Text

R. E. Ginna Nuclear Power Plant - License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b
	ML21140A324
Person / Time
Site:	Ginna
Issue date:	05/20/2021
From:	David Gudger; Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML21140A324 (359)
	v • d • e

200 Exelon Way Kennett Square, PA 19348 www.exeloncorp.com 10 CFR 50.90 May 20, 2021 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 R. E. Ginna Nuclear Power Plant Renewed Facility Operating License No. DPR-18 NRC Docket No. 50-244

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Pursuant to 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC (Exelon) is requesting approval for proposed changes to the Technical Specifications (TS), Appendix A of Renewed Facility Operating License No. DPR-18 for R. E. Ginna Nuclear Power Plant (Ginna).

The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML18183A493). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (ADAMS Accession No. ML18253A085).

Attachment 1 provides a description and assessment of the proposed changes, the requested confirmation of applicability, and plant-specific verifications.

Attachment 2 provides the existing TS pages marked up to show the proposed changes.

Attachment 3 provides the existing TS Bases pages marked up to show the proposed changes and is provided for information only.

Attachment 4 provides a cross-reference between the improved Standard Technical Specifications included in TSTF-505, Rev. 2 and the Ginna plant-specific TS.

Attachment 5 provides information supporting the redundancy and diversity of instrumentation governed by the TS proposed to be included as part of the Risk Informed Completion Time (RICT) Program in this submittal.

Attachment 6 provides a list of PRA implementation items that must be completed prior to implementing the RICT Program at Ginna.

Attachment 7 provides proposed License Condition for Ginna that require completion of the items listed in Attachment 6 prior to implementation of the RICT program.

These proposed changes have been reviewed and approved by the sites Plant Operations Review Committee in accordance with the requirements of the Exelon Quality Assurance Program.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 May 20, 2021 Page 2 Exelon requests approval of the proposed amendment by May 20, 2022. The amendment shall be implemented within 180 days following NRC approval, or following completion of the License Condition specified in Attachment 6, whichever is later.

In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (a)(1), the analysis about the issue of no significant hazards consideration using the standards in 10 CFR 50.92 is being provided to the Commission.

In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b), Exelon is notifying the State of New York of this application for license amendment by transmitting a copy of this letter and its attachments to the designated State Official. contains a summary of commitments.

Should you have any questions concerning this submittal, please contact Jessie Hodge at (610) 765-5532.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 20th day of May 2021.

Respectfully, David T. Gudger Senior Manager, Licensing Exelon Generation Company, LLC Attachments:

1. Description and Assessment

2. Proposed Technical Specification Changes (Mark-Ups)

3. Proposed Technical Specification Bases Changes (Mark-Ups) (For Information Only)

4. Cross-Reference of TSTF-505 and Ginna Technical Specifications

5. Information Supporting Instrumentation Redundancy and Diversity

6. RICT Program PRA Implementation Items

7. Proposed Renewed Facility Operating License Changes (Mark-ups)

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 May 20, 2021 Page 3

Enclosures:

1. List of Revised Required Actions to Corresponding PRA Functions

2. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

3. Information Supporting Technical Adequacy of PRA Models Without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2

4. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

5. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

6. Justification of Application of At-Power PRA Models to Shutdown Modes

7. PRA Model Update Process

8. Attributes of the Real-Time Risk Model

9. Key Assumptions and Sources of Uncertainty

10. Program Implementation

11. Monitoring Program

12. Risk Management Action Examples cc: USNRC Region I, Regional Administrator w/ attachments USNRC Project Manager, Ginna "

USNRC Senior Resident Inspector, Ginna "

A. L. Peterson, NYSERDA "

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 May 20, 2021 Page 4 bcc: Senior Vice President - East Operations w/o attachments Vice President - Nuclear Security, Licensing and Regulatory "

Site Vice President - Ginna "

Plant Manager - Ginna "

Director, Site Operations - Ginna "

Director, Site Engineering - Ginna "

Director, Organizational Performance and Regulatory "

Senior Manager, Site Training - Ginna "

Manager, Site Regulatory Assurance - Ginna w/ attachments Manager, Licensing, KSA "

J. Hodge, KSA "

Commitment Coordinator - KSA "

Licensing Records - KSA "

ATTACHMENT 1 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Description and Assessment

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 1 of 6 Docket No. 50-244 Description and Assessment

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC (Exelon) is requesting approval for proposed changes to the Technical Specifications (TS), Appendix A of Renewed Facility Operating License No. DPR-18 for R. E. Ginna Nuclear Power Plant (Ginna).

The proposed amendment would modify the TS requirements related to Completion Times (CTs) for Required Actions (Action allowed outage times for Ginna) to provide the option to calculate a longer, risk-informed CT. A new program, the Risk-Informed Completion Time (RICT) Program, is added to TS Section 5.5, Programs and Manuals.

The methodology for using the RICT Program is described in NEI 06-09, Revision 0-A (hereafter referred to as NEI 06-09-A), "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, which was approved by the NRC on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program.

The proposed amendment is consistent with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b." However, only those Required Actions described in Attachment 4 and Enclosure 1, as reflected in the proposed TS markups provided in Attachment 2, are proposed to be changed. Some of the modified Required Actions in TSTF-505 are not applicable to Ginna. Also, there are some plant-specific Required Actions not included in TSTF-505 that are included in this proposed amendment.

2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation Exelon has reviewed TSTF-505, Revision 2, and the model safety evaluation dated November 21, 2018 (ADAMS Accession No. ML18253A085). This review included the information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, Exelon has concluded that the technical basis is applicable to Ginna, and support incorporation of this amendment in the Ginna TS.

2.2 Verifications and Regulatory Commitments In accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A, the following is provided:

1. Enclosure 1 identifies each of the TS Required Actions to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the probabilistic risk assessment (PRA) of the structures, systems and components (SSCs) subject to those actions.

2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as required by Regulatory Guide (RG) 1.200, Section 4.2.

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 2 of 6 Docket No. 50-244 Description and Assessment

3. Enclosure 3 is not applicable since each PRA model used for the RICT Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.

4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.

5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

6. Enclosure 6 is not applicable since the RICT Program is not being applied to shutdown modes.

7. Enclosure 7 provides a discussion of the licensees programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified for use in the Real-Time Risk (RTR) tool to assess real-time configuration risk, and describes the scope of, and quality controls applied to, the RTR tool.

9. Enclosure 9 provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.

10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.

11. Enclosure 11 provides a description of the implementation and monitoring program as described in NEI 06-09-A, Section 2.3.2, Step 7.

12. Enclosure 12 provides a description of the process to identify and provide RMAs.

Exelon is providing a regulatory commitment to include additional tornado missile protection to support the screening and the high winds penalty as provided in Enclosure 4.

2.3 Optional Changes and Variations Exelon is proposing variations from TSTF-505, Revision 2, or the applicable parts of the NRC staffs model safety evaluation dated November 21, 2018, as described in subparagraph 5 below. These options were recognized as acceptable variations in TSTF-505 and the NRC staff's model safety evaluation.

In several instances, the Ginna TS use different numbering and titles than the Standard Technical Specifications (STS) on which TSTF-505 was based. These differences are

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 3 of 6 Docket No. 50-244 Description and Assessment administrative and do not affect the applicability of TSTF-505 to the Ginna TS. Only TS changes consistent with the Ginna design and TS are included. is a cross reference that provides a comparison between the NUREG-1431, Standard Technical Specifications Westinghouse Plants, Required Actions included in TSTF-505 and the Ginna Actions included in this license amendment request. The attachment includes a summary description of the referenced Required Actions, which is provided for information purposes only and is not intended to be a verbatim description of the Required Action. The cross reference in Attachment 4 identifies the following:

1. Ginna Actions that have identical numbers to the corresponding NUREG-1431 Required Actions are not deviations from TSTF-505, except for administrative deviations (if any) such as formatting. These deviations are administrative with no impact on the NRC's model safety evaluation dated November 21, 2018.

2. Ginna Actions that have different numbering than the NUREG-1431 Required Actions are an administrative deviation from TSTF-505 with no impact on the NRC's model safety evaluation dated November 21, 2018.

3. For NUREG-1431 Required Actions that are not contained in the Ginna TS, the corresponding TSTF-505 mark-ups for the Required Actions are not applicable to Ginna.

This is an administrative deviation from TSTF-505 with no impact on the NRC's model safety evaluation dated November 21, 2018.

4. The model application provided in TSTF-505, Revision 2, includes an attachment for typed, camera-ready (revised) TS pages reflecting the proposed changes. Ginna is not including such an attachment due to the number of TS pages included in this submittal that have the potential to be affected by other unrelated license amendment requests and the straightforward nature of the proposed changes. Providing only mark-ups of the proposed TS changes satisfies the requirements of 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," in that the mark-ups fully describe the changes desired. This is an administrative deviation from TSTF-505 with no impact on the NRC's model safety evaluation dated November 21, 2018.

Because of this deviation, the contents and numbering of the attachments for this amendment request differ from the attachments specified in the model application in TSTF-505.

5. There are several plant-specific LCOs and associated Actions for which Ginna is proposing to apply the RICT Program that are variations from TSTF-505 as identified in Attachment 4 with additional justification provided below:

TS 3.3.5.A.1- One rad monitor inoperable. Per UFSAR Section 6.2.4.3, there is no loss of function if R-11 or R-12 become inoperable. These radiation monitors actuate Containment Ventilation Isolation (CVI), for the mini-purge valves. CVI serves as a backup to the Containment Isolation (CI) signal, and is not specifically credited in the accident analysis.

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 4 of 6 Docket No. 50-244 Description and Assessment TS 3.4.11.C.2 and TS 3.4.11.D.2 - Two PORV block valves inoperable. The current completion time to terminate the loss of function is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Because this situation is comprised of such a set of low probability occurrences (both block valves inoperable, manual operation of a PORV needed to mitigate an RCS overpressure event, and the failure of the PORV to reclose following operation), a probabilistic calculation could show acceptable delta risk for a longer time period than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

TS 3.5.1.A.1 and TS 3.5.1.B.1 - One accumulator inoperable. For a large break cold leg LOCA, one accumulator is assumed to spill out the break, while the other provides the required core cooling. Therefore, having one inoperable accumulator constitutes a loss of function for this particular scenario. Because this is such a low probability event, a probabilistic calculation could indicate that an accumulator could be inoperable for longer than the current action completion times with acceptable delta risk results.

TS 3.6.3.E.2 - One or two mini-purge penetration flowpaths with two valves not within the leakage limits. As long as Action E.1 is successful (show overall containment leakage is low in the current configuration), there is no loss of function.

TS 3.6.6.D.1 - One or two CRFC units inoperable. Table 6.2-16 of the UFSAR lists the assumed number of containment fan coolers and containment spray pumps assumed in the limiting large break analysis for containment conditions. These correspond to a minimum of 2 CRFCs (out of 4) and 1 containment spray pump (out of 2).

TS 3.7.1.A.1 - One or more MSSVs inoperable - Analysis has demonstrated that the required valve combinations needed to mitigate the limiting Design Basis Accident or an ATWS event are 8/8 MSSVs, or 7/8 MSSVs and1/2 ARVs, or 6/8 MSSVs and 2/2 ARVs.

Thus inoperability of a MSSV by itself does not constitute a loss of safety function.

TS 3.8.7.B.2 - Class 1E CVT for AC Instrument Bus B inoperable. The use of Constant Voltage Transformers (CVTs) is below the level of detail in TSTF-505. However, because there exists a non-Class 1E CVT to power Instrument Bus B, there is no loss of function and this is therefore an appropriate application of RICT.

Exelon has determined that the application of a RICT for these Ginna plant-specific LCOs is consistent with TSTF-505, Revision 2, and with the NRC's model safety evaluation dated November 21, 2018. Application of a RICT for these plant-specific LCOs will be controlled under the RICT Program. The RICT Program provides the necessary administrative controls to permit extension of Completion Times and thereby delay reactor shutdown or remedial actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance levels of TS required structures, systems or components (SSCs) are unchanged, and the remedial actions, including the requirement to shut down the reactor, are also unchanged; only the Completion Times are extended by the RICT Program.

Application of a RICT will be evaluated using the methodology and probabilistic risk guidelines contained in NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," which was approved by

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 5 of 6 Docket No. 50-244 Description and Assessment the NRC on May 17, 2007 (ADAMS Accession No. ML071200238). The NEI 06-09-A, methodology includes a requirement to perform a quantitative assessment of the potential impact of the application of a RICT on risk, to reassess risk due to plant configuration changes, and to implement compensatory measures and risk management actions (RMAs) to maintain the risk below acceptable regulatory risk thresholds. In addition, the NEI 06-09-A, methodology satisfies the five key safety principles specified in Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision making: Technical Specifications," dated August 1998 (ADAMS Accession No. ML003740176), relative to the risk impact due to the application of a RICT.

Therefore, the proposed application of a RICT in the Ginna plant-specific Actions is consistent with TSTF-505, Revision 2, and with the NRC staffs model safety evaluation dated November 21, 2018.

Exelon has reviewed these changes and determined that they do not affect the applicability of TSTF-505, Revision 2, to the Ginna TS.

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Determination Exelon Generation Company, LLC (Exelon) has evaluated the proposed changes to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration.

R. E. Ginna Nuclear Power Plant (Ginna) requests adoption of an approved change to the standard technical specifications (STS) and plant-specific technical specifications (TS), to modify the TS requirements related to Completion Times for Required Actions to provide the option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Chapter 5, "Administrative Controls," entitled the "Risk-Informed Completion Time Program."

As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:

1. Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes permit the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes do not involve a significant increase in the probability of an accident previously evaluated because the changes involve no change to the plant or its modes of operation. The proposed changes do not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 6 of 6 Docket No. 50-244 Description and Assessment extended Completion Time are no different from those during the existing Completion Time.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes do not change the design, configuration, or method of operation of the plant. The proposed changes do not involve a physical alteration of the plant (no new or different kind of equipment will be installed).

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No.

The proposed changes permit the extension of Completion Times provided that risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes implement a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS.

Therefore, the proposed changes do not involve a significant reduction in a margin of safety.

Based on the above, Exelon concludes that the proposed changes present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

3.2 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

License Amendment Request Attachment 1 Adopt Risk Informed Completion Times TSTF-505 Page 7 of 6 Docket No. 50-244 Description and Assessment 4.0 ENVIRONMENTAL EVALUATION The proposed changes would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed changes do not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed changes meet the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed changes.

ATTACHMENT 2 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Proposed Technical Specification Changes (Mark-Ups)

TS Pages 1.3-9 through -10 3.6.6-1 3.3.1-1 through -8 3.7.1-1 3.3.1-11 through -14 3.7.2-1 3.3.2-1 through -3 3.7.4-1 3.3.2-5 through -10 3.7.5-1 through -2 3.3.4-1 3.7.7-1 3.3.5-1 3.7.8-1 3.4.11-1 through -2 3.8.1-1 through -2 3.5.1-1 3.8.4-1 3.5.2-1 3.8.7-1 3.6.2-1 through -3 3.8.9-1 3.6.3-1 through -5 5.5-13

INSERT EXAMPLE 1.3-8 EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable. to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Required Action andB.1 B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated CompletionB.2 Time not met. B.3 AND B.4 B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

INSERT RICT OR In accordance with the Risk Informed Completion Time Program INSERT RICT NOTE 1 OR

NOTE------

Not applicable when trip capability is not maintained.

In accordance with the Risk Informed Completion Time Program INSERT RICT NOTE 2 OR

NOTE------

Not applicable if there is a loss of function.

In accordance with the Risk Informed Completion Time Program INSERT RICT Program 5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, Risk-Managed Technical Specifications (RMTS) Guidelines.

The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODES 1 and 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support License Amendment No. [XXX], or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

Completion Times 1.3 EXAMPLE 1.3-7 MULTIPLE ACTIONS WITHIN A CONDITION/ COMPLETION TIME EXTENSIONS ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.2 Verify affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND inoperable. subsystem isolated. Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.3 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months subsystem to OPERABLE status.

B. Required ActionB.5and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not B.6 AND met.

B.7 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months B.8 C

Required Action A.1 has two Completion Times. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time begins at the time the Condition is entered and each "Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter" interval begins upon performance of Required Action A.1.

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2), Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

R.E. Ginna Nuclear Power Plant 1.3-9 Amendment 80

Completion Times INSERT 1.3 EXAMPLE 1.3-8 IMMEDIATE When "Immediately" is used as a Completion Time, the Required Action COMPLETION should be pursued without delay and in a controlled manner.

TIME R.E. Ginna Nuclear Power Plant 1.3-10 Amendment 80

RTS Instrumentation 3.3.1 3.3 INSTRUMENTATION 3.3.1 Reactor Trip System (RTS) Instrumentation LCO 3.3.1 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1-1.

ACTIONS

- NOTE -

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more A.1 Enter the Condition Immediately Functions with one channel referenced in Table 3.3.1-1 for the inoperable. channel(s).

OR Two source range channels inoperable.

B. As required by Required B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months INSERT Action A.1 and referenced by OPERABLE status.

RICT Table 3.3.1-1.

C. Required Action andC.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition B not met.

C.2 Initiate action to fully insert all rods.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND C.3 Place Control Rod Drive System in a condition incapable of rod withdrawal. 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months R.E. Ginna Nuclear Power Plant 3.3.1-1 Amendment 112

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME D. As required by Required D.1 Action A.1 and referenced by Table 3.3.1-1. - NOTE -

1. For Functions 2a, 2b, 5, 6, 7b, 8, and 13, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Place channel in trip.

INSERT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT NOTE 2

E. As required by Required E.1 Reduce THERMAL POWER to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Action A.1 and referenced by < 5E-11 amps.

Table 3.3.1-1.

OR E.2

- NOTE -

Required Action E.2 is not applicable when:

a. Two channels are inoperable, or

b. THERMAL POWER is

< 5E-11 amps.

Increase THERMAL POWER to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 8% RTP.

F. As required by Required F.1 Open RTBs and RTBBs Immediately upon Action A.1 and referenced by upon discovery of two inoperable discovery of two Table 3.3.1-1. channels. inoperable channels AND R.E. Ginna Nuclear Power Plant 3.3.1-2 Amendment 144

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME F.2 Immediately

- NOTE -

Limited plant cooldown or boron dilution is allowed provided the change is accounted for in the calculated SDM.

Suspend operations involving positive reactivity additions.

AND F.3 Restore channel to OPERABLE status. 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D, E, or F is not met.

H. As required by H.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Required Action A.1 and channel to OPERABLE status upon discovery of two referenced by Table 3.3.1-1. discovery of two inoperable channels. inoperable channels AND H.2 Immediately

- NOTE -

Limited plant cooldown or boron dilution is allowed provided the change is accounted for in the calculated SDM.

Suspend operations involving positive reactivity additions.

AND R.E. Ginna Nuclear Power Plant 3.3.1-3 Amendment 112

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME H.3 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

I. Required Action and I.1 Initiate action to fully insert Immediately associated Completion Time of all rods.

Condition H not met.

AND I.2 Place the Control Rod Drive 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months System in a condition incapable of rod withdrawal.

J. As required by J.1 Required Action A.1 and - NOTE -

referenced by Table 3.3.1-1. Plant temperature changes are allowed provided the temperature change is accounted for in the calculated SDM.

Suspend operations involving positive reactivity additions. Immediately AND J.2 Perform SR 3.1.1.1.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter K. As required by K.1 Required Action A.1 and - NOTE -

referenced by Table 3.3.1-1. 1. For Functions 7a and 9b, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

INSERT Place channel in trip. RICT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months R.E. Ginna Nuclear Power Plant 3.3.1-4 Amendment 144

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME L. Required Action and L.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of to < 8.5% RTP.

Condition K not met.

M. As required by Required M.1 Action A.1 and referenced by Table 3.3.1-1. - NOTE -

1. For Function 9a, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Place channel in trip. INSERT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT N. As required by Required N.1 Restore channel to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT Action A.1 and referenced by OPERABLE status. RICT Table 3.3.1-1.

O. Required Action and O.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of to < 30% RTP.

Condition M or N not met.

P. As required by Required P.1 Action A.1 and referenced by Table 3.3.1-1. - NOTE -

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

INSERT Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months RICT Q. Required Action and Q.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time of to < 50% RTP.

Condition P not met.

AND R.E. Ginna Nuclear Power Plant 3.3.1-5 Amendment 144

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME Q.2.1 Verify Steam Dump System 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months is OPERABLE.

OR Q.2.2 Reduce THERMAL POWER 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months to < 8% RTP.

R. As required by R.1 Required Action A.1 and referenced by Table 3.3.1-1. - NOTE -

One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing provided the other train is OPERABLE.

Restore train to OPERABLE status. INSERT 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months RICT S. As required by Required S.1 Action A.1 and referenced by Table 3.3.1-1. ------------------------

-NOTE-For Functions 16c, 16d, and 16e, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

Verify interlock is in required state for existing plant conditions. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR S.2 Declare associated RTS Function channel(s) inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months R.E. Ginna Nuclear Power Plant 3.3.1-6 Amendment 144

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME T. As required by Required T.1 Action A.1 and referenced by Table 3.3.1-1. - NOTE -

1. One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE.

2. One RTB may be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms, provided the other train is OPERABLE.

INSERT Restore train to OPERABLE status. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months RICT NOTE 2

U. As required by U.1 Restore at least one trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Required Action A.1 and mechanism to OPERABLE status discovery of two referenced by Table 3.3.1-1. upon discovery of two RTBs with inoperable trip inoperable trip mechanisms. mechanisms AND U.2 Restore trip mechanism to OPERABLE status. 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months INSERT RICT V. Required Action and V.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition R, S, T or U not met.

W. As required by Required W.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced by trip mechanism to OPERABLE discovery of two Table 3.3.1-1. status upon discovery of two RTBs inoperable trip with inoperable trip mechanisms. mechanisms AND R.E. Ginna Nuclear Power Plant 3.3.1-7 Amendment 144

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME W.2 Restore trip mechanism or 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months train to OPERABLE status.

X. Required Action X.1 Initiate action to fully insert all Immediately and associated Completion rods.

Time of Condition W not met.

AND X.2 Place the Control Rod Drive 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months System in a Condition incapable of rod withdrawal.

SURVEILLANCE REQUIREMENTS

- NOTE -

Refer to Table 3.3.1-1 to determine which SRs apply for each RTS Function.

SURVEILLANCE FREQUENCY SR 3.3.1.1 Perform CHANNEL CHECK. In accordance with the Surveillance Frequency Control Program SR 3.3.1.2 - NOTE -

Required to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 50% RTP.

Compare results of calorimetric heat balance calculation In accordance with to Nuclear Instrumentation System (NIS) channel output the Surveillance and adjust if calorimetric power is Frequency Control

> 2% higher than indicated NIS power. Program SR 3.3.1.3 - NOTE -

1. Required to be performed within 7 days after THERMAL POWER is 50% RTP but prior to exceeding 90% RTP following each refueling and if the Surveillance has not been performed within the last 31 EFPD.

2. Performance of SR 3.3.1.6 satisfies this SR.

In accordance with Compare results of the incore detector measurements to the Surveillance NIS AFD and adjust if absolute difference is 3%. Frequency Control Program R.E. Ginna Nuclear Power Plant 3.3.1-8 Amendment No. 122

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR LIMITING OTHER SAFETY SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

1. Manual Reactor Trip 1, 2, 2 B,C SR 3.3.1.11 NA 3(b), 4(b), 5(b)

2. Power Range Neutron Flux

a. High 1, 2 4 D,G SR 3.3.1.1 109.27%

SR 3.3.1.2 RTP SR 3.3.1.7 SR 3.3.1.10

b. Low 1(c), 2 4 D,G SR 3.3.1.1 29.28%

SR 3.3.1.8 RTP SR 3.3.1.10

3. Intermediate Range 1(c), 2 2 E,G SR 3.3.1.1 (d)

Neutron Flux SR 3.3.1.8 SR 3.3.1.10

4. Source Range 2(e) 2 F,G SR 3.3.1.1 (d)

Neutron Flux SR 3.3.1.8 SR 3.3.1.10 3(b), 4(b), 5(b) 2 H,I SR 3.3.1.1 (d)

SR 3.3.1.7 SR 3.3.1.10 3(f), 4(f), 5(f) 1 J SR 3.3.1.1 NA SR 3.3.1.10

5. Overtemperature T 1, 2 4 D,G SR 3.3.1.1 Refer to SR 3.3.1.3 Note 1 SR 3.3.1.6 SR 3.3.1.7 SR 3.3.1.10

6. Overpower T 1, 2 4 D,G SR 3.3.1.1 Refer to SR 3.3.1.7 Note 2 SR 3.3.1.10 R.E. Ginna Nuclear Power Plant 3.3.1-11 Amendment 112

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR LIMITING OTHER SAFETY SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

7. Pressurizer Pressure

a. Low 1(g) 4 K,L SR 3.3.1.1 1791.3 SR 3.3.1.7 psig SR 3.3.1.10

b. High 1, 2 3 D,G SR 3.3.1.1 2396.2 SR 3.3.1.7 psig SR 3.3.1.10

8. Pressurizer Water 1, 2 3 D,G SR 3.3.1.1 96.47%

Level-High SR 3.3.1.7 SR 3.3.1.10

9. Reactor Coolant Flow-Low

a. Single Loop 1(h) 3 per loop M,O SR 3.3.1.1 89.86%

SR 3.3.1.7 SR 3.3.1.10

b. Two Loops 1(i) 3 per loop K,L SR 3.3.1.1 89.86%

SR 3.3.1.7 SR 3.3.1.10

10. Reactor Coolant Pump (RCP)

Breaker Position

a. Single Loop 1(h) 1 per RCP N,O SR 3.3.1.11 NA

b. Two Loops 1(j) 1 per RCP K,L SR 3.3.1.11 NA

11. Undervoltage- 1(g) 2 per bus K,L SR 3.3.1.9 (d)

Bus 11A and 11B SR 3.3.1.10

12. Underfrequency- 1(g) 2 per bus K,L SR 3.3.1.9 57.5 HZ Bus 11A and 11B SR 3.3.1.10 R.E. Ginna Nuclear Power Plant 3.3.1-12 Amendment 112

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR LIMITING OTHER SAFETY SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

13. Steam Generator 1, 2 3 per SG D,G SR 3.3.1.1 13.88%

(SG) Water Level- SR 3.3.1.7 Low Low SR 3.3.1.10

14. Turbine Trip

a. Low Autostop 1(k)(l) 3 P,Q SR 3.3.1.10 (d)

Oil Pressure SR 3.3.1.12

b. Turbine Stop 1(k)(l) 2 P,Q SR 3.3.1.12 NA Valve Closure

15. Safety Injection (SI) 1, 2 2 R,V SR 3.3.1.11 NA Input from Engineered Safety Feature Actuation System (ESFAS)

R.E. Ginna Nuclear Power Plant 3.3.1-13 Amendment 112

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR LIMITING OTHER SAFETY SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

16. Reactor Trip System Interlocks

a. Intermediate 2(e) 2 S,V SR 3.3.1.10 5E-11 Range SR 3.3.1.13 amp Neutron Flux, P-6

b. Low Power 1(g) 4 (power range S,V SR 3.3.1.10 8.0% RTP Reactor Trips only) SR 3.3.1.13 Block, P-7

c. Power Range 1(h) 4 S,V SR 3.3.1.10 29.0% RTP Neutron Flux, SR 3.3.1.13 P-8

d. Power Range 1(l) 4 S,V SR 3.3.1.10 50.0% RTP Neutron Flux, SR 3.3.1.13 P-9 1(k) 4 S,V SR 3.3.1.10 8.0% RTP SR 3.3.1.13

e. Power Range 1(c), 2 4 S,V SR 3.3.1.10 6.0% RTP Neutron Flux, SR 3.3.1.13 P-10

17. Reactor Trip 1, 2 2 trains T,V SR 3.3.1.4 NA Breakers (m) 3(b), 4(b), 5(b) 2 trains W,X SR 3.3.1.4 NA

18. Reactor Trip 1, 2 1 each per RTB U,V SR 3.3.1.4 NA Breaker 3(b), 4(b), 5(b) 1 each per RTB W,X SR 3.3.1.4 NA Undervoltage and Shunt Trip Mechanisms

19. Automatic Trip Logic 1, 2 2 trains R,V SR 3.3.1.5 NA 3(b), 4(b), 5(b) 2 trains W,X SR 3.3.1.5 NA R.E. Ginna Nuclear Power Plant 3.3.1-14 Amendment 112

ESFAS Instrumentation 3.3.2 3.3 INSTRUMENTATION 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation LCO 3.3.2 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.2-1.

ACTIONS

- NOTE -

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more A.1 Enter the Condition Immediately Functions with one channel or referenced in Table 3.3.2-1 for the train inoperable. channel or train.

B. As required by B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months INSERT Required Action A.1 and OPERABLE status. RICT referenced by Table 3.3.2-1.

C. Required Action C.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition B not met.

D. As required by D.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months INSERT Required Action A.1 and OPERABLE status. RICT referenced by Table 3.3.2-1.

E. As required by E.1 Restore train to OPERABLE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT Required Action A.1 and status. RICT referenced by Table 3.3.2-1.

R.E. Ginna Nuclear Power Plant 3.3.2-1 Amendment 109

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Action A.1 and referenced by Table 3.3.2-1. - NOTE -

1. For Functions 4c and 5b, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Place channel in trip.

INSERT RICT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months G.1 Be in MODE 3.

G. Required Action and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of AND Condition D, E, or F not met.

G.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months INSERT H. As required by H.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months RICT Required Action A.1 and OPERABLE status.

referenced by Table 3.3.2-1.

I. As required by Required I.1 Restore train to OPERABLE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT RICT Action A.1 and referenced by status.

Table 3.3.2-1.

J. As required by J.1 Required Action A.1 and referenced by Table 3.3.2-1. - NOTE -

1. For Functions 1c, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Place channel in trip.

INSERT RICT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months R.E. Ginna Nuclear Power Plant 3.3.2-2 Amendment 144

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME K. Required Action andK.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time K.2 of Condition H, I, or J not met.K.3 AND Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months L. As required by Required L.1 Action A.1 and referenced by - NOTE -

Table 3.3.2-1. 1. For Functions 1d and 1e, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Place channel in trip.

INSERT RICT 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months M. Required Action andM.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition L not met. AND M.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to < 2000 psig.

N. As required by N.1 Declare associated Immediately Required Action A.1 and Auxiliary Feedwater pump inoperable referenced by Table 3.3.2-1. and enter applicable condition(s) of LCO 3.7.5, "Auxiliary Feedwater (AFW) System."

SURVEILLANCE REQUIREMENTS

- NOTE -

Refer to Table 3.3.2-1 to determine which SRs apply for each ESFAS Function.

SURVEILLANCE FREQUENCY SR 3.3.2.1 Perform CHANNEL CHECK In accordance with the surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant 3.3.2-3 Amendment 144

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER LIMITING SPECIFIED SAFETY CONDITIONS REQUIRED SURVEILLANCE SYSTEM FUNCTION CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

1. Safety Injection

a. Manual 1,2,3,4 2 H,K SR 3.3.2.4 NA Initiation

b. Automatic 1,2,3,4 2 trains I,K SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. Containment 1,2,3,4 3 J,K SR 3.3.2.1 4.61 psig Pressure-High SR 3.3.2.2 SR 3.3.2.5

d. Pressurizer 1,2,3(b) 3 L,M SR 3.3.2.1 1729.8 Pressure-Low SR 3.3.2.2 psig SR 3.3.2.5 SR 3.3.2.6

e. Steam Line 1,2,3(b) 3 per steam line L,M SR 3.3.2.1 393.8 psig Pressure-Low SR 3.3.2.2 SR 3.3.2.5 SR 3.3.2.6 R.E. Ginna Nuclear Power Plant 3.3.2-5 Amendment 109

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER LIMITING SPECIFIED SAFETY CONDITIONS REQUIRED SURVEILLANCE SYSTEM FUNCTION CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

2. Containment Spray

a. Manual Initiation Left pushbutton 1,2,3,4 1 H,K SR 3.3.2.4 NA 1,2,3,4 1 H,K SR 3.3.2.4 NA Right pushbutton 1,2,3,4 2 trains I,K SR 3.3.2.7 NA

b. Automatic Actuation Logic and Actuation Relays

c. Containment 1,2,3,4 3 per set J,K SR 3.3.2.1 32.11 psig Pressure-High SR 3.3.2.2 (narrow range)

High SR 3.3.2.5 29.6 psig (wide range)

3. Containment Isolation

a. Manual 1,2,3,4,(c) 2 H,K SR 3.3.2.4 NA Initiation

b. Automatic 1,2,3,4 2 trains I,K SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. Safety Refer to Function 1 (Safety Injection) for all automatic initiation Injection functions and requirements.

R.E. Ginna Nuclear Power Plant 3.3.2-6 Amendment 109

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER LIMITING SPECIFIED SAFETY CONDITIONS REQUIRED SURVEILLANCE SYSTEM FUNCTION CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

4. Steam Line Isolation

a. Manual 1,2(d),3(d) 1 per loop D,G SR 3.3.2.4 NA Initiation

b. Automatic 1,2(d),3(d) 2 trains E,G SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. Containment 1,2(d),3(d) 3 F,G SR 3.3.2.1 18.0 psig Pressure-High SR 3.3.2.2 High SR 3.3.2.5

d. High Steam 1,2(d),3(d) 2 per steam line F,G SR 3.3.2.1 1.30E6 Flow SR 3.3.2.2 lbm/hr SR 3.3.2.5 @ 1005 psig Coincident with Safety Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

Injection and Coincident with Tavg-Low 1,2(d),3(d) 2 per loop F,G SR 3.3.2.1 544.0F SR 3.3.2.2 SR 3.3.2.5

e. High-High 1,2(d),3(d) 2 per steam line F,G SR 3.3.2.1 4.53E6 Steam Flow SR 3.3.2.2 lbm/hr SR 3.3.2.5 @ 785 psig Coincident with Safety Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

Injection R.E. Ginna Nuclear Power Plant 3.3.2-7 Amendment 109

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER LIMITING SPECIFIED SAFETY CONDITIONS REQUIRED SURVEILLANCE SYSTEM FUNCTION CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

5. Feedwater Isolation

a. Automatic 1,2(e),3(e) 2 trains E,G SR 3.3.2.7 NA Actuation Logic and Actuation Relays

b. SG Water 1,2(e),3(e) 3 per SG F,G SR 3.3.2.1 91.15%

Level-High SR 3.3.2.2 SR 3.3.2.5

c. Safety Refer to Function 1 (Safety Injection) for all initiation functions and Injection requirements.

R.E. Ginna Nuclear Power Plant 3.3.2-8 Amendment 109

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR LIMITING OTHER SAFETY SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETTINGS(a)

6. Auxiliary Feedwater (AFW)

a. Manual Initiation AFW 1,2,3 1 per pump N SR 3.3.2.4 NA Standby AFW 1,2,3 1 per pump N SR 3.3.2.4 NA

b. Automatic 1,2,3 2 trains E,G SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. SG Water 1,2,3 3 per SG F,G SR 3.3.2.1 13.88%

Level-Low Low SR 3.3.2.2 SR 3.3.2.5

d. Safety Refer to Function 1 (Safety Injection) for all initiation functions and Injection requirements.

(Motor driven pumps only)

e. Undervoltage - 1,2,3 2 per bus D,G SR 3.3.2.3 2597 V Bus 11A and SR 3.3.2.5 with 3.6 11B (Turbine sec time driven pump delay only)

f. Trip of Both 1 2 per MFW B,C SR 3.3.2.4 NA Main pump Feedwater Pumps (Motor driven pumps only)

R.E. Ginna Nuclear Power Plant 3.3.2-9 Amendment 109

ESFAS Instrumentation 3.3.2 (a)

A channel is OPERABLE when both of the following conditions are met:

1. The absolute difference between the as-found Trip Setpoint (TSP) and the previous as-left TSP is within the COT Acceptance Criteria. The COT Acceptance Criteria is defined as:

las-found TSP - previous as-left TSPl COT uncertainty The COT uncertainty shall not include the calibration tolerance.

2. The as-left TSP is within the established calibration tolerance band about the nominal TSP. The nominal TSP is the desired setting and shall not exceed the Limiting Safety System Setting (LSSS). The LSSS and the established calibration tolerance band are defined in accordance with the Ginna Instrument Setpoint Methodology. The channel is considered operable even if the as-left TSP is non-conservative with respect to the LSSS provided that the as-left TSP is within the established calibration tolerance band.

(b) Pressurizer Pressure 2000 psig.

(c) During CORE ALTERATIONS and movement of irradiated fuel assemblies within containment.

(d) Except when both MSIVs are closed and de-activated.

(e) Except when all Main Feedwater Regulating and associated bypass valves are closed and de-activated or isolated by a closed manual valve.

R.E. Ginna Nuclear Power Plant 3.3.2-10 Amendment 109

LOP DG Start Instrumentation 3.3.4 3.3 INSTRUMENTATION 3.3.4 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.4 Each 480 V safeguards bus shall have two OPERABLE channels of LOP DG Start Instrumentation.

APPLICABILITY: MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - MODES 5 and 6."

ACTIONS

- NOTE -

Separate Condition entry is allowed for each 480 V safeguards bus.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more 480 A.1 Place channel(s) in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT V bus(es) with one channel RICT inoperable.

B. Required Action B.1 Enter applicable Immediately and associated Completion Condition(s) and Required Action(s)

Time of Condition A not met. for the associated DG made inoperable by LOP DG start OR instrumentation.

One or more 480 V bus(es) with two channels inoperable.

R.E. Ginna Nuclear Power Plant 3.3.4-1 Amendment 109

Containment Ventilation Isolation Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Containment Ventilation Isolation Instrumentation LCO 3.3.5 The Containment Ventilation Isolation instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.5-1.

ACTIONS

- NOTE -

Separate Condition entry is allowed for each Function.

CONDITION REIQUIRED ACTION COMPLETION TIME A. One radiation A.1 Restore the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months INSERT monitoring channel inoperable. channel to OPERABLE status. RICT NOTE 2 B. B.1 Enter applicable Immediately Conditions and Required Actions of

- NOTE - LCO 3.6.3, "Containment Isolation Only applicable in MODE 1, 2, 3, Boundaries," for containment mini-or 4. purge isolation valves made inoperable by isolation One or more Functions with one instrumentation.

or more manual or automatic actuation trains inoperable.

OR Both radiation monitoring channels inoperable.

OR Required Action and associated Completion Time of Condition A not met.

R.E. Ginna Nuclear Power Plant 3.3.5-1 Amendment 85

Pressurizer PORVs 3.4.11 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

LCO 3.4.11 Each PORV and associated block valve shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

- NOTE -

1. Separate entry into Condition A is allowed for each PORV.

2. Separate entry into Condition C is allowed for each block valve.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or both A.1 Close and maintain power 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months PORVs OPERABLE and not to associated block valve.

capable of being automatically controlled. OR A.2 Place associated PORV in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months manual control.

B. One PORV inoperable. B.1 Close associated block 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months valve.

AND B.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated block valve.

AND INSERT B.3 Restore PORV to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT OPERABLE status.

C. One C.1 Place associated 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months block valve inoperable. PORV in manual control.

AND R.E. Ginna Nuclear Power Plant 3.4.11-1 Amendment 88

Pressurizer PORVs 3.4.11 CONDITION REQUIRED ACTION COMPLETION TIME INSERT C.2 Restore block valve to 7 days RICT OPERABLE status.

D. Both block valves D.1 Place associated PORVs in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. manual control.

AND INSERT D.2 Restore at least one block 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT NOTE valve to OPERABLE status. 2 E. Required Action E.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition A, B, C, or D not E.2 Be in MODE 4.

met.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months F. Two PORVs inoperable. F.1 Initiate action to restore one Immediately PORV to OPERABLE status.

AND F.2 Close associated block 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months valves.

AND F.3 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated block valves.

AND F.4 Be in MODE 3 with Tavg 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

< 500F.

R.E. Ginna Nuclear Power Plant 3.4.11-2 Amendment 88

Accumulators 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Accumulators LCO 3.5.1 Two ECCS accumulators shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure > 1600 psig.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One accumulator A.1 Restore boron 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months INSERT RICT inoperable due to boron concentration to within limits.

NOTE 2 concentration not within limits.

B. One accumulator B.1 Restore 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT inoperable for reasons other accumulator to OPERABLE RICT than Condition A. status. NOTE 2 C. Required Action C.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition A or B not C.2 Reduce pressurizer met. pressure to 1600 psig.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months D. Two accumulators D.1 Enter LCO 3.0.3. Immediately inoperable.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each accumulator motor operated isolation In accordance with the Surveillance valve is fully open.

Frequency Control Program In accordance with SR 3.5.1.2 Verify borated water volume in each accumulator is the Surveillance 1090 cubic feet (24%) and 1140 cubic feet (83%).

Frequency Control Program R.E. Ginna Nuclear Power Plant 3.5.1-1 Amendment No. 122

ECCS - MODES 1, 2, and 3 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS - MODES 1, 2, and 3 LCO 3.5.2 Two ECCS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

- NOTE -

1. In MODE 3, both safety injection (SI) pump flow paths may be isolated by closing the isolation valves for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to perform pressure isolation valve testing per SR 3.4.14.1. Power may be restored to motor operated isolation valves 878B and 878D for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for the purpose of testing per SR 3.4.14.1 provided that power is restored to only one valve at a time.

2. Operation in MODE 3 with ECCS pumps declared inoperable pursuant to LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," is allowed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or until the temperature of both RCS cold legs exceeds 375F, whichever comes first.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One train inoperable. A.1 Restore train to OPERABLE 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months INSERT status. RICT NOTE 2 AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C. Two trains inoperable. C.1 Enter LCO 3.0.3 Immediately R.E. Ginna Nuclear Power Plant 3.5.2-1 Amendment 118

Containment Air Locks 3.6.2 3.6 CONTAINMENT SYSTEMS 3.6.2 Containment Air Locks LCO 3.6.2 Two containment air locks shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

- NOTE -

1. Entry and exit is permissible to perform repairs on the affected air lock components.

2. Separate Condition entry is allowed for each air lock.

3. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when air lock leakage results in exceeding the overall containment leakage rate acceptance criteria.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more containment

- NOTE -

air locks with one containment

1. Required Actions A.1, air lock door inoperable.

A.2, and A.3 are not applicable if both doors in the same air lock are inoperable and Condition C is entered.

2. Entry and exit is permissible for 7 days under administrative controls if both air locks are inoperable.

A.1 Verify the OPERABLE door 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is closed in the affected air lock.

AND R.E. Ginna Nuclear Power Plant 3.6.2-1 Amendment 80

Containment Air Locks 3.6.2 CONDITION REQUIRED ACTION COMPLETION TIME A.2 Lock the OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.

AND A.3

- NOTE -

Air lock doors in high radiation areas may be verified locked closed by administrative means.

Verify the OPERABLE door is locked closed in the affected Once per 31 days air lock.

B. One or more containment

- NOTE -

air locks with containment air lock

1. Required Actions B.1, interlock mechanism inoperable.

B.2, and B.3 are not applicable if both doors in the same air lock are inoperable and Condition C is entered.

2. Entry and exit of containment is permissible under the control of a dedicated individual.

B.1 Verify an OPERABLE door is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months closed in the affected air lock.

AND Lock an OPERABLE door B.2 closed in the affected air 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months lock.

AND R.E. Ginna Nuclear Power Plant 3.6.2-2 Amendment 80

Containment Air Locks 3.6.2 CONDITION REQUIRED ACTION COMPLETION TIME B.3

- NOTE -

Air lock doors in high radiation areas may be verified locked closed by administrative means.

Verify an OPERABLE door is Once per 31 days locked closed in the affected air lock.

C. One or more containment C.1 Initiate action to evaluate Immediately air locks inoperable for overall containment leakage reasons other than rate per LCO 3.6.1.

Condition A or B.

AND C.2 Verify a door is closed in the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months affected air lock.

AND INSERT C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months RICT OPERABLE status. NOTE 2 D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months R.E. Ginna Nuclear Power Plant 3.6.2-3 Amendment 80

Containment Isolation Boundaries 3.6.3 3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Boundaries LCO 3.6.3 Each containment isolation boundary shall be OPERABLE.

- NOTE -

1. Not applicable to the main steam safety valves in MODES 1, 2, and 3.

2. Not applicable to the main steam isolation valves (MSIVs) in MODE 1, and in MODES 2 and 3 with the MSIVs open or not deactivated.

3. Not applicable to the atmospheric relief valves in MODES 1 and 2, and in MODE 3 with the Reactor Coolant System average temperature (Tavg) 500F.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

- NOTE -

1. Penetration flow path(s), except for Shutdown Purge System valve flow paths, may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path.

3. Enter applicable Conditions and Required Actions for systems made inoperable by containment isolation boundaries.

4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when isolation boundary leakage results in exceeding the overall containment leakage rate acceptance criteria.

R.E. Ginna Nuclear Power Plant 3.6.3-1 Amendment 80

Containment Isolation Boundaries 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME A. A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months INSERT penetration flow path by use of RICT

- NOTE - at least one closed and de-Only applicable to activated automatic valve, penetration flow paths which closed manual valve, blind do not use a closed system flange, or check valve with as a containment isolation flow through the valve boundary. secured.

One or more penetration AND flow paths with one containment isolation A.2 boundary inoperable except

- NOTE -

for mini-purge valve Isolation boundaries in high leakage not within limit.

radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. for isolation boundaries outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation boundaries inside containment R.E. Ginna Nuclear Power Plant 3.6.3-2 Amendment 80

Containment Isolation Boundaries 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME B. B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months penetration flow path by use

- NOTE - of at least one closed and de-Only applicable to activated automatic valve, penetration flow paths which closed manual valve, or blind do not use a closed system flange.

as a containment isolation boundary.

One or more penetration flow paths with two containment isolation boundaries inoperable except for mini-purge valve leakage not within limit.

INSERT C. C.1 Isolate the affected 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT penetration flow path by use

- NOTE - of at least one closed and de-Only applicable to activated automatic valve, penetration flow paths which closed manual valve, or blind use a closed system as a flange.

containment isolation boundary. AND One or more penetration flow paths with one containment isolation boundary inoperable.

R.E. Ginna Nuclear Power Plant 3.6.3-3 Amendment 80

Containment Isolation Boundaries 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME C.2

- NOTE -

Isolation boundaries in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation isolated. for isolation boundaries outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation boundaries inside containment D. One or more mini-purge D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months penetration flow paths with one penetration flow path by use valve not within leakage limits. of at least one closed and de-activated automatic valve, closed manual valve, or blind flange.

AND R.E. Ginna Nuclear Power Plant 3.6.3-4 Amendment 80

Containment Isolation Boundaries 3.6.3 CONDITION REQUIRED ACTION COMPLETION TIME D.2

- NOTE -

Isolation boundaries in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is for isolation isolated. boundaries outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation boundaries inside containment E. One or more mini-purge E.1 Initiate action to evaluate Immediately penetration flow paths with two overall containment leakage valves not within leakage limits. rate per LCO 3.6.1.

AND INSERT E.2 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT penetration flow path by use of NOTE 2 at least one closed and de-activated automatic valve, closed manual valve, or blind flange.

F. Required Action and F.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND F.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months R.E. Ginna Nuclear Power Plant 3.6.3-5 Amendment 80

CS, CRFC, and NaOH Systems 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray (CS), Containment Recirculation Fan Cooler (CRFC), and NaOH Systems LCO 3.6.6 Two CS trains, four CRFC units, and the NaOH system shall be OPERABLE.

- NOTE -

In MODE 4, both CS pumps may be in pull-stop for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the performance of interlock and valve testing of motor operated valves (MOVs) 857A, 857B, and 857C. Power may also be restored to MOVs 896A and 896B, and the valves placed in the closed position, for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the purpose of each test.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One CS train inoperable. A.1 Restore CS train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months INSERT OPERABLE status. RICT NOTE 2 B. NaOH system inoperable. B.1 Restore NaOH System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

C. Required Action C.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition A or B not C.2 Be in MODE 5.

met.

84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months INSERT D. One or two D.1 Restore CRFC unit(s) to 7 days RICT CRFC units inoperable. OPERABLE status. NOTE 2 E. Required Action E.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition D not met. E.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months R.E. Ginna Nuclear Power Plant 3.6.6-1 Amendment 118

MSSVs 3.7.1 3.7 PLANT SYSTEMS 3.7.1 Main Steam Safety Valves (MSSVs)

LCO 3.7.1 Eight MSSVs shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

- NOTE -

Separate Condition entry is allowed for each MSSV.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MSSVs A.1 Restore inoperable 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months INSERT inoperable. MSSV(s) to OPERABLE RICT NOTE status. 2 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months R.E. Ginna Nuclear Power Plant 3.7.1-1 Amendm ent 80

MSIVs and Non-Return Check Valves 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs) and Non-Return Check Valves LCO 3.7.2 Two MSIVs and two non-return check valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 except when all MSIVs are closed and de-activated.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One or more valves A.1 Restore valve(s) to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months RICT NOTE inoperable in flowpath from a OPERABLE status. 2 steam generator (SG) in MODE 1.

B. Required Action and B.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not met.

C. One or more valves C.1 Close MSIV. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable in flowpath from a SG in MODE 2 or 3. AND C.2 Verify MSIV is closed. Once per 7 days D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time of Condition C not met. AND D.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. One or more valves E.1 Enter LCO 3.0.3. Immediately inoperable in flowpath from each SG.

R.E. Ginna Nuclear Power Plant 3.7.2-1 Amendment 80

ARVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Relief Valves (ARVs)

LCO 3.7.4 Two ARV lines shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with Reactor Coolant System average temperature (Tavg) 500F.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One ARV line inoperable. A.1 Restore ARV line to 7 days RICT OPERABLE status.

B. Required Action B.1 Be in MODE 3 with Tavg 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and associated Completion Time < 500F.

of Condition A not met.

C. Two ARV lines C.1 Enter LCO 3.0.3. Immediately inoperable.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.4.1 Perform a complete cycle of each ARV. In accordance with the Surveillance Frequency Control Program In accordance with SR 3.7.4.2 Verify one complete cycle of each ARV block valve.

the Surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant 3.7.4-1 Amendment No. 122

AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Two motor driven AFW (MDAFW) trains, one turbine driven AFW (TDAFW) train, and two standby AFW (SAFW) trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One TDAFW A.1 Restore TDAFW 7 days RICT train flowpath inoperable. train flowpath to OPERABLE status.

INSERT B. One MDAFW train B.1 Restore MDAFW train to 7 days RICT inoperable. OPERABLE status.

C. TDAFW train C.1 inoperable. OR - NOTE -

LCO 3.0.4.b is not Two MDAFW trains applicable.

inoperable.

INSERT Restore one MDAFW train or 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT OR TDAFW train flowpath to OPERABLE status.

One TDAFW train flowpath and one MDAFW train inoperable to opposite steam generators (SGs).

R.E. Ginna Nuclear Power Plant 3.7.5-1 Amendment 88

AFW System 3.7.5 CONDITION REQUIRED ACTION COMPLETION TIME D. All AFW trains to D.1 one or more SGs inoperable.

- NOTE -

LCO 3.0.4.b is not applicable.

Restore one AFW train or TDAFW 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months INSERT RICT NOTE flowpath to each affected SG to 2 OPERABLE status.

INSERT E. One SAFW train E.1 Restore SAFW train to 14 days RICT inoperable. OPERABLE status.

INSERT F. Both SAFW trains F.1 Restore one SAFW train to 7 days RICT NOTE inoperable. OPERABLE status. 2 G. Required Action andG.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time for Condition A, B, C, D, E, or F G.2 Be in MODE 4.

not met.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months H. Three AFW H.1 trains and both SAFW trains inoperable. - NOTE -

LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one MDAFW, TDAFW, or SAFW train is restored to OPERABLE status.

Initiate action to restore one MDAFW, TDAFW, or SAFW Immediately train to OPERABLE status.

R.E. Ginna Nuclear Power Plant 3.7.5-2 Amendment 88

CCW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Component Cooling Water (CCW) System LCO 3.7.7 Two CCW trains, two CCW heat exchangers, and the CCW loop header shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One CCW train A.1 Restore CCW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT inoperable. OPERABLE status.

B. One CCW heat B.1 Restore CCW heat 31 days exchanger inoperable. exchanger to OPERABLE status.

C. Required Action C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition A or B not AND met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months D. Two CCW trains, two CCW

- NOTE -

heat exchangers, or loop LCO 3.0.3 and all other header inoperable.

LCO Required Actions requiring MODE changes are suspended until one CCW train, one CCW heat exchanger, and the loop header are restored to OPERABLE status.

D.1 Initiate Action to restore one Immediately CCW train, one heat exchanger, and loop header to OPERABLE status.

AND R.E. Ginna Nuclear Power Plant 3.7.7-1 Amendment 80

SW System 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Service Water (SW) System LCO 3.7.8 Four SW pumps and the SW loop header shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One A.1 Restore SW 14 days RICT SW pump inoperable. pump to OPERABLE status.

INSERT B. Two SW B.1 Restore SW 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT pumps inoperable. pump(s) to OPERABLE status.

C. Required Action C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of Condition A or B not AND met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months D. Three or more SW D.1 pumps or loop header inoperable. - NOTE -

Enter applicable conditions and Required Actions of LCO 3.7.7, "CCW System,"

for the component cooling water heat exchanger(s) made inoperable by SW.

Enter LCO 3.0.3. Immediately R.E. Ginna Nuclear Power Plant 3.7.8-1 Amendment 102

AC Sources - MODES 1, 2, 3, and 4 3.8.1 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources - MODES 1, 2, 3, and 4 LCO 3.8.1 The following AC electrical sources shall be OPERABLE:

a. One qualified independent offsite power circuit connected between the offsite transmission network and each of the onsite 480 V safeguards buses required by LCO 3.8.9, "Distribution Subsystems

- MODES 1, 2, 3, and 4"; and

b. Two emergency diesel generators (DGs) capable of supplying their respective onsite 480 V safeguards buses required by LCO 3.8.9.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

- NOTE -

LCO 3.0.4.b is not applicable to DGs.

CONDITION REQUIRED ACTION COMPLETION TIME A. Offsite power to A.1 Declare required feature(s) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from one or more 480 V safeguards inoperable when its discovery of bus(es) inoperable. redundant required Condition A feature(s) is inoperable. concurrent with inoperability of redundant required feature(s)

AND INSERT A.2 Restore offsite circuit to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT NOTE OPERABLE status. 2 B. One DG inoperable. B.1 Perform SR 3.8.1.1 for the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months offsite circuit.

AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND R.E. Ginna Nuclear Power Plant 3.8.1-1 Amendment 109

AC Sources - MODES 1, 2, 3, and 4 3.8.1 CONDITION REQUIRED ACTION COMPLETION TIME B.2 Declare required feature(s) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from supported by the inoperable DG discovery of inoperable when its required Condition B redundant feature(s) is inoperable. concurrent with inoperability of redundant required feature(s)

AND B.3.1 Determine OPERABLE DG is not inoperable due to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months common cause failure.

OR B.3.2 Perform SR 3.8.1.2 for OPERABLE DG. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months AND B.4 Restore DG to OPERABLE INSERT status. 7 days RICT C. Offsite power to

- NOTE -

one or more 480 V safeguards Enter applicable Conditions and bus(es) inoperable.

Required Actions of LCO 3.8.9, "Distribution AND Systems - MODES 1, 2, 3, and 4,"

when Condition C is entered with no One DG inoperable.

AC power source to one distribution train.

C.1 Restore required offsite circuit to OPERABLE 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months INSERT RICT status.

OR C.2 Restore DG to OPERABLE INSERT status. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months RICT R.E. Ginna Nuclear Power Plant 3.8.1-2 Amendment 109

DC Sources - MODES 1, 2, 3, and 4 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - MODES 1, 2, 3, and 4 LCO 3.8.4 The Train A and Train B DC electrical power sources shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT A. One DC electrical power A.1 Restore DC electrical power 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months RICT source inoperable. source to OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time of Condition A not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C. Both DC electrical power C.1 Enter LCO 3.0.3. Immediately sources inoperable.

R.E. Ginna Nuclear Power Plant 3.8.4-1 Amendment 80

AC Instrument Bus Sources - MODES 1, 2, 3, and 4 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 AC Instrument Bus Sources - MODES 1, 2, 3, and 4 LCO 3.8.7 The following AC instrument bus power sources shall be OPERABLE:

a. Inverters for Instrument Buses A and C; and

b. Class 1E constant voltage transformer (CVT) for Instrument Bus B.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One inverter inoperable. A.1 Power AC instrument bus 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months from its Class 1E or non-Class 1E CVT.

AND A.2 Power AC instrument bus 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from its Class 1E CVT.

AND INSERT A.3 Restore inverter to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months RICT OPERABLE status.

B. Class 1E CVT for AC B.1 Power AC Instrument Bus B 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Instrument Bus B from its non-Class 1E CVT.

inoperable.

AND INSERT Restore Class 1E CVT for 7 days RICT B.2 AC Instrument Bus B to NOTE 2 OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months R.E. Ginna Nuclear Power Plant 3.8.7-1 Amendment 80

Distribution Systems - MODES 1, 2, 3, and 4 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems - MODES 1, 2, 3, and 4 LCO 3.8.9 Train A and Train B of the following electrical power distribution subsystems shall be OPERABLE:

a. AC power;

b. AC instrument bus power; and

c. DC power.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical power A.1 Restore AC electrical power 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months INSERT RICT distribution train inoperable. distribution train to OPERABLE status.

B. One AC instrument bus B.1 Restore AC instrument bus 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months INSERT electrical power distribution electrical power distribution RICT train inoperable. train to OPERABLE status. NOTE 2 INSERT C. One DC electrical C.1 Restore DC electrical power 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months RICT power distribution train distribution train to inoperable. OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Conditions A, B, or C not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months E. Two trains with inoperable E.1 Enter LCO 3.0.3. Immediately electrical power distribution subsystems that result in a loss of safety function.

R.E. Ginna Nuclear Power Plant 3.8.9-1 Amendment 80

Programs and Manuals 5.5

f. The quantitative limits on unfiltered air inleakage into the CRE.

These limits shall be stated in a manner to allow direct comparison to the unfiltered air inleakage measured by the testing described in paragraph c. The unfiltered air inleakage limit for radiological challenges is the inleakage flow rate assumed in the licensing basis analyses of DBA consequences.

Unfiltered air inleakage limits for hazardous chemicals must ensure that exposure of CRE occupants to these hazards will be within the assumptions in the licensing basis.

g. The provisions of SR 3.0.2 are applicable to the Frequencies for assessing CRE habitability and determining CRE unfiltered inleakage as required by paragraph c.

5.5.2 Surveillance Frequency Control Program This program provides controls for the Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of the Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Controlled Program shall be made in accordance with NEI 04-10, Risk-Informed Method for Control of Surveillance Frequency, Revision 1.

c. The provisions of Surveillance Requirement 3.0.2 and 3.0.3 are INSERT applicable to the Frequencies established in the Surveillance RICT Frequency Control Program.

PROGRAM R.E. Ginna Nuclear Power Plant 5.5-13 Amendment No. 122

ATTACHMENT 3 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Proposed Technical Specification Bases Changes (Mark-Ups)

(for Information Only)

TS Bases Pages B 3.3.1-30 B 3.5.2-10 B 3.8.4-5 B 3.3.1-31 B 3.6.2-6 B 3.8.7-4 B 3.3.1-34 B 3.6.3-7 B 3.8.7-5 B 3.3.1-35 B 3.6.3-8 B 3.8.9-6 B 3.3.1-36 B 3.6.6-7 B 3.8.9-7 B 3.3.1-37 B 3.6.6-8 B 3.8.9-8 B 3.3.2-26 B 3.7.1-3 B 3.3.2-27 B 3.7.2-4 B 3.3.2-28 B 3.7.4-3 B 3.3.2-29 B 3.7.5-5 B 3.3.2-30 B 3.7.5-6 B 3.3.4-6 B 3.7.5-7 B 3.3.5-6 B 3.7.7-4 B 3.4.11-4 B 3.7.8-6 B 3.4.11-5 B 3.8.1-8 B 3.5.1-5 B 3.8.1-10 B 3.5.1-6 B 3.8.1-11

RTS Instrumentation B 3.3.1 A.1 Condition A applies to all RTS protection functions. Condition A addresses the situation where one required channel for one or more Functions is inoperable or if both source range channels are inoperable. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

When the number of inoperable channels in a trip Function exceed those specified in all related Conditions associated with a trip Function, then the plant is outside the safety analysis.

Therefore, LCO 3.0.3 must be immediately entered if the trip Function is applicable in the current MODE of operation. This essentially applies to the loss of more than one channel of any RTS Function except with respect to Condition H.

B.1 Condition B applies to the Manual Reactor Trip Function in MODE 1 or 2 and in MODES 3, 4, and 5 with the CRD system capable of rod withdrawal or all rods not fully inserted. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or within the RICT. In this Condition, the remaining OPERABLE channel is adequate to perform the required safety function.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is These COMPLETION TIMES are reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.

C.1, C.2, and C.3 If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time of Condition B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , action must be initiated within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to ensure that all rods are fully inserted, and the Control Rod Drive System must be placed in a condition incapable of rod withdrawal within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . The Completion Times provide adequate time to exit the MODE of Applicability from full power operation in an orderly manner without challenging plant systems based on operating experience.

D.1 Condition D applies to the following reactor trip Functions:

Power Range Neutron Flux-High;

Power Range Neutron Flux-Low; R.E. Ginna Nuclear Power Plant B 3.3.1-30 Revision 61

RTS Instrumentation B 3.3.1

Overtemperature T;

Overpower T;

Pressurizer Pressure-High;

Pressurizer Water Level-High; and

SG Water Level-Low Low.

With one channel inoperable, the channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or within the RICT. Placing the channel in the tripped condition results in a partial trip condition. For the Power Range Neutron Flux-High, Power Range Neutron Flux-Low, Overtemperature T, and Overpower T functions, this results in a one-out-of-three logic for actuation. For the Pressurizer Pressure-High and Pressurizer Water Level-High Functions, this results in a one-out-of two logic for actuation. For the SG Water Level-Low Low Function, this results in a one-out-of-two logic per each affected SG for actuation. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.

Alternatively, a COMPLETION TIME can be determined in accordance with the Risk Informed Completion Time Program.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of other channels.

This includes placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

E.1 and E.2 Condition E applies to the Intermediate Range Neutron Flux trip Function when THERMAL POWER is below 6% RTP and one channel is inoperable. Below the P-10 setpoint, the NIS intermediate range detector performs a monitoring and protection function. With one NIS intermediate range channel inoperable, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is allowed to either reduce THERMAL POWER below 5E-11amps or increase THERMAL POWER above 8% RTP. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above 8% RTP or below 5E-11amps and take into account the redundant capability afforded by the redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out- of-two logic. Tripping one channel would trip the reactor.

Thus, the Required Actions specified in this Condition are only applicable when channel inoperability does not result in reactor trip.

R.E. Ginna Nuclear Power Plant B 3.3.1-31 Revision 61

RTS Instrumentation B 3.3.1 K.1 Condition K applies to the following reactor trip Functions:

Pressurizer Pressure-Low;

Reactor Coolant Flow-Low (Two Loops);

RCP Breaker Position (Two Loops);

Undervoltage-Bus 11A and 11B; and

Underfrequency-Bus 11A and 11B.

With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or within the RICT. Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the channel in the tripped condition is consistent with Reference 9 if the inoperable channel cannot be restored to OPERABLE status. Alternatively, a COMPLETION TIME can be determined in accordance with the Risk Informed Completion Time Program.

Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel(s), and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition K.

For the Reactor Coolant Flow-Low (Two Loops) Function, Condition K applies on a per loop basis. For the RCP Breaker Position (Two Loops) Function, Condition K applies on a per RCP basis. For Undervoltage-Bus 11A and 11B and underfrequency-Bus 11A and 11B, Condition K applies on a per bus basis. This allows one inoperable channel from each loop, RCP, or bus to be considered on a separate condition entry basis.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels.

R.E. Ginna Nuclear Power Plant B 3.3.1-34 Revision 61

RTS Instrumentation B 3.3.1 L.1 If the Required Action and Completion Time of Condition K is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 1 < 8.5% RTP at which point the Function is no longer required. An alternative is not provided for increasing THERMAL POWER above the P-8 setpoint for the Reactor Coolant Flow-Low (Two Loops) and RCP Breaker Position (Two Loops) trip Functions since this places the plant in Condition M. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 1 < 8.5% RTP from full power conditions in an orderly manner and without challenging plant systems.

M.1 Condition M applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip Function.

Condition M applies on a per loop basis. With one channel per loop inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or within the RICT. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or place in trip is consistent with Reference 9. Alternatively, a COMPLETION TIME can be determined in accordance with the Risk Informed Completion Time Program.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the two OPERABLE channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

N.1 Condition N applies to the RCP Breaker Position (Single Loop) trip Function. Condition N applies on a per loop basis. There is one breaker position device per RCP breaker. With one channel per RCP inoperable, the inoperable channel must be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or within the RICT. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status is consistent with Reference 9. Alternatively, a COMPLETION TIME can be determined in accordance with the Risk Informed Completion Time Program.

O.1 If the Required Action and associated Completion Time of Condition M or N is not met, the plant must be placed in a MODE where the Functions are not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced to < 30% RTP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 9.

R.E. Ginna Nuclear Power Plant B 3.3.1-35 Revision 61

RTS Instrumentation B 3.3.1 P.1 Condition P applies to Turbine Trip on Low Autostop Oil Pressure or on Turbine Stop Valve Closure in MODE 1 above the P-9 setpoint. With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or within the RICT. If placed in the tripped Condition, this results in a partial trip condition requiring only one additional channel to initiate a reactor trip. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is consistent with Reference 9. Alternatively, a CT can be determined in accordance with the Risk Informed Completion Time Program.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each remaining OPERABLE channel. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

Q.1, Q.2.1, and Q.2.2 If the Required Action and Associated Completion Time of Condition P are not met, the plant must be placed in a MODE where the Turbine Trip Functions are no longer required to be OPERABLE.

To achieve this status, THERMAL POWER must be reduced to < 50% RTP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 9.

The Steam Dump system must also be verified OPERABLE within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months or THERMAL POWER must be reduced to < 8% RTP. This ensures that either the secondary system or RCS is capable of handling the heat rejection following a reactor trip. The Completion Times are reasonable considering the need to perform the actions in an orderly manner and the low probability of an event occurring in this time.

R.1 Condition R applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES 1 and 2. With one train inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , or within the RICT, is allowed to restore the train to OPERABLE status. These Completion Times of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the train to OPERABLE status is are reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.

The Required Action has been modified by a Note that allows bypassing one train up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE.

R.E. Ginna Nuclear Power Plant B 3.3.1-36 Revision 61

RTS Instrumentation B 3.3.1 S.1 and S.2 Condition S applies to the P-6, P-7, P-8, P-9, and P-10 permissives. With one channel inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the associated RTS channel(s) must be declared inoperable. These actions are conservative for the case where power level is being raised. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator actions.

T.1 Condition T applies to the RTBs in MODES 1 and 2. With one train inoperable, it must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , or within the RICT 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the train to OPERABLE status. These 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Times is are based on operating experience and the minimum amount of time allowed for manual operator actions.

The Required Action has been modified by two Notes. Note 1 allows one train to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms if the other RTB train is OPERABLE. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance is in addition to the 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing (e.g., if a RTB fails 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months into its testing window, it must be restored within 6 additional hours (or 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months from start of test)).

U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms (i.e., diverse trip features) in MODES 1 and 2. Condition U applies on a RTB basis. This allows one diverse trip feature to be inoperable on each RTB. However, with two diverse trip features inoperable (i.e.,

one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable considering the low probability of an event occurring during this time interval.

With one trip mechanism for one RTB inoperable, it must be restored to an OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or within the RICT. The affected RTB shall not be bypassed while one of the diverse trip features is inoperable except for the time required to perform maintenance to one of the diverse trip features. The allowable time for performing maintenance of the diverse trip features is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the reasons stated under Condition T. These Completion Times of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for Required Action U.2 is are reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

R.E. Ginna Nuclear Power Plant B 3.3.1-37 Revision 61

ESFAS Instrumentation B 3.3.2 B.1 Condition B applies to the AFW-Trip of Both MFW Pumps ESFAS Function. If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or within the RICT is allowed to return it to OPERABLE status. These specified Completion Times of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is are reasonable considering the nature of this Function, the available redundancy, and the low probability of an event occurring during this interval.

C.1 If the Required Action and Completion Time of Condition B is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion time is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

D.1 Condition D applies to the following ESFAS Functions:

Manual Initiation of SI;

Manual Initiation of Steam Line Isolation; and

AFW-Undervoltage-Bus 11A and 11B.

If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or within the RICT is allowed to restore it to OPERABLE status.

These specified Completion Times of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is are reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each manual initiation Function, additional AFW actuation channels available besides the Undervoltage- Bus 11A and 11B AFW Initiation Function, and the low probability of an event occurring during this interval.

E.1 Condition E applies to the automatic actuation logic and actuation relays for the following ESFAS Functions:

Steam Line Isolation;

Feedwater Isolation; and

AFW.

R.E. Ginna Nuclear Power Plant B 3.3.2-26 Revision 42

ESFAS Instrumentation B 3.3.2 Condition E addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this time interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 7. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

F.1 Condition F applies to the following Functions:

Steam Line Isolation-Containment Pressure-High High;

Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg -Low;

Steam Line Isolation-High-High Steam Flow Coincident With Safety Injection;

Feedwater Isolation-SG Water Level-High; and

AFW-SG Water Level-Low Low.

Condition F applies to Functions that typically operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out- of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Placing the channel in the Tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for testing, are justified in Reference 7. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

R.E. Ginna Nuclear Power Plant B 3.3.2-27 Revision 42

ESFAS Instrumentation B 3.3.2 G.1 If the Required Actions and Completion Times of Conditions D, E, or F are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

H.1 Condition H applies to the following ESFAS functions:

Manual Initiation of CS; and

Manual Initiation of Containment Isolation.

If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to OPERABLE status. The specified Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or within the RICT is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each Function (except for CS) and the low probability of an event occurring during this interval.

I.1 Condition I applies to the automatic actuation logic and actuation relays for the following Functions:

SI;

CS; and

Containment Isolation.

Condition I addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 7. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

R.E. Ginna Nuclear Power Plant B 3.3.2-28 Revision 42

ESFAS Instrumentation B 3.3.2 J.1 Condition J applies to the following Functions:

SI-Containment Pressure-High; and

CS-Containment Pressure-High High.

Condition J applies to Functions that operate on a two-out-of-three logic (for CS-Containment Pressure-High High there are two sets of this logic). Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

K.1 If the Required Actions and Completion Times of Conditions H, I, or J are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

L.1 Condition L applies to the following Functions:

SI-Pressurizer Pressure-Low; and

SI-Steam Line Pressure-Low.

R.E. Ginna Nuclear Power Plant B 3.3.2-29 Revision 42

ESFAS Instrumentation B 3.3.2 Condition L applies to Functions that operate on a two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

M.1 If the Required Actions and Completion Times of Condition L are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 2000 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

N.1 Condition N applies if an AFW Manual Initiation channel is inoperable. If a manual initiation switch is inoperable, the associated AFW or SAFW pump must be declared inoperable and the applicable Conditions of LCO 3.7.5, "Auxiliary Feedwater (AFW) System" must be entered immediately. Each AFW manual initiation switch controls one AFW or SAFW pump. Declaring the associated pump inoperable ensures that appropriate action is taken in LCO 3.7.5 based on the number and type of pumps involved.

R.E. Ginna Nuclear Power Plant B 3.3.2-30 Revision 42

LOP DG Start Instrumentation B 3.3.4 LOP or degraded power to the 480 V safeguards buses.

ACTIONS In the event a relay's trip setpoint is found to be nonconservative with respect to the CHANNEL CALIBRATION Acceptance Criteria, or the channel is found to be inoperable, then the channel must be declared inoperable and the LCO Condition entered as applicable.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. This Note states that separate Condition entry is allowed for each 480 V safeguards bus.

A.1 With one or more 480 V bus(es) with one channel inoperable, Required Action A.1 requires the inoperable channel(s) to be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or in accordance with Risk Informed Completion Time Program. With an undervoltage channel in the tripped condition, the LOP DG start instrumentation channels are configured to provide a one-out-of- one logic to initiate a trip of the incoming offsite power for the respective bus. The remaining OPERABLE channel is comprised of one-out-of-two logic from the degraded and loss of voltage relays. Any additional failure of either of these two OPERABLE relays requires entry into Condition B.

B.1 Condition B applies to the LOP DG start Function when the Required Action and associated Completion Time for Condition A are not met or with one or more 480 V bus(es) with two channels of LOP start instrumentation inoperable.

Condition B requires immediate entry into the Applicable Conditions specified in LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4," or LCO 3.8.2, "AC Sources - MODES 5 and 6," for the DG made inoperable by failure of the LOP DG start instrumentation. The actions of those LCOs provide for adequate compensatory actions to assure plant safety.

SURVEILLANCE The Surveillances are modified by a Note to indicate that, when a channel is REQUIREMENTS placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , provided the second channel maintains trip capability. Upon completion of the Surveillance, or expiration of the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the assumption that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform channel surveillance. Based on engineering judgement, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months testing allowance does not R.E. Ginna Nuclear Power Plant B 3.3.4-6 Revision 37

Containment Ventilation Isolation Instrumentation B 3.3.5 ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by plant specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification.

A channel is considered OPERABLE when:

a. The nominal trip setpoint is equal to or conservative with respect to the LSSS;

b. The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and

c. The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.

The channel is still operable even if the as-left trip setpoint is non- conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.

A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.5-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the failure of one containment ventilation isolation radiation monitor channel. Since the two containment radiation monitors measure different parameters, failure of a single channel may result in loss of the radiation monitoring Function for certain events.

Consequently, the failed channel must be restored to OPERABLE status. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time, or the Completion Time determined in accordance with the RICT, allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that one or more of the remaining channels will respond to most events.

R.E. Ginna Nuclear Power Plant B 3.3.5-6 Revision 42

Pressurizer PORVs B 3.4.11 both automatically opening and automaticaly closing. For these reasons, the block valve may either be closed to isolate the flowpaths or isolated by placing the PORV control switch in the closed position. However, if the block valve is closed to isolate the flowpath, the Action requires power be maintained to the valve. This Condition is only intended to permit operation of the plant for a limited period of time not to exceed the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem. Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE status prior to entering startup (MODE 2). Seat leakage problems are controlled by LCO 3.4.13, "RCS Operational LEAKAGE."

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

B.1, B.2, and B.3 If one PORV is not capable of being manually cycled, it is inoperable and must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. PORV inoperability includes (but is not limited to) the inability of the solenoid operated isolation valve from the nitrogen accumulator to open or the solenoid operated isolation valve from instrument air to vent. The Completion Times of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is a second PORV that is OPERABLE, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore the inoperable PORV to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If the PORV cannot be restored within this time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.

C.1 and C.2 If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in manual control. The prime importance for the capability to close the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the Required Action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. Manual control is accomplished by placing the PORV control board switch in the closed position. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because the PORV is not capable of automatically opening R.E. Ginna Nuclear Power Plant B 3.4.11-4 Revision 58

Pressurizer PORVs B 3.4.11 and the small potential for an SGTR or other event requiring Manual operation, the operator is permitted a Completion Time of 7 days to restore the inoperable block valve to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The time allowed to restore the block valve is limited to 7 days since the PORVs are not capable of automatically mitigating an overpressure event when placed in manual control. If the block valve is restored within the determined Completion Times of 7 days, the PORV will again be capable of automatically responding to an overpressure event, and the block valves capable of isolating a stuck open PORV which may result from the overpressure event. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.

D.1 and D.2 If both block valves are inoperable, then it is necessary to either restore at least one block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the PORVs in manual control.

The prime importance for the capability to close the block valve is to isolate a stuck open PORV.

Therefore, if the block valves cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the Required Action is to place the PORVs in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. Manual control is accomplished by placing the PORV control board switch in the closed position. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because the PORV is not capable of automatically opening and the small potential for an SGTR or other event requiring Manual operation, the operator is permitted a Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or as permitted by RICT, to restore at least one inoperable block valve to OPERABLE status. The time allowed to restore one block valve is limited to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months since the PORVs are not capable of automatically mitigating an overpressure event when placed in manual control. If at least one block valve is restored within the determined Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , at least one PORV will again be capable of automatically responding to an overpressure event, and the associated block valve capable of isolating a stuck open PORV which may result from the overpressure event. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.

R.E. Ginna Nuclear Power Plant B 3.4.11-5 Revision 58

Accumulators B 3.5.1 APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 1600 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

This LCO is only applicable at pressures > 1600 psig. At pressures 1600 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 5) limit of 2200ºF.

In MODE 3, with RCS pressure 1600 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.

ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood since the accumulator water volume is very small when compared to RCS and RWST inventory. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators are not expected to discharge following a large steam line break. Even if they do discharge, their impact is minor and not a design limiting event. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or within the RICT is allowed to return the boron concentration to within limits.

B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this Condition, the required contents of one accumulator cannot be assumed to reach the core during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time to open the valve, remove R.E. Ginna Nuclear Power Plant B 3.5.1-5 Revision 44

Accumulators B 3.5.1 power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the potential for exposure of the plant to a LOCA under these conditions.

The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed to restore an inoperable accumulator to OPERABLE status is justified in WCAP-15049-A, Rev. 1 (Ref. 10). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to 1600 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If both accumulators are inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Each accumulator motor-operated isolation valve shall be verified to be fully open. Use of control board indication for valve position is an acceptable verification. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

R.E. Ginna Nuclear Power Plant B 3.5.1-6 Revision 77

ECCS - MODES 1, 2, and 3 B 3.5.2 In MODES 4, 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Mode 4 core cooling requirements are addressed by LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.5.3, "ECCS - MODE 4." Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops -

MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level 23 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."

ACTIONS A.1 With one train inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC reliability evaluation (Ref. 12) and is a reasonable time for repair of many ECCS components. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

An ECCS train is inoperable if it is not capable of delivering 100% design flow to the RCS.

Individual components are inoperable if they are not capable of performing their design function.

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one active component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that 100% of the ECCS flow equivalent to a single OPERABLE ECCS train remains available. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.

In the case where SI Pump C is inoperable, both RCS cold leg injection lines must be OPERABLE to provide 100% of the ECCS flow equivalent to a single train of SI due to the location of check valves 870A and 870B.

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 2) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

R.E. Ginna Nuclear Power Plant B 3.5.2-10 Revision 76

Containment Air Locks B 3.6.2 Additionally, the affected air lock must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time or in accordance with the Risk Informed Completion Time Program. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock and the containment overall leakage rate is acceptable.

D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established based on industry experience. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is as required by the Containment Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 requires that the results of this SR be evaluated against the acceptance criteria of the Containment Leakage Rate Testing Program. This ensures that air lock leakage is properly accounted for in determining the overall containment leakage rate.

R.E. Ginna Nuclear Power Plant B 3.6.2-6 Revision 21

Containment Isolation Boundaries B 3.6.3 A.1 In the event one containment isolation boundary in one or more penetration flow paths is inoperable (except for mini-purge valve leakage not within limit), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation boundary that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation boundaries that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the boundary used to isolate the penetration should be the closest available one to containment.

Required Action A.1 must be completed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or in accordance with the Risk Informed Completion Time. These 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Times is are reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

A.2 For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being isolated following a single failure will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation boundaries capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation boundaries outside containment" is appropriate considering the fact that the boundaries are operated under administrative controls and the probability of their misalignment is low. For the isolation boundaries inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation boundaries and other administrative controls that will ensure that isolation boundary misalignment is an unlikely possibility.

Required Action A.2 is modified by a Note that applies to isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means (e.g., ensuring that all valve manipulations in these areas have been independently verified).

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these boundaries, once they have been verified to be in the proper position, is small.

R.E. Ginna Nuclear Power Plant B 3.6.3-7 Revision 64

Containment Isolation Boundaries B 3.6.3 Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flowpaths which do not use a closed system as a containment isolation boundary. For those penetrations which do use a closed system, Condition C provides the appropriate actions.

B.1 With two containment isolation boundaries in one or more penetration flow paths inoperable (except for mini-purge valve leakage not within limit), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation boundary that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation boundaries that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. Check valves and closed systems are not acceptable isolation boundaries in this instance since they cannot be assured to meet the design requirements of a normal containment isolation boundary. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.

Following completion of Required Action B.1, verification that the affected penetration flow path remains isolated must be performed in accordance with Required Action A.2.

Condition B is modified by a Note indicating that this Condition is only applicable to penetration flow paths which do not use a closed system as containment isolation boundary. For those penetrations which do use a closed system, Condition C provides the appropriate actions.

C.1 With one or more penetration flow paths with one containment isolation boundary inoperable, the inoperable boundary must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path. Required Action C.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time or in accordance with the Risk Informed Completion Time Program. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4.

R.E. Ginna Nuclear Power Plant B 3.6.3-8 Revision 64

CS, CRFC and NaOH Systems B 3.6.6 APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the CS System, CRFC System and NaOH System.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the CS System, CRFC System and NaOH System are not required to be OPERABLE in MODES 5 and 6.

ACTIONS A.1 With one CS train inoperable, the inoperable CS train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE spray and CRFC units are adequate to perform the iodine removal and containment cooling functions. These 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Times takes into account the redundant heat and iodine removal capability afforded by the CRFCs, reasonable time for repairs, and low probability of a DBA occurring during this period.

B.1 With the NaOH System inoperable, OPERABLE status must be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The pH adjustment of the Containment Spray System flow for corrosion protection and iodine removal enhancement is reduced in this condition. The Containment Spray System would still be available and would remove some iodine from the containment atmosphere in the event of a DBA. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time takes into account the redundant flow path capabilities and the low probability of the worst case DBA occurring during this period.

C.1 and C.2 If the inoperable CS train or the NaOH System cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time for attempting restoration of the inoperable component(s) and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

R.E. Ginna Nuclear Power Plant B 3.6.6-7 Revision 76

CS, CRFC and NaOH Systems B 3.6.6 D.1 With one or two CRFC units inoperable, the inoperable CRFC unit(s) must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. The inoperable CRFC units provided up to 100% of the containment heat removal needs. These 7 day Completion Times is are justified considering the redundant heat removal capabilities afforded by combinations of the CS System and CRFC System and the low probability of DBA occurring during this period.

E.1 and E.2 If the Required Action and associated Completion Time of Condition D of this LCO are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 With two CS trains inoperable, or three or more CRFC units inoperable, the plant is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS The applicable SR descriptions from Bases 3.5.2 apply. This SR is required since the OPERABILITY of valves 896A and 896B is also required for the CS System.

SR 3.6.6.2 R.E. Ginna Nuclear Power Plant B 3.6.6-8 Revision 77 10

MSSVs B 3.7.1 ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.

A.1 With one or more MSSVs inoperable, the assumptions used in the accident analysis for loss of external load may no longer be valid and the safety valve(s) must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or within the RICT. This Condition specifically addresses the appropriate ACTIONS to be taken in the event that a non-significant discrepancy related to the MSSVs is discovered with the plant operating in MODES 1, 2, or 3. Examples of this type of discrepancy include administrative (e.g., documentation of inspection results) or similar deviations which do not result in a loss of MSSV capability to relieve steam. These 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Times allows a reasonable period of time for correction of administrative only problems or for the plant to contact the NRC to discuss appropriate action. These 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion times are is based on engineering judgement.

This Condition is not applicable to a situation in which the ability of a MSSV to open or reclose is questionable. In this event, this Condition is no longer applicable and Condition B of this LCO should be entered immediately since no corrective actions can be implemented during MODES 1, 2, and 3.

B.1 and B.2 If the MSSV(s) cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

R.E. Ginna Nuclear Power Plant B 3.7.1-3 Revision 58

MSIVs and Non-Return Check Valves B 3.7.2 ACTIONS A.1 With one or more valves inoperable in flow path from a SG in MODE 1, ACTION must be taken to restore OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program. Some repairs to these valves can be made with the plant under hot conditions.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Times are is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs and non-return check valves and the ability to isolate the affected SG by turbine stop valves.

These 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Times are is greater than that normally allowed for containment isolation boundaries because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from most other containment isolation boundaries in that the closed system provides an additional means for containment isolation. Failure of this closed system can only result from a SGTR which is not postulated to occur with any other DBA (e.g.,

LOCA).

B.1 If the MSIV and/or non-return check valve from a SG cannot be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition C would be entered.

The Completion Time is reasonable, based on operating experience, to reach MODE 2 in an orderly manner without challenging plant systems.

C.1 and C.2 Since the MSIVs and non-return check valve are required to be OPERABLE in MODES 2 and 3, the inoperable valve(s) may either be restored to OPERABLE status or the associated MSIV closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis and the non-return check valve is no longer required.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is consistent with that allowed in Condition A.

For inoperable valves that cannot be restored to OPERABLE status within the specified Completion Time, but the associated MSIV is closed, the MSIV must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgement, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.

R.E. Ginna Nuclear Power Plant B 3.7.2-4 Revision 58

ARVs B 3.7.4 APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature 500ºF, the ARV lines are required to be OPERABLE.

In MODE 3 with RCS average temperature < 500ºF, and in MODE 4, the ARVs are not required since the saturation pressure of the reactor coolant is below the lift settings of the MSSVs. In MODE 5 or 6, an SGTR is not a credible event since the water in the SGs is below the boiling point and RCS pressure is low.

ACTIONS A.1 With one ARV line inoperable, ACTION must be taken to restore the valve to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. These 7 day Completion Times allows for the redundant capability afforded by the remaining OPERABLE ARV line and a nonsafety grade backup in the steam dump system.

B.1 If the ARV line cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 with RCS average temperature < 500ºF within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 If both ARV lines are inoperable, the plant is in a condition outside of the accident analyses for a SGTR event; therefore, LCO 3.0.3 must be entered immediately.

R.E. Ginna Nuclear Power Plant B 3.7.4-3 Revision 69

AFW System B 3.7.5 The SAFW Pump Building room coolers are required to be OPERABLE. If one room cooler is inoperable, the associated SAFW train is inoperable.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW System is lost. In addition, the AFW System is required to supply enough makeup water to replace the lost SG secondary inventory as the plant cools to MODE 4 conditions.

In MODE 4, 5, or 6, the SGs are not normally used for heat removal, and the AFW System is not required.

ACTIONS A.1 If one of the TDAFW train flow paths is inoperable, action must be taken to restore the flow path to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. These 7 day Completion Times are is reasonable, based on the following reasons:

a. The redundant OPERABLE turbine driven AFW pump flow path;

b. The availability of redundant OPERABLE MDAFW and SAFW pumps; and

c. The low probability of an event occurring that requires the inoperable TDAFW pump flow path.

A TDAFW train flow path is defined as the steam supply line and SG injection line from/to the same SG.

B.1 If one MDAFW train is inoperable, action must be taken to restore the train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. These 7 day Completion Times are is reasonable, based on the following reasons:

a. The redundant OPERABLE MDAFW train;

b. The availability of redundant OPERABLE TDAFW and SAFW pumps; and

c. The low probability of an event occurring that requires the inoperable MDAFW train.

R.E. Ginna Nuclear Power Plant B 3.7.5-5 Revision 75

AFW System B 3.7.5 C.1 With the TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program. If the inoperable MDAFW train supplies the same SG as the inoperable TDAFW flow path, Condition D must be entered.

The combination of failures which requires entry into this Condition all result in the loss of one train (or one flow path) of preferred AFW cooling to each SG such that redundancy is lost. These 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Times are is reasonable, based on redundant capabilities afforded by the SAFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

Condition C is modified by a Note which prohibits the application of LCO 3.0.4.b with a TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with a TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs consequently the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in these circumstances.

D.1 With all AFW trains to one or both SGs inoperable, action must be taken to restore at least one train or TDAFW flow path to each affected SG to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or in accordance with the Risk Informed Completion Time Program.

The combination of failures which require entry into this Condition all result in the loss of preferred AFW cooling to at least one SG. If a SGTR were to occur in this condition, preferred AFW is potentially unavailable to the unaffected SG. If AFW is unavailable to both SGs, the accident analyses for small break LOCAs and loss of MFW would not be met.

The two MDAFW trains of the preferred AFW System are normally used for decay heat removal during low power operations since air operated bypass control valves are installed in each train to better control SG level (see Figure B 3.7.5-1). Since a feedwater transient is more likely during reduced power conditions, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is provided to restore at least one train of additional preferred AFW before requiring a controlled cooldown. This will also provide time to find a condensate source other than the SW System for the SAFW System if all three AFW trains are inoperable.

These 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Times are is reasonable, based on redundant capabilities afforded by the SAFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

R.E. Ginna Nuclear Power Plant B 3.7.5-6 Revision 75

AFW System B 3.7.5 Condition D is modified by a Note which prohibits the application of LCO 3.0.4.b with all AFW trains to one or both SGs inoperable. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with all AFW trains to one or both SGs inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in these circumstances.

E.1 With one SAFW train inoperable, action must be taken to restore OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. This Condition includes the inoperability of one of the two SAFW cross-tie valves which requires declaring the associated SAFW train inoperable (e.g., failure of 9703B would result in declaring SAFW train D inoperable).

However, the inoperability of either flow path downstream of the SAFW cross-tie is addressed by Condition F. These 14 day Completion Times are is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a HELB or other event which would require the use of the SAFW System during this time period.

F.1 With both SAFW trains inoperable, action must be taken to restore at least one SAFW train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. This Condition includes the inoperability of both of the SAFW cross-tie valves (9703A and 9703B) or the inoperability of either flow path down stream of the SAFW cross-tie. These 7 day Completion Times are is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a HELB or other event which would require the use of the SAFW System during this time period.

G.1 and G.2 When Required Action A.1, B.1, C.1, D.1, E.1, or F.1 cannot be completed within the required Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

H.1 R.E. Ginna Nuclear Power Plant B 3.7.7-7 Revision 81

CCW System B 3.7.7

a. LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"

b. LCO 3.5.2, "ECCS - MODES 1, 2, and 3,"

c. LCO 3.5.3, "ECCS - MODE 4,"

d. LCO 3.9.4, "RHR and Coolant Circulation - Water Level 23 Ft,"

and

e. LCO 3.9.5, "RHR and Coolant Circulation - Water Level < 23 Ft."

The CCW piping inside containment for the reactor coolant pumps (RCPs) and the reactor support coolers also serves as a containment isolation boundary. This is addressed by LCO 3.6.3, "Containment Isolation Boundaries."

The CCW system radiation detector (R-17) is not required to be OPERABLE for this LCO since the CCW system outside containment is not required to be a closed system.

The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.

APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be capable to perform its post accident safety functions. The failure to perform this safety function could result in the loss of reactor core cooling and containment integrity during the recirculation phase following a LOCA.

In MODE 5 or 6, the OPERABILITY requirements of the CCW System are determined by LCO 3.4.7, LCO 3.4.8, LCO 3.9.4, and LCO 3.9.5.

ACTIONS A.1 If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE CCW train could result in loss of CCW function. These 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Times are is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.

R.E. Ginna Nuclear Power Plant B 3.7.7-4 Revision 58

SW System B 3.7.8 The SW piping inside containment for the CRFCs and the reactor compartment coolers also serves as a containment isolation boundary. This is addressed under LCO 3.6.3, "Containment Isolation Boundaries."

APPLICABILITY In MODES 1, 2, 3, and 4, the SW System is a normally operating system which must be capable of performing its post accident safety functions. The failure to perform this safety function could result in the loss of reactor core cooling during the recirculation phase following a LOCA or loss of containment integrity following a SLB.

In MODES 5 and 6, the OPERABILITY requirements of the SW system are determined by LCO 3.7.7 and LCO 3.8.2.

ACTIONS A.1 If one SW pump is inoperable, action must be taken to restore OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE SW pumps are more than adequate to perform the heat removal function.

However, the overall reliability is reduced because a single failure of the opposite electrical train could result in loss of SW System function. These 14 day Completion Times are is based on the redundant capabilities afforded by the OPERABLE pumps, and the low probability of a DBA occurring during this time period.

B.1 If two SW pumps are inoperable, action must be taken to restore at least one of the inoperable pumps to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or within the RICT. In this condition, the remaining OPERABLE SW pumps are adequate to perform the heat removal function. However, any single failure of the remaining pumps would result in a loss of SW System function in a DBA. These 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion times are is based on the reliability of the remaining two pumps and the low probability of a DBA occurring during this time period. To ensure the possibility of a common cause failure mode is not present to reduce the reliability of the remaining pumps, further actions may be required. Specifically, if one SW pump is inoperable due to equipment failure, and a second SW pump fails before the first pump is returned to service, an evaluation of possible common cause and determination of the operability of the remaining pumps shall be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the second failure (commitment per Reference 5).

R.E. Ginna Nuclear Power Plant B 3.7.8-6 Revision 68

AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 using the same example as above, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or within the RICT Completion Time for restoring RHR pump B was developed assuming that RHR pump A had both offsite and onsite standby emergency power available). Therefore, a penalty is assessed to only allow 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months in this configuration.

The Completion Time for Required Action A.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time is an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that:

a. There is no offsite power available to one or more 480 V safeguards bus; and

b. A redundant required feature is inoperable on a second 480 V safeguards bus.

If at any time during the existence of Condition A, a redundant required feature becomes inoperable, this Completion Time begins to be tracked. Required Action A.1 can be exited if the inoperable DG or the required feature on the OPERABLE DG is restored to OPERABLE status.

The level of degradation during Condition A means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite standby AC sources have not been degraded. This level of degradation generally corresponds to either:

a. Loss of offsite power sources to SAT 12A and/or SAT 12B;

b. Failure of SAT 12A or 12B or 4.16 kV Bus 12A or 12B; or

c. Failure of a station service transformer supplying a 480 V safeguards bus.

With a total loss of the offsite power sources to SAT 12A and 12B, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident for either train. With loss of offsite power to SAT 12A or 12B, failure of SAT 12A or 12B, or failure of Bus 12A or 12B, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident for a single AC electrical train.

With a failure of a station service transformer, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the consequences of an accident for one 480 V safeguards bus in one AC electrical train. In all cases, sufficient onsite AC sources are available to maintain the plant in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time provides a period of time to R.E. Ginna Nuclear Power Plant B 3.8.1-8 Revision 74

AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to declare the required safety features inoperable is based on the fact that it is less than the Completion Time for restoring OPERABILITY of the DG and all safety features supported by the DG. A shorter Completion Time is provided since the required safety features have been potentially degraded by the inoperable DG. Therefore, a penalty is assessed to only allow 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months in this configuration. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Required Action B.2 can be exited if the inoperable DG or the required feature on the OPERABLE DG is restored to OPERABLE status.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of the OPERABLE DG. If it can be determined within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 is not required to be performed. If the cause of inoperability is determined to exist on the other DG, the second DG would be declared inoperable upon discovery and Condition E would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the second DG within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, activities must continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to confirm that the OPERABLE DG is not affected by the same problem as the inoperable DG (Ref. 8).

B.4 With one inoperable DG, the remaining OPERABLE DG and the offsite circuit are adequate to supply electrical power to the onsite 480 V safeguards buses. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

R.E. Ginna Nuclear Power Plant B 3.8.1-10 Revision 74

AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 C.1 and C.2 With offsite power to one or more 480 V safeguards bus(es) and one DG inoperable, redundancy is lost in both the offsite and onsite AC electrical power systems. Since power system redundancy is provided by these two diverse sources of power, the AC power sources are only degraded and no loss of safety function has occurred since at least one DG and potentially one offsite AC power source are available. However, the plant is vulnerable to a single failure which could result in the loss of multiple safety functions. Therefore, a Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or within the RICT is provided to either restore the offsite power circuit or the DG to OPERABLE status.

This Completion Time is less than that for an inoperable offsite power source or an inoperable DG due to the single failure vulnerability of this configuration.

As discussed in LCO 3.0.6, the AC electrical power distribution subsystem ACTIONS would not be entered even if all AC sources to either train were inoperable, resulting in de-energization.

Therefore, the Required Actions of this Condition are modified by a Note which states that the Required Actions of LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4" must also be immediately entered with no AC power source to one distribution train. This allows Condition C to provide requirements for the loss of an offsite power circuit and one DG, without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

D.1 and D.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 If both DGs are inoperable, a loss of safety function would exist if offsite power were unavailable; therefore, LCO 3.0.3 must be entered.

R.E. Ginna Nuclear Power Plant B 3.8.1-11 Revision 74

DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 ACTIONS A.1 With one DC electrical power source inoperable, OPERABILITY must be restored within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

In this Condition, redundancy is lost and only one train is capable to completely respond to an event. If one of the required DC electrical power sources is inoperable, the remaining DC electrical power source has the capacity to support a safe shutdown and to mitigate an accident condition. A subsequent worst case single failure would, however, result in the complete loss of the remaining 125 VDC electrical power distribution subsystem with attendant loss of ESF functions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or within the RICT Completion Time reflects a reasonable time to assess plant status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power source is not restored to OPERABLE status, to prepare to effect an orderly and safe plant shutdown.

B.1 and B.2 If the inoperable DC electrical power source cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 If both DC electrical power sources are inoperable, a loss of multiple safety functions exists; therefore, LCO 3.0.3 must be immediately entered.

R.E. Ginna Nuclear Power Plant B 3.8.4-5 Revision 41

AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 ACTIONS A.1, A.2, and A.3 With an inverter inoperable, its associated AC instrument bus becomes inoperable until it is re-energized from either its Class 1E or non-Class 1E CVT.

Required Action A.1 allows the instrument bus to be powered from either its associated Class 1E CVT or from a non-Class 1E CVT. For Instrument Buses A and C, the non-Class 1E power is supplied by a non- safety related motor control center (MCC A) which is supplied by 480 V Bus 13.

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is consistent with LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4."

Required Action A.2 is intended to limit the amount of time that the instrument bus can be connected to a non-Class 1E power supply. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is based upon engineering judgement, taking into consideration the time required to repair the Class 1E CVT or the inverter and the additional risk to which the plant is exposed because of the connection to a non-Class 1E power supply.

Required Action A.3 allows 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to fix the inoperable inverter and restore it to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. These 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Times are is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the plant is exposed because of the inverter inoperability. This must be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC instrument bus is powered from its CVT, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible, battery backed inverter source to the AC instrument buses is the preferred source for powering instrumentation trip setpoint devices.

R.E. Ginna Nuclear Power Plant B 3.8.7-4 Revision 41 13

AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 B.1 and B.2 With the Class 1E CVT for Instrument Bus B inoperable, the instrument bus becomes inoperable until it is re-energized from its non-Class 1E CVT. Required Action B.1 requires Instrument Bus B to be powered from its non-Class 1E CVT within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The non-Class 1E power is supplied by a nonsafety related 480 V motor control center (MCC A) which is supplied by 480 V Bus 13.

Required Action B.2 is intended to limit the amount of time that Instrument Bus B can be connected to a non-Class 1E power supply. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. These 7 day limits are is based on engineering judgement, taking into consideration the time required to repair the Class 1E CVT and the additional risk to which the plant is exposed because of the Class 1E CVT inoperability.

This must be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When Instrument Bus B is powered from its non- Class 1E CVT, it is relying upon interruptible offsite AC electrical power sources.

The Class 1E, diesel generator backed, CVT to Instrument Bus B is the preferred power source for powering instrumentation trip setpoint devices.

C.1 and C.2 If the inoperable devices or components cannot be restored to OPERABLE status or other Required Actions are not completed within the required Completion Time of Condition A or B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If two or more required AC instrument bus power sources are inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately. This Condition must be entered when both inverters, or one or more inverters and the Class 1E CVT to Instrument Bus B are discovered to be inoperable.

R.E. Ginna Nuclear Power Plant B 3.8.7-5 Revision 41 14

Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 The trains as specified in Table B 3.8.9-1 identify the major AC, DC, and AC instrument bus electrical power distribution subsystem components. A train is defined to begin from the boundary of the power source for the respective subsystem (as defined in the power source LCOs), and continues up to the isolation device for the supplied safety related or ESF component (e.g., safety injection pump). The isolation device for the supplied safety related or ESF component is only considered part of the train when the device is not capable of opening to isolate the failed component from the train (e.g., breaker unable to open an overcurrent). Otherwise, the failure of the isolation device to close to provide power to the component is addressed by the respective component's LCO. The isolation device for nonsafety related components are considered part of the train since these devices must be available to protect the safety related functions. Therefore, the train boundary essentially ends at the motor control center, distribution panel, or bus which supplies multiple components.

The inoperability of any component within the above defined train boundaries renders the train inoperable.

APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Electrical power distribution subsystem requirements for MODES 5 and 6 are addressed in LCO 3.8.10, "Distribution Systems - MODES 5 and 6."

ACTIONS A.1 With one AC electrical power distribution train inoperable, the remaining AC electrical power distribution train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because a single failure in the remaining AC power distribution train could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, motor control centers, and distribution panels which comprise a train must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program.

R.E. Ginna Nuclear Power Plant B 3.8.9-6 Revision 68

Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 The worst case Condition A scenario is one train without AC power (i.e., no offsite power to the train and the associated DG inoperable). In this Condition, the plant is more vulnerable to a complete loss of AC power.

The Completion Time for restoring the inoperable train before requiring a plant shutdown is limited to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months because of:

a. The potential for decreased safety if the plant operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train; and

b. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE train with AC power which results in the loss of multiple safety functions.

B.1 With one AC instrument bus electrical power distribution train inoperable, the remaining OPERABLE AC instrument bus train is capable of supporting the minimum safety functions necessary to shut down the plant and maintain it in the safe shutdown condition. Overall reliability is reduced, however, because a single failure in the remaining AC instrument bus train could result in the minimum ESF functions not being supported. Therefore, the AC instrument bus train must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

Condition B represents one AC instrument bus train without power which includes the potential loss of both the DC source and the associated AC sources to the instrument bus. In this situation, the plant is significantly more vulnerable to a complete loss of all noninterruptible power.

Therefore, the Completion Time is limited to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months due to the potential vulnerabilities. Taking exception to LCO 3.0.2 for components without adequate 120 VAC power, that would have Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared inoperable, is acceptable because of:

a. The potential for decreased safety by requiring a change in plant conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;

b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate 120 VAC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and R.E. Ginna Nuclear Power Plant B 3.8.9-7 Revision 68

Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9

c. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE AC instrument bus train.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time takes into account the importance to safety of restoring the AC instrument bus train to OPERABLE status, the redundant capability afforded by the other OPERABLE instrument bus train, and the low probability of a DBA occurring during this period.

C.1 With one DC electrical power distribution train inoperable, the remaining DC electrical power distribution train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution train could result in the minimum required ESF functions not being supported. Therefore, the required DC distribution panels must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

Condition C represents one train without adequate DC power. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. Therefore, the Completion Time is limited to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months due to this potential vulnerability. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety by requiring a change in plant conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;

b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and

c. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE train with DC power.

ATTACHMENT 4 License Amendment Request R.E. Ginna Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Cross-Reference of TSTF-505 and R.E. Ginna Technical Specifications

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 1 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Completion Times 1.3 1.3 Example 1.3-8 1.3-8 1.3-8 TSTF-505 changes are incorporated.

Reactor Trip System (RTS) 3.3.1 3.3.1 Instrumentation One Manual Reactor Trip channel 3.3.1.B.1 3.3.1.B.1 Yes Ginna Condition B is As required by Required Action inoperable. A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated.

One channel or train inoperable. 3.3.1.C.1 3.3.1.C.1 No Ginna TS Condition C is Required Action and 3.3.1.W.1 No associated Completion Time of Condition B not met.

Ginna TS Condition W is As Required Action A.1 and referenced by Table 3.3.1-1.

Conditions C and W are default conditions and should remain as is, unchanged in Ginna TS. Condition W is applicable to modes 3, 4, and 5 so RICT does not apply.

One Power Range Neutron Flux - 3.3.1.D.1.1 3.3.1.D.1 Yes Ginna Condition D is As required by Required Action High channel inoperable. 3.3.1.D.1.2 A.1 and referenced by Table 3.3.1-1.

3.3.1.D.2.1 TSTF-505 changes are incorporated.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

Surveillance tests 3.2.2.2, 3.2.4.1, and 3.2.4.2 are required to be performed

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 2 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One channel inoperable. 3.3.1.E.1 3.3.1.D.1 Yes Ginna Condition D is As required by Required Action A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated. For Ginna, Condition D covers Power Range high power, Power Range low power, OTDT, OPDT, Pressurizer Pressure high, Pressurizer water level-high, and SG water level -

low-low trips.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

One Source Range Neutron Flux 3.3.1.J.1 --------- No At Ginna Conditions F, H, and J are As required by channel inoperable. Required Action A.1 and referenced by Table 3.3.1-1, and Condition A only applies to TWO source range channels inoperable. Ginna Doesnt have a TS condition or required actions for one source range channel inoperable. Also, Conditions H and J are applicable to modes 3, 4, and 5.

Required Action and associated [NEW]3.3.1.K 3.3.1.C.2 No At Ginna, these default conditions have actions that are Completion Time of Condition C or 3.3.1.C.3 No different for the corresponding functions. The actions J not met. 3.3.1.I.1 No for conditions C, I, and W are already in their own 3.3. No default conditions and the actions for condition J at Ginna specific to two inoperable SR channels. These conditions should remain unchanged at Ginna.

One channel inoperable. 3.3.1.K.1 3.3.1.D.1 Yes The functions relating to this condition, at Ginna, are 3.3.1.M.1 Yes split across three conditions: D (Prz water level hi), M 3.3.1.K.1 Yes (Reactor coolant flow low single loop), and K (Reactor coolant flow low two loops, undervoltage RCPs, underfrequency RCPs)

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 3 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Required Action and associated [NEW]3.3.1.M 3.3.1.G No Ginna already has separate default conditions for Completion Time of Condition L not 3.3.1.O No conditions D, M, and K not met. These are default met. 3.3.1.L No conditions G, O, and L at Ginna.

One Reactor Coolant Pump 3.3.1.L.1 3.3.1.N.1 Yes Ginna Condition N is As required by Required Action Breaker Position (Single Loop) A.1 and referenced by Table 3.3.1-1.

channel inoperable. TSTF-505 changes are incorporated.

A loss of breaker position channel would result in a loss of anticipatory trip to avoid RCS heatup and would occur before the actual low flow trip actuation. Since this function is not credited in the accident analysis, it is not considered a loss of function.

Required Action and associated [NEW]3.3.1.O 3.3.1.O No Ginna TS Condition O is Required Action and Completion Time of Condition N not associated Completion Time of Condition M or N not met. met.

Condition O is a default condition and should remain as is, unchanged in Ginna TS.

Required Action and associated [NEW]3.3.1.Q 3.3.1.L No Ginna TS Condition L is Required Action and Completion Time of Condition P not associated Completion Time of Condition K not met.

met. Condition L is a default condition and should remain as is, unchanged in Ginna TS.

One Turbine Trip channel 3.3.1.N.1 3.3.1.P.1 Yes Ginna Condition P is As required by Required Action inoperable. A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 4 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Required Action and associated [NEW]3.3.1.S 3.3.1.Q No Ginna TS Condition Q is Required Action and Completion Time of Condition R not associated Completion Time of Condition P not met.

met. Condition Q is a default condition and should remain as is, unchanged in Ginna TS.

One train inoperable. 3.3.1.O.1 3.3.1.R.1 Yes Ginna Condition R is As required by Required Action A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore loss of one train does not preclude trip capability and no further justification is required.

One RTB train inoperable. 3.3.1.P.1 3.3.1.T.1 Yes Ginna Condition T is As required by Required Action A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore, loss of one train does not preclude trip capability for Design Basis Accidents. AMSAC is also credited to provide trip capability for most scenarios, except some LOCAs and secondary line breaks. Also, procedural guidance exists to successfully mitigate a loss of automatic reactor trip function by opening local trip breakers at the M-G sets Required Action and associated [NEW]3.3.1.X 3.3.1.V No Ginna TS Condition V is Required Action and Completion Time of Condition W associated Completion Time of Condition R, S, T or U not met. not met.

Condition V is a default condition and should remain as is, unchanged in Ginna TS.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 5 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One trip mechanism inoperable for 3.3.1.S.1 3.3.1.U.2 Yes Ginna Condition U is As required by Required Action one RTB. A.1 and referenced by Table 3.3.1-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore loss of one train does not preclude trip capability and no further justification is required.

Required Action and associated [NEW]3.3.1.Z 3.3.1.C No Ginna already has separate default conditions for Completion Time of Condition B, D, 3.3.1.G No conditions B, D, R, S, T, and U not met. These are E, T, U, V, W, or Y not met. 3.3.1.V No default conditions C, G, and V at Ginna.

Engineered Safety Feature 3.3.2 3.3.2 Actuation System (ESFAS)

Instrumentation One channel or train inoperable. 3.3.2.B.1 3.3.2.H.1 Yes Ginna Condition H is As required by Required Action A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore loss of one train does not preclude trip capability and no further justification is required.

One train inoperable. 3.3.2.C.1 3.3.2.I.1 Yes Ginna Condition I is As required by Required Action A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore loss of one train does not preclude trip capability and no further justification is required.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 6 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One channel inoperable. 3.3.2.D.1 3.3.2.J.1 Yes Ginna Conditions J, L, and F are As required by 3.3.2.L.1 Yes Required Action A.1 and referenced by Table 3.3.2-1.

3.3.2.F.1 Yes TSTF-505 changes are incorporated. Ginna Required Action J.1 is to place the channel in trip with a Note over Function 1c being able to be bypassed. Ginna Required Action F.1 is to place the channel in trip with a Note over functions 4c and 5b being able to be bypassed.

Ginna Required Action L.1 is to place the channel in trip with a Note over Functions 1d and 1e being able to be bypassed.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

One Containment Pressure channel 3.3.2.E.1 3.3.2.J.1 Yes TSTF-505 Required Action E.1 is to place the channel inoperable in bypass which is excluded from the TSTF. Ginna Required Action J.1 is to place the channel in trip with a Note over Function 1c being able to be bypassed.

TSTF-505 changes are incorporated.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

One channel or train inoperable. 3.3.2.F.1 3.3.2.D.1 Yes Ginna Conditions D is As required by Required Action A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There is one channel per loop, either of which will actuate both MSIVs. Loss of one channel does not preclude trip capability.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 7 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One train inoperable. 3.3.2.G.1 3.3.2.E.1 Yes Ginna Conditions E is As required by Required Action A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore, loss of one train does not preclude trip capability and no further justification is required.

One train inoperable. 3.3.2.H.1 3.3.2.E.1 Yes Ginna Conditions E is As required by Required Action A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore, loss of one train does not preclude trip capability and no further justification is required.

One channel inoperable. 3.3.2.I.1 3.3.2.D.1 Yes Ginna Conditions D and F are As required by Required 3.3.2.F.1 Yes Action A.1 and referenced by Table 3.3.2-1. Ginna Required Action F.1 is to place the channel in trip with a Note over Functions 4c and 5b being able to be bypassed.

TSTF-505 changes are incorporated.

Required action is to place channel in trip. Therefore trip capability is maintained and no further justification is required.

One Main Feedwater Pumps trip 3.3.2.J.1 3.3.2.B.1 Yes Ginna Conditions B is As required by Required Action channel inoperable. A.1 and referenced by Table 3.3.2-1.

TSTF-505 changes are incorporated.

There are two trains of actuation available. Therefore loss of one train does not preclude trip capability and no further justification is required.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 8 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One channel inoperable. 3.3.2.K.1 --------- No TSTF-505 Required Action K.1 is to place the channel in bypass which is excluded from the TSTF.

The Ginna TS do not contain this TS. Therefore, a change is not proposed to the Ginna TS.

Required Action and associated 3.3.2.M.1 3.3.2.K No Ginna already has default condition K for conditions H, Completion Time of Conditions B, I, or J not met.

C, or K not met.

Required Action and associated 3.3.2.N.1 3.3.2.G No Ginna already has default condition G for conditions D, Completion Time of Conditions D, 3.3.2.K No E, or R not met. Ginna already has default condition K E, F, G, or L not met. 3.3.2.M No for conditions H, I, or J not met. Ginna already has default condition M for condition L not met.

Required Action and associated 3.3.2.O.1 3.3.2.C No Ginna already has default condition C for condition B Completion Time of Conditions H, I, 3.3.2.G No not met. Ginna already has default condition G for or J not met. conditions D, E, or F not met.

Loss of Power (LOP) Diesel 3.3.5 3.3.4 .

Generator (DG) Start Instrumentation One or more Functions with two 3.3.5.A.1 3.3.4.A.1 Yes Ginna Condition A is One or more 480V bus(es) with channel per bus inoperable. one channel inoperable.

TSTF-505 changes are incorporated.

One or more Functions with two or 3.3.5.B.1 3.3.4.B.1 No Ginna TS has a Completion Time of immediately and is more channels per bus inoperable. therefore excluded.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 9 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Containment Ventilation Isolation --------- 3.3.5 Instrumentation

[Ginna TS Condition Description] --------- 3.3.5.A.1 Yes Ginna TS 3.3.5 Condition A is a Ginna-specific One radiation monitoring channel condition. Exelon proposes to apply a RICT to the inoperable. existing Ginna TS 3.3.5 Required Action A.1, consistent with TSTF-505.

Per UFSAR Section 6.2.4.3, there is no loss of function if R-11 or R-12 become inoperable. These radiation monitors actuate Containment Ventilation Isolation (CVI), for the mini-purge valves. CVI serves as a backup to the Containment Isolation (CI) signal, and is not specifically credited in the accident analysis.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 10 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Boron Dilution Protection 3.3.9 ---------

System (BDPS)

One train inoperable. 3.3.9.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a change is not proposed to the Ginna TS.

RCS Loops - MODE 3 3.4.5 3.4.5 Ginna TS is titled RCS Loops - MODES 1<= 8.5%

RTP, 2, and 3 One required RCS loop inoperable. 3.4.5.A.1 3.4.5.A.1 No Models the RCPs and SGs for removal of decay heat in Mode 2 and Mode 1 when < 8.5% RTP. We do not model this function in the PRA.

One required RCS loop not in 3.4.5.C.1 --------- No The Ginna TS do not contain this TS. Therefore, a operation with Rod Control System 3.4.5.C.2 --------- No change is not proposed to the Ginna TS.

capable of rod withdrawal.

Pressurizer 3.4.9 ---------

One [required] group of pressurizer 3.4.9.B.1 --------- No The Ginna TS do not contain this TS. Therefore, a heaters inoperable. change is not proposed to the Ginna TS.

Pressurizer Power Operated 3.4.11 3.4.11 Relief Valves (PORVs)

One [or two] PORV[s] inoperable 3.4.11.B.3 3.4.11.B.3 Yes Ginna Condition B is One PORV inoperable.

and not capable of being manually TSTF-505 changes are incorporated.

cycled.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 11 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One [or two] block valve(s) 3.4.11.C.2 3.4.11.C.2 Yes TSTF-505 changes are incorporated.

inoperable. 3.4.11.D.2 Yes Ginna TS 3.4.11 Condition D is a Ginna-specific condition. Exelon proposes to apply a RICT to the existing Ginna TS 3.4.11 Required Action D.2, consistent with TSTF-505.

The current completion time to terminate the loss of function is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Because this situation is comprised of such a set of low probability occurrences (both block valves inoperable, manual operation of a PORV needed to mitigate an RCS overpressure event, and the failure of the PORV to reclose following operation), a probabilistic calculation could show acceptable delta risk for a longer time period than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Accumulators --------- 3.5.1

[Ginna TS Condition Description] --------- 3.5.1.A.1 Yes Ginna TS 3.5.1 Condition A is a Ginna-specific One accumulator inoperable due to condition. Exelon proposes to apply a RICT to the boron concentration not within existing Ginna TS 3.5.1 Required Action A.1, consistent limits. with TSTF-505.

For a large break cold leg LOCA, one accumulator is assumed to spill out the break, while the other provides the required core cooling. Therefore, having one inoperable accumulator constitutes a loss of function for this particular scenario. Because this is such a low probability event, a probabilistic calculation could indicate that an accumulator could be inoperable for longer than the current action completion times with acceptable delta risk results.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 12 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

[Ginna TS Condition Description] --------- 3.5.1.B.1 Yes Ginna TS 3.5.1 Condition B is a Ginna-specific One accumulator inoperable for condition. Exelon proposes to apply a RICT to the reasons other than Condition A. existing Ginna TS 3.5.1 Required Action B.1, consistent with TSTF-505.

For a large break cold leg LOCA, one accumulator is assumed to spill out the break, while the other provides the required core cooling. Therefore, having one inoperable accumulator constitutes a loss of function for this particular scenario. Because this is such a low probability event, a probabilistic calculation could indicate that an accumulator could be inoperable for longer than the current action completion times with acceptable delta risk results.

ECCS - Operating 3.5.2 3.5.2 Ginna TS titled ECCS - MODES 1, 2, and 3 One or more trains inoperable. 3.5.2.A.1 3.5.2.A.1 Yes Ginna Condition A is One train inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

TSTF-505 changes are incorporated.

Since the Ginna LCO applies only when 1 ECCS train is inoperable (as opposed to TSTF-505 being applicable when one or more trains are inoperable), and at least 100% of required ECCS flow is available to that train, there is no possibility of a loss of function in this situation.

Containment Air Locks 3.6.2 3.6.2 Ginna TS titled Containment Air Locks.

(Atmospheric, Subatmospheric, Ice Condenser, and Dual)

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 13 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One or more containment air locks 3.6.2.C.3 3.6.2.C.3 Yes TSTF-505 changes are incorporated.

inoperable for reasons other than As long as actions C.1 (ensure overall containment Condition A or B. leakage is low) and C.2 (close a door in the affected air lock) are successfully accomplished, there is no loss of function.

Containment Isolation Valves 3.6.3 3.6.3 Ginna TS titled Containment Isolation (Atmospheric, Subatmospheric, Boundaries.

Ice Condenser, and Dual)

One or more penetration flow paths 3.6.3.A.1 3.6.3.A.1 Yes Ginna Condition A is One or more penetration flow with one containment isolation paths with one containment isolation boundary valve inoperable [for reasons other inoperable except for mini-purge valve leakage not than Condition[s] D [and E)). within limit.

TSTF-505 changes are incorporated.

One or more penetration flow paths 3.6.3.C.1 3.6.3.C.1 Yes Ginna Condition C is One or more penetration flow with one containment isolation paths with one containment isolation boundary valve inoperable. inoperable.

TSTF-505 changes are incorporated.

[Ginna TS Condition Description] --------- 3.6.3.E.2 Yes This is a Ginna-specific Condition to which Exelon One or more mini-purge penetration proposes to apply a RICT. Changes consistent with flowpaths with two valves not within TSTF-505 are incorporated. As long as Action E.1 is leakage limits successful (show overall containment leakage is low in the current configuration), there is no loss of function Containment Spray and Cooling 3.6.6A 3.6.6 Ginna TS titled Containment Spray (CS),

System (Atmospheric and Dual) Containment Recirculation Fan Cooler (CRFC), and (Credit taken for iodine removal NaOH Systems.

by the Containment Spray System)

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 14 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One containment spray train 3.6.6A.A.1 3.6.6.A.1 Yes TSTF-505 changes are incorporated.

inoperable. Table 6.2-16 of the UFSAR lists the assumed number of containment fan coolers and containment spray pumps assumed in the limiting large break analysis for containment conditions. These correspond to a minimum of 2 RCFCs (out of 4) and 1 containment spray pump (out of 2).

[Ginna TS Condition Description] --------- 3.6.6.D.1 Yes This is a Ginna-specific Condition to which Exelon One or two CRFC units inoperable. proposes to apply a RICT. Changes consistent with TSTF-505 are incorporated.

Table 6.2-16 of the UFSAR lists the assumed number of containment fan coolers and containment spray pumps assumed in the limiting large break analysis for containment conditions. These correspond to a minimum of 2 RCFCs (out of 4) and 1 containment spray pump (out of 2).

Hydrogen Ignition System (HIS) 3.6.10 ---------

(Ice Condenser)

One HIS train inoperable. 3.6.10.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a change is not proposed to the Ginna TS.

One containment region with no 3.6.10.B.1 --------- No The Ginna TS do not contain this TS. Therefore, a OPERABLE hydrogen ignitor. change is not proposed to the Ginna TS.

Air Return System (ARS) (Ice 3.6.14 ---------

Condenser)

One ARS train inoperable. 3.6.14.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a change is not proposed to the Ginna TS.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 15 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Ice Condenser Doors (Ice 3.6.16 ---------

Condenser)

One or more ice condenser inlet 3.6.16.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a doors inoperable due to being change is not proposed to the Ginna TS.

physically restrained from opening.

One or more ice condenser doors 3.6.16.B.1 --------- No The Ginna TS do not contain this TS. Therefore, a inoperable for reasons other than change is not proposed to the Ginna TS.

Condition A or not closed.

Divider Barrier Integrity (Ice 3.6.17 ---------

Condenser)

One or more personnel access 3.6.17.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a doors or equipment hatches open change is not proposed to the Ginna TS.

or inoperable, other than for personnel transit entry.

Main Steam Safety Valves --------- 3.7.1 (MSSVs)

[Ginna TS Condition Description] --------- 3.7.1.A.1 Yes Ginna TS 3.7.1 Condition A is a Ginna-specific One or more MSSVs inoperable. condition. Exelon proposes to apply a RICT to the existing Ginna TS 3.7.1 Required Action A.1, consistent with TSTF-505.

Analysis has demonstrated that the required valve combinations needed to mitigate the limiting Design Basis Accident or an ATWS event are 8/8 MSSVs, or 7/8 MSSVs and1/2 ARVs, or 6/8 MSSVs and 2/2 ARVs.

Thus inoperability of a MSSV by itself does not constitute a loss of safety function.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 16 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Main Steam Isolation Valves 3.7.2 3.7.2 Ginna TS is titled Main Steam Isolation Valves (MSIVs) (MSIVs) and Non-Return Check Valves One MSIV inoperable in MODE 1. 3.7.2.A.1 3.7.2.A.1 Yes Wording of Ginna TS differs from TSTF-505 (i.e., Ginna uses One or more valves inoperable in flowpath from a steam generator (SG) in MODE 1).

TSTF-505 changes are incorporated.

In the event of a limiting case steam line break inside containment, if one MSIV is inoperable, the combination of the closure of the other MSIV as well as the closure of the affected SGs main steamline non-return valve will prevent the blowdown of more than one steam generator.

Atmospheric Dump Valves 3.7.4 3.7.4 (ADVs)

One required ADV line inoperable. 3.7.4.A.1 3.7.4.A.1 Yes TSTF-505 changes are incorporated.

Two or more required ADV lines 3.7.4.B.1 --------- No The Ginna TS do not contain this TS. Therefore, a inoperable. change is not proposed to the Ginna TS.

Auxiliary Feedwater (AFW) 3.7.5 3.7.5 System

[Ginna TS Condition Description] 3.7.5.A.1 3.7.5.A.1 Yes TSTF-505 changes are incorporated.

One TDAFW train flowpath inoperable.

[Ginna TS Condition Description] 3.5.5.A.1 3.7.5.B.1 Yes Loss of a MDAFW train still leaves 2 TDAFW flowpaths One MDAFW train inoperable. and 2 SAFW trains available for accident mitigation.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 17 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

[Ginna TS Condition Description] 3.5.5.B.1 3.7.5.C.1 Yes Because Ginna has 2 trains of MDAFW, two TDAFW TDAFW train inoperable. flowpaths, and 2 trains of SAFW, the loss of any combination of 2 AFW flowpaths still OR leaves 4 unaffected AFW flowpaths for accident Two MDAFW trains inoperable. mitigation. No loss of function would occur.

OR One TDAFW train flowpath and one MDAFW train inoperable to opposite steam generators (SGs).

[Ginna TS Condition Description] --------- 3.7.5.D.1 Yes As long as one MDAFW train, one TDAFW flowpath, or All AFW trains to one or more SGs one SAFW train is available to one SG, there would no inoperable. loss of function except for a feedwater line break on that SG in containment. This is a very low probability event that could be shown to be of low risk significance for longer than the currently specified completion time.

[Ginna TS Condition Description] 3.7.5.A.1 3.7.5.E.1 Yes The function of the SAFW system is a backup for, and One SAFW train inoperable. comparable to, the MDAFW system.

[Ginna TS Condition Description] --------- 3.7.5.F.1 Yes Even if both SAFW trains were inoperable, there are 2 Both SAFW trains inoperable. MDAFW trains and 2 TDAFW flowpaths available.

There would be no loss of function except in the event of a steam or feedwater line break in the Intermediate Building. This is a very low probability event that could be shown to be of low risk significance for longer than the currently specified completion time.

Component Cooling Water (CCW) 3.7.7 3.7.7 System One CCW train inoperable. 3.7.7.A.1 3.7.7.A.1 Yes TSTF-505 changes are incorporated.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 18 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

Service Water System (SWS) 3.7.8 3.7.8 One SWS train inoperable. 3.7.8.A.1 3.7.8.A.1 Yes Ginna TS Conditions A and B are to pump level. TSTF-3.7.8.B.1 505 changes are incorporated.

Ultimate Heat Sink (UHS) 3.7.9 ---------

One or more cooling towers with 3.7.9.A.1 --------- No The Ginna TS do not contain this TS. Therefore, a one cooling tower fan inoperable. change is not proposed to the Ginna TS.

AC Sources - Operating 3.8.1 3.8.1 One [required] offsite circuit 3.8.1.A.3 3.8.1.A.2 Yes TSTF-505 changes are incorporated.

inoperable. If one source of offsite power becomes unavailable, the redundant offsite power circuit, or the capability to backfeed through the main transformer using a flexible connection that can be tied into the plant auxiliary transformer 11, are available to supply required loads.

Therefore , there is no loss of function.

One [required] DG inoperable. 3.8.1.B.4 3.8.1.B.4 Yes TSTF-505 changes are incorporated.

Two [required] offsite circuits 3.8.1.C.2 3.8.1.C.1 Yes The Ginna TS combines Condition C and D. TSTF-505 inoperable. changes are incorporated.

One [required] offsite circuit 3.8.1.D.1 3.8.1.C.1 Yes The Ginna TS combines Condition C and D. TSTF-505 inoperable. 3.8.1.D.2 3.8.1.C.2 Yes changes are incorporated.

AND One [required] DG inoperable.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 19 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

[One [required] [automatic load 3.8.1.F --------- No The Ginna TS do not contain this TS. Therefore, a sequencer] inoperable. change is not proposed to the Ginna TS.

DC Sources - Operating 3.8.4 3.8.4 One [or two] battery charger[s on 3.8.4.A.3 3.8.4.A.1 Yes TSTF-505 changes are incorporated.

one train] inoperable.

One [or two] batter[y][ies on one 3.8.4.B.1 3.8.4.A.1 Yes TSTF-505 changes are incorporated.

train] inoperable.

One DC electrical power subsystem 3.8.4.C.1 --------- No The Ginna TS do not contain this TS. Therefore, a inoperable for reason other than change is not proposed to the Ginna TS.

Condition A [or B].

Inverters - Operating 3.8.7 3.8.7 One [required] inverter inoperable. 3.8.7.A.1 3.8.7.A.3 Yes TSTF-505 changes are incorporated.

[Ginna TS Condition Description] --------- 3.8.7.B.2 Yes Ginna TS 3.8.7 Condition B is a Ginna-specific Class 1E CVT for AC Instrument condition. Exelon proposes to apply a RICT to the Bus B inoperable existing Ginna TS 3.8.7 Required Action B.2, consistent with TSTF-505. The use of Constant Voltage Transformers (CVTs) is below the level of detail in TSTF-505. However, because there exists a non-Class 1E CVT to power Instrument Bus B, there is no loss of function and this is therefore an appropriate application of RICT.

Distribution Systems - Operating 3.8.9 3.8.9 One or more AC electrical power 3.8.9.A.1 3.8.9.A.1 Yes TSTF-505 changes are incorporated.

distribution subsystems inoperable.

License Amendment Request Attachment 4 Adopt Risk Informed Completion Times TSTF-505 Page 20 of 20 Docket No. 50-244 Cross-Reference of TSTF-505 and R.E. Ginna Nuclear Power Plant Technical Specifications Tech Spec Description TSTF-505 Ginna Tech Spec Apply Comments Tech Spec RICT?

One or more AC vital buses 3.8.9.B.1 3.8.9.B.1 Yes TSTF-505 changes are incorporated.

inoperable.

One or more DC electrical power 3.8.9.C.1 3.8.9.C.1 Yes TSTF-505 changes are incorporated.

distribution subsystems inoperable.

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.18 [NEW TS] 5.5.18 The Ginna TS do not currently contain this program.

The new RICT Program will be added to the Ginna TS 5.5.15 consistent with TSTF-505.

ATTACHMENT 5 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Information Supporting Instrumentation Redundancy and Diversity

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 1 of 23 Information Supporting Redundancy and Diversity The following Instrumentation Technical Specifications (TS) Sections are included in this TSTF-505 License Amendment Request (LAR) for R.E. Ginna Nuclear Power Plant.

1. Reactor Trip System (RTS) Instrumentation - TS Section 3.3.1

2. Engineered Safety Feature Actuation System (ESFAS) Instrumentation - 3.3.2

3. Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation - 3.3.4

4. Containment Ventilation Isolation Instrumentation - 3.3.5

5. Reactor Coolant System (RCS) Loops - MODES 1 < 8.5% RTP, 2, and 3 - 3.4.5

6. Pressurizer Power Operated Relief Valves (PORVs) - 3.4.11

7. Accumulators - 3.5.1

8. ECCS - MODES 1, 2, and 3 - 3.5.2

9. Containment Air Locks - 3.6.2

10. Containment Isolation Boundaries - 3.6.3

11. Containment Spray (CS), Containment Recirculation Fan Cooler (CRFC), and NaOH Systems - 3.6.6

12. Main Steam Safety Valves (MSSVs) - 3.7.1

13. Main Steam Isolation Valves (MSIVs) and Non-Return Check Valves - 3.7.2

14. Atmospheric Relief Valves (ARVs) - 3.7.4

15. Auxiliary Feedwater (AFW) System - 3.7.5

16. Component Cooling Water (CCW) System - 3.7.7

17. Service Water (SW) System - 3.7.8

18. AC Sources - MODES 1, 2, 3, and 4 - 3.8.1

19. DC Sources - MODES 1, 2, 3, and 4 - 3.8.4

20. AC Instrument Bus Sources - MODES 1, 2, 3, and 4 - 3.8.7

21. AC Instrument Bus Sources - MODES 5 and 6 - 3.8.8

22. Distribution Systems - MODES 1, 2, 3, and 4 - 3.8.9 R.E. Ginna TS Section 3.3 Limiting Conditions for Operation (LCOs) were developed to ensure that R.E. Ginna maintains necessary redundancy and diversity, and complies with the single failure design criterion as defined in IEEE-279-1971, and the diversity requirements as defined in Appendix A, General Design Criteria for Nuclear Power Plants (GDC), to Part 50 of 10 CFR, GDC-22, Protection System Independence.

Included below is a description of the redundant and diverse means available to mitigate accidents that each identified instrumentation and control function defined in TS Section 3.3 is designed to prevent.

1. Reactor Trip System (RTS)

Reference:

TS 3.3.1 Reactor Protection System (RPS) Instrumentation The RPS design creates defense-in-depth from the redundancy of the channels for each Function Unit.

Each Functional Unit has multiple channels.

Each Functional Unit will cause a reactor trip with 2/3 or 2/4 tripped channels.

A failed channel does not cause or prevent a trip.

Diverse inputs trip the reactor (USAR Figure 7.2-1).

Manual Trip

High-Nuclear-Flux (Power Range) Trip 2/4

High-Nuclear-Flux (Intermediate Range) Trip 1/2

High-Nuclear-Flux (Source Range) Trip 1/2

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 2 of 23 Information Supporting Redundancy and Diversity

Overtemperature Delta T Trip 2/4

Overpower Delta T Trip 2/4

Low Pressurizer Pressure Trip 2/4

High Pressurizer Pressure Trip 2/3

High Pressurizer Water Level Trip 2/3

Low Reactor Coolant Flow Trip 2/3

Safety Injection System Actuation Trip 2/3

Turbine Trip/Reactor Trip 2/3

Low-Low Steam-Generator Water Level Trip 2/3 The table on the following page provides the equipment available to respond to each accident condition. Not all equipment is assumed or credited in the UFSAR Chapter 15 analysis of records for conservative modeling reasons; however, all equipment has been confirmed to be available and useable in case of any event. The information in the table below is taken from UFSAR Chapter 15 with the majority taken from UFSAR Table 15.0-6.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 3 of 23 Information Supporting Redundancy and Diversity UFSAR Event Description RPS or ESFAS Signal(s) Actuated LOP Diverse RTS Instrumentation Section 15.1.1 Decrease in Feedwater Temperature a N/A 1) Automatic Protection-

- Overpower delta T Trip

- Overtemperature delta T Trip 15.1.2 Increase in Feedwater Flow High-High Steam Generator Water N/A 1) Automatic Protection -

Level Feedwater Regulator Valve - Overpower delta T Trip Closure - Overtemperature delta T Trip

- Power Range Neutron Flux High Trip

- Low Pressurizer Pressure SI 15.1.3 Excessive Load Increase N/A N/A 1) Automatic Protection -

- Overpower delta T Trip

- Overtemperature delta T Trip

- Power Range Neutron Flux High Trip

- Low Pressurizer Pressure Trip 15.1.4 Inadvertent Opening of a Steam a N/A a Generator Relief/Safety Valve 15.1.5 Steam System Piping Failure - Zero - Low Pressurizer Pressure SI N/A 1) Automatic Protection -

Power (Core response only) - Low Steam Line Pressure SI 1) Automatic Protection -

- Steam Line Isolation Delay from - Low Pressurizer Pressure SI High-High Steam Flow with SI - High Containment Pressure SI

- Feedwater Isolation Delay from SI - Overpower delta T trip SI Pumps at Full Flow Following SI - High Containment Pressure Signal - High Steam Flow with Low-Tavg with SI

2) Manual Initiation SI Pumps at Full Flow Following SI SI signal Manual Initiation Signal (with/without offsite power)

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 4 of 23 Information Supporting Redundancy and Diversity UFSAR Event Description RPS or ESFAS Signal(s) Actuated LOP Diverse RTS Instrumentation Section Steam System Piping Failure-Full OPT reactor trip N/A 1) Automatic Protection -

Power (Core response only) - Low Pressurizer Pressure SI

- Low Steam Line Pressure SI

- High Containment Pressure SI

2) Manual SCRAM 15.1.6 Combined Steam Generator ARV and High-High Steam Generator Water N/A 1) Automatic Protection -

Feedwater Control Valve Failures Level Feedwater Regulator Valve - FW Regulator Valve Closure Closure on Low Pressurizer Pressure SI

2) Manual Initiation OPT Reactor Trip N/A 1) Automatic Protection -

- Overtemperature delta T Reactor Trip

- Power Range High Neutron Flux Trip

2) Manual SCRAM Low-Pressurizer Pressure Safety N/A Manual Initiation Injection 15.2.1 Steam Pressure Regulator Malfunction b N/A b or Failure That Results in Decreasing Steam Flow 15.2.2 Loss-of-External-Electrical Load High-Pressurizer Pressure Reactor Trip N/A 1) Automatic Protection -

OTT Reactor Trip 2) Manual SCRAM

3) ATWS Mitigation System Actuation Circuitry (AMSAC) 15.2.3 Turbine Trip b N/A b 15.2.4 Loss-of-Condenser Vacuum b N/A b 15.2.5 Loss-of-Offsite-AC Power to the Station Low-Low Steam Generator Water N/A 1) Automatic Protection -

Auxiliaries Level Reactor Trip - High Pressurizer Pressure Trip

- Overtemperature delta T Trip

- Pressurizer Water Level -

High

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 5 of 23 Information Supporting Redundancy and Diversity UFSAR Event Description RPS or ESFAS Signal(s) Actuated LOP Diverse RTS Instrumentation Section

2) Manual SCRAM

3) ATWS Mitigation System Actuation Circuitry (AMSAC)

Low-Low Steam Generator Water LOOP 1) Automatic Protection -

Level Auxiliary Feedwater (AFW) - Safety Injection Pump Start - Main FW Pump Breaker Trip

- Loss of 4kV voltage on both buses 11A and 11B

2) Manual Actuation of MDAFW pumps and TDAFW pump

3) ATWS Mitigation System Actuation Circuitry (AMSAC) 15.2.6 LONF Low-Low Steam Generator Water N/A 1) Automatic Protection -

Level Reactor Trip - High Pressurizer Pressure Trip

- Overtemperature delta T Trip

- Pressurizer Water Level -

High

2) Manual SCRAM

3) ATWS Mitigation System Actuation Circuitry (AMSAC)

Low-Low Steam Generator Water N/A 1) Automatic Protection -

Level AFW Pump Start - Safety Injection

- Main FW Pump Breaker Trip

- Loss of 4kV voltage on both buses 11A and 11B

2) Manual Actuation of MDAFW pumps and TDAFW pump

3) ATWS Mitigation System Actuation Circuitry (AMSAC)

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 6 of 23 Information Supporting Redundancy and Diversity UFSAR Event Description RPS or ESFAS Signal(s) Actuated LOP Diverse RTS Instrumentation Section 15.2.7 Feedwater System Pipe Breaks Low-Low Steam Generator Water N/A 1) Automatic Protection -

Level Reactor Trip - High Pressurizer Pressure Trip

- Overtemperature delta T Trip

- Pressurizer Water Level -

High

2) Manual SCRAM Low-Low Steam Generator Water LOOP 1) Automatic Protection -

Level AFW Pump Start - Safety Injection

- Main FW Pump Breaker Trip

- Loss of 4kV voltage on both buses 11A and 11B

2) Manual Actuation of MDAFW pumps and TDAFW pump

3) ATWS Mitigation System Actuation Circuitry (AMSAC) 15.3.1 Flow Coastdown Accidents - Low RCL Flow Reactor Trip N/A 1) Automatic Protection -

- RCP Undervoltage Reactor Trip - Opening of Both RCP Breakers

- RCP Underfrequency Reactor Trip Anticipatory Trip

2) Manual SCRAM 15.3.2 Locked Rotor Accident Low RCL Flow Reactor Trip N/A 1) Automatic Protection -

- Opening of Both RCP Breakers Anticipatory Trip

2) Manual SCRAM 15.4.1 Uncontrolled RCCA Withdrawal from a Power-Range High Neutron Flux N/A 1) Automatic Protection -

Subcritical Condition Reactor Trip (Low Setting) - Source Range Neutron Flux Trip

- Intermediate Range Neutron Flux Trip

2) Manual SCRAM

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 7 of 23 Information Supporting Redundancy and Diversity UFSAR Event Description RPS or ESFAS Signal(s) Actuated LOP Diverse RTS Instrumentation Section 15.4.2 Uncontrolled RCCA Withdrawal at - Power-Range High Neutron Flux N/A 1) Automatic Protection -

Power Reactor Trip (High Setting) - Over-Power Delta T trip

- OTT Reactor Trip - High Pressurizer Water Level

- High Pressurizer Pressure Reactor Reactor Trip Trip 2) Manual SCRAM 15.4.3 Startup of an Inactive RCL N/A N/A 1) Automatic Protection -

- Power Range Low Neutron Flux Trip

2) Manual SCRAM 15.4.4 Chemical and Volume Control System OTT Reactor Trip N/A 1) Automatic Protection -

Malfunction (Boron Dilution) - Intermediate Range Neutron Flux Trip

- Power Range High or Low Neutron Flux Trip

2) Manual SCRAM 15.4.5 RCCA Ejection Power-Range High Neutron Flux N/A Manual SCRAM Reactor Trip (Low and High Settings) 15.4.6 RCCA Drop Low-Pressurizer Pressure Reactor Trip N/A Manual SCRAM 15.6.1 Inadvertent Opening of a Pressurizer OTT Reactor Trip N/A 1) Automatic Protection -

Safety or Relief Valve - Low Pressurizer Pressure Reactor Trip

2) Manual SCRAM 15.6.4 Primary System Pipe Ruptures Low-Pressurizer Pressure Reactor Trip N/A Manual SCRAM Low-Pressurizer Pressure Safety SI signal Manual Initiation Injection (SI) 15.8 ATWS ATWS Mitigation System Actuation N/A 1) Manual SCRAM Circuitry (AMSAC) - Turbine Trip (TT),

AFW Pump Start (AFW) a.Transient bounded by steam system piping failure (UFSAR, Section 15.1.5) b.Transient bounded by loss-of-external-electrical load (UFSAR, Section 15.2.2)

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 8 of 23 Information Supporting Redundancy and Diversity

2. Engineered Safety Features Actuation System (ESFAS)

Reference:

TS 3.3.2 Engineered Safety Feature Actuation System (ESFAS)

Instrumentation The Engineered Safety Feature Actuation System (ESFAS) design creates defense-in-depth from the redundancy of the channels for the Actuation Function.

Trip Function has multiple channels.

Trip Function will cause an Actuation with 2/3 tripped channels.

A failed channel does cause or prevent a trip.

The Engineered Safety Features Actuation System (ESFAS) provides actuation of the following functions: safety injection, containment isolation, steam line isolation, containment spray and feedwater isolation, automatic diesel startup, and preferred auxiliary feedwater pump startup.

Safety Injection Containment Pressure-High Pressurizer Pressure-Low Steam Line Pressure-Low o Containment Spray Containment Pressure-High High o Steam Line Isolation Containment Pressure-High High High Steam Flow/Safety Injection/Tavg-Low High-High Steam flow/Safety Injection o Feedwater Isolation SG Water Level-High o Auxiliary Feedwater SG Water Level-Low Low Undervoltage bus 11A and 11B (turbine driven pump only)

Trip of Both main Feedwater Pumps (Motor driven pumps only)

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 9 of 23 Information Supporting Redundancy and Diversity

3. Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation

Reference:

TS 3.3.4 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation The LOP DG design creates defense-in-depth from the redundancy of the channels for the Initiation Function.

The LOP DG start instrumentation consists of two channels on each of safeguards Buses 14, 16, 17, and 18.

Each channel contains one loss of voltage relay and one degraded voltage relay.

A one-out-of-two logic in both channels will cause the following actions on the associated safeguards bus:

a. trip of the normal feed breaker from offsite power;

b. trip of the bus-tie breaker to the opposite electrical train (if closed);

c. shed of all bus loads except the CS pump, component cooling water pump (if no safety injection signal is present), and safety related motor control centers; and

d. start of the associated DG.

The LOP DG start instrumentation is required for the ESF Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESF Actuation System (ESFAS).

Undervoltage conditions which occur independent of any accident conditions result in the start and bus connection of the associated DG, but no automatic loading occurs.

Accident analyses credit the loading of the DG based on the loss of offsite power during a Design Basis Accident (DBA). The most limiting DBA of concern is the large break loss of coolant accident (LOCA) which requires ESF Systems in order to maintain containment integrity and protect fuel contained within the reactor vessel (Ref. 2). The detection and processing of an undervoltage condition, and subsequent DG loading, has been included in the delay time assumed for each ESF component requiring DG supplied power following a DBA and loss of offsite power.

The loss of offsite power has been assumed to occur coincident with the DBA accident analyses assumes the SI signal will actuate the DG within 2 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12 seconds total time). If the loss of offsite power occurs before the SI signal parameters are reached, the accident analyses assumes the LOP DG start instrumentation will actuate the DG within 2.75 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12.75 seconds total time).

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 10 of 23 Information Supporting Redundancy and Diversity Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o Current Technical Specifications (TS) reflect this balance by allowing one channel to be placed in trip, while preserving the fundamental safety function of the applicable system.

Tripping an inoperable channel does not affect the number of channels required to provide the safety function.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one channel of the applicable instrumentation is inoperable. The remaining operable channels for that function are fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable functions has not been decreased (diversity), the number of minimum operable channels to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one channel inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable instrumentation and its functions. It may allow the allowed outage time to be extended for one channel in a function to be inoperable prior to placing the channel in trip. Placing the channel in trip fulfils one of the two required channels in trip needed to perform the safety function.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 11 of 23 Information Supporting Redundancy and Diversity

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of trip channel functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

Safety Guide 6 - Independence Between Redundant Standby (onsite) Power Sources and Between Their Distribution Systems The electrically powered safety systems are divided into two groups so that loss of either one will not prevent safety functions from being performed.

Each ac load group has a connection to the preferred (offsite) power source. In a situation where offsite power is not available, two diesel generators supply standby power to separate redundant load groups. There is no automatic connection between either the diesel generators or the load groups.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Independence between redundant standby power sources is maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Regulatory Guide 1.32 - Use of IEEE Standard 308-1971, Criteria for Class IEE Electric Systems for Nuclear Power Generating Stations The availability of offsite power is discussed fully in UFSAR Chapter 8. The electrical power system was initially designed with a single station auxiliary transformer (12A) but a spare transformer (12B) was added after the beginning of commercial operation. The station auxiliary transformers are used to supply the normal auxiliary power during plant startup and shutdown.

During normal power operation, the station auxiliary transformers remain energized, essentially unloaded (except for supplying 1E loads), and plant auxiliary power is supplied from the main generator via the station unit transformer. With the plant not operating, and offsite power not available, the principal source of power for vital electrical loads is from the emergency diesel generators. For long-term outages of offsite power a backup source of power for the diesel generators is from the normally outgoing power feeder. Power can be brought in over this feeder to the station unit transformer by removing the flexible generator bus disconnects (links) to disconnect the main generator. This can be accomplished in a short time, (less than 8 hr) after which all the vital loads could be supplied from the unit auxiliary transformer. Because of the multiple immediate access power sources, the one delayed access power source conforms to Regulatory Guide 1.32 and General Design Criteria 17.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 12 of 23 Information Supporting Redundancy and Diversity o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

4. Containment Ventilation Isolation Instrumentation

Reference:

TS 3.3.5 Containment Ventilation Isolation Instrumentation Containment ventilation isolation instrumentation closes the containment isolation valves in the Mini-Purge System and the Shutdown Purge System. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident.

The Containment Ventilation Isolation actuation design creates defense-in-depth from the redundancy of the channels for each Trip Function.

Each Trip Function has multiple channels

Each Trip Function will cause an isolation actuation.

Diverse inputs for Containment Ventilation Isolation Actuation (UFSAR Section 6.2.4.3)

Containment Ventilation Isolation o Containment Radiation Signal (from either of 2 Channels):

Gaseous 1/1 Particulate 1/1 o Containment Isolation - Manual Initiation o Containment Spray - Manual Initiation o Safety Injection The safety analyses assume that the containment remains intact with penetrations unnecessary for accident mitigation functions isolated early in the event, within approximately 60 seconds.

The isolation of the purge valves has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed. The containment ventilation isolation radiation monitors act as backup to the containment isolation signal to ensure closing of the ventilation valves. They are also the primary means for automatically isolating containment in the event of a fuel handling accident during shutdown even though containment isolation is not specifically credited for this event. Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses and ensures that the calculated accident offsite radiological doses are below 10 CFR 50.67 (Ref. 1) limits.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 13 of 23 Information Supporting Redundancy and Diversity Containment Ventilation Isolation Instrumentation Diversity Credited Safety Analysis Event TS Table Instrument Function UFSAR Diverse Instrumentation Transient / Accident Section 3.3.5 2. Containment Radiation

a. Gaseous 15.6.4 Primary System Pipe 1) Manual Initiation - Containment Ruptures Isolation

2) Manual Initial - Containment Spray

3) Safety Injection Signal

b. Particulate 15.6.4 Primary System Pipe 1) Manual Initiation - Containment Ruptures Isolation

2) Manual Initial - Containment Spray

3) Safety Injection Signal 3.3.5 5. Safety Injection Refer to Refer to LCO 3.3.2, Function Refer to LCO 3.3.2, Function 1 LCO 3.3.2, 1 Function 1

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 14 of 23 Information Supporting Redundancy and Diversity

5. AC Sources - MODES 1, 2, 3, and 4

Reference:

TS 3.8.1 AC Sources - MODES 1, 2, 3, and 4 The Electrical Power Systems AC Power Sources design creates defense-in-depth from the redundancy of power sources and configurations available.

The plant AC sources consist of an independent offsite power source and the onsite standby emergency power source. Atomic Industrial Forum (AIF) GDC 39 requires emergency power sources be provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning of the Engineered Safety Features (ESF) and protection systems.

o The offsite and onsite AC sources can each supply power to 480 V safeguards buses to ensure that reliable power is available during any normal or emergency mode of plant operation.

o The 480 V safeguards buses are divided into redundant trains so that the loss of any one train does not prevent the minimum safety functions from being performed.

Safeguards Buses 14 and 18 are associated with Train A and safeguards Buses 16 and 17 are associated with Train B.

o Since only the onsite standby power source is classified as Class 1E, the offsite power source is not required to be separated into redundant trains.

The independent offsite power source essentially begins from two station auxiliary transformers (SAT 12A and 12B) each supplied from an independent transmission line emanating from the same switchyard (see Figure B 3.8.1-1). SAT 12A is connected to the 115 kV transmission system (via 34.5 kV circuit 7T) and SAT 12B is connected to the 115 kV transmission system (via 34.5 kV circuit 767). The SATs may be configured in the following modes:

a. SAT 12A (or SAT 12B) supplies safeguards Buses 16 and 17 and SAT 12B (or SAT 12A) supplies safeguards Buses 14 and 18 (50/50 mode);

b. SAT 12A supplies all safeguards Buses (0/100 mode); or

c. SAT 12B supplies all safeguards Buses (100/0 mode).

The preferred configuration is the 50/50 mode; however, all three modes of operation meet applicable design requirements for normal operation. Offsite power can also be provided during an emergency through the plant auxiliary transformer 11 by backfeeding from the 115 kV transmission system and main transformer.

The onsite standby power sources consist of two 1950 kW continuous rating emergency diesel generators (DGs) connected to the safeguards buses to supply emergency power in the event of loss of all other AC power.

o In the event of loss of offsite power, or abnormal offsite power where offsite power is tripped as a consequence of bus undervoltage or degraded voltage, the DGs automatically start and tie to their respective buses.

o In the event of a loss of offsite power and a coincident SI signal, the electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA).

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 15 of 23 Information Supporting Redundancy and Diversity Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. Current Technical Specifications (TS) reflect this balance. The first Completion Time to declare the required safety features inoperable is based on the fact that it is less than the Completion Time for restoring OPERABILITY. A shorter Completion Time is provided since the required safety features have been potentially degraded by the loss of offsite power is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The first, shorter Completion time of the impacted Conditions is not changing with this LAR. The LAR will apply RICT to the actions for restoring equipment to operable status only. This completion time provides a period of time to effect restoration of the offsite circuit commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria. Therefore, a reasonable balance is maintained.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one power source is inoperable. The remaining operable sources for that function are fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable power sources has not been decreased (diversity),

the number of minimum operable power sources to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one source inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable power sources. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 16 of 23 Information Supporting Redundancy and Diversity

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

Safety Guide 6 - Independence Between Redundant Standby (onsite) Power Sources and Between Their Distribution Systems The electrically powered safety systems are divided into two groups so that loss of either one will not prevent safety functions from being performed.

Each ac load group has a connection to the preferred (offsite) power source. In a situation where offsite power is not available, two diesel generators supply standby power to separate redundant load groups. There is no automatic connection between either the diesel generators or the load groups.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Independence between redundant standby power sources is maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Regulatory Guide 1.32 - Use of IEEE Standard 308-1971, Criteria for Class IEE Electric Systems for Nuclear Power Generating Stations The availability of offsite power is discussed fully in UFSAR Chapter 8. The electrical power system was initially designed with a single station auxiliary transformer (12A) but a spare transformer (12B) was added after the beginning of commercial operation. The station auxiliary transformers are used to supply the normal auxiliary power during plant startup and shutdown.

During normal power operation, the station auxiliary transformers remain energized, essentially unloaded (except for supplying 1E loads), and plant auxiliary power is supplied from the main generator via the station unit transformer. With the plant not operating, and offsite power not available, the principal source of power for vital electrical loads is from the emergency diesel generators. For long-term outages of offsite power a backup source of power for the diesel generators is from the normally outgoing power feeder. Power can be brought in over this feeder to the station unit transformer by removing the flexible generator bus disconnects (links) to disconnect the main generator. This can be accomplished in a short time, (less than 8 hr) after which all the vital loads could be supplied from the unit auxiliary transformer. Because of the multiple immediate access power sources, the one delayed access power source conforms to Regulatory Guide 1.32 and General Design Criteria 17.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 17 of 23 Information Supporting Redundancy and Diversity o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

6. DC Sources - MODES 1, 2, 3, and 4

Reference:

TS 3.8.4 DC Sources - MODES 1, 2, 3, and 4 The Electrical Power Systems DC Power Sources design creates defense-in-depth from the redundancy of power sources available.

The station DC electrical power subsystem provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC instrument bus power (via inverters).

The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power distribution train (Train A and Train B). Each subsystem consists of one 125 VDC battery, two battery chargers supplied from the 480 V system, distribution panels and buses, and all the associated control equipment and interconnecting cabling.

Each battery provides a separate source of DC power independent of AC power. There are four battery chargers available to the batteries, each with a capacity of 200 amps. Normally, only one battery charger is aligned to a battery while the second battery charger is maintained in standby.

Train A Engineered Safety Feature (ESF) equipment is supplied from battery A, while Train B ESF equipment is supplied from battery B. Additionally, the 480 V ESF switchgear and diesel generator (DG) control panels are supplied from either battery by means of an automatic transfer circuit in the switchgear and control panels. The normal supply from Train A (Buses 14 and 18 and DG A) is from DC distribution panels A. These panels also provide the emergency DC supply for Train B. Similarly, the normal supply from Train B (Buses 16 and 17 and DG B) is from DC distribution panels B. These panels also provide the emergency DC supply for Train A.

Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o The DC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. Current Technical Specifications (TS) reflect this balance. With one DC electrical power source inoperable, redundancy is lost and only one train is capable to completely respond to an event. If one of the required DC electrical power sources is inoperable, the remaining DC electrical power source has the capacity to support a safe shutdown and to mitigate an accident condition. A subsequent worst case single failure would, however, result in the complete loss of the remaining 125 VDC electrical power distribution subsystem with attendant loss of ESF functions. A Risk Informed Completion

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 18 of 23 Information Supporting Redundancy and Diversity Time still reflects a reasonable time to assess plant status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power source is not restored to OPERABLE status, to prepare to affect an orderly and safe plant shutdown. Therefore, a reasonable balance is maintained.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one power source is inoperable. The remaining operable source for that function is fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable power sources has not been decreased (diversity),

the number of minimum operable power sources to perform the safety function has not been decreased, and the trains remain independent as originally designed, even with one source inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable power sources. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

Safety Guide 6 - Independence Between Redundant Standby (onsite) Power Sources and Between Their Distribution Systems

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 19 of 23 Information Supporting Redundancy and Diversity The 125-V dc system is divided into two buses with one battery and two battery chargers (supplied from the 480-V system) serving each. The battery chargers supply the normal dc loads as well as maintaining proper charges on the batteries.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Independence between redundant standby power sources is maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Regulatory Guide 1.32 - Use of IEEE Standard 308-1971, Criteria for Class IEE Electric Systems for Nuclear Power Generating Stations An isolation device prevents malfunctions in one section of a distribution system from causing unacceptable influences in other sections of that system. Non-Class 1E circuits are electrically isolated from Class 1E circuits by these isolation devices. All fuses used as isolation devices in the distribution systems are required to be coordinated, which is generally defined as being able to carry design basis currents for all loads. The dc distribution system fed from the Class 1E vital batteries has been analyzed, upgraded if required, and tested to meet the dc fuse coordination requirements.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

7. AC Instrument Bus Sources - MODES 1, 2, 3, and 4

Reference:

TS 3.8.7 AC Instrument Bus Sources - MODES 1, 2, 3, and 4 The Electrical Power Systems AC Instrument Bus Power Sources design creates defense-in-depth from the redundancy of power sources and configurations available.

The AC instrument bus electrical power distribution subsystem consists of four 120 VAC instrument buses. The power source for one 120 VAC instrument bus (Instrument Bus D) is normally supplied from offsite power via a non-Class 1E constant voltage transformer (CVT) such that only three buses are considered safety related (A, B, and C) and supply a source of power to instrumentation and controls which are used to monitor and actuate the Reactor Protection System (RPS) and Engineered Safety Features (ESF) and other components.

Instrument Buses A and C can be supplied power either from inverters which are powered from separate and redundant DC power sources, a non-Class 1E CVT (maintenance CVT) powered from offsite power, or a Class 1E CVT.

Instrument Bus B can be supplied power from either a Class 1E CVT or a non-Class 1E CVT (maintenance CVT) powered from offsite power.

Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 20 of 23 Information Supporting Redundancy and Diversity

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. Current Technical Specifications (TS) reflect this balance. Required action A.1 completion time to allow the instrument bus to be powered from either its associated Class 1E CVT or from a non-Class 1E CVT will not be impacted by this LAR. Required Action A.2 completion time to limit the amount of time that the instrument bus can be connected to a non-Class 1E power supply will not be impacted by this LAR. Required Action A.3 will be changed to have a Risk Informed Completion Time to fix the inoperable inverter and restore it to OPERABLE status. The RICT will continue to balance against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. The Required Action B.1 completion time to allow the instrument bus to be powered from its non-Class 1E CVT will not be impacted by this LAR. Required Action B.2 will be changed to have a Risk Informed Completion Time to fix the inoperable CVT and restore it to OPERABLE status. The RICT will continue to balance against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. Therefore, a reasonable balance is maintained.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one Inverter/CVT is inoperable. The remaining operable sources for that function are fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable power sources has not been decreased (diversity),

the number of minimum operable power sources to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one source inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable power sources. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 21 of 23 Information Supporting Redundancy and Diversity

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

Instrument buses 1A, 1B, 1C, and 1D provide 120-V ac power to instrumentation and controls which are used to monitor and actuate systems important to the safety of the plant.

The instrument buses meet the single failure criteria of IEEE Standard 379-1972. The inverters and static switches for instrument buses 1A and 1C meet the separation criteria of IEEE Standard 384-1974.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT)

Program, to perform actions that the NRC has previously determined to be acceptable.

8. Distribution Systems - MODES 1, 2, 3, and 4

Reference:

TS 3.8.9 Distribution Systems - MODES 1, 2, 3, and 4 The Electrical Power Distribution Systems design creates defense-in-depth from the redundancy of power sources and configurations available.

A source of electrical power is required for most safety related and nonessential action components. Two sources of electrical power are available, alternating current (AC) and direct current (DC). Separate distribution systems are developed for each of these electrical power sources which are further divided and organized based on voltage considerations and safety classification.

o The Class 1E AC electrical power distribution subsystem is organized into two redundant and independent trains (Train A and Train B). Each train consists of two 480 V safeguards buses, distribution panels, motor control centers and load centers.

o The Class 1E DC electrical power distribution subsystem is organized into two redundant and independent trains (Train A and Train B). Each train consists of a Class 1E battery and two battery chargers which supply a main 125 VDC distribution panel.

o The AC instrument bus electrical power distribution subsystem consists of four 120 VAC instrument buses. The power source for one 120 VAC instrument bus (Instrument Bus D) is normally supplied from offsite power via a non-Class 1E constant voltage transformer (CVT) such that only three buses are considered safety related (A, B, and C) and supply a source of power to instrumentation and controls which are used to monitor and actuate the Reactor Protection System (RPS) and Engineered Safety Features (ESF) and other components.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 22 of 23 Information Supporting Redundancy and Diversity Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. Current Technical Specifications (TS) reflect this balance. With one electrical power distribution train inoperable, the remaining train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because a single failure in the remaining train could result in the minimum required ESF functions not being supported. Therefore, the required power distribution train must be restored to OPERABLE status within a determined Completion Time. This LAR will change this to a Risk Informed Completion Time to restore the train to OPERABLE status. The RICT will continue to balance against the vulnerability of a complete loss of power. Therefore, a reasonable balance is maintained with the RICT LAR.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one train is inoperable. The remaining train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable power distribution trains has not been decreased (diversity), the number of minimum operable power sources to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one train inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable power distribution system trains. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

License Amendment Request Attachment 5 Adopt TSTF-505 Risk Informed Completion Times Page 23 of 23 Information Supporting Redundancy and Diversity

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

Safety Guide 6 - Independence Between Redundant Standby (onsite) Power Sources and Between Their Distribution Systems The electrically powered safety systems are divided into two groups so that loss of either one will not prevent safety functions from being performed.

Each ac load group has a connection to the preferred (offsite) power source. In a situation where offsite power is not available, two diesel generators supply standby power to separate redundant load groups. There is no automatic connection between either the diesel generators or the load groups.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Independence between redundant standby power sources is maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

The 125-V dc system is divided into two buses with one battery and two battery chargers (supplied from the 480-V system) serving each. The battery chargers supply the normal dc loads as well as maintaining proper charges on the batteries.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Independence between redundant standby power sources is maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

ATTACHMENT 6 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

RICT Program Implementation Items

License Amendment Request Attachment 6 Adopt Risk Informed Completion Times TSTF-505 Page 1 of 1 Docket No. 50-244 RICT Program Implementation Items The table below identifies the items that are required to be completed prior to implementation of the Risk-Informed Completion Time (RICT) Program at R. E. Ginna. All issues identified below will be addressed and any associated changes will be made.

Source Description Implementation Item Enclosure 4 Additional

SAFW Generator Radiator Exhaust: Replace 19W4 tornado 1/4x 2 Bar Grating with 19W4 1/4x 4Bar Grating protection margin

B Emergency Diesel Generator Room Air Intake:

being Replace 19W4 1/4x 2 Bar Grating with 19W4 1/4x implemented 4Bar Grating

B EDG Roof Vents: Increase anchorage capacity by expanding baseplate, increasing the size/embedment depth of anchors

KDG08 Exhaust: Additional gussets at outside face of piping and, re-pad on outside edge of elbow

KDG01B Exhaust: Perform field measurements to determine thickness of silencer (SDG01A) shell; upgrade as necessary.

ATTACHMENT 7 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Proposed Renewed Facility Operating License Changes (Mark-ups)

FOL Page 9

License Amendment Request Attachment 7 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Proposed Renewed Facility Operating License Changes (Mark-ups)

INSERT 1 (17) Adoption of Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extension Completion Times - RITSTF Initiative 4b" Exelon is approved to implement TSTF-505, Revision 2, modifying the Technical Specification requirements related to Completion Times (CT) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). The methodology for using the new Risk-Informed Completion Time Program is described in NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, which was approved by the NRC on May 17, 2007.

Exelon will complete the implementation items listed in Attachment 6 of Exelon Letter to the NRC dated May 20, 2021, prior to implementation of the RICT Program. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa -2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to the implementation of the RICT Program.

(15) At least half the members of the CENG Board of Directors must be U.S.

citizens.

(16) The CENG Chief Executive Officer, Chief Nuclear Officer, and Chairman of the CENG Board of Directors must be U.S. citizens. These individuals shall have the responsibility and exclusive authority to ensure and shall ensure that the business and activities of CENG with respect to the facilitys license are at all times conducted in a manner consistent with the public health and safety and common defense and security of the INSERT 1 United States.

(17)

(18)

D. The facility requires an exemption from certain requirements of 10 CFR 50.46(a)(1). This includes an exemption from 50.46(a)(1), that emergency core cooling system (ECCS) performance be calculated in accordance with an acceptable calculational model which conforms to the provisions in Appendix K (SER dated April 18, 1978). The exemption will expire upon receipt and approval of revised ECCS calculations. The aforementioned exemption is authorized by law and will not endanger life property or the common defense and security and is otherwise in the public interest. Therefore, the exemption is hereby granted pursuant to 10 CFR 50.12.

E. Exelon Generation shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27827 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "R. E. Ginna Nuclear Power Plant Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan," submitted by letter dated May 15, 2006.

Exelon Generation shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 113 and modified by License Amendment No. 117. The licensee has obtained Commission authorization to use Section 161A preemption authority under 42 U.S.C. 2201a for weapons at its facility.

ENCLOSURE 1 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

List of Revised Required Actions to Corresponding PRA Functions

ENCLOSURE 1 List of Revised Required Actions to Corresponding PRA Functions

1. Introduction Section 4.0, Item 2 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (Reference 2) identifies the following needed content:

The License Amendment Request (LAR) will provide identification of the Time Sensitive (TS) Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the Structures, Systems, and Components (SSCs) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 50.46 ECCS flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure provides confirmation that the Ginna Nuclear Power Plant PRA models include the necessary scope of SSCs and their functions to address each proposed application of the Risk-Informed Completion Time (RICT) Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The Ginna PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.

Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:

- Column "Tech Spec Description": Lists all of the LCOs and condition statements within the scope of the RICT Program.

- Column "SSCs Covered by TS LCO Condition": The SSCs addressed by each action requirement.

- Column "Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.

- Column "Function Covered by TS LCO Condition": A summary of the required functions from the design basis analyses.

- Column "Design Success Criteria": A summary of the success criteria from the design basis analyses.

- Column "PRA Success Criteria": The function success criteria modeled in the PRA.

E1-1

ENCLOSURE 1 List of Revised Required Actions to Corresponding PRA Functions

- Column "Comments": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09 Revision 0-A.

The corresponding SSCs for each TS LCO [4] and the associated TS functions [5] are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to capability Category II of the PRA standard as required by NEI 06-09 Revision 0-A.

Examples of calculated RICT are provided in Table E1-2 for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). These example calculations demonstrate the scope of the SSCs covered by technical specifications modeled in the PRA. Following 4b implementation, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09, Revision 0-A and the NRC safety evaluation, and may differ from the RICTs presented.

Table E1-3 lists the TSTF-505 Rev 2 Table 1 Tech Specs that require additional justification along with a description of how the additional justification is provided in the LAR.

Table E1-4 Provides additional detail of PRA modeling of I&C functions. It includes a discussion of how digital equipment is modeled in the PRA.

E1-2

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1 below lists each in scope TS LCO Condition, associated TS function, Design Success Criteria, and correspding PRA Success Criteria.

Refer to Enclosure 1 section Modeling of Instrumentation and Control for further discussion of how RTS, ESFAS, and EDG start instrumentation are modeled in the Ginna PRA.

Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Required One of two Action A.1 and Manual Reactor pushbuttons in referenced by Pushbuttons (1) Manual the Main Control 3.3.1.B Table 3.3.1-1. modeled Yes Reactor Trip Room Same as Design Explicitly modeled As required by (2a) Two of four Required channels Action A.1 and Power Range (2) Power Range referenced by Channels/Detectors Neutron Flux (2b) Two of four 3.3.1.D Table 3.3.1-1. modeled Yes (a) High (b) Low. channels Same as Design Explicitly modeled As required by Required Overtemperature Action A.1 and Delta T. indicators (5) referenced by and bistabes Overtemperature Two of four 3.3.1.D Table 3.3.1-1. modeled Yes Delta T. channels Same as Design Explicitly modeled As required by Overpower Delta T.

Required Temperature Action A.1 and indicators and referenced by bistabes are (6) Overpower Two of four 3.3.1.D Table 3.3.1-1. modeled Yes Delta T. channels Same as Design Explicitly modeled E1-3

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Pressurizer Required pressure-high.

Action A.1 and Pressure transmitters referenced by and controllers are (7b) Pressurizer Two of three 3.3.1.D Table 3.3.1-1. modeled Yes pressure-high. channels Same as Design Explicitly modeled As required by Required Action A.1 and Pressurizer water referenced by level-high. Level (8) Pressurizer Two of three 3.3.1.D Table 3.3.1-1. Transmitters Yes water level-high channels Same as Design Explicitly modeled As required by Required SG water level-low Action A.1 and low. Level Two of three referenced by Transmitters (13) SG water channels (per 3.3.1.D Table 3.3.1-1. modeled Yes level-low low SG) Same as Design Explicitly modeled As required by Pressurizer Required Pressure-Low.

Action A.1 and Pressure referenced by Transmitters (7a) Pressurizer Two of four 3.3.1.K Table 3.3.1-1. modeled Yes Pressure-Low channels Same as Design Explicitly modeled As required by Required RX coolant flow-Low Action A.1 and (Two Loops). Flow (9b) RX coolant Two of three referenced by Transmitters flow-Low (Two channels (per 3.3.1.K Table 3.3.1-1. modeled Yes Loops) loop) Same as Design Explicitly modeled E1-4

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Required Action A.1 and RCP breaker position (10b) RCP breaker referenced by (Two Loops) position (Two One open 3.3.1.K Table 3.3.1-1. Breakers modeled Yes Loops) breaker per RCP Same as Design Explicitly modeled As required by Required Under Voltage Action A.1 and BUS11A and referenced by BUS11B UV relays (11) UV BUS11A One of two 3.3.1.K Table 3.3.1-1. modeled Yes. and BUS11B channels per bus Same as Design Explicitly modeled E1-5

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Required Under Frequency (12) Under Action A.1 and BUS11A and Frequency referenced by BUS11B UV relays BUS11A and One of two 3.3.1.K Table 3.3.1-1. modeled Yes BUS11B channels per bus Same as Design Explicitly Modeled As required by Required RX coolant flow-Low Action A.1 and (Single Loop) Flow (9a) RX coolant Two of three referenced by Transmitters flow-Low (Single channels (per 3.3.1.M Table 3.3.1-1. modeled. Yes Loop) loop) Same as Design Explicitly modeled As required by Required Action A.1 and RCP breaker position (10a) RCP breaker referenced by (Single Loop) position (Single One open 3.3.1.N Table 3.3.1-1. breakers modeled Yes Loop) breaker per RCP Same as Design Explicitly modeled E1-6

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Turbine Trip on Low Autostop Oil (14)(a) Turbine As required by Pressure and Trip on Low 14(a) Two of Required Turbine Stop Valve Autostop Oil three channels Action A.1 and Closure relays and Pressure and (b) referenced by pressure switches Turbine Stop Valve 14(b) Two of two 3.3.1.P Table 3.3.1-1. modeled Yes Closure channels Same as Design Explicitly modeled Safety Injection Input As required by from Engineered (15) Safety Required Safety Feature Injection Input from Action A.1 and Actuation System Engineered Safety referenced by (ESFAS) relays Feature Actuation 3.3.1.R Table 3.3.1-1. modeled Yes System (ESFAS) One of two trains Same as Design Explicitly modeled As required by Automatic Trip Logic A modeled surrogate Required function is modeled can be used to Action A.1 and via surrogate. SSCs Not Function is either represent a failure of referenced by are not explicitly Explicitly (19) Automatic Trip available or not automatic scram 3.3.1.R Table 3.3.1-1. modeled Modeled Logic One of two trains available functionality E1-7

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Required Reactor Trip Action A.1 and Breakers and bypass referenced by breakers are (17) Reactor Trip One of two RTBs 3.3.1.T Table 3.3.1-1. modeled Yes Breakers open Same as Design Explicitly modeled As required by Reactor Trip Breaker (18) Reactor Trip Required Undervoltage and Breaker Action A.1 and Shunt Trip Undervoltage and One trip referenced by Mechanisms Relays Shunt Trip mechanism per 3.3.1.U Table 3.3.1-1. are modeled Yes Mechanisms RTB Same as Design Explicitly modeled E1-8

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments A modeled surrogate basic event can be used to represent the loss of EITHER channel start signal to AFW pumps. This event is only applied to the MFPX1A1 function. This is representative of risk for either train function (6f) due to four levels of redundancy Trip of both Main available to start the As required by Feedwater Pumps MDAFW pumps (i.e. 2 Required (Motor Driven Pumps (6f) Auxiliary SG water level starts, Action A.1 and only) breaker Feedwater-Trip of Two of two MFW starts, and referenced by contacts are Yes. See Both Main channels per operation action to 3.3.2.B Table 3.3.2-1. modeled comment Feedwater Pumps MFW Pump Same as Design start).

As required by Required Steamline Isolation One of two Assumed A modeled surrogate Action A.1 and (manual initiation) Not (4a) Steamline devices complete loss of can be used to referenced by push buttons are not Explicitly Isolation (manual (pushbutton or manual steam line represent failure of this 3.3.2.D Table 3.3.2-1. modeled Modeled initiation) switch) per MSIV initiation function.

E1-9

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments In addition to UV relays explicitly modeled for One of two this function, there is a coincidence on modeled surrogate that As required by BUS11A may be used for the Required AND TS condition to sense Action A.1 and (6e) AFW One of two an UV condition and to referenced by Undervoltage Yes. See Undervoltage coincidence on open TDAFW Steam 3.3.2.D Table 3.3.2-1. BUS11A and 11B comment BUS11A and 11B BUS11B Same as Design admission valves.

Components are Explicitly modeled for this function. In As required by addition, modeled Required Steam line isolation (4b) Steam line Tech Spec flags can Action A.1 and Automatic actuation isolation Automatic be used as surrogates referenced by logic and actuation Yes. See actuation logic and to represent this 3.3.2.E Table 3.3.2-1. relays modeled comment actuation relays One of two trains Same as Design function Components are Explicitly modeled for As required by (5a) Feedwater this function. In Required Feedwater isolation; isolation; addition, modeled tech Action A.1 and Automatic actuation Automatic spec flags can be used referenced by logic and actuation Yes. See actuation logic and as surrogates to 3.3.2.E Table 3.3.2-1. relays are modeled comment actuation relays One of two trains Same as Design represent this function E1-10

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Components are Explicitly modeled. In As required by addition, modeled Required AFW Automatic (6b) AFW Tech Spec flags can Action A.1 and actuation logic and Automatic be used as surrogates referenced by actuation relays are Yes. See actuation logic and to represent this 3.3.2.E Table 3.3.2-1. modeled comment actuation relays One of two trains Same as Design function Components are Explicitly modeled to represent this function.

As required by In addition, modeled Required Containment Tech Spec flags can Action A.1 and Pressure-High High (4c) Containment be used as surrogates referenced by Transmitters Yes. See Pressure-High Two of three to represent this 3.3.2.F Table 3.3.2-1. modeled comment High channels Same as Design function One of two channels per steam line Components are As required by coincident with Explicitly modeled to Required two of four Tavg- represent this function.

Action A.1 and High Steam Flow Low channels Surrogates are also referenced by Flow Transmitters Yes. See (4d) High Steam coincident with available to represent 3.3.2.F Table 3.3.2-1. modeled comment Flow SI. Same as Design function.

E1-11

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Components are As required by One of two Explicitly modeled to Required channels per represent this function.

Action A.1 and High-High steam flow steam line TS surrogates can also referenced by Flow Transmitters Yes. See (4e) High-High coincident with be used to model one 3.3.2.F Table 3.3.2-1. modeled comment steam flow SI. Same as Design channel unavailable (5b) SG water level- (5b) Same as High and design to isolate As required by (5b) SG water (5b) Two of three MFW.

Required (6c) SG water level- level-High. channels per SG Action A.1 and low low Level (6c) Same as referenced by transmitters/ (6c) SG water (6c) Two of three design for AFW 3.3.2.F Table 3.3.2-1. controllers modeled Yes level-low low channels per SG actuation. Explicitly modeled E1-12

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Safety Injection; (1a) Manual Initiation Safety Injection; (1a) Manual Initiation Containment (1a) One of two Spray; pushbuttons Containment Spray; (2a) Manual Success is As required by (2a) Manual Initiation Initiation (2a) Two of two Manual SI/CS/CI Required pushbuttons actuation Condition can be Action A.1 and Containment Not Containment (individual represented via referenced by Isolation; (3a) Explicitly Isolation; (3a) (3a) One of two components are modeled surrogate to 3.3.2.H Table 3.3.2-1. Manual Initiation Modeled Manual Initiation pushbuttons not modeled). represent this function.

Auto Start not explicitly modeled for SI pump A. A surrogate can be used to fail autostart of this SI pump. Auto-start on SI signal is SI Automatic modeled for SI pump B actuation logic and and C, Containment As required by actuation relays not isolation, MDAFW Required explicitly modeled to pumps, steamline Action A.1 and auto start SI pump A. (1b) SI Automatic isolation, EDG's, referenced by However, SI pumps Yes. See actuation logic and Containment Spray, 3.3.2.I Table 3.3.2-1. are modeled. comments actuation relays One of two trains Same as Design and more.

E1-13

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments As required by Required CS Automatic Action A.1 and actuation logic and (2b) CS Automatic referenced by actuation relay is actuation logic and Function explicitly 3.3.2.I Table 3.3.2-1. modeled Yes actuation relays One of two trains Same as Design modeled via relay In addition to explicitly As required by modeled relays that Required CI Automatic represent this function, Action A.1 and actuation logic and (3b) CI Automatic a surrogate is modeled referenced by actuation relays are Yes. See actuation logic and per train that can be 3.3.2.I Table 3.3.2-1. modeled comment actuation relays One of two trains Same as Design used to represent (3b)

E1-14

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments (1c) is explicitly modeled for RX trip logic via components and there is a surrogate available to represent a single channel for RTS. (1c)

Components are also modeled to actuate containment spray.

(1c) is not explicitly modeled to actuate SI pump A. A surrogate can be used to represent failure of A SI pump to automatically start.

Safety Injection; (1c) Containment (2c) is modeled Pressure High explicitly for this Transmitters and (1c) Two of three function via As required by controllers are Containment channels transmitters. In Required modeled, but not Spray; addition, there are Action A.1 and auto actuation of SI Not (2c) Containment (2c) Two of three surrogate events referenced by pumps for (1c) and Explicitly Pressure High channels (both available to represent 3.3.2.J Table 3.3.2-1. (2c) Modeled High sets) Same as Design the LCO.

E1-15

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Pressure Transmitters are modeled for many SI related functions such as PORV and Pressurizer spray As required by Pressurizer Pressure operation but are not Required Low transmitters are modeled to actuate SI Action A.1 and modeled for PORV pumps. Surrogates referenced by and Spray but not SI Yes. See (1d) Pressurizer Two of three can be used to fail 3.3.2.L Table 3.3.2-1. pump actuation Comment Pressure Low channels Same as Design Auto SI pump function.

Modeled components and surrogates are modeled for many SI functions including Containment Fan Cooler operation and Reactor Trip. This As required by Steam line pressure function is not modeled Required low transmitters to actuate SI pumps.

Action A.1 and modeled for ESFAS Two of three Surrogates can be referenced by except autostart of SI Yes. See (1e) Steam line channels (per used to fail Auto SI 3.3.2.L Table 3.3.2-1. pumps Comment pressure low steam line) Same as Design pump function.

E1-16

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Trip of the normal feed breaker from offsite power; trip of the bus-tie breaker to the opposite electrical One or more train (if closed);

480 V bus(es) shed of all bus Undervoltage relays with one Loss of voltage and loads except CS, One of two logic are explicitly modeled channel degraded voltage CCW, MCCs; and in both channels to meet design logic for 3.3.4.A inoperable. relays are modeled. Yes start EDGs (per bus) Same as Design EDG loading.

E1-17

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments In the Ginna model, Rad monitors are mostly modeled for hot short and SERF impacts. However, some of the SERF gates propagate to Containment LERF given Radiation Signal combination paths that from either of 2 combine to greater channels: than 2". Mini purge valves are explicitly Gaseous: one of modeled but not one channel Same as Design. currently impacted by Isolates the R-11 and R-12 rad monitor failures containment Particulate: one rad monitors do (Mini purge valves will atmosphere from of one channel not account for all be mapped to the environment to applicable Radiation monitors for One radiation minimize releases R-11 and R-12 isolation valves RICT). For this monitoring of radioactivity in provide backup and surrogate reason, this function is channel Rad Monitors R-11 Yes. See the event of an signals to the mapping will be modeled for RICT via 3.3.5.A inoperable. and R-12 comment accident primary CI signal required. surrogate.

Success requires 1/2 PORVs for Feed and Bleed.

2/2 PORVs required for Loss One PORV Both PORVs are Depressurize the 1/2 PORVs of Main Function is Explicitly 3.4.11.B inoperable. modeled Yes RCS operable Feedwater, LOOP modeled E1-18

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments and loss of Electrical Load Events 1/2 block valves required to ensure One block Isolate PORV to PORV on the isolation of valve Both PORV block mitigate PORV same train affected PORV Function Explicitly 3.4.11.C inoperable. valves Yes LOCA operable LOCA. modeled 1/2 block valves required to ensure Both block Isolate PORV to isolation of valves Both PORV block mitigate PORV 2/2 PORVs affected PORV Function Explicitly 3.4.11.D inoperable. valves Yes LOCA operable LOCA. modeled One accumulator inoperable due 1/2 Accumulators to boron Provide core above the concentration Both Accumulators cooling to the minimum boron not within and associated Reactor during a concentration Function Explicitly 3.5.1.A limits. discharge Valves Yes LOCA limit Same as Design modeled E1-19

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments One accumulator 1/2 Accumulators inoperable for Provide core above the 1 of 2 reasons other Both Accumulators cooling to the minimum boron accumulators than Condition and associated Reactor during a concentration injecting into core Function Explicitly 3.5.1.B A. discharge Valves Yes LOCA limit for success modeled.

Provide core cooling and One train negative reactivity 1/2 RHR trains inoperable. to ensure that the required for AND At least reactor core is success of core 100% of the protected after cooling.

ECCS flow LOCA, rod equivalent to a ejection, loss of 1/2 RHR trains 1/3 SI trains single RHR and SI Pumps secondary coolant, operable required for core OPERABLE and associated and Steam AND cooling per ECCS train suction and Generator Tube 2/3 SI trains thermal-hydraulic Function Explicitly 3.5.2.A available. discharge valves Yes Rupture. operable analysis modeled One or more 1/2 personnel containment hatch doors air locks operable Containment airlocks inoperable for Control of the AND A failure of either not explicitly modeled.

reasons other Not containment 1/2 equipment airlock is assumed A surrogate can be than Condition Equipment hatch and Explicitly leakage rate hatch doors a failure of used to represent a 3.6.2.C A or B. personnel hatch Modeled following a DBA operable containment. failure of containment.

E1-20

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments One or more penetration flow paths with one containment Many CI valve are isolation explicitly modeled.

boundary This Function can be inoperable 1/2 Containment captured via surrogate except for Minimizing the isolation valves for those valves not mini-purge containment of that explicitly modeled by valve leakage Yes see barrier leakage penetration using alternate CI 3.6.3.A not within limit. CI valves per A-3.3 comment rates during a DBA operable Same as Design valves One or more Many CI valve are penetration explicitly modeled.

flow paths with This Function can be one captured via surrogate containment Minimizing the for those valves not isolation containment 1/2 Containment explicitly modeled by boundary Yes. see barrier leakage isolation valves using alternate CI 3.6.3.C inoperable. CI valves per A-3.3 comment rates during a DBA operable Same as Design valves Minimizing the loss One or more of reactor coolant mini-purge inventory and penetration establishing the flow paths with containment two valves not barrier leakage 1/2 Containment within leakage rates during a isolation valves Mini Purge valves are 3.6.3.E limits Mini Purge Valves Yes DBA. operable Same as Design explicitly modeled.

E1-21

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments For Level 1 PRA, CS and CRFCs are modeled to aid in determination of plant damage states for medium and large LOCAs.

For Level 2 PRA, CS and CRFCs are explicitly modeled to At least 1 prevent failure of Maintain the Containment containment with containment peak Spray pump (or 1 consideration of pressure and CRFC) must be pressure and temperature below available to temperature loads.

the design limits. ensure Remove iodine containment Although the iodine from the ultimate strength removal function is not containment is not exceeded. explicitly modeled for atmosphere and Bounding impact on LERF, the maintain pressure and impact on containment concentrations temperatures heat removal is below those 1/2 Containment loads were bounding from a risk One CS train Two Containment Yes. See assumed in the Spray trains evaluated in this perspective.

3.6.6.A inoperable. Spray trains Comment safety analysis. operable analysis.

E1-22

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments For Level 1 PRA, CS and CRFCs are modeled to aid in determination of plant damage states for medium and large LOCAs.

For Level 2 PRA, CS and CRFCs are explicitly modeled to Maintain the prevent failure of containment peak containment with pressure and consideration of temperature below pressure and the design limits. 1/4 CRFC's (or temperature loads.

Remove iodine 1/2 CS pumps) from the required to Although the iodine containment maintain removal function is not atmosphere and containment explicitly modeled for maintain pressure and impact on LERF, the concentrations temperature impact on containment One or two below those below ultimate heat removal is CRFC units Yes. See assumed in the 2/4 CRFCs strength failure bounding from a risk 3.6.6.D inoperable. Four CRFCs Comment safety analysis. operable criteria. perspective.

E1-23

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Same as Design to provide overpressure protection for ATWS (explicitly modeled). ATWS modeling gives Provide 8/8 MSSVs, an appropriate overpressure or Else 1 of 8 approximation for delta protection for 7/8 MSSVs and MSSVs required risk. Non ATWS design basis 1/2 ARVs, for non-ATWS EVENTS require One or more transients or transients (not failure of all 8 MSSVs MSSVs Yes. see occurring at 1817 6/8 MSSVs and explicitly and is not explicitly 3.7.1.A inoperable. Eight MSSVs comment Mwt 2/2 ARVs modeled). modeled.

MSIV closure is necessary to MSIV on affected isolate a SG SG required to affected by a isolate SG to steam generator prevent loss of tube rupture inventory and (SGTR) event or a ensure heat steam line break removal from One or more (SLB) to stop the intact SG.

valves loss of SG 1/2 MSIVs inoperable in inventory and to operable Non-return check flowpath from protect the integrity AND valve required to a steam MSIVs and of the unaffected 2/2 non-return isolate affected generator (SG) associated non- SG for decay heat check valves SG during 3.7.2.A in MODE 1. return check valves Yes removal. operable Steamline break. Explicitly modeled E1-24

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Function explicitly Steam generator modeled except for tube rupture block valve. Block (SGTR) events 1/2 ARVs on the valve can be which require the SG being used for represented by a use of at least one cooldown required surrogate. ARV block ARV to provide for Steam valves function to heat removal from generator tube isolate a stuck open the Reactor 1/2 ARVs rupture (SGTR) ARV are not modeled Coolant System operable events to provide for SGTR, but are (RCS) to prevent AND heat removal from modeled to prevent ARVs and saturation Opposite train the Reactor both SGs from blowing One ARV line associated block Yes. see conditions from block valve Coolant System down during a 3.7.4.A inoperable. valves comment developing operable (RCS) feedwater event.

1/2 MDAFW trains operable For loss of MFW Supply water to AND events, other the SG(s) to 1/2 SAFW trains transients, SGTR, remove decay heat operable small-small and other residual LOCAs and small heat. Mitigate the OR LOCAs, one of consequences of three AFW, or one accidents that 2/2 MDAFW of two SAFW could result in trains operable pumps provide TDAFW pump and overpressurization sufficient feed associated discharge of the reactor OR flow. Determined One TDAFW valves and steam coolant pressure by thermal-train flowpath supply valves are boundary or 2/2 SAFW trains hydraulic analysis.

3.7.5.A inoperable modeled. Yes containment operable Explicitly modeled.

E1-25

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Following an ATWS up to all 3 AFW pumps may be required based on Pressure transient and available RCS relief capability per WCAP-15831-P

[6]

2/2 TDAFW flow For loss of MFW paths operable events, other Supply water to transients, SGTR, the SG(s) to OR small-small remove decay heat LOCAs and small and other residual 1/2 MDAFW LOCAs, one of heat. Mitigate the trains operable three AFW, or one consequences of AND of two SAFW accidents that 1/2 SAFW trains pumps provide could result in operable sufficient feed overpressurization flow.

Preferred MDAFW of the reactor OR One MDAFW AFW pumps and coolant pressure Following an train associated discharge boundary or 2/2 SAFW trains ATWS up to all 3 3.7.5.B inoperable. valves are modeled. Yes containment operable AFW pumps may Explicitly modeled E1-26

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments be required based on Pressure transient and available RCS relief capability.

E1-27

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments 1/2 TDAFW flow paths operable AND 1/2 MDAFW trains operable OR------------------

1/2 TDAFW flow For loss of MFW paths operable events, other AND transients, SGTR, 1/2 SAFW trains small-small operable LOCAs and small One TDAFW OR------------------ LOCAs, one of train flowpath -- three AFW, or one inoperable OR Supply water to 1/2 MDAFW of two SAFW Two MDAFW the SG(s) to trains operable pumps provide trains remove decay heat AND sufficient feed inoperable OR and other residual 1/2 SAFW trains flow.

One TDAFW heat. Mitigate the operable train flowpath consequences of OR------------------ Following an and one accidents that -- ATWS up to all 3 MDAFW train could result in 2/2 MDAFW AFW pumps may inoperable to overpressurization trains operable be required based opposite Preferred AFW of the reactor OR------------------ on Pressure steam pumps and coolant pressure -- transient and generators associated discharge boundary or 2/2 SAFW trains available RCS 3.7.5.C (SGs). valves are modeled. Yes containment operable relief capability. Explicitly modeled E1-28

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments 1/2 TDAFW flow paths operable AND 1/2 MDAFW trains operable OR For loss of MFW events, other 1/2 TDAFW flow transients, SGTR, paths operable small-small AND LOCAs and small 1/2 SAFW trains LOCAs, one of operable three AFW, or one Supply water to of two SAFW the SG(s) to OR pumps provide remove decay heat sufficient feed and other residual 1/2 MDAFW flow.

Preferred AFW heat. Mitigate the trains operable pumps and consequences of AND Following an associated discharge accidents that 1/2 SAFW trains ATWS up to all 3 valves are modeled. could result in operable AFW pumps may Preferred MDAFW overpressurization be required based All AFW trains pump crossties of the reactor OR on Pressure to one or more [4000A and 4000B] coolant pressure transient and SGs are not credited in boundary or 2/2 SAFW trains available RCS 3.7.5.D inoperable. the PRA. Yes containment operable relief capability. Explicitly modeled E1-29

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Standby Auxiliary Feedwater pumps and associated 1/2 TDAFW flow discharge valves. paths operable Includes the AND inoperability of one of 1/2 MDAFW the two SAFW cross- trains operable tie valves which requires declaring OR the associated SAFW train Supply water to 1/2 TDAFW flow inoperable (e.g., the SG(s) to paths operable failure of 9703B, remove decay heat AND would result in and other residual 1/2 SAFW trains declaring SAFW train heat. Mitigate the operable D inoperable). consequences of However, the accidents that OR inoperability of either could result in flow path overpressurization 1/2 MDAFW 1/2 Standby AFW downstream of the of the reactor trains operable pumps to either One SAFW SAFW cross-tie is coolant pressure AND SG required for train addressed by boundary or 1/2 SAFW trains decay heat 3.7.5.E inoperable. condition F Yes containment operable removal. Explicitly modeled E1-30

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments 1/2 TDAFW flow paths operable Supply water to AND Standby Auxiliary the SG(s) to 1/2 MDAFW Feedwater pumps remove decay heat trains operable and associated and other residual discharge valves. heat. Mitigate the OR Includes the consequences of inoperability of both accidents that 2/2 TDAFW flow of the SAFW cross- could result in paths operable tie valves (9703A overpressurization 1/2 Standby AFW and 9703B), or either of the reactor OR pumps to either Both SAFW flowpath downstream coolant pressure SG required for trains of the SAFW cross- boundary or 2/2 MDAFW decay heat 3.7.5.F inoperable. tie Yes containment trains operable removal Explicitly modeled Removal of decay heat from the CCW pumps, Heat reactor via the One CCW Exchangers, and Residual Heat train associated discharge Removal (RHR) 1/2 CCW trains 3.7.7.A inoperable. valves. Yes System operable Same as Design Explicitly modeled E1-31

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Provide reactor core cooling during 1/4 SW pumps the recirculation required phase following a coincident with Service Water LOCA or loss of non-essential SW Pumps and containment isolation. 2/4 SW One SW pump associated discharge integrity following a 2/4 SW pumps pumps without 3.7.8.A inoperable. valves Yes SLB. operable isolation. Explicitly modeled Provide reactor core cooling during 1/4 SW pumps the recirculation required phase following a coincident with Service Water LOCA or loss of non-essential SW Two SW Pumps and containment isolation. 2/4 SW pumps associated discharge integrity following a 2/4 SW pumps pumps without 3.7.8.B inoperable. valves Yes SLB. operable isolation. Explicitly modeled E1-32

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments One qualified independent offsite power circuit connected between the offsite transmission network and the onsite 480 V safeguards buses for each train ensure availability Explicitly modeled.

Offsite power Station of the required Offsite Power can also Auxiliary power to shut be provided during an Offsite power Transformers 12A, down the reactor 1/2 offsite power emergency through the to one or more 12B, as well as and maintain it in a circuits required plant auxiliary 480 V associated breakers. safe shutdown to provide power transformer 11.

safeguards BUS16,17,18, and condition after an to onsite 480 V However this is not bus(es) 14 transformers and AOO or a safeguards credited in the plant 3.8.1.A inoperable. associated breakers. Yes postulated DBA. buses Same as Design PRA.

E1-33

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments EDGs for each train ensure 1/2 EDGs availability of the required to required power to ensure shut down the availability of the reactor and required power maintain it in a to shut down the safe shutdown reactor and condition after an maintain it in a One DG Emergency Diesel AOO or a safe shutdown 3.8.1.B inoperable. Generators Yes postulated DBA. condition Same as Design Explicitly modeled E1-34

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments One qualified independent offsite power circuit connected between the offsite transmission network and the onsite 480 V safeguards buses and separate and independent DGs 1/2 trains 480V Offsite power Station for each train AC power Auxiliary ensure availability required to Offsite power Transformers 12A, of the required ensure to one or more 12B, as well as power to shut availability of the 480 V associated breakers. down the reactor required power safeguards BUS16,17,18, and and maintain it in a to shut down the bus(es) 14 transformers and safe shutdown reactor and inoperable. associated breakers. condition after an maintain it in a AND One DG EDG1A and EDG1B AOO or a safe shutdown 3.8.1.C inoperable. are also in scope. Yes postulated DBA. condition Same as Design Explicitly modeled E1-35

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments Ensure the availability of the 1/2 DC power An OPERABLE DC required power to sources to electrical power shut down the distribution source requires the reactor and panels is One DC battery and at least maintain it in a required to shut electrical one battery charger safe condition after down the reactor power source connected to the DC an AOO or a and maintain it in 3.8.4.A inoperable. BUS. Yes postulated DBA. a safe condition Same as Design Explicitly modeled The AC instrument bus sources ensure the availability of 120 VAC electrical power for the Instrument instrumentation for Buses A and C systems required can be supplied to shut down the power either reactor and from inverters, a Instrument Bus maintain it in a non-Class 1E success criteria is safe condition after CVT evaluated at the an anticipated (maintenance system level as operational CVT) powered equipment Instrument Bus occurrence (AOO) from offsite dependency and One inverter Inverters INVTA and or a postulated power, or a is configuration 3.8.7.A inoperable. INVTB Yes DBA. Class 1E CVT. specific Explicitly modeled.

E1-36

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments The AC instrument bus sources ensure the availability of 120 VAC electrical power for the instrumentation for systems required Instrument Bus B to shut down the can be supplied reactor and power from Instrument Bus maintain it in a either a Class 1E success criteria is safe condition after CVT or a non- evaluated at the Class 1E CVT an anticipated Class 1E CVT system level as for AC operational (maintenance equipment Instrument occurrence (AOO) CVT) powered dependencies and Bus B or a postulated from offsite is configuration 3.8.7.B inoperable. CVTA1 Yes DBA. power. specific. Explicitly modeled.

1/2 AC electrical power One AC distribution trains electrical is required to power provide power to distribution 480V AC Power Provide power to ESF systems to train components in TSB ESF systems to meet design 3.8.9.A inoperable. Table B 3.8.9-1 Yes meet design limits limits Same as Design Explicitly modeled.

E1-37

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function Tech Spec TS Condition SSCs Covered by Modeled Required by TS Design Success PRA Success (TS) Description TS LCO Condition in PRA LCO Condition Criteria Criteria Comments 1/2 AC instrument bus Instrument Bus One AC electrical power success criteria is instrument bus distribution trains evaluated at the electrical is required to system level as power provide power to equipment distribution 120V AC IB Power Provide power to ESF systems to dependencies and train components in TSB ESF systems to meet design is configuration 3.8.9.B inoperable. Table B 3.8.9-1 Yes meet design limits limits specific. Explicitly modeled.

1/2 DC electrical power One DC distribution trains electrical is required to power provide power to distribution 125V DC Power Provide power to ESF systems to train components in TSB ESF systems to meet design 3.8.9.C inoperable. Table B 3.8.9-1 Yes meet design limits limits Same as Design Explicitly modeled.

E1-38

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Examples of calculated RICT are provided in Table E1-2 for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable).

Table E1-2: RICT Estimates RICT Estimate(1)

Tech Spec LCO Condition (Days)

The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

3.3.1.B (1) Manual Reactor Trip 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

(2) Power Range Neutron Flux (a) High (b) Low.

(5) Overtemperature Delta T.

(6) Overpower Delta T.

(7b) Pressurizer Pressure High.

(8) Pressurizer Water Level-High.

3.3.1.D (13) Steam Generator Water Level-Low Low 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

(7a) Pressurizer Pressure Low.

(9b) Reactor Coolant Flow-Low (Two Loops).

(10b) RCP Breaker Position (Two Loops).

(11) Undervoltage- BUS11A and BUS11B.

3.3.1.K (12) Underfrequency- BUS11A and BUS11B 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

3.3.1.M (9a) Reactor Coolant Flow-Low (Single Loop) 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

3.3.1.N (10a) RCP Breaker Position (Single Loop) 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

(14) Turbine Trip (a) Low Autostop Oil Pressure and (b) 3.3.1.P Turbine Stop Valve Closure 30.0 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

(15) Safety Injection Input from Engineered Safety Feature Actuation System and 3.3.1.R2 (19) Automatic Trip Logic 0.5 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

3.3.1.T (17) Reactor Trip Breakers 30.0 E1-39

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-2: RICT Estimates RICT Estimate(1)

Tech Spec LCO Condition (Days)

The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

(18) Reactor Trip Breaker Undervoltage and Shunt Trip 3.3.1.U Mechanisms 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

(6f) Auxiliary Feedwater-Trip of Both Main Feedwater Pumps 3.3.2.B (Motor driven pumps only) 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

(4a) Steam Line Isolation (Manual Initiation).

(6e) AFW Undervoltage BUS11A and 11B (Turbine driven 3.3.2.D pump only) 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

(4b) Steam Line Isolation Automatic Actuation Logic and Actuation Relays.

(5a) Feedwater Isolation; Automatic Actuation Logic and Actuation Relays.

3.3.2.E (6b) AFW Automatic Actuation Logic and Actuation Relays. 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

Steam Line Isolation; (4c) Containment Pressure-High High, (4d) High Steam Flow, (4e) High-High Steam Flow.

Feedwater Isolation; (5b) SG Water Level-High.

AFW; 3.3.2.F (6c) SG Water Level-Low Low 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

Safety Injection; (1a) Manual Initiation Containment Spray; (2a) Manual Initiation 3.3.2.H2 Containment Isolation; (3a) Manual Initiation 0.4 E1-40

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-2: RICT Estimates RICT Estimate(1)

Tech Spec LCO Condition (Days)

The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

Safety Injection; (1b) Automatic Actuation Logic and Actuation Relays Containment Spray; (2b) Automatic Actuation Logic and Actuation Relays Containment Isolation; (3b) Automatic Actuation Logic and 3.3.2.I2 Actuation Relays 0.4 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

Safety Injection; (1c) Containment Pressure High Containment Spray; 3.3.2.J (2c) Containment Pressure High High 30.0 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

Safety Injection; (1d) Pressurizer Pressure Low 3.3.2.L (1e) Steam Line Pressure Low 30.0 3.3.4.A One or more 480 V bus(es) with one channel inoperable. 30.0 3.3.5.A One radiation monitoring channel inoperable. 30.0 3.4.11.B One PORV inoperable. 30.0 3.4.11.C One block valve inoperable. 30.0 3.4.11.D Both block valves inoperable 30.0 One accumulator inoperable due to boron concentration not 3.5.1.A within limits. 30.0 3.5.1.B One accumulator inoperable for reasons other than Condition A 30.0 One train inoperable AND at least 100% of the ECCS flow 3.5.2.A equivalent to a single operable ECCS train available 30.0 One or more containment air locks inoperable for reasons other 3.6.2.C3 than Condition A or B 8.7 One or more penetration flow paths with one containment isolation boundary inoperable except for mini-purge valve 3.6.3.A leakage not within limit. 28.3 One or more penetration flow paths with one containment 3.6.3.C isolation boundary inoperable. 28.3 One or more mini-purge penetration flow paths with two valves 3.6.3.E,3 not within leakage limits. 8.3 3.6.6.A One CS train Inoperable 30.0 3.6.6.D One or two CRFC units Inoperable 30.0 3.7.1.A One or more MSSVs Inoperable 30.0 E1-41

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-2: RICT Estimates RICT Estimate(1)

Tech Spec LCO Condition (Days)

One or more valves inoperable in flowpath from a steam 3.7.2.A generator (SG) in Mode 1 30.0 3.7.4.A One ARV line Inoperable 30.0 3.7.5.A One TDAFW train Inoperable 30.0 3.7.5.B One MDAFW train Inoperable 30.0 TDAFW train Inoperable OR Two MDAFW trains Inoperable OR One TDAFW train flowpath and one MDAFW train 3.7.5.C Inoperable to opposite steam Generators (SGs). 30.0 3.7.5.D All AFW trains to one or more SGs inoperable 30.0 3.7.5.E One SAFW train Inoperable 30.0 3.7.5.F2,3 Both SAFW trains inoperable 1.4 3.7.7.A One CCW train inoperable 30.0 3.7.8.A One SW pump inoperable. 30.0 3.7.8.B Two SW pumps Inoperable 30.0 Offsite power to one or more 480 V safeguards bus(es) 3.8.1.A inoperable. 30.0 3.8.1.B One DG inoperable 30.0 Offsite power to one or more 480 V safeguards bus(es) 3.8.1.C inoperable. AND One DG inoperable. 10.5 3.8.4.A One DC electrical power source Inoperable 29.8 3.8.7.A One DC electrical power source Inoperable 30.0 3.8.7.B Class 1E CVT for AC Instrument Bus B Inoperable 30.0 3.8.9.A One AC electrical power distribution train inoperable 11.0 One AC instrument bus electrical power distribution train 3.8.9.B inoperable 30.0 3.8.9.C One DC electrical power distribution train inoperable 4.7 Notes to Table E1-2:

1. RICTs are based on the internal events, internal flood, and internal fire PRA model calculations with seismic and high winds CDF and LERF penalties. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A [2]. RICTs are rounded to nearest tenth of a day.

2. Per NEI 06-09-A [2], for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.

3. For these cases, the High Wind penalty is different from the other cases E1-42

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3 lists the TSTF-505 Rev 2 Table 1 Tech Specs that require additional justification along with a description of how the additional justification is provided in the LAR.

Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: The RTS 3.3.1.D 3.3.1.D When one power range instrumentation for each neutron flux-high channel is Function in Table 3.3.1-1 out of service, surveillance shall be tests 3.2.2.2, 3.2.4.1, and OPERABLE. 3.2.4.2 must be performed.

Condition: One Power Range Neutron Flux

- High channel inoperable.

LCO: The RTS 3.3.1.U 3.3.1.T There are two trains of instrumentation for each actuation available.

Function in Table 3.3.1-1 Therefore, loss of one train shall be does not preclude trip OPERABLE. capability for design basis accidents. Also, procedural Condition: One RTB train guidance exists to inoperable. successfully mitigate a loss of automatic reactor trip function by opening local trip breakers at the M-G sets.

PRA modeling:

RTS instrumentation and logic is explicitly modeled in the Ginna PRA. AMSAC is also modeled in the PRA for defense in depth when active (at power levels above 40%).

Given a failure of RTS, AMSAC is credited to mitigate Core Damage for most scenarios with the exception of some LOCAs and secondary line breaks.

E1-43

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: The Containment N/A 3.3.5.A These radiation monitors Ventilation Isolation actuate CVI for mini-purge instrumentation for each valves. As backup to CI Function in Table 3.3.5-1 signal, they are not credited in shall be OPERABLE. accident analysis.

Condition: One radiation monitoring channel inoperable.

LCO: [Three] channels per 3.3.5.B N/A Not Submitted for two or more bus of the loss of channels per bus inoperable.

voltage Function and

[three] channels per bus of the degraded voltage Function shall be OPERABLE.

Condition: One or more Functions with two or more channels per bus inoperable.

LCO: Boron Dilution 3.3.9.A N/A Not Submitted Protection System (BDPS)

Condition: One train inoperable (applicable to MODES [2,] 3, 4, and 5.)

LCO: The pressurizer shall 3.4.9.B N/A Not Submitted be OPERABLE Condition: One [required]

group of pressurizer heaters inoperable.

E1-44

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: Two ECCS N/A 3.5.1.A For a double-ended cold leg accumulators shall be 3.5.1.B LOCA, there is no loss of OPERABLE. function except for the low probability event that the large Condition A: One break LOCA occurred on the accumulator inoperable same leg as the inoperable due to boron concentration accumulator.

not within limits.

Condition B: One accumulator inoperable for reasons other than Condition A.

LCO: Two ECCS trains 3.5.2.A 3.5.2.A Since the Ginna LCO applies shall be only when 1 ECCS train is OPERABLE. inoperable (as opposed to TSTF-505 being applicable Condition: One or more when one or more trains are

[ECCS] trains inoperable), and at least inoperable. 100% of required ECCS flow is available to that train, there is no possibility of a loss of function in this situation.

LCO: [Two] containment 3.6.2.C 3.6.2.C As long as actions C.1 air lock[s] shall be (ensure overall containment OPERABLE. leakage is low) and C.2 (close a door in the affected air lock)

Condition: One or more are successfully containment air locks accomplished, there is no loss inoperable for reasons of function.

other than an inoperable door or inoperable interlock mechanism.

LCO: Each containment N/A 3.6.3.E As long as Action E.1 is isolation boundary shall be successful (overall OPERABLE. containment leakage is low),

there is no loss of function.

Condition: One or more mini-purge penetration flow paths with two valves not within leakage limits.

E1-45

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: Containment Spray 3.6.6.A 3.6.6.A Although the iodine removal and Cooling 3.6.6.D function is not explicitly Systems (Atmospheric and modeled for impact on LERF, Dual) (Credit the impact on containment taken for iodine removal by heat removal is bounding the Containment from a risk perspective.

Spray System)

Condition A: One containment spray train inoperable.

Condition C: One

[required] containment cooling train inoperable.

Condition D: Two

[required] containment cooling trains inoperable.

E1-46

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: Containment Spray 3.6.6.B 3.6.6.A Table 6.2-16 of the UFSAR and Cooling 3.6.6.D lists the assumed number of Systems (Atmospheric and containment fan coolers and Dual (Credit not containment spray pumps taken for iodine removal by assumed in the limiting large the Containment break analysis for Spray System) containment conditions.

These correspond to a Condition A: One minimum of 2 RCFCs (out of containment spray train 4) and 1 containment spray inoperable. pump (out of 2).

Condition B: One

[required] containment PRA Discussion:

cooling train inoperable. At least 1 Containment Spray Condition C: Two (CS) pump [or 1 Containment containment spray trains Recirculation Fan Cooler inoperable. (CRFC)] must be available to Condition D: One ensure containment ultimate containment spray train strength is not exceeded.

and one [required] Bounding pressure and containment cooling train temperatures loads were inoperable. evaluated in this analysis.

Condition E: Two

[required] containment For Level 1 PRA, CS and cooling trains inoperable. CRFCs are modeled to aid in determination of plant damage states for medium and large LOCAs.

For Level 2 PRA, CS and CRFCs are explicitly modeled to prevent failure of containment with consideration of pressure and temperature loads.

Although the iodine removal function is not explicitly modeled for impact on LERF, the impact on containment heat removal is bounding from a risk perspective.

E1-47

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: Containment Spray 3.6.6.C.A N/A Not Submitted System (Ice Condenser)

Condition: One containment spray train inoperable.

LCO: Quench Spray (QS) 3.6.6.D.A N/A Not Submitted System (Subatmospheric)

Condition: One QS train inoperable LCO: Recirculation Spray 3.6.6.E N/A Not Submitted (RS) System (Subatmospheric)

Condition A: One RS subsystem inoperable.

Condition B: Two RS subsystems inoperable in one train.

Condition C: Two inside RS subsystems inoperable Condition D: Two outside RS subsystems inoperable.

Condition E: Casing cooling tank inoperable.

LCO: The ice condenser 3.6.16.A N/A Not Submitted inlet doors, intermediate deck doors, and top deck

[doors] shall be OPERABLE and closed.

Condition: One or more ice condenser doors physically restrained from opening E1-48

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: Eight MSSVs shall N/A 3.7.1.A Analysis has demonstrated be OPERABLE. that the requires valve combinations needed to Condition: One or more mitigate a Design Basis MSSVs inoperable. Accident or an ATWS event are 8/8 MSSVs, 7/8 MSSVs and 1/2 ARVs, or 6/8 MSSVs and 1/2 ARVs LCO: [Four] MSIVs shall 3.7.2.A 3.7.2.A In the event of a limiting case be OPERABLE. steam line break inside containment, if one MSIV is Condition: One MSIV inoperable, the combination of inoperable in MODE the closure of the other MSIV

1. as well as the closure of the affected SGs main steamline non-return valve will prevent the blowdown of more than one steam generator.

LCO: [Three] Atmospheric 3.7.4.B N/A Not Submitted Dump Valves (ADV) lines shall be OPERABLE.

Condition: Two or more required ADV lines inoperable LCO: Two motor driven N/A 3.7.5.D As long as one of the five AFW (MDAFW) trains, one AFW pumps is available to turbine driven AFW one SG, there is no loss of (TDAFW) train, and two function except for the low standby AFW (SAFW) probability event of a FLB on trains shall be that SG.

OPERABLE.

3.7.5.F No loss of function except for Condition D: All AFW the concurrent low probability trains to one or more SGs event of a steam or FW line inoperable. break in the Intermediate Building.

Condition F: Both SAFW trains inoperable.

E1-49

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Technical Specifications (TS) that Require Additional Justification TSTF-505 Description TSTF-505 TS Ginna TS Additional Justification LCO: The following AC 3.8.1.A 3.8.1.A The redundant offsite power electrical sources shall be circuit, or the capability to OPERABLE. backfeed through the main transformer using a flexible Condition: Offsite power connection that can be tied to one or more 480 V into the plant auxiliary safeguards bus(es) transformer 11, are available inoperable. to supply required loads LCO: The following AC N/A 3.8.7.B The use of the CVTs is below instrument bus power the level of detail in TSTF-sources shall be 505. However, because there OPERABLE. exists a non-Class 1E CVT to power Instrument Bus B, Condition: Class 1E CVT there is no loss of function for AC Instrument Bus B inoperable.

E1-50

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Modeling of Instrumentation and Control This section addresses how I&C is modeled in the Ginna PRA Explicit PRA modeling The Ginna PRA explicitly models most ESFAS and Reactor trip signals (at the component and relay level) to reflect design logic of the systems. For example, if 2/3 design logic is required for LCO 3.3.1.D function 7b to initiate a reactor trip per design, then the fault tree logic also requires 2/3 inputs.

Figure E1 Explicit PRA modeling of Design Logic E1-51

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Surrogate PRA Modeling In specific cases where components are not explicitly modeled but the function is modeled, then surrogates may be chosen to represent equivalent or conservative logic of these system functions. Many ESFAS and RTS LCO functions are modeled as a Surrogate basic events.

For example, basic event TS3.3.2.I(1AB)X is modeled in the fault tree as Channel A of SI automatic actuation logic and relays inoperable (LCO 3.3.2, Condition I function 1b) which is logically equivalent to failure of one channel of the LCO function (SI-A1).

Figure E1 Surrogate PRA modeling of Design Logic E1-52

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1-4 provides the scope of I&C components that are modeled for each TS LCO, the level of detail that the model supports, and a discussion of Digital PRA modeling as it pertains to the LCO. This table is not intended to document final mapping for each function. Final mapping will be chosen during implementation phase of the program.

Technical Specification section 3.3 is for Instrumentation. These include:

LCO 3.3.1 - The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

LCO 3.3.2 - The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

LCO 3.3.4 - Each 480 V safeguards bus shall have two OPERABLE channels of LOP DG Start Instrumentation.

Notes on Digital equipment:

1. All PRA items mapped to LCO 3.3.1 for RTS are analog.

2. All PRA items mapped to LCO 3.3.2 for ESFAS are analog. No digital ESFAS equipment are credited. All the computation modules listed in table E1-4 are NUS DAM503 bistables, which are analog modules. The transmitters are N-E11 (Foxboro or now Weed Ultra) transmitters, which are analog. The relays are also analog.

3. ALL PRA items mapped to LCO 3.3.4 are relays which are analog Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion As required by The PRA explicitly models Manual Reactor Required Action A.1 operator failure to recover Pushbuttons PB/IW and No Digital equipment and referenced by a failed RTS using push PB/RAU are explicitly credited for RICT Table 3.3.1-1. buttons on the main control modeled in the fault tree mapping of this 3.3.1.B (1) Manual Reactor Trip board as basic events function E1-53

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Power Range Channels/Detectors N-41A, N41B, N-42A, The RTS N42B, N-43A, N43B, N-instrumentation for Neutron Flux-High and 44A, N44B and No Digital equipment each Function in Low trip functions explicitly corresponding NE-4* are credited for RICT Table 3.3.1-1 shall (2) Power Range Neutron are modeled using Power modeled as basic events mapping of this 3.3.1.D be OPERABLE. Flux (a) High (b) Low. Range channels/detectors that reflect RTS logic. function Temperature indicators and computation modules TI-405A, TI-406A, TI-407A, T*-408A,, TC-The RTS Overtemperature Delta T. 405C/D, TC-406C/D, TC-instrumentation for trip function is explicitly 407C/D, and TC-408C/D No Digital equipment each Function in modeled via Temperature are modeled as basic credited for RICT Table 3.3.1-1 shall elements and computation events that reflect RTS mapping of this 3.3.1.D be OPERABLE. (5) Overtemperature Delta T. modules logic. function Temperature indicators and computation modules TC-405A/B, TC-406A/B, The RTS TC-407A/B, TC-408A/B, instrumentation for Overpower Delta T. trip TI-405C, TI-406C, TI- No Digital equipment each Function in function explicitly modeled 407C, and TI-408C are- credited for RICT Table 3.3.1-1 shall via Temperature elements modeled as basic events mapping of this 3.3.1.D be OPERABLE. (6) Overpower Delta T. and computation modules that reflect RTS logic. function E1-54

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Pressure transmitters and computation modules PT-The RTS Pressurizer pressure-high 429, PT-430, PT431, PC-instrumentation for trip function is explicitly 429A, PC-430A, and PC- No Digital equipment each Function in modeled via pressure 431A are modeled as credited for RICT Table 3.3.1-1 shall (7b) Pressurizer pressure- transmitters and basic events that reflect mapping of this 3.3.1.D be OPERABLE. high. computation modules RTS logic. function The RTS instrumentation for Pressurizer water level- Level transmitters LT-426, No Digital equipment each Function in high function is explicitly LT-427, and LT-428 are credited for RICT Table 3.3.1-1 shall (8) Pressurizer water level- modeled via level modeled as basic events mapping of this 3.3.1.D be OPERABLE. high transmitters that reflect RTS logic. function Level transmitters LT-461, LT-462, LT-463, LT-471, LT-472, LT-473*, LC-The RTS SG water level-low low 461A/B, LC-46 and instrumentation for function is explicitly associated computation No Digital equipment each Function in modeled via level modules LC-4* modeled credited for RICT Table 3.3.1-1 shall transmitters and as basic events that reflect mapping of this 3.3.1.D be OPERABLE. (13) SG water level-low low computation modules RTS logic. function Pressure transmitters PT-The RTS Pressurizer Pressure-Low 429, PT-430, PT-431, PT-instrumentation for function is explicitly 449 and related No Digital equipment each Function in modeled via pressure computation modules are credited for RICT Table 3.3.1-1 shall (7a) Pressurizer Pressure- transmitters and modeled as basic events mapping of this 3.3.1.K be OPERABLE. Low computation modules that reflect RTS logic. function E1-55

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Flow transmitters FT-411 The RTS RX coolant flow-Low (Two through FT-416 and instrumentation for Loops) function is explicitly associated computation No Digital equipment each Function in modeled via flow modules are modeled as credited for RICT Table 3.3.1-1 shall (9b) RX coolant flow-Low transmitters and basic events that reflect mapping of this 3.3.1.K be OPERABLE. (Two Loops) computation modules RTS logic. function The RTS Reactor trip breakers instrumentation for RCP breaker position (Two 52/RCP1A and 52/RCP1B No Digital equipment each Function in Loops) function is explicitly are modeled as basic credited for RICT Table 3.3.1-1 shall (10b) RCP breaker position modeled via Reactor trip events that reflect RTS mapping of this 3.3.1.K be OPERABLE. (Two Loops) breakers logic. function The relays explicitly modeled for this function include:

27X3/11A 27X4/11A 27X3/11B UV BUS11A and BUS11B 27X4/11B function is explicitly That reflect RTS logic.

modeled via some UV The RTS relays. Other UV relays The other relays will instrumentation for will require surrogate require surrogate mapping No Digital equipment each Function in mapping to represent one to those noted above to credited for RICT Table 3.3.1-1 shall (11) UV BUS11A and channel of the RX trip represent one channel of mapping of this 3.3.1.K be OPERABLE. BUS11B function. the RX trip function. function E1-56

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion The relays explicitly modeled for this function include:

The RTS 81X1/11A instrumentation for Under Frequency BUS11A 81X2/11A No Digital equipment each Function in and BUS11B function is 81X1/11B credited for RICT Table 3.3.1-1 shall (12) Under Frequency explicitly modeled via 81X2/11B mapping of this 3.3.1.K be OPERABLE. BUS11A and BUS11B relays That reflect RTS logic function Flow transmitters FT-411 The RTS through FT-416 and instrumentation for RX coolant flow-Low associated computation No Digital equipment each Function in (Single Loop) function is modules are modeled as credited for RICT Table 3.3.1-1 shall (9a) RX coolant flow-Low explicitly modeled via flow basic events that reflect mapping of this 3.3.1.M be OPERABLE. (Single Loop) transmitters RTS logic. function The RTS Reactor trip breakers instrumentation for RCP breaker position 52/RCP1A and 52/RCP1B No Digital equipment each Function in (Single Loop) function is are modeled as basic credited for RICT Table 3.3.1-1 shall (10a) RCP breaker position explicitly modeled via events that reflect RTS mapping of this 3.3.1.N be OPERABLE. (Single Loop) Reactor trip breakers logic. function Pressure switches PS-2019, PS-2020, and PS-2026 are modeled as basic events that reflect (a) Turbine Trip on Low RTS logic. In addition, The RTS Autostop Oil Pressure and fault tree gate G4439 instrumentation for (b) Turbine Stop Valve Failure of RTS Function No Digital equipment each Function in (14)(a) Turbine Trip on Low Closure functions are 14b can be used to derive credited for RICT Table 3.3.1-1 shall Autostop Oil Pressure and (b) explicitly modeled via any surrogate events to mapping of this 3.3.1.P be OPERABLE. Turbine Stop Valve Closure pressure switches represent the function. function E1-57

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Safety injection relays including:

SIA-1 SIA-2 SIAM1-X-A SIAM1-X-B SIAM2-X-A The RTS Safety Injection Input from SIAM2-X-B instrumentation for (15) Safety Injection Input Engineered Safety Feature And Y counterparts No Digital equipment each Function in from Engineered Safety Actuation System (ESFAS) are modeled as basic credited for RICT Table 3.3.1-1 shall Feature Actuation System function is explicitly events that reflect RTS mapping of this 3.3.1.R be OPERABLE. (ESFAS) modeled via SI relays logic. function A modeled surrogate basic event TLCCFEATWS CCF - Electrical Scram Failure Probability (Signal The RTS Only) instrumentation for is one option that can be No Digital equipment each Function in Modeled at the function used to represent a failure credited for RICT Table 3.3.1-1 shall level rather than individual of automatic scram mapping of this 3.3.1.R be OPERABLE. (19) Automatic Trip Logic components functionality function Both RX trip breakers and bypass breakers are The RTS modeled for RX trip.

instrumentation for 52/RTA No Digital equipment each Function in Reactor Trip Breakers 52/BYA credited for RICT Table 3.3.1-1 shall function is explicitly 52/RTB mapping of this 3.3.1.T be OPERABLE. (17) Reactor Trip Breakers modeled via breakers 52/BYB function E1-58

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion The RTS Reactor Trip Breaker Relays are modeled to instrumentation for Undervoltage and Shunt reflect RTS logic including: No Digital equipment each Function in (18) Reactor Trip Breaker Trip Mechanisms function RT-1-A through RT-12-A credited for RICT Table 3.3.1-1 shall Undervoltage and Shunt Trip is explicitly modeled via as well as mapping of this 3.3.1.U be OPERABLE. Mechanisms relays RT-1-B through RT-12-B function Main Feedwater pump breakers 52/FWP1A and B 52S1/FWP1A and B are modeled as basic events as input to ESFAS logic for function (6f) but may require a fault tree change or the use of the surrogate noted below.

A modeled surrogate basic event TS3.3.2.B(6F)X can be used to represent the loss of EITHER channel for automatic AFW start. This event is only applied to the Auxiliary Feedwater-Trip of MFPX1A1 function. This Both Main Feedwater is representative of risk for As required by Pumps function is explicitly either train function (6f) No Digital equipment Required Action A.1 (6f) Auxiliary Feedwater-Trip modeled via Feedwater due to four levels of credited for RICT and referenced by of Both Main Feedwater pump breakers and a redundancy available to mapping of this 3.3.2.B Table 3.3.2-1. Pumps Surrogate is available start the MDAFW pumps function E1-59

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Operator actions are explicitly modeled for failure to close MSIVs.

These actions or Steamline Isolation equivalent logic can be (manual initiation) function used as a surrogate to can be represented in the represent failure of As required by PRA via surrogate to function 4a. Alternately, a No Digital equipment Required Action A.1 conservatively assume surrogate can be used to credited for RICT and referenced by (4a) Steamline Isolation complete loss of manual fail the automatic function mapping of this 3.3.2.D Table 3.3.2-1. (manual initiation) steam line initiation of steamline isolation. function Undervoltage relays are explicitly modeled to sense a UV condition:

27X1/11A 27X2/11A 27X1/11B 27X2/11B In addition, there is a modeled surrogate AFW Undervoltage TS3.3.2.D(6E)X that may BUS11A and 11B is be used for the TS As required by explicitly modeled via UV condition to sense an UV No Digital equipment Required Action A.1 relays for this function or a condition and to open credited for RICT and referenced by (6e) AFW Undervoltage surrogate is available. TDAFW Steam admission mapping of this 3.3.2.D Table 3.3.2-1. BUS11A and 11B valves. function E1-60

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion SI/Steamline isolation relays are explicitly modeled:

MS-1 MS-2 MS-3 MS-4 Steam line isolation In addition, there are Automatic actuation logic modeled surrogate events and actuation relays are TS3.3.2.E(4BA)X As required by explicitly modeled via TS3.3.2.E(4BB)X No Digital equipment Required Action A.1 (4b) Steam line isolation relays for this function or a that may be used for the credited for RICT and referenced by Automatic actuation logic and surrogate is available. TS condition to close mapping of this 3.3.2.E Table 3.3.2-1. actuation relays. MSIVs function E1-61

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Manual initiation Main Feedwater relays are explicitly modeled for MFW isolation:

F10X F20X F30X F40X In addition, there is a Feedwater isolation; modeled surrogate event Automatic actuation logic TS3.3.2.E(5AA)X As required by and actuation relays are that may be used to No Digital equipment Required Action A.1 (5a) Feedwater isolation; explicitly modeled via represent channel A of credited for RICT and referenced by Automatic actuation logic and relays for this function or a MFW isolation automatic mapping of this 3.3.2.E Table 3.3.2-1. actuation relays. surrogate is available. actuation logic inoperable. function E1-62

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion AFW start logic relays are explicitly modeled for this function:

MFPX-1A1 MFPX-1A2 MFPX-1B1 MFPX-1B2 2/MAFP1A 2/MAFP1B In addition, there are modeled surrogate events TS3.3.2.E(6BA)X AFW Automatic actuation TS3.3.2.E(6BB)X As required by logic and actuation relays that may be used to No Digital equipment Required Action A.1 (6b) AFW Automatic are explicitly modeled via represent Channel A (or credited for RICT and referenced by actuation logic and actuation relays for this function or a B) of AFW automatic mapping of this 3.3.2.E Table 3.3.2-1. relays. surrogate is available. actuation logic inoperable. function E1-63

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Pressure transmitters and computation modules are explicitly modeled for this function:

PT-946 PT-948 PT-950 PC-946A/B PC-948A/B PC-950A/B In addition, there is a Containment Pressure- modeled surrogate event High High pressure TS3.3.2.F(4C)X that may transmitters and be used to represent one As required by computation modules are channel of Containment No Digital equipment Required Action A.1 explicitly modeled for this Pressure - High High for credited for RICT and referenced by (4c) Containment Pressure- function or a surrogate is Main Steam Isolation mapping of this 3.3.2.F Table 3.3.2-1. High High available. inoperable. function E1-64

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Flow transmitters and computation modules are explicitly modeled for this function:

FT-464 FT-465 FT-474 FT-475 TC-401A/D TC-402A FC-464A FC-465A FC-474A FC-475A In addition, there is a modeled surrogate event TS3.3.2.F(4D1)X High Steam Flow TS3.3.2.F(4D2)X transmitters and that may be used to As required by computation modules are represent one channel of No Digital equipment Required Action A.1 explicitly modeled for this Main Steam Isolation on credited for RICT and referenced by function or a surrogate is High Steam Flow for mapping of this 3.3.2.F Table 3.3.2-1. (4d) High Steam Flow available. Function 4.d function E1-65

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Flow transmitters and computation modules are explicitly modeled for this function:

FT-464 FT-465 FT-474 FT-475 FC-464A FC-465A FC-474A FC-475A In addition, there is a modeled surrogate event TS3.3.2.F(4E1)X High-High steam flow TS3.3.2.F(4E2)X transmitters and that may be used to As required by computation modules are represent one channel of No Digital equipment Required Action A.1 explicitly modeled for this High-High Steam Flow credited for RICT and referenced by function or a surrogate is inoperable - SG A (LCO mapping of this 3.3.2.F Table 3.3.2-1. (4e) High-High steam flow. available. 3.3.2, Condition F, 4e function E1-66

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Level transmitters and computation modules are explicitly modeled for this function:

LT-461 LT-462 LT-463 LT-471 LT-472 LT-473 LC-461A/B LC-462A/B LC-463C/D LC-471A/B LC-472A/B LC-473C/D In addition, there is a modeled surrogate event High-High steam flow TS3.3.2.F(6C1)X transmitters and TS3.3.2.F(6C2)X As required by computation modules are No Digital equipment Required Action A.1 explicitly modeled for this that may be used to credited for RICT and referenced by (5b) SG water level-High. function or a surrogate is represent one channel of mapping of this 3.3.2.F Table 3.3.2-1. (6c) SG water level-low low available. SG water level-low low function E1-67

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Function (1a) represents manual actuation of ESFAS via two pushbuttons. This is not explicitly modeled, thus surrogates are required.

One option for surrogates for (1a) can be to conservatively fail the SI auxiliary relays (see 3.3.2.I function 1b) that are explicitly modeled for the automatic ESFAS response. The few pumps such as SI pump A that are not explicitly modeled for ESFAS autostart can be represented via a surrogate to fail the pump.

The following operator actions or similar logic can be used to represent failure of functions (2a) and (3a):

Safety Injection; Functions (1a) (2a) and (2a) CSHFDRECIRC -

(1a) Manual Initiation (3a) for manual Initiation Operators fail to align are not explicitly modeled containment spray for Containment Spray; via components. However, recirculation.

As required by (2a) Manual Initiation these functions can be (3a) CTHFD-CNT-I-AT3 - No Digital equipment Required Action A.1 represented by surrogate Operations fails to Isolate credited for RICT and referenced by Containment Isolation; relays and operator CTMT Ventilation per mapping of this 3.3.2.H Table 3.3.2-1. (3a) Manual Initiation actions. ATT-3 function E1-68

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Function (1b) represents automatic actuation of ESFAS. This is explicitly modeled via SI auxiliary relays:

SI-10X SI-11X SI-12X SI-15X SI-16X SI-17X SI-18X SI-20X SI-21X SI-22X SI-26X SI-27X SI-28X A few pumps such as SI Function (1b) SI auto pump A that are not As required by actuation logic and explicitly modeled for No Digital equipment Required Action A.1 actuation relays are ESFAS autostart can be credited for RICT and referenced by (1b) SI Automatic actuation explicitly modeled via accounted for via a mapping of this 3.3.2.I Table 3.3.2-1. logic and actuation relays components. surrogate to fail the pump function E1-69

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion As required by CS Automatic actuation CS Automatic actuation No Digital equipment Required Action A.1 logic and actuation relays logic and actuation relays credited for RICT and referenced by (2b) CS Automatic actuation are explicitly modeled via are explicitly modeled vis mapping of this 3.3.2.I Table 3.3.2-1. logic and actuation relays components. SI relay SI-10X function Containment Isolation Relays are modeled to reflect plant design for only a few valves.

C1 C2 Therefore, mapping may require surrogates to CI Automatic actuation represent failure of the logic and actuation relays train/function, which can are explicitly modeled for be represented as the As required by some valves. In addition a following modeled basic No Digital equipment Required Action A.1 surrogate is modeled per events: credited for RICT and referenced by (3b) CI Automatic actuation train can be used to TS3.3.2.I(3BA)X mapping of this 3.3.2.I Table 3.3.2-1. logic and actuation relays represent (3b) TS3.3.2.I(3BB)X function E1-70

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions (1c) Containment Pressure High modeled surrogate is TS3.3.2.J(1C)X (2c) Containment Pressure High High modeled surrogates are TS3.3.2.J(2C1)X TS3.3.2.J(2C2)X Safety Injection; In addition, components (1c) Containment Pressure are explicitly modeled to High is represented in the represent function (2c):

PRA with a surrogate to PT-946 represent a single channel PT-948 for RTS. There are also PT-950 some explicitly modeled PC-946A/B components for this PC-948A/B function. PC-950A/B Containment Spray; Explicitly modeled (2c) is modeled explicitly components that apply for Safety Injection; for this function via both (1c) and (2c) include:

(1c) Containment Pressure transmitters and PT-945 High computation modules. In PT-947 As required by addition, there are PT-949 No Digital equipment Required Action A.1 Containment Spray; surrogate events available PC-945A/B credited for RICT and referenced by (2c) Containment Pressure to represent the LCO. PC-947A/B mapping of this 3.3.2.J Table 3.3.2-1. High High PC-949A/B function As required by (1d) Pressurizer Pressure Pressurizer Pressure Low Pressure transmitters and No Digital equipment 3.3.2.L Required Action A.1 Low transmitters and computation modules are credited for RICT E1-71

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion and referenced by computation modules are explicitly modeled for this mapping of this Table 3.3.2-1. explicitly modeled for this function: function function. A surrogate is PT-429 also available to represent PT-430 this function. PT-431 PC-429D/C PC-430E/F PC-431I/G The following modeled surrogate is also available to represent this function:

TS3.3.2.L(1D)X E1-72

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion Pressure transmitters and computation modules are explicitly modeled for this function:

PT-468 PT-469 PT-482 PT-478 PT-479 PT-483 PC-468A PC-469A PC-482A PC-478A/B PC-479A PC-483A Steam line Pressure Low transmitters and The following modeled computation modules are surrogates are also As required by explicitly modeled for this available to represent this No Digital equipment Required Action A.1 function. A surrogate is function: credited for RICT and referenced by also available to represent TS3.3.2.L(1EA)X mapping of this 3.3.2.L Table 3.3.2-1. (1e) Steam line pressure low this function. TS3.3.2.L(1EB)X function E1-73

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions Table E1 PRA modeling of I&C functions TS TS Condition TS Function Scope of Modeling Model Level of Detail Digital I&C LCO Description Discussion A few example relays of what are explicitly modeled to reflect design logic for EDG loading on Trip of the normal feed BUS14 include:

breaker from offsite power; 27X1/14 trip of the bus-tie breaker to 27BX1/14 the opposite electrical train (if This function is met via 27D/14 No Digital equipment One or more 480 V closed); shed of all bus loads explicitly modeled Loss of 27D/B/14 credited for RICT bus(es) with one except CS, CCW, MCCs; and voltage 27X and degraded 27/14 mapping of this 3.3.4.A channel inoperable. start EDGs voltage 27D relays 27B/14 function E1-74

License Amendment Request Enclosure 1 Adopt Risk Informed Completion Times TSTF-505 Docket No: 50-244 List of Revised Required Actions to Corresponding PRA Functions

2. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

3. G1-PRA-003, Rev 4, Ginna Nuclear Power Plant Probabilistic Risk Assessment Success Criteria Notebook, December 2020

4. TECHSPEC, Rev 143, Technical Specifications Amendment For RE Ginna Nuclear Power Plant. November 2020

5. TSB, Rev 101, Technical Specification Bases for RE Ginna Nuclear Power Plant, November 2020

6. WCAP-15831-P, WOG Risk-Informed ATWS Assessment and Licensing Implementation Process, Westinghouse, Revision 1, September 2004.

E1-75

ENCLOSURE 2 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Information Supporting Consistency with Regulatory Guide 1.200

1. Introduction This enclosure provides information on the technical adequacy of the Ginna Nuclear Power Plant Probabilistic Risk Assessment (PRA) Internal Events model (including internal flooding) and the GINNA Fire PRA model in support of the license amendment request to revise Technical Specifications to implement NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines [1].

Topical Report NEI 06-09, as clarified by the NRC final safety evaluation of this report [2],

defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool required to implement this risk-informed application.

Meeting these requirements satisfies Regulatory Guide (RG) 1.174 [3] requirements for risk-informed plant-specific changes to a plant's licensing basis.

Exelon employs a multi-faceted approach to establishing and maintaining the technical adequacy and fidelity of PRA models for all operating Exelon nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process and the use of self-assessments and independent peer reviews.

Section 2 of this enclosure describes requirements related to the scope of the Ginna PRA models. Section 3 addresses the technical adequacy of the Internal Events PRA for this application. Section 4 similarly addresses the technical adequacy of the Fire PRA for this application. Section 5 lists references used in the development of this enclosure.

All PRA models described below have been peer reviewed, and the review and closure of F&Os from the peer review have been independently evaluated to confirm that the associated model changes did not constitute a model upgrade. Sections 3 and 4 provide the disposition of all open peer review F&Os that were associated with Supporting Requirements (SRs) assessed as Not Met or Capability Category (CC) I following the closure reviews, including the disposition of the open F&O relative to this application. Note that all open F&Os that represent a gap to meeting CC II, regardless of whether it is categorized as a finding or suggestion, are dispositioned in this application. The resolved F&Os and the basis for resolution are documented in the F&O Closure Review reports [11, 12].

Note on RCP SHEILD modeling: As part of Ginnas NFPA 805 submittal, the NRC reviewed the modeling of the Westinghouse RCP SHIELD. Discussions related to the RCP SHIELD are contained in the Ginna Safety Evaluation for NFPA 805 [13].

2. Requirements Related to Scope of GINNA PRA Models The PRA models discussed in this enclosure have been assessed against RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 [4] consistent with NRC RIS 2007-06 [8].

Both the GINNA Internal Events PRA model (including internal flooding) and the GINNA Fire PRA model are at-power models. The models are capable of quantifying Core Damage Frequency (CDF) and Large Early Release Frequency (LERF).

E2-1

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Information Supporting Consistency with Regulatory Guide 1.200 Note that this portion of the GINNA PRA model does not incorporate the risk impacts of external events. The treatment of seismic risk and other external hazards for this application are discussed in Enclosure 4.

3. Scope and Technical Adequacy of GINNA Internal Events and Internal Flooding PRA Model Topical Report NEI 06-09 [1] requires that the PRA be reviewed to the guidance of RG 1.200 Revision 2 [4] for a PRA which meets Capability Category (CC) II for the Supporting Requirements (SRs) of the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) PRA Standard [5]. It also requires that deviations from these CCs relative to the Risk Informed Completion Time (RICT) Program be justified and documented.

The Ginna Internal Events PRA model was peer reviewed in June 2009 using the NEI 05-04 process, the PRA Standard (ASME/ANS RA-Sc-2007) and Regulatory Guide 1.200, Revision 1.

This Peer Review [9] was a full-scope review of the technical elements of the Internal Events and internal flooding, at-power PRA.

In June 2017, an F&O Closure Review was conducted for the Ginna FPIE PRA model to evaluate elements of the PRA relative to the requirements of ASME/ANS RA-Sa-2009 [5] and RG 1.200 Rev. 2 [4]

In 2020, a second F&O Closure Review was conducted for the Ginna PRA Model [12]. The Internal Events scope of the review was the open and partially resolved finding-level F&Os from the 2017 F&O Closure Review [11]. - The focused-scope peer review determined there is one finding-level F&O that remains open resulting in a capability category I SR. This finding level F&O is discussed in Table 3-1.

Based on the assessments provided in Table 3-1, it is concluded that the GINNA Internal Events PRA (including internal flooding) is of adequate technical capability to support the TSTF-505 program.

E2-2

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Information Supporting Consistency with Regulatory Guide 1.200 Table 3-1 Ginna FPIE / Internal Flooding PRA Peer Review - Open Fact and Observations - Findings F&O Proposed Description F&O Basis Resolution Disposition Upgrade, Impact to Associated (from Peer (from Peer (from Peer (from F&O Closure Y/N Implementation F&Os SR Topic Status Review) Review) Review) Review) (basis) of TSTF-505 SC-A2-01 SC- Success MET The The For From 2017 F&O No. No The Ginna PRA A2 Criteria Capability definition of definition of Category II Closure Review: changes remains Category core core Ginna could have been conservative I damage damage use the The definition of core implemente with respects to documented documented code- damage used in the d associated the definition of in the Ginna- in the predicted PRA for events other with this core damage.

AS- Ginna-AS- core exit than large LOCA is Finding; Notebook; Notebook- temperature the onset of therefore, no For some Rev. 1 Rev-1 >1,200°F uncovering of the upgrade has sequences, a Section 2.2 Section 2.2 for 30 min core, as calculated been more realistic is consistent is consistent using using the code performed. definition may with the with the PCTRAN PCTRAN. This is a afford some examples of examples of (code with conservative additional time measures measures simplified definition that for operator for core for core core satisfies SR SC-A2 at actions.

damage damage modeling Capability Category I. However, over suitable for suitable for (PWR)). Further discrimination the typical loss Capability Capability is needed if it is of decay heat Category I Category I desired to employ removal timing as defined in as defined more realistic criteria success criteria, NUREG/CR- in that would the time 4550. For NUREG/CR correspond to between core Category II, -4550. Capability Category II uncovery and Ginna could - III. For slower CET use the evolving events temperatures of code- (especially for 1200°F or predicted transients with a total 1800°F peak E2-3

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Information Supporting Consistency with Regulatory Guide 1.200 F&O Proposed Description F&O Basis Resolution Disposition Upgrade, Impact to Associated (from Peer (from Peer (from Peer (from F&O Closure Y/N Implementation F&Os SR Topic Status Review) Review) Review) Review) (basis) of TSTF-505 core exit loss of feedwater), centerline is temperature more realistic fairly small.

>1,200°F for calculations might HEPs are 30 min using afford additional time acknowledged PCTRAN for the operators to as a source of (code with restore core cooling uncertainty for simplified beyond that currently this application.

core credited. An example modeling of such a case is Some modest (PWR)). addressed with conservatism in respect to Finding HEPs would not Review the SC-A4-02. [Note 1] adversely impact definition of Not addressed in this application.

core 2020 F&O Closure damage and Review.

determine if PCTRAN The SR remains MET could for Capability support the Category I.

Category II core damage definition.

Note 1 - Finding SC-A4-02 identifies that an operator action - operator fails to align bleed-and-feed given 1 of 2 PORVs and no charging within 15 minutes- was not included in the fault tree model. This Finding has subsequently been RESOLVED.

E2-4

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 Information Supporting Consistency with Regulatory Guide 1.200 Table 3-2 Ginna FPRA PRA Peer Review - Open Fact and Observations - Findings F&O Proposed Description F&O Basis Resolution Disposition Upgrade, Impact to Associated (from Peer (from Peer (from Peer (from F&O Closure Y/N Implementation F&Os SR Topic Status Review) Review) Review) Review) (basis) of TSTF-505 None E2-5

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-461 Information Supporting Consistency with Regulatory Guide 1.200

4. Scope and Technical Adequacy of GINNA Fire PRA Model The Ginna Fire PRA (FPRA) peer review [10] was performed in June 2012 using the NEI 07-12 Fire PRA peer review process [6], the ASME PRA Standard, ASME/ANS RA-Sa-2009 [5] and Regulatory Guide 1.200, Rev. 2 [4]. The purpose of this review was to establish the technical acceptability of the FPRA for the spectrum of potential risk-informed plant licensing applications for which the FPRA may be used. The FPRA peer review was a full-scope review of all of the technical elements of the Ginna at-power FPRA against all technical elements in Part 4 of the ASME/ANS PRA Standard, including the referenced internal events supporting requirements (SRs) in Part 2.

The findings from the Fire PRA peer review have been addressed in the Fire PRA model. An F&O Closure Review was conducted for Ginna [12]. The scope of the review included fire peer review findings. All of the findings from the 2012 fire PRA peer review were resolved. Currently, there are no open findings against the fire PRA model.

Given the resolution of all F&Os related to SRs assessed with less than a CC II, it is concluded that the GINNA FPRA is of adequate technical capability to support the TSTF-505 program.

E2-6

License Amendment Request Enclosure 2 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-461 Information Supporting Consistency with Regulatory Guide 1.200

5. References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A, October 12, 2012 (ADAMS Accession No. ML12286A322).

2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines', May 17, 2007 (ADAMS Accession No. ML071200238).

3. Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, Rev. 3, January 2018.

4. Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Rev. 2, March 2009.

5. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RAS-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

6. NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Rev. 1, June 2010.

7. NEI 05-04, Process for Performing PRA Peer Reviews Using the ASME PRA Standard, Rev. 2, November 2008.

8. NRC Regulatory Issue Summary 2007-06, "Regulatory Guide 1.200 Implementation," March 2007.

9. LTR-RAM-II-09-049, "RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirement for the R.E. Ginna Station Probabilistic Risk Assessment", August 2009.

10. LTR-RAM-II-12-066, Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications, August 6, 2012

11. For the Ginna Fire Probabilistic Risk Assessment" 1BT132299.006.058.100, "Ginna Nuclear Power Plant PRA Finding-Level Fact and Observation Technical Review, August 2017

12. G1-MISC-023, Revision 0, Risk Management Finding Level F&O Independent Assessment Ginna, March 2020.

13. GINNA NUCLEAR POWER PLANT - ISSUANCE OF AMENDMENT REGARDING TRANSITION TO A RISK INFORMED, PERFORMANCE-BASED FIRE PROTECTION PROGRAM IN ACCORDANCE WITH TITLE 10 OF THE CODE OF FEDERAL REGULATIONS SECTION 50.48(c) (CAC NO. MF1393), Ginna NFPA 805 Safety Evaluation, ML15271A101, November 23, 2015, E2-7

ENCLOSURE 3 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Information Supporting Technical Adequacy of PRA Models Without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This enclosure is not applicable to the Ginna submittal. Exelon is not proposing to use any PRA models in the Ginna Risk-Informed Completion Time Program for which a PRA standard, endorsed by the NRC in RG 1.200, Revision 2 does not exist.

ENCLOSURE 4 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 1 Introduction and Scope Topical Report NEI 06-09, Revision 0-A (Reference [1]), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference [2]), requires that the License Amendment Request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on their insignificance to the calculation of configuration risk as well as discuss conservative or bounding analyses applied to the configuration risk calculation. This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources. This enclosure also provides the R.E. Ginna Nuclear Power Plant (Ginna) specific results of the application of the generic methodology and the disposition of impacts on the Ginna Risk Informed Completion Time (RICT) Program. Section 3 of this enclosure presents the plant-specific analysis of seismic risk to Ginna. Section 4 of this enclosure presents the justification for excluding analysis of high wind risk to Ginna. Section 5 presents the justification for excluding External Flooding for Ginna. Section 6 of this enclosure presents the justification for excluding analyses of other external hazards from the Ginna PRA.

Topical Report NEI 06-09 does not provide a specific list of hazards to be considered in a RICT Program. However, non-mandatory Appendix 6-A in the ASME/ANS PRA Standard (Reference [3]) provides a guide for identification of most of the possible external events for a plant site. Additionally, NUREG-1855 (Reference [4]) provides a discussion of hazards that should be evaluated to assess uncertainties in plant PRAs and support the risk-informed decision-making process. This information was reviewed for the Ginna site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The information in the UFSAR regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well as present and projected industrial activities in the vicinity of the plant were also reviewed for this purpose. No new site-specific and plant-unique external hazards were identified through this review. The list of hazards in Appendix 6-A of the PRA Standard were considered for Ginna as summarized in Table E4-4.

The scope of this enclosure is consideration of the hazards in Table E4-4 for Ginna. As explained in subsequent Sections of this enclosure, risk contribution from seismic events and is evaluated quantitatively, and the other listed external hazards are evaluated and screened as having low risk. Although the high winds (missiles) hazard screened for total risk, it does not screen for all configurations; therefore, a penalty factor is developed to account for tornado missile risk in the RICT.

2 Technical Approach The guidance contained in NEI 06-09 states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the E4-1

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCOs) selected to be part of the RICT Program.

Consistent with NUREG-1855 (Reference [4]), external hazards may be addressed by:

1) Screening the hazard based on a low frequency of occurrence,

2) Bounding the potential impact and including it in the decision-making, or

3) Developing a PRA model to be used in the RMAT/RICT calculation.

The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.

The first is the contribution from the occurrence of beyond design basis conditions, e.g.,

winds greater than design, seismic events greater than the design-basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant.

The second aspect addressed is the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power, etc. While the plant design basis assures that the safety related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems that present a risk.

Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the NRCs 1975 Standard Review Plan (SRP)

(Reference [5]), which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance [6] as assuring a bounding CDF of less than 1E-6/yr for each hazard. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. If the bounding CDF for the hazard can be shown to be less than 1E-6/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program.

E4-2

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models The basis for this is as follows:

The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-5.

The maximum time interval allowed for this RICT is 30 days.

If the maximum CDF contribution from a hazard is <1E-6/yr, then the maximum ICDP from the hazard is <1E-7 (1E-6/yr

30 days/365 days/yr).

Thus, the bounding ICDP contribution from the hazard is shown to be less than 1% of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

The Ginna IPEEE hazard screening analysis (Reference [7]) has been updated to reflect current Ginna site conditions. The results are discussed in Section 6 and show that all the events listed in Table E4-4 can be screened except seismic events for Ginna. While high winds can be screened at Ginna based on average risk, there are configuration specific conditions identified for Ginna such that development of a High Winds RICT penalty was warranted as discussed in Section 4 below.

Hazard Analysis - CDF There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-6/yr. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard.

Evaluate Bounding LERF Contribution The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the LERF considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as follows:

ILERFHazard = ICDFHazard

CLERPHazard The approach used for seismic LERF is described in Section 3.

E4-3

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Risks from Hazard Challenges Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out of service equipment. For Ginna, as discussed later in this enclosure, the only beyond design basis hazard that could not be screened out are the seismic hazard, and the approach used considers that the change in risk with equipment out of service will not be higher than the estimated seismic CDF. In addition, while the high wind hazard for Ginna was screened for the average test and maintenance conditions, it could not be screened under different configuration-specific conditions.

The above steps address the direct risks from damage to the facility from external hazards.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using these steps without a full PRA, there are risks that may be addressed.

These risks are related to the fact that some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events below the design basis levels can cause extended loss of offsite power conditions. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms.

The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or they are not significant to risk.

Section 3 of this enclosure provides the analysis for Ginna with respect to the beyond design basis seismic hazard, Section 4 provides an analysis for the extreme winds hazard, Section 5 addresses the analysis of external flooding, and Section 6 of this enclosure provides an analysis of the other external hazards for Ginna.

E4-4

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 3 Seismic Risk Contribution Analysis Introduction The TSTF 505 program requires accounting for seismic risk contribution in calculating extended risk informed technical specification (TS) completion times (CT, also referred to as Allowed Outage Time, AOT). The basis for the estimate of seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) for application in the Ginna Risk Informed Completion Time - TSTF-505 program is documented in Reference [8].

Since a seismic PRA (SPRA) has not been previously developed (e.g., for the Ginna IPEEE (Individual Plant Examination for External Events) (Reference [9]), an alternative approach is taken to provide an estimate of seismic core damage frequency (SCDF) based on the current Ginna seismic hazard curve (Reference [10]), and assuming the seismic capacity of a component whose seismic failure would lead directly to core damage.

The calculation of seismic large early release frequency (SLERF) is performed by convolving the plant seismic core damage estimate described above with an assumed independent containment integrity HCLPF to estimate seismic LERF. That is, the seismic LERF can be estimated by convolving the plant seismic hazard with the plant limiting HCLPF for core damage and the limiting HCLPF for containment integrity.

Inputs and Assumptions Hazard Curve The Ginna seismic hazard is defined by the seismic hazard curve provided to NRC in Reference [11] using the seismic hazard curve per Reference [10].

PGA Metric The ground motion metric used to define the seismic hazard in this analysis is peak ground acceleration (PGA). PGA is a common ground motion metric used in seismic risk analyses for nuclear power plants (Reference [12]).

Plant Level Seismic Fragility The assumed limiting plant level seismic capacity used in the Ginna seismic penalty calculation has a high confidence of low probability of failure (HCLPF) value of 0.20g PGA. The HCLPF capacity is intended to represent an earthquake level in which there is approximately 95%

confidence of less than about a 5% failure probability. The basis for this value is the Ginna IPEEE (Reference [9]) seismic analysis. The IPEEE assessed Ginna structures, systems and components (SSCs) associated with Ginna SMA (seismic margins analysis) success paths to a review level earthquake (RLE) value of 0.30g PGA in accordance with NRC guidance in NUREG-1407 (Reference [6]). The Electric Power Research Institute (EPRI) NP-6041 seismic margin assessment methodology (Reference [13]) was used for the Ginna IPEEE seismic analysis.

E4-5

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models The Ginna IPEEE (Reference [9]) and the NRC SER (Reference [14]) of the Ginna IPEEE were reviewed for insights to determine the limiting plant HCLPF. For Ginna, the Seismic Margin Earthquake (SME) assigned by the NRC is the median NUREG/CR-0098 (Reference [15])

spectrum anchored at 0.3g (Reference [14]). The IPEEE included a review of the integrity of the containment itself and isolation systems such as valves and mechanical and electrical penetrations. A number of Ginna components could not be screened out in the IPEEE using the 0.3g PGA HCLPF value for focused review level plants. Because some SSCs could not screen at 0.3g PGA, the lower HCLPF of 0.2g PGA is used as the Ginna plant level fragility for this evaluation. The 0.2g HCLPF is consistent with the value cited in Table B.2 of Safety/Risk Assessment Panel for GI-199 (Reference [16]) for the Ginna IPEEE SMA-based plant level seismic fragility.

The uncertainty parameter for seismic capacity is represented by a composite beta factor (c) of 0.4. This is a commonly accepted approximation and is consistent with the value used in GI-199, Table C.1, Bases for Establishing Plant-Level Fragility Curves Parameters from IPEEE Information (Reference [16]).

Convolution to Determine SCDF The estimation of SCDF in this calculation is performed by a mathematical convolution of the PGA-based seismic hazard curve and the Ginna PGA-based plant HCLPF value of 0.2g. This convolution estimation approach is a common analysis in approximating an SCDF for use in risk-informed decision making (e.g., it is commonly used in RICT seismic penalty calculations; the NRC used this approach in the GI-199 risk assessment) in absence of a current full-scope SPRA.

Convolution to Determine SLERF The estimate of SLERF is performed by convolving the plant seismic core damage estimate described above with an assumed independent (i.e., seismically uncorrelated) containment integrity HCLPF. This approach is consistent with the approach provided in response to an NRC Request for Additional Information (RAI) regarding the calculation of seismic LERF to support RICT calculations (Reference [17]). This approach for estimating SLERF is judged to be conservative in the absence of a current full-scope SPRA.

Calculations The general approach to estimation of the SCDF is to use the plant level HCLPF and convolve the corresponding failure probabilities as a function of seismic hazard level with the seismic hazard curve frequencies of occurrence. This is a commonly used approach to estimate SCDF when a seismic PRA is not available and is also the approach that was used in the Vogtle pilot TSTF-505 license amendment request submittal (Reference [18]) and a previous Exelon TSTF-505 submittal for Calvert Cliffs (Reference [19]). A second convolution with an assumed low seismic capacity for containment is used to estimate SLERF. The key elements of the SCDF and SLERF seismic penalty calculations are discussed below.

E4-6

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Seismic Hazard and Intervals The seismic hazard input per Reference [11] is shown in Table E4-1. The mean fractile occurrence frequencies in Table E4-1 are used in the convolution calculations here; use of mean values is a typical and expected PRA practice.

To facilitate calculation of the plant fragility probability at each seismic hazard interval, a representative g-level is calculated for each interval. The representative g-level for all seismic intervals is calculated using a geometric mean approach (i.e., the square root of the product of the g-level values at the beginning and end of the given interval). For the last open-ended seismic interval greater than 10g, the representative g-level is estimated as 10g as opposed to a higher g-level (e.g., 11g) for modeling convenience. However, the precision of the representative magnitude used for the final open-ended seismic interval in the SCDF convolution is immaterial given that the calculated conditional failure probability is at a g-level of 10g is 1.0 and the contribution from this final interval has a negligible contribution to the overall SCDF estimate.

The seismic hazard interval annual initiating event frequency is calculated (except for the final interval) by subtracting the mean exceedance frequency associated with the g-interval (high) end point from the mean exceedance frequency associated with the g-interval beginning point.

The frequency of the last seismic hazard interval is the exceedance frequency at the beginning point of that interval. This is common practice in industry SPRAs (References [20] and [12]).

E4-7

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models TABLE E4-1 EPRI 2013 SEISMIC HAZARD DATA FOR GINNA NUCLEAR POWER PLANT (Reproduced from Reference [10] Table A-1a. Mean and Fractile Seismic Hazard Curves for PGA at Ginna)

(g PGA) MEAN 0.05 0.16 0.50 0.84 0.95 0.0005 5.05E-02 2.46E-02 3.95E-02 5.05E-02 6.26E-02 7.13E-02 0.001 3.62E-02 1.38E-02 2.60E-02 3.57E-02 4.77E-02 5.66E-02 0.005 8.15E-03 2.25E-03 4.25E-03 6.93E-03 1.10E-02 1.98E-02 0.01 3.20E-03 8.60E-04 1.36E-03 2.49E-03 4.19E-03 1.01E-02 0.015 1.71E-03 4.37E-04 6.45E-04 1.21E-03 2.19E-03 6.09E-03 0.03 5.19E-04 1.02E-04 1.55E-04 3.01E-04 6.73E-04 2.19E-03 0.05 2.07E-04 3.28E-05 5.27E-05 1.10E-04 2.80E-04 8.85E-04 0.075 9.91E-05 1.44E-05 2.42E-05 5.20E-05 1.40E-04 4.01E-04 0.1 5.87E-05 8.47E-06 1.44E-05 3.14E-05 8.35E-05 2.22E-04 0.15 2.78E-05 3.95E-06 7.03E-06 1.60E-05 4.01E-05 9.51E-05 0.3 7.24E-06 8.72E-07 1.77E-06 4.50E-06 1.10E-05 2.25E-05 0.5 2.45E-06 2.22E-07 5.05E-07 1.51E-06 3.95E-06 7.55E-06 0.75 9.52E-07 5.75E-08 1.53E-07 5.42E-07 1.60E-06 3.09E-06

1. 4.61E-07 1.84E-08 5.75E-08 2.42E-07 7.89E-07 1.60E-06 1.5 1.51E-07 2.96E-09 1.16E-08 6.54E-08 2.60E-07 5.75E-07

3. 1.67E-08 1.20E-10 4.56E-10 4.25E-09 2.68E-08 7.34E-08

5. 2.44E-09 5.05E-11 9.11E-11 4.07E-10 3.37E-09 1.15E-08 7.5 4.30E-10 3.47E-11 5.35E-11 9.79E-11 5.35E-10 2.07E-09

10. 1.12E-10 3.01E-11 4.01E-11 9.11E-11 1.62E-10 5.75E-10 E4-8

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Seismic Failure Probabilities The seismic failure probability of the Ginna limiting plant fragility for each hazard interval is calculated using the following fragility equations. These are the typical lognormal fragility equations used in most hazard PRAs (Reference [12]).

Fragility (i.e., failure probability) = [ln(A/Am)/c],

where is the standard lognormal distribution function A is the g level in question, Am is the median seismic capacity, c is the composite uncertainty parameter HCLPF and Am are related as follows: Am = HCLPF / (exp -2.33c)

The above fragility relationships are used to determine the plant level seismic induced failure probability as a function of seismic hazard interval. The following shows the Ginna limiting plant level seismic fragility statistics.

Ginna Limiting Plant Level Seismic Fragility Parameters Source HCLPF Am c Ginna IPEEE SMA 0.20g PGA 0.51g PGA 0.40 (NRC GI-199, Table B-2)

Seismic Core Damage Frequency The SCDF for each hazard interval is computed as the product of the hazard interval initiating event frequency (/yr) and the plant level fragility failure probability for that same hazard interval.

The results per hazard interval are then straight summed to produce the overall total SCDF across the entire hazard curve. The SCDF convolution calculation is summarized in Table E4-2 and shows the total estimated SCDF is 3.4E-6/yr.

Table E4-3 provides the following information:

Ginna limiting plant level seismic fragility inputs

Seismic hazard intervals and their associated initiating event frequencies (Mean)

Representative magnitudes and plant level fragility failure probabilities (Mean) per hazard interval

Convolved SCDF per interval and total SCDF.

E4-9

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Seismic Large Early Release Frequency (Seismic LERF)

In the absence of a seismic PRA or other detailed current seismic evaluation, the following approach is used to estimate seismic LERF for use in the TSTF-505 program. The following approach is consistent with the approach provided in response to an NRC Request for Additional Information (RAI) regarding the calculation of seismic LERF to support RICT calculations for another PWR (Reference [17]).

The robustness of the containment integrity is established by reviewing the seismically important plant specific and generic information on LERF contributors. The failure of containment isolation and the ability to isolate the containment were also reviewed in detail. An estimate of SLERF is obtained by convolving the plant seismic hazard curve with the plant limiting fragility for core damage (0.2g PGA HCLPF based on IPEEE SMA) and a plant limiting fragility representing containment integrity (conservatively assumed as 0.2g PGA HCLPF).

Most containment isolation pathways at Ginna are equipped with combinations of check valves, which are seismically rugged components, and air operated valves (AOV) that fail closed on loss of support and are also generally seismically rugged components. Certain containment isolation motor operated valves (MOV) require actuation signals and power for closure, but most such valves would normally be already closed at the time of the earthquake or they are part of a closed-loop system that would not represent a large magnitude release pathway (thus, not LERF release).

Seismic LERF Estimate As mentioned above, an estimate of seismic LERF for use in the TSTF-505 program is calculated by convolving the plant seismic hazard curve with the plant limiting fragility for core damage (0.2g PGA HCLPF based on IPEEE SMA) and a plant limiting fragility representing containment integrity (conservatively assumed as 0.2g PGA HCLPF).

Similar to the SCDF convolution calculation in Table E4-2, the SLERF convolution calculation is summarized in Table E4-3 and shows the total estimated SLERF is 1.9E-6/yr. Table E4-3 provides the following information:

Ginna limiting plant level seismic fragility inputs (same information as Table E4-2)

Ginna limiting seismic fragility inputs representing containment

Seismic hazard intervals and their associated initiating event frequencies (Mean) (same information as Table E4-2)

Representative magnitudes and plant level and containment fragility failure probabilities (Mean) per hazard interval

Convolved SCDF per interval and total SCDF (same information as Table E4-2)

Convolved SLERF per interval and total SLERF E4-10

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Application of SLERF in RICT Calculations The SLERF estimate documented above is conservatively used in the RICT calculation process.

Conservatism in the RICT process derives from the proposed approach to apply the total estimated annual seismic LERF as a delta SLERF in each RICT calculation, regardless of the duration of the completion time. The total estimated annual seismic CDF and LERF will be applied starting at time zero for each RICT calculation.

E4-11

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-2 Convolution Calculation Summary of Ginna Seismic CDF Limiting Plant Fragility Ginna Seismic Hazard Convolution Calculation (Ginna IPEEE SMA) Curve (Ginna limiting plant fragility with Seismic Hazard)

Hazard Interval Hazard Peak Mean Hazard HCLPF Am Representative Interval Convolved Ground Exceedance Interval (g, (g, c Magnitude Occurrence Frequency Acceleration Frequency Fragility PGA) PGA) (geo. mean, g Frequency (/yr)

(g) (/yr) (Mean)

PGA) (/yr) 0.2 0.51 0.40 0.0005 5.05E-02 0.001 4.77E-61 1.43E-02 6.82E-63 0.001 3.62E-02 0.002 3.27E-42 2.81E-02 9.18E-44 0.005 8.15E-03 0.007 5.93E-27 4.95E-03 2.94E-29 0.01 3.20E-03 0.012 6.24E-21 1.49E-03 9.30E-24 0.015 1.71E-03 0.021 1.02E-15 1.19E-03 1.21E-18 0.03 5.19E-04 0.039 6.20E-11 3.12E-04 1.94E-14 0.05 2.07E-04 0.061 6.15E-08 1.08E-04 6.64E-12 0.075 9.91E-05 0.087 4.88E-06 4.04E-05 1.97E-10 0.1 5.87E-05 0.122 1.88E-04 3.09E-05 5.82E-09 0.15 2.78E-05 0.212 1.45E-02 2.06E-05 2.99E-07 0.3 7.24E-06 0.387 2.49E-01 4.79E-06 1.19E-06 0.5 2.45E-06 0.612 6.80E-01 1.50E-06 1.02E-06 E4-12

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-2 Convolution Calculation Summary of Ginna Seismic CDF Limiting Plant Fragility Ginna Seismic Hazard Convolution Calculation (Ginna IPEEE SMA) Curve (Ginna limiting plant fragility with Seismic Hazard)

Hazard Interval Hazard Peak Mean Hazard HCLPF Am Representative Interval Convolved Ground Exceedance Interval (g, (g, c Magnitude Occurrence Frequency Acceleration Frequency Fragility PGA) PGA) (geo. mean, g Frequency (/yr)

(g) (/yr) (Mean)

PGA) (/yr) 0.2 0.51 0.40 0.75 9.52E-07 0.866 9.09E-01 4.91E-07 4.46E-07 1 4.61E-07 1.225 9.86E-01 3.10E-07 3.06E-07 1.5 1.51E-07 2.121 1.00E+00 1.34E-07 1.34E-07 3 1.67E-08 3.873 1.00E+00 1.43E-08 1.43E-08 5 2.44E-09 6.124 1.00E+00 2.01E-09 2.01E-09 7.5 4.30E-10 8.660 1.00E+00 3.18E-10 3.18E-10 10 1.12E-10 10.000 1.00E+00 1.12E-10 1.12E-10 Total Convolved SCDF Across Hazard Curve (1/yr): 3.4E-06 E4-13

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-3 Convolution Calculation Summary of Ginna Seismic LERF Convolution Calculation Limiting Plant Fragility Ginna Seismic Hazard (Ginna limiting plant fragility and Containment fragility with Seismic (Ginna IPEEE SMA) Curve Hazard)

Hazard Interval Hazard Hazard Mean Representative Hazard Interval Convolved Interval Convolved Peak Ground Exceedance Magnitude Interval Occurrence Frequency Containment Frequency HCLPF Am Acceleration Frequency (geo. mean, g Fragility Frequency (SCDF) Fragility (LERF)

(g, PGA) (g, PGA) c (g) (/yr) PGA) (Mean) (/yr) (/yr) (Mean) (/yr) 0.2 0.51 0.40 0.0005 5.05E-02 0.001 4.77E-61 1.43E-02 6.82E-63 4.77E-61 3.25E-123 0.001 3.62E-02 0.002 3.27E-42 2.81E-02 9.18E-44 3.27E-42 3.01E-85 Limiting Containment 0.005 8.15E-03 0.007 5.93E-27 4.95E-03 2.94E-29 5.93E-27 1.74E-55 Fragility HCLPF Am 0.01 3.20E-03 0.012 6.24E-21 1.49E-03 9.30E-24 6.24E-21 5.81E-44 c

(g, PGA) (g, PGA) 0.2 0.51 0.40 0.015 1.71E-03 0.021 1.02E-15 1.19E-03 1.21E-18 1.02E-15 1.23E-33 0.03 5.19E-04 0.039 6.20E-11 3.12E-04 1.94E-14 6.20E-11 1.20E-24 0.05 2.07E-04 0.061 6.15E-08 1.08E-04 6.64E-12 6.15E-08 4.08E-19 0.075 9.91E-05 0.087 4.88E-06 4.04E-05 1.97E-10 4.88E-06 9.62E-16 0.1 5.87E-05 0.122 1.88E-04 3.09E-05 5.82E-09 1.88E-04 1.09E-12 0.15 2.78E-05 0.212 1.45E-02 2.06E-05 2.99E-07 1.45E-02 4.34E-09 0.3 7.24E-06 0.387 2.49E-01 4.79E-06 1.19E-06 2.49E-01 2.97E-07 E4-14

ENCLOSURE 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-3 Convolution Calculation Summary of Ginna Seismic LERF Convolution Calculation Limiting Plant Fragility Ginna Seismic Hazard (Ginna limiting plant fragility and Containment fragility with Seismic (Ginna IPEEE SMA) Curve Hazard)

Hazard Interval Hazard Hazard Mean Representative Hazard Interval Convolved Interval Convolved Peak Ground Exceedance Magnitude Interval Occurrence Frequency Containment Frequency HCLPF Am Acceleration Frequency (geo. mean, g Fragility Frequency (SCDF) Fragility (LERF)

(g, PGA) (g, PGA) c (g) (/yr) PGA) (Mean) (/yr) (/yr) (Mean) (/yr) 0.2 0.51 0.40 0.5 2.45E-06 0.612 6.80E-01 1.50E-06 1.02E-06 6.80E-01 6.93E-07 0.75 9.52E-07 0.866 9.09E-01 4.91E-07 4.46E-07 9.09E-01 4.06E-07 Limiting Containment 1 4.61E-07 1.225 9.86E-01 3.10E-07 3.06E-07 9.86E-01 3.01E-07 Fragility HCLPF Am 1.5 1.51E-07 2.121 1.00E+00 1.34E-07 1.34E-07 1.00E+00 1.34E-07 c

(g, PGA) (g, PGA) 0.2 0.51 0.40 3 1.67E-08 3.873 1.00E+00 1.43E-08 1.43E-08 1.00E+00 1.43E-08 5 2.44E-09 6.124 1.00E+00 2.01E-09 2.01E-09 1.00E+00 2.01E-09 7.5 4.30E-10 8.660 1.00E+00 3.18E-10 3.18E-10 1.00E+00 3.18E-10 10 1.12E-10 10.000 1.00E+00 1.12E-10 1.12E-10 1.00E+00 1.12E-10 Total Convolved SCDF Across Hazard Curve (1/yr): 3.4E-06 Total Convolved SLERF Across Hazard Curve (1/yr): 1.9E-06 E4-15

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Summary Estimates of SCDF and SLERF have been derived for use in the Ginna TSTF-505 program. Since the estimates are intended to be treated as conservative values in the RICT calculations for that program, the results for the case of a limiting plant level seismic fragility of 0.20g PGA HCLPF and limiting containment seismic fragility of 0.2g PGA HCLPF, both with c = 0.4, will be used.

Seismic CDF = 3.4E-6/yr Seismic LERF = 1.9E-6/yr Note: RICT calculations use the formulaic construct of: CDF x Time in Configuration (same formula for LERF metric). In the case of the seismic risk contribution to the RICT calculations, the total SCDF and total SLERF seismic penalties are treated as SCDF and SLERF. In effect this approach is assuming the base seismic risk is negligible, which has the effect of producing conservative SCDF and SLERF values.

E4-16

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 4 Extreme Winds Analysis This section provides an analysis of the High Winds / Tornados risk impact for Ginna.

Wind Pressure Section 3.3.4 of the Ginna UFSAR (Reference [21]) states that the Ginna Category I buildings are designed to withstand a fastest-mile wind velocity of 132-mph. A 132-mph fastest-mile wind speed is equivalent to ~150 mph 3-second gust wind speed (Reference [8]); current hazard curves are based on the 3-second gust wind speed.

Section 3.3.5 of the UFSAR describes the Structural Upgrade Program that was completed at Ginna. Section 3.3.5.7 describes the principal modifications and analyses performed such that:

All primary structural steel framing, including their connections and anchorages, found to be overstressed when subjected to the following design loads have been modified to resist these loads: 132mph tornado windspeeds and 100 psf extreme snow load. They have also been modified as necessary to maintain integrity for 188-mph tornado windspeeds. The modifications were included in the auxiliary building, turbine building, intermediate building, control building, and facade structure.

No modifications were required on the secondary members or exterior shell, since their failure would not damage required safety equipment.

Per Section 3.3.3.3.5 of the UFSAR, the diesel generator building was modified to withstand 132-mph tornado loads with no significant damage, and remain functional at a windspeed of 188 mph.

As a result of the Structural Upgrade Program, the plant is capable of achieving and maintaining safe shutdown conditions following a 188-mph tornado strike. Per Section 3.3.2.1.4 of the UFSAR, this was the wind speed for the 1E-6/yr tornado at that time.

As part of the IPEEE (Reference [7]), a site walkdown was performed and no changes at the plant were found that would increase the plants vulnerability to high winds. The IPEEE screened high winds consistent with the criteria in Section 5.2.4 of NUREG-1407 (Reference [6]). It was stated that assuring all safe shutdown functions could be met for a 1E-6/yr tornado was comparable to the NUREG-1407 Section 5.2.4 criteria of a design basis event with frequency less than 1E-5/yr and conditional core damage probability of 0.1.

Per Table 6-1 of the more recent NUREG/CR-4461, Rev. 2 (Reference [22]), the 1E-6 annual exceedance probability (AEP) of tornado wind speed at the Ginna site is 169 mph, based on the EF-scale. Therefore, the frequency of the 188-mph tornado is significantly less than 1E-6/yr.

E4-17

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Tornado Missiles The Ginna licensing basis for tornado missiles is described in Section 3.3.2.1.4 of the UFSAR.

Further, Section 3.5.1.4 of the UFSAR documents that the facility was upgraded as part of the Structural Upgrade Program to provide adequate protection for required SSCs to perform their appropriate safety function (Reference [21]).

Subsequent to the IPEEE, Ginna performed evaluations of tornado missile protection (TMP) in order to address US NRC Regulatory Information Summary (RIS) 2015-06 (Reference [23]). Potential vulnerabilities were documented in the Ginna Tornado Missile Vulnerability Report (Reference [24]).

The Ginna TMP Structural Barriers Design Analysis, DA-CE-17-001 (Reference [25]), documents the barrier upgrades and analyses to meet the design basis for TMP. Analysis DA-CE-17-001 demonstrates that the structural barriers at Ginna provide sufficiently robust missile resistance to protect safety related building and components.

An additional analysis was performed to evaluate key tornado missile barriers against the 3 pipe, weighing 78 lbs travelling at 67.6 mph (i.e., 0.4 x 169 mph, which is the windspeed associated with the 1E-6/yr tornado from NUREG/CR-4461 (Reference [22])). This analysis showed that standby auxiliary feedwater (SAFW) and B EDG structures and barriers were capable of stopping such a missile, after upgrades to several of the barriers are made (Reference [26]). This provides additional assurance that Ginna tornado missile risk is low, since key SSCs are protected against tornado missiles beyond the design basis.

The upgrades/modifications identified are (Reference [26]):

SAFW Generator Radiator Exhaust: Replace 19W4 1/4x2 Bar Grating with 19W4 1/4x4 Bar Grating

B Emergency Diesel Generator Room Air Intake: Replace 19W4 1/4x2 Bar Grating with 19W4 1/4x4 Bar Grating

B EDG Roof Vents: Increase anchorage capacity by expanding baseplate, increasing the size/embedment depth of anchors

KDG08 Exhaust: Additional gussets at outside face of piping and, re-pad on outside edge of elbow

KDG01B Exhaust: Perform field measurements to determine thickness of silencer (SDG01A) shell; upgrade as necessary As described above, the 132 mph fastest-mile windspeed is equivalent to ~150 mph 3-second gust, which is the windspeed scale used for tornado windspeeds and frequencies reported in NUREG/CR-4461 (Reference [22]). The EF-scale windspeed associated with the 1E-5 AEP for Ginna is 130 mph. Therefore, the design windspeed of ~150 mph (3-second gust) is less than 1E-5/yr.

E4-18

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models A conservative estimate was made of the conditional core damage (CCDP) probability for the tornado missile hazard with wind-speeds of 150 mph. The CCDP was determined to be approximately 3.1E-2 (Reference [8]).

Configuration Specific Considerations Wind Hazard The plant design for wind pressure and the low frequency of design tornadoes results in a demonstrably conservative estimate of CDF associated with high wind hazard (other than wind generated missiles) less than 1E-6/yr. Therefore, all non-missile high wind hazards can be screened from consideration for the TSTF-505 application, based on EXT-C1 Criterion C of ASME/ANS RA-Sa-2009 (Reference [3]).

Missile Hazard Based on a plant-specific tornado missile risk analysis for Ginna (Reference [8]), the CCDP for tornado missiles associated with design basis 150 mph (3-second gust) windspeeds is approximately 3.1E-2. The frequency of 150 mph tornados is less than 1E-5/yr, based on the EF-scale. Therefore, tornado missile hazards can be screened from consideration for the TSTF-505 application, based on EXT-C1 Criterion B of ASME/ANS RA-Sa-2009 (Reference [3]). There are no vulnerabilities to tornado missiles at Ginna that would specifically affect containment integrity and large early release probability.

However, CDF due to tornado missiles for certain maintenance configurations is determined to be above 1E-6/yr, requiring a high winds penalty factor to be established for TSTF-505 calculations.

Summary Conservative high winds penalty factors are calculated in G1-MISC-021 (Reference [8]). These conservative high winds penalty factors should be included in the TSTF-505 calculations for all configurations except LCOs 3.7.5.F, 3.6.2.C, and 3.6.3.E (Reference [8]).

CDF = 1E-5/yr LERF = 2E-6/yr The following penalty factors should be used for LCO 3.7.5.F, 3.6.2.C, and 3.6.3.E.

LCO 3.7.5.F: CDF = 7E-5/yr; LERF = 2E-6/yr LCO 3.6.2.C and 3.6.3.E: CDF = 1E-5/yr; LERF = 5E-6/yr Additionally, if any of the following conditions exist, the higher CDF penalty of 1E-5/yr should be used, regardless of the LCO(s):

E4-19

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

SAFW DG (KDG08) unavailable

Either FLEX fuel trucks/trailers unavailable

Either FLEX portable fuel pumps unavailable

DI Water Storage Tank (TCD05) unavailable or not filled to minimum level

Portable Fans for SAFW Building (Smoke Eaters) are unavailable when outside air temperature requires SAFW Building ventilation to be operable (>60 °F)

City Water supply to B EDG unavailable E4-20

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 5 External Flooding Assessment The evaluation of the impact of the external flooding hazard at the site was updated as a result of the NRCs post-Fukushima 50.54(f) Request for Information. The stations flood hazard reevaluation report (FHRR) was submitted to the NRC for review on March 11, 2015 (Reference [27]). The results indicated that all flood causing mechanisms, except Local Intense Precipitation (LIP) and combined effects River Flood which produces a probable maximum flood (PMF), were bounded by the current licensing basis (CLB) and did not pose a challenge to the plant.

Local Intense Precipitation (LIP)

The reevaluated LIP mechanism was found to produce various water surface elevations (WSEs) at different locations throughout the site. At the Auxiliary Building, the peak water surface elevation is 270.9 ft and the finished floor elevation is 271.0 ft. Peak LIP WSEs at the battery and diesel generator rooms are 255.8 ft with the buildings having a finished floor elevation of 253.5 ft. Both structures have watertight doors and seals that provide 4.5 ft protection against flood water intrusion. Therefore, the available physical margin (APM) against flooding is 2.2 ft and no impacts are expected to the Auxiliary Building or Battery or Diesel Generator rooms. The peak WSEs at the screen house is 255.8 ft and water intrusion is expected to affect the Service Water system, however, SW is not credited for providing cooling water during an external flood. An alternate cooling water tank is available at elevation 271.0 ft.

The LIP flooding mechanism is screened from further analysis utilizing the Criteria EXT-B1 from the ASME/ANS RA-S 2009 where the hazard is of equal or lesser damage potential than the hazards for which the plant has been designed.

Combined Effects River Flooding The PMF resulting from the combined effects river flood would inundate the site and the CLB requires temporary barriers to be installed by site personnel prior to the arrival of flood waters. As outlined in the Ginna Focused Evaluation (FE) (Reference [28]), the evaluation concluded the site has an adequate site response and available physical margin (APM) to mitigate the effects from the PMF.

To better characterize the frequency of exceedance for the combined effects river flood risk-significant flood events, a flood-frequency study was completed in August 2020 (Reference [29]). The report analyzed flooding events up to an exceedance frequency of 1E-6/yr and provided inundation mapping to show the impact to the site from a flood with an exceedance frequency of 1E-6/yr. The results show that a combined effects river flood with this exceedance frequency would not produce a water surface elevation (WSE) greater than the elevation of the stream banks on the south and east sides of the plant. The result is no flood water will top the banks allowing inundation throughout the site. There are no other impacts from this flood event to site equipment important to safety. The frequency analysis and inundation mapping for these floods are provided in Reference [29].

E4-21

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models The conclusion is that the combined effects river flood is screened, utilizing the ASME/ANS RA-S 2009 Criteria EXT-C2, with a hazard frequency less than 1E-6/yr and no impacts to the site.

Disposition for RICT Program:

The LIP flooding mechanism has been screened from further consideration in the RICT Program. The site is designed to mitigate the effects from the hazard utilizing permanently installed exterior watertight doors that do not require any manual actions to close. Therefore, there are no postulated impacts to safe shutdown equipment required during the LIP flood.

The combined effects river flood mechanism was evaluated based on the frequency of the initiating event at the screening threshold (1E-6/yr). It was determined that no impacts to safe shutdown equipment are postulated from a combined effects river flood initiating event at the screening frequency threshold. Therefore, the frequency of a combined effects river flood that could impact the site is lower than the screening threshold of 1E-6/yr as identified in criteria EXT-C2 and is screened from further consideration in the RICT program.

Configuration Specific Considerations There are no configuration specific considerations related to the screening assessment provided above for Ginna.

E4-22

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 6 Evaluation of External Event Challenges and IPEEE Update Results This section provides an evaluation of other external hazards. The results of the assessment of these hazards is provided in Table E4-4. Table E4-5 provides the summary criteria for screening of the hazards listed in Table E4-4.

Hazard Screening The IPEEE for Ginna provides an assessment of the risk to Ginna associated with these hazards.

Additional analyses have been performed since the IPEEE to provide updated risk assessments of various hazards, such as aircraft impacts, industrial facilities and pipelines, and external flooding.

These analyses are documented in the UFSAR (Reference [21]. Table E4-4 reviews and provides the bases for the screening of external hazards, identifies any challenges posed, and identifies any additional treatment of these challenges, if required. The conclusions of the assessment, as documented in Table E4-4, assure that the hazard either does not present a design-basis challenge to Ginna, or is adequately addressed in the PRA.

In the application of Risk-Informed Completion Times, a significant consideration in the screening of external hazards is whether particular plant configurations could impact the decision on whether a particular hazard that screens under the normal plant configuration and the base risk profile would still screen given the particular configuration. The external hazards screening evaluation for Ginna has been performed accounting for such configuration-specific impacts. The process involves several steps.

As a first step in this screening process, hazards that screen for one or more of the following criteria (as defined in Table E4-5) still screen regardless of the configuration, as these criteria are not dependent on the plant configuration.

The occurrence of the event is of sufficiently low frequency that its impact on plant risk does not appreciably impact CDF or LERF. (Criterion C2)

The event cannot occur close enough to the plant to affect it. (Criterion C3)

The event which subsumes the external hazard is still applicable and bounds the hazard for other configurations (Criterion C4)

The event develops slowly, allowing adequate time to eliminate or mitigate the hazard or its impact on the plant. (Criterion C5)

The next step in the screening process is to consider the remaining hazards (i.e., those not screened per the above criteria) to consider the impact of the hazard on the plant given particular E4-23

License Amendment Request Enclosure 4 Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models configurations for which a RICT is allowed. For hazards for which the ability to achieve safe shutdown may be impacted by one or more such plant configurations, the impact of the hazard to particular SSCs is assessed and a basis for the screening decision applicable to configurations impacting those SSCs is provided.

As noted above, the configurations to be evaluated are those involving unavailable SSCs whose LCOs are included in the RICT program.

E4-24

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Acceptance criterion 1.A of Standard Review Plan 3.5.1.6 (Reference [30]) states the probability is considered to be less than an order of magnitude of 10-7 per year by inspection if the plant-to-airport distance D is between 5 and 10 statute miles, and the projected annual number of operations is less than 500 D2, or the plant-to-airport distance D is greater than 10 statute miles, and the projected annual number of operations is less than 1000 D2 A direct or indirect (i.e.

(PS2, PS4).

skidding impact) collision of PS2 a portion of or an entire Aircraft impacts Y Per UFSAR Section 2.2.2.4 (Reference [21]), the aircraft with one or more PS4 closest airport to the plant is the Williamson Flying structures at or in the area Club Airport, a small, privately owned, general surrounding the plant site.

aviation facility located approximately 10 miles east-southeast of the plant. According to the Federal Aviation Administrations Air Traffic Activity System, the annual operations from this airport is less than 27,000, which is less than the 500 D2 criteria (PS2, PS4).

Greater Rochester International Airport, about 25 miles southwest of the plant, is the nearest airport E4-25

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a) with scheduled commercial air service. According to the Federal Aviation Administrations Air Traffic Activity System, the annual operations from this airport is less than 85,000, which is less than the 1000 D2 criteria (PS2, PS4).

Based on this review, the aircraft impact hazard is considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

The Ginna Nuclear Power Plant located on the south shore of Lake Ontario precludes the possibility of an avalanche.

A rapid flow of a large mass of accumulated frozen Based on this review, the Avalanche hazard can Avalanche Y C3 precipitation down a sloped be considered to be negligible.

surface.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

E4-26

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Per UFSAR Section 9.2.1.2.6 (Reference [21]),

Lake Ontario has an infestation of zebra mussels, which makes Ginna Station's cooling systems potentially vulnerable to plugging. To control this problem, the Rochester Gas and Electric Corporation (RG&E) has installed sodium hypochlorite injection lines in the screen house inlet plenum and service water (SW) pump bays to The accumulation or prevent colonization of zebra mussels in the deposition of vegetation or screen house bays. This is part of an overall organisms (e.g., zebra Service Water System Reliability Optimization Biological events mussels, clams, fish) on an Y C5 Program to define the techniques, equipment, intake structure or internal methods, and responsibilities that are used to to a system that uses an ensure the service water (SW) system performs intake structure. the following functions: transfer the necessary heat from safety related equipment to the ultimate heat sink under both normal and accident conditions, provide a source of water to the preferred auxiliary feedwater system and the standby auxiliary feedwater system for decay heat removal, and support reliable and economic operation of Ginna Station.

E4-27

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Based on this review, the Biological Event hazard can be considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

Per UFSAR Section 2.4.4 (Reference [21]), the NRC required the placement of additional shoreline erosion protection. This protection was added to ensure minimum wave overtopping of the concrete wall fronting the plant and lower water levels in the vicinity of the screen house.

The wearing away of a shoreline due to wave The NRC performed an analysis using procedures Coastal erosion action, tidal currents, wave Y C1 from the Shore Protection Manual, U.S. Army currents, drainage, or Coastal Engineering Research Center of the winds. stability and condition of the revetment fronting the plant site (Reference [31]) and concluded that if the revetment fronting the plant exists as designed, it would be capable of resisting surge flooding from Lake Ontario, and therefore, it would meet current regulatory criteria.

E4-28

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Subsequent inspections of the revetment in November and December 1981 showed that the revetment appears to be structurally sound and stable with no evidence of major structure stability problems. Further, the inspections verified the revetment had not degraded from the original design. These revetments are monitored via the Structures Monitoring Program and Periodic Surveillance and Preventive Maintenance Programs. Therefore, it was concluded that adequate protection from surge flooding exists at Ginna Station.

Based on this review, the Coastal Erosion hazard can be considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

Drought is a slowly developing hazard allowing An extended period of time for orderly plant reductions, including Drought months or years when a Y C5 shutdowns.

region experiences a E4-29

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a) deficiency in its surface or Based on this review, the Drought hazard can be underground water supply considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

Accumulation of excessive See Section 5 of this enclosure for results and water on the station justification of screening of external flooding C1 grounds from various related hazards.

External Flooding Y sources including Local PS4 Intense Precipitation and Snow Accumulation See Section 4 of this enclosure for results and PS3 Extreme Wind or Excessive winds, justification of screening extreme winds. Section 4 Y

Tornado straight-line or tornadic also provides penalty factors to account for PS4 tornado risk during RICT configurations.

The principal effects of such events (such as Water droplets suspended freezing fog) would be to cause a loss of off-site in the atmosphere at or power, which is addressed in weather-related Fog Y C4 near the Earths surface LOOP scenarios in the FPIE PRA model for that limit visibility. Ginna.

E4-30

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Based on this review, the Fog hazard can be considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

External fires (Forest or Range Fire) originating from outside the plant boundary have the potential to cause a loss of offsite power event, which is Fires originating from addressed for grid-related LOOP scenarios in the outside the plant site FPIE PRA model for Ginna.

boundary that are caused Forest or Range by the uncontrolled Y C4 Based on this review, the Forest or Range Fire Fire combustion of vegetation hazard can be considered to be negligible.

(e.g., trees, grasses, brush, etc.) There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

A thin layer of ice crystals The principal effects of such events would be to Frost that form on the ground or Y C4 cause a loss of off-site power, which is addressed the surface of an E4-31

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a) earthbound object when the for weather-related LOOP scenarios in the FPIE temperature of the ground PRA model for Ginna.

or surface of the object falls below freezing. Based on this review, the Frost hazard can be considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

The principal effects of such events would be to cause a loss of off-site power, which is addressed for weather-related LOOP scenarios in the FPIE PRA model for Ginna.

Showery precipitation in the Based on this review, the Hail hazard can be Hail form of irregular pellets or Y C4 considered to be negligible.

balls of ice.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

High summer High abnormal ambient C1 The plant is designed for this hazard (C1).

Y temperature temperatures.

E4-32

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

C4 The principal effects of such events would result in elevated lake temperatures, which are monitored by station personnel in order to affect an orderly shutdown should temperatures exceed prescribed limits.

In addition, plant trips due to this hazard are covered in the definition of another event in the PRA model (e.g., transients, loss of condenser)

(C4).

Based on this review, the High Summer Temperature hazard can be considered to be negligible.

There are no configuration-specific considerations for this hazard. This hazard can be excluded from the RICT program evaluation.

The periodic maximum rise UFSAR Appendix 2A.3 (Reference [21]) discusses High tide, Lake of sea level resulting from Lake Ontario water level, which is under the Level, or River the combined effects of the Y C5 International St. Lawrence River Board of Control Stage tidal gravitational forces with supervision and direction from the exerted by the Moon and E4-33

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Enclosure 4 Docket Nos. 50-244 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models Table E4-4 Evaluation of Other External Hazards Screening Screened Hazard Definition Criterion Ginna Response (Y/N)

(Note a)

Sun and the rotation of the International Joint Commission of the United Earth. States and Canada.

Operation and regulation criteria have been developed by the Board and its staff. The regulation plan has two sets of basic rule curves for discharge using a basic storage equation and supply indicators for adjusting outflows from the lake. Seasonal adjustments to the outflow curves permit storage of water in winter, spring, and early summer and the opposite in the late summer and fall, resulting in a high operating efficiency for maximum benefits to all water users.

Thus, the basic water supply to the lake changes very slowly, permitting reasonably accurate forecasts and operating actions to maintain desired levels. Because of this, only minor concern is given to "short-term" supply changes, such as ice jams on the Niagara River or local winter floods (C5).

Subject:

Evaluation of SEP Topics II-3.A, 3.B, 3.B.1, and 3.C, April 10, 1981..

[32] NUREG-0737, "Clarification of TMI Action Plan Requirements," November 1980 (ML051400209).

[33] RG 1.78, "Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," Revision 1, December 2001 (ADAMS Accession No. ML013100014).

[34] IPEEE , Supplement to High Winds and Transportation Report, Attachment to letter from Robert C. Mecredy, Rochester Gas and Electric Corporation, to USNRC, September 8, 1988.

E4-63

ENCLOSURE 5 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

1. Introduction Section 4.0, Item 6 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation [1]

for NEI 06-09-A, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," [2] requires that the license amendment request (LAR) provide the plant-specific total CDF and LERF to confirm applicability of the limits of Regulatory Guide (RG) 1.174, Revision 1 [3]. (Note that RG 1.174, Revision 2 [4], issued by the NRC in May 2011, did not revise these limits.)

The purpose of this enclosure is to demonstrate that the R.E. Ginna Nuclear Power Plant (REG) total Core Damage Frequency (CDF) and total Large Early Release Frequency (LERF) are below the guidelines established in RG 1.174. RG 1.174 does not establish firm limits for total CDF and LERF, but it recommends that risk-informed applications be implemented only when the total plant risk is no more than about 1E-4/year for CDF and 1E-5/year for LERF.

Demonstrating that these limits are met confirms that the risk metrics of NEI 06-09-A can be applied to the REG Risk-Informed Completion Time (RICT) Program.

2. Technical Approach Table E5-1 lists the REG CDF and LERF point estimate values that resulted from a quantification of the baseline internal events (including internal flooding) model GN119A-ASM-002 [5] and fire Probabilistic Risk Assessment (PRA) model GI120AF0 [6]. This table also includes an estimate of the seismic contribution to CDF and LERF based on the methodology detailed in Enclosure 4, Section 3.

Table E5-1 Total Baseline CDF/LERF REG Baseline CDF REG Baseline LERF Source Contribution Source Contribution Internal Events PRA 7.5E-06 Internal Events PRA 3.4E-07 Fire PRA 3.8E-05 Fire PRA 5.4E-07 Seismic 3.4E-06 Seismic 1.9E-06 Other External Events Screened Other External Events Screened Total Unit 1 CDF 4.9E-05 Total Unit 1 LERF 2.8E-06 As demonstrated in Table E5-1, the total CDF and total LERF are within the guidelines set forth in RG 1.174 and support small changes in risk that may occur during RICT entries following TSTF-505 implementation. Therefore, REG TSTF-505 implementation is consistent with NEI 06-09-A guidance.

E5-1

Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

3. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0, dated October 12, 2012 (ADAMS Accession No. ML12286A322 (part of ADAMS Package Accession No. ML122860402)).

3. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, November 2002.

4. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011 (Accession No. ML10091006).

5. G1-ASM-002, Revision 2, Ginna PRA 2021 Application Specific Model, March 2021.

6. G1-FQ-F001, Revision 4, Fire PRA Notebook -Fire Risk Quantification (FQ), August 2019.

E5-2

ENCLOSURE 6 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Justification of Application of At-Power PRA Models to Shutdown Modes This enclosure is not applicable to the Ginna submittal. Exelon is proposing to apply the Risk-Informed Completion Time Program only in Modes 1 and 2 and not in the shutdown Modes.

E7-1

ENCLOSURE 7 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

PRA Model Update Process E7-1

Introduction Section 4.0, Item 8 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09-A, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," (Reference 2) requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the PRA models which support the RMTS are maintained consistent with the as-built/as-operated plant.

This enclosure describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and design changes, will be identified and reviewed prior to implementation to determine if they could impact the PRA models per ER- AA-600-1015, FPIE [Full Power Internal Events] PRA Model Update (Reference 3), and ER-AA-600-1061, Fire PRA Model Update and Control (Reference 4). In addition, the procedure review process per ER-AA-600-1015 (Reference 3) will ensure all new procedure changes that could impact the PRA will be reviewed for impact to the PRA models.

The configuration control program will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models, which will be addressed by the applicable site Corrective Action Program.

Should a plant change or a discovered condition be identified that has a significant impact to the RICT Program calculations as defined by the above procedures, an unscheduled update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic updates are typically performed every two refueling cycles.

2. PRA Model Update Process Internal Event, Internal Flood, and Fire PRA Model Maintenance and Update The Fleet risk management PRA model maintenance and update process ensures that the applicable PRA models used for the RICT Program reflect the as-built/as-operated plant for Ginna Unit 1. The PRA configuration control process delineates the responsibilities and guidelines for updating the full power internal events, internal flood, and fire PRA models, and includes both periodic and unscheduled PRA model updates.

The process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the real time risk model.

Changes that are considered an upgrade per the ASME/ANS PRA standard receive a peer E7-1

review focused on those aspects of the PRA model that represent the upgrade.

Review of Plant Changes for Incorporation into the PRA Model

1. Plant changes or discovered conditions are reviewed for potential impact to the PRA models, including the real time risk model and the subsequent risk calculations which support the RICT Program (NEI 06-09-A, Section 2.3.4, Items 7.2 and 7.3, and 2.3.5, Items 9.2 and 9.3).

2. Plant changes that meet the criteria defined in References 3 and 4 (including consideration of the cumulative impact of other pending changes) will be incorporated in the applicable PRA model(s), consistent with the NEI 06-09-A guidance. Otherwise, the change is assigned a priority and is incorporated at a subsequent periodic update consistent with procedural requirements. (NEI 06-09-A, Section 2.3.5, Item 9.2)

3. PRA updates for plant changes are performed at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A (NEI 06-09-A, Section 2.3.4, Item 7.1, and 2.3.5, Item 9.1).

4. If a PRA model change is required for the real time risk model, but cannot be immediately implemented for a significant plant change or discovered condition, either:

a. Interim analyses to address the expected risk impact of the change will be performed.

In such a case, these interim analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A.

OR

b. Appropriate administrative restrictions on the use of the RICT Program for extended Completion Times are put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9.3.

E7-2

3. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

3. ER-AA-600-1015, "FPIE PRA Model Update."

4. ER-AA-600-1061, "Fire PRA Model Update and Control.

E7-3

ENCLOSURE 8 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Attributes of the Real-Time Risk Model

ENCLOSURE 8 Attributes of the Real Time Risk Model

1. Introduction Section 4.0, Item 9 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation [1] for NEI 06-09-A, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," [2] requires that the license amendment request (LAR) provide a description of PRA models and tools used to support the RMTS. This includes identification of how the baseline probabilistic risk assessment (PRA) model is modified for use in the configuration risk management program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. NEI 06-09-A, Revision 0, uses the term CRMP for the program controlling the use of RMTS. This term is also used to designate the program implementing 10 CFR 50.65(a)(4) and the monitoring program for other risk informed LARs. To avoid confusion the term Risk-Informed Completion Time (RICT) program is used to indicate the program required by NEI 06-09-A, Revision 0, in lieu of the term CRMP. This item should also confirm that the RICT program tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant-specific submittal.

This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the real time risk (RTR) tool to support the RICT Program. The process employed to adapt the baseline models is demonstrated:

a) to preserve the Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) quantitative results; b) to maintain the quality of the peer-reviewed PRA models; and c) to correctly accommodate changes in risk due to configuration-specific considerations.

Quality controls and training programs applicable for the RICT Program are also discussed in this enclosure.

2. Translation of Baseline PRA Model for Use in Configuration Risk The baseline PRA models for internal events, including internal flood and internal fire, are the peer-reviewed models. These models are updated when necessary to incorporate plant changes to reflect the as-built/as-operated plant. The internal flood model is integrated into the internal events model. These models will be used in the RICT Program. The models may be optimized for quantification speed but are verified to provide the same result as the baseline models in accordance with approved procedures.

The Real Time Risk (RTR) tool will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. The PRA Models utilize system initiator event fault trees so equipment unavailabilities are captured explicitly in these system E8-1

ENCLOSURE 8 Attributes of the Real Time Risk Model initiator fault trees. Therefore, no adjustment to initiating event frequencies are required within the RTR tool.

The baseline PRA models are modified as follows for use in configuration risk calculations:

The unit availability factor is set to 1.0 (unit available).

Maintenance unavailability is set to zero/false unless unavailable due to the configuration.

Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.

For systems where some trains or components are in service and some in standby or there are seasonal dependencies, the RTR tool addresses the actual configuration of the plant as needed.

Changes in success criteria based on the time in the core operating cycle (i.e., impact on ATWS pressure relief) will be addressed in the Real Time Risk Model.

The configuration risk software is designed to quantify the unit-specific configuration for both internal events, including internal flooding and fire, and includes the seismic risk contribution when calculating the Risk Management Action Times (RMAT) and RICT. Full quantifications will be used for each configuration. Pre-solved cutsets will be limited to results for specific configurations. For configurations without pre-solved cutsets, the model will be quantified to produce cutsets for the previously unanalyzed configuration. If there are any changes in the underlying PRA, the PRA results database in PARAGON will be updated in accordance with the RTR update procedure. The unique aspect of the configuration risk software for the RICT program is the quantification of fire risk and the inclusion of the seismic risk contribution. The other adjustments above are those used for the evaluation of risk under the 10CFR 50.65(a)(4) program.

The R.E. Ginna Nuclear Power Plant (REG) PRA calculates Common Cause Basic Event (CCBE) probabilities from alpha factors and places the basic events under appropriate gates in the fault tree.

Adjustments to the Common Cause Failure (CCF) grouping or CCF probabilities are not necessary when a component is taken out-of-service for preventative maintenance:

The component is not out-of-service for reasons subject to a potential common cause failure, and so the in-service components are not subject to increases in common cause probabilities. CCF relationships are retained for the remaining in-service components.

The net failure probability for the in-service components includes the CCF contribution of the out-of-service component.

As described in Regulatory Guide (RG) 1.177 [6], Section A-1.3.2.2, the CCF term should be treated differently when a component is taken down for preventive maintenance (PM) than as described for failure of a component. For PMs, the common cause factor is changed so that E8-2

ENCLOSURE 8 Attributes of the Real Time Risk Model the model represents the unavailability of the remaining component. In the example provided in Reg Guide 1.177 for a 2-train system, the CCF event can be set to zero for PMs. This is done so that the model represents the unavailability of the remaining component, and not the common cause multiplier. The REG approach is conservative in that for a 2-train system, the CCF event is retained for the component removed from service. Likewise, for systems with three or more trains, the CCF events that are related to the out-of-service component are retained.

The Vogtle RICT Safety Evaluation [5] describes the Vogtle approach for modeling common cause events with planned inoperability: "For planned inoperability, the licensee sets the appropriate independent failure to 'true' and makes no other changes while calculating a RICT." The REG approach is the same as this Vogtle approach.

It is recognized that other modifications could be made to CCF factors for planned maintenance, particularly for common cause groups of three or more components. For example, in the Safety Evaluation (SE) in the Vogtle RICT Amendment [5], the NRC identifies a possible planned maintenance CCF modification to "modify all the remaining basic event probabilities to reflect the reduced number of redundant components."

Like Vogtle, the REG CCF approach is a straightforward simplification that has inherent uncertainties. In the context of modifying CCF basic events for PMs, the Vogtle SE states the following:

"The NRC staff also notes that common cause failure probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce non-conservative results and because the calculations reasonably include common cause failures consistent with the accuracy of the estimates." [5]

The REG approach for CCF during PMs is the same as the Vogtle approach; therefore, the REG CCF approach is acceptable for RICT calculations and adjusting the common cause grouping is not necessary for PMs. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

For emergent conditions where the extent of condition is not completed prior to entering into the RMAT or the extent of condition cannot rule out the potential for common cause failure, common cause Risk Management Actions (RMAs) are expected to be implemented to mitigate common cause failure potential and impact, in accordance with Exelon procedures.

This is in line with the guidance of NEI 06-09-A [2] and precludes the need to adjust CCF probabilities. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

E8-3

ENCLOSURE 8 Attributes of the Real Time Risk Model

3. Quality Requirements and Consistency of PRA Model and Configuration Risk Tools The approach for establishing and maintaining the quality of the PRA models, including the configuration risk model, includes both a PRA maintenance and update process (described in ), and the use of self-assessments and independent peer reviews (described in ).

The information provided in Enclosure 2 demonstrates that the site's internal event, internal flood, and internal fire PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide 1.200 [3]. This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.

For maintenance of an existing configuration risk model, changes made to the baseline PRA model in translation to the configuration risk model will be controlled and documented. Every PRA Model of Record (MOR) update results in an update to the RTR model in accordance with the FPIE and Fire PRA update procedures. Acceptance testing is performed after every configuration risk model update. This testing also verifies correct mapping of plant components to the basic events in the configuration risk model. The RTR model documentation includes changes made to the MOR model files to work with the RTR model software (e.g., quantification settings) along with verification that results are consistent between the MOR and RTR zero maintenance results. In addition, the RTR update for the MOR includes quantifying the RTR model for representative maintenance configurations and examining the results for appropriateness. These actions are procedurally controlled.

4. Training and Qualification The PRA staff is responsible for development and maintenance of the configuration risk model.

Operations and Work Control staff will use the configuration risk tool under the RICT Program.

PRA Staff and Operations are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is also accredited by INPO.

5. Application of the Configuration Risk Tool to the RICT Program Scope The PARAGON software will be used to facilitate all configuration-specific risk calculations for the RICT Program implementation. This program is specifically designed to support implementation of RMTS. PARAGON will permit the user to evaluate all plant configurations using appropriate mapping of equipment to PRA basic events. The equipment in the scope of the RICT program will be able to be evaluated in the appropriate PRA models. The RICT program will meet RG 1.174 [4] and Exelon software quality assurance requirements.

E8-4

ENCLOSURE 8 Attributes of the Real Time Risk Model

6. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI),"Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines,'" dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009.

4. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011.

5. Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Regarding Implementation of Topical Report Nuclear Energy Institute NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specification (RMTS)

Guidelines," Revision 0-A (CAC NOS. ME9555 and ME9556), ML15127a669.

6. Nuclear Regulatory Commission, Regulatory Guide 1.177, May 2011, Revision 1.

E8-5

ENCLOSURE 9 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Key Assumptions and Sources of Uncertainty

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty

1. Introduction The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.

Topical Report NEI 06-09-A (Reference 1), Section 2.3.4, item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties. The baseline internal events PRA and Fire PRA (FPRA) models document assumptions and sources of uncertainty and these were reviewed during the model peer reviews. The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT Program.

The epistemic uncertainty analysis approach described below applies to the internal events PRA and any epistemic uncertainty impacts that are unique to FPRA are also addressed. In addition, Topical Report NEI 06-09-A requires that the uncertainty be addressed in RICT Program Configuration Risk Management Program (CRMP) tools by consideration of the translation from the PRA model to the CRMP tool. The CRMP or real time risk model, also referred to as the PARAGON model, discussed in Enclosure 8 includes internal events, flooding events and fire events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the real time risk tool during RICT Program calculations.

2. Assessment of Internal Events PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty for RICT Program application, an evaluation of internal events baseline PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and Electric Power Research Institute (EPRI) report 1016737 (Reference 3). As described in NUREG-1855, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the Ginna baseline PRA model quantification (Reference 4) and the Fire PRA uncertainty evaluation (Reference 8).

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions made for each of the Ginna internal events PRA technical elements are noted in the individual notebooks. These assumptions are reviewed to identify potential key sources of uncertainty. The internal events PRA model uncertainties evaluation is documented in Reference 11 and considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 3), and the evaluation performed for Ginna (Reference 11) considered each of the generic sources of modeling uncertainty as well as the plant-specific sources.

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to E9-1

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty the TSTF-505 application, based on the results of the internal events PRA and fire PRA peer reviews.

Additionally, an evaluation of Level 2 internal events PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and Electric Power Research Institute (EPRI) report 1026511 (Reference 5). The potential sources of model uncertainty in the Ginna PRA model were evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511. It has been concluded that the Level 2 related uncertainties outlined in EPRI 1026511 do not present a significant impact on the Ginna RICT calculations.

Based on following the methodology in EPRI 1016737 as supplemented by EPRI 1026511 for a review of sources of uncertainty, the impact of potential sources of uncertainty on the RICT application is discussed in Table E9-1, which identifies those potential sources that may be key sources of uncertainty for the RICT program. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.

Table E9-1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Source of Uncertainty and Impacted TS Model Sensitivity and Assumptions LCOs Disposition The Loss of Offsite Power (LOOP) LCOs for which The overall approach for the frequency and fail to recover offsite LOOP scenarios LOOP frequency and failure to power probabilities are based on have an effect recover probabilities utilized is available industry data. on the RICT. consistent with industry practice and are representative of Ginna.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

Use of 24-hour mean-time-to-repair RICT analysis The use of SSIE fault trees (MTTR) in support system initiating that involve provides an improved event trees. components assessment of component modeled in importances. The use of a 24 initiating event MTTR is reasonable and follows trees. industry convention. MTTR is typically less than 24-hours.

This does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E9-2

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Source of Uncertainty and Impacted TS Model Sensitivity and Assumptions LCOs Disposition Uncertainties associated with the Potentially all Sensitivity cases performed using assumptions and method of calculation LCOs in the the base internal events PRA of Human Error Probabilities (HEPs) for RICT program. (HEP values of 0.0 or use of the the Human Reliability Analysis (HRA) 95th percentile value HEPs) may introduce uncertainty. indicate some sensitivity to human performance. Use of 95th percentile HEPs for applications Detailed evaluations of HEPs are is not considered realistic given performed for the risk significant human the consistent use of a failure events (HFEs) using industry consensus HRA approach.

consensus methods. Mean values are used for the modeled HEPs. The Ginna PRA model is based Uncertainty associated with the mean on industry consensus modeling values can have an impact on CDF and approaches for its HEP LERF results. calculations, so this is not considered a significant source of epistemic uncertainty.

However, the TSTF-505 process requires appropriate risk management action (RMA) development, including those related to operator actions in the PRA that are pertinent to the RICT configuration. Refer to Enclosure 12 for additional discussion on RMAs.

Common cause failure values are Potentially all The Ginna PRA model is based developed using available industry LCOs in the on industry consensus modeling data. RICT program. approaches for its common cause identification and value determination, so this is not considered a significant source of epistemic uncertainty.

In the RICT process, common cause failures will be addressed through risk management actions.

E9-3

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Source of Uncertainty and Impacted TS Model Sensitivity and Assumptions LCOs Disposition Core-melt arrest in-vessel is credited None identified. The probability of core melt arrest for SBO LERF sequences, using a is not a significant contributor to conditional probability. risk. The Ginna LERF model is dominated by bypass events.

For other accident sequences, CDF is the predominant important measure for RICT.

This does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E9-4

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty

3. Assessment of Translation (RTR Model) Uncertainty Impacts Incorporation of the baseline PRA models into the RTR model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-2 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to Enclosure 8 for additional discussion on the RTR model.

E9-5

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-2 Assessment of Translation Uncertainty Impacts RTR Model Change Part of Model Impact on Model Disposition and Assumptions Affected PRA model logic structure may Fault tree logic model The model, if restructured, will be Since the restructured model will be optimized to increase solution structure, affecting logically equivalent and produce produce comparable numerical speed. both internal and fire results comparable to the baseline results, this is not a source of PRAs. PRA logic model. uncertainty for the RICT program.

Incorporation of seismic risk Calculation of RICT The addition of bounding impacts for Since this is a bounding approach bias to support RICT Program and RMAT within seismic events has no impact on for addressing seismic risk in the risk calculations. RTR. baseline PRA or RTR model. Impact RICT Program, it is not a source of is reflected in calculation of all RICTs translation uncertainty, and RICT A conservative value for the and RMATs. Program calculations are not seismic delta CDF is impacted, so no mandatory RMAs applicable. are required.

Set Maintenance Fault tree database. Consistent with the concept of a Creates the zero-maintenance Unavailability events to 0. zero-maintenance model, these model. Not a source of events are set to 0 in the fault tree uncertainty.

and are adjusted as components are taken out of service for planned or emergent maintenance.

Set plant availability Fault Tree Logic Since the RTR model evaluates This change is consistent with (Reactor Critical Years specific configurations during at- RTR tool practice; therefore, this Factor) basic event to 1.0. power conditions, the use of a plant change does not represent a availability factor less than 1.0 is source of uncertainty, and RICT not appropriate. This change allows program calculations are not the RTR model to produce impacted, so no mandatory RMAs appropriate results for specific at- are required.

power configurations.

E9-6

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-2 Assessment of Translation Uncertainty Impacts RTR Model Change Part of Model Impact on Model Disposition and Assumptions Affected Ambient Air Temperature Fault Tree Logic The success criteria for some HVAC This is not a candidate source of Basic Events systems is dependent on outside air model uncertainty.

temperature, using conditional probability events based on probability of temperature over a year. In the CRMP model, these events are set to 1.0 or 0 based on actual or projected maximum outside air temperature.

Alignment events. Fault Tree Logic Alignment flags are set to 1.0 or 0.0 This is not a source of uncertainty.

based on actual or projected alignments in the plant. For example, service water pumps may be in service, out-of-service, or in standby (and appropriately aligned).

Valve and relay Fault tree logic. For convenience, in many cases, a This introduces an acceptable Unavailability. valve or relay may be considered conservativism to the analysis. Not unavailable for both its open and a source of uncertainty. Cases that closed functions, or its energized significantly impact an evaluation and not energized functions. may be split into open/close cases or energized/de-energized case.

E9-7

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty

4. Assessment of FPRA Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the Ginna FPRA. The Ginna FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA and because the state of knowledge in these elements continues to evolve. The development of the Ginna FPRA was guided by NUREG/CR-6850 (Reference 6). The Ginna FPRA model used consensus models within the areas described in NUREG/CR-6850.

Ginna used guidance provided in NUREG/CR-6850 and NUREG-1855 (Reference 2) to address uncertainties associated with FPRA for the RICT Program application. As stated in Section 1.5 of NUREG-1855:

Although the guidance in this report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision-making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards.

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It states:

A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time. In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time.

NUREG-1855 defines a consensus model as:

A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that the NRC has utilized or accepted for the specific risk-informed application for which it is proposed.

E9-8

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty The plant-specific assumptions in the Ginna FPRA (Reference 8) and the 71 potential sources of uncertainty identified in EPRI 1026511 (Reference 5) were evaluated for their potential impact on the RICT application. The EPRI guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850.

As noted above, the Ginna FPRA was developed using consensus methods in areas outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. Further, appropriate cable impacts were identified for the systems modeled in the Internal Events PRA and were modeled in the Fire PRA. Fire PRA methods were based on NUREG/CR-6850, other more recent NUREGs, e.g., NUREG-7150 (Reference 7), and published frequently asked questions (FAQs) for the FPRA.

Table E9-3 summarizes the results of the plant specific review and EPRI 1026511 review within the Topic Areas outlined by NUREG/CR-6850.

The evaluation of sources of model uncertainty in the FPRA and associated sensitivity studies identified two modeling uncertainties that are be candidates for RMAs for this application. These are:

Human error probabilities in the fire PRA In the RICT application, HEPs that contribute significantly to CDF or LERF when technical specification equipment is removed from service are briefed as part of the RMAs. This addresses any uncertainty associated with HEPs.

Assumptions regarding impact of transient fires In the RICT application, fire ignition sources including transient fire that contribute significantly to CDF or LERF when technical specification equipment is removed from service are controlled to reduce ignition likelihood as part of the RMAs. This helps to address any uncertainty associated with ignition frequencies including transient fires.

E9-9

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 1 Analysis This task establishes the overall spatial Based on a review of the assumptions and potential boundary and scope of the analysis and provides a sources of sources of uncertainly associated with partitioning framework for organizing the data for the this element it is concluded that the methodology for analysis. The partitioning features credited the Analysis Boundary and Partitioning task does not are required to satisfy established industry introduce any epistemic uncertainties that would standards. affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

2 Component This task involves the selection of components In the context of the FPRA, one of the uncertainty Selection to be treated in the analysis in the context of issues that is unique to the analysis is related to initiating events and mitigation. The potential initiating event identification. However, that impact is sources of uncertainty include those inherent in minimized through use of the PWROG Generic Multiple the internal events PRA model as that model Spurious Operation (MSO) list and the process used to provides the foundation for the FPRA. identify and assess potential MSOs.

As part of the Fire PRA, a small set of loads associated with uncoordinated cabling were assigned bounding routes. This was only done in the case of extremely low significance loads.

A bounding sensitivity analysis was performed to measure the risk associated with this bounding routing.

This concluded no significant impact.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-10

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 3 Cable Selection The selection of cables to be considered in the Based on a review of the assumptions and potential analysis is identified using industry guidance sources of uncertainty related to this element it is documents. The overall process is essentially concluded that the methodology for the Cable Selection the same as that used to perform the analyses task does not introduce any epistemic uncertainties to demonstrate compliance with 10 CFR 50.48. that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

4 Qualitative Qualitative screening was performed; however, In the event a structure (location) which could result in Screening some structures (locations) were eliminated a plant trip was incorrectly excluded, its contribution to from the global analysis boundary and ignition CDF would be small (with a CCDP commensurate with sources deemed to have no impact on the base risk). Such a location would have a negligible risk FPRA (based on industry guidance and criteria) contribution to the overall FPRA.

were excluded from the quantification based on qualitative screening criteria. The only criterion Based on a review of the assumptions and potential subject to uncertainty is the potential for plant sources of uncertainty related to this element and the trip. However, such locations would not discussion above, it is concluded that the methodology contain any features (equipment or cables for the Qualitative Screening task does not introduce identified in the prior two tasks) and any epistemic uncertainties that would affect the RICT consequently are expected to have a low risk calculation.

contribution.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-11

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 5 Fire-Induced The internal events PRA model was updated to The identified source of uncertainty could result in the Risk Model add fire specific initiating event structure as over-estimation of fire risk. In general, the FPRA well as additional system logic. The development process would have reviewed significant methodology used is consistent with that used fire initiating events and performed supplemental for the internal events PRA model assessments to address this possible source of development as was subjected to industry uncertainty.

Peer Review.

Based on a review of the assumptions and potential The developed model is applied in such a sources of uncertainty related to this element and the fashion that all postulated fires are assumed to discussion above, it is concluded that the methodology generate a plant trip. This represents a source for the Fire-Induced Risk Model task does not of uncertainty, as it is not necessarily clear that introduce any epistemic uncertainties that would affect fires would result in a trip. In the event the fire the RICT calculation.

results in damage to cables and/or equipment identified in Task 2, the PRA model includes Therefore, RICT program calculations are not structure to translate them into the appropriate impacted, and no RMAs are required to address this induced initiator. item.

E9-12

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 6 Fire Ignition Fire ignition frequency is an area with inherent Based on a review of the assumptions and potential Frequency uncertainty. Part of this uncertainty arises due sources of uncertainty related to this element it is to the counting and related partitioning concluded that the methodology for the Fire Ignition methodology. Frequency task does not introduce any epistemic uncertainties that would affect the RICT calculation.

However, the resulting frequency is not particularly sensitive to changes in ignition Consensus approaches are employed in the model.

source counts. The primary source of uncertainty for this task is associated with the Therefore, RICT program calculations are not industry generic frequency values used for the impacted, and no RMAs are required to address this FPRA. This is because there is no specific item.

treatment for variability among plants along with some significant conservatism in defining the frequencies, and their associated heat release rates. GINNA uses the ignition frequencies in NUREG-2169 (Reference 9) along with the revised heat release rates from NUREG-2178 (Reference 10).

E9-13

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 7 Quantitative Other than screening out potentially risk The GINNA FPRA did not screen out any fire Screening significant scenarios (ignition sources), this scenarios based on low CDF/LERF contribution. That task is not a source of uncertainty. is, quantified fire scenarios results are retained in the cumulative CDF/LERF.

Based on the discussion above, it is concluded that the methodology for the Quantitative Screening task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

8 Scoping Fire The framework of NUREG/CR-6850 includes See Task 11 discussion.

Modeling two tasks related to fire scenario development.

These two tasks are 8 and 11. The discussion of uncertainty for both tasks is provided in the discussion for Task 11.

E9-14

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 9 Detailed The circuit analysis is performed using Circuit analysis was performed as part of the Circuit Failure standard electrical engineering principles. deterministic post fire safe shutdown analysis.

Analysis However, the behavior of electrical insulation Refinements in the application of the circuit analysis properties and the response of electrical results to the FPRA were performed on a case-by-case circuits to fire induced failures is a potential basis where the scenario risk quantification was large source of uncertainty. This uncertainty is enough to warrant further detailed analysis. Hot short associated with the dynamics of fire and the probabilities and hot short duration probabilities as inability to ascertain the relative timing of circuit defined in NUREG-7150, Volume 2, based on actual failures. The analysis methodology assumes fire test data, were used in the GINNA Fire PRA. The failures would occur in the worst possible uncertainty (conservatism) which may remain in the configuration, or if multiple circuits are FPRA is associated with scenarios that do not involved, at whatever relative timing is required contribute significantly to the overall fire risk.

to cause a bounding worst-case outcome. This results in a skewing of the risk estimates such Based on a review of the assumptions and potential that they are over-estimated. sources of uncertainty related to this element and the discussion above, it is concluded that the methodology for the Detailed Circuit Failure Analysis task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-15

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 10 Circuit Failure One of the failure modes for a circuit (cable) The use of hot short failure probability and duration Mode given fire induced failure is a hot short. A probability is based on fire test data and associated Likelihood conditional probability and a hot short duration consensus methodology published in NUREG/CR-Analysis probability are assigned using industry 7150, Volume 2.

guidance published in NUREG/CR-7150, Volume 2 (Reference 7). The uncertainty Based on a review of the assumptions and potential values specified in NUREG/CR-7150, Volume sources of uncertainty related to this element and the 2 are based on fire test data. discussion above, it is concluded that the methodology for the Circuit Failure Mode Likelihood Analysis task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-16

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty 11 Detailed Fire The application of fire modeling technology is Consensus modeling approach is used for the Modeling used in the FPRA to translate a fire initiating Detailed Fire Modeling.

event into a set of consequences (fire induced failures). The performance of the analysis The methodology for the Detailed Fire Modeling task requires a number of key input parameters. does not introduce any epistemic uncertainties that These input parameters include the heat affect the RICT calculation.

release rate (HRR) for the fire, the growth rate, the damage threshold for the targets, and However, given the nature of postulated transient fire response of plant staff (detection, fire control, scenarios that can be controlled in some cases, fire suppression). consideration should be given to appropriate risk management actions, e.g., to limit transient The fire modeling methodology itself is largely combustibles and hot work in fire areas that are empirical in some respects and consequently important to the configuration-specific CDF/LERF is another source of uncertainty. For a given results.

set of input parameters, the fire modeling results (temperatures as a function of distance Therefore, RICT program calculations are not from the fire) are characterized as having impacted.

some distribution (aleatory uncertainty). The epistemic uncertainty arises from the selection of the input parameters (specifically the HRR and growth rate) and how the parameters are related to the fire initiating event. While industry guidance is available, that guidance is derived from laboratory tests and may not necessarily be representative of randomly occurring events.

The fire modeling results using these input parameters are used to identify a zone of influence (ZOI) for the fire and cables/equipment within that ZOI are assumed to be damaged. In general, the guidance provided for the treatment of fires is conservative and the application of that guidance retains that conservatism. The resulting risk estimates are also conservative.

E9-17

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 12 Post-Fire The human error probabilities (HEPs) used in The HEPs include the consideration of degradation or Human the FPRA were adjusted to consider the loss of necessary cues due to fire. The fire risk Reliability additional challenges that may be present importance measures indicate that the results are Analysis given a fire. The HEPs were obtained using the somewhat sensitive to HRA model and parameter EPRI HRAC and included the consideration of values. The GINNA FPRA model HRA is based on degradation or loss of necessary cues due to industry consensus modeling approaches for its HEP fire. Given the methodology used, the impact calculations, so this is not considered a significant of any remaining uncertainties is expected to source of epistemic uncertainty.

be small.

Assuming no credit for operator response is not realistic. However, given the nature of human error probability development, the TSTF-505 procedure will require appropriate risk management action (RMA) focus on human performance for RICT entry, e.g.,

including an operator briefing on the significant human actions in the PRA that are pertinent to the configuration.

E9-18

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 13 Seismic-Fire Since this is a qualitative evaluation, there is The qualitative assessment of seismic induced fires Interactions no quantitative impact with respect to the should not be a source of model uncertainty as it is not Assessment uncertainty of this task. expected to provide changes to the quantified FPRA model. A conservative seismic hazard penalty is applied to all RICT calculations to account for seismic risk impact.

Based on the discussion above, it is concluded that the methodology for the Seismic-Fire Interactions Assessment task does not introduce any epistemic uncertainties that affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

14 Fire Risk As the culmination of other tasks, most of the The selected truncation was confirmed to be Quantification uncertainty associated with quantification has consistent with the requirements of the PRA already been addressed. The other source of Standard.

uncertainty is the selection of the truncation limit. However, the selected truncation was Based on a review of the assumptions and potential confirmed to be consistent with the sources of uncertainty related to this element and the requirements of the PRA Standard. discussion above, it is concluded that the methodology for the Fire Risk Quantification task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-19

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty Table E9-3 Fire PRA Sources of Model Uncertainty Task Description Sources of Uncertainty Disposition for RICT Application 15 Uncertainty This task does not introduce any new This task does not introduce any new uncertainties.

and Sensitivity uncertainties. This task is intended to address This task is intended to address how the fire risk Analyses how the fire risk assessment could be assessment could be impacted by the various impacted by the various sources of uncertainty. sources of uncertainty.

The Uncertainty and Sensitivity Analyses task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

16 FPRA This task does not introduce any new This task does not introduce any new uncertainties to Documentation uncertainties to the fire risk. the fire risk as it outlines documentation requirements.

The methodology for the FPRA documentation task does not introduce any epistemic uncertainties that would affect the RICT calculation.

Therefore, RICT program calculations are not impacted, and no RMAs are required to address this item.

E9-20

ENCLOSURE 9 Key Assumptions and Sources of Uncertainty

5. References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

2. NUREG-1855, Revision 1, Guidance on the treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report, July 2016.

3. Electric Power Research Institute (EPRI) Technical Report TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008.

4. G1-PRA-014, Revision 2, Ginna PRA Quantification Notebook, March 2019.

5. Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012.

6. NUREG/CR-6850 (also EPRI 1011989), Fire PRA Methodology for Nuclear Power Facilities, September 2005, with Supplement 1 (EPRI 1019259), September 2010.

7. NUREG/CR-7150, Vol. 1, (also EPRI 3002001989), Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 2: Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure, U.S. NRC and Electric Power Research Institute, Final Report, May 2014.

8. G1-UNC-F001, Revision 3, Fire PRA Notebook Uncertainty and Sensitivity Analysis (UNC), Revision 3, July 2015.

9. NUREG-2169 (also EPRI 3002002936) Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database," U.S.

NRC and Electric Power Research Institute, January 2015.

10. NUREG-2178, Volume 1 (also EPRI 3002005578), "Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE) Volume 1: Peak Heat Release Rates and Effect of Obstructed Plume, ," U.S. Nuclear Regulatory Commission, April 2016.

11. G1-MISC-026, Revision 0, Assessment of Key Assumptions and Sources of Uncertainty for the R.E. Ginna PRA, April 2020.

E9-21

ENCLOSURE 10 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Program Implementation

1. Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference

2) requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk Managed Technical Specifications (RMTS) implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT).

This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including training of plant personnel, and specifically discusses the decision process for RMA implementation during extended Completion Times (CT).

2. RICT Program and Procedures Exelon will develop a program description and implementing procedures for the RICT Program.

The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT program. The program description and implementing procedures will incorporate the programmatic requirements for RMTS included in NEI 06-09-A. The program will be integrated with the online work control process. The work control process currently identifies the need to enter an LCO Action statement as part of the planning process and will additionally identify whether the provisions of the RICT program are required for the planned work. The risk thresholds associated with 10CFR50.65(a)(4) will be coordinated with the RICT limits. The Maintenance Rule performance monitoring provisions and Mitigating System Performance Index (MSPI) thresholds will assist in controlling the amount of risk expended in use of the RICT program.

The Operations Department (licensed operators) is responsible for compliance with the TS and will be responsible for implementation of RICTs and RMAs. Entry into the RICT program will require management approval prior to pre-planned activities and as soon as practicable following emergent conditions.

The procedures for the RICT program will address the following attributes consistent with NEI 06-09-A:

Plant management positions with authority to approve entry into the RICT Program.

Important definitions related to the RICT Program.

Departmental and position responsibilities for activities in the RICT Program.

Plant conditions for which the RICT Program is applicable.

Limitations on implementing RICTs under voluntary and emergent conditions.

Implementation of the RICT Program 30-day back stop limit.

Use of the Real-Time Risk tool.

Guidance on recalculating RICT and risk management action time (RMAT) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or within the most limiting front-stop CT after a plant configuration change.

E10-1

Requirements to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded, and to consider common cause failure potential in emergent RICTs.

Guidance on the use of RMAs including the conditions under which they may be credited in RICT calculations.

Conditions for exiting a RICT.

Requirements for training on the RICT Program.

Documentation requirements related to individual RICT evaluations, implementation of extended CTs, and accumulated annual risk.

3. RICT Program Training The scope of training for the RICT Program will include rules for the new TS program, Real-Time Risk tool software, TS Actions included in the program, and procedures. This training will be conducted for the following Exelon personnel:

Site Personnel

Operations Director

Operations Personnel (Licensed and Non-Licensed)

Operations Training

Outage Manager

On-line Manager

Planning and Scheduling Personnel

Work Week Managers

Regulatory Assurance Personnel

Selected Maintenance Personnel

Engineering

Risk Management

Other Selected Management Corporate Personnel

Operations Corporate Functional Area Manager

Fleet Outages Corporate Functional Area Manager

Licensing Management and Personnel

Risk Management Personnel and Managers

Training Management and Personnel

Other Selected Management Training will be carried out in accordance with Exelon training procedures and processes. These procedures were written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training. Exelon has planned three levels of training for implementation of the RICT Program. They are described below:

E10-2

Level 1 Training This is the most detailed training. It is intended for the individuals who will be directly involved in the implementation of the RICT Program. This level of training includes the following attributes:

Specific training on the revised TS

Record keeping requirements

Case studies

Hands-on experience with the Real-Time Risk tool for calculating RMAT and RICT

Identifying appropriate RMAs

Common cause failure RMA considerations in emergent RICTs

Other detailed aspects of the RICT Program Level 2 Training This training is applicable to plant management positions with authority to approve entry into the RICT Program, as well as supervisors, managers, and other personnel who will closely support RICT implementation. These individuals need a broad understanding of the purpose, concepts, and limitations of the RICT Program. Level 2 training is significantly more detailed than Level 3 training (described below), but it is different from Level 1 training in that hands-on time with the Real-Time Risk tool, case studies, and other specifics are not required.

Level 3 Training This training is intended for the remaining personnel who require an awareness of the RICT Program. These employees need basic knowledge of the RICT Program requirements and procedures. This training will cover the RICT Program concepts that are important to disseminate throughout the organization.

4. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines,'" dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

E10-3

ENCLOSURE 11 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Monitoring Program

1. Introduction Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1 (Reference 3), and NEI 06-09-A (Reference 2).

(Note that RG 1.174, Revision 2 [Reference 4], issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation for Section 4.0, Item 12.)

This enclosure provides a description of the process applied to monitor the cumulative risk impact of implementation of the Risk-Informed Completion Time (RICT) Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A, Risk Informed Technical Specifications Initiative 4b (Reference 2). General requirements for a Performance Monitoring Program for risk-informed applications are discussed in Element 3 of Regulatory Guide 1.174 (Reference 3).

2. Description of Monitoring Program The RICT Program will require calculation of cumulative risk impact at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09-A (Reference 2). For the assessment period under evaluation, data will be collected for the risk increase associated with each application of an extended CT for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk will be calculated by summing all risk associated with each RICT application. This summation is the change in CDF or LERF above the zero maintenance baseline levels during the period of operation in the extended CT (i.e., beyond the front-stop CT). The change in risk will be converted to average annual values.

The total average annual change in risk for extended CTs will be compared to the guidance of RG 1.174, Figures 4 and 5 (Reference 4), acceptance guidelines for CDF and LERF, respectively.

If the actual annual risk increase is acceptable (i.e., not in Region I of Figures 4 and 5 of RG 1.174), then RICT program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the acceptance guidelines of RG 1.174 and implementation of any necessary corrective actions to ensure future plant operation is within the guidelines will be conducted under the corrective action program.

The evaluation of cumulative risk will also identify areas for consideration, such as:

RICT applications that dominated the risk increase

Risk contributions from planned vs. emergent RICT applications

Risk Management Actions (RMAs) implemented but not credited in the risk calculations

Risk impact from applying RICT to avoid multiple shorter duration outages

Any specific RICT application that incurred a large proportion of the risk Based on a review of the considerations above, corrective actions will be developed and implemented as appropriate. These actions may include:

Administrative restrictions on the use of RICTs for specific high-risk configurations E11-1

Additional RMAs for specific configurations

Rescheduling planned maintenance activities

Deferring planned maintenance to shutdown conditions

Use of temporary equipment to replace out-of-service systems, structures, or components (SSCs)

Plant modifications to reduce risk impact of future planned maintenance configurations In addition to impacting cumulative risk, implementation of the RICT Program may potentially impact the unavailability of SSCs. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts which may be incurred from implementation of the RICT Program. The SSCs in the scope of the RICT Program are also in the scope of the MR, which allows the use of the MR Program.

The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as described in Element 3 of RG 1.174 (Reference 3) and NEI 06-09-A (Reference 2).

3. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'" dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322).

3. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, November 2002.

4. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011.

E11-2

ENCLOSURE 12 License Amendment Request R. E. Ginna Nuclear Power Plant Docket No. 50-244 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Risk Management Action Examples

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244

1. Introduction This enclosure describes the process for identification and implementation of Risk Management Actions (RMA) applicable during extended Completion Times (CT) and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program consistent with the guidance provided in NEI 06-09, Revision 0-A (Reference 1).

2. Responsibilities For planned entries into the RICT Program, Work Management is responsible for developing the RMAs with assistance from Operations and Risk Management. Operations is responsible for approval and implementation of RMAs. For emergent entry into extended CTs, Operations is also responsible for developing the RMAs with support from work management and/or risk management as needed.

3. Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the Risk Management Action Time (RMAT) will be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs requiring recalculation of a RMAT already in place, the procedure will require a reevaluation of the existing RMAs for the new plant configuration to determine if new RMAs are appropriate.

These requirements of the RICT Program are consistent with the guidance of NEI 06-09.

For emergent entry into a RICT, if the extent of condition is not known, RMAs related to the success of redundant and diverse SSCs and reducing the likelihood of initiating events relying on the affected function will be developed and implemented to address the increased likelihood of a common cause event.

RMAs will be implemented in accordance with current procedures (e.g., References 2, 3, 4, and

5) no later than the time at which an Incremental Core Damage Probability (ICDP) of 1E-6 is reached, or no later than the time when an Incremental Large Early Release Probability (ILERP) of 1E-7 is reached. If, as the result of an emergent condition, the Instantaneous Core Damage Frequency (ICDF) or the Instantaneous Large Early Release Frequency (ILERF) exceeds 1E-3 per year or 1E-4 per year, respectively, RMAs are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09.

By determining which Structures, Systems, or Components (SSCs) are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. The guidance in NUREG-1855 (Reference 6) and EPRI TR-1026511 (Reference 7) will be used in examining PRA results for significant contributors for the configuration, to aid in identifying appropriate compensatory measures (e.g., related to risk-significant systems that may provide diverse protection, or important support systems or human actions). Enclosure 9 identifies several areas of uncertainty in the internal events and fire PRAs that will be considered in defining configuration-specific RMAs when entering a RICT.

E12-1

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 If the planned activity or emergent condition includes an SSC that is identified to impact Fire PRA, as identified in the current Real Time Risk Program, Fire PRA specific RMAs associated with that SSC will be implemented per the current plant procedure.

It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and operator actions are modeled in the PRA; however, such quantification of RMAs is neither required nor expected by NEI 06-09. Nonetheless, if RMAs will be credited to determine RICTs, the procedure instructions will be consistent with the guidance in NEI 06-09.

NEI 06-09 classifies RMAs into the three categories described below:

1) Actions to increase risk awareness and control.

Shift brief

Pre-job brief

Training

Presence of system engineer or other expertise related to the activity

Special purpose procedure to identify risk sources and contingency plans

2) Actions to reduce the duration of maintenance activities.

Pre-staging materials

Conducting training on mock-ups

Performing the activity around the clock

Performing walk-downs on the actual system(s) to be worked on prior to beginning work

3) Actions to minimize the magnitude of the risk increase.

Suspend or minimize activities on redundant systems

Suspend or minimize activities on other systems that adversely affect the CDF or LERF

Suspend or minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate

Use temporary equipment to provide backup power, ventilation, etc.

Reschedule other risk-significant activities Determination of RMAs involves the use of both qualitative and quantitative considerations for the specific plant configuration and the practical means available to manage risk. The scope and number of RMAs developed and implemented are reached in a graded manner.

Procedural guidance for development of RMAs in support of the RICT program builds off the RMAs developed for other processes, such as the RMAs developed under the 10CFR 50.65(a)(4) program and the protected equipment program. Additionally, Common Cause RMAs are developed to address the potential impact of common cause failures.

E12-2

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 General RMAs are developed for input into the RICT system guidelines. These guidelines are listed in site-specific T&RMs and are developed using a graded approach. Consideration is given for system functionality and includes consideration for common cause impacts within the system. These RMAs include:

Consideration of rescheduling maintenance to reduce risk

Discussion of RICT in pre-job briefs

Consideration of proactive return-to-service of other equipment

Efficient execution of maintenance In addition to the RMAs developed qualitatively for the system guidelines, RMAs are developed based on the Real-Time Risk tool to identify configuration-specific RMA candidates to manage the risk associated with internal events, internal flooding, and fire events. These actions include:

Identification of important equipment or trains for protection

Identification of important Operator Actions for briefings

Identification of key fire initiators and fire zones for RMAs in accordance with the site Fire RMA process

Identification of dominant initiating events and actions to minimize potential for initiators

Consideration of insights from PRA model cutsets, through comparison of importances Common cause RMAs are also developed to ensure availability of redundant SSCs, to ensure availability of diverse or alternate systems, to reduce the likelihood of initiating events that require operation of the out-of-service components, and to prepare plant personnel to respond to additional failures. Common cause RMAs are developed by considering the impact of loss of function for the affected SSCs.

Examples of common cause RMAs include:

Performance of non-intrusive inspections on alternate trains

Confidence runs performed for standby SSCs

Increased monitoring for running components

Expansion of monitoring for running components

Deferring maintenance and testing activities that could generate an initiating event which would require operation of potentially affected SSCs

Readiness of operators and maintenance to respond to additional failures

Shift briefs or standing orders which focus on initiating event response or loss of potentially affected SSCs Per Exelon procedure, for emergent conditions where the extent of condition is not performed prior to entering into the Risk Management Action Times or the extent of condition cannot rule out the potential for common cause failure, common cause RMAs are expected to be implemented to mitigate common cause failure potential and impact. These can include the pre-identified RMAs included in the system guidelines as discussed above, as well as alternative common cause RMAs for the specific configuration. Alternate RMAs, including both regular and common cause considerations, are developed for the specific configuration following the steps outlined above.

E12-3

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244

4. Examples Multiple example RMAs that may be considered during a RICT Program entry to reduce the risk impact and ensure adequate defense-in-depth are provided below. Specific examples are given for unavailability of one Emergency Diesel Generator (EDG), one Offsite Source, one Battery Charger, or one Residual Heat Removal (RHR) pump.

A. Emergency Diesel Generator (Using the A EDG as an example):

1) Actions to increase risk awareness and control.

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

Loss of Offsite Power events Loss of All AC events

Including Relay room flooding and fire response Loss of Secondary Heat Sink events

Including alignment of Standby AFW (SAFW) and backup 1MW DGs Component Cooling Water (CCW) Malfunction events LOCA events

Including alignment of Alternate RCS Injection for inventory control.

Perform a walkdown and validation of the B EDG to validate standby / readiness condition

Perform a walkdown and validation of the B CCW train to validate standby / readiness condition

Perform a walkdown and validation of the Turbine Driven AFW (TDAFW), SAFW, Alternate RCS Injection and supporting 1MW DG trains to validate standby / readiness condition

Perform a walkdown of and confirm availability of applicable suppression, detection and fire barriers for the following Fire Zones per A-601.16:

o BUS11A, BUS11B, BUS12A, and BUS12B o Relay Room

For the above fire zones, minimize the accumulation of transient combustibles in accordance with the station Fire Protection program

Notification of the Transmission System Operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

o Discuss projected grid loading conditions with the TSO to identify if a planned entry into DG unavailability should be deferred

2) Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

E12-4

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244

3) Actions to minimize the magnitude of the risk increase.

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluate weather conditions for threats to the reliability of offsite power supplies.

Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers.

Defer planned maintenance or testing that affects the reliability of operable B EDG and its associated support equipment which affect common system availability. Treat this supporting equipment as protected equipment.

Defer planned maintenance or testing on redundant train EDG safety systems as well as TDAFW, SAFW, Alternate RCS Injection and supporting 1MW DG

Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected EDG, as required.

Implement 10 CFR 50.65(a)(4) equipment protection schemes in accordance with OPG-PROTECTED-EQUIPMENT and A-601.16, as required.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those Fire Areas / Zones identified as being significant for the configuration.

B. One AC Electrical Power Distribution Train Inoperable

1) Actions to increase risk awareness and control.

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

Loss of Offsite Power events

Steam Generator Tube rupture response Station blackout events

Perform a walkdown and validation of the EDGs to validate standby / readiness condition

Perform a walkdown and validation of the TDAFW and Standby AFW trains to validate standby / readiness condition

Notification of the TSO of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

2) Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

3) Actions to minimize the magnitude of the risk increase.

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluate weather conditions for threats to the reliability of offsite power supplies.

E12-5

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244

Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers.

Defer planned maintenance or testing that affects the reliability of operable EDGs, Alternate RCS Injection and their associated support equipment which affect common system availability. Treat this as protected equipment.

Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

Implement 10 CFR 50.65(a)(4) equipment protection schemes in accordance with OPG-PROTECTED-EQUIPMENT, as required.

C. One Main DC Battery Inoperable

1) Actions to increase risk awareness and control.

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

Actions to provide alternate DC power options.

Perform a walkdown and validation of the redundant DC chargers to validate standby /

readiness condition

Notification of the TSO of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

2) Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

3) Actions to minimize the magnitude of the risk increase.

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluate weather conditions for threats to the reliability of offsite power supplies.

Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers.

Defer planned maintenance or testing that affects the reliability of operable EDGs and their associated support equipment which affect common system availability. Treat this as protected equipment.

Align redundant Battery charger on the same train if applicable

Protection of the remaining DC electrical buses and DC chargers.

Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

Develop a work order and have a crash cart available E12-6

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244 D. RHR pump (Using the A RHR pump as an example):

1) Actions to increase risk awareness and control.

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

LOCA and Steam-line break events

Implementation of Containment Sump recirculation

Local operation of MOV-857B as cable failures from steam line breaks impact remote capability.

Operation of Standby AFW.

Perform a walkdown and validation of the B RHR train to validate standby / readiness condition

Perform a walkdown and validation of the containment sump recirculation valves, and control logic to validate standby / readiness condition

2) Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

3) Actions to minimize the magnitude of the risk increase.

Defer planned maintenance or testing that affects the RHR B Pump and its associated support equipment and treat those SSCs as protected equipment.

Defer planned maintenance or testing that affects the CCW HXs and associated support equipment and treat those SSCs as protected equipment.

Implement 10 CFR 50.65(a)(4) equipment protection schemes in accordance with OPG-PROTECTED-EQUIPMENT, as required.

E12-7

License Amendment Request Enclosure 12 Adopt Risk Informed Completion Times TSTF-505 Docket No. 50-244

5. References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0, dated October 12, 2012 (ADAMS Accession No. ML12286A322)

2. Exelon Procedure OP-AA-201-012-1001, "Operations On-Line Fire Risk Management"

3. A-601.16, Online Fire Risk Management.

4. Exelon Procedure WC-AA-101-1006, "On-Line Risk Management and Assessment"

5. Exelon Procedure OP-AA-108-117, "Protected Equipment Program."

6. NUREG-1855 Rev. 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk- Informed Decision Making," U.S. Nuclear Regulatory Commission, March 2017.

7. EPRI TR-1026511, "Practical Guidance on the Use of Probabilistic Risk Assessment in Risk- Informed Applications with a Focus on the Treatment of Uncertainty," Technical Update, Electric Power Research Institute, December 2012 E12-8

v t e Letter Sequence Request
EPID:L-2021-LLA-0091, TSTF-505, TSTF-3, TSTF-505 (Approved, Closed)
Initiation Request, Request, Request Acceptance, Acceptance Supplement, Supplement, Supplement, Supplement Administration Questions Answers Results Approval, Approval, Approval Other: ML21222A114
MONTHYEAR2022-04-28 [Table View]

ML21140A324

Text

Subject:

Enclosures:

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Subject:

Navigation menu

Search