ML21336A394

NRR E-mail Capture - Audit Questions for Sequoyah Units 1 and 2 - LAR to Adopt TSTF-505, Revision 2 (L-2021-LLA-0145)

ML21336A394
Person / Time
Site:	Sequoyah
Issue date:	12/01/2021
From:	Perry Buckberg NRC/NRR/DORL/LPL2-2
To:	Taylor A Tennessee Valley Authority
Buckberg P
References
L-2021-LLA-0145
Download: ML21336A394 (29)

Text

From: Buckberg, Perry Sent: Wednesday, December 1, 2021 3:29 PM To: Taylor, Andrew Charles Cc: Victor, William Ross

Subject:

SQN TSTF-505 Audit Questions - L-2021-LLA-0145 Attachments: Audit Questions - Sequoyah TSTF-505 12-1-2021 L-2021-LLA-0145.pdf

Andy, The September 15, 2021, Audit Plan (ML21246A053) includes that ..the NRC staff will provide the licensee with audit questions and audit-related requests so that the licensee can better prepare for audit discussions with NRC staff. Attached are the NRC staffs audit questions.

We look forward to discussing these questions and TVA responses during the agreed formal virtual audit meeting from January 25 thru January 28, 2022. However please contact me at any time prior if a clarification discussion is needed. Also, please post the response(s) for any question(s) to the Certrec Portal as the response is completed (please dont wait for all responses to be completed or until the formal meeting in January).

Thanks, Perry Buckberg Senior Project Manager / Agency 2.206 Petition Coordinator U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation office: (301)415-1383 perry.buckberg@nrc.gov Mail Stop O-8B1a, Washington, DC, 20555-0001

Hearing Identifier: NRR_DRMA Email Number: 1442 Mail Envelope Properties (BLAPR09MB7409C75754DF6D2A56B120E89A689)

Subject:

SQN TSTF-505 Audit Questions - L-2021-LLA-0145 Sent Date: 12/1/2021 3:29:08 PM Received Date: 12/1/2021 3:29:00 PM From: Buckberg, Perry Created By: Perry.Buckberg@nrc.gov Recipients:

"Victor, William Ross" <wrvictor@tva.gov>

Tracking Status: None "Taylor, Andrew Charles" <actaylor@tva.gov>

Tracking Status: None Post Office: BLAPR09MB7409.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 1060 12/1/2021 3:29:00 PM Audit Questions - Sequoyah TSTF-505 12-1-2021 L-2021-LLA-0145.pdf 425609 Options Priority: Normal Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

AUDIT QUESTIONS LICENSE AMENDMENT REQUEST TO REVISE TECHNICAL SPECIFICATIONS TO ADOPT TSTF-505, REVISION 2 TENNESSEE VALLEY AUTHORITY SEQUOYAH NUCLEAR PLANT, UNITS 1 AND 2 DOCKET NUMBERS 50-327 AND 50-328 By application dated August 5, 2021, Tennessee Valley Authority (the licensee) submitted a license amendment request (LAR) for Sequoyah Nuclear Plant, Units 1 and 2 (Sequoyah)

(Agencywide Documents Access and Management System (ADAMS) Accession No. ML21217A174). The amendment would revise technical specification (TS) requirements to permit the use of risk-informed completion times (RICTs) for actions to be taken when limiting conditions for operation (LCOs) are not met. The proposed changes are based on Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated July 2, 2018 (ADAMS Accession No. ML18183A493). The U.S. Nuclear Regulatory Commission (NRC) issued a final model safety evaluation (SE) approving TSTF 505, Revision 2, on November 21, 2018 (ADAMS Accession No. ML18269A041). The NRC staff has determined that the following information is needed to complete its review.

PRA Licensing Branch A (APLA) Audit Questions - Internal Events PRA and RICT Implementation Regulatory Guide (RG) 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (ADAMS Accession No. ML17317A256), states that the scope, level of detail, and technical adequacy of the probabilistic risk assessment (PRA) are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process. The NRCs SE for Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, dated November 6, 2006 (ADAMS Package Accession No. ML122860402) (hereafter NEI 06-09-A), and the NRCs Final Safety Evaluation for NEI 06-09-A, dated May 17, 2007 (ADAMS Accession No. ML071200238), state that the PRA models should conform to the guidance in RG 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. The current version is RG 1.200, Revision 2 (ADAMS Accession No. ML090410014), which clarifies the current applicable American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard is ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications. In RG 1.200, the quality of the PRA must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

RG 1.200 describes a peer review process using ASME/ANS RA-Sa-2009 as one acceptable approach for determining the technical acceptability of the PRA. The primary results of a peer review are the facts and observations (F&Os) recorded by the peer review team and the 1

subsequent resolution of these F&Os. A process to close finding-level F&Os is documented in Appendix X to the NEI guidance documents NEI 05-04, NEI 07-12, and NEI 12-13, titled NEI 05-04/07-12/12-[13] Appendix X: Close-out of Facts and Observations (F&Os)

(ADAMS Package Accession No. ML17086A431), which was accepted by the NRC in a letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). NEI 06-09-A states that the PRA shall meet Capability Category (CC)-II for the supporting requirements of the PRA standard, and any deviations from these capability categories relative to the RMTS program shall be justified.

APLA AUDIT QUESTION 01 - PRA Model Uncertainty Analysis Process The NRC staff SE to NEI 06-09-A specifies that the LAR should identify key assumptions and sources of uncertainty and assess and disposition each as to its impact on the RMTS application. Section 2.3.4 of NEI 06-09-A states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of a RICT calculation.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitatively screening model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainty for the internal events (including internal floods), fire, and seismic PRAs was performed using the guidance in NUREG-1855, Revision 1. The LAR indicates that in addition to plant-specific assumptions and sources of uncertainty from the internal events (including internal floods), fire, and seismic PRA notebooks, that generic industry sources of uncertainty were also reviewed for applicability presented in Electric Power Research Institute (EPRI)

Topical Report (TR) 1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, and EPRI TR 1026511, "Practical Guidance of the Use of Probabilistic Risk Assessment in Risk-informed Applications with a Focus on the Treatment of Uncertainty." The LAR states that no assumptions and sources of uncertainty were identified to have the potential to impact the TSTF-505 application (i.e., no key assumptions and sources of uncertainty). The LAR presents two sources of modeling uncertainty (i.e., modeling of FLEX and digital equipment) in Enclosure 9, Tables E9-1, E9-3, and E9-4, but states they were not determined to be key sources of uncertainty for Sequoyah. No other assessment of candidate assumptions or sources of uncertainty was provided in the LAR, and the LAR did not identify any sensitivity studies to support its conclusions or identify any Risk Management Actions (RMAs) needed for LCO conditions that could be impacted by modeling uncertainty.

The word screened is not used in LAR Enclosure 9, but it appears that a master compilation of plant-specific and generic industry PRA modeling assumptions and sources of uncertainty was screened using a set of criteria to determine that none of the applicable PRA modeling assumptions and sources of uncertainty are key to this application. It is not clear to NRC staff what evaluation criteria were used to consistently evaluate plant-specific and generic sources of uncertainty to conclude that none are key for this application. Therefore, address the following:

2

a) Describe and justify the criteria used to consistently evaluate a comprehensive list of internal events (including internal floods), fire, and seismic PRA modeling assumptions and sources uncertainty (including those associated with plant-specific features, modeling choices, and generic industry concerns) to conclude none are key to the Sequoyah RICT program.

b) Discuss and provide the results of sensitivity studies (if any) that were performed to evaluate an identified assumption or source of uncertainty for its impact on the RICT calculations.

c) Discuss additional RMAs (if any) that will be used to address sources of PRA modeling uncertainty: (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06 09; and (2) provide RMA examples that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

APLA AUDIT QUESTION 02 - Dispositions of PRA Model Assumptions and Sources of Uncertainty - Internal Events The NRC staff SE to NEI 06-09-A specifies that the LAR should identify key assumptions and sources of uncertainty and should assess and disposition each as to their impact on the RMTS application. Section 2.3.4 of NEI 06-09-A states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of a RICT calculation.

NUREG-1855, Revision 1, presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

The NRC staff reviewed the dispositions of two sources of modeling uncertainty identified in LAR Table E9-1 and also reviewed the dispositions of other internal events (including internal floods) PRA modeling uncertainties evaluated by the licensee in the PRA notebooks for their impact on the RICT application. In a few instances, there is not enough information for NRC staff to conclude that the assumption or source of modeling uncertainty would not have an impact on the RICT calculations. Therefore, address the following:

a) LAR Table E9-1 identifies modeling of the Digital I&C Process Protection System (i.e., Eagle 21) as being a source of modeling uncertainty. Enclosure 9 of the LAR provides the following statements about the modeling of this digital equipment:

The failure probability of the comparator/bistable is representative of the Eagle 21 digital control system.

There is no common cause failure (CCF) added for the digital aspects of the system.

The results of the Eagle 21 availability assessment and the equivalent analog process protection system demonstrate that the Eagle 21 digital system is at least as reliable as the analog technologies.

3

Based on the statements above and the review of the Reactor Protection System (RPS)

PRA notebook, it appears that the Eagle 21 system was modeled using an analog component failure event (i.e., failure of the comparator/bistable) as a surrogate.

Moreover, it appears that the licensee considers using the failure probability of a comparator/bistable sufficient for modeling the Eagle 21 system including potential CCFs because the cited availability assessment determined that the Eagle 21 system is at least as reliable as the analog technologies. A description of this availability assessment was not provided in the LAR. It is not clear to NRC staff that modeling a digital system using an analog system failure event as a surrogate is sufficient to reflect the failure modes that are possible in a digital system including CCF. Additionally, it is not clear to NRC staff whether other digital systems besides the Eagle 21 are credited in the PRA models.

NRC staff notes the lack of consensus industry guidance for modeling digital systems in plant PRAs to be used in support of risk-informed applications. Known modeling challenges exist, such as the lack of industry failure data for digital I&C components, the difference between digital and analog system failure modes, and the complexities associated with modeling software failures, including common cause software failures.

Research and guidance documents such as NUREG/CR-6962, Traditional Probabilistic Risk Assessment Methods for Digital Systems (ADAMS Accession No. ML083110448),

indicate that software CCF can involve failures across function and system boundaries.

Accordingly, it seems possible that software failure could defeat more than one function in the Process Protection System such as failure of the software that performs centralized calculations.

Given the observations and challenges described above, it appears that the uncertainty associated with modeling a digital I&C system could impact the RICT program.

Therefore, address the following:

i. Identify the digital systems that are credited in the Real-Time Risk (RTR) model that will be used to support the RICT program and for each digital system describe the function(s) that the digital equipment is credited to provide.

ii. Describe and provide the results of a sensitivity study performed for each digital system credited in the RTR model demonstrating that the uncertainty associated with modeling of the digital systems has an inconsequential impact on the calculated RICTs. The LCO conditions used for the sensitivity study should be those in scope of RMTS that are most impacted by the modeling uncertainty and have a RICT less than the 30-day backstop (i.e., the 30-day RICT back-stop condition could mask the impact of this uncertainty in the sensitivity study). Note that the sensitivity study should be sufficiently conservative to address the modeling concerns and challenges discussed above for digital equipment.

iii. As an alternative to part (ii) above, identify the LCO conditions in scope of RMTS impacted by digital system modeling for which RMAs will be applied during a RICT. Include discussion of the kinds of RMAs that would be applied and justification that the RMAs will be sufficient to address the modeling concerns and challenges discussed above for digital equipment.

4

APLA/APLC AUDIT QUESTION 03 - Credit for FLEX Equipment and Actions The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2.

With regards to equipment failure probability, in the May 30, 2017 memo, the NRC staff concludes (Conclusion 8):

The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA Standard as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.

With regards to human reliability analysis (HRA), Section 7.5 of NEI 16-06 recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as: debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses; and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. In the May 30, 2017 memo, the NRC staff concludes (Conclusion 11):

Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, [Human Error Probabilities] HEPs associated with actions for which the existing approaches are not explicitly applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

Regarding uncertainty, Section 2.3.4 of NEI 06-09-A states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of a RICT calculation.

NEI 06-09-A also states that the insights from the sensitivity studies should be used to develop appropriate RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions. Uncertainty exists in PRA modeling of FLEX strategies related to the equipment failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities. Therefore, FLEX modeling assumptions can be key assumptions and sources of uncertainty for RICTs proposed in this application.

LAR Enclosure 2, Section 6, states that FLEX equipment is credited in the PRA models that will be used to support the RICT program. However, the LAR characterizes the credited 480 V and 6.9kV 3 MW FLEX diesel generators (DGs) as installed on the Auxiliary Building roof and in the Additional Diesel Generator Building, respectively. The LAR also describes required support systems such as the ventilation system for the 6.9kV 3 MW DGs. It does not appear that portable FLEX equipment and actions associated with moving and setting up FLEX 5

equipment are credited in the PRA models, though the DGs need to be manually started.

However, the LAR does refer to skid mounted FLEX equipment inferring that the FLEX equipment is capable of being moved. It is not clear whether FLEX equipment might be moved under certain circumstances or be in a configuration in which they are not installed. Also, it is not clear whether the operation of installed FLEX equipment requires portable supporting equipment or actions such as routing of cables or hoses. NRC staff notes the comments made in LAR Enclosure 9, Tables E9-1, E9-3, and E9-4 indicating that FLEX DGs are not risk significant in the internal events and fire PRAs but are relatively more important to the seismic risk. To complete the NRC staffs review of the FLEX strategies modeled in the PRA, the NRC staff requests the following information for the internal events PRA (including internal floods),

fire PRA, and seismic PRA, as appropriate:

a) Summarize the FLEX strategies, including the operator actions and associated equipment that have been quantitatively credited for each of the PRA models (i.e.,

internal events, internal floods, fire, and seismic) used to support this application.

Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

b) Regarding the credited FLEX equipment:

i. Discuss whether the credited FLEX equipment (regardless of whether it is portable or permanently installed) are similar to other plant equipment credited in the PRA (i.e., structures, systems, and components (SSCs) with sufficient plant-specific or generic industry data).

ii. For credited FLEX equipment that is not similar to other plant equipment credited in the PRA:

• Discuss the data and failure probabilities used to support its modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard, as endorsed by RG 1.200, Revision 2.

• Justify and provide results of LCO-specific sensitivity studies for the seismic PRA that assess impact on the RICT due to FLEX equipment data and failure probabilities. As part of the response, include the following information:

1. Justify values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Discuss the bases for the chosen TS LCO conditions in the sensitivity studies. Because the 30-day RICT back-stop condition could mask the impact of this uncertainty in the sensitivity study, discuss whether the RICTs for plant configurations involving more than one LCO entry (e.g., where the calculated RICTs are less than the 30-day backstop) are significantly impacted by this uncertainty.

3. Provide numerical results on specific selected RICTs and discussion of the results.

6

4. Discuss whether the uncertainty associated with FLEX equipment failure probabilities is a key source of uncertainty for the RMTS program.

If this uncertainty is key, then describe and provide a basis for how this uncertainty will be addressed in the RMTS program (e.g.,

programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty). If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09-A; and (2) for those TS LCO conditions in LAR Enclosure 12 (Risk Management Action Examples) that are significantly impacted by this uncertainty, provide updated RMAs that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty, and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

c) Regarding human reliability analysis (HRA), address the following:

i. Discuss whether any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06.

ii. For credited operator actions related to FLEX equipment that contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06:

• Justify and provide results of LCO-specific sensitivity studies for the seismic PRA that assess impact on the RICT from the FLEX independent and dependent HEPs associated with deploying and staging FLEX portable equipment. As part of the response, include the following information:

1. Justify the independent and joint HEP values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Discuss the bases for the chosen TS LCO conditions in the sensitivity studies. Because the 30-day RICT back-stop condition could mask the impact of this uncertainty in the sensitivity study, discuss whether the RICTs for plant configurations involving more than one LCO entry (e.g., where the calculated RICTs are less than the 30-day backstop) are significantly impacted by this uncertainty.

3. Provide numerical results on specific selected RICTs and discussion of the results.

4. Discuss composite sensitivity studies of the RICT results to the operator action HEPs and the FLEX equipment reliability uncertainty sensitivity study provided in response to part (3.b.ii) above.

7

5. Discuss whether the uncertainty associated with FLEX HEPs is a key source of uncertainty for the RMTS program.

If this uncertainty is key, then describe and provide a basis for how this uncertainty will be addressed in the RMTS program (e.g.,

programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty). If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06 09, Revision 0-A; and (2) for those TS LCOs in LAR Enclosure 12 (Risk Management Action Examples) that are significantly impacted by this uncertainty, provide updated RMAs that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty, and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

OR:

• Alternatively, provide information associated with the following items listed in supporting requirements (SR) HR-G3 and HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard to support the NRC staffs detailed review of the LAR:

1. the level and frequency of training that the operators and/or non-operators receive for deployment of the FLEX equipment (performance shaping factor (a) in SR HR-G3),

2. performance shaping factor (f) in SR HR-G3, regarding estimates of time available and time required to execute the response,

3. performance shaping factor (g) in SR HR-G3, regarding complexity of detection, diagnosis, and decision-making and executing the required response,

4. Performance shaping factor (h) in SR HR-G3, regarding consideration of environmental conditions, and

5. Human action dependencies as listed in SR HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard.

d) The Section 1-2 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard, as endorsed by RG 1.200, Revision 2, defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences.

Section 1-5.4 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that PRA upgrades shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

8

Given the challenges of modeling FLEX mitigation strategies, explain whether the modeling of FLEX equipment and FLEX actions in the PRA has been peer reviewed in accordance with NRC accepted methods. If it was not, then justify how the model changes associated with incorporating FLEX mitigating strategies does not constitute a PRA upgrade as defined in Section 1-2 of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2.

APLA AUDIT QUESTION 04 - Consideration of Shared Systems in RICT Calculations RG 1.200, Revision 2, states, [t]he base PRA serves as the foundational representation of the as-built and as-operated plant necessary to support an application.

Table E8-1 of LAR Enclosure 8 indicates the existence of cross-ties between units and identifies several systems that are shared. It is not clear to NRC staff how these systems are shared, whether they can support both units in an accident, and how the shared systems are credited for each unit in the PRA models. NRC staff notes that for certain events, such as dual unit events (e.g., loss of offsite power), it may be appropriate to only credit the shared systems for one unit. Therefore, address the following:

a) Explain how shared systems are modeled in the RTR model for each unit in a dual unit event demonstrating that shared systems are not over-credited in the RTR model.

OR:

b) If the RTR model does not address the impact of events that can create a concurrent demand for the system shared by both units, then justify that this exclusion has an inconsequential impact the RICT calculations.

APLA AUDIT QUESTION 05 - Impact of Seasonal Variations The Tier 3 assessment in RG 1.177 stipulates that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. NEI 06-09-A and its associated NRC safety evaluation state that, for the impact of seasonal changes, either conservative assumptions should be made, or the PRA should be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration.

LAR Enclosure 8, Section 3, on attributes of the RTR model, states, Seasonal variations are included in the SQN risk model. Systems included in this treatment include Emergency Raw Cooling Water (ERCW) and component cooling systems. The LAR explains that success criteria for the number of ERCW pumps required is related to the river water temperature, and that this change is made in the PRA models by applying a flag to toggle between both seasons in the model. It is not clear to NRC staff what mechanism and criteria are used to determine when PRA adjustments need to be made in the RTR due to the change in river water temperature. It is also not clear whether other modeling adjustments besides the cited example are needed to account for seasonal and time of cycle dependencies and what kind of adjustments will be made. Therefore, address the following to clarify the treatment of seasonal and time of cycle variations:

a) Discuss any other PRA modeling adjustments made in the RTR to account for seasonal 9

and time of cycle variations during a RICT evolution. Also, explain how these adjustments are made and how this approach is consistent with the guidance in NEI 06-09-A and its associated NRC safety evaluation.

b) Describe the criteria used to determine when PRA adjustments due to seasonal or time of cycle variations need to be made in the RTR and what mechanism initiates these changes.

APLA AUDIT QUESTION 06 - In-Scope LCOs and Corresponding PRA Modeling The NRC SE to NEI 06-09-A specifies that the LAR should provide a comparison of the TS functions to the PRA modeled functions to show that the PRA modeling is consistent with the licensing basis assumptions or to provide a basis for when there is a difference. LAR Enclosure 1, Table E1-1 identifies each TS LCO Condition proposed to be in the RICT program, describes whether the systems and components participating in the TS LCO are modeled in the PRA, and compares the design basis and PRA success criteria. For certain TS LCO Conditions, the table explains that the associated SSCs are not explicitly modeled in the PRAs, but their unavailability will be represented using a surrogate event that fails the function performed by the SSC. For some LCO Conditions, the LAR did not provide enough description for NRC staff to conclude that the PRA modeling will be sufficient for each proposed LCO Condition. Therefore, address the following:

a) LAR Table E1-1 states for TS LCO 3.6.2 (Containment Air Locks) Condition C (One or more containment airlocks inoperable for reasons other than Condition A or B) that the design basis success criterion is Single door closure and the PRA success criterion is Containment intact. The comment column for this entry states that the containment airlocks are not modeled but indicates that small and large containment leaks will be used as surrogates. It is not clear to NRC staff what affect the surrogate failure events has on containment functionality. The phrase large containment leak suggests a failure of containment isolation that could lead to large early release, but the phrase small containment leak suggests the containment may be still isolated or partially isolated. Therefore, address the following:

i. Explain what impact the surrogate failure events for modeling the unavailability of an airlock (i.e., small and large containment leaks) identified for LCO 3.6.2.C has on containment functionality. Include discussion of the difference between using a small or large leak as the surrogate event, and if there is a difference, discuss why different impacts are needed to model air lock unavailability.

ii. Justify that the impacts discussed in part (i), above, are equivalent to or bound the impact of an inoperable airlock.

b) LAR Table E1-1 states for TS LCO 3.7.7 (Component Cooling Water System (CCS))

Condition A (One CCS train inoperable) that the design basis success criterion is One CCS train and the PRA success criteria is One of two pumps for train A. One of one pump for train B. Based on the information provided in the table, it is not clear whether the PRA success criteria is consistent with the design basis success criterion. In one case the criterion is presented at the train level, and in the other case it is presented at the pump level. LAR Table E1-1 does not state for this LCO condition whether the design basis and PRA success criteria are consistent. If there is a difference, the basis for the difference is not clear. Therefore, address the following:

10

i. Clarify whether the PRA success criteria for LCO 3.7.7.A is consistent with the design basis success criteria. Include discussion of the success criteria for the design basis and PRA in terms of both trains and individual pumps.

ii. If the PRA success criteria is inconsistent with the design basis success criteria, then explain how it is different and justify the success criteria used in the PRA to model LCO 3.7.7.A.

c) LAR Table E1-1 states for TS LCO 3.7.8 (Essential Raw Cooling Water (ERCW))

Condition B (One ERCW System train inoperable for reasons other than Condition A) that the design basis success criteria are One ERCW train in conjunction with CCS and a 100% capacity containment cooling system and the PRA success criteria is One of four pumps per train when CS heat exchangers not in operation. Two of four pumps per train when CS heat exchangers in operation. The design basis success criteria are provided in terms of ERCW trains, and the PRA success criteria are provided in terms of pumps per ERCW train. Therefore, it is not clear whether the PRA success criteria are consistent with the design basis success criteria for the case in which the Containment Cooling System (CS) is in operation. LAR Table E1-1 does not state for this LCO condition that the design basis and PRA success criteria are consistent. If there is a difference, the basis for the difference is not clear. Therefore, address the following:

i. Describe both the design basis and PRA success criteria in terms of ERCW trains as well as pumps.

ii. If the PRA success criteria is inconsistent with the design basis success criteria in the case when CS is in operation, then justify the success criteria used in the PRA to model LCO 3.7.8.B for this case and for the case when CS is not in operation.

APLA AUDIT QUESTION 07 - Total Risk and Accounting for the SOKC Based on RG 1.174 and Section 6.4 of NUREG-1855, Revision 1, for a Capability Category II risk evaluation, the mean values of the risk metrics (total and incremental values) need to be compared against the risk acceptance guidelines. The risk management threshold values for the RICT program have been developed based on RG 1.174, and therefore, the most appropriate measures with which to make a comparison are also mean values. Point estimate PRA results are commonly calculated and reported, but these are typically lower than the mean values and do not account for the state-of-knowledge correlation (SOKC) between nominally independent basic event probabilities. NUREG-1855, Revision 1, provides guidance on evaluating how the SOKC uncertainty impacts the comparison of the PRA results with the guideline values. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the SOKC is unimportant (i.e., the risk results are well below the acceptance guidelines).

Section 1 of LAR Enclosure 9 states that the SOKC was addressed in the Sequoyah uncertainty and sensitivity study and was determined to be less than 2% of core damage frequency (CDF).

However, it is not clear to NRC staff whether this study was performed for the internal events, fire, and seismic PRAs or just the internal events PRA. LAR Enclosure 5, Section 2, Table E5-1 presents total CDF and large early release frequency (LERF) values for Sequoyah Units 1 and 2 that appear to be based on point estimates. The mean seismic CDF values reported in the 11

Sequoyah seismic PRA (SPRA) report (ADAMS Accession No. ML19291A003) for Units 1 and 2 are 1.27E-05 per year and 1.50E-05 per year, respectively. Whereas the seismic CDF values reported in the LAR for Units 1 and 2 are 4.19E-06 per year and 3.95E-06 per year, respectively. This suggests that the CDF and LERF values reported in Table E5-1 of Sequoyah TSTF-505 LAR are point estimate values given that the mean values reported in the seismic PRA are significantly higher by a factor of 3 to 4 than the seismic CDF and LERF values reported in the LAR. Also, the LAR explains that SOKC multipliers are applied in the PRA model via recovery rules to address SOKC. Therefore, it appears that rather than correlating the failure probabilities that were used in the PRA derived from the same data in the parametric uncertainty analysis, another method involving a multiplier was used to estimate the SOKC impact. This multiplier approach, its basis, and the multiplier value used are not discussed in the LAR.

Based on the observations above, the difference in the point estimate and mean total CDF could be significantly higher than the 2% reported in the LAR. As a result, it is not clear to NRC staff: (1) whether the total CDF and LERF values could exceed the RG 1.174 risk acceptance guidelines when the mean values that consider SOKC are used to determine the total risk; and (2) how the RICT calculation will consider the mean values in the determination of the change in CDFs (CDFs) and change in LERFs (LERFs) for extended completion times if the difference between the point estimate and mean values are significant. Given these observations and those observations in APLC Question 02 (Inconsistency in Reported Seismic CDF and LERF Results), address the following:

a) If failure probabilities used in the PRA models that are derived from common data sources were not correlated in the parametric uncertainty analysis and another approach was used to estimate the SOKC correlation, then describe that approach. Include justification for the approach and multiplier values used to provide an adequate estimate of the impact of SOKC for this application.

b) If it cannot be justified that the approach and multiplier values used to estimate the impact of the SOKC on total CDF and LERF are adequate for this application, then provide a revised estimate of the impact of the SOKC on CDF and LERF using an acceptable method (e.g., by correlating failure probabilities that come from the same data source during quantification). Also, provide a description and justification of the method used for this revised SOKC assessment.

c) Based on the total mean internal events (including internal floods), fire, and seismic CDF and LERF values calculated considering any change in approach resulting from the response to part (b), above, demonstrate that Sequoyah is in conformance with the RG 1.174 risk acceptance guidelines.

d) Provide and discuss the results of a comparison study between the RICT values calculated using point estimate versus mean risk values for various LCO conditions in scope of RICT program. The LCO conditions selected for this comparison study should be those judged most likely to be impacted by the SOKC uncertainty and have a point estimate RICT less than the 30-day backstop so that the comparison results are not masked by the backstop. Provide the bases for the chosen LCO conditions in this comparison study. Also, provide the intermediate risk results from these RICT calculations (e.g., the CDFs and LERFs for the baseline case using point estimates and for sensitivity case using mean values from the internal events (including internal floods),

fire and seismic PRAs). Perform this comparison study considering any change in 12

approach resulting from the response to part (b), above, e) Based on the results above, provide a summary of how the SOKC will be addressed for RICT calculations during RICT program implementation (i.e., based upon the risk metrics to be considered), and explain how this process/approach is consistent with NUREG-1855, Revision 1.

APLA AUDIT QUESTION 08 - PRA Model Update Process Section 2.3.4 of NEI 06-09-A specifies that criteria shall exist in PRA configuration risk management to require PRA model updates concurrent with implementation of facility changes that significantly impact RICT calculations.

LAR Enclosure 7 states that if a plant modification or a corrective action [is] identified with potential significant impact to the RICT Program calculations or results in a change in CDF/LERF of more than 25%, as defined by TVA procedures, an unscheduled update of the PRA model will be implemented. It is not clear to NRC staff how plant changes and discovered conditions are monitored and assessed for their impact to the RICT program and whether the cited criterion of a change in CDF/LERF of more than 25% is by itself sufficient to identify plant changes or discovered conditions with the potential to significantly impact the calculated RICTs.

Therefore, address the following:

a) Explain how plant changes (including changes in procedures) and discovered conditions (including conditions that could change important assumptions made in the PRA models) are monitored for impact on the RICT program.

b) Explain what mechanism or criteria is used in conjunction with the criterion of a change in CDF/LERF of more than 25% to identify plant changes or discovered conditions with the potential to significantly impact the calculated RICTs. It appears possible to NRC staff that plant changes or discovered conditions that result in less impact on the CDF and LERF could impact the RICT calculations for certain plant configurations.

APLA AUDIT QUESTION 09 - Performance Monitoring The LAR states that the application of a RICT will be evaluated using the guidance provided in NEI 06-09-A. NEI 06-09-A was approved by the NRC on May 17, 2007 (ADAMS Accession No. ML071200238). The NRC SE for NEI 06-09-A, states, [t]he impact of the proposed change should be monitored using performance measurement strategies. NEI 06-09-A considers the use of NUMARC 93-01, Revision 4F, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (ADAMS Accession No. ML18120A069), as endorsed by RG 1.160, Revision 4 (ADAMS Accession No. ML18220B281), for the implementation of the Maintenance Rule. NUMARC 93-01, Section 9.0, contains guidance for the establishment of performance criteria.

In addition, the NEI 06-09-A methodology satisfies the five key safety principles specified in RG 1.177 relative to the risk impact due to the application of a RICT. Moreover, NRC staff position C.3.2 provided in RG 1.177 for meeting the fifth key safety principle acknowledges the use of performance criteria to assess degradation of operational safety over a period. It is unclear how the licensees RICT program captures performance monitoring for the SSCs within-scope of the RMTS program. Therefore:

13

a) Confirm that the Sequoyah Maintenance Rule program incorporates the use of performance criteria to evaluate SSC performance as described in the NRC-endorsed guidance in NUMARC 93-01.

b) Alternatively, describe the approach or method used by Sequoyah for SSC performance monitoring, as described in Regulatory Position C.3.2 of RG 1.177, for meeting the fifth key safety principle. In the description, include criteria (e.g., qualitative or quantitative),

along with the appropriate risk metrics, and explain how the approach and criteria demonstrate the intent to monitor the potential degradation of SSCs in accordance with the NRC SE for NEI 06-09.

APLA AUDIT QUESTION 10 - RICT Program Implementation When CDF or LERF Limits are Exceeded The NRC safety evaluation for NEI 06-09-A, dated May 17, 2007, states:

[T]he NRC staff interprets TR NEI 06-09, Revision 0, guidance as not permitting a RICT to be entered (i.e., to exceed the frontstop CT [completion time]) when the configuration-specific risk exceeds the 10-3 CDF or 10-4 LERF limits, since use of a RICT is a voluntary decision to extend a CT. However, TR NEI 06-09, Revision 0, does not require exiting a RICT if the limits of either 10-3 CDF or 10-4 LERF are subsequently exceeded due to emergent conditions which arise after a RICT is in effect. This is consistent with the guidance of NUMARC 93-01. The RICT, once in effect, is solely governed by the ICDP and ILERP limits described above, and emergent configurations whose risk level exceeds the 10-3 CDF or 10-4 LERF limits are managed using RMAs.

Note 2 in LAR Tables E1-2 and E1-3 states:

Per NEI 06-09-A, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be voluntarily entered. However, it is possible that the LCO could be entered for an emergent failure and RICT entry would be allowed.

Section 3 of LAR Enclosure 12 states, If, as the result of an emergent condition, the ICDF or the ILERF exceeds 10-3 per year or 10-4 per year, respectively, RMAs will be required to be implemented. However, the RICT will need to be exited and the Technical Specification will drive the completion time. These requirements are consistent with the guidelines of NEI 06-09-A, Revision 0.

It is unclear to NRC staff how the RICT program will be implemented when the CDF or LERF limits are exceeded due to emergent conditions. For example, note 2 in LAR Tables E1-2 and E1-3 seems to suggest that a RICT entry is allowed for emergent conditions when the 1E-3/year or 1E-4/year limits are exceeded for CDF or LERF, respectively. However, this is not consistent with the NRC safety evaluation for NEI 06-09-A that states a RICT cannot be entered when configuration-specific risk exceeds the CDF or LERF limits, since use of a RICT is a voluntary decision; however, a RICT does not require exiting if these CDF or LERF limits are subsequently exceeded due to emergent conditions which arise after a RICT is in 14

effect. Another example, note 2 in LAR Tables E1-2 and E1-3 seems to contradict Section 3 of LAR Enclosure 12 that states the RICT will be exited if the CDF or LERF limits are exceeded due to an emergent condition.

Explain how the RICT program will be implemented when the CDF or LERF limits are exceeded due to an emergent condition which arises: (1) after a RICT is in effect; and (2) when a RICT is not in effect. Also, explain how this approach is consistent with the guidance in NEI 06-09-A and its associated NRC safety evaluation.

APLA AUDIT QUESTION 11 - Open Phase Condition Section C.1.4 of RG 1.200 states the base (e.g., Model of Record) PRA is to represent the as-built, as-operated plant to the extent needed to support the application. The licensee is to have a process that identifies updated plant information that necessitate changes to the base PRA model.

In response to the January 30, 2012 Open Phase Condition (OPC) event at the Byron Generating Station, the NRC issued Bulletin 2012-01 1. As part of the initial Voluntary Industry Initiative (VII) for mitigation of the potential for the occurrence of an OPC in electrical switchyards 2, licensees have made the addition of an Open Phase Isolation System (OPIS).

As per SRM-SECY-16-0068 3, the NRC staff was directed to ensure that licensees have appropriately implemented OPIS and that licensing bases have been updated accordingly.

Inspections of OPIS by NRC staff are currently underway. From the revised voluntary initiative 4 and resulting industry guidance in NEI 19-02 5 on estimating OPC and OPIS risk, it is understood that the risk impact of an OPC can vary widely dependent on electrical switchyard configuration and design. Considering these observations, provide the following information:

a) For Sequoyah, discuss the evaluation of the risk impact associated with OPC events including the likelihood of OPC initiating plant trips and the impact of those trips on PRA-modeled SSCs. Also, explain whether an OPIS has been installed and if it has been installed, then discuss its functionality and any operator actions needed to operate the system or needed in response to the system.

b) Clarify whether any installed OPIS equipment and associated operator actions are credited in the PRAs that support this application. If OPIS equipment and associated operator actions are credited, then provide the following information:

1 U.S. NRC Bulletin 2012-01, Design Vulnerability in Electric Power System (ADAMS Accession No. ML12074A115).

2 Anthony R. Pietrangelo to Mark A. Satorius, Ltr re: Industry Initiative on Open Phase Condition - Functioning of Important-to-Safety Structures, Systems and Components (SSCs), dated October 9, 2013 (ADAMS Accession No. ML13333A147).

3 U.S. NRC SRM-SECY-16-0068, Interim Enforcement Policy for Open Phase Conditions in Electric Power Systems for Operating Reactors, dated March 9, 2017 (ADAMS Accession No. ML17068A297).

4 Doug True to Ho Nieh, Ltr re: Industry Initiative on Open Phase Condition, Revision 3, dated June 6, 2019 (ADAMS Accession No. ML19163A176).

5 Nuclear Energy Institute (NEI) 19-02, Guidance for Assessing Open Phase Condition Implementation Using Risk Insights, Revision 0, April 2019 (ADAMS Accession No. ML19122A321).

15

i. Describe the OPIS equipment and associated actions that are credited in the PRA models.

ii. Describe the impact that this treatment, if any, has on key assumptions and sources of uncertainty for the RICT program.

iii. Discuss HRA methods and assumptions used for crediting OPIS alarm manual response.

iv. Discuss how OPC related scenarios are modelled for non-internal event scenarios such as internal floods, fire, and seismic.

v. Regarding inadvertent OPIS actuation:

• Explain whether scenarios regarding inadvertent actuation of the OPIS, if applicable, are included in the PRA models that support the RICT calculations.

• If inadvertent OPIS actuation scenarios are not included in the PRA models, then provide justification that the exclusion of this inadvertent actuation does not impact the RICT calculations.

c) If OPC and OPIS are not included in the application PRA models (whether OPIS equipment is installed or not), then provide justification that the exclusion of this failure mode and mitigating system does not impact the RICT calculations.

d) As an alternative to Part (c), propose a mechanism to ensure that OPC-related scenarios are incorporated into the application PRA models prior to implementing the RICT program.

16

PRA Licensing Branch B (APLB) Audit Questions - Fire PRA APLB AUDIT QUESTION 01 - Deviations from NRC Endorsed Guidance as Source of Modeling Uncertainty RG 1.200 states, NRC reviewers [will] focus their review on key assumptions and areas identified by peer reviewers as being of concern and relevant to the application. The implementation of some of the complex fire PRA methods often use nonconservative and over-simplified assumptions to apply the method to specific plant configurations. Historically, some of these issues were not always identified in F&Os by the peer review teams but are considered potential key assumptions by the NRC staff because using more defensible and less simplified assumptions could substantively affect the fire risk and fire risk profile of the plant. The NRC staff evaluates the acceptability of the PRA for each new risk-informed application, and as discussed in RG 1.174, recognizes that the acceptable technical adequacy of risk analyses necessary to support regulatory decision-making may vary with the relative weight given to the risk assessment element of the decision-making process. The calculated results of the PRA are used directly to calculate a RICT, which subsequently determines how long SSCs (both individual SSCs and multiple unrelated SSCs) controlled by TSs can remain inoperable.

Therefore, the PRA results are given a very high weight in a TSTF-505 application, and the NRC staff is asking for information on the following issues that have been previously identified in previous TSTF-505 LARs as potentially key fire PRA assumptions.

APLB AUDIT QUESTION 01.a - Treatment of Sensitive Electronics Based on NRC staff review of the electronic portal documents during the audit of the treatment of sensitive electronics, it was not clear whether an attempt was made to identify and characterize cabinets that contain credited sensitive electronics in order to evaluate their vulnerability to fire. Frequently Asked Question (FAQ) 13-0004, Clarifications on Treatment of Sensitive Electronics (ADAMS Accession No. ML13322A085), provides supplemental guidance for application of the damage criteria provided in Sections 8.5.1.2 and H.2 of NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2 (ADAMS Accession No ML052580118), for solid-state and sensitive electronics. The fire modeling uncertainty associated with treatment of sensitive electronics could have an impact on the RICT calculations. Therefore, provide the following:

a) Confirm that credited sensitive electronics were identified and characterized using some process such as walkdowns.

b) Describe the treatment of sensitive electronics for the fire PRA and explain whether it is consistent with the guidance in FAQ 13-0004, including the caveats about configurations that can invalidate the approach (i.e., sensitive electronics mounted on the surface of cabinets and the presence of louver or vents).

c) If the approach is not consistent with FAQ 13-0004, please provide justification that the treatment of sensitive electronics has an inconsequential impact on the RICT calculations. [Based on text in the Fire Modeling report, sensitive electronics may only exist in locations where the treatment of potential fire damage is conservatively bounding.] An acceptable approach is to describe and provide the results of a sensitivity study for sensitive electronics credited in the RTR model demonstrating that the uncertainty associated with the modeling the digital I&C systems has an inconsequential 17

impact on the calculated RICTs using LCO conditions that could be most impacted by this modeling uncertainty having RICTs less than the 30-day backstop APLB AUDIT QUESTION 01.b - Obstructed Plume Fire Modeling Based on NRC staff review of the electronic portal documents during the audit of fire modeling treatments, it appears that the fire modeling of obstructed plumes is credited in the fire PRA.

NUREG-2178, Volume 1, "Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE), Volume 1: Peak Heat Release Rates and Effect of Obstructed Plume" (ADAMS Accession No. ML16110A140), contains guidance on fire modeling the effect of plume obstruction in addition to refined peak heat release rates (HRRs).

NUREG-2178 provides guidance that indicates that the obstructed plume model is not applicable to cabinets in which the fire is assumed to be located at elevations of less than one-half of the cabinet. The fire modeling uncertainty associated with obstructed plume modeling could have an impact on the RICT calculations. Therefore, address the following:

a) If obstructed plume modeling was used, then indicate whether the base of the fire was assumed to be located at an elevation of less than one-half of the cabinet.

b) Justify any fire modeling in which the base of an obstructed plume is located at less than one half of the cabinet's height.

c) As an alternative to item (b) above, justify that the treatment of obstructed plume modeling has an inconsequential impact on the RICT calculations. An acceptable approach is to describe and provide the results of a sensitivity study for obstructed plume modeling credited in the RTR model demonstrating that the treatment has an inconsequential impact on the calculated RICTs using LCO conditions that could be most impacted by this modeling uncertainty having RICTs less than the 30-day backstop.

APLB AUDIT QUESTION 01.c - Well-Sealed Motor Control Center (MCC) Cabinets NRC staff review of the electronic portal documents during the audit of fire modeling treatments did not identify a description of how well-sealed cabinets were treated in the fire PRA.

Guidance in FAQ 08-0042 from Supplement 1 of NUREG/CR-6850 applies to electrical cabinets below 440 V. With respect to Bin 15, as discussed in Chapter 6, it clarifies the meaning of "robustly or well-sealed." Thus, for cabinets of 440 V or less, fires from well-sealed cabinets do not propagate fire outside the cabinet. For cabinets of 440 V and higher, the original guidance in Chapter 6 remains and requires that Bin 15 panels which house circuit voltages of 440 V or greater are counted because an arcing fault could compromise panel integrity (an arcing fault could burn through the panel sides, but this should not be confused with the high energy arcing fault type fires)." Fire PRA FAQ 14-0009, Treatment of Well-Sealed MCC Electrical Panels Greater than 440V (ADAMS Accession No. ML15119A176) provides the technique for evaluating fire damage from MCC cabinets having a voltage greater than 440 V.

Therefore, propagation of fire outside the ignition source panel must be evaluated for all MCC cabinets that house circuits of 440 V or greater. The modeling uncertainty associated with well-sealed MCC cabinets fire modeling could have an impact on the RICT calculations. Therefore, address the following:

a) Describe how fire propagation outside of well-sealed MCC cabinets greater than 440 V is evaluated and address if it is consistent with the guidance in fire PRA FAQ 14-0009.

18

b) The guidance in NUREG/CR-6850 does not include well-sealed cabinets less than 440 V in the Bin 15 count of ignition sources. If well-sealed cabinets less than 440 V are included in the Bin 15 count of ignition sources, provide justification for using this approach.

c) As an alternative to parts (a) and/or (b), demonstrate that the treatment of well-sealed MCC cabinets has an inconsequential impact on the RICT calculations. An acceptable approach is to describe and provide the results of a sensitivity study for the unacceptable treatment of well-sealed MCC cabinets credited in the RTR model demonstrating that the treatment has an inconsequential impact on the calculated RICTs using LCO conditions that could be most impacted by this modeling uncertainty having RICTs less than the 30-day backstop APLB AUDIT QUESTION 01.d - Influence Factors for Transient Fires Based on NRC staff review of the electronic portal documents during the audit of the application of transient fire influence factors, it appears that guidance used to apply transient fire influence factors was limited to NUREG/CR-6850, Volume 2 (ADAMS Accession No ML052580118).

Further guidance in FAQ 12-0064, Hot Work/Transient Fire Frequency Influence Factors" (ADAMS Accession No. ML12346A488), describes the process for assigning influence factors for hot work and transient fires. Modeling uncertainty associated with use of transient fire influence factors could have an impact on the RICT calculations. Provide the following regarding application of NRC guidance to use of transient fire influence factors:

a) Clarify whether the methodology used to calculate hot work and transient fire frequencies applies influencing factors using NUREG/CR-6850 guidance or FAQ 12-0064 guidance.

b) Indicate whether administrative controls are used to reduce transient fire frequency, and if so, describe and justify these controls.

c) Indicate whether any specific non-conformances of administration control to limit combustible materials with NUREG/CR-6850 guidance or FAQ 12-0064 guidance exist and discuss the transient fire frequency influence factors assigned to these non-conformances. For those which were assigned an influence factor of 1 (Low) or less, indicate the value of the assigned influence factors and provide the justification.

d) If an influencing factor of "0" was assigned to Maintenance, Occupancy, or Storage, or Hot Work for any fire Physical Analysis Units (PAUs), provide the justification e) The guidance in FAQ 12-0064 indicates weighting factors of 50 should be used in any fire PAU. Please identify and justify any deviations.

APLB AUDIT QUESTION 01.e - PRA Treatment of Fire Dependencies between Units 1 and 2 Many operating nuclear power plants with more than one unit have adjoined and common areas. For plants, the risk contribution from fires originating in one unit must be addressed for impacts to the other unit given the physical proximity of the other unit, common areas, and the 19

existence of shared systems. Therefore, address the following if Units 1 and 2 have adjoined and common areas, and shared systems:

a) Explain how the risk contribution of fires originating in one unit is addressed for the other unit given impacts due to the physical proximity of equipment and cables in one unit to equipment and cables in the other unit. Include identification of locations where fire in one unit can affect components in the other unit and explain how the risk contributions of such scenarios are allocated in the LAR.

b) Explain how the contributions of fires in common areas are addressed, including the risk contribution of fires that can impact components in both units.

APLB AUDIT QUESTION 02 - Dispositions of PRA Model Assumptions and Sources of Uncertainty - Internal Fire The NRC staff SE to NEI 06-09-A specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application. Section 2.3.4 of NEI 06-09-A states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of a RICT calculation.

NUREG-1855, Revision 1, presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

The NRC staff reviewed the disposition of the source of modeling uncertainty identified in LAR Table E9-3 and reviewed the dispositions of other fire PRA modeling uncertainties evaluated by the licensee in the PRA notebooks for their impact on the RICT application. In a few instances, there is not enough information for NRC staff to conclude that the assumption or source of modeling uncertainty would not have an impact on the RICT calculations. Therefore, address the following:

a) Portal report SQN-0-21-126, Sequoyah Nuclear: Review of Sources of Uncertainty for the RICT LAR, identifies the treatment of components without cable routing information as always failed in the fire PRA to be a source of modeling uncertainty. These components are referred to in the report as Unknown Equipment List (UNL) components and the report explains that a sensitivity study was performed on their treatment.

Though the assumption that UNL components always fail in a fire scenario is conservative, NRC staff notes that this conservatism in fire PRA modeling could have a nonconservative impact on the RICT calculations. If an SSC is part of a system not credited in the fire PRA or supports a system that is assumed to always fail, then the risk increases due to taking that SSC out of service could be masked. The report states based on the sensitivity study results that the treatment of this uncertainty was determined to have at most a moderate impact on fire CDF (i.e., greater than 10% and less than 100% change) and that the modeling uncertainty is, therefore, considered not to be a key source of uncertainty. The report did not identify the SSCs that were assumed always to fail in a fire scenario. Given that the results of the sensitivity study indicate that impact of this modeling uncertainty on fire CDF is moderate, it is not clear to NRC staff why the licensee concluded that this source of uncertainty has an inconsequential impact of the RICT calculations for the plant configuration allowed by the RICT program. Therefore, address the following:

20

i. Identify the UNL systems or components that are assumed to be always failed in the fire PRA or are not included in the fire PRA model.

ii. Justify that this assumption has an inconsequential impact on the RICT calculations by describing and performing a sensitivity study using LCO conditions that could be most impacted by this modeling uncertainty having RICTs less than the 30-day backstop.

iii. As an alternative to part (ii) above, identify the LCO conditions impacted by the treatment of this modeling uncertainty for which RMAs will be applied during a RICT. Include discussion of the kinds of RMAs that would be applied and justification that the RMAs will be sufficient to address the modeling uncertainty.

b) Portal report SQN-0-21-126 identifies an assumption made about the properties of electrical cable used in the plant to be a source of modeling uncertainty. The report states that the electrical cables in the control room are treated like thermoplastic cables because they do not meet the qualification criteria for thermoset cables. According to the guidance in Appendix H of NUREG/CR-6850 for fire PRA (ADAMS Accession No. ML052580118), the thermal damage threshold of thermoplastic cable (i.e., 6 kW/m2) is significantly lower than the thermal damage threshold of thermoset cables (i.e.,

11 kW/m2). The report states, however, based on a parameter sensitivity study that this assumption only introduces a slight conservative bias in the PRA model results. It is not clear to NRC staff how the licensee concluded that this assumption leads to just a slight conservative bias in the PRA model results. Using the damage threshold for thermoplastic cables could result in significantly more damaged targets than using the damage threshold for thermoset cables. Additionally, NRC staff notes that a conservatism in fire PRA modeling could have a nonconservative impact on the RICT calculations. If SSC targets are considered damaged because nearby cables were assumed to be thermoplastic cables that otherwise would not be considered damaged if the cables were assumed to thermoset cables, then the risk increase due to taking that SSC out of service could be masked.

Another portal report on fire modeling (MDN000NA201000469) states that the licensee assumed all cables in the plant are thermoplastic, even though it was determined that a significant fraction could have thermoset properties. This contrasts with the uncertainty analysis report which indicates that the conservative cable property assumption was limited to the control room.

In light of the observations above, address the following:

i. Clarify where the cable property assumption was applied (e.g., to the whole plant or just the control room).

ii. Justify that this assumption has an inconsequential impact on the RICT calculations. One option for doing this is describing and performing a sensitivity study using LCO conditions that could be most impacted by this modeling uncertainty having RICTs less than the 30-day backstop.

21

iii. As an alternative to part (ii) above, identify the LCO conditions impacted by the treatment of this modeling uncertainty for which RMAs will be applied during a RICT. Include discussion of the kinds of RMAs that would be applied and justification that the RMAs will be sufficient to address the modeling uncertainty.

PRA Licensing Branch C (APLC) Audit Questions - Seismic PRA and External Hazards APLC AUDIT QUESTION 01 - Resolution of Focused-Scope Peer Review F&Os The LAR states that, as part of the Independent Assessment, four of the seven SHA findings were assessed to be upgrades and were resolved as part of a focused scope of HLRs, SHA-I and SHA-J. It is not clear to the NRC staff whether any F&Os were generated by the focused-scope peer review and whether they were closed. Therefore:

a) Explain whether F&Os were generated by the focused-scope peer review and confirm that they were closed during the Independent Assessment.

b) If F&Os were generated by the focused-scope peer review and not closed during the Independent Assessment, then provide the open F&Os and justify that each open focused-scope generated F&Os will have an inconsequential impact on the RICT calculations.

APLC AUDIT QUESTION 02 - Inconsistency in Reported Seismic CDF and LERF Results LAR Enclosure 5, Table E5-1 presents the point estimate seismic CDFs for Sequoyah to be 4.19E-06 and 3.95E-06 per year for Units 1 and 2, respectively. Section 6.0 of the Sequoyah SPRA (Fukushima) report presents the point estimate seismic CDFs for Sequoyah to be 4.1E-06 and 4.95E-06 per year for Units 1 and 2, respectively. Similarly, LAR Enclosure 5, Table E5-1 presents the point estimate seismic LERFs for Sequoyah to be 3.00E-06 and 2.83E-06 per year for Units 1 and 2, respectively, but Section 6.0 of the Sequoyah SPRA report presents the point estimate seismic LERFs for Sequoyah to be 2.6E-06 and 2.4E-06 per year for Units 1 and 2, respectively.

Accordingly, there is an inconsistency in the reported seismic CDF for Unit 2 and seismic LERF for Units 1 and 2 between the LAR and the SPRA report. Therefore, address the following:

a) Reconcile the differences between point estimate seismic CDF and LERF values presented in the LAR and SPRA and confirm which seismic CDF and LERF values are being used in support of the Sequoyah TSTF-505 LAR. In particular, explain and justify why the seismic CDF value for Unit 2 in the LAR is 20% lower than the value in the SPRA Fukushima report.

b) If different seismic CDF and/or LERF values are being used in support of the Sequoyah TSTF-505 LAR than presented in LAR Enclosure 5, Table E5-1, then ensure that the appropriate values are used when responding to APLA Question 07.

22

APLC AUDIT QUESTION 03 - External Flooding and Intense Precipitation Section 2.3.1, Item 7, of NEI 06-09-A states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that [o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4, Table E4-1 discusses the evaluation of the risk from the external flooding hazard on the RICT application. Table E4-1 indicates that criterion C5 (Event develops slowly, allowing adequate time to eliminate or mitigate the threat) was used to screen the extreme flood and intense precipitation. However, as noted in LAR, the revision of the warning time analysis has not yet been performed. The LAR states that this analysis is expected to be complete by early May 2022, and therefore, the LAR commits to either (1) supplement the TSTF-505 request with the revised warning time analysis that supports the screening criterion of C5, or (2) propose a license condition that requires confirmation from the revised Sequoyah warning time prior to implementation of the RICT program or use another screening criteria from Section 6-2 of the AMSE/ANS RA Sa-2009 PRA Standard in the event that the hazard cannot be screened using criterion C5. Explain how the licensee intends to confirm that the revised warning time will allow adequate time to eliminate or prevent the threat.

Containment and Plant Systems Branch (SCPB) Audit Question SCPB AUDIT QUESTION 01 - Design Success Criteria for TS Condition 3.6.8.B TS Condition 3.6.8.B of Table E1-1 in Enclosure 1 of the LAR (pdf page 323 of 405) gives the Design Success Criteria as One region without an operable ignitor. It appears that without should be changed to with. Please clarify.

Nuclear Systems Performance Branch (SNSB) Audit Question SNSB AUDIT QUESTION 01 - TS Condition 3.4.11.C - One Block Valve Inoperable Sequoyah TS Bases 3.4.11 indicates that the pressurizer Power Operated Relief Valves (PORVs) and block valves have multiple safety functions, including: (1) providing flow path for depressurization control during a design basis event (DBE), steam generator tube rupture (SGTR), to equalize the primary and secondary pressure in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator; (2) providing flow path for the low temperature over-pressurization protection (LTOP) specified in TS LCO 3.4.12; and (3) terminating a small break LOCA (SBLOCA) in the event a pressurizer PORV fails to reclose following actuation.

1) Discuss the following Case 1 to show whether the proposed plant configurations specified in TS 3.4.11.B.3 and TS 3.4.11.C.2 adopting RICT satisfy the assumptions used in the DBE SGTR and LTOP analyses to meet the NEI 06-09-A requirements for 23

preservation of the safety function assumed in the SGTR and LTOP analyses crediting PORVs for reactor coolant system (RCS) pressurization control.

Case 1 Configurations -

TS 3.4.11.B: One PORV inoperable assuming that one PORV is inoperable and closed; and TS 3.4.11.C: One block valve inoperable assuming one blocked valve on the other PORV line is inoperable and closed.

2) Discuss the following Case 2 to show whether the proposed plant configurations specified in TS 3.4.11.B.3 and TS 3.4.11.C.2 adopting RICT meet the NEI 06-09-A requirements for preservation of the safety function to terminate a SBLOCA.

Case 2 Configurations-TS 3.4.11.B: One PORV inoperable assuming that one PORV is inoperable and open; and TS 3.4.11.C: One block valve inoperable assuming one PORV associated blocked valve is inoperable and open.

3) Identify any other plant configurations specified in TS 3.4.11.B and TS 3.4.11.C that could be inconsistent with the assumptions used in the DBE analyses and result in a loss of the intended safety functions.

4) Discuss any TS requirements that could prohibit the entry to the plant configurations discussed in above items 1 through 3, when the configurations are determined that they could be inconsistent with the assumptions used in the DBE analyses and result in a loss of the intended safety function.

Technical Specifications Branch (STSB) Audit Question STSB AUDIT QUESTION 01 - TS 5.5.18, Proposed Administrative Controls for the RICT Program The proposed administrative controls for the RICT Program in TS 5.5.18 paragraph e of Attachments 2.1 and 2.2 of the LAR were based on the TS markups of TSTF-505, Revision 2 for Sequoyah Unit 1 and Unit 2, respectively. The NRC staff recognizes that the model SE for TSTF-505, Revision 2, contains improved phrasing for the administrative controls for the RICT Program in TS 5.5.18, paragraph e, namely the phrasing approved for use with this program instead of used to support this license amendment. In lieu of the original phrasing in paragraph e of TS 5.5.18, discuss whether the phrases used to support Amendment # xxx or, as discussed in the TSTF-505 model SE, approved for use with this program would provide more clarity for this paragraph.

24

Electrical Engineering Branch (EEEB) Audit Questions EEEB AUDIT QUESTION 01 - DSC for Electrical TSs For all electrical TS proposed changes in LAR Table E1-1, is each of their Design Success Criteria (DSC) based on a successful response to the Sequoyah worst case accident by the station or each unit?

EEEB AUDIT QUESTION 02 - DSC for TS 3.8.1.B In LAR Table E1-1 for TS 3.8.1.B DSC, if the only remaining power sources for the station is one DG from each load group or train, is that a loss of function (LOF) scenario for station? Are the load groups or trains A and B for each unit fully redundant based on that? Is a LOF note applicable for LAR Tables E1-2 and E1-3 for this TS since that could happen for some scenarios for remaining DGs available for operation? For DSC, do both accident and non-accident unit only need one DG each?

EEEB AUDIT QUESTION 03 - DSC for TS 3.8.1.E In LAR Table E1-1 for TS 3.8.1.E DSC, is this a technical variation from standard TSs since specific to Sequoyah in what DGs that are not available? Explain how DSC for this TS is met?

EEEB AUDIT QUESTION 04 - DSC for TS 3.8.4.A and B In LAR Table E1-1 for TS 3.8.4.A and B DSC, is each for accident unit or for station?

EEEB AUDIT QUESTION 05 - DSC for TS 3.8.7.A In LAR Table E1-1 for TS 3.8.7.A DSC, is this for accident unit or for station? Denote in DSC how many channels are required for accident unit?

EEEB AUDIT QUESTION 06 - DSC for TS 3.8.9.A In LAR Table E1-1 for TS 3.8.9.A DSC, explain whether for station or each unit: If two Unit 1 shutdown boards are inoperable, explain how DSC is achieved. Is a LOF note applicable for LAR Tables E1-2 and E1-3 for this TS?

EEEB AUDIT QUESTION 07 - DSC for TS 3.8.9.B In LAR Table E1-1 for TS 3.8.9.B DSC, explain whether for station or each unit: If two Unit 1 120 VAC instrument boards are inoperable, explain how DSC is achieved. Is a LOF note applicable for LAR Tables E1-2 and E1-3 for this TS?

EEEB AUDIT QUESTION 08 - DSC for TS 3.8.9.C In LAR Table E1-1 for TS 3.8.9.C DSC, explain whether for station or each unit: If two Unit 1 120 VAC instrument boards are inoperable, explain how DSC is achieved if each instrument board is from a different train. Is a LOF note applicable for LAR Tables E1-2 and E1-3 for this TS?

25

EEEB AUDIT QUESTION 09 - Calculated RICTs for Electrical TSs For LAR Tables E1-2 and E1-3, explain why RICT times are so different for Units 1 and 2 for TSs 3.8.1, 3.8.4, 3.8.7, and 3.8.9?

EEEB AUDIT QUESTION 10 - Total Loading of DGs Provide total loading (final load sum) of each DG for worst-case licensing basis accident separating out required safety and any non-safety loads and basis for supplying non-safety loads for one DG in RICT per TS 3.8.1.B.

Instrumentation and Controls Branch (EICB) Audit Questions EICB AUDIT QUESTION 01 - TS Table 3.3.1-1 Function 13, SG Water Level For TS Table 3.3.1-1 Function 13, Steam Generator (SG) Water Level, the proposed technical variation to TSTF-505 is discussed in LAR Section 2.3.2.1, starting on page A1-4 of 7 (PDF page 8 of 405).

a) The TS Bases state:

Control/protection interaction is addressed by the use of the Median Signal Selector that prevents a single failure of a channel providing input to the control system requiring protection function action. That is, a single failure of a channel providing input to the control system does not result in the control system initiating a condition requiring protection function action. The Median Signal Selector performs this by not selecting the channels indicating the highest or lowest steam generator levels as input to the control system.

However, it is not clear how control/protection interaction is adequately addressed when one channel inoperable, but is not placed in trip or has the setpoint adjusted. If control/protection interaction is NOT adequately addressed, then a LOF condition exists b) How does the OR (between V.1 & V.2, as well as between W.1 & W.2 - see PDF page 26 of 405 of the LAR) work on proposed condition (V) and (W) when deciding on entering a RICT?

EICB AUDIT QUESTION 02 - TS Table 3.3.1-1 Function 2.a, Power Range Neutron Flux, Condition D Regarding TS Table 3.3.1-1 Function 2.a, Power Range Neutron Flux, Condition D, Table 1 (Conditions Requiring Additional Justification) in TSTF-505, Revision 2, includes TS 3.3.1.D.

The Suggested Information for TS 3.3.1.D states, Licensee must justify that the condition does not represent the inability to perform the safety function assumed in the FSAR given the loss of special distribution of the remaining Power Range detectors. The justification can include that the Actions require periodic monitoring of spacial power distribution and imposition of compensatory limits and reduced power. Sequoyah TS 3.3.1.D, Note 2 invokes SR 3.2.4.2; which has a surveillance frequency in accordance with the surveillance frequency control program. With a 72-hour completion time for Required Action 3.3.1.D.1, this program may have 26

little practical effect on the surveillance frequency of SR 3.2.4.2; however, combined with calculated RICT (potential 30 day CT) for Required Action D.1, the surveillance frequency control program may have a practical effect on the surveillance frequency of SR 3.2.4.2.

Describe why the combined effect of implementing both these programs is still acceptable.

EICB AUDIT QUESTION 03 - TS Condition 3.3.2.F Regarding LAR Table E1-1, Condition 3.3.2.F, explain why one of one switch is not a loss of function.

EICB AUDIT QUESTION 04 - TS Condition 3.3.2.K Regarding LAR Table E1-1, Condition 3.3.2.K, explain why one inoperable channel when 4 channels required is not a loss of function.

EICB AUDIT QUESTION 05 - Defense in Depth Starting on LAR page E1-33 of 36 (PDF page 339 of 405), the licensee provides a general description of the defense-in-depth for the facility; however, the NRC staff is interested in evaluating the defense in depth with respect to each event in the accident analysis. Typically, the LAR includes a table that identifies, for each event in Chapter 15, the primary and the diverse means to address that event. Please prepare such a table in preparation for the audit.

27