Text

Response to Request for Additional Information and Supplement to License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide .
	ML22335A468
Person / Time
Site:	Browns Ferry
Issue date:	12/01/2022
From:	Jim Barstow; Tennessee Valley Authority
To:	; Office of Nuclear Reactor Regulation, Document Control Desk
References
	CNL-22-097, EPID L-2022-LLA-0049
	Download: ML22335A468 (1)
	v • d • e

1101 Market Street, Chattanooga, Tennessee 37402 CNL-22-097 December 1, 2022 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Dockets 50-259, 50-260, and 50-296

Subject:

Response to Request for Additional Information and Supplement to License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (BFN TS-524) EPID L-2022-LLA-0049

References:

1. TVA Letter to NRC, CNL-21-009, License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, (BFN TS-524), dated March 31, 2022 (ML22090A287)

2. NRC electronic mail to TVA, Request for Additional Information Related to TVA's Request to Adopt TSTF-505 and TSTF-439 for Browns Ferry Nuclear Plant, Units 1, 2, and 3 (EPID L-2022-LLA-0049), dated October 19, 2022 (ML22292A272)

In Reference 1, Tennessee Valley Authority (TVA) requested an amendment to the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68. The proposed amendment would modify Technical Specifications (TS) requirements to permit the use of Risk-Informed Completion Times in accordance with Technical Specification Task Force (TSTF)-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF [Risk-Informed TSTF] Initiative 4b. In Reference 2, the Nuclear Regulatory Commission (NRC) issued a request for additional information (RAI) and requested TVA response by December 5, 2022.

provides TVAs responses to the RAI. Enclosure 2 provides a supplement to the Reference 1 license amendment request resulting from RAI responses. The supplemental pages in Enclosure 2 replace their respective pages from Reference 1.

U.S. Nuclear Regulatory Commission CNL-22-097 Page 2 December 1, 2022 This letter does not change the no significant hazard consideration, or the environmental consideration contained in Reference 1. Additionally, in accordance with 10 Code of Federal Regulations (10 CFR) 50.91(b)(1), TVA is sending a copy of this letter and enclosures to the Alabama Department of Public Health.

There are no new regulatory commitments contained in this submittal.

Please address any questions regarding this submittal to Stuart L. Rymer, Director (Acting),

Nuclear Regulatory Affairs at slrymer@tva.gov.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 1st day of December 2022.

Respectfully, James Barstow Vice President, Nuclear Regulatory Affairs and Support Services

Enclosures:

1.

Response to Request for Additional Information

2.

Supplement to CNL-21-009 License Amendment Request cc (w/Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant State Health Officer, Alabama Department of Public Health Digitally signed by Rearden, Pamela S Date: 2022.12.01 11:57:51 -05'00' CNL-22-097 E1 of 17 Response to Request for Additional Information Note: The Nuclear Regulatory Commission (NRC) staffs questions are in italics throughout this enclosure. The Tennessee Valley Authority (TVA) responses are in unitalicized font.

By application dated March 31, 2022 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML22090A287), the Tennessee Valley Authority (TVA) submitted a license amendment request (LAR) for Browns Ferry Nuclear Plant (Browns Ferry or BFN), Units 1, 2, and 3. The proposed amendments would revise certain technical specifications (TSs) to permit the use of a risk-informed completion time (RICT) for actions to be taken when a limiting condition for operation (LCO) is not met. The proposed changes to implement RICT are based on a Technical Specifications Task Force (TSTF) Traveler, TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times (ML18183A493).

The LAR also proposed to implement TSTF-439, Eliminate Second Completion Times Limiting Time From Discovery of Failure to Meet an LCO (ML21272A357).

By letter dated June 14, 2022 (ML22147A137), the U. S. Nuclear Regulatory Commission (NRC) staff transmitted an audit plan to TVA stating its plan to conduct a regulatory audit to examine TVAs non-docketed information with the intent to gain understanding, to verify information, and to identify information that will require docketing to support the basis of the licensing or regulatory decision.

By emails August 19, 2022 (ML22238A065), August 24, 2022 (ML22238A067), September 13, 2022 (ML22259A037), and September 14, 2022 (ML22259A038 and ML22259A039), the NRC staff transmitted audit questions in advance of and during the audit meeting that was conducted the week of September 12, 2022. Based on discussions during the audit meeting, the NRC staff determined that additional information would need to be placed on the docket to support the staffs regulatory decision regarding the application. Below are the requests for the additional information.

RAI 1 (APLA/APLC) - PRA Model Uncertainty Analysis for Updated PRA Models (Audit Question 3)

Section 2 of Enclosure 5 to the LAR identifies the model of record (MOR) for each probabilistic risk assessment (PRA) used in the application. For the internal events PRA it is MOR 10, for the fire PRA it is MOR 6, and for the seismic PRA it is MOR 1. The NRC staff reviewed the portal documents provided and it appears that some uncertainty analyses were conducted using earlier models. The NRC staff notes that an MOR update can significantly affect the risk results.

It may raise the importance of a previously analyzed source of uncertainty that was not significant to the point where it becomes a key source of uncertainty. A model update can also introduce a new source of uncertainty.

a.

Clarify how the uncertainty analyses that the staff has audited reflect the MORs used to support this application.

b.

For any PRA hazard model for which the MOR used for this application is different from the model subjected to the last uncertainty review, justify the conclusion that the difference introduces no new key source of uncertainty relevant to this application.

Similarly, confirm the conclusion provided in Section 5 of Enclosure 9 of the LAR, based on any updated MOR uncertainty review, that the adjustments to the MOR to create the OTMHM introduce no key source of uncertainty relevant to RICTs.

CNL-22-097 E2 of 17 TVA Response Response to Part a The evaluation of sources of uncertainty relied on the probabilistic risk assessment (PRA) documentation pertaining to MOR 10 for the internal events PRA, MOR 6 for the fire PRA, and MOR 1 for the seismic PRA.

MOR 10 of the internal events PRA incorporates the model changes associated with the resolution of internal events findings. For the Risk-Informed Completion Times (RICT) application, these model changes were implemented in the one-top multi-hazard model (OTMHM) for the internal events, seismic, and fire portions (see response to RAI 3 (APLA/APLC)).

The incorporation of the MOR 10 model changes is not yet reflected in the documentation of the fire PRA and of the seismic PRA. In addition, the OTMHM contains minor fault tree logic corrections not yet incorporated into MOR 10.

Response to Part b Based on the response to Part a, there is a gap between the uncertainty review and the OTMHM used for the RICT application. This gap essentially corresponds to a lag between:

1) the OTMHM model, and 2) the seismic and fire MOR documentation regarding the changes associated with the resolution of internal events findings.

With respect to the internal events PRA, there is no gap between the last uncertainty review and the MOR used for the RICT application because the OTMHM reflects MOR 10 and is therefore consistent with the internal events PRA model documentation. The minor fault tree logic corrections in the OTMHM (mentioned in the response to Part a) do not introduce new sources of uncertainty.

With respect to the seismic and fire PRA, there are no additional sources of uncertainty. This is because the MOR 10 changes propagated to the seismic and fire portions of the OTMHM pertain to internal events and do not introduce new sources of uncertainty beyond what was already evaluated in the internal events PRA. There is only one notable difference, which is between the fire portion of the OTMHM and the fire PRA of MOR 6. This difference consists of crediting the emergency high-pressure makeup (EHPM) crossties in the OTMHM, whereas these crossties were not credited in the fire PRA MOR 6. The absence of credit for the EHPM crosstie in the fire PRA MOR 6 was not identified as a source of uncertainty in the fire PRA documentation, because at the time of MOR 6, the plant had no procedures to credit these crossties in case of a fire, and therefore the modeling reflected the as-built, as-operated plant.

Crediting the EHPM crosstie in the OTMHM introduces no new source of uncertainty due to the fact that the plant has since incorporated procedural guidance to credit these crossties in case of a fire (as relevant), and therefore still represents the as-built, as-operated plant.

In conclusion, the gap between the uncertainty review and the OTMHM used for the RICT application has not introduced new key source of uncertainty relevant to the RICT application.

Therefore, the conclusions provided in Section 5 of Enclosure 9 of the LAR (CNL-21-009)1 that the adjustments to the MOR to create the OTMHM introduce no key source of uncertainty relevant to RICTs, remain correct.

1 ML22090A287 CNL-22-097 E3 of 17 RAI 2 (APLA) - In-Scope LCOs and Corresponding PRA Modeling (Audit Question 4)

The NRCs safety evaluation for NEI 06-09 specifies that the LAR should provide a comparison of the TS functions to the PRA modeled functions to show that the PRA modelling is consistent with the licensing basis assumptions or to provide a basis for when there is a difference. Table E1-1 in Section 1 of Enclosure 1 to the LAR identifies each LCO in the TSs proposed for inclusion in the RICT program. The table also describes whether the systems and components covered by the LCO are modeled in the PRA and, if so, presents both the design success criteria (DSC) and PRA success criteria. For certain LCOs, the table explains that the associated structures, systems, and components (SSCs) are not modeled in the PRAs but will be represented using a surrogate event that fails the function performed by the SSC. For some LCOs, the LAR did not provide an adequate description for the NRC staff to conclude that the PRA modeling will be sufficient.

a.

Regarding TS 3.3.5.1.B, Table E1-1 states that the suppression pool valves will be used as surrogates for the Reactor Vessel Level Low - Level 0 instrument signal (Function 2.e). It is unclear to the NRC staff which systems are affected by the Function 2.e signal.

i.

Describe the systems that are affected by the Function 2.e signal. In this description, address each configuration of the systems and how they are affected.

ii. Explain how the suppression pool surrogate bounds these effects.

b.

Regarding TS 3.3.6.1.A, Table E1-1 states for Function 3 (HPCI isolations), Function 4 (RCIC isolations), Function 5 (RWCU isolations), and Function 6 (SDC isolations) that one of the modeled pathways will be used as a surrogate. It is unclear to the NRC staff which pathways will be used for each of these functions.

i.

Clarify which modeled pathways will be used as a surrogate for each of the system isolation functions.

ii. Explain how the surrogate bounds each of the isolation functions.

c.

Regarding TS 3.6.1.2.C, Table E1-1 states that one of the modeled pathways will be used as a surrogate when one of the primary containment airlocks is inoperable. Indicate the impact of this surrogate on large early release calculations compared to the airlock.

i.

Briefly describe the effect of the failure of early containment isolation (i.e., plant response to the failure of the modeled pathway).

ii. Explain how this bounds the effect of an inoperable containment airlock door.

d.

Regarding TS 3.6.1.3.A, Table E1-1 states that, for the valves not modeled, a pathway that is modeled will be used as a surrogate. It is unclear to the NRC staff which pathways will be used for each affected function.

i.

Clarify which modeled pathways will be used as a surrogate for each of the system isolation functions affected.

ii. Provide justification that the surrogate bounds each of the isolation functions.

CNL-22-097 E4 of 17 TVA Response Response to Part a.i Technical Specification (TS) Bases 3.3.5.1 for Function 2.e notes, The Level 0 Function is provided as a permissive to allow the RHR System to be manually aligned from the low pressure coolant injection (LPCI) mode to the suppression pool cooling/spray or drywell spray modes. The permissive ensures that water in the vessel is approximately two thirds core height before the manual transfer is allowed. This ensures that LPCI is available to prevent or minimize fuel damage. The TVA PRA RHR System Notebook, Section 3.4.3, notes, Reactor vessel water level -183 inches indicated on Post Accident Flooding Range. LIS used to provide a level permissive signal to containment cooling valves based on level inside the shroud.

Containment spray is permitted only if level is >2/3 core height with LOCA signal present.

Therefore, the suppression pool cooling (SPC) system is impacted where the injection valves (i.e., containment cooling valves) may not open. Additionally, if the valves fail to close, then flow diversion impacts loop I(II) injection path (for shutdown cooling (SDC) and LPCI).

Response to Part a.ii The level permissive signal is sent to the containment cooling valves, which are valves FCV-74-57(71). Failure of these valves to open/close bounds the effects of the level permissive signal. Failure of the valves to open fails the SPC injection path and failure of the valves to close provides a flow diversion impacting SDC and LPCI.

Response to Part b.i Penetration X18 (Drywell Floor Drain) valves are used as a surrogate for each of the system functions not already mapped.

Response to Part b.ii Valve FCV-77-2A fails to close and Valve FCV-77-2B spuriously opens were used as surrogates to fail penetration X18, which results in containment isolation failure greater than or equal to 3 inches. BFN PRA Containment Isolation Notebook, Section 3.3 Functional Success Criteria, states that The failure to isolate containment (i.e., a containment breach of greater than 2 inches in diameter) is treated as a drywell failure. Therefore, this surrogate represents bypass of containment and fails the containment isolation top gate.

Response to Part c.i BFN PRA Primary Containment Isolation System (PCIS) Notebook, Section 3.1, notes:

The PCIS is designed to prevent leakage of radioactive materials during accident conditions from primary containment into the reactor building or directly into the environment. The PCIS accomplishes this function by initiating automatic isolation of appropriate pipelines that penetrate the primary containment, whenever monitored parameters exceed pre-selected operational limits.

If the PCIS fails to accomplish this function, it is assumed that radioactive material will be released into the reactor building or directly into the environment, thus being guaranteed to fail to fulfill its success criteria of ensuring that all penetrations between the reactor and the drywell or wetwell atmosphere are closed and isolated.

CNL-22-097 E5 of 17 Section 3.3 of the PCIS Notebook notes that the failure to isolate containment (for a breach greater than 2-inch diameter) is treated as drywell failure.

Response to Part c.ii TS B 3.6.1.2 Primary Containment Air Lock notes the air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. As part of primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBA). The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary containment leakage rate to within limits in the event of a DBA.

Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analysis.

Valve FCV-77-2A fails to close and Valve FCV-77-2B spuriously opens were used as surrogates to fail penetration X18, which results in containment isolation failure greater than or equal to 3 inches. BFN PRA Containment Isolation Notebook, Section 3.3 Functional Success Criteria, states that The failure to isolate containment (i.e., a containment breach of greater than 2 inches in diameter) is treated as a drywell failure. Therefore, this surrogate of a failed primary containment penetration represents bypass of containment and is used to bound the effect of the primary containment air lock not maintaining air lock integrity.

Response to Part d.i Penetration X18 (Drywell Floor Drain) valves are used as a surrogate for PCIVs not already mapped.

Response to Part d.ii Valve FCV-77-2A fails to close and Valve FCV-77-2B spuriously opens were used as surrogates to fail penetration X18, which results in containment isolation failure greater than or equal to 3 inches. BFN PRA Containment Isolation Notebook, Section 3.3 Functional Success Criteria, states that The failure to isolate containment (i.e., a containment breach of greater than 2 inches in diameter) is treated as a drywell failure. Therefore, this surrogate of a failed primary containment penetration represents bypass of containment and is used to bound the primary containment isolation function.

RAI 3 (APLA/APLC) - Update of Fire and Seismic PRAs with the resolution of Internal Event F&Os (Audit Question 5a)

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (ML090410014) recommends a peer review of the PRA model and its results. The primary results of peer review are the facts and observations (F&Os) recorded by the peer review team and the subsequent resolution of these F&Os using the closure process documented in NEI 05-04/07-12/12-06 Appendix X, Close-out of Facts and Observations (F&Os) (ML17086A431), that the NRC has accepted for use.

The NRC staff notes that implementation of risk-informed categorization of SSCs under 10 CFR 50.69 previously has been authorized by license amendments issued to Browns Ferry CNL-22-097 E6 of 17 (ML21173A177). A prerequisite to implementation of these amendments is that the resolutions to the internal events findings with the potential to impact the FPRA [fire PRA] and SPRA

[seismic PRA] modeling will be incorporated into the FPRA and SPRA. Enclosure 2 to the LAR does not discuss the resolution of internal events F&Os in either the fire or seismic PRA models.

It is not clear to the NRC staff whether the PRA models to be used in RICT calculations have incorporated all relevant F&O resolutions.

Confirm that all internal events PRA modeling updates performed to resolve F&Os that could impact fire or seismic risk were incorporated into the fire and seismic PRA models.

TVA Response The OTMHM used for the RICT application incorporates the model changes associated with the resolution of internal events findings. These model changes were also incorporated into the seismic portion and fire portion of the OTMHM.

Regarding documentation of this incorporation, refer to the response to RAI 1 (APLA/APLC).

RAI 4 (APLA) - Risk Calculation Based on the Model of Record (Audit Question 6a)

Regulatory Guide 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (ML17317A256),

provides risk acceptance criteria for total core damage frequency (CDF 1E-04/year) and large early release frequency (LERF 1E-05/year). Section 6.4 of NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (ML17062A466), states that for a capability category II risk evaluation, the mean values of the risk metrics (total risk and change in risk) are evaluated against these guidelines. More specifically, these metrics are the means of the probability distributions that result from the propagation of input parameter uncertainties and model uncertainties explicitly reflected in the PRA models.

In general, the point estimates of CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability do not represent true mean values of the CDF and LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state-of-knowledge correlation (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines).

Table E5-1 of Enclosure 5, Section 2 of Attachment 1 to the LAR presents point estimates of CDF and LERF based on the optimized one-top multihazard model. For each of the three units, values for total risk are listed along with risk contributions from internal events (which includes internal flooding), internal fire, and seismic events. These reported values did not match the point estimates developed from the model of record.

When quantification explicitly addresses the SOKC, point estimates are likely to be lower than the mean risk values. The total LERF is reported as 9.08E-06/year, 8.63E-06/year, and 8.53E-06/year for Browns Ferry, Units 1, 2, and 3, respectively. When both model updates to resolve F&Os and the SOKC are considered, the total risk could approach the criteria from RG 1.174.

Demonstrate that the total risk for Units 1, 2, and 3 meet RG 1.174 risk acceptance guidelines for CDF and LERF. Mean values based on the model of record should be appropriately combined to include risk from internal events, seismic hazards, and fire as well as accounting CNL-22-097 E7 of 17 for the SOKC. In this demonstration, account for changes in risk due to PRA model updates needed in response to NRC staff information requests or previous commitments and include identification of the parameters that are assumed to be correlated in the parametric uncertainty analysis of fire and seismic events.

TVA Response As shown in Enclosure 5 of CNL-21-009, the BFN OTMHM was built using the Internal Events and Internal Flooding PRA (MOR 10), the SPRA (MOR 1), and the FPRA (MOR 6). The OTMHM currently includes SOKC for the internal events (plus internal flooding), seismic, and fire models. See the Enclosure 9 of CNL-21-009 for an explanation on how the SOKC and correlation is incorporated into the BFN models.

In addition, all F&Os were resolved prior to the CNL-21-009 submittal to the NRC so no changes were required to be made following the submittal for F&O resolutions. As pointed out by the NRC, the BFN RICT LAR submittal in CNL-21-009 provided the point estimates results for CDF and LERF based on the optimized OTMHM. The OTMHM has been quantified and compared to the individual hazard benchmark models. The OTMHM results closely matched the benchmark results for all hazards and any discrepancies were dispositioned. Cutset reviews were also performed, and the OTMHM was judged to be working as intended.

The mean values were calculated by running the optimized OTMHM cutsets through UNCERT and then applying ACUBE to the results to eliminate overly conservative results on the seismic model.

In order to properly run UNCERT, some changes had to be made to the reliability (RR) database. The following are the changes that were made to the RR database:

x To turn on sampling in UNCERT, the type code @POINTCALC was changed from 1 to

0.

x In the internal events (including internal flooding) and seismic recovery files, recoveries are applied to non-dependent human reliability analyses (HRAs). For example, HFA_0_519FLOOD is set to 1.0 and later recovered using HFA_0_519FLOOD_REC with a value of 1.780E-03. In the BE table, the HRA values for the unrecovered HRAs are set to the nominal value. To properly account for the uncertainty, the unrecovered HRAs are set to 1.0 in the RR database while the recovered HRAs are kept at the nominal value.

x In the OTMHM database, there are discrepancies in the fire HRAs when compared with the HRA Calculator Database file. The values in the HRA BEs in the RR database were updated to match the HRA database values.

x The cutsets were loaded with the database probabilities to get the proper uncertainty distribution using the type code equations.

CNL-22-097 E8 of 17 The seismic cutsets were processed using ACUBE with the options applied in the table below.

PRA Model ACUBE Options U1 SPRA CDF OTMHM Options: /C=300 /NOTRUE1 U1 SPRA LERF OTMHM Options: /C=400 /NOTRUE1 U2 SPRA CDF OTMHM Options: /C=300 /NOTRUE1 U2 SPRA LERF OTMHM Options: /C=400 /NOTRUE1 U3 SPRA CDF OTMHM Options: /C=300 /NOTRUE1 U3 SPRA LERF OTMHM Options: /C=400 /NOTRUE1 The mean value results were then compared to the point estimate results from CNL-21-009 as follows.

BFN IE PRA Point Estimate Values U1 CDF 3.50E-06 U1 LERF 8.95E-07 U2 CDF 2.99E-06 U2 LERF 6.89E-07 U3 CDF 3.34E-06 U3 LERF 7.80E-07 BFN IE PRA Mean Values U1 CDF 3.54E-06 U1 LERF 9.34E-07 U2 CDF 3.04E-06 U2 LERF 7.37E-07 U3 CDF 3.40E-06 U3 LERF 8.20E-07 BFN FPRA Point Estimate Values U1 CDF 2.75E-05 U1 LERF 4.19E-06 U2 CDF 3.19E-05 U2 LERF 4.05E-06 U3 CDF2.69E-05 U3 LERF 3.58E-06 BFN FPRA Mean Values U1 CDF 2.79E-05 U1 LERF 4.30E-06 U2 CDF 3.21E-05 U2 LERF 4.14E-06 U3 CDF 2.71E-05 U3 LERF 3.68E-06 BFN SPRA Point Estimate Values U1 CDF 5.87E-06 U1 LERF 3.99E-06 U2 CDF 5.80E-06 U2 LERF 3.89E-06 U3 CDF 6.23E-06 CNL-22-097 E9 of 17 U3 LERF 4.17E-06 BFN SPRA Mean Values U1 CDF 7.41E-06 U1 LERF 4.46E-06 U2 CDF 7.21E-06 U2 LERF 4.44E-06 U3 CDF 7.84E-06 U3 LERF 4.61E-06 BFN ALL HAZARDS Point Estimate Values U1 CDF 3.69E-05 U1 LERF 9.08E-06 U2 CDF 4.07E-05 U2 LERF 8.63E-06 U3 CDF 3.65E-05 U3 LERF 8.53E-06 BFN ALL HAZARDS Mean Values U1 CDF 3.88E-05 U1 LERF 9.69E-06 U2 CDF 4.23E-05 U2 LERF 9.32E-06 U3 CDF 3.84E-05 U3 LERF 9.11E-06 As can be seen above, the total risk using the mean values for Units 1, 2, and 3 meet Regulatory Guide (RG) 1.174 risk acceptance guidelines for CDF and LERF.

RAI 5 (APLA) - Consistency of the Results Produced by the CRM Tool With the PRA Model Of Record (Audit Question 7a)

Regulatory Guide 1.174, Revision 3, recommends that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship when quantifying the effect of the proposed licensing-basis change on the PRA elements.

Section 4.2 of NEI 06-09-A, Risk-Managed Technical Specifications Guidelines, (ML12286A322) describes attributes of the tool used for configuration risk management (CRM).

The PRA models are normally transformed to create a real-time risk (RTR) model suitable for use with the CRM tool. Item 3 of Section 2.3.5 of the NEI guidance document states, The following specific CRM tool attributes are required for [Risk Managed Technical Specifications]

RMTS implementation: Appropriate benchmarking of results from the CRM tool against the PRA model shall be performed to demonstrate consistency.

The staff reviewed how the one-top multihazard model (OTMHM) was integrated with the Phoenix model and how example evaluations were used to check the Phoenix model. However, it is not clear how results using the CRM tool were directly benchmarked against results from the PRA MOR. The NRC staff noted that benchmarking was performed between the individual CNL-22-097 E10 of 17 PRA hazard models on one hand and the OTMHM on the other, with each hazard quantified separately. Total CDF and total LERF were quantified for each unit, using the OTMHM.

Clarify how the benchmarking activities performed can confirm consistency of the RTR model results with the results of each PRA model of record.

TVA Response Benchmarking was performed between the individual PRA hazard models and the OTMHM, with each hazard quantified separately. Quantifying hazards separately allows clear comparison between each hazards models. No significant differences were found during these comparison quantifications (only slight differences due to quantification settings). In addition, example Phoenix quantifications were performed to demonstrate that the model performed as expected.

RAI 6 (STSB) - Justification for ECCS Instrumentation Variation (Audit Question 11)

Attachments 2.1, 2.2, and 2.3 to the LAR contain the proposed TS markups for Browns Ferry, Units 1, 2, and 3, respectively. In proposed TS 3.3.5.1, ECCS Instrumentation, each of the Required Actions proposed for the RICT program includes a loss of function in Conditions B, C, E, F, and G. Per TSTF-505, Revision 2, loss of function is a prohibited condition. Provide a justification for this variation.

TVA Response TVA concurs that there is a potential for loss of function for TS 3.3.5.1 Conditions B, C, E, F, and G. Accordingly, in Enclosure 2, TVA has supplemented the LAR to provide loss-of-function Notes preceding the RICT inserts for these Completion Times. In this manner, a RICT will not be applicable when there is a loss of function.

RAI 7 (STSB) - Apparent Loss of Function for TS Conditions (Audit Question 12a-d)

Table E1-1 of Enclosure 1 to the LAR includes descriptions of the DSC of TSs proposed for inclusion in the RICT program. Given the inoperable equipment in the TS condition, the DSC represents the minimum set of remaining credited equipment sufficient to perform TS safety function while in an RICT. The following TS conditions appear to include a loss of function.

Clarify the associated DSC in Table E1-1:

a) TS 3.3.5.1.E (One or more channels inoperable for Function 3.f, HPCI Pump Discharge Flow - Low (Bypass))

b) TS 3.5.1.C (HPCI System inoperable) c) TS 3.5.1.D (HPCI System inoperable and Condition A entered) d) TS 3.5.3.A (RCIC System inoperable)

CNL-22-097 E11 of 17 TVA Response TS 3.3.5.1 Condition E - Function 3.f (High Pressure Coolant Injection (HPCI) Pump Discharge Flow - Low (Bypass)) is provided to protect the HPCI pump from overheating when the pump is operating at reduced flow. This is a pump protection feature and not a safety function. This Function will also close the minimum flow valve, but it is not required to ensure that the Emergency Core Cooling System (ECCS) flow assumed during analyzed transients and accidents are met. Accordingly, no loss of function results.

TS 3.5.1 Conditions C and D - HPCI is a single train high pressure ECCS that is credited with mitigating a small break loss-of-coolant accident. If that function is lost, the Reactor Core Isolation Cooling (RCIC) system provides a high pressure makeup capability. Otherwise, the Automatic Depressurization System will depressurize the Reactor Pressure Vessel (RPV),

allowing the low pressure ECCS to provide RPV makeup.

TS 3.5.3 Condition A - RCIC is a single train high pressure system that is not credited in the accident analysis. Notwithstanding, if the RCIC function is lost, the HPCI system provides a high pressure makeup capability to the RPV.

The LAR has been supplemented in Enclosure 2 to add this information to the Other Comments column of Table E1-1 for these entries.

RAI 8 (EEEB) - Other Comments (Audit Question 13)

Table E1-1 of Enclosure 1 to the LAR lists the TS LCO Conditions to which the RICT Program is proposed to be applied and documents the certain information regarding the TSs with the associated safety analyses, the analogous PRA functions, and the results of the comparison.

TS Condition 3.3.8.1.A The TS Condition states: One degraded voltage relay channel inoperable on one or more shutdown board(s). AND The loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

Under the column Other Comments it states, Not explicitly modeled. Undervoltage DG start relays are used as surrogates. This is conservative because one of the two diesel start signals are failed.

Provide an explanation of Other Comments, preferably with an example, considering that the TS Condition description applies to one or more shutdown board(s).

TVA Response The undervoltage and degraded voltage logic is shown below. The degraded voltage relays are not modeled in the PRA, but the two undervoltage relays are modeled. When TS Condition 3.3.8.1.A is entered and the decision has been made to utilize the RICT, one of the two undervoltage relays is failed in the real time risk PRA model. In this situation, a failure of a single undervoltage relay would fail the EDG start signal (probability = 1.01E-04).

Assuming that the degraded voltage relays were modeled in the PRA, when TS Condition 3.3.8.1.A is entered and the decision has been made to utilize the RICT, one of the three degraded relays would be failed in the real time risk PRA model. In this situation, the relay CNL-22-097 E12 of 17 would be in the tripped position and two degraded voltage relays would need to fail in order to fail the EDG start signal (probability = 1.01E-04*1.01E-04 = 1.02E-08). Therefore, modeling TS Condition 3.3.8.1.A using the failure of a single undervoltage relay as a surrogate will give a conservative probability of the failure to start the EDGs.

RAI 9 (EEEB) - Availability of Temporary DGs (Audit Question 14)

TS Condition 3.8.1.B (U1 & U2) and TS 3.8.1.B (U3)

The TS Conditions state, One required Unit 1 and 2 [diesel generator] DG inoperable, and One required Unit 3 DG inoperable.

The current Competition [sic] Time varies from 7 days to 14 days depending on the availability of Temporary/Supplemental diesel generators (TDG).

Clarify whether credit of availability of TDG(s) is or will be considered in the calculation of RICT of DGs.

TVA Response The availability of TDGs is not considered in the calculation of RICT of DGs. The TDGs are not in the BFN PRA model.

CNL-22-097 E13 of 17 RAIs 10-15 The following applies to RAIs 10 through 15 Table E1-1 of Enclosure 1 to the LAR includes descriptions of the design success criteria (DSC) of TSs proposed for inclusion in the RICT program. Column 2, TS Condition Description, lists the current TS Condition for which an RICT is being proposed, Column 3, SSCs Covered by TS LCO Condition, describes the SSCs addressed by each action requirement, and Column 6, Design Success Criteria, provides a summary of the success criteria from the design basis analyses. Regarding the information in these columns for certain TS Conditions, the NRC staff requests the following information.

RAI 10 (EEEB) - TS 3.8.1, Condition F (U1 & U2) and Condition F (U3) (Audit Question 18)

Column 2 of Table E1-1 for TS 3.8.1, Condition F, states One required offsite circuit inoperable.

AND One required Unit 1 and 2 [or Unit 3] DG inoperable. Column 6 states that the DSC is One offsite AC power source AND Three of four U1 and U2 [or U3] DGs. These two statements seem to be inconsistent with statements in Table E1-1 for TS 3.8.1 Conditions A and B, and TS 3.8.1 Required Actions (RAs) F.1 and F.2, which require either power source for safe shutdown Explain the minimum required alternating current (AC) sources needed to fulfill the required safety function.

TVA Response The TS 3.8.1 Condition F (U1 & U2) Design Success Criteria on Table E1-1 has been changed in Enclosure 2 to read One offsite AC power source OR Two of four U1 and U2 DGs. The TS 3.8.1 Condition F (U3) Design Success Criteria on Table E1-1 has been changed in Enclosure 2 to read One offsite AC power source OR Two of four U3 DGs.

RAI 11 (EEEB) - TS 3.8.4, Condition A (U1 & U2) and Condition A (U3) (Audit Question 19)

Column 2 for TS 3.8.4.A (U1 & U2) states One Unit DC electrical power subsystem inoperable.

OR One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable, whereas column 3 lists the SSCs covered by the LCO as Three 250 VDC Unit subsystems AND Four 250 VDC shutdown board subsystems AND Four Unit 2 and Two Unit 3 DG DC subsystems.

These two statements appear to be inconsistent. Similarly, columns 2 and 3 of TS 3.8.4, Condition A for Unit 3 seem to have same inconsistency.

a.

Explain why column 3 is inconsistent for SSCs listed in column 2. Inoperable DG DC subsystems are addressed by TS 3.8.4, Condition C (e.g., U1 TS).

b.

Explain why column 6 refers to an inoperable direct current (DC) subsystem in reference to 250 VDC shutdown boards, which has no impact on 250 VDC shutdown boards since they are powered by their own batteries according to Browns Ferry Updated Final Safety Analysis Report Section 8.5.3.5, Distribution System (ML21286A411).

TVA Response

a. The entries in Table E1-1 for TS 3.8.4 Condition A (U1 & U2) and TS 3.8.4 Condition A (U3),

are not clear as to how the success criteria correspond to the SSCs included in each of TS CNL-22-097 E14 of 17 Conditions. The entries for these TS conditions in Table E1-1 have been updated as shown in Enclosure 2.

b. The Design Success Criteria entries in Table E1-1 for TS 3.8.4 Condition A (U3) have been updated as shown in Enclosure 2.

RAI 12 (EEEB) - TS 3.8.7, Condition A (U1 & U2) and Condition A (U3), and TS 3.8.7, Condition E (U1) and Condition F (U3) (Audit Question 20)

In the LAR, the TS Bases for TS 3.8.7, Action A.1 (page B 3.8-89) states, in part, that however, because another single failure in the remaining three 4.16 kV shutdown boards could result in the minimum required ESF functions not being supported. Therefore, the 4.16 kV shutdown board must be restored to OPERABLE status within 5 days. However, column 6 of Table E1-1 for TS Condition 3.8.7.A (U1 & U2) lists the DSC as One of two divisions.

Additionally, TS Condition 3.8.1.B (U1 & U2) in Table E1-1, column 6 lists the DSC for one required Unit 1 and 2 DG (1 of 4 DGs) inoperable as Three of four U1 and U2 DGs. The DSC for TS 3.8.7.A appears to be inconsistent with the information in the TS Bases and the DSC for TS 3.8.1.B. Similarly, TS 3.8.4, Condition A for Unit 3 seems to have the same inconsistency.

Explain why a minimum of three of four shutdown boards are not listed as the DSC (for safe shutdown) for TS Condition 3.8.7.A.

TVA Response The following changes have been made to Table E1-1, as shown in Enclosure 2.

1.

The TS 3.8.1 Condition B (U1 & 2) Design Success Criteria has been revised to read Two of four U1 and U2 DGs.

2.

The TS 3.8.1 Condition B (U3) Design Success Criteria has been revised to read Two of four U3 DGs.

3.

The TS 3.8.7 Condition A (U1 & U2) Design Success Criteria One of two divisions has been replaced with the more descriptive Two Unit 1 and 2 4.16 kV shutdown boards.

4.

The TS 3.8.7 Condition A (U3) Design Success Criteria One of two divisions has been replaced with the more descriptive Two Unit 3 4.16 kV shutdown boards.

5.

The TS 3.8.7 Condition E (U1) Design Success Criteria One of two divisions has been replaced with the more descriptive One division of 4.16 kV shutdown boards (Division 1

- Shutdown Board A and B. Division 2 - Shutdown Board C and D).

6.

The TS 3.8.7 Condition F (U3) Design Success Criteria One of two divisions has been replaced with the more descriptive One division of 4.16 kV shutdown boards (Division 1

- Shutdown Board 3EA and 3EB. Division 2 - Shutdown Board 3EC and 3ED).

RAI 13 (EEEB) - TS 3.8.7, Condition B (U1, U2, U3) (Audit Question 21)

TS Condition 3.8.7.B in Table E1-1 states One Unit 1 480 V Shutdown Board inoperable. OR 480 V (reactor motor operated valve (RMOV)) Board 1A inoperable. However, column 3 for the entry does not list the RMOV board as an SSC cover by the LCO Condition.

CNL-22-097 E15 of 17 Explain why column 3 does not list the RMOV board available per unit identified specifically in the LCO.

TVA Response The following changes have been made to Table E1-1, as shown in Enclosure 2.

1.

TS 3.8.7, Condition B (U1) column 3 has been revised to read: 480V Shutdown Boards 1A and 1B and 480V RMOV Boards 1A and 1B and associated load centers and transformers.

2.

TS 3.8.7, Condition B (U2) column 3 has been revised to read: 480V Shutdown Boards 2A and 2B and 480V RMOV Boards 2A and 2B and associated load centers and transformers.

3.

TS 3.8.7, Condition B (U3) column 3 has been revised to read: 480V Shutdown Boards 3A and 3B and 480V RMOV Boards 3A and 3B and associated load centers and transformers.

RAI 14 (EEEB) - TS 3.8.7, Condition D (U1) and TS 3.8.7, Condition E (U2 or U3) (Audit Question 22)

a.

Column 3 for TS Condition 3.8.7.D in Table E1-1 states, in part, Five Shutdown Board 250 V DC electrical power distribution subsystems and Column 6 states, in part, Three of four Unit 1 & 2 Shutdown Boards. These statements appear to be inconsistent.

Additionally, the TS Bases on page B3.8-58 refers to four 250 V DC shutdown boards for Units 1 and 2, and TS 3.8.4, Condition A (U3) in Table E1-1 refers to four shutdown boards.

Clarify the correct number of 250 VDC shutdown boards needed for the DSC.

b.

Column 2 for TS 3.8.7.E (U3) in Table E1-1 refers to the shutdown boards for Unit 3; however, column 6 for the TS condition states, in part, Three of four Unit 1 & 2 Shutdown Boards.

Explain why column 6 for TS 3.8.7.E (U3) includes only the U1 and U2 shutdown boards and not the U3 shutdown boards.

TVA Response Response to Part a The entries in Table E1-1 for TS 3.8.7 Condition D (U1), TS 3.8.7 Condition E (U2), and TS 3.8.7 Condition E (U3) are not clear as to how the success criteria correspond to the SSCs included in each of TS Conditions. The entries for these TS conditions in Table E1-1 have been updated in Enclosure 2.

Response to Part b The Table E1-1 entry for TS 3.8.7 Condition E (U3) has been updated to correct the success criteria as shown in Enclosure 2.

CNL-22-097 E16 of 17 RAI 15 (EEEB) - TS 3.8.7, Condition F (U2) (Audit Question 23)

In Attachment 2.2 to the LAR, there is a markup for TS 3.8.7, Condition F for Unit 2.

Additionally, there is an entry for TS 3.8.7, Condition F in LAR Table E1-3. However, there is not a corresponding entry in LAR Table E1-1.

Explain why there is not a line item for Unit 2 in LAR Table E1-1.

TVA Response The entry for TS 3.8.7, Condition F (U2) was inadvertently omitted. The entry should be identical to TS 3.8.7, Condition E (U1). The LAR has been supplemented in Enclosure 2 to include this line item.

RAI 16 (STSB) - (Audit Question 24)

In attachments 2.1, 2.2, and 2.3 of the LAR, TVA proposed to add an RICT to Browns Ferry, Units 1, 2, and 3, TS 3.8.1 Required Action B.5 for one inoperable DG. Currently, Required Action B.5 has Completion Times with nested logic related to the availability of the TDG. The addition of the RICT to this set of Completion Times, as proposed, has the potential to be a confusing requirement.

Discuss revising the nesting of the and logical connectors for clarity.

TVA Response Although the existing nesting logic for TS 3.8.1 Required Action B.5 does not appear to be inconsistent with the Improved Standard Technical Specifications Writers Guide, TVA acknowledges that this could be a source of confusion to the Operations staff. Accordingly, TVA has supplemented the LAR in Enclosure 2 to indent the AND logical connectors.

RAI 17 (APLA/APLC) - Difference Between CDF and LERF Mean and Point Estimate Values (Audit Question 25)

During the audit discussions, TVA noted that it updated the values for CDF and LERF from internal events, fire, and seismic PRA for all three units. Based on the updated values, the NRC staff noted that the mean values are greater than the point estimate of these quantities for all cases considered, and the differences are greater than 2 percent. Section 1 of Enclosure 9 to the LAR states, A comparison of CDF results from the normal model quantification and the parametric uncertainty evaluation shows that the difference between the point estimate and mean results is less than 2%. Therefore, SOKC is not a key source of uncertainty for the TSTF-505 application. The cited statement appears to contradict statements made by TVA in response to Audit Question 6.

Explain this apparent contradiction or correct the cited statements to make them consistent with the updated PRA results.

TVA Response Following submittal of the LAR, it was found that the mean values calculated for the BFN OTMHM was performed incorrectly and that resulted in the point estimate and mean values to be within 2% of each other. These values were corrected and the new results are shown in the CNL-22-097 E17 of 17 response to RAI 4 (APLA). These new values show that the difference between the mean and point estimate values are greater than 2%.

Because the difference between the mean and point estimate values are greater than 2%, the statement A comparison of CDF results from the normal model quantification and the parametric uncertainty evaluation shows that the difference between the point estimate and mean results is less than 2%. Therefore, SOKC is not a key source of uncertainty for the TSTF-505 application.

is no longer valid. However, correlation was one of the generic sources of uncertainty reviewed in Enclosure 9 of the LAR. In that review, it was found that correlation was not considered a key source of uncertainty. In order to avoid confusion, the above phrase has been removed from the LAR as shown in Enclosure 2.

CNL-22-097 Supplement to the CNL-21-009 License Amendment Request (60 pages)

Note - These pages are from CNL-21-009. Changes are as shown in magenta. Locations in CNL-21-009 are shown in blue notes in the footer.

CNL-21-009 A1-5 of 15 The language in the model safety evaluation provides more clarity for BFN TS Section 5.5.16 Paragraph e., so that language has been proposed. This is an administrative variation that promotes conformity with the model safety evaluation.

2.3.1.8 STS 3.8.4 Condition C, One DC electrical power subsystem inoperable for reason other than Condition A [or B]. best correlates with:

BFN Unit 1 and 2 TS 3.8.4 Condition A, One Unit DC electrical power subsystem inoperable OR One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

and BFN Unit 3 TS 3.8.4 Condition A, One Unit DC electrical power subsystem inoperable OR 3EB Shutdown Board DC electrical power subsystem inoperable.

Although the wording of the BFN Conditions is more detailed than the STS Condition, they are similarly bounded by the loss of a single DC electrical power subsystem that does not result in a loss of function. This is therefore an administrative variation with no effect on the NRC staffs model safety evaluation.

2.3.2 Technical Variations The following variations from the TSTF-505-A template for NUREG-1433 are considered to be technical in nature.

2.3.2.1 BFN TS 3.3.8.1, Loss of Power (LOP) Instrumentation, Condition A states:

RAI 6

Loss of function note precedes INSERT RICT

RAI 6

NOTE-----------------

Not applicable when a loss of function occurs Loss of function note precedes INSERT RICT LAR Attachment 2.3

INSERT RICT

Reference:

RAI 6

NOTE-----------------

Not applicable when a loss of function occurs Loss of function note precedes INSERT RICT LAR Attachment 2.3

INSERT RICT Reference RAI 16 Indent LAR Attachment 2.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-36 Amendment No. 234, 311, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

B.1

NOTES-----------

Only applicable for Functions 1.a, 1.b, 2.a, and 2.b.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND B.2

NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure Coolant Injection (HPCI)

System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of HPCI initiation capability AND B.3 Place channel in trip.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE------

Not applicable when a loss of function occurs.

In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-37 Amendment No. 234, 311 ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

C.1

NOTES-----------

Only applicable for Functions 1.c, 1.e, 2.c, 2.d, and 2.f.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND C.2 Restore channel to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program D. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

D.1

NOTE------------

Only applicable if HPCI pump suction is not aligned to the suppression pool.

Declare HPCI System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-38 Amendment No. 234, 311, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

E.1

NOTES-----------

Only applicable for Function 1.d.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for subsystems in both divisions AND E.2 Restore channel to OPERABLE status.

7 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-39 Amendment No. 234, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

F.1 Declare Automatic Depressurization System (ADS) valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND F.2 Place channel in trip.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-40 Amendment No. 234, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

G.1 Declare ADS valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND G.2 Restore channel to OPERABLE status.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 1 3.3-40a Amendment No. 234BBB ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H. Required Action and associated Completion Time of Condition B, C, D, E, F, or G not met.

H.1 Declare associated supported ECCS feature(s) inoperable.

Immediately LAR Attachment 3.1 234

AC Sources - Operating 3.8.1 BFN-UNIT 1 3.8-3a Amendment No. 280, ___

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B.

(continued)

B.5 Restore Unit 1 and 2 DG to OPERABLE status.

(continued) 7 days from discovery of unavailability of TDG(s)

$1' 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

GD\\V

FRQFXUUHQWZLWK

XQDYDLODELOLW\\RI

7'*V

$1' 14 days OR In accordance with the Risk Informed Completion Time Program LAR Attachment 3.1

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-37 Amendment No. 253, 334, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

B.1

NOTES-----------

Only applicable for Functions 1.2, 1.b, 2.a, and 2.b.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND B.2

NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure Coolant Injection (HPCI)

System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of HPCI initiation capability AND B.3 Place channel in trip.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-38 Amendment No. 253, 334, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

C.1

NOTES-----------

Only applicable for Functions 1.c, 1.e, 2.c, 2.d, and 2.f.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND C.2 Restore channel to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program D. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

D.1

NOTE------------

Only applicable if HPCI pump suction is not aligned to the suppression pool.

Declare HPCI System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-39 Amendment No. 253, 334, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

E.1

NOTES-----------

Only applicable for Function 1.d.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for subsystems in both divisions AND E.2 Restore channel to OPERABLE status.

7 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-40 Amendment No. 253, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F.

As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

F.1 Declare Automatic Depressurization System (ADS) valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND F.2 Place channel in trip.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-41 Amendment No. 253, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

G.1 Declare ADS valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND G.2 Restore channel to OPERABLE status.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR

NOTE---------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE--------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 2 3.3-41a Amendment No. 253, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H.

Required Action and associated Completion Time of Condition B, C, D, E, F, or G not met.

H.1 Declare associated supported ECCS feature(s) inoperable.

Immediately LAR Attachment 3.2

AC Sources - Operating 3.8.1 BFN-UNIT 2 3.8-3a Amendment No. 307, ___

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.5 Restore Unit 1 and 2 DG to OPERABLE status.

(continued) 7 days from discovery of unavailability of TDG(s)

$1' 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

GD\\V

FRQFXUUHQWZLWK

XQDYDLODELOLW\\RI

7'*V

$1' 14 days OR In accordance with the Risk Informed Completion Time Program LAR Attachment 3.2

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-37 Amendment No. 213, 294, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

B.1

NOTE------------

Only applicable for Functions 1.a, 1.b, 2.a, and 2.b.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND B.2

NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure Coolant Injection (HPCI)

System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of HPCI initiation capability AND B.3 Place channel in trip.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-38 Amendment No. 213, 294, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

C.1

NOTE-------------

Only applicable for Functions 1.c, 1.e, 2.c, 2.d, and 2.f.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for features in both divisions AND C.2 Restore channel to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program D. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

D.1

NOTE------------

Only applicable if HPCI pump suction is not aligned to the suppression pool.

Declare HPCI System inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

LAR Attachment 3.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-39 Amendment No. 213, 294, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

E.1

NOTE------------

Only applicable for Function 1.d.

Declare supported ECCS feature(s) inoperable when its redundant feature ECCS initiation capability is inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for subsystems in both divisions AND E.2 Restore channel to OPERABLE status.

7 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-40 Amendment No. 213, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F.

As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

F.1 Declare Automatic Depressurization System (ADS) valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND F.2 Place channel in trip.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR

NOTE---------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE---------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-41 Amendment No. 213, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

G.1 Declare ADS valves inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems AND G.2 Restore channel to OPERABLE status.

96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program AND 8 days OR

NOTE-------

Not applicable when a loss of function occurs In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 3.3

ECCS Instrumentation 3.3.5.1 BFN-UNIT 3 3.3-41a Amendment No. 213, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H. Required Action and associated Completion Time of Condition B, C, D, E, F, or G not met.

H.1 Declare associated supported ECCS feature(s) inoperable.

Immediately LAR Attachment 3.3

AC Sources - Operating 3.8.1 BFN-UNIT 3 3.8-3a Amendment No. 266, ___

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B.

(continued)

B.5 Restore Unit 3 DG to OPERABLE status.

7 days from discovery of unavailability of TDG(s)

$1' 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry 6 days concurrent with unavailability of TDG(s)

$1' 14 days OR In accordance with the Risk Informed Completion Time Program (continued)

LAR Attachment 4

CNL-21-009 A5-2 of 9 TSTF-505-A TS Title/Section/

Condition Description TSTF-505-A TS/RA BFN TS/RA Disposition Variation Reference B. Two or more feedwater and main turbine high water level trip channels inoperable.

B.1 B.1 Did not add RICT Administrative Variation - Section 2.3.1.4 End of Cycle Recirculation Pump Trip (EOC-RPT)

Instrumentation 3.3.4.1 3.3.4.1 A. One or more required channels inoperable.

A.1 A.2 A.1 A.2 Did not add RICT Did not add RICT Administrative Variation - Section 2.3.1.6 Administrative Variation - Section 2.3.1.6 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation 3.3.4.2 3.3.4.2 A. One or more required channels inoperable.

A.1 A.2 A.1 A.2 Added RICT Added RICT No variation No variation Emergency Core Cooling System (ECCS)

Instrumentation 3.3.5.1 3.3.5.1 B. As required by Required Action A.1 and referenced in Table 3.3.5.1-1 B.3 B.3 Added RICT Administrative Variation - Section 2.3.1.3 C. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

C.2 C.2 Added RICT Administrative Variation - Section 2.3.1.3 D. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

D.2.1 N/A N/A Administrative Variation - Section 2.3.1.2 E. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

E.2 E.2 Added RICT Administrative Variation - Section 2.3.1.3 Added loss of function Note Administrative Variation - Section 2.3.1.9

Reference:

RAI 6

LAR Attachment 5

CNL-21-009 A5-3 of 9 TSTF-505-A TS Title/Section/

Condition Description TSTF-505-A TS/RA BFN TS/RA Disposition Variation Reference F. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

F.2 F.2 Added RICT No variation G. As required by Required Action A.1 and referenced in Table 3.3.5.1-1.

G.2 G.2 Added RICT No variation Reactor Core Isolation Cooling (RCIC) System Instrumentation 3.3.5.2 3.3.5.3 B. As required by Required Action A.1 and referenced in Table 3.3.5.2-1 B.2 B.2 Added RICT Administrative Variation - Section 2.3.1.1 D. As required by Required Action A.1 and referenced in Table 3.3.5.2-1.

D.2.1 N/A N/A Administrative Variation - Section 2.3.1.2 Primary Containment Isolation Instrumentation 3.3.6.1 3.3.6.1 A. One or more required channels inoperable.

A.1 A.1 Added RICT Administrative Variation - Section 2.3.1.3 Low-Low Set (LLS)

Instrumentation 3.3.6.3 N/A A. One LLS valve inoperable due to inoperable channel(s).

A.1 N/A N/A Administrative Variation - Section 2.3.1.2 Loss of Power (LOP)

Instrumentation 3.3.8.1 3.3.8.1 A. One or more required channels inoperable.

N/A A.1 N/A N/A A.2 N/A Added RICT Administrative Variation - Section 2.3.1.2 Technical Variation - Section 2.3.2.1 Safety/Relief Valves (S/RVs) 3.4.3 3.4.3 A. [One [or two][required]

S/RV[s] inoperable.

A.1 N/A N/A Administrative Variation - Section 2.3.1.2 Added loss of function Note No variation No variation Administrative Variation - Section 2.3.1.9

Reference:

RAI 6

LAR Attachment 5

ENCLOSURE 1 CNL-21-009 E1-6 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments Reactor Vessel Water Level - High, Level 8 (Function 3.c) start and either the associated DG (diesel power) fails to start or the Shutdown Bus faults (normal power). This is conservative because if a channel is not available, the time delay would fail and the pump start could overload the diesel or shutdown board.

3.3.5.1.E One or more channels inoperable as required by Action A.1 and referenced in Table 3.3.5.1-1.

Core Spray Pump Discharge Flow - Low (Bypass) (Function 1.d)

High Pressure Coolant Injection Pump Discharge Flow

- Low (Bypass)

(Function 3.f)

ECCS actuation instrumentation for CS and HPCI No The ECCS instrumentation actuates CS and HPCI Two Channels, (One channel per CS subsystem)

One of one channel for HPCI Pump Discharge Flow N/A Function 1.d: Not explicitly modeled.

Failure of CS Pump min-flow motor-operated valves are used as surrogates. This is conservative since it fails the pump.

Function 3.f: Not explicitly modeled.

HPCI fails to run is used as a surrogate. This is conservative since it fails the pump.

Note - Function 3.f is provided to protect the HPCI pump from overheating when the pump is operating at reduced flow. This is a pump protection feature and not a safety function. This Function will also close the minimum flow valve, but is not required to ensure that the ECCS flow assumed during analyzed transients and accidents are met. Accordingly, no loss of function results.

Reference:

RAI 7

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-10 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments LPCI subsystems inoperable.

each LPCI subsystem.

3.5.1.C HPCI System inoperable.

HPCI system Yes Reactor inventory control for small break LOCA.

One train Same as Design Success Criteria 3.5.1.D HPCI System inoperable.

AND Condition A entered.

HPCI System AND one low pressure ECCS injection / spray subsystem inoperable Yes See LCO Conditions 3.5.1.A and 3.5.1.C See LCO Conditions 3.5.1.A and 3.5.1.C See PRA Success Criteria for 3.5.1.A and 3.5.1.C 3.5.1.E One ADS valve inoperable ADS (6 of 13 Safety/Relief Valves)

No Rapid reactor vessel depressurization to allow low pressure ECCS injection Five of Six ADS valves N/A ADS is not explicitly modeled. Operator actions for failure to initiate reactor-vessel depressurization (medium steam LOCA) and (medium liquid LOCA) are used as surrogates.

3.5.1.F One ADS valve inoperable.

AND Condition A entered.

ADS and one low pressure ECCS injection / spray subsystem inoperable Yes (low pressure ECCS injection /

spray subsystem)

ADS not modeled See LCO Conditions 3.5.1.A and 3.5.1.E See LCO Conditions 3.5.1.A and 3.5.1.E See PRA Success Criteria for 3.5.1.A and 3.5.1.E ADS is not explicitly modeled. Operator actions for failure to initiate reactor-vessel depressurization (medium steam LOCA) and (medium liquid LOCA) are used as surrogates.

Reference:

RAI 7

Note - HPCI is a single train high pressure ECCS that is credited with mitigating a small break loss-of-coolant accident. If that function is lost, the RCIC system provides a high pressure makeup capability.

Otherwise, ADS will depressurize the RPV, allowing the low pressure ECCS to provide RPV makeup.

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-11 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments 3.5.3.A RCIC System inoperable RCIC System Yes Provide adequate core cooling and control of the RPV water level following reactor pressure vessel isolation.

One train Same as Design Success Criteria 3.6.1.2.C Primary containment air lock inoperable for reasons other than Condition A or B.

Primary containment airlock No Containment Integrity One of two containment air lock doors closed.

N/A Not explicitly modeled. A loss of primary containment isolation capability via one of the modeled pathways is used as a surrogate.

3.6.1.3.A One or more penetration flow paths with one Primary Containment Isolation Valves (PCIV) inoperable except due to Main Steam Isolation Valve (MSIV) leakage not within limits. (Only applicable to penetration flow paths with two PCIVs).

PCIVs on flowpaths with two PCIVs in series Not All PCIVs are modeled Primary Containment Isolation One PCIV per penetration flow path Same as Design Success Criteria A loss of primary containment isolation capability via one of the modeled pathways is used as a surrogate for PCIVs not explicitly modeled.

3.6.2.3.B Two residual heat removal (RHR) suppression pool cooling subsystems inoperable.

Four redundant RHR suppression pool cooling subsystems Yes Remove heat from suppression pool Two of four RHR suppression pool cooling subsystems Same as Design Success Criteria

Reference:

RAI 7

Note - RCIC is a single train high pressure system that is not credited in the accident analysis. Notwithstanding, if the RCIC function is lost, the HPCI system provides a high pressure makeup capability to the RPV.

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-13 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments is maintained when:

-Two RHRSW subsystems per fueled unit are OPERABLE 3.7.2.A One required Emergency Equipment Cooling Water (EECW) pump inoperable.

Two independent and redundant loops, with two pumps per loop Yes Provide cooling water for heat removal from equipment (DGs, RHR coolers, ECCS room coolers)

Two EECW pumps Same as Design Success Criteria 3.8.1.A One required offsite circuit inoperable.

Two qualified offsite circuits Yes Provide power to safety-related buses One offsite AC power source Same as Design Success Criteria 3.8.1.B (U1 &

U2)

One required Unit 1 and 2 DG (1 of 4 DGs) inoperable.

Four separate and independent U1 &

U2 DGs Yes Provide power to safety-related buses Three of four U1 and U2 DGs The DG is successful if power remains available at the power distribution system from the associated DG for a period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an initiating event.

3.8.1.B (U3)

One required Unit 3 DG inoperable.

Four separate and independent U3 DGs Yes Provide power to safety-related buses Three of four U3 DGs The DG is successful if power remains available at the power distribution system from the associated DG for a period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an initiating event.

Three Two Three

Reference:

RAI 12

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-14 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments 3.8.1.E Two required offsite circuits inoperable.

Two qualified offsite circuits Yes Provide power to safety-related buses One offsite AC power source As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

With both offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a design basis accident or transient.

3.8.1.F (U1 &

U2)

One required offsite circuit inoperable.

AND One required Unit 1 and 2 DG inoperable.

Two qualified offsite circuits AND Four separate and independent U1 &

U2 DGs Yes Provide power to safety-related buses One offsite AC power source AND Three of four U1 and U2 DGs As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.1.F (U3)

One required offsite circuit inoperable.

AND One Unit 3 DG inoperable.

Two qualified offsite circuits AND Four separate and independent U3 DGs Yes Provide power to safety-related buses One offsite AC power source AND Three of four U3 DGs As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.4.A (U1 &

U2)

One Unit DC electrical power subsystem inoperable.

OR One Unit 1 and 2 Shutdown Board DC electrical power Three 250 VDC Unit subsystems AND Four 250 VDC shutdown board subsystems AND Four Unit 2 and Yes Provide motive and control power for selected safety-related equipment One DC subsystem inoperable (2 of 3 250 VDC Unit subsystems, 3 of 4 250 VDC shutdown As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

AND Three OR Two

Reference:

RAI 10

(

AND Three

Reference:

RAI 11

Replace entries with Insert 1 LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-15 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments subsystem inoperable.

Two Unit 3 DG DC subsystems board subsystems) 3.8.4.A (U3)

One Unit DC electrical power subsystem inoperable.

OR 3EB Shutdown Board DC electrical power subsystem inoperable.

Three 250 VDC Unit subsystems AND Four 250 VDC shutdown board subsystems AND Four Unit 2 and Two Unit 3 DG DC subsystems Yes Provide motive and control power for selected safety-related equipment One DC subsystem inoperable (2 of 3 250 VDC Unit subsystems, 3 of 4 250 VDC shutdown board subsystems)

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.A (U1 &

U2)

One Unit 1 and 2 4.16 kV Shutdown Board inoperable.

Four Unit 1 and 2 4.16 kV shutdown boards Yes Distribute 4.16 kV power to required loads One of two divisions As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.A (U3)

One Unit 3 4.16 kV Shutdown Board inoperable.

Four Unit 3 4.16 kV shutdown boards Yes Distribute 4.16 kV power to required loads One of two divisions As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.B (U1)

One Unit 1 480 V Shutdown Board inoperable.

OR 480 V (reactor motor operated valve (RMOV)) Board 1A inoperable.

480 VAC shutdown boards and associated load centers and transformers Yes Distribute 480 V power to required loads One of two Unit 1 480 V shutdown boards One of two 480 V RMOV boards (1A or 1B)

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

AND Four Unit 2 and Two Unit 3 DG DC subsystems

Reference:

RAI 11

)

One DC subsystem inoperable

(

)

One of two divisions Two Unit 1 and 2 4.16 kV shutdown boards One of two divisions

Reference:

RAI 12

480 VAC shutdown boards and associated load centers and transformers 480V Shutdown Boards 1A and 1B and 480V RMOV Boards 1A and 1B and associated load centers and transformers

Reference:

RAI 13

Replace entries with Insert 1 Two Unit 3 4.16 kV shutdown boards LAR Enclosure 1

Technical Specification (TS) Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments 3.8.4.A (U1 &

U2)

One Unit DC Board inoperable.

OR Battery Boards 1, 2, and 3 Yes Distribute DC power to required loads Two of three unit battery boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable.

OR DC Distribution Panels on Unit 1 & 2 Shutdown Boards A, B, C, and D Three of four DC Distribution Panels on Unit 1

& 2 Shutdown Boards A, B, C, and D 3.8.4.A (U3)

One Unit DC Board inoperable.

OR Shutdown Board DC Distribution Panel 3EB inoperable OR Battery Boards 1, 2, and 3 and Shutdown Board DC Distribution Panel 3EB Yes Distribute DC power to required loads Three of four DC boards (includes 3 battery boards and Shutdown Board DC Distribution Panel 3EB).

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Insert 1

Reference:

RAI 11

ENCLOSURE 1 CNL-21-009 E1-16 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments OR 480 V RMOV Board 1 B inoperable.

3.8.7.B (U2)

One Unit 2 480 V Shutdown Board inoperable.

OR 480 V RMOV Board 2A inoperable.

OR 480 V RMOV Board 2B inoperable.

480 VAC shutdown boards and associated load centers and transformers Yes Distribute 480 V power to required loads One of two Unit 2 480 V shutdown boards One of two 480 V RMOV boards (2A or 2B)

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.B (U3)

One Unit 3 480 V Shutdown Board inoperable.

OR 480 V RMOV Board 3A inoperable.

OR 480 V RMOV Board 3B inoperable.

480 VAC shutdown boards and associated load centers and transformers Yes Distribute 480 V power to required loads One of two Unit 3 480 V shutdown boards One of two 480 V RMOV boards (3A or 3B)

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.C (U1)

One Unit 1 and 2 DG Auxiliary Board inoperable.

Two Units 1 and 2 480 V diesel auxiliary boards Yes Distribute 480 V power to required loads One of two Units 1 and 2 480 V diesel auxiliary boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.D (U1)

One Unit DC Board inoperable.

OR One Unit 1 and 2 Shutdown Board DC Distribution Panel Three Unit DC and associated 250 V DC RMOV boards AND Five Shutdown Board 250 V DC Yes Distribute DC power to required loads All but one DC board operable.

Two of three unit battery As needed to supply supported functions.

Success of these top events requires that power remain available to the 480 VAC shutdown boards and associated load centers and transformers 480V Shutdown Boards 2A and 2B and 480V RMOV Boards 2A and 2B and associated load centers and transformers.

480 VAC shutdown boards and associated load centers and transformers 480V Shutdown Boards 3A and 3B and 480V RMOV Boards 3A and 3B and associated load centers and transformers.

Reference:

RAI 14

Replace entry with Insert 2

Reference:

RAI 13

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-17 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments inoperable.

OR 250 V DC RMOV Board 1A inoperable.

OR 250 V DC RMOV Board 1 B inoperable.

OR 250 V DC RMOV Board 1 C inoperable.

electrical power distribution subsystems boards Three of four Unit 1 & 2 Shutdown Boards Two of three RMOV Boards applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.D (U2)

One Unit 1 and 2 DG Auxiliary Board inoperable.

Two Units 1 and 2 480 V diesel auxiliary boards Yes Distribute 480 V power to required loads One of two Units 1 and 2 480 V diesel auxiliary boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.D (U3)

One Unit 3 DG Auxiliary Board inoperable.

Two Unit 3 480 V diesel auxiliary boards Yes Distribute 480 V power to required loads One of two Unit 3 480 V diesel auxiliary boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.E (U1)

Unit 1 and 2 4.16 kV Shutdown Board A and B inoperable.

OR Unit 1 and 2 4.16 kV Shutdown Board C and D inoperable.

Four Unit 1 and 2 4.16 kV shutdown boards, divided into two divisions Yes Distribute 4.16 kV power to required loads One of two divisions As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

One of two divisions One division of 4.16 kV shutdown boards (Division 1 -

Shutdown Board A and B.

Division 2 - Shutdown Board C and D)

Reference:

RAI 12

Reference:

RAI 14

Replace entries with Insert 2 3.8.7.F (U2)

Reference:

RAI 15

LAR Enclosure 1

ENCLOSURE 1 CNL-21-009 E1-18 of 46 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification (TS)

Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments 3.8.7.E (U2)

One Unit DC Board inoperable.

OR One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable.

OR 250 V DC RMOV Board 2A inoperable.

OR 250 V DC RMOV Board 2B inoperable.

OR 250 V DC RMOV Board 2 C inoperable.

Three Unit DC and associated 250 V DC RMOV boards AND Five Shutdown Board 250 V DC electrical power distribution subsystems Yes Distribute DC power to required loads All but one DC board operable.

Two of three unit battery boards Three of four Unit 1 & 2 Shutdown Boards Two of three RMOV Boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.E (U3)

One Unit DC Board inoperable.

OR Shutdown Board DC Distribution Panel 3EB inoperable OR 250 V DC RMOV Board 3A inoperable.

OR 250 V DC RMOV Board 3B inoperable.

OR 250 V DC RMOV Board 3 C inoperable.

Three Unit DC and associated 250 V DC RMOV boards AND Shutdown Board DC Distribution Panel 3EB Yes Distribute DC power to required loads All but one DC board operable.

Two of three unit battery boards Three of four Unit 1 & 2 Shutdown Boards Two of three RMOV Boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.F (U3)

Unit 3 4.16 kV Shutdown Board 3EA and 3EB inoperable.

OR Unit 3 4.16 kV Four Unit 3 4.16 kV shutdown boards, divided into two divisions Yes Distribute 4.16 kV power to required loads One of two divisions As needed to supply supported functions.

Success of these top events requires that power remain One of two divisions One division of 4.16 kV shutdown boards (Division 1 - Shutdown Board 3EA and 3EB. Division 2 -

Shutdown Board 3EC and 3ED).

Reference:

RAI 12

Replace entries with Insert 2

Reference:

RAI 14

LAR Enclosure 1

Technical Specification (TS) Condition TS Condition Description SSCs Covered by TS LCO Condition SSCs Modeled in PRA?

Function Required by TS LCO Condition Design Success Criteria PRA Success Criteria Other Comments 3.8.7.D (U1)

One Unit DC Board inoperable.

OR Battery Boards 1, 2, and 3 Yes Distribute DC power to required loads Two of three unit battery boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable.

OR DC Distribution Panels on Unit 1 & 2 Shutdown Boards A, B, C, and D Three of four DC Distribution Panels on Unit 1 & 2 Shutdown Boards A, B, C, and D 250 V DC RMOV Board 1A inoperable.

OR 250 V DC RMOV Board 1 B inoperable.

OR 250 V DC RMOV Board 1 C inoperable.

250 V DC RMOV Board 1A, 1 B, and 1C Two of three 250 VDC RMOV Boards 3.8.7.E (U2)

One Unit DC Board inoperable.

OR Battery Boards 1, 2, and 3 Yes Distribute DC power to required loads Two of three unit battery boards As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable.

OR DC Distribution Panels on Unit 1 & 2 Shutdown Boards A, B, C, and D Three of four DC Distribution Panels on Unit 1 & 2 Shutdown Boards A, B, C, and D 250 V DC RMOV Board 2A inoperable.

OR 250 V DC RMOV Board 2B inoperable.

OR 250 V DC RMOV Board 2 C inoperable.

250 V DC RMOV Board 2A, 2 B, and 2C Two of three 250 VDCRMOV Boards Insert 2

Reference:

RAI 14

3.8.7.E (U3)

One Unit DC Board inoperable.

OR Shutdown Board DC Distribution Panel 3EB inoperable OR Battery Boards 1, 2, and 3 and Shutdown Board DC Distribution Panel 3EB Yes Distribute DC power to required loads Three of four DC boards (includes 3 battery boards and Shutdown Board DC Distribution Panel 3EB)

As needed to supply supported functions.

Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

250 V DC RMOV Board 3A inoperable.

OR 250 V DC RMOV Board 3B inoperable.

OR 250 V DC RMOV Board 3C inoperable.

250 V DC RMOV Board 3A, 3B, and 3C Two of three 250 VDC RMOV Boards Insert 2 (continued)

Reference:

RAI 14

CNL-21-009 E9-2 of 9 The basic events used in the Fire PRA Model associated with these parameters were correlated using type codes in the same manner as described above for the internal events PRA model.

A comparison of CDF results from the normal model quantification and the parametric uncertainty evaluation shows that the difference between the point estimate and mean results is less than 2%. Therefore, SOKC is not a key source of uncertainty for the TSTF-505 application.

2.

ASSESSMENT OF INTERNAL EVENTS PRA EPISTEMIC UNCERTAINTY IMPACTS In order to identify key sources of uncertainty for the TSTF-505 Program application, an evaluation of the internal events, including internal flooding, baseline PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and Electric Power Research Institute (EPRI) report 1016737 (Reference 3). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the BFN internal events, including internal flooding baseline model quantification documented in the summary notebook, the fire baseline model quantification documented in the Fire PRA uncertainty notebook, and the seismic baseline model quantification. See Section 3.0 and 4.0 for discussions on the Fire PRA and Seismic PRA uncertainties.

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development to address a particular modeling uncertainty because there is not a single definitive approach.

Plant-specific assumptions made for each of the BFN internal events PRA technical elements are noted in the individual notebooks. The internal events, including internal flooding, PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary.

EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 4), and the evaluation performed for BFN considered each of the generic sources of modeling uncertainty as well as the plant-specific sources. The process for identification of key assumptions and sources of uncertainty for the internal events and internal flooding PRA, the Seismic PRA, and the Fire PRA are identical and is discussed in Section 6.

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA model documentation but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the TSTF-505 application, based on the results of the internal events including internal flooding, fire and seismic PRA model peer reviews.

Additionally, an evaluation of analysis performed for the Large Early Release Frequency (LERF) for internal events, including internal flooding, PRA model uncertainty was performed, based on the guidance in NUREG-1855 and EPRI Report 1026511. The potential sources of model uncertainty in the BFN PRA model were evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511.

A comparison of CDF results from the normal model quantification and the parametric uncertainty evaluation shows that the difference between the point estimate and mean results is less than 2%

Therefore SOKC is not a key source of uncertainty for the TSTF-505 application

Reference:

RAI 17

LAR Enclosure 9

v t e Letter Sequence Supplement
EPID:L-2022-LLA-0049, TSTF-505 (Approved, Closed)
Initiation Request, Request Acceptance Supplement, Supplement Administration Questions 19 October 2022 Answers Results Approval, Approval Other: ML22147A137, ML22238A065, ML22238A067, ML22259A037, ML22259A038, ML22259A039
MONTHYEAR2022-08-19 [Table View]

CNL-22-097, Response to Request for Additional Information and Supplement to License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide .

Text

Subject:

References:

Enclosures:

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 6

Reference:

RAI 7

Reference:

RAI 7

Reference:

RAI 7

Reference:

RAI 12

Reference:

RAI 10

Reference:

RAI 11

Reference:

RAI 11

Reference:

RAI 12

Reference:

RAI 13

Reference:

RAI 11

Reference:

RAI 14

Reference:

RAI 13

Reference:

RAI 12

Reference:

RAI 14

Reference: