated in order to prevent damage to protected components.

The design procedures and calculations used to predict local damage in the impact area included estimating the depth of penetration, minimum thickness required to prevent perforation, and minimum thickness required to preclude spalling. Table 3.5-7 shows results of calculations performed for the selected missiles discussed in Section 3.5.3. The penetration and perforation formulae assumed that the missile strikes the target normal to the surface, and the axis of the missile was assumed parallel to the line of flight. These assumptions resulted in a conservative estimate of local damage to the target.