ML23269A023

NRR E-mail Capture - Arkansas Nuclear One, Unit 2 - TSTF-505 Audit Questions

ML23269A023
Person / Time
Site:	Arkansas Nuclear
Issue date:	09/22/2023
From:	Thomas Wengert NRC/NRR/DORL/LPL4
To:	Reid M Entergy Operations
Wengert T
References
L-2022-LLA-0197
Download: ML23269A023 (16)

Text

From: Thomas Wengert Sent: Friday, September 22, 2023 8:08 AM To: REID, MARK Cc: Keele Jr, Riley D; Jennifer Dixon-Herrity; William Orders; Thomas Byrd

Subject:

Arkansas Nuclear One, Unit 2 - TSTF-505 Audit Questions (EPID L-2022-LLA-0197)

Attachments: ANO-2 TSTF-505 Audit Questions 22-23.pdf By application dated April 5, 2023 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML23095A281), Entergy Operations, Inc. (the licensee) submitted a license amendment request (LAR) for Arkansas Nuclear One, Unit 2 (ANO-2). The proposed amendment would revise technical specification (TS) requirements to permit the use of risk-informed completion times in accordance with Technical Specifications Task Force (TSTF)

Traveler TSTF-505, Provide Risk-Informed Extended Completion Times - RITSTF [Risk-Informed TSTF] Initiative 4b, Revision 2, dated July 2, 2018 (ML18183A493).

On August 9, 2023 (ML23209A602), the NRC staff issued an audit plan that conveyed the staffs intent to conduct a regulatory audit to support its review of the subject licensing action. In the audit plan, the NRC staff requested an electronic portal setup and provided a list of documents to be added to the portal. The audit plan also indicated that the NRC may request information and audit meetings/interviews throughout the audit period.

The NRC staff has performed an initial review of these documents and developed a list of audit questions in the attachment to this email. Please post the responses to the questions to the online portal as the responses are completed (but no later than one week before the date of the initial audit meeting). The dates and times for the audit discussions have been established for October 17 through October 19, 2023, to conduct the meetings via MS Teams teleconference call. The proposed agenda for the audit discussions will be provided later.

Please contact me at any time prior if a clarification discussion is needed. We look forward to discussing these questions and Entergys responses during the virtual audit meeting.

Tom Wengert Project Manager - Arkansas Nuclear One NRR/DORL/LPL4 (301) 415-4037

Hearing Identifier: NRR_DRMA Email Number: 2247 Mail Envelope Properties (PH0PR09MB74030D2AF7DF0952E6572F5D8FFFA)

Subject:

Arkansas Nuclear One, Unit 2 - TSTF-505 Audit Questions (EPID L-2022-LLA-0197)

Sent Date: 9/22/2023 8:07:33 AM Received Date: 9/22/2023 8:07:00 AM From: Thomas Wengert Created By: Thomas.Wengert@nrc.gov Recipients:

"Keele Jr, Riley D" <rkeele@entergy.com>

Tracking Status: None "Jennifer Dixon-Herrity" <Jennifer.Dixon-Herrity@nrc.gov>

Tracking Status: None "William Orders" <William.Orders@nrc.gov>

Tracking Status: None "Thomas Byrd" <Thomas.Byrd@nrc.gov>

Tracking Status: None "REID, MARK" <mreid1@entergy.com>

Tracking Status: None Post Office: PH0PR09MB7403.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 1873 9/22/2023 8:07:00 AM ANO-2 TSTF-505 Audit Questions 22-23.pdf 275422 Options Priority: Normal Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

AUDIT QUESTIONS LICENSE AMENDMENT REQUEST TO REVISE TECHNICAL SPECIFICATIONS TO ADOPT TSTF-505, REVISION 2 ARKANSAS NUCLEAR ONE, UNIT 2 ENTERGY OPERATIONS, INC.

DOCKET NO. 50-368 By application dated April 5, 2023 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML23095A281), Entergy Operations, Inc. (the licensee) submitted a license amendment request (LAR) for Arkansas Nuclear One, Unit 2 (ANO-2). The amendment would revise technical specification (TS) requirements to permit the use of risk-informed completion times (RICTs) for actions to be taken when limiting conditions for operation (LCOs) are not met. The proposed changes are based on Technical Specifications Task Force (TSTF)

Traveler TSTF-505, Revision 2, dated July 2, 2018 (ML18183A493). The U.S. Nuclear Regulatory Commission (NRC) issued a final revised model safety evaluation (SE)

(ML18269A041) approving TSTF-505, Revision 2, on November 21, 2018.

The NRC staff determined that the following information is needed to complete its review.

Probabilistic Risk Analysis (PRA) Licensing Branch A (APLA) PRA Acceptability and Risk-informed Approach APLA Question 01 - Digital Instrumentation and Control (I&C) Modeling Concerning the quality of the PRA model, Nuclear Energy Institute (NEI) 06-09-A, Risk-Informed Technical Specifications Initiative 4b Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0-A (ML12286A322), states that Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis and RG 1.200, Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities, define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

LAR Attachment 1, Evaluation of Proposed Changes, and Attachment 5, ANO-1 Technical Specification TSTF-505 Cross-Reference, explain that ANO-2 is considered a digital plant and identifies the following digital I&C systems:

1) Control Element Assembly Calculators (TS 3.3.1.1)

2) Reactor Protective System (RPS) Logic and Trip Initiation (TS 3.3.1.1)

3) Engineered Safety Features (ESF) Actuation System (ESFAS) Logic and Manual Trip (TS 3.3.2.1)

4) Diesel Generator (DG) - Loss of Voltage Start (LOVS) (TS 3.3.2.1).

Regarding digital I&C, the NRC staff notes the lack of consensus industry guidance for modeling these systems in plant PRAs to be used to support risk-informed regulatory applications. In addition, known modeling challenges exist, such as the lack of industry data for digital I&C components, the difference between digital and analog system failure modes, and the complexities associated with modeling software failures, including common-cause software failures. Also, although reliability data from vendor tests may be available, this source of data is not a substitute for in-the-field operational data. Given these challenges, the uncertainty associated with modeling a digital I&C system could impact the RICT program. Therefore, address the following:

a) Clarify whether digital I&C systems, other than those identified above, are credited in the PRA models that will be used in the RICT program.

b) For the digital I&C systems that are credited in the PRA models, and which will be used in the RICT program, provide justification (e.g., describe and provide the results of a sensitivity study) that demonstrates the modeling uncertainty associated with crediting digital I&C systems has an inconsequential impact on the RICT calculations.

-OR-Alternatively, if a justification is not provided, identify which LCOs are determined to be impacted by digital I&C systems modeling for which risk management actions (RMAs) will be applied during a RICT. Explain and justify the criteria used to determine what level of impact to the RICT calculation requires additional RMAs.

APLA Question 02 - Consideration of Shared Systems in RICT Calculations RG 1.200, Revision 2, states, [t]he base PRA serves as the foundational representation of the as-built and as-operated plant necessary to support an application. LAR Enclosure 8, Attributes of the Real-Time Risk Model, explains that Systems with shared components or capability across units which are credited in the RTR models are able to be represented in both unit PRA models simultaneously, reflecting availability or unavailability of the shared system to each unit based on the actual plant configuration. However, the LAR does not appear to specifically address the systems that are cross-tied or shared between units and how these are modeled and accounted for in the development of RICTs. The NRC staff has reviewed system documents on the licensees audit portal that have shared systems. The NRC staff notes that for some of these systems, it appears the sharing of a system is not consistent between units. It appears that some operational aspects, such as alternate alignments, were excluded from the PRA models. For multi-unit events (e.g., loss of offsite power and seismic events), credit for a shared system may be limited to one unit.

Clarify what systems are shared, how they are shared, and whether they can support one or both units in the event of an accident. Explain how the shared systems are credited for each unit in the PRA models. This discussion should also address the following:

a) Explain whether shared systems are credited in the internal events, including flooding and fire PRA models for both units and, if so, identify those systems.

b) If shared systems are credited in the real time risk (RTR) tool that supports the RICT calculations, then explain how the shared system is modelled for each unit in a dual unit event demonstrating that shared systems are not over-credited in the PRA models.

c) If a shared system is credited in the RTR model that supports the RICT calculations and the impact of events that can create a concurrent demand for the system shared by both units is not addressed in the PRA models, then justify that this exclusion has an inconsequential impact on the RICT calculations.

APLA Question 03 - Impact of Seasonal Variations The Tier 3 assessment in RG 1.177, An Approach for Plant-specific, Risk-informed Decision-making: Technical Specifications, Revision 2 (ML20164A034), stipulates that a licensee should develop a program that ensures the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. NEI 06-09-A and its associated NRC safety evaluation (SE) (ML071200238) state that, for the impact of seasonal changes, either conservative assumptions should be made, or the PRA should be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration.

LAR Enclosure 8, Attributes of the Real-Time Risk Model, states that the RTR tool to be used for the RICT program will either conservatively model seasonal variations or include the capability to account for the variations if determined to impact the calculated RICT. However, the LAR does not appear to address specific modeling adjustments needed to account for seasonal and time of cycle dependencies and what kind of adjustments will be made. Therefore, address the following to clarify the treatment of seasonal and time of cycle variations:

a) Explain how the RICT calculations address changes in PRA data points, basic events, and structures, systems, and components (SSCs) operability constraints because of extreme weather conditions, seasonal variations, other environmental factors, or time of cycle. Also, explain how these adjustments are made in the configuration risk management program (CRMP) model and how this approach is consistent with the guidance in NEI 06-09-A and its associated NRC final SE.

b) Describe the criteria used to determine when PRA adjustments due to extreme weather conditions, seasonal variations, other environmental factors, or time of cycle variations need to be made in the CRMP model and what mechanism initiates these changes.

APLA Question 04 - Open Phase Condition Section C.1.4 of RG 1.200 states that the base (e.g., Model of Record) PRA is to represent the as-built, as-operated plant to the extent needed to support the application. The licensee is to have a process that identifies updated plant information that necessitates changes to the base PRA model.

In response to the January 30, 2012, Open Phase Condition (OPC) event at the Byron Generating Station, the NRC issued Bulletin 2012-01 1. As part of the initial Voluntary Industry 1 U.S. NRC Bulletin 2012-01, Design Vulnerability in Electric Power System (ML12074A115).

Initiative for mitigation of the potential for the occurrence of an OPC in electrical switchyards 2, licensees have made the addition of an Open Phase Isolation System (OPIS). As per SRM-SECY-16-0068 3, the NRC staff was directed to ensure that licensees have appropriately implemented OPIS and that licensing bases have been updated accordingly. From the revised voluntary initiative 4 and resulting industry guidance in NEI 19-02 5 on estimating OPC and OPIS risk, it is understood that the risk impact of an OPC can vary widely dependent on electrical switchyard configuration and design. Considering these observations, provide the following information:

a) For ANO-2, discuss the evaluation of the risk impact associated with OPC events, including the likelihood of OPC initiating plant trips and the impact of those trips on PRA-modeled SSCs. Also, explain whether an OPIS has been installed and if it has been installed, then discuss its functionality and any operator actions needed to operate the system or needed in response to the system.

b) Clarify whether any installed OPIS equipment and associated operator actions are credited in the PRAs that support this application. If OPIS equipment and associated operator actions are credited, then provide the following information:

i. Describe the OPIS equipment and associated actions that are credited in the PRA models.

ii. Describe the impact that this treatment, if any, has on key assumptions and sources of uncertainty for the RICT program.

iii. Discuss Human Reliability Analysis (HRA) methods and assumptions used for crediting OPIS alarm manual response.

iv. Discuss how OPC related scenarios are modelled for non-internal event scenarios such as internal floods, fire, and seismic.

v. Regarding inadvertent OPIS actuation:

a. Explain whether scenarios regarding inadvertent actuation of the OPIS, if applicable, are included in the PRA models that support the RICT calculations.

b. If inadvertent OPIS actuation scenarios are not included in the PRA models, then provide justification that the exclusion of this inadvertent actuation does not impact the RICT calculations.

c) If OPC and OPIS are not included in the application PRA models (whether OPIS equipment is installed or not), then provide justification that the exclusion of this failure mode and mitigating system does not impact the RICT calculations.

2 Anthony R. Pietrangelo to Mark A. Satorius, Letter re: Industry Initiative on Open Phase Condition - Functioning of Important-to-Safety Structures, Systems and Components (SSCs), dated October 9, 2013 (ML13333A147).

3 U.S. NRC SRM-SECY-16-0068, Interim Enforcement Policy for Open Phase Conditions in Electric Power Systems for Operating Reactors, dated March 9, 2017 (ML17068A297).

4 Doug True to Ho Nieh, Letter re: Industry Initiative on Open Phase Condition, Revision 3, dated June 6, 2019 (ML19163A176).

5 Nuclear Energy Institute (NEI) 19-02, Guidance for Assessing Open Phase Condition Implementation Using Risk Insights, Revision 0, April 2019 (ML19122A321).

As an alternative to Part (c), propose a mechanism to ensure that OPC-related scenarios are incorporated into the application PRA models prior to implementing the RICT program.

APLA Question 05 - Performance Monitoring The NRC SE for NEI 06-09-A, states in part, The impact of the proposed change should be monitored using performance measurement strategies. NEI 06-09-A considers the use of NUMARC 93-01, Revision 4F, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (ML18120A069), as endorsed by RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4 (ML18220B281), for the implementation of the Maintenance Rule. NUMARC 93-01, Section 9.0, contains guidance for the establishment of performance criteria.

In addition, the NEI 06-09-A methodology satisfies the five key safety principles specified in RG 1.177, Revision 2, relative to the risk impact due to the application of a RICT. Moreover, NRC staff position C.3.2 provided in RG 1.177, Revision 2, for meeting the fifth key safety principle acknowledges the use of performance criteria to assess degradation of operational safety over a period. It is unclear how the licensees RICT program captures performance monitoring for the SSCs within the scope of the RMTS program. Therefore:

a) Confirm that the ANO-2 Maintenance Rule program incorporates the use of performance criteria to evaluate SSC performance as described in NUMARC 93-01, as endorsed by RG 1.160.

b) Alternatively, describe the approach or method used by ANO-2 for SSC performance monitoring, as described in NRC staff position C.3.2 of RG 1.177, Revision 2, for meeting the fifth key safety principle. In the description, include criteria (e.g., qualitative or quantitative), along with the appropriate risk metrics, and explain how the approach and criteria demonstrate the intent to monitor the potential degradation of SSCs in accordance with the NRC SE for NEI 06-09-A.

APLA Question 06 - In-Scope LCOs and Corresponding PRA Modeling The NRCs SE for NEI 06-09-A specifies that the LAR should provide a comparison of the TS functions to the PRA modeled functions to show that the PRA modeling is consistent with the licensing basis assumptions or to provide a basis for when there is a difference. Table E1-1, In Scope TS/LCO Conditions to Corresponding PRA Functions, of LAR Enclosure 1 identifies each LCO in the TSs proposed for inclusion in the RICT program. The table also describes whether the systems and components covered by the LCO are modeled in the PRA and, if so, presents both the design success criteria and PRA success criteria. For certain LCOs, the table explains that the associated SSCs are not modeled in the PRAs but will be represented using a surrogate event that fails the function performed by the SSC. For some LCOs, the LAR did not provide an adequate description for the NRC staff to conclude that the PRA modeling will be sufficient.

a) Regarding TS LCO 3.3.1.1, Functional Unit 11.A, LAR Table E1-1 states that the six Matrix Logic channels are not explicitly modeled and that the conservative surrogate is to fail the downstream trip path solid state relays. From this description the NRC staff interprets this to mean that one or more of the four relays will be failed in the PRA model if only two Matrix Logic channels are operable. It is unclear to the NRC staff that this is conservative because each Matrix Logic channel, which receives input from two of the four measurement channels, will trip all four relays resulting in a reactor trip. Address the following:

i. Identify and summarize the function of the PRA model components that are assumed to be failed as a surrogate for an out-of-service Matric Logic Channel.

ii. Provide justification that the surrogate conservatively bounds the reactor trip function of a Matric Logic channel.

b) Regarding TS LCO 3.3.1.1, Functional Unit 14, LAR Table E1-1 states that the components for the two Control Element Assembly Calculator (CEAC) are not explicitly modeled and that the conservative surrogate is to fail the downstream trip path solid state relays. From this description the NRC staff interprets this to mean that one or more of the four relays will be failed in the PRA model if only one CEAC system is operable.

Similar to part a) above, it is unclear to the NRC staff that this is conservative because each CEAC provides input to the four Core Protection Calculators (CPCs), each of which provides input to three of six Logic Matric channels, and each Logic Matrix channel will trip all four relays resulting in a reactor trip. Address the following:

i. Identify and summarize the function of the PRA model components that are assumed to be failed as a surrogate for an out-of-service CEAC.

ii. Provide justification that the surrogate conservatively bounds the function of a CEAC to provide input to the CPCs which act to initiate a reactor trip.

c) Regarding TS LCO 3.3.2.1, Functional Units 1.a, 2.a, 3.a, 4.a, 5.a, 6.a, and 8.a, Table E1-1 states that, for engineered safety features actuation system (ESFAS) manual initiation, that either ESF master relays, operator actions, or automatic actuations for the affected functions that are modeled will be used as conservative surrogates. From this description it is unclear to the NRC staff what surrogates will be used for the affected functions. For example, it is unclear to the NRC staff how assuming failure of a modeled automatic actuation is conservative with respect to failure of an operator action. Address the following:

i. Describe the PRA model surrogates to be used for each of the Functional Units 1.a, 2.a, 3.a, 4.a, 5.a, 6.a, and 8.a.

ii. Provide justification that each of the surrogates conservatively bounds the associated ESFAS function.

d) Regarding TS LCO 3.3.2.1, Functional Units 1.d.1, 2.c.1, 3.c.1, 4.c.1, 5.d.1, 6.c.1, and 8.d.1, Table E1-1 states that, for ESFAS Matrix Logic channels, these channels are not explicitly modeled in the PRA and that the conservative surrogate is to fail the downstream trip path ESF solid state relays. Similar to part a) above, it is unclear to the NRC staff that this is conservative because each Matrix Logic channel, which receives input from two of the four measurement channels, will trip all four relays resulting in a reactor trip. Address the following:

i. For each of the Functional Units 1.d.1, 2.c.1, 3.c.1, 4.c.1, 5.d.1, 6.c.1, and 8.d.1, identify and summarize the functions of the PRA model components that are assumed to be failed as a surrogate for an out-of-service Matric Logic Channel.

ii. Provide justification that the surrogates conservatively bound the reactor trip function of a Matric Logic channel.

APLA Question 07 - Sources of PRA Model Uncertainty RG 1.200 states in part NRC reviewers, [will] focus their review on key assumptions and areas identified by peer reviewers as being of concern and relevant to the application. The NRC Staff evaluates the acceptability of the PRA for each new risk-informed application and as discussed in RG 1.174, recognizes that the acceptable technical adequacy of risk analyses necessary to support regulatory decision-making may vary with the relative weight given to the risk assessment element of the decision-making process. The NRC staff notes that the calculated results of the PRA are used directly to calculate a RICT, which subsequently determines how long SSCs (both individual SSCs and multiple, unrelated SSCs) controlled by TSs can remain inoperable. Therefore, the PRA results are given a very high weight in a TSTF-505 application and the NRC staff requests additional information on the following issues that have been previously identified as potentially key fire PRA assumptions.

a) LAR Table E9-2, Fire PRA Sources of Model Uncertainty, Item #3, FPRA [Fire PRA]

Cable Selection, identifies that some FPRA components were assumed to be failed because the locations of associated cables were undetermined. The disposition is that, based on the results of a sensitivity study in which the cables were assumed to not be failed in any fire scenario, the risk of assuming the cables are failed is small. [This is confirmed by a review of the ANO-2 uncertainty analysis report, PSA-ANO2-06-4B-SOU, provided on the audit portal.] However, Table E9-2 does not provide a disposition as to whether this assumption is a key source of uncertainty and whether RMAs are needed to address this source of uncertainty. Address the following:

i. Identify the SSCs that are assumed to be always failed in the fire PRA, or are not included in the FPRA, due to lack of cable tracing or other reasons.

ii. Justify that this assumption has an inconsequential impact on the RICT calculations.

iii. If, in response to part ii) above, it cannot be determined that the cited assumption has an inconsequential impact on the estimated RICTs, then identify what programmatic changes will be considered to compensate for this uncertainty and the basis for their consideration (e.g., identification of additional RMAs).

b) LAR Enclosure 9 Section 4, Assessment of Level 2 Epistemic Uncertainty Impacts, states that no key sources of uncertainty for the RICT program were identified for the Level 2 PRA. In reviewing the ANO-2 key assumptions and sources of uncertainty analysis report [PSA-ANO2-06-4B-SOU] provided on the audit portal, the NRC staff noted, in Table 8.4-3, that the assessment of the sensitivity of the steam generator tube rupture (SGTR) probability of burst assumption shows that the RICT for LCO 3.7.1.5, Main Steam Isolation Valves, is very sensitive to the model assumption (reduction in the RICT of 55 percent), and so it appears to be a key source of uncertainty for the RMTS application. Therefore, address the following:

i. Describe the plant-specific assessment used as the basis to develop the PRA modeling assumptions regarding SGTR probability of burst under severe accident conditions.

ii. Justify that these assumptions have an inconsequential impact on the RICT calculations.

If, in response to part ii) above, it cannot be determined that the cited assumption has an inconsequential impact on the estimated RICTs, then identify what programmatic changes will be considered to compensate for this uncertainty and the basis for their consideration (e.g., identification of additional RMAs).

c) LAR Table E9-1, Internal Events Characterization of Generic Sources of Modeling Uncertainty, Item #12, Containment sump / strainer performance, identifies the assumed sump strainer failure rates as a source of PRA modeling uncertainty. The modeling is based on the results of NUREG/CR-6771, GSI-191: The Impact of Debris Induced Loss of ECCS [Emergency Core Cooling System] Recirculation on PWR

[Pressurized Water Reactor] Core Damage Frequency (ML022410135). NUREG/CR-6771 shows that core damage frequency (CDF) can be significantly impacted by the performance of the containment sumps during severe accidents and explains that there is significant uncertainty about containment sump performance under severe accident conditions because, in part, it is dependent on plant-specific conditions. The ANO-2 modeling appears to be a generic assumption and not based on a plant-specific assessment. The NRC staff notes that conservative PRA modeling could have a nonconservative impact on the RICT calculations. Therefore, address the following:

i. Describe the plant-specific assessment used as the basis to develop the PRA modeling assumptions regarding containment sump performance under severe accident conditions.

ii. Justify that these assumptions have an inconsequential impact on the RICT calculations.

If, in response to part ii) above, it cannot be determined that the cited assumption has an inconsequential impact on the estimated RICTs, then identify what programmatic changes will be considered to compensate for this uncertainty and the basis for their consideration (e.g., identification of additional RMAs).

APLA Audit Question 08- Credit for FLEX Equipment and Actions NRC memorandum dated May 6, 2022 6 provides the NRCs staff updated assessment of identified challenges and strategies for incorporating Diverse and Flexible Mitigation Capability (FLEX) equipment into a PRA model in support of risk-informed decisionmaking in accordance with the guidance of RG 1.200 7.

Section 6 of Enclosure 9 of the LAR states that FLEX is credited in the ANO-2 full power internal events PRA, which includes internal flooding, and the FPRA. The enclosure explains how NRCs Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments (ML22014A084) is addressed in the modeling of FLEX. The following summarizes specific areas either addressed or not addressed in the enclosure:

• The PRAs do not currently use the equipment failure data from PWROG-18042-NP, FLEX Equipment Data Collection and Analysis, Revision 1 6 U.S. NRC memorandum, Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Risk Assessments, dated May 6, 2022 (ML22014A084).

7 U.S. NRC, Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities, RG 1.200, Revision 3, December 2020 (ML20238B871).

(ML22123A259), but that the failure data in this report will be incorporated in the 2023 update of the PRAs.

• The guidance in Electric Power Research Institute (EPRI) Knowledge Base Article 2021-001, Guidance for Pre-Initiator HRA [Human Reliability Analysis] for FLEX Portable Equipment, Revision 1, was used for identifying pre-initiator human failure events (HFEs).

• The guidance in EPRI Knowledge Base Article 2021-007, Guidance for Modeling Refueling of FLEX and Portable Equipment, was not cited in the LAR as being used in the PRAs, however, Table E9-5, FLEX System Post-Initiator Human Failure Events, of the LAR identifies the operator action Operator Fails to Refuel FLEX Equipment.

• The LAR does not cite EPRI 3002013018, Human Reliability Analysis (HRA) for Diverse and Flexible Mitigation Strategies (FLEX) and Use of Portable Equipment, which includes guidance for how to perform HRA for the use of onsite portable equipment.

• In reviewing the ANO-2 key assumptions and sources of uncertainty analysis report [PSA-ANO2-06-4B-SOU] provided on the audit portal, the NRC staff noted in Tables 8.2-4 and 8.2-5 that RICTs can be significantly impacted (e.g., RICTs reduced by up to 50 percent) by FLEX equipment reliability assumptions and in Tables 8.3 -2 and 8.3-4 that RICTs can be significantly impacted (e.g., RICTs reduced by up to 40 percent) by FLEX human error probability (HEP) assumptions.

Address the following:

a) Propose a mechanism to incorporate updated FLEX parameter values in accordance with PWROG-18042-N into the ANO-2 PRA models used for RICT calculations prior to implementing the RMTS program.

-OR-Alternatively, identify the LCO conditions impacted by the treatment of this modelling uncertainty for which RMAs will be applied during a RICT. Include discussion of the kinds of RMAs that would be applied and justification that the RMAs will be sufficient to address the modeling uncertainty.

b) Provide a discussion detailing the methodology used to assess operator actions related to installation and operation of FLEX equipment. The discussion should include:

i. A list of the FLEX-related operator actions and a summary description of the plant-specific HRA used as the basis to develop the HEPs for each operator action.

ii. An assessment of how the HRA is or is not in accordance with EPRI 3002013018 and EPRI Knowledge Base Article 2021-007.

iii. If the FLEX-related HRA is not in accordance with the NRC memorandum dated May 6, 2022, justification that the HRA assumptions have an inconsequential impact on the RICT calculations.

iv. If, in response to part iii) above, it cannot be determined that the cited assumptions have an inconsequential impact on the estimated RICTs, then identify the LCO conditions impacted by the treatment of this modelling uncertainty for which RMAs will be applied during a RICT. Include a discussion of the programmatic changes that the licensee will consider to compensate for this uncertainty and the basis for their consideration (e.g., identification of additional RMAs and justification that they are sufficient to address the modeling uncertainty).

c) If the PRA modeling of FLEX equipment and/or operator actions is revised or updated to be in accordance with the NRC memorandum dated May 6, 2022, provide justification that the revisions do not meet the definition of a PRA upgrade as defined by RG 1.200.

-OR-Alternatively, if justification cannot be provided, propose a mechanism to conduct a focused-scope peer review (FSPR) regarding incorporation of the PWR Owners Group FLEX equipment reliability modeling and/or EPRI FLEX HRA methodology for the ANO-2 PRA models. Include in the mechanism to close out all Facts and Observations (F&Os) that result from the FSPR prior to implementing the RMTS program.

Probabilistic Risk Analysis (PRA) Licensing Branch C (APLC) PRA Acceptability and Risk-informed Approach APLC Question 01 - Determination of the High Winds CDF and Large Early Release Frequency (LERF) Penalty Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states, in part, that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT. The NRC staffs safety evaluation for NEI 06-09 states, in part, that [w]here PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT.

Section 4.2 of LAR Enclosure 4 provides the results of the development of CDF and LERF penalty factors to include in RICT calculations to bound the impact of tornado-generated missiles for certain maintenance or LCO configurations. It is stated that these penalty factors are conservative. However, only the results of this assessment are provided; no description is provided of the methodology, input, and assumptions used to develop the risk model and to justify that the results are conservative. Address the following:

a) Identify the SSCs that are the tornado missile risk targets for the development of the tornado-generated missile CDF and LERF penalty factors for the RICT calculations and provide justification for why these were selected for evaluation.

b) A description of the approach used for the development of the tornado-generated missile CDF and LERF penalty factors for the RICT calculations with justification for the results of the approach being conservative. The description and justification should (i) include information about the tornado missile failure frequencies, conditional failure probabilities for impacted SSCs, and the plant response model, and (ii) identify any deviations from the Tornado Missile Risk Evaluator methodology approved for use for ANO-2 (ML20135H141).

c) In reviewing the ANO-2 Conservative Tornado Risk Model [PSA-ANO2-06-4B-TRM]

provided on the audit portal, the NRC staff noted in Tables A-2 and A-4 that the mean fragilities and mean tornado missile hit probabilities, respectively, decreased with increasing wind speed in some cases (e.g., Target Group Number 7 for initiators F4 to F6 in Table A-2, Target Group Number 17 for initiators F5 to F6 in Table A-4). Address the following:

i. Explain the basis for these apparent anomalies and provide justification that their treatment is conservative.

ii. If justification cannot be provided, then provide the results of a sensitivity study that shows these assumptions have an inconsequential impact on the RICT calculations.

iii. If, in response to part ii) above, it cannot be determined that the cited assumptions have an inconsequential impact on the estimated RICTs, then identify what programmatic changes will be considered to compensate for this uncertainty and the basis for their consideration (e.g., identification of additional RMAs).

Electrical Engineering Branch (EEEB) Audit Questions EEEB Question 01 - TS LCO 3.8.1.1, Conditions a and d General Design Criterion (GDC) 17 of Appendix A to Title 10 of the Code of Federal Regulations requires, in part, that both offsite and onsite electrical power systems be provided to permit functioning of SSCs important to safety. The safety function for each system, assuming the other is not functioning, shall be to assure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded, the core is cooled, and containment integrity and other vital functions are maintained in the event of postulated accidents. LCO 3.8.1.1, Conditions a and d, are respectively for the inoperability of one or both offsite alternating current (AC) power circuits.

A described in Section 8.2, Offsite Power System, of the ANO-2 Safety Analysis Report (SAR)

(ML21288A074), there are two offsite AC power sources for ANO-2, which are Startup Transformers 3 and 2. These transformers provide the safe shutdown of ANO-2 and maintain it in a safe shutdown condition. For the loss of one offsite power source with main generator unavailable, the available offsite power source is sufficient for unit safe shutdown. TS 3.8.1.1, Action a.3, requires the restoration of an inoperable offsite AC circuit in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in hot standby in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. If a design basis accident (DBA) happened at this moment, the plant could be safely shutdown using the existing available offsite AC circuit. TS 3.8.1.1, Action d.4, concerns the loss of both offsite AC power sources and requires the restoration of one source in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in hot standby in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in hot shutdown within the following six hours. As indicated in SAR Section 8.3.1.1.3, if a DBA happened at this moment, plant can be safely shut down with one diesel generator (DG) of a redundant ESF train.

Design success criteria (DSC) in Table E1-1 for TS LCO 3.8.1.1, Actions a.3 and d.4 appear inconsistent with their respective LCOs by not listing the minimum power source(s) of the type identified in the respective LCO condition. Clarify or explain the following inconsistencies:

• Action a.3 - Minimum offsite power circuit powered by Startup Transformer 3 or 2 to address DBA, since this LCO is for a single unavailable offsite AC circuit. LCO 3.8.1.1, Condition d is for two unavailable offsite AC circuits for which DGs are applicable, but not true for this LCO since one offsite power circuit is still available.

• Action d.4 - Minimum DG to address DBA since this LCO is for both offsite AC circuits unavailable. If a single offsite AC circuit is recovered, then this LCO is exited and LCO 3.8.1.1, Condition a is entered. However, for this LCO, DGs are the only available AC power sources.

EEEB Question 02 - TS LCO 3.8.2.3, Action b GDC 17 requires, in part, that both offsite and onsite electrical power systems be provided to permit functioning of SSCs important to safety. The safety function for each system, assuming the other is not functioning, shall be to assure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded, the core is cooled, and containment integrity and other vital functions are maintained in the event of postulated accidents. This includes the onsite electrical direct current (DC) system.

ANO-2 SAR Section 8.3.2.1 indicates that there are two trains in the DC system. LCO 8.3.2.3, Action b refers to subsystems instead of trains.

DSC in LAR Table E1-1 for TS LCO 3.8.2.3, Action b appears inconsistent with the LCO by referring to subsystems in column 1 and trains in Column 5. Clarify or explain inconsistency.

EEEB Question 03 - TS LCO 3.8.2.1 GDC 17 requires, in part, that both offsite and onsite electrical power systems be provided to permit functioning of SSCs important to safety. The safety function for each system, assuming the other is not functioning, shall be to assure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded, the core is cooled, and containment integrity and other vital functions are maintained in the event of postulated accidents. This includes the onsite 120-Volt Uninterruptable AC Power System.

ANO-2 SAR Section 8.3.1.1.6 indicates that there are six inverters and four distribution panels in 120-Volt Uninterruptable AC Power System. System Training Manual 2-32-4, Section 2.2.1 indicates that there are red and green swing inverters with each employed if either one of the two normal inverters it supports is inoperable. The diagram in Section 2.2.2 is for a swing inverter.

If the incoming breaker for the static switch, as shown in diagram System Training Manual 2 4, Section 2.2.2, should fail, is there an alarm to indicate that failure in the main control room?

Technical Specifications Branch (STSB) Audit Questions STSB Question 01 NRC staff suggestion for licensee consideration: The proposed administrative controls for the RICT Program in TS 6.5.20 paragraph e of Attachment 2 to the LAR was based on the TS markups of TSTF-505, Revision 2. The NRC staff recognizes that the model SE for TSTF-505, Revision 2 contains improved phrasing for the administrative controls for the RICT Program in TS 5.5.7 paragraph e, namely the phrasing approved for use with this program instead of used to support this license amendment. In lieu of the original phrasing in TS 5.5.18 paragraph e, discuss whether the phrases used to support Amendment # xxx or, as discussed in the TSTF-505 model SE, approved for use with this program would provide more clarity for this paragraph.

STSB Question 02

• On pages 2 and 3 of Attachment 5, in the cross-reference table, it is indicated that Table 3.3-3, Actions 12, 13, and 14.b are cross-referenced to 505 TS 3.3.6.A.1, 3.3.6.D.1, and 3.3.7.A.1, respectively. When compared to TSTF-505, Revision 2, Standard Technical Specifications (STS) for Combustion Engineering (CE) plants, the NRC staff notes that Action 12 is aligned with STS 3.3.6.A.2.1 and Action 13 is aligned with STS 3.3.6.B.2.2.

Confirm and correct, as necessary.

• On pages 9 and 10 of Attachment 5, in the cross-reference table, it is indicated that TS 3.8.2.3 Action b is cross-referenced to 505 TS 3.8.4.B.1, C.1, and 3.8.9.C.1. When compared to TSTF-505, Revision 2, STS for CE plants, the NRC staff notes that Action b is aligned with STS 3.8.4.C.1 only. Confirm and correct, as necessary.

• In Attachment 5, in the cross-reference table, TS 3.8.1.1 Action e.3 is missing. When compared to TSTF-505, Revision 2 STS for CE plants, the NRC staff notes that Action e.3 is aligned with STS 3.8.1.B.4. Confirm and correct, as necessary.

STSB Question 03 In Enclosure 1, Table E1-1 for TS LCO 3.3.2.1 Action 9, the design success criterion appears to be one-out-of-two channels. Confirm and correct, as necessary.

STSB Question 04 TSTF-505, Revision 2, does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be operable) in the RICT program.

Based on the design success criteria provided in the license amendment request Table E1-1, it appears that some LCO Actions may constitute a loss of function. For example:

• For TS 3.6.2.1 Action b.2, for both containment spray system (CSS) trains inoperable, the design success criteria is one CSS train and one containment cooling system (CCS) train. If both CSS trains are inoperable, this could result in a loss of function. The NRC staff notes that in Section 2.3.2.5 of the LAR it is discussed that TS 3.6.2.1 Action b.2 is cross-referenced to STS 3.6.6A Action G.1 of TSTF-505, which is not included in the RICT program. The discussion also states that: With both Containment Spray trains inoperable, the Containment Cooling System, consisting of two service water supplied containment cooling units per train, is capable of providing the necessary post-accident heat removal function such that design pressure and temperature limits of the Containment Building are not exceeded. Based on this statement, the NRC staff believes that the design success criteria should be the CCS. In addition, in Section 2.5 of Enclosure 1 listing additional justification for TS 3.6.2.1 Action b.2, it states that: During a DBA, both containment spray trains, or one containment spray train and one containment cooling group is sufficient to reduce the containment building pressure and temperature. This statement mirrors the design success criteria listed in Table E1-1 but contradicts the information provided in Section 2.3.2.5 of the LAR. Confirm and correct, as necessary.

• For TS 3.7.1.2 Action c, for two emergency feedwater (EFW) trains inoperable, the design success criterion is 1 out of 2 EFW trains. If both EFW trains are inoperable, this could result in a loss of function. The NRC staff notes that a discussion of this TS is in Section 2.3.2.6 of the LAR, which states that: assuming no single failure of the remaining steam supply to the turbine-driven EFW pump, a loss of safety function can only occur if a steam line break on the steam generator supplying steam via the remaining operable steam supply valve were to occur. Because the ANO-2 PRA model can also quantify the potential of a steam line break occurring, a RICT may be applied to this unique ANO-2 Action. However, for Action c of TS 3.7.1.2, the plant is already in a condition where both EFW trains are inoperable and therefore, a loss of function exists. Confirm and correct, as necessary.

STSB Question 05 TSTF-505, Revision 2, requires additional justification for STS 3.6.6A Conditions A, C, D, and E.

In Attachment 5 of the LAR, page 6, TS 3.6.2.3 Actions a, b and c are cross-referenced to STS 3.6.6A Actions C.1, E.1, and D.1, respectively. In Attachment 5 of the LAR on page 6, it states that additional justification is provided in Enclosure 1 for Actions a and b. However, the NRC staff was unable to locate that information. In addition, the staff notes that additional justification is also required for Action c. Confirm and correct, as necessary.