ML17025A409

Safety Evaluation Regarding Implementation of Mitigating Strategies and Reliable Spent Fuel Pool Instrumentation Related to Orders EA-12-049 and EA-12-051 (CAC Nos. MF0803 and MF0866)

ML17025A409
Person / Time
Site:	Three Mile Island
Issue date:	02/14/2017
From:	Halter M Japan Lessons-Learned Division
To:	Bryan Hanson Exelon Nuclear
Hughey J, NRR/JLD 415-3204
References
CAC MF0803, CAC MF0866, EA-12-049, EA-12-051
Download: ML17025A409 (90)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 February 14, 2017 Mr. Bryan C. Hanson President and Chief Nuclear Officer Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

THREE MILE ISLAND NUCLEAR STATION, UNIT 1 -SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 (CAC NOS. MF0803, AND MF0866)

Dear Mr. Hanson On March 12, 2012, the U.S. Nuclear Regulatory Commission (NRC) issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events" and Order EA-12-051, "Order to Modify Licenses With Regard To Reliable Spent Fuel Pool Instrumentation," (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML12054A736 and ML12054A679, respectively). The orders require holders of operating reactor licenses and construction permits issued under Title 10 of the Code of Federal Regulations Part 50 to modify the plants to provide additional capabilities and defense-in-depth for responding to beyond-design-basis external events, and to submit for review Overall Integrated Plans (OIPs) that describe how compliance with the requirements of Attachment 2 of each order will be achieved.

By letter dated February 28, 2013 (ADAMS Accession No. ML13059A299), Exelon Generation Company, LLC (Exelon, the licensee) submitted its OIP for Three Mile Island Nuclear Station, Unit 1 (TMI), in response to Order EA-12-049. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-049.

These reports were required by the order, and are listed in the attached safety evaluation. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits" (ADAMS Accession No. ML082900195). By letters dated December 17, 2013 (ADAMS Accession No. ML13225A552), and January 11, 2016 (ADAMS Accession No. ML15357A102), the NRC issued an Interim Staff Evaluation (ISE) and audit report, respectively, on the licensee's progress. By letter dated June 29, 2016 (ADAMS Accession No. ML16183A025), Exelon submitted a compliance letter and Final Integrated Plan (FIP) in response to Order EA-12-049. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-049 and that FIP provides the final description of the strategy and all elements of compliance as implemented, and supersedes the plan described in the OIP and six-month updates. By letter dated December 1, 2016 (ADAMS Accession No. ML16336A446), Exelon submitted a supplement to the FIP.

B. Hanson By letter dated February 28, 2013 (ADAMS Accession No. ML13063A540), Exelon submitted its 01 P for TMI in response to Order EA-12-051. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-051.

These reports were required by the order, and are listed in the attached safety evaluation. By letters dated November 13, 2013 (ADAMS Accession No. ML13308C188), and January 11, 2016 (ADAMS Accession No. ML15357A102), the NRC issued an ISE and audit report, respectively, on the licensee's progress. By letter dated March 26, 2014 (ADAMS Accession No. ML14083A620), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-051 in accordance with NRC NRR Office Instruction LIC-111, similar to the process used for Order EA-12-049. By letter dated January 20, 2016 (ADAMS Accession No. ML16020A026), Exelon submitted a compliance letter in response to Order EA-12-051. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-051 .

The enclosed safety evaluation provides the results of the NRC staff's review of Exelon's strategies for TMI. The intent of the safety evaluation is to inform Exelon on whether or not its integrated plans, if implemented as described, appear to adequately address the requirements of Orders EA-12-049 and EA-12-051. The staff will evaluate implementation of the plans through inspection, using Temporary Instruction 191, "Implementation of Mitigation Strategies and Spent Fuel Pool Instrumentation Orders and Emergency Preparedness Communications/Staffing/ Multi-Unit Dose Assessment Plans" (ADAMS Accession No. ML15257A188). This inspection will be conducted in accordance with the NRC's inspection schedule for the plant.

If you have any questions, please contact John Hughey, Orders Management Branch, TMI Project Manager, at 301-415-3204 or at John.Hughey@nrc.gov.

Sincerely, I i / IP. J-1

)J/tznct{ ./l'r:fl t:Uf./&2-1 Mandy Halter, Acting Chief Orders Management Branch Japan Lessons-Learned Division Office of Nuclear Reactor Regulation Docket No.: 50-289

Enclosure:

Safety Evaluation cc w/encl: Distribution via Listserv

TABLE OF CONTENTS

2.0 REGULATORY EVALUATION

2.1 Order EA-12-049 2.2 Order EA-12-051

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 3.1 Overall Mitigation Strategy 3.2 Reactor Core Cooling Strategies 3.2.1 Core Cooling Strategy and RCS Makeup 3.2.1.1 Core Cooling Strategy 3.2.1.1.1 Phase 1 3.2.1.1.2 Phase 2 3.2.1.1.3 Phase 3 3.2.1.2 RCS Makeup Strategy 3.2.1.2.1 Phase 1 3.2.1.2.2 Phase 2 3.2.1.2.3 Phase 3 3.2.2 Variations to Core Cooling Strategy for Flooding Event 3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems, and Components 3.2.3.1.1 Plant SSCs 3.2.3.1.2 Plant Instrumentation 3.2.3.2 Thermal-Hydraulic Analyses 3.2.3.3 Reactor Coolant Pump Seals 3.2.3.4 Shutdown Margin Analyses 3.2.3.5 FLEX Pumps and Water Supplies 3.2.3.6 Electrical Analyses 3.2.4 Conclusions 3.3 Spent Fuel Pool Cooling Strategies 3.3.1 Phase 1 3.3.2 Phase 2 3.3.3 Phase 3 3.3.4 Staff Evaluations 3.3.4.1 Availability of Structures, Systems, and Components 3.3.4.1.1 Plant SSCs 3.3.4.1.2 Plant Instrumentation 3.3.4.2 Thermal-Hydraulic Analyses 3.3.4.3 FLEX Pumps and Water Supplies 3.3.4.4 Electrical Analyses 3.3.5 Conclusions

3.4 Containment Function Strategies 3.4.1 Phase 1 3.4.2 Phase 2 3.4.3 Phase 3 3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures, Systems, and Components 3.4.4.1.1 Plant SSCs 3.4.4.1.2 Plant Instrumentation 3.4.4.2 Thermal-Hydraulic Analyses 3.4.4.3 FLEX Pumps and Water Supplies 3.4.4.4 Electrical Analyses 3.4.5 Conclusions 3.5 Characterization of External Hazards 3.5.1 Seismic 3.5.2 Flooding 3.5.3 High Winds 3.5.4 Snow, Ice, and Extreme Cold 3.5.5 Extreme Heat 3.5.6 Conclusions 3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards 3.6.1.1 Seismic 3.6.1.2 Flooding 3.6.1.3 High Winds 3.6.1.4 Snow, Ice, Extreme Cold, and Extreme Heat 3.6.2 Reliability of FLEX Equipment 3.6.3 Conclusions 3.7 Planned Deployment of FLEX Equipment 3.7.1 Means of Deployment 3.7.2 Deployment Strategies 3.7.3 FLEX Connection Points 3.7.3.1 Mechanical Connection Points 3.7.3.2 Electrical Connection Points 3.7.4 Accessibility and Lighting 3.7.5 Access to Protected and Vital Areas 3.7.6 Fueling of FLEX Equipment 3.7.7 Conclusions 3.8 Considerations in Using Offsite Resources 3.8.1 TMI SAFER Plan 3.8.2 Staging Areas 3.8.3 Conclusions

3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling 3.9.1.2 Loss of Heating 3.9.1.3 Hydrogen Gas Accumulation in Vital Battery Rooms 3.9.2 Personnel Habitability 3.9.2.1 Main Control Room 3.9.2.2 Spent Fuel Pool Area 3.9.2.3 Other Plant Areas 3.9.3 Conclusions 3.10 Water Sources 3.10.1 Steam Generator Make-Up 3.10.2 Reactor Coolant System Make-Up 3.10.4 Containment Cooling 3.10.5 Conclusions 3.11 Shutdown and Refueling Analyses 3.12 Procedures and Training 3.12.1 Procedures 3.12.2 Training 3.12.3 Conclusions 3.13 Maintenance and Testing of FLEX Equipment 3.14 Alternatives to NEI 12-06, Rev. O 3.15 Conclusions for Order EA-12-049

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 4.1 Levels of Required Monitoring 4.2 Evaluation of Design Features 4.2.1 Design Features: Instruments 4.2.2 Design Features: Arrangement 4.2.3 Design Features: Mounting 4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process 4.2.4.2 Instrument Channel Reliability 4.2.5 Design Features: Independence 4.2.6 Design Features: Power Supplies 4.2.7 Design Features: Accuracy 4.2.8 Design Features: Testing 4.2.9 Design Features: Display

4.3 Evaluation of Programmatic Controls 4.3.1 Programmatic Controls: Training 4.3.2 Programmatic Controls: Procedures 4.3.3 Programmatic Controls: Testing and Calibration 4.4 Conclusions for Order EA-12-051

6.0 REFERENCES

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO ORDERS EA-12-049 AND EA-12-051 EXELON GENERATION COMPANY, LLC THREE MILE ISLAND NUCLEAR STATION, UNIT 1 DOCKET NO. 50-289

1.0 INTRODUCTION

The earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011 highlighted the possibility that extreme natural phenomena could challenge the prevention, mitigation and emergency preparedness defense-in-depth layers already in place in nuclear power plants in the United States. At Fukushima, limitations in time and unpredictable conditions associated with the accident significantly challenged attempts by the responders to preclude core damage and containment failure. During the events in Fukushima, the challenges faced by the operators were beyond any faced previously at a commercial nuclear reactor and beyond the anticipated design-basis of the plants. The U.S. Nuclear Regulatory Commission (NRC) determined that additional requirements needed to be imposed at U.S. commercial power reactors to mitigate such beyond-design-basis external events (BDBEEs).

On March 12, 2012, the NRC issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" [Reference 4]. This order directed licensees to develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and spent fuel pool (SFP) cooling capabilities in the event of a BDBEE. Order EA-12-049 applies to all power reactor licensees and all holders of construction permits for power reactors.

On March 12, 2012, the NRC also issued Order EA-12-051, "Order Modifying Licenses With Regard to Reliable Spent Fuel Pool Instrumentation" [Reference 5]. This order directed licensees to install reliable SFP level instrumentation with a primary channel and a backup channel, and with independent power supplies that are independent of the plant alternating current (ac) and direct current (de) power distribution systems. Order EA-12-051 applies to all power reactor licensees and all holders of construction permits for power reactors.

Enclosure

2.0 REGULATORY EVALUATION

Following the events at the Fukushima Dai-ichi nuclear power plant on March 11, 2011, the NRC established a senior-level agency task force referred to as the Near-Term Task Force (NTTF). The NTTF was tasked with conducting a systematic and methodical review of the NRC regulations and processes and determining if the agency should make additional improvements to these programs in light of the events at Fukushima Dai-ichi. As a result of this review, the NTTF developed a comprehensive set of recommendations, documented in SECY-11-0093, "Near-Term Report and Recommendations for Agency Actions Following the Events in Japan,"

dated July 12, 2011 [Reference 1]. Following interactions with stakeholders, these recommendations were enhanced by the NRC staff and presented to the Commission.

On February 17, 2012, the NRC staff provided SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," [Reference 2] to the Commission. This paper included a proposal to order licensees to implement enhanced BDBEE mitigation strategies. As directed by the Commission in staff requirements memorandum (SRM)-SECY-12-0025 [Reference 3], the NRC staff issued Orders EA-12-049 and EA-12-051.

2.1 Order EA-12-049 Order EA-12-049, Attachment 2, [Reference 4] requires that operating power reactor licensees and construction permit holders use a three-phase approach for mitigating BDBEEs. The initial phase requires the use of installed equipment and resources to maintain or restore core cooling, containment and SFP cooling capabilities. The transition phase requires providing sufficient, portable, onsite equipment and consumables to maintain or restore these functions until they can be accomplished with resources brought from off site. The final phase requires obtaining sufficient offsite resources to sustain those functions indefinitely. Specific requirements of the order are listed below:

1) Licensees or construction permit (CP) holders shall develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and SFP cooling capabilities following a beyond-design-basis external event.

2) These strategies must be capable of mitigating a simultaneous loss of all ac power and loss of normal access to the ultimate heat sink [UHS] and have adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

3) Licensees or CP holders must provide reasonable protection for the associated equipment from external events. Such protection must demonstrate that there is adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

4) Licensees or CP holders must be capable of implementing the strategies in all modes of operation.

5) Full compliance shall include procedures, guidance, training, and acquisition, staging, or installing of equipment needed for the strategies.

On August 21, 2012, following several submittals and discussions in public meetings with NRG staff, the Nuclear Energy Institute (NEI) submitted document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Rev. O [Reference 6] to the NRG to provide specifications for an industry-developed methodology for the development, implementation, and maintenance of guidance and strategies in response to the Mitigation Strategies order. The NRG staff reviewed NEI 12-06 and on August 29, 2012, issued its final version of Japan Lessons-Learned Directorate (JLD) Interim Staff Guidance (ISG) JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" [Reference 7], endorsing NEI 12-06, Rev. 0, with comments, as an acceptable means of meeting the requirements of Order EA-12-049, and published a notice of its availability in the Federal Register(?? FR 55230).

2.2 Order EA-12-051 Order EA-12-051, Attachment 2, [Reference 5] requires that operating power reactor licensees and construction permit holders install reliable SFP level instrumentation. Specific requirements of the order are listed below:

All licensees identified in Attachment 1 to the order shall have a reliable indication of the water level in associated spent fuel storage pools capable of supporting identification of the following pool water level conditions by trained personnel: (1) level that is adequate to support operation of the normal fuel pool cooling system, (2) level that is adequate to provide substantial radiation shielding for a person standing on the spent fuel pool operating deck, and (3) level where fuel remains covered and actions to implement make-up water addition should no longer be deferred.

1. The spent fuel pool level instrumentation shall include the following design features:

1.1 Instruments

The instrumentation shall consist of a permanent, fixed primary instrument channel and a backup instrument channel. The backup instrument channel may be fixed or portable. Portable instruments shall have capabilities that enhance the ability of trained personnel to monitor spent fuel pool water level under conditions that restrict direct personnel access to the pool, such as partial structural damage, high radiation levels, or heat and humidity from a boiling pool.

1.2 Arrangement

The spent fuel pool level instrument channels shall be arranged in a manner that provides reasonable protection of the level indication function against missiles that may result from damage to the structure over the spent fuel pool. This protection may be provided by locating the primary instrument channel and fixed portions of the backup instrument channel, if applicable, to maintain instrument channel

separation within the spent fuel pool area, and to utilize inherent shielding from missiles provided by existing recesses and corners in the spent fuel pool structure.

1.3 Mounting

Installed instrument channel equipment within the spent fuel pool shall be mounted to retain its design configuration during and following the maximum seismic ground motion considered in the design of the spent fuel pool structure.

1.4 Qualification

The primary and backup instrument channels shall be reliable at temperature, humidity, and radiation levels consistent with the spent fuel pool water at saturation conditions for an extended period.

This reliability shall be established through use of an augmented quality assurance process (e.g., a process similar to that applied to the site fire protection program).

1.5 Independence

The primary instrument channel shall be independent of the backup instrument channel.

1.6 Power supplies: Permanently installed instrumentation channels shall each be powered by a separate power supply. Permanently installed and portable instrumentation channels shall provide for power connections from sources independent of the plant ac and de power distribution systems, such as portable generators or replaceable batteries. Onsite generators used as an alternate power source and replaceable batteries used for instrument channel power shall have sufficient capacity to maintain the level indication function until offsite resource availability is reasonably assured.

1.7 Accuracy

The instrument channels shall maintain their designed accuracy following a power interruption or change in power source without recalibration.

1.8 Testing

The instrument channel design shall provide for routine testing and calibration.

1.9 Display

Trained personnel shall be able to monitor the spent fuel pool water level from the control room, alternate shutdown panel, or other appropriate and accessible location. The display shall provide on-demand or continuous indication of spent fuel pool water level.

2. The spent fuel pool instrumentation shall be maintained available and reliable through appropriate development and implementation of the following programs:

2.1 Training

Personnel shall be trained in the use and the provision of alternate power to the primary and backup instrument channels.

2.2 Procedures

Procedures shall be established and maintained for the testing, calibration, and use of the primary and backup spent fuel pool instrument channels.

2.3 Testing and Calibration: Processes shall be established and maintained for scheduling and implementing necessary testing and calibration of the primary and backup spent fuel pool level instrument channels to maintain the instrument channels at the design accuracy.

On August 24, 2012, following several NEI submittals and discussions in public meetings with NRC staff, the NEI submitted document NEI 12-02, "Industry Guidance for Compliance With NRC Order EA-12-051, To Modify Licenses With Regard to Reliable Spent Fuel Pool Instrumentation," Rev. 1 [Reference 8], to the NRC to provide specifications for an industry-developed methodology for compliance with Order EA-12-051. On August 29, 2012, the NRC staff issued its final version of JLD-ISG-2012-03, "Compliance with Order EA-12-051, Reliable Spent Fuel Pool Instrumentation" [Reference 9), endorsing NEI 12-02, Rev. 1, as an acceptable means of meeting the requirements of Order EA-12-051 with certain clarifications and exceptions, and published a notice of its availability in the Federal Register (77 FR 55232).

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 By letter dated February 28, 2013 [Reference 10), Exelon Generation Company, LLC (Exelon, the licensee) submitted an Overall Integrated Plan (OIP) for Three Mile Island Nuclear Station, Unit 1 (TMI, Three Mile Island), in response to Order EA-12-049. By letters dated August 28, 2013 [Reference 11 ], February 28, 2014 [Reference 12), August 28, 2014 [Reference 13),

February 27, 2015 [Reference 14], August 28, 2015 [Reference 43), and February 26, 2016

[Reference 44], the licensee submitted six-month updates to the OIP. By letter dated August 28, 2013 [Reference 15), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRA) Office Instruction LIC-111, "Regulatory Audits" [Reference 33). By letters dated December 17, 2013 [Reference 16) and January 11, 2016 [Reference 17),

the NRC issued an Interim Staff Evaluation (ISE) and an audit report on the licensee's progress.

By letter dated June 29, 2016 [Reference 18) the licensee reported that full compliance with the requirements of Order EA-12-049 was achieved, and submitted a Final Integrated Plan (FIP).

The compliance letter stated that the FIP provides the final description of the strategy and all elements of compliance as implemented, and supersedes the plan described in the OIP and six-month updates. By letter dated December 1, 2016 [Reference 39], Exelon submitted a supplement to the FIP.

3.1 Overall Mitigation Strategy to Order EA-12-049 describes the three-phase approach required for mitigating BDBEEs in order to maintain or restore core cooling, containment and SFP cooling capabilities.

The phases consist of an initial phase (Phase 1) using installed equipment and resources, followed by a transition phase (Phase 2) in which portable onsite equipment is placed in service, and a final phase (Phase 3) in which offsite resources may be placed in service. The timing of when to transition to the next phase is determined by plant-specific analyses.

While the initiating event is undefined, it is assumed to result in an extended loss of ac power (ELAP) with a loss of normal access to the UHS. Thus, the ELAP with loss of normal access to the UHS is used as a surrogate for a BDBEE. The initial conditions and assumptions for the analyses are stated in NEI 12-06, Section 3.2.1, and include the following:

1. The reactor is assumed to have safely shut down with all rods inserted (subcritical).

2. The de power supplied by the plant batteries is initially available, as is the ac power from inverters supplied by those batteries; however, over time the batteries may be depleted.

3. There is no core damage initially.

4. There is no assumption of any concurrent event.

5. Because the loss of ac power presupposes random failures of safety-related equipment (emergency power sources), there is no requirement to consider further random failures.

Three Mile Island is a Babcock & Wilcox (B&W) pressurized-water reactor (PWR) with a dry ambient pressure containment. The licensee's three-phase approach to mitigate a postulated ELAP event, as described in the FIP, is summarized below. The approach is somewhat different if the plant receives warning of a pending flood, but the initial actions are similar.

At the onset of an ELAP the reactor is assumed to trip from full power. The reactor coolant pumps (RCPs) coast down and flow in the reactor coolant system (RCS) transitions to natural circulation. The RCS letdown is isolated following the loss of offsite power via automatic closing of an air operated containment isolation valve. The RCS temperature is stabilized within the desired band (i.e. no cooldown) until pressurizer level has been restored. The RCS temperature is maximized to conserve RCS inventory and to maximize the time before the loss of inventory would interrupt single phase natural circulation.

For Phase 1, the RCS inventory loss through the controlled bleed off (CBO) path will continue until ac power and resources are available to close the CBO isolation valves when 480 Vac power is restored in approximately six hours. The RCS pressure, temperature and rate of temperature changes will be maintained within normal operating limits. The RCS temperature will be controlled with the atmospheric dump valves (ADVs) venting steam from the once through steam generators (OTSGs). The steam turbine driven emergency feedwater (TDEFW) pump and the emergency feedwater control valves will be automatically actuated to maintain adequate OTSG level for natural circulation. The RCS temperature will be maintained stable until RCS makeup has been restored. Natural circulation can be maintained for at least five and one-half hours without RCS makeup capability. The ability to stabilize RCS temperature is dependent upon the ability to control OTSG pressure and maintaining the integrity of the main steam system pressure boundary.

For Phase 2, TMI initially uses pre-installed and/or pre-staged FLEX equipment to implement the strategies for RCS cooling, RCS inventory control, SFP makeup, and re-energization of plant equipment. This consists of pre-installed (in the control building) FLEX high pressure RCS makeup pumps, pre-installed (in the turbine building) submersible FLEX feedwater pumps for supplying the OTSGs, and pre-staged (in the turbine building) FLEX 480 Vac diesel generators (DGs) and cabling to power this FLEX equipment and other installed plant equipment. This strategy includes several alternate approaches to the guidance in NEI 12-06 and they are discussed in Section 3.14 of this evaluation. Three Mile Island has portable diesel-driven pumps, FX-P-3A or FX-P-3, stored in the FLEX storage facility (FSF) to supply water from the river at normal levels. In addition, TMI has diesel-driven submersible pumps, FX-P-6A or FX-P-

68, stored in the Unit 1 intake screen and pump house {ISPH), if river water level is too low as a result of a downstream dam failure. These pumps can be staged and then connected with hoses routed to the hotwell or condensate storage tank (CST) B as a backup for the primary FLEX condensate water supply system.

For Phase 2, the reactor will be maintained shutdown indefinitely by injecting borated water to recover and maintain pressurizer level. The FLEX RCS makeup pumps (FX-P-1A or B) will use water from the borated water storage tank (BWST) to restore and maintain pressurizer level.

RCS makeup with borated water will continue until the pressurizer level is raised above 300 in.

The RCS temperature is minimized to ensure the reliability of the RCP seals. Reducing the RCS temperature at the seals to less than 400 degrees Fahrenheit (°F) within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> maintains the reliability of the seal materials and leakage remains significantly less than one gallon per minute (gpm) per RCP. The FLEX RCS makeup pumps will be started within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to ensure RCS heat removal via the OTSGs is not interrupted. Makeup from the core flood tanks (CFTs) is not required or expected, but the CFTs will be maintained as a backup for RCS makeup until a reliable means to maintain a pressurizer steam bubble is established. The CFTs will be isolated when pressurizer heaters are functional to eliminate the risk of CFT nitrogen interrupting primary to secondary heat transfer. When the target RCS temperature of 400°F is achieved, pressurizer level will be raised to approximately 300 in. to provide a significant inventory margin in case makeup capability is interrupted. The RCS temperature will not be reduced below 313°F, and OTSG pressure will not be reduced below 140 per square inch gage (psig) until the recovery phase. Pressurizer heaters will be energized to maintain or restore a pressurizer steam bubble. If pressurizer heaters are not available, then hydraulic control of RCS pressure will be maintained with makeup using FLEX RCS makeup pumps. The initial RCS pressure reduction will be accomplished by pressurizer ambient heat losses. This will be supplemented with use of the pressurizer vent valves if necessary. The primary power operated relief valve (PORV) will be maintained available as a contingency measure for limiting RCS pressure rise if cooling is temporarily interrupted. The stable post ELAP RCS pressure will be maintained at approximately 400 psig, which is well above the maximum RCS pressure at which CFT nitrogen injection could occur (256 psig).

When power is available, the main steam isolation valves (MSIVs) will be closed. An RCS cooldown will be controlled and the rate will be limited by the capability to maintain pressurizer level. The RCS conditions will be stabilized within approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of the event. After OTSG pressure is below 200 psig, the FLEX feedwater pumps, FX-P-2A & 28, can provide sufficient feedwater for core heat removal. FX-P-2A & 28 remain in standby as a backup to the TDEFW pump.

For Phase 3, it estimated that the volume of condensate inventory in one CST will last at least 1 day. Before the condensate is depleted, FLEX portable pumps FX-P-3A or 38 will be configured to maintain CST inventory. Off-site water treatment equipment will be used when available to reduce the minerals and suspended solids in the water being injected into the OTSGs and SFP. The BWST contains a sufficient volume of borated water to maintain RCS inventory for more than a week. Off-site mobile boration equipment can be used to provide an indefinite supply. The on-site fuel oil supply is sufficient for all FLEX strategy needs for at least 9 days, which provides adequate time to arrange for off site diesel fuel delivery.

De load shedding after ELAP will be initiated to maintain essential instrument power available for more than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. This strategy is contingent upon actions to decelerate main turbine

rotation, vent hydrogen from the main generator and shutdown the de powered main turbine lube oil pump. Pre-staged (in the turbine building) FLEX DGs, FX-Y-1 A or FX-Y-1 B, will be started and selected plant switchgear and battery chargers will be energized in less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> using these DGs. The FLEX DGs FX-Y-1 A or 1B have the capacity to handle all FLEX power requirements including instrumentation power, emergency lighting, portable ventilation and FLEX pump motors. The FX-Y-1 A or 1B will be started with fuel oil stored in the FLEX DG day tank, FX-T-3.

The SFP is located in the fuel handling building. For normal operation with all fuel in the core, upon initiation of the ELAP event, the SFP will heat up due to the unavailability of the normal cooling system. The licensee has calculated that boiling could start as soon as 34.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> after the start of the event with reduced SFP level and 40.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> with normal SFP level. To maintain SFP cooling capabilities, the licensee determined that it would take approximately 246 hours0.00285 days <br />0.0683 hours <br />4.06746e-4 weeks <br />9.3603e-5 months <br /> with reduced SFP level and 330 hours0.00382 days <br />0.0917 hours <br />5.456349e-4 weeks <br />1.25565e-4 months <br /> with normal SFP level for SFP water level to drop to the top of active fuel {TAF). The lower level would result from use of the SFP for RCS makeup. Makeup water would be provided using a diesel-driven FLEX feedwater pump, FX-P-2A or FX-P-28 with suction from the CSTs. A SFP building steam vent path to atmosphere will be established through the Unit 2 SFP area. For shutdown operations with a full core offload, and minimum SFP water level (at low level alarm), the SFP would take more than 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (9.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> with SFP reduced level) to boil and there is at least 93 hours0.00108 days <br />0.0258 hours <br />1.537698e-4 weeks <br />3.53865e-5 months <br /> (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with reduced SFP level) before the SFP water level would reach the top of the active fuel. The SFP is being cooled as noted above and building pressure is also maintained as above.

An active means of reactor building cooling is not required to maintain building pressure below design for Phases 1, 2, and 3. The CBO containment isolation valve will be closed to contain RCP controlled bleed off flow within the reactor building. At least one isolation valve is closed on each containment penetration which provides a direct path from containment atmosphere or from the RCS to the outside environment.

Below are specific details on the licensee's strategies to restore or maintain core cooling, containment, and SFP cooling capabilities in the event of a BDBEE, and the results of the staff's review of these strategies. The NRC staff evaluated the licensee's strategies against the endorsed NEI 12-06, Rev. 0, guidance.

3.2 Reactor Core Cooling Strategies Order EA-12-049 requires licensees to maintain or restore cooling to the reactor core in the event of an ELAP concurrent with a loss of normal access to the UHS. Although the ELAP results in an immediate trip of the reactor, sufficient core cooling must be provided to account for fission product decay and other sources of residual heat. Consistent with endorsed guidance from NEI 12-06, Phase 1 of the licensee's core cooling strategy credits installed equipment (other than that presumed lost to the ELAP with loss of normal access to the UHS) that is robust in accordance with the guidance in NEI 12-06. In Phase 2, robust installed equipment is supplemented by onsite FLEX equipment, which is used to cool the core either directly (e.g., pumps and hoses) or indirectly (e.g., FLEX electrical generators and cables repowering robust installed equipment). The equipment available onsite for Phases 1 and 2 is further supplemented in Phase 3 by equipment transported from the National Strategic Alliance of FLEX Emergency Response (SAFER) Response Centers (NSRCs).

To adequately cool the reactor core under ELAP conditions, two fundamental physical requirements exist: (1) a heat sink is necessary to accept the heat transferred from the reactor core to coolant in the RCS and (2) sufficient RCS inventory is necessary to transport heat from the reactor core to the heat sink via natural circulation. Furthermore, inasmuch as heat removal requirements for the ELAP event consider only residual heat, the RCS inventory should be replenished with borated coolant in order to maintain the reactor in a subcritical condition as the RCS is cooled and depressurized.

As reviewed in this section, the licensee's core cooling analysis for the ELAP with loss of normal access to the UHS event presumes that, per endorsed guidance from NEI 12-06, the reactor would have been operating at full power prior to the event. Therefore, the SGs may be credited as the heat sink for core cooling during the ELAP/loss of normal access to the UHS event.

Maintenance of sufficient RCS inventory, despite ongoing system leakage expected under ELAP conditions, is accomplished through a combination of installed systems and FLEX equipment. The specific means used by the licensee to accomplish adequate core cooling during the ELAP/ loss of normal access to the UHS event are discussed in further detail below.

The licensee's strategy for ensuring compliance with Order EA-12-049 for conditions where the reactor is shut down or being refueled is reviewed separately in Section 3.11 of this evaluation.

3.2.1 Core Cooling Strategy and RCS Makeup 3.2.1.1 Core Cooling Strategy 3.2.1.1.1 Phase 1 Immediately following the trips of the reactor and RCPs resulting from the initiating external event, RCS temperature and pressure will stabilize at no-load conditions. Core cooling would be accomplished by natural circulation flow in the RCS using the two SGs as the heat sink. The SG inventory makeup would be automatically initiated using the TDEFW pump taking suction from the CSTs (denoted CO-T-1A and CO-T-18) with steam vented via the ADVs.

One of the two CSTs (CO-T-1A) is fully protected from all applicable external hazards, and by itself would contain sufficient water (216,000 gallons minimum) to provide 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of inventory to the EFW pump. The other CST (CO-T-1 B), which contains the same minimum volume, is potentially vulnerable to a windborne missile hazard. In addition, the water volume in the demineralized water storage tank (DWST, denoted DW-T-2) and in the main condenser hotwell can be made available to the EFW pump; however, the hotwell is not robust to a seismic hazard and DW-T-2 is not designed to withstand seismic forces or tornado missiles. The EFW pump itself is located within a robust structure with external flood protection, and is credited to be available for all applicable external hazards with the exception of the FLEX Design Flood (320 ft.

elevation). The licensee's FIP [Reference 18] states that the EFW pump will perform its function prior to potential flood damage.

The mitigating strategy for TMI would delay RCS cooldown and depressurization for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the initiation of the ELAP event. By 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the event, the licensee could provide sufficient RCS makeup flow to maintain a stable pressurizer level despite thermally induced contraction of the RCS inventory as the RCS is gradually cooled down. Maintaining a stable pressurizer level for the B&W-designed reactor assures that adequate core cooling can be provided via natural circulation. Thus, operators would initially stabilize RCS temperature

and pressure within normal operating limits until pressurizer level has been restored (which requires the use of Phase 2 FLEX equipment). The RCS temperature would be controlled by throttling the ADVs.

The ADVs, as well as the EFW flow control valves (which control feedwater flow to the two SGs) are air-operated valves; the motive force at the beginning of the ELAP/ loss of normal access to the UHS event would be provided by air pressure from a compressed air bottle bank, which the licensee states would last for a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. When the air pressure source is depleted, local manual operation would be utilized to control the ADVs and EFW flow control valves.

3.2.1.1.2 Phase 2 The licensee's primary Phase 2 strategy is to cool down and depressurize the RCS to 400 °F (as read by in-core instruments) and 400 psig by throttling open the ADVs. This cooldown will begin only after pressurizer level has been restored to 100 inches (in.) using a FLEX RCS makeup pump (see Section 3.2.1.2 of this safety evaluation (SE) for the RCS makeup strategy).

The sequence of events timeline in the FIP states that the RCS makeup pump must be started within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the initiating event in order to support the cooldown, and that conditions to begin core cooldown (i.e., sufficient pressurizer level) would be met approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> later.

The cooldown rate will be controlled so as to maintain pressurizer level at 100 in. as active RCS injection continues. The feedwater makeup to the SGs would continue to be supplied by the EFW pump; the cooldown target SG pressure is approximately 150 psig, which the licensee states should allow for continued operation of the turbine-driven EFW pump.

To provide backup to the EFW pump, and to ensure continued SG makeup as SG pressure decreases, two installed submersible motor-driven FLEX pumps (denoted FX-P-2A and -2B) will be connected via hose to the FLEX feedwater header. The licensee's FIP [Referance 18] states that each centrifugal FLEX SG makeup pump has a capacity of 120 gpm at 420 ft. total developed head, and would be powered by the plant's 480V electrical distribution system, which during an ELAP/ loss of normal access to the UHS event would be supported by two 500-kilowatt (kW) FLEX DGs which are installed in the turbine building (but not electrically pre-connected). The FLEX SG makeup pumps are also installed in the turbine building, and take suction from FLEX tanks FX-T-1 A and -1 B. The FLEX tanks would be continuously supplied by any of the surviving water sources (the CSTs, DWST and hotwell) which supply the EFW pump.

The SG pressure must be lowered to less than 200 psig before the FLEX feedwater pumps can effectively provide makeup to the SGs.

The licensee has stated that the installed FLEX equipment (the FLEX tanks, FLEX feedwater pumps, and FLEX DGs) have been designed for operability following all applicable external events, and also that their design is "dependent upon the turbine building structural integrity."

The turbine building (TB) is not a Seismic Class I structure, but the licensee has made some structural modifications to strengthen the building, and demonstrated to the NRG staff that the structural integrity of the TB will be maintained during a BDBEE per American Society of Civil Engineers (ASCE) Standard 41-13, "Seismic Evaluation and Retrofit of Existing Buildings." For more detail on the licensee's justification of the integrity of the TMI turbine building, see Sections 3.6.1.1 and 3.14.2 of this SE.

The licensee states that the minimum creditable volume in the CSTs, DWST and hotwell will support decay heat removal and core cooling for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, since the fully robust CST

(CO-T-1A) will contain at least 216,000 gallons. Before these sources are depleted, a portable, diesel-driven FLEX pump (FX-P-3A or -38) will be deployed from the FLEX storage facility to take suction from the Susquehanna River and discharge to either CO-T-1 B or the hotwell. As noted above, the hotwell is not seismically qualified, and CO-T-1 Bis potentially vulnerable to a tornado missile - but the licensee states that at least one of the two will survive the initiating event. (A contingency strategy also exists for using FX-P-3A or -38 to directly provide makeup water to the SGs via a connection on the main feedwater header, if no other feedwater pump is available.) In the event that the river level is inadequate or inaccessible (e.g. if there is ice on the river or the York Haven Dam has failed due to a seismic event) and use of these pumps is prevented, operators would deploy a portable, electric, submersible FLEX pump (FX-P-6A or -68) to refill CO-T-1 B or the hotwell, taking suction from the protected ISPH intake channel.

3.2.1.1.3 Phase 3 The licensee's FIP states that Phase 3 will be a continuation of the Phase 2 coping strategy, supplemented by backup pumps, fuel oil, and water treatment equipment provided by the NSRC. The FIP also states that NSRC water treatment equipment will be deployed, when available, to improve the quality of makeup water that is being provided to the CST (or hotwell) and SGs.

3.2.1.2 RCS Makeup Strategy 3.2.1.2.1 Phase 1 Following initiation of the ELAP event, operators would verify isolation of normal letdown and other isolable flowpaths to conserve RCS inventory. However, under ELAP conditions, RCS inventory would tend to diminish gradually due to leakage through RCP seals and other leakage points. Thermal contraction from an RCS cooldown, if conducted in the absence of active RCS makeup, would result in a further volumetric reduction of the RCS inventory, to the extent that the pressurizer would drain and a vapor void would form in the upper head of the reactor vessel.

Three Mile Island, Unit 1 is a B&W PWR with two once-through SGs and lowered RCS loops.

In order to maintain natural circulation in the RCS loops for this design configuration, plant operators should avoid taking actions that tend to drain the pressurizer. For this reason, the licensee intends to delay the RCS cooldown until the Phase 2 RCS makeup strategy can adequately refill the RCS. The licensee's FIP states that passive RCS injection from the nitrogen-pressurized Core Flood Tank (CFT) is neither required nor expected to occur, since RCS pressure will remain higher than CFT pressure until the CFT is isolated in Phase 2.

3.2.1.2.2 Phase 2 No later than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the event, the licensee would power one of two installed FLEX RCS makeup pumps (designated FX-P-1A and -18) using the 500-kW FLEX DGs. The discharge of the pump would be aligned to one or both of the "C" and "D" high pressure injection (HPI) lines via installed piping. The preferred suction source for the FLEX RCS makeup pump would be the BWST, which contains a minimum of 237,000 gallons of water borated to a concentration of at least 2500 parts per million (ppm) [Reference 18]. The BWST is robust to all applicable external hazards except for tornado missiles. In the event that the BWST is unavailable due to a windborne missile strike, the FLEX RCS makeup pumps can take suction from the fully robust

SFPs, which are also borated to at least 2500 ppm. The licensee calculates that approximately 62,000 gallons of borated water in the SFPs could be made available for RCS injection without compromising the SFP's own heat removal function. Additionally, in the event of a tornado hazard, the FIP states that the Reactor Coolant Bleed Tank (RCBT, designated WDL-T-1C) typically contains more than 50,000 gallons of highly borated (above 2200 ppm) water, and could be aligned to supply suction to the FLEX RCS makeup pumps. This tank is seismically qualified and located within the Auxiliary Building, an aircraft-impact-hardened structure.

Once a FLEX RCS makeup pump is injecting to the RCS, pressurizer level will begin to rise.

When indicated level is 100 in., operators will commence the core cooldown through the ADVs, as described in Section 3.2.1.1 of this SE. Pressurizer heater group 8 or 9 will be transferred to the emergency power supply (supported by a FLEX DG) and energized, which will allow for pressure control. (In the case of an External Flood, both pressurizer heater groups 8 and 9 are connected to the emergency power supply.) Operators will also energize the core flood tank isolation valves and, when an effective steam bubble has been established in the pressurizer, isolate the CFTs, thereby preventing nitrogen injection into the RCS. The Sequence of Events in the licensee's FIP states that the expected ELAP response timeline would have pressurizer heaters energized at 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (after the start of the ELAP event), CFTs isolated at 7.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, and initial cooldown complete at 10.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Active RCS injection will continue until pressurizer level is above 300 in. If the FLEX RCS makeup pumps are drawing suction from the BWST, operators will stabilize pressurizer level between 300 in. and 320 in.; if they are drawing from the SFP or RCBT, level will be stabilized between 360 in. and 380 in. This additional level will extend coping time until a Phase 3 borated water supply is aligned, since the FLEX pumps cannot take suction from the SFP once SFP temperature exceeds 150 °F.

3.2.1.2.3 Phase 3 The licensee's FIP states that Phase 3 will be a continuation of the Phase 2 coping strategy, supplemented by NSRC backup pumps, water treatment and mobile boration equipment, and diesel fuel. The licensee calculates that the BWST (if intact) would contain a sufficient supply of borated water to maintain RCS inventory and shutdown margin for more than a week, and that NSRC mobile boration equipment would represent an essentially indefinite supply (with raw water from the Susquehanna River).

3.2.2 Variations to Core Cooling Strategy for Specific External Events 3.2.2.1 Variations to Core Cooling Strategy for Flooding Event The analyzed flood event at TMI is extreme precipitation resulting in flooding of the Susquehanna River. The licensee notes that, in order for an ELAP/loss of normal access to the UHS event to be flood-related, the flood waters must exceed the height of the protective dike (304.5 ft. at the Intake Screen and Pump House). The licensee therefore assumes that sufficient preparation time would exist such that, at the start of the ELAP, the reactor would have been shutdown for at least 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />, cooled down (in-core temperature at 400 °F and SG pressure between 150-165 psig) and borated to the cold shutdown boron concentration. The pressurizer level would have been raised to 200-220 in, with the pressurizer heater groups 8 and 9 already supported by emergency power (1 P and 1S Engineered Safeguards (ES) buses).

The CBO valves associated with the two shutdown RCPs would have been shut. Also during the preparation for a flooding ELAP, operators would pre-connect power cables and discharge hoses for the FLEX SG makeup pumps (FX-P-2A and 2B).

When the ELAP/loss of normal access to the UHS event begins, operators would control SG pressure at approximately 150 psig using the ADVs, and feed the SGs with the turbine-driven EFW pump, controlling SG level with the air-operated flow control valves. Since the RCS would have already been cooled down and depressurized, the pressurizer level raised to greater than 200 in., and CBO partially isolated, there would be significantly more coping time before single-phase natural circulation would be lost.

As the flood level approaches the 313 ft. elevation, operators would establish necessary conditions to withdraw from the Intermediate Building, Auxiliary Building, and the lower elevation of the Control Building. This would entail opening valves to establish the RCS injection flowpath (suction from the BWST, discharge to the HPI lines), shutting the remaining CBO isolation valves, starting the FLEX SG makeup pumps, and isolating the EFW pump discharge path.

From this point, SG level would be controlled by throttling the FLEX SG makeup pump discharge valves (FX-V-206A and -206B). The licensee states that ADVs would be left in a fixed position; SG pressure would slowly decrease as core decay heat decreased over time.

The FIP states that the FLEX design flood period of inundation is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Since all the condensate sources (the two CSTs, DWST and hotwell) would survive a flood event, the quality condensate supply would last approximately 6 days. After the flood waters have receded (below 305 ft. elevation) flood water in the condenser pit would represent another five days of SG makeup supply. Also, when the flood waters recede, the diesel-driven FLEX condensate makeup pump (FX-P-3A or 3B) could then be deployed to pump river water to the "B" CST.

When available, NSRC water treatment equipment would be deployed to provide a long-term source of quality makeup to the "B" CST and SFP.

3.2.2.2 Variations to Core Cooling Strategy for Seismic Event The FLEX strategy for a beyond design basis seismic event is affected by the following structures and components not being seismically qualified:

• Demineralized Water Storage Tank (DWST, designated DW-T-2)

• Condenser hotwell

• 1A Radwaste motor controller center (MCC) and power cables to the CBO isolation valves (MU-V-33)

• Pressurizer heater groups 8 and 9

• York Haven Dam After an earthquake that initiates an ELAP/loss of normal access to the UHS event, operators would shut certain valves in the condensate system so as to lower the probability of uncontrolled condensate loss through damaged non-seismic piping and tanks. Since the 1A Radwaste MCC and associated power cables are not robust, operators may not be able to re-power and shut the four CBO isolation valves. Therefore, RCS leakage may continue at a higher rate (up to 2.5 gpm per RCP, plus 1 gpm of unidentified leakage, as assumed by the

analysis in Technical Evaluation 15-00325, see Section 3.2.3.3). However, since the BWST is seismically qualified, the licensee states that sufficient borated makeup volume will be available throughout the event to maintain single-phase natural circulation in the RCS.

If pressurizer heaters (groups 8 and 9) or their respective power supplies are damaged by the earthquake, operators must use hydraulic control of RCS pressure (i.e. manipulating the discharge of the FLEX RCS makeup pumps), rather than a reliable steam bubble in the pressurizer, to maintain RCS subcooling.

Finally, as noted in Section 3.2.1.1.2 of this SE, if the York Haven Dam has failed due to a seismic event and use of a diesel-driven FLEX condensate makeup pump drawing from the river is prevented, operators would deploy a portable, electric, submersible FLEX pump (FX-P-6A or -6B) to refill CO-T-1 B, taking suction from the protected ISPH intake channel.

3.2.2.3 Variations to Core Cooling Strategy for High Wind Event For an extreme high wind (i.e. tornado) event, the "B" CST (CO-T-1 B), DWST, and BWST are not guaranteed to be available for use. If the non-robust condensate sources were damaged by a tornado, operators would isolate the tanks to prevent further uncontrolled condensate losses.

The other CST (CO-T-1A) and condenser hotwell are robust for applicable high wind missile hazards.

If the BWST is lost, the FLEX RCS makeup pumps would take suction from the SFP, as described in Section 3.2.1.2.2 of the SE. The "C" Reactor Coolant Bleed Tank may also be available as a backup source of borated makeup water. Eventually (but no sooner than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> into the event) SFP temperature will exceed 150 °F and be unavailable for RCS injection.

Therefore, if the SFP (or RCBT) is used for RCS makeup, operators would stabilize pressurizer level at 360 in. after the core cooldown is complete, well before SFP temperature reaches 150

°F. The licensee calculates that this would be sufficient inventory to maintain coverage of the pressurizer heaters (the operation limit for heaters is 80 in. pressurizer level) for at least 66 hours7.638889e-4 days <br />0.0183 hours <br />1.09127e-4 weeks <br />2.5113e-5 months <br /> into the event. By that time, NSRC boration and water treatment equipment will be on-site and ready to provide long-term RCS inventory and shutdown margin control.

The preferred path for condensate makeup from the UHS is into CO-T-1 B. If this tank is damaged, an alternate flowpath can be established, using hoses, through tank EX-T-1 and into the condenser hotwell. Tank EX-T-1 is shielded from tornado missiles.

3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems, and Components (SSCs)

Guidance document NEI 12-06 provides guidance that the baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for core cooling during an ELAP caused by a BDBEE.

3.2.3.1.1 Plant SSCs Core Cooling and Inventory Control - All Plant Modes (except Refueling Shutdown) with Steam Generators Available In NEI 12-06, Section 3.2 states that, for developing mitigating strategies, licensees may assume that existing installed equipment designed to be robust with respect to design-basis external events is fully available for use in mitigating the effects of an ELAP. In addition, Condition 6 of NEI 12-06, Section 3.2.1.3, states that licensees may assume that permanent plant equipment contained in structures with designs that are robust with respect to the applicable hazard(s) is available. The TMI, Unit 1 Updated Final Safety Analysis Report (UFSAR), Section 5.1.1.1 lists all Class 1 SSCs. Section 5.2.1.2, of the UFSAR, states that all Class I SSCs are designed to function following the maximum anticipated design-basis, or safe shutdown earthquake (SSE), to allow a safe and orderly shutdown of the plant. Sections 5.2.1.2.5, 5.4.1.1, and 5.4.1.2 of the UFSAR state that the reactor building and other Class 1 structures, respectively, provide protection from design-basis snow, ice, high wind loads, tornado winds, and tornado-generated missiles. Section 2.6.5 of the UFSAR lists measures taken by the licensee to ensure structures that house Class 1 SSCs provide protection from the design-basis flood.

Phase 1 The licensee's Phase 1 core cooling FLEX strategies for TMI rely on its existing OTSGs, TDEFW pump, EFW control valves, main steam system, ADVs, and 2-hour instrument air system to remove heat from the RCS. In addition, the licensee relies on its station batteries, and vital direct current de system for powering critical instrumentation, and control systems. For Phase 1 RCS inventory control, the licensee relies on its RCP seals to limit RCS leakage until personnel can initiate RCS injection in Phase 2. Section 3.2.3.3 of this SE discusses the RCS pump seals.

The licensee's primary core cooling strategy uses the OTSGs to transfer heat from the RCS to the atmosphere. As described in the FIP and Section 5.1.1.1 of the UFSAR, the OTSGs are Class 1 components located in the reactor building. As described in Sections 5.1.1.1, 5.2.1.2.5 5.2.1.2.6, and 5.2.1 .2.13 the reactor building is a Class I structure and provides protection from all applicable external hazards. Based on the location and design of the RCS system, as described in the FIP and the UFSAR, the OTSGs should be available to support Phase 1 core cooling during an ELAP.

The TDEFW pump supplies water from the CSTs to the OTSGs. The TDEFW pump starts and aligns automatically following a loss of all ac power. If needed, operators can manually start and control the TDEFW pump using existing station procedures. Per FIP Section 4.4.1

[Reference 18], the TDEFW pump all required support are located within a Seismic Class I Aircraft Impact hardened structure with external flood protection up to 313.5 ft elevation (i.e.

above design basis flood elevation). The FIP also states that the TDEFW pump and all required support are designed to function during and after a Safe Shutdown Earthquake. Section 3.1 O of this evaluation discusses the availability of the CSTs. Based on the location and design of the TDEFW pump, as described in the FIP and the UFSAR, the TDEFW pump should be available to support Phase 1 core cooling during an ELAP.

The ability to stabilize RCS temperature is dependent upon the ability to control OTSG pressure and the integrity of the pressure boundary within the main steam system. Because the MSIVs at TMI cannot automatically close following the loss of all ac power, the boundary includes the main steam system piping downstream of the MSIVs in the Turbine Building. As described in Section 10.3.1.1 of the UFSAR, the main steam lines from the steam generator, out through containment up to and including the MSIVs, including the steam piping to the emergency feedwater pump turbine are seismic Class I components. However, all steam piping and valves downstream of the MSIVs are seismic Class Ill components and are designed in accordance with applicable building code requirements and not design-basis SSE loading. In accordance with NEI 12-06, the licensee performed evaluations ECR 15-00330, "Main Steam BDBEE Seismic Evaluation and Mods" and ECR 15-00328, "Main Steam BDBEE Missile Protection Mods" and determined that, with modifications to piping and valve supports, the applicable piping and valves should remain functional following a design-basis seismic event, or a tornado as defined in Regulatory Guide 1.76, Rev. 1, to provide requisite pressure boundary integrity.

The licensee has completed necessary modifications and has revised emergency procedures to direct operators to verify and close if needed selected valves in the turbine building that would compromise the steam piping integrity. In addition, once Phase 2 power sources are aligned and available the licensee plans to close the MSIVs.

The EFW flow control valves control the flow of cooling water from the TDEFW pump to the OTSG. The EFW control valves are air-operated valves with a compressed air bottle bank that provides a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of motive force in an event that no air compressors are available. Once the air supply is depleted, operators will take local manual control of the valves.

As described in the FIP and Section 5.1.1.1 of the UFSAR, the EFW control valves and air supply are Class I components located the Class I portion of the intermediate building and are protected from all applicable hazards. Based on the location and design of the EFW control valves and air supply, as described in the FIP and the UFSAR, the EFW valves should be available to support Phase 1 core cooling during an ELAP.

During Phase 1 core cooling, heat generated by the reactor is transferred from the RCS to the atmosphere via the OTSGs and the ADVs. The ADVs are air-operated valves with a compressed air bottle bank that provides a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of motive force in an event that no air compressors are available. Once the air supply is depleted, operators will take local manual control of the valves. As described in the FIP and Section 5.1.1.1 of the UFSAR, the ADVs, and associated air supply, are Class 1 components located in the Class I portion of the intermediate building and are protected from all applicable hazards. Based on the location and design of the ADVs and air supply, as described in the FIP and the UFSAR, the EFW valves should be available to support Phase 1 core cooling during an ELAP.

During Phase 1 core cooling, the licensee relies on the station batteries and the vital de distribution system to power key instrumentation and control systems. As described in the FIP and Section 5.1.1.1 of the UFSAR, the vital de distribution system, including the station batteries and inverters, is a Class 1 system located in Class 1 structures and is protected from all applicable hazards. Based on the location and design of vital de distribution system, as described in the FIP and the UFSAR, the vital de system should be available to support Phase 1 core cooling during an ELAP.

Phase 2 The licensee's Phase 2 core cooling strategy relies on the continued use of the TDEFW pump supplying water to the OTSG from the CSTs and relieving heat to the atmosphere via the ADVs as described above. In addition, the licensee's strategy includes the ability, if necessary, to utilize the core flooding tanks, pressurizer heaters, pressurizer vents, and RCS PORVs, to maintain RCS pressure and level.

For Phase 2 core cooling, the licensee continues water injection in the OTSGs with the TDEFW pump. Once the volume of water in the CST is depleted, the licensee can provide makeup to the tank with portable FLEX pumps from the UHS. In addition, if the TDEFW pump becomes unavailable, the licensee can inject water in the OTSGs from the CSTs using installed FLEX pumps or from the UHS using a portable pump. Section 3.7.3.1 of this SE discusses the protection and availability of the FLEX pumps' connections and piping systems.

For RCS inventory control during Phase 2, the licensee provides borated water to the RCS from the BWST using an installed FLEX RCS makeup pumps. Sections 3. 7.3.1 and 3.1 O of this SE discuss the protection and availability of the FLEX piping and connections, and the BWST respectively. The licensee credits the core flooding tanks as a contingency, if needed, to provide RCS makeup until a reliable means to maintain a pressurizer steam bubble is established. As described in FIP Attachment 2A, the core flood tanks (CF-T-1 A & CF-T-1 B) are Seismic Class I components located within the reactor building. Section 5.1.1.1 of the UFSAR lists the core flooding tanks, including process and instrument piping and valves, as seismic Class I components. The core flooding tanks are located in the seismic Class 1 reactor building and are protected from all applicable external hazards. Based on the location and design of the core flooding tanks, as described in the FIP and the UFSAR, the core flooding tanks should be available to support Phase 2 inventory control during an ELAP.

Once the FLEX DGs are available, the licensee will repower the pressurizer heaters to maintain or restore a pressurizer steam bubble. As described in FIP Attachment 2A, the pressurizer heater elements are Seismic Class I components. The heaters are inside of the pressurizer, which is located in the reactor building and protected from all applicable external hazards.

However, in Section 4.7.2 of the FIP, the licensee states that hydraulic control of RCS pressure will be required if the emergency pressurizer heaters or their power supply are damaged by the earthquake.

During Phase 2 inventory control, the licensee credits ambient heat loss from the pressurizer for initial RCS pressure reduction. If necessary, the licensee can supplement this pressure reduction using the pressurizer vent valves. In addition, the licensee credits the RCS PORVs as a contingency measure for limiting RCS pressure rise if cooling is temporarily interrupted. As described in FIP Attachment 2A, the pressurizer vent valves (RC-V-28 and RC-V-44) and the RCS PORV (RC-RV-2) are Seismic Class I components located within the reactor building and are protected from all applicable external hazards. Based on the location and design of the pressurizer vent valves and PORV, as described in the FIP, these valves should be available to support Phase 2 inventory control during an ELAP.

Phase 3 For Phase 3 core cooling, the licensee plans to continue the Phase 2 strategies discussed above while augmenting the onsite portable equipment with NSRC supplied equipment. The licensee's Phase 3 strategies do not credit any additional existing installed SSCs.

3.2.3.1.2 Plant Instrumentation Per the FIP, the following instrumentation credited for FLEX will be available following the stripping of non-essential loads:

• in-core thermocouple temperature

• SG pressure

• SG level

• pressurizer level

• RCS pressure

• low-level neutron flux monitoring (source range nuclear instrument)

The instrumentation available to support the licensee's strategies for core cooling and RCS inventory during the ELAP event is consistent with and in some cases exceeds the recommendations specified in the endorsed guidance of NEI 12-06. However, the available indicator of RCS temperature (i.e., in-core thermocouples) would tend to reflect hot side temperatures only. In this regard, the NRG staff notes that, considering the licensee's strategy to maintain natural circulation in the RCS, via the saturation relationship of water, available SG pressure indication should allow deduction of the RCS cold leg temperature. Based upon the information provided by the licensee, the NRG staff understands that indication for the above instruments would be available and accessible continuously throughout the ELAP event.

As recommended by Section 5.3.3 of NEI 12-06, the licensee has developed procedural guidance with instructions and information to obtain readings locally (e.g., at containment penetrations and instrument racks) for the majority of the plant instrumentation listed above.

These instructions are contained in procedure OP-TM-919-907, "Alternate Methods for Obtaining Critical Parameters". An exception to this statement is the source range nuclear instrument, which is not included as required instrumentation in NEI 12-06.

3.2.3.2 Thermal-Hydraulic Analyses In the analysis of the ELAP event performed by the PWR Owners Group (PWROG) in WCAP-17601-P, "Reactor Coolant System Response to the Extended Loss of AC Power Event for Westinghouse, Combustion Engineering and Babcock & Wilcox NSSS Designs," the RELAP5/MOD2-B&W code was chosen for the evaluation of B&W-designed plants such as TMI. The RELAP5/MOD2-B&W code, as described in AREVA topical report BAW-10164-PA, "RELAP5/MOD2-B&W - An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analysis," Rev. 6 (non-public, proprietary information), is a general purpose thermal-hydraulic code that is capable of modeling accident scenarios including large-and small-break LOCAs, as well as a range of operational transients. The RELAP5/MOD2-B&W code is an adaption of the two-fluid, non-equilibrium RELAP5/MOD2 code developed at the Idaho National Engineering Laboratory. Although RELAP5/MOD2-B&W has been approved for performing certain design-basis transient and accident analyses, the NRG staff had not

previously examined its technical adequacy for performing best-estimate simulations of the ELAP event. Therefore, in support of mitigating strategy reviews to assess compliance with Order EA-12-049, the NRC staff evaluated licensees' thermal-hydraulic analyses, including a limited review of the significant assumptions and modeling capabilities of the RELAP5/MOD2-B&W code and other thermal-hydraulic codes used for these analyses.

Based upon this review, the NRC staff questioned whether RELAP5/MOD2-B&W and other codes used to analyze ELAP scenarios for PWRs would provide reliable coping time predictions in the reflux or boiler-condenser cooling phase of the event because of challenges associated with modeling complex phenomena that could occur in this phase, including boric acid dilution in the intermediate leg loop seals, two-phase leakage through RCP seals, and primary-to-secondary heat transfer with two-phase flow in the RCS. In particular, for B&W PW Rs with once-through SGs, the boiler-condenser cooling mode is said to exist when vapor boiled off from the reactor core flows up through the saturated, stratified hot legs, around the hot leg bends, and then down into the once-through SG tubes, where it is condensed by EFW sprayed onto the SG tubes. Unlike PWRs with inverted U-tube SGs that undergo reflux cooling (i.e.,

wherein the majority of condensation occurs on the uphill side of the SG tubes, with the resulting condensate flowing back downhill into the reactor vessel via the hot legs), for B&W reactors in the boiler-condenser cooling mode, the condensate continues to drain downward through the once-through SGs and into the intermediate legs.

Due to the B&W RCS design configuration, at the time natural circulation ceases in the RCS (i.e., hot leg bends are sufficiently voided), the once-through SG tubes remain full of water. The presence of this stagnant liquid precludes effective heat transfer via boiler-condenser cooling, since it prevents vapor from penetrating down into the SG tubes being sprayed by EFW flow. In this condition, degraded primary-to-secondary heat transfer conditions may occur, persisting until either: (1) sufficient RCS volume is restored to restart natural circulation, or (2) sufficient RCS volume is lost such that steam from the hot legs can enter the once-through SG tubes to permit adequate, continuous condensation heat transfer via boiler-condenser cooling. Owing to the relatively low RCS leakage rate considered during the analyzed ELAP event, if this situation occurs prior to the establishment of FLEX RCS makeup, a significant period of time may elapse, during which primary-to-secondary heat transfer may be significantly degraded, as illustrated in simulations conducted for B&W reactors in both WCAP-17601-P and WCAP-17792-P, "Emergency Procedure Development Strategies for the Extended Loss of AC Power Event for all Domestic Pressurized Water Reactor Designs" (proprietary). These simulations show the potential for RCS re-pressurization in excess of 2000 psia [per square inch absolute] after RCS loop flow stagnates, with the RCS pressure in some cases remaining in this vicinity for many hours. Extensive re-pressurization of the RCS following a loss of natural circulation should be avoided for a number of reasons, including the potential to lift a safety or relief valve on the pressurizer and the potential for elevated RCS temperatures induced by the re-pressurization to result in RCP seal degradation and increased RCS leakage.

Furthermore, the NRC staff observed that the modeling capability of the RELAP5/MOD2-B&W code with respect to two-phase primary-to-secondary heat transfer for B&W reactors had not been sufficiently benchmarked to support best-estimate calculations for the ELAP event. As noted in BAW-10164-PA, limited benchmarking of the models for two-phase heat transfer across the SG was undertaken because the RCS pressure response during a LOCA tends to be dominated by the mass and energy loss from the break effluent, even down into the size range of the most limiting small break. However, considering the much lower RCS leakage rates

associated with the analyzed ELAP event, heat transfer to the once-through SGs becomes the primary means of energy removal from the RCS. Furthermore, the analytical modeling techniques used in the calculations in WCAP-17601-P and WCAP-17792-P for B&W reactors were not adequately documented (e.g., modeling of SG tube wetting by auxiliary feedwater),

and in some cases, the calculated results did not appear to match ostensible descriptions (e.g.,

the B&W simulations apparently did not use the 75°F per hour cooldown rate described in Section 4.2.1 of WCAP-17601-P). As a result, the NRC staff could not credit the generic B&W coping time results from WCAP-17601-P and WCAP-17792-P beyond the point at which natural circulation ceases and RCS loop flow stagnates.

Likewise, the licensee did not credit boiler-condenser cooling to extend its credited coping time, but instead performed analysis intended to demonstrate that the TMI strategy will be successful by taking actions to maintain natural circulation in all RCS loops and establish FLEX RCS makeup early in the event. In particular, for the B&W reactor design, prudent objectives for plant operators to prolong the duration of natural circulation flow in the RCS include:

• Maintaining adequate pressurizer level, which suppresses void formation in the RCS loop piping and the potential for an associated increase in flow resistance to interrupt natural circulation. Initiating RCS makeup early in the ELAP event prevents RCS leakage from draining the pressurizer. Delaying the RCS cooldown until RCS makeup is restored, and thereafter conducting a slow cooldown within the volumetric capacity of the FLEX RCS makeup source prevents thermally induced contraction of the RCS from draining the pressurizer.

• Maintaining adequate subcooling in the RCS loops, which similarly suppresses void formation in the RCS loops and the associated potential to interrupt natural circulation. Using the SGs to cool down the RCS with normal plant equipment unavailable would substantially degrade the RCS subcooling margin, potentially beneath minimum values considered desirable or necessary to support natural circulation. By delaying the RCS cooldown until critical steps within the FLEX strategy can be accomplished (e.g.,

restoration of pressurizer heaters, establishing FLEX RCS makeup),

adequate subcooling margin to support natural circulation can be preserved during the RCS cooldown.

• Maximization of the elevation at which primary-to-secondary heat transfer occurs, since increasing the height of the heat sink relative to the heat source promotes natural circulation flow. In the B&W reactor design, upon demand, the EFW system sprays feedwater onto the once-through SG tubes at their upper elevation near the upper tubesheet. This elevation is significantly higher than the water level maintained by the main feedwater system during normal operation. Per the TMI FLEX strategy, the EFW pump and FLEX pumps used for SG makeup would discharge into EFW system piping and hence accrue a similar benefit. In the event that adequate primary to secondary heat transfer were lost, the licensee's procedures would also direct raising the SG water level, which has a similar objective.

Based upon the result of a generic calculation from WCAP-17792-P, in the absence of FLEX RCS makeup, the licensee concluded that at least 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would be available prior to loss of heat transfer by ongoing RCS leakage under ELAP conditions. In light of this, the licensee's mitigating strategy directs that FLEX RCS makeup be established no later than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the ELAP event, along with restoration of the pressurizer heaters. Conceptually, the NRG staff did not consider the B&W analysis from WCAP-17792-P to be satisfactory at a generic level. The generic analysis contains some variables that may not reflect appropriate and conservative plant-specific parameter values (e.g., for RCP seal leakage). In order to evaluate a specific TMI case, the NRG staff performed a confirmatory evaluation of this scenario using the TRACE thermal-hydraulic code. In particular, the TRACE evaluation modeled RCP seal leakage per the conditions and limitations in the Flowserve white paper (see Section 3.2.3.3 of this SE) and the associated NRG endorsement letter, i.e., a constant mass leakage rate as opposed to a non-constant choked-flow model.

The results of the NRG staff's simulations indicated that at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the event, at least 2 feet of actual level would remain in the pressurizer, even assuming that letdown remains unisolated for the first 1O minutes of the event. The licensee states that letdown isolation would occur automatically upon high temperature after a loss of offsite power (LOOP) where automatic restoration of ac power does not occur, and that no significant RCS inventory would be lost via letdown in an ELAP event. The staff's simulations indicated that, assuming automatic letdown isolation, approximately 5.4 feet of actual level would remain in the pressurizer at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the event. The NRG staff's TRACE simulations also indicated that, in either case, indicated pressurizer level could be lost (i.e., go off-scale) in the first hours of the event, before makeup begins; the licensee states that reactor vessel level (hot leg level) indication would be available through the plant process computer until about two hours into the event. The NRG staff agrees that given the licensee's plan to perform a symmetric cooldown (except for contingency strategies), and the fact that actual pressurizer level will be maintained, natural circulation in all loops is assured throughout the event. The staff further noted that neither the thermal-hydraulic analysis performed by the licensee nor the NRG staff explicitly credited isolation of the CBO flow from the Flowserve N-9000 RCP seals installed at TMI. As discussed further in Section 3.2.3.3 of this SE, for at least the 6-7 hour duration over which the N-Seal design was tested, CBO isolation would be expected to decrease leakage well below the flow rate considered in the calculations. Thus, despite differences in the analytical results, the NRG staff's audit review supports the licensee's strategy for initiating RCS makeup for TMI by 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the ELAP event.

The licensee's thermal-hydraulic analysis further concluded that providing FLEX RCS makeup at a rate of 40 gpm would maintain adequate pressurizer level at an RCS cooldown rate of 37 °F per hour. The NRG staff's confirmatory simulations using TRACE do not support this conclusion; the staff's calculations indicate that given a makeup rate of 40 gpm, approximately 28°F per hour would be the maximum sustainable average cooldown rate, if 100 in. pressurizer level is to be maintained. In any case, the licensee's plant emergency operating procedure (EOP), EOP-12, "Station Blackout," directs operators to reduce the cooldown rate, if necessary, to maintain pressurizer level. If operators do reduce the cooldown rate, the cooldown completion time would be slightly extended; the licensee states that the impact to the RCP seals and availability of the spent fuel pool for RCS makeup (which cannot be used for this purpose after it heats up to 150°F) will not threaten the successful implementation of the FLEX strategy.

Therefore, based on the evaluation above, the NRG staff concludes that the licensee's analytical approach should appropriately determine the sequence of events for reactor core cooling, including time-sensitive operator actions, and evaluate the required equipment to mitigate the analyzed ELAP event, including pump sizing and cooling water capacity.

3.2.3.3 Reactor Coolant Pump (RCP) Seals Leakage from RCP seals is among the most significant factors in determining the duration that a PWR can cope with an ELAP event prior to initiating RCS makeup. An ELAP event would interrupt cooling to the RCP seals, potentially resulting in increased leakage and the failure of elastomeric a-rings and other components, which could further increase the leakage rate. As discussed above, as long as adequate inventory is maintained in the RCS, natural circulation can effectively transfer residual heat from the reactor core to the SGs and limit local variations in boric acid concentration. Along with cooldown-induced contraction of the RCS inventory, cumulative leakage from RCP seals governs the duration over which natural circulation can be maintained in the RCS. Furthermore, the seal leakage rate at the depressurized condition can be a controlling factor in determining the flow capacity requirement for FLEX pumps to offset ongoing RCS leakage and recover adequate system inventory.

As noted above, Flowserve N-9000 3-stage seals are installed on the RCPs at TMI Unit 1. The N-9000 seal is a product in Flowserve's N-seal line of hydrodynamic seals that was developed by Flowserve in the 1980s. One of the design objectives for the N-9000 seal was to provide low-leakage performance under loss-of-seal-cooling conditions during events such as a station blackout. On August 5, 2015, in support of licensees using Flowserve RCP seals, the PWROG submitted a white paper to the NRG staff describing the response of the Flowserve N-Seal RCP Seal Package to a postulated ELAP (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15222A366).

The N-Seal white paper contains information regarding the expected leakage rates over the course of an ELAP event for each PWR at which Flowserve N-Seals are currently installed.

Leakage rates as a function of time were assigned based upon a comparison of plant-specific thermal profiles relative to the thermal margin demonstrated in a test of N-Seal performance under simulated station blackout conditions that was conducted by Flowserve in 1988.

According to measured data from this test, following CBO isolation at 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, over the course of the succeeding period of 6 to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> during which CBO isolation was maintained, the average seal leakage rate was slightly less than 0.05 gpm. Although the NRG staff agreed that it is appropriate to allow credit for demonstrated performance, during its review of the Flowserve white paper, the staff questioned the extrapolation of evidence from a limited test period of 6 to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to the indefinite coping period associated with the ELAP event. While the NRG staff ultimately agreed with the credit Flowserve's N-Seal white paper allowed for CBO isolation in determining the short-term thermal exposure profile of seal elastomers, the staff did not endorse direct application of the average leakage rate measured with the CBO isolated in the 1988 test for an indefinite period in the absence of demonstrated long-term seal performance. By letter dated November 12, 2015 (ADAMS Accession No. ML 1531 OA094), the staff endorsed the leakage rates described in the white paper for the beyond-design-basis ELAP event, subject to certain limitations and conditions.

During the audit, the licensee addressed the status of its conformance with the Flowserve N-Seal white paper and the limitations and conditions in the NRC staff's endorsement letter.

The licensee's FIP states that the plant design and planned mitigation strategy of TMI are consistent with the calculation performed by Flowserve, as summarized in Table 1 of the white paper, and that the peak cold-leg temperature is based on the lowest main steam safety valve lift pressure. The NRC staff audited the applicable information from the Flowserve white paper against the TMI plant design and the mitigating strategy and determined that they were generally consistent. In particular, the peak cold-leg temperature prior to the RCS cooldown assumed in Flowserve's analysis (555 °F) was found to be slightly higher than the saturation temperature (551 °F) corresponding to the lowest setpoint for MSSV valve lift pressure.

However, the NRC staff found in its confirmatory TRACE evaluation (described in Section 3.2.3.2 of this SE) that the cooldown rate assumed by the Flowserve white paper (37 °F/hour) may not be achievable, given an RCS makeup rate of 40 gpm and the requirement to maintain pressurizer level at 100 in. during cooldown. This introduces additional uncertainty in predicting the potential failure of the seal elastomers. In response, the licensee stated in its FIP that such a failure would remain unlikely, and notes that even assuming seal elastomer failures on all four RCPs, the total RCS leakage rate would remain within the makeup capacity of one FLEX RCS makeup pump, given the Abeyance feature of the seals installed at TMI. Based upon its audit review, the NRC staff considers the issue of achievable cooldown rate to be addressed inasmuch as (1) natural circulation is maintained in all RCS loops throughout the analyzed ELAP event, even during the intervening period between the partial draining of the pressurizer and the time at which the licensee's mitigating strategy would establish FLEX RCS makeup, and (2) no credit for CBO isolation was taken in determining the RCP seal leakage rates.

Based upon the discussion above, the NRC staff concludes that the RCP seal leakage rates assumed in the licensee's thermal-hydraulic analysis may be applied to the beyond-design basis ELAP event for the site.

3.2.3.4 Shutdown Margin Analyses In an analyzed ELAP event, the loss of electrical power to control rod drive mechanisms is assumed to result in an immediate reactor trip with the full insertion of all control rods into the core. The insertion of the control rods provides sufficient negative reactivity to achieve subcriticality at post-trip conditions. However, as the ELAP event progresses, the shutdown margin for PWRs is typically affected by several primary factors:

• the cooldown of the RCS and fuel rods adds positive reactivity

• the concentration of xenon-135, which (according to the core operating history assumed in NEI 12-06) would o initially increase above its equilibrium value following reactor trip, thereby adding negative reactivity o peak at roughly 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> post-trip and subsequently decay away gradually, thereby adding positive reactivity

• the passive injection of borated makeup from nitrogen-pressurized accumulators due to the depressurization of the RCS, which adds negative reactivity

At some point following the cooldown of the RCS, PWR licensees' mitigating strategies generally require active injection of borated coolant via FLEX equipment. In many cases, boration would become necessary to offset the gradual positive reactivity addition associated with the decay of xenon-135; but, in any event, borated makeup would eventually be required to offset ongoing RCS leakage. The necessary timing and volume of borated makeup depend on the particular magnitudes of the above factors for individual reactors.

The specific values for these and other factors that could influence the core reactivity balance that are assumed in the licensee's current calculations could be affected by future changes to the core design. However, NEI 12-06, Section 11.8 states that "[e]xisting plant configuration control procedures will be modified to ensure that changes to the plant design ... will not adversely impact the approved FLEX strategies." Inasmuch as changes to the core design are changes to the plant design, the staff expects that any core design changes, such as those considered in a core reload analysis, will be evaluated to determine that they do not adversely impact the approved FLEX strategies, especially the analyses which demonstrate that recriticality will not occur during a FLEX RCS cooldown.

During the audit, the NRC staff reviewed the licensee's shutdown margin calculation for TMI.

The licensee concluded that adequate shutdown margin could be achieved without crediting the boron injected via the core flood tanks. Based upon the licensee's planned mitigating strategy and procedural guidance for core flood tank isolation, the NRC staff considers the lack of credit appropriate. The assumptions in the licensee's analysis are appropriately conservative, including the most limiting initial core conditions, most limiting cooldown profile, and injected boron concentration at the minimum allowed by technical specifications (2500 ppm). Per NEI 12-06, there is no requirement to consider further random failures besides the initial ELAP/loss of normal access to the UHS; hence, all rods are assumed to insert into the core. The licensee concluded that if pressurizer level is raised to 100 in. prior to cooling down the RCS, and borated injection to the RCS is performed so as to maintain 100 in. pressurizer level, and the boron concentration of the injected water is at least 2500 ppm, then the reactor will remain subcritical for the duration of the event. The licensee's calculations for this case (all rods in) do not take any credit for xenon, another conservatism.

The calculation did not specifically address the potential for core flood tank injection. However, the staff notes that the analyzed range of RCS leakage rates should result in the RCS pressure remaining sufficiently high to prevent core flood tank discharge prior to the injection of sufficient inventory from the BWST or SFP to provide the required shutdown margin. The NRC staff observed that the licensee's thermal-hydraulic calculations further support this conclusion.

Toward the end of an operating cycle, when RCS boron concentration reaches its minimum value, some PWR licensees may need to vent the RCS to ensure that their FLEX strategies can inject a volume of borated coolant that is sufficient to satisfy shutdown margin requirements in cases where minimal RCS leakage occurs. Understanding the need for RCS venting is necessary because completion of this action can extend the time required to complete RCS boration to the required concentration. The licensee's calculations adequately demonstrate that RCS venting would not be required. One assumption in the shutdown margin calculation is that pressurizer level is maintained at 100 in, and the high boron concentration of the injected water ensures that the makeup volume required to maintain 100 in. in the pressurizer is itself enough to keep the reactor subcritical.

The NRC staff's audit review of the licensee's shutdown margin calculation determined that credit was taken for uniform mixing of boric acid during the ELAP event. The NRC staff had previously requested that the industry provide additional information to justify that borated makeup would adequately mix with the RCS volume under natural circulation conditions potentially involving two-phase flow. In response, the PWROG submitted a proprietary position paper, dated August 15, 2013, which provided test data regarding boric acid mixing under single-phase natural circulation conditions and outlined applicability conditions intended to ensure that boric acid addition and mixing during an ELAP would occur under conditions similar to those for which boric acid mixing data is available. By letter dated January 8, 2014, the NRC staff endorsed the above position paper with three conditions:

• The required timing and quantity of borated makeup should consider conditions with no RCS leakage and with the highest applicable leakage rate.

• Adequate borated makeup should be provided either (1) prior to the RCS natural circulation flow decreasing below the flow rate corresponding to single-phase natural circulation, or (2) if provided later, then the negative reactivity from the injected boric acid should not be credited until one hour after the flow rate in the RCS has been restored and maintained above the flow rate corresponding to single-phase natural circulation.

• A delay period adequate to allow the injected boric acid solution to mix with the RCS inventory should be accounted for when determining the required timing for borated makeup. Provided that the flow in all loops is greater than or equal to the corresponding single-phase natural circulation flow rate, a mixing delay period of one hour is considered appropriate.

Because credit is taken for uniform boric acid mixing under natural circulation flow, the NRC staff determined that the boric acid mixing position paper, including the conditions in the endorsement letter, is applicable to TMI, Unit 1. The licensee's FIP does not include a discussion of the boric acid mixing model or mixing delay period, apart from a stating that by maintaining single-phase natural circulation in the RCS, adequate boron mixing is assured for the duration of the event. The NRC staff agrees with this, and further notes that the licensee's timeline entails initiating RCS makeup relatively early in the event (at or before 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), well before the time at which positive reactivity introduced by xenon decay or RCS cooldown would threaten shutdown margin.

Therefore, based on the evaluation above, the NRC staff concludes that the sequence of events in the proposed mitigating strategy should result in acceptable shutdown margin for the analyzed ELAP event.

3.2.3.5 FLEX Pumps and Water Supplies As described in the licensee's FIP, the licensee credits 5 FLEX pumps for core cooling and inventory control FLEX strategies; a FLEX RCS makeup Pump, a FLEX feedwater pump, a portable diesel-driven pump, a portable boron transfer pump, and a portable submersible pump.

RCS Makeup The FLEX RCS makeup pumps, identified by the licensee as FX-P-1 A/B, are credited as the primary motive force for supplying borated water to the RCS during Phase 2. The pumps are skid-mounted, electric motor-driven, positive displacement pumps. The licensee has two FLEX RCS makeup pumps onsite, which satisfies the N+ 1 provision of NEI 12-06. In accordance with NEI 12-06, Section 11.2, the licensee performed calculation C-1101-919-E410-001, "FLEX System Hydraulic Analysis," and Technical Evaluation 15-00345, "Diverse Flow Paths," which analyzed the credited primary and alternate flow path for RCS injection and determined the minimum pumping capabilities required for the pump to perform its credited FLEX function. The NRC staff reviewed the calculations to determine if the licensee used standard evaluation methods, and proper assumptions and inputs, and compared the results of the calculation to the actual design specifications of the procured pumps. The licensee's calculations use classical hydraulic analysis head loss and pressure gradient methods, and includes all pumps, valves, hoses, strainers, elevations, and line distances for the FLEX strategy water supply using the most limiting set of conditions for RPV injection. The calculations determined the minimum required flow rate, minimum discharge pressure, and minimum net positive suction head available (NPSHa) for the pump to be able to perform its required function for the primary and alternate flow paths. Comparison of the actual pump performance data and the sizing criteria of the calculation shows that the FLEX pumps FX-P-1 A/B should have the capacity needed to perform the required function for supporting RCS injection during an ELAP.

The portable boron transfer pump, identified by the licensee as FX-P-4, is used to transfer borated water from a mobile boration unit to the suction of FX-P-1 A/B. The transfer pump is a portable diesel motor-driven centrifugal pump. The licensee has three transfer pumps on site, which satisfies the N+ 1 provision of NEI 12-06. In accordance with NEI 12-06, Section 11.2, the licensee performed Technical Evaluation 14-00218 "FLEX Borated Water Supply Plan," to determine the capability of FX-P-4 to provide an adequate suction head to FX-P-1A/B. The NRC staff reviewed the calculations to determine if the licensee used standard evaluation methods, and proper assumptions and inputs, and compared the results of the calculation to the actual design specifications of the procured pumps. The licensee's calculations use classical hydraulic analysis head loss and pressure gradient methods, and includes all pumps, valves, hoses, strainers, elevations, and line distances. Comparison of the actual pump performance data and the sizing criteria of the calculation shows that the FLEX pump FX-P-4 should have the capacity needed to perform the required function for supporting RCS injection during an ELAP.

Based on the staff's review of the FX-P-4 and FX-P-1A/B pumping capabilities at TMI, as described in the above hydraulic analyses and the FIP, the NRC staff concludes that the portable the FX-P-4 and FX-P-1A/B pumps should perform as intended to support RCS inventory control during an ELAP event, as required by NRC Order EA-12-049 consistent with NEI 12-06, Section 11 .2.

Steam Generator and Spent Fuel Pool Makeup The FLEX feedwater pumps, identified by the licensee as FX-P-2A/B, are credited as the backup to the TDEFW pump to supply water to the OTSGs and as the primary source of SFP makeup. The FLEX feedwater pumps are electric motor-driven, canned submersible centrifugal pumps. The licensee has two FLEX feedwater pumps onsite, which satisfies the N+ 1 provision of NEI 12-06. In accordance with NEI 12-06, Section 11.2, the licensee performed calculation

C-1101-919-E410-001, "FLEX System Hydraulic Analysis," which analyzed the credited primary flow paths for OTSG injection and SFP makeup, and determined the minimum pumping capabilities required for the pump to perform its credited FLEX function. The NRC staff reviewed the calculations to determine if the licensee used standard evaluation methods, and proper assumptions and inputs, and compared the results of the calculation to the actual design specifications of the procured pumps. The licensee's calculations use classical hydraulic analysis head loss and pressure gradient methods, and includes all pumps, valves, hoses, strainers, elevations, and line distances for the FLEX strategy water supply using the most limiting set of conditions for OTSG injection concurrent with SFP makeup. The calculations determined the minimum required flow rate, minimum discharge pressure, and minimum NPSHa for the pump to be able to perform its required function for the primary flow paths.

Comparison of the actual pump performance data and the sizing criteria of the calculation shows that the FLEX pumps FX-P-2A/B should have the capacity needed to perform the required function for supporting core and SFP cooling during an ELAP.

Even though the FX-P-2A/B pumps can eventually discharge into the OTSGs through separate EFW trains, the discharge of the pumps share a significant amount of common FLEX piping (see Section 3.7.3.1 of this SE). As a result, the licensee does not have diverse primary and alternate flow paths in accordance with NEI 12-06. Therefore, the licensee proposed the use of the portable FLEX pump FX-P-3A/B to supply water to the OTSGs and SFP without using any installed FLEX piping. In accordance with NEI 12-06, the licensee performed Technical Evaluation 15-00345 "Diverse Flow Paths," to show that FX-P-3A/B has the capacity to provide the required flow to the OTSGs and the SFP.

Based on the staff's review of the FX-P-2A/B and FX-P-3A/B pumping capabilities at TMI, as described in the above hydraulic analyses and the FIP, the NRC staff concludes that the FX-P-2A/B and FX-P-3A/B pumps should perform as intended to support core and SFP cooling during an ELAP event, as required by NRC Order EA-12-049 and consistent with NEI 12-06, Section 11.2, with the exception of a seismically-induced downstream dam failure. In the event of a seismically-induced downstream dam failure the licensee would not be able to access the UHS using the FX-P-3A/B pumps and inject directly into the OTSGs. Therefore, for the condition of a seismically-induced downstream dam failure, the FX-P-3A/B pumps cannot provide the diverse, alternate OTSG injection flowpath and NEI 12-06 guidance is not met for this specific case.

However, the FX-P-6A/B submersible pumps are credited to provide makeup to the CST if the FX-P-3A/B pumps are unavailable (as discussed below), including unavailability due to a seismically-induced downstream dam failure. Therefore, the CST would continue to serve as a supply source for the FX-P-2A/B pumps and the pumps, with their associated FLEX piping do provide at least one means to provide water to maintain or restore core or SFP cooling after a seismic event, including a seismic-induced downstream dam failure, as required by NRC Order EA-12-049.

Condensate Storage Tank/Hotwell Makeup The portable diesel-driven pumps, identified by the licensee as FX-P-3A/B, are credited as the primary motive force for supplying makeup to the condensate storage tank or hotwell from the UHS. The pump is a trailer mounted, diesel motor-driven pump. The licensee has two portable diesel-driven pumps on site, which satisfies the N+ 1 provision of NEI 12-06. In the event of a downstream dam failure, the licensee would replace FX-P-3A/B with FX-P-6A/B. The pumps

are portable, electric motor-driven, submersible centrifugal pumps. The licensee has two pumps on site, which satisfies the N+ 1 provision of NEI 12-06. In accordance with NEI 12-06, Section 11.2, the licensee performed calculation C-1101-919-E410-001, "FLEX System Hydraulic Analysis," which analyzed the credited primary flow path for condensate storage tank and hotwell makeup, and determined the minimum pumping capabilities required for the pump to perform its credited FLEX function. The NRC staff reviewed the calculations to determine if the licensee used standard evaluation methods, and proper assumptions and inputs, and compared the results of the calculation to the actual design specifications of the procured pumps. The licensee's calculations uses classical hydraulic analysis head loss and pressure gradient methods, and includes all pumps, valves, hoses, strainers, elevations, and line distances for the FLEX strategy water supply using the most limiting set of conditions for condensate storage tank or hotwell makeup. The calculations determined the minimum required flow rate, minimum discharge pressure, and minimum NPSHa for the pump to be able to perform its required function for the primary flow paths. Comparison of the actual pump performance data and the sizing criteria of the calculation shows that the FLEX pumps FX-P-3A/B and FX-P-6A/B should have the capacity needed to perform the required function for supporting condensate storage tank or hotwell makeup during an ELAP.

Based on the staff's review of the FX-P-3A/B and FX-P-6A/B pumping capabilities at TMI, as described in the above hydraulic analyses and the FIP, the NRC staff concludes that the portable the FX-P-3A/B and FX-P-6A/B pumps should perform as intended to support condensate storage tank or hotwell makeup during an ELAP event, consistent with NEI 12-06, Section 11.2.

3.2.3.6 Electrical Analyses The licensee's electrical strategies provide power to the equipment and instrumentation used to mitigate the ELAP and LUHS. The electrical strategies described in the FIP are practically identical for maintaining or restoring core cooling, containment, and SFP cooling, except as noted in Sections 3.3.4.4 and 3.4.4.4 of this SE.

The NRC staff reviewed the licensee's FIP, conceptual electrical single-line diagrams and the summary of calculations for sizing the FLEX generators and station batteries. The staff also reviewed the licensee's evaluations that addressed the effects of temperature on the electrical equipment credited in the FIP as a result of the loss of heating, ventilation, and air conditioning (HVAC) caused by the event.

According to the licensee's FIP, operators would declare an ELAP following a loss of offsite power, emergency diesel generators (EDGs), and any ac source, with a simultaneous loss of the UHS. The plants indefinite coping capability is attained through the implementation of pre-determined FLEX strategies that are focused on maintaining or restoring key plant safety functions. A safety function-based approach provides consistency with, and allows coordination with, existing plant EOPs. The FLEX strategies are implemented in support of EOPs using FLEX Support Guidelines (FSGs).

The TMI Phase 1 FLEX mitigation strategy involves relying on installed plant equipment and onsite resources, such as the installed Class 1 E station batteries and vital inverters. This equipment is located within safety-related Class 1 structures and is considered robust and protected with respect to applicable site external hazards. The Class 1E station batteries will

provide power to system instrumentation, control systems, and other required loads. Operators will strip or shed unnecessary loads to extend the battery life until backup power (Phase 2) is available. Attachment 5A of the licensee's FIP describes some of the load shedding actions operators will take to extend battery life during an ELAP/LUHS event.

Three Mile Island has two redundant 125/250 Volt-direct current (Vdc) systems serving 125 and 250 Vdc Channel 'A' and 'B' loads. Each 250 Vdc battery system consists of two sections of 58 cells providing 125 Vdc power supply to various de loads. These batteries were manufactured by C&D Technologies (Model LCR-21) and are rated at 1500 ampere-hours at an 8-hour discharge rate to 1.75 V per cell.

The NRC staff reviewed the summary of the licensee's de coping analysis calculation C-1101-734-E420-009, "TMl-1 Extending Battery Life to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> under ELAP," Rev. 0, including Attachment 1, "Extending Battery Life to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> under ELAP with OTSG's, and Attachment 11, "Extending Battery Life to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> under ELAP without OTSG's," to verify the capability of the de system to supply the required loads during Phase 1. The licensee's analysis identified the required loads and their associated ratings (amperage and minimum voltage) and loads that would be shed to ensure battery operation for at least 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> {power is expected to be restored to the battery chargers by this time). Procedures OP-TM-AOP-020 "Loss of Station Power",

Rev. 17, OP-TM-EOP-012, "Station Blackout, Rev. 1, and OP-TM-919-906, "FSG DC Load Management for Extended Loss of AC Power," Rev. 0, provide guidelines to the plant operators to shed loads from the Class 1E station batteries to extend the battery coping time.

Based on the staff's review of the licensee's analysis and procedures, the battery vendor's capacity and discharge rates for the Class 1E station batteries, the NRC staff finds that the TMI de systems have adequate capacity and capability to power the loads required to mitigate the consequences during Phase 1 of an ELAP as a result of a BDBEE provided that necessary load shedding is completed within the times assumed in the licensee's analysis.

The licensee's Phase 2 strategy is to use a pre-staged FLEX 480 Vac diesel generator (DG) to repower 480 Vac buses to ensure power is available to the battery chargers prior to depletion of the station batteries and to power other loads. The licensee has developed a primary and alternate strategy for supplying power. The strategy relies on one of two pre-staged 500 kW, 480 Vac FLEX DGs (.9 power factor). Having two 480 Vac FLEX DGs of equal capacity provides N+ 1 capability to meet the criteria in NEI 12-06, Rev. O. The FLEX DGs are pre-staged on a FLEX platform above the 320 foot (ft.) elevation in the Turbine Building that is qualified for the SSE, tornado wind load, and is protected from tornado generated missiles (the NRC staff's analysis of the Turbine Building's robustness is discussed in Sections 3.6.1.1 and 3.14.2 of this SE). According to the FIP, the FLEX electrical distribution system can deliver 390 kW at the FLEX maximum outside ambient temperature or 500 kW with ambient temperature below 68°F. In its FIP, the licensee noted that a 480 Vac FLEX DG is expected to be started and energize required equipment approximately 150 minutes (to initiate RCS makeup within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) and 240 minutes (to power the battery chargers before the station battery depletes to the minimum acceptable voltage) after initiation of an ELAP event.

The NRC staff reviewed the summary of calculation ECR-TM-13-00208, "FLEX Design Specification," Rev. 6, to confirm the adequacy of the capacity of the Phase 2 FLEX DGs. The NRC staff also reviewed conceptual single line diagrams and the separation and isolation of the FLEX DGs from the EDGs. This calculation showed that the total worst-case (limiting cold

weather) expected loads on the 480 Vac FLEX DG will be approximately 479 kW. The equipment that will be supplied power from the 480 Vac FLEX DG includes: FX-Y-1A or FX-Y-1B, 1P 480 Vac switchgear, 1S 480 Vac switchgear, 1A ES MCC, 1 B ES MCC, and the A & B battery chargers. The results of this calculation confirmed that one 480 Vac, 500 kW FLEX DG is adequate to start and run the loads required for either the primary or the alternate Phase 2 FLEX strategies.

Additionally, based on its review of the licensee's procedures and conceptual single line electrical diagrams and sketches, the NRC staff finds that the licensee's Phase 2 electrical approach is acceptable given the protection and diversity of the power supply pathways including the separation and isolation of the FLEX DGs from the Class 1E EDGs.

For Phase 3, the licensee plans to continue the Phase 2 coping strategy with additional assistance provided from an NSRC, as needed. The NSRC equipment that TMI will receive includes two 1 megawatt (MW), 4160 Vac, 3-phase Combustion Turbine Generators (CTGs),

one 480 Vac, 1 MW CTG, electrical cables, and a 4160 Vac Electrical Distribution System. In its supplement to the FIP, the licensee noted that the 480 Vac CTG could be used to substitute the Phase 2 FLEX DGs, if necessary. The capacity of NSRC-supplied 480 Vac CTG is of greater capacity than the licensee's Phase 2 FLEX DGs. Licensee procedure OP-TM-919-955, "Connection to SAFER Equipment," Rev. 1, provides the necessary guidance to enable connection of the Phase 3 FLEX 480 Vac CTGs to the TMI 480 Vac buses. According to its supplement to the FIP, the licensee does not have any plans or needs to use the NSRC-supplied 4160 Vac equipment. However, this equipment will be available to use if the recovery organization determines that it is necessary. Based on the above, the NRC staff finds that a single 480 Vac NSRC-supplied CTG will have adequate capacity to supply the required loads to maintain or restore core cooling indefinitely following an ELAP.

Based on its review, the NRC staff finds that the Class 1E station batteries used in the strategy have sufficient capacity to support the licensee's strategy, and that the FLEX DGs and the NSRC-supplied CTGs have sufficient capacity and capability to supply the necessary loads during an ELAP event.

3.2.4 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that should maintain or restore core cooling and RCS inventory during an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.3 Spent Fuel Pool Cooling Strategies In NEI 12-06, Table 3-2 and Appendix D, summarize an acceptable approach consisting of three separate capabilities for the SFP cooling strategies. This approach uses a portable injection source to provide the capability for 1) makeup via hoses on the refueling floor capable of exceeding the boil-off rate for the design basis heat load; 2) makeup via connection to spent fuel pool cooling piping or other alternate location capable of exceeding the boil-off rate for the design basis heat load; and 3) spray via portable monitor nozzles from the refueling floor using a portable pump capable of providing a minimum of 200 gpm per unit (250 gpm if overspray occurs). However, in JLD-ISG-2012-01, Rev. 1 [Reference 47] the NRC staff allows the

licensee to complete an SFP integrity evaluation in lieu of a spray capability that demonstrates that a seismic event would have a very low probability of inducing a crack in the SFP or its piping systems so that spray would not be needed to cool the spent fuel. The evaluation must use the reevaluated seismic hazard described in Section 3.5.1 below if it is higher than the site's current SSE. During the event, the licensee selects the SFP makeup method to use based on plant conditions. This approach also requires a strategy to mitigate the effects of steam from the SFP, such as venting.

As described in NEI 12-06, Section 3.2.1. 7 and JLD-ISG-2012-01, Section 2.1, strategies that must be completed within a certain period of time should be identified and a basis that the time can be reasonably met should be provided. In NEI 12-06, Section 3 provides the performance attributes, general criteria, and baseline assumptions to be used in developing the technical basis for the time constraints. Since the event is beyond-design-basis, the analysis used to provide the technical basis for time constraints for the mitigation strategies may use nominal initial values (without uncertainties) for plant parameters, and best-estimate physics data. All equipment used for consequence mitigation may be assumed to operate at nominal setpoints and capacities. In NEI 12-06, Section 3.2.1.2 describes the initial plant conditions for the at-power mode of operation; Section 3.2.1.3 describes the initial conditions; and Section 3.2.1.6 describes SFP initial conditions.

In NEI 12-06, Section 3.2.1.1 provides the acceptance criterion for the analyses serving as the technical basis for establishing the time constraints for the baseline coping capabilities to maintain SFP cooling. This criterion is keeping the fuel in the SFP covered with water.

Part of the licensee's FIP defines strategies capable of mitigating a simultaneous ELAP and loss of normal access to the UHS by providing the capability to maintain or restore SFP cooling on the TMI site. The NRC staff reviewed the licensee's FIP to determine whether the strategies outlined in the FIP, if implemented appropriately, would maintain or restore SFP cooling following the loss of all ac power and access to the UHS. As part of its review, the NRC staff reviewed simplified flow diagrams, engineering drawings, summaries of calculations for sizing the FLEX pumps, and summaries of calculations that addressed the heat up rates of the SFP following a loss of normal cooling functions, during an ELAP.

The NRC staff discussed the SFP cooling portion of the TMI mitigation strategy for an ELAP event with the licensee's staff and performed a walk-down of the licensee's SFP cooling strategies during an onsite audit. The walk-down focused on the areas where SFP cooling FLEX equipment will be stored, deployed, and operated, the connection points to the existing piping systems, and the hose runs from the deployed FLEX pumps. The licensee's basic FLEX strategy for maintaining SFP cooling is to monitor SFP level utilizing the SFP level instrumentation installed in accordance with NRC Order EA-12-051 and initiating SFP makeup as soon as resources are available to maintain SFP water level by compensating for steam losses after boiling.

3.3.1 Phase 1 For Phase 1 SFP cooling, the licensee credits the large inventory and heat capacity of the water in the SFP. Following the loss of SFP cooling, the SFP will slowly heat up and eventually begin to boil. As described in the FIP, using the most limiting non-outage, decay heat load, and SFP starting temperature, the SFP would begin to boil in approximately 40.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after the loss of

SFP cooling with the level reaching the top of the fuel in approximately 330.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. The licensee's initial coping strategy for SFP cooling is to allow evaporative cooling of the SFP while monitoring SFP level using instrumentation installed as required by NRC Order EA-12-051.

Although SFP makeup is commenced during Phase 2, as described in the FIP the licensee plans to deploy makeup hoses prior to the SFP reaching 212 °F in order to minimize personnel entering the area during a high heat and humidity conditions which may occur in later phases.

In addition, the licensee will establish a vent pathway through the Unit 2 SFP area. This steam release path is independent and isolated from areas where FLEX equipment is located or where operators may need to access to traverse. The licensee establishes this vent pant prior to pool boiling when the area is accessible.

3.3.2 Phase 2 In accordance with NEI 12-06, Table 3-1 and Appendix D, the licensee has developed two baseline SFP cooling strategies. The strategies use a new, permanently installed FLEX feedwater pump with newly installed FLEX piping connected to spent fuel pool cooling piping without having to access the refueling floor, and via hoses on the refueling floor. As described in a supplement to the FIP dated December 1, 2016 [Reference 39], the licensee performed a seismic spent fuel pool integrity evaluation for their mitigating strategies seismic hazard determined as a result of the March 12, 2012, requests for information under 10 CFR 50.54(f).

The evaluation was performed in accordance with the NRC approved method in EPRI 3002007148, "Seismic Evaluation Guidance: Spent Fuel Pool Integrity Evaluation." The evaluation compared the TMI site-specific seismic hazard and SFP design to the acceptance criteria set forth in EPRI 3002007148. The evaluation showed that the TMI SFP meets or exceeds the criteria in EPRI 3002007148 and therefore is seismically adequate and should retain adequate water inventory for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. As a result, the licensee does not need to provide spray cooling to the SFP.

The licensee's first method provides water, at a rate that matches boil-off to the SFP from the CSTs, condenser hotwell, or the condenser pit depending on the hazard and available water sources. FLEX pump FX-P-2A/B discharges into a newly installed FLEX header and then to the SFP cooling system through a series of installed piping, and portable hoses and mechanical connections. Section 3.7.3.1 of this SE discusses the mechanical connections and newly installed FLEX piping. This method would allow the licensee to provide makeup water to the SFP without having to access to the SFP area.

The licensee's second method provides water at a rate that matches boil off to the SFP using the portable FLEX pump (FX-P-3A or B) taking suction from the river and discharging to the SFP through a fire hose connected to an existing SFP standpipe, then from the standpipe into the pool via portable hose. If needed, the licensee will deploy the hoses in the SFP area prior to the SFP reaching 212 °F in order to minimize the need for personnel access to the SFP area after boiling begins.

3.3.3 Phase 3 For Phase 3 SFP cooling, the licensee plans to continue using Phase 2 strategies and equipment. Personnel will continue monitoring SFP level and adding inventory as necessary using the portable FLEX pump. Once NSRC equipment arrives on site, the licensee can use the equipment to replace depleted on-site water inventories.

3.3.4 "Staff Evaluations 3.3.4.1 Availability of Structures. Systems. and Components 3.3.4.1.1 Plant SSCs Condition 6 of NEI 12-06, Section 3.2.1.3, states that permanent plant equipment contained in structures with designs that are robust with respect to seismic events, floods, and high winds, and associated missiles, are available. In addition, Section 3.2.1.6 states that the initial SFP conditions are: 1) all boundaries of the SFP are intact, including the liner, gates, transfer canals, etc., 2) although sloshing may occur during a seismic event, the initial loss of SFP inventory does not preclude access to the refueling deck around the pool and 3) SFP cooling system is intact, including attached piping.

As described in the licensee's FIP, the licensee's Phase 1 SFP cooling strategy does not require existing SSCs other than the SFP. Per Section 5.3.2 of the FIP, a SFP steam vent path to atmosphere will be established through the Unit 2 fuel pool area. Prior to the SFP reaching 212° F personnel will establish a primary ventilation path by manually opening doors to vent the SFP area to atmosphere. The licensee referenced OP-TM-AOP-035, "Loss of Spent Fuel Cooling," Rev. 8, which initiates procedures to: use of FX-P-2A or B for SFP makeup; establish a monitored vent path of SFP area to prevent pressurizing the FHB; and if spent fuel pool reaches boiling, then SFP level is maintained in a stable ban. The NRC staff reviewed the selected vent path and determined that the vent path should provide adequate ventilation of steam in the auxiliary building SFP area. As described in Attachment SA of the FIP, the expected time for the licensee to establish an SFP area ventilation path is 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> after the ELAP. The licensee states that this action is required to prevent pressurizing the FHB when the SFP boils.

The licensee's Phase 2 and Phase 3 SFP cooling strategy involves the use of permanent and portable FLEX pumps with suction from the CSTs, hotwell, condenser basin, or UHS depending on the hazard and available water source. The Installed FLEX pumps discharge to a newly installed FLEX header via connection with a portable hose. From the FLEX header, water is sent via portable hose to newly installed FLEX RCS injection piping, which ties in to existing SFP cooling piping. As described in the FIP, and Section 5.1.1.1 of the UFSAR, the SFP cooling system is a seismic Class I system located in the fuel handling building and is protected from all applicable external hazards. The staff's evaluation of the robustness and availability of FLEX connections points for the installed FLEX pumps is discussed in Section 3.7.3.1 of this SE.

The portable FLEX pump discharges to an existing SFP standpipe via portable hoses. The SFP standpipe is located in the fuel handling building which provides protection from tornado winds and tornado-generated missiles. However, the FIP does not provide any description of the seismic qualification of the standpipe or its associated hose connections. In response to NRC staff questions, the licensee stated that the standpipe is not constructed to seismic specifications. In addition the licensee has chosen not to evaluate the standpipe to determine if it would remain functional following a seismic event. The licensee stated that the standpipe does not need to be seismically qualified or evaluated as such because the standpipe is only credited as a compensatory measure if the newly installed FLEX piping fails or otherwise

becomes unusable. However, in accordance with NEI 12-06, Table D-3, each licensee needs to have a strategy for supplying the SFP using existing SFP cooling or other piping, and a direct injection method using a hose over the side of the pool. As such, the NRC staff considers the use of the standpipe to supply water directly into the pool via hose as part of the licensee's primary baseline SFP coping capability in accordance with NEI 12-06. The licensee has not provided sufficient information for the staff to conclude that the standpipe would be available following a seismic event to support the licensee's baseline SFP cooling strategy. As a result, the staff cannot conclude that the licensee has the requisite capability to supply water to the SFP via direct injection with a hose over the side of the pool in accordance with NEI 12-06.

3.3.4.1.2 Plant Instrumentation In its FIP, the licensee stated that the instrumentation for SFP level will meet the requirements of Order EA-12-051. Furthermore, the licensee stated that these instruments will have initial local battery power with the capability to be powered from the FLEX DGs. The NRC staff's review of the SFP level instrumentation, including the primary and back-up channels, the display to monitor the SFP water level and environmental qualifications to operate reliably for an extended period are discussed in Section 4 of this SE.

3.3.4.2 Thermal-Hydraulic Analyses In accordance with NEI 12-06, the licensee performed an evaluation ECR-TM-13-00208, Rev. 6, "FLEX Design Specification," Appendix 5: "Core & Spent Fuel Pool Heat Loads and to Boil!TAF," to determine the SFP heat up times and boil off rates given the operating decay heat load of 2.5 megawatts-thermal . The evaluation determined that, with no operator action, following a loss of SFP cooling the pool would boil in approximately 40.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reach the top of the fuel in 330.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. In addition, because some RCS injection strategies may use part of the SFP inventory, the license calculated the time to boil and time to top of active fuel with a starting SFP level at elevation of 339.3 ft. At this reduced water level, the pool would boil in approximately 34. 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and reach the top of the fuel in 246.1 . Makeup water at a rate of 15.6 gpm is needed to maintain water level once bulk boiling commences.

3.3.4.3 FLEX Pumps and Water Supplies As described in its FIP, the licensee's SFP cooling strategy relies on a portable or installed FLEX pump to provide SFP makeup during Phase 2. The FLEX pumps are the same pumps as described in Section 3.2.3.5 of this evaluation and are sized to provide OTSG injection concurrent with SFP makeup.

3.3.4.4 Electrical Analyses The licensee's Phase 1 strategy is to monitor SFP level using installed instrumentation (the capability of this instrumentation is described in other areas of this SE). In its FIP, the licensee stated that SFP level instrumentation has a battery backup that will provide power to the instrumentation for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> when normal power is lost.

For Phase 2, the licensee's strategy includes supplying power to the pumps for SFP makeup (FX-P-2A or B) by the FLEX electrical system (FX-Y-1A or B) using a 480 Vac FLEX DG.

Additionally, the licensee has installed a receptacle and a selector switch in each SFP channel electronics/UPS enclosure to directly connect power to the SFP level instrumentation.

Therefore, during an ELAP and before the backup batteries are fully discharged, the licensee plans to restore power to the cabinets via the receptacle and selector switch using the FLEX DGs. The NRC staff reviewed the summary of TMI ECR-TM-13-00208, Rev. 6, which showed that one 480 Vac, 500 kW FLEX DG will have sufficient capacity and capability to supply power to the required SFP loads following a BDBEE. During Phase 3, the licensee noted that the 480 Vac NSRC-supplied CTG could be used to substitute the Phase 2 DGs, if necessary to support SFP cooling indefinitely. The capacity of NSRC-supplied 480 Vac CTG is of greater capacity than the licensee's Phase 2 FLEX DGs. Therefore, the NRC staff finds that the 480 Vac NSRC-supplied CTG has sufficient capacity and capability to supply power to the required SFP loads following a BDBEE.

Based on its review, the NRC staff finds that the licensee's strategy is acceptable to restore or maintain SFP cooling indefinitely during an ELAP as a result of a BDBEE.

3.4 Containment Function Strategies The industry guidance document, NEI 12-06, Table 3-2, provides some examples of acceptable approaches for demonstrating the baseline capability of the containment strategies to effectively maintain containment functions during all phases of an ELAP event. One such approach is for a licensee to perform an analysis demonstrating that containment pressure control is not challenged. Three Mile Island has a dry ambient pressure containment.

The licensee performed a containment evaluation, TM-FLEX-002, "Reactor Building Pressure Analysis for FLEX," Rev. 3, which was based on the boundary conditions described in Section 2 of NEI 12-06. The calculation analyzed the strategy of containment isolation and monitoring containment pressure using installed instrumentation and concluded that, even with the licensee taking no mitigating actions related to removing heat from containment, the containment parameters of pressure and temperature remain well below the respective UFSAR Section 5.2.1 design limits of 55 psig and 281 °F for more than 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />. From its review of the evaluation, the NRC staff noted that the required actions to maintain containment integrity and required instrumentation functions have been developed, and are summarized below.

3.4.1 Phase 1 The licensee's containment analysis shows that the structural integrity of the reactor containment building, due to increasing containment pressure, should not be challenged during the first 7 days of a BDBEE ELAP event. For the Power Operation plant mode, the analysis shows that with no operator actions, containment pressure will slowly increase to less than 20 psig over 7 days and the maximum temperature remains below the containment temperature limit of 281°F over the same 7 days. Since the calculated maximum pressure is below the containment design pressure of 55 psig (UFSAR Section 5.2.1 ), no mitigation actions are necessary to maintain or restore containment cooling.

The Phase 1 coping strategy for containment involves verifying containment isolation per procedure OP-TM-244-901, "Containment Isolation" and monitoring containment pressure using installed instrumentation. Containment pressure will be available via essential plant instrumentation.

3.4.2 Phase 2 The licensee's containment analysis shows that there are no mitigation actions necessary or planned, to maintain or restore containment cooling during Phase 2 for the Power Operation, Hot Standby, Reactor Critical and Hot Shutdown plant modes, in events where the once through steam generators are available to remove the heat generated in the core. Containment temperature and pressure are expected to remain below design limits for more than 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />; however, containment status will be monitored.

The Phase 2 coping strategy is to continue monitoring containment pressure using installed instrumentation. Phase 2 activities to repower instruments are adequate to facilitate continued containment monitoring.

3.4.3 Phase 3 No additional action is required to maintain containment pressure and temperature limits.

3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures. Systems. and Components Guidance document NEI 12-06 baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for maintaining containment functions during an ELAP.

3.4.4.1.1 Plant SSCs Containment In the UFSAR, Section 5.2 states that the reactor building is a seismic Category I reinforced concrete structure with cylindrical wall, a flat foundation mat, and a shallow dome roof. The foundation slab is reinforced with conventional mild steel reinforcing. The cylindrical wall is pre-stressed with a post-tensioning system in the vertical and horizontal directions. The dome roof is pre-stressed using a three way post-tensioning system. The inside surface of the reactor building is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions. Nominal line plate thickness is 3/8-inch for the cylinder and dome and 1/4-inch for the base.

The foundation mat is bearing on sound rock and is 9-ft thick with a 2-ft thick concrete slab above the bottom liner plate. The cylinder portion has an inside diameter of 130 ft., wall thickness of 3 ft 6 in., and a height of 157-ft from top of foundation slab to the spring line. The shallow dome roof has a large radius of 110-ft, a transition radius of 20 ft 6 in., and a thickness of 3 ft. The internal free volume is at least 2.00 x 106 ft 3 . It is designed for a positive internal pressure of 55 psig with a coincident temperature of 281°F at accident conditions, an additional positive internal pressure of 3 psig during a tornado, and a negative internal pressure of 2.5 psig during normal operation of the plant.

The reactor building has been designed to contain radioactive material which might be released from the core following a LOCA at a maximum leak rate of 0.1 percent by weight of contained atmosphere in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at the design pressure. The pre-stressed concrete shell ensures that the structure has an elastic response to all loads and that the structure strains are limited such that the integrity of the liner is not compromised. The liner has been anchored so as to ensure composite action with the concrete shell.

The staff noted that the containment structure is safety related and seismically qualified to all applicable seismic criteria. It acts as a closed vessel, and is therefore not subject to external flooding issues. The site limited extreme temperatures will not have a significant effect on the containment as the containment is a large mass which will act as a heat sink to disperse any heating or cooling effects. It is therefore protected from all applicable hazards and is expected to be available during an ELAP event.

3.4.4.1.2 Plant Instrumentation In NEI 12-06, Table 3-2, specifies that containment pressure is a key containment parameter which should be monitored by repowering the appropriate instruments. The licensee's FIP states that the FLEX strategy will provide electrical power to maintain the reactor building pressure prior to and after load stripping of the de and ac buses during Phase 1. The vital de power system has redundant subsystems. Each subsystem is made up of two 125-VDC batteries. Each battery has a design capacity to maintain voltage for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> with design de load including engineered safeguards actuation system. A de load management plan has been implemented to extend the battery service up to six hours. The FLEX diesel generator will be used to restore power to the vital ac and de power system within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Indication is available in the control room (CR) or locally at the instrument throughout the event.

Procedure OP-TM-919-907, "Alternate Methods for obtaining Critical Parameters," Rev. 0, provides direction to obtain essential instrument readings without vital ac power or vital instruments systems, as required by NEI 12-06.

3.4.4.2 Thermal-Hydraulic Analyses The NRC staff reviewed analysis TM-FLEX-002, "Reactor Building Pressure Analysis for FLEX,"

Rev. 3, which was based on the boundary conditions described in Section 2 of NEI 12-06. In this calculation, the licensee utilized the Modular Accident Analysis Program (MAAP) computer code, version 4.0.5, to perform numeric computations of the fundamental thermodynamic equations which predict the heat up and pressurization of the containment atmosphere under ELAP conditions. The only additions of heat and mass to the containment atmosphere under ELAP conditions are the heat loads from the reactor coolant system and main steam system (e.g., from the surfaces of hot equipment and the leakage of reactor coolant from the RCP seals). Specifically, Case 1 models the containment conditions for the Power Operation, Hot Standby, Reactor Critical and Hot Shutdown plant modes, in which the OTSGs are available to remove RCS heat. The RCS heat sink is maintained in Phase 1, which relies on installed plant equipment and on-site resources, by feeding the OTSGs using the TDEFW pump while steaming to the atmosphere via the ADVs.

After a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> hold, a cooldown rate of 30 °F/hr is assumed. The cooldown continues until RCS temperature is reduced from 550 °F to 400 °F. This FLEX mitigation strategy will initiate cooldown sooner and at a rate above 30 °F/hr. Therefore, the effect of this cooldown on Reactor Building (RB) pressure response is conservative. The licensee installed new N-9000 low leakage RCP seals during the FLEX implementation refueling outage. The new total RCS loss at normal operating pressure (2155 psig) is 11 gpm, which includes a controlled bleed off flow of 2.5 gpm per RCP and 1 gpm total unidentified leakage. A RCS leakage of 20 gpm at normal operating pressure is used in this analysis. Leakage is equally distributed over all 4 pumps in both the broken and unbroken loops. The assumption of 20 gpm leakage bounds the expected leakage. The leakage flow paths are assumed to be constant and the flow rate is reduced proportionally with RCS pressure reductions.

Using the input described above, the containment pressure was less than 20 psig at the end of the 168-hour period and the maximum temperature remains below the containment temperature limit of 281°F over the same period of time. The maximum values calculated are well below the UFSAR design parameters of 55 psig and 281 'F, so the licensee has adequately demonstrated that there is significant margin before a limit would be reached.

3.4.4.3 FLEX Pumps and Water Supplies No FLEX pump or water supplies are credited for containment integrity coping strategies.

3.4.4.4 Electrical Analyses In its FIP, the licensee noted that active means of RB cooling is not immediately required to maintain the RB below design limits. The licensee's analysis (FLEX-TM-002, "FLEX RB Pressure Analysis,") shows that the Reactor Building will remain below the design limits after 7 days. The analysis further showed that after 7 days, without any active means of cooling, temperature was less than 220°F and rising slowly. The licensee's evaluation (Technical Evaluation ECR 15-00341, "RB Environmental evaluation for FLEX Instruments,"), utilized the Arrhenius method to compare the ELAP temperature profile to the component qualification test results. The licensee's analysis showed that the required electrical components and instruments in the RB would be expected to reliably perform beyond 7 days without any actions take to reduce temperature or pressure in the RB. Therefore, the licensee's strategy for all Phases of the event is to monitor containment temperature and pressure using installed instruments and rely on resources from offsite (Phase 3) to provide cooling, if necessary.

Based on the NRC staff's evaluation in Section 3.2.3.6 of this SE, the TMI Class 1E station batteries (Phase 1) and FLEX DGs (Phase 2) will have adequate capacity and capability to supply power to the required containment instrumentation.

For Phase 3, the licensee expects that additional pumps and electrical generators would be supplied by an NSRC within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of event initiation that could be used to provide additional capability and redundancy for on-site equipment until such time that normal power to the site can be restored. This capability will include two 1 MW, 4160 Vac, 3-phase CTGs, one 480 Vac, 1100 kW (derated to 1000 kW) CTG, electrical cables, and a 4160 Vac Electrical Distribution System. The 480 Vac CTG provided from an NSRC could be used as a substitute for either 480 Vac FLEX DGs. Given that TMI will begin receiving support from offsite (both personnel and equipment from an NSRC) within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation, it is reasonable to expect that the licensee would be able to take measures to cool the RB (i.e., restore an EDG, connect a

4160 Vac CTG, or restore offsite power) to ensure that required equipment will continue to function, if necessary.

Based on its review, the NRC staff determined that the electrical equipment available onsite (e.g., 480 Vac FLEX DGs) supplemented with the equipment that will be supplied from an NSRC (e.g., 480 Vac and 4160 Vac CTGs), there is sufficient capacity and capability to supply the loads (e.g., cooling fans) to reduce containment temperature and pressure, if necessary, to ensure that the key components including required instruments remain functional.

3.4.5 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore containment functions following an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and adequately addresses the requirements of the order.

3.5 Characterization of External Hazards Sections 4 through 9 of NEI 12-06 provide the methodology to identify and characterize the applicable BDBEEs for each site. In addition, NEI 12-06 provides a process to identify potential complicating factors for the protection and deployment of equipment needed for mitigation of applicable site-specific external hazards leading to an ELAP and loss of normal access to the UHS.

Characterization of the applicable hazards for a specific site includes the identification of realistic timelines for the hazard, characterization of the functional threats due to the hazard, development of a strategy for responding to events with warning, and development of a strategy for responding to events without warning.

The licensee reviewed the plant site against NEI 12-06 and determined that FLEX equipment should be protected from the following hazards: seismic; external flooding; severe storms with high winds; snow, ice and extreme cold; and extreme high temperatures.

References to external hazards within the licensee's mitigating strategies and this SE are consistent with the guidance in NEl-12-06 and the related NRC endorsement of NEI 12-06 in JLD-ISG-2012-01. Guidance document NEI 12-06 directed licensees to proceed with evaluating external hazards based on currently available information. For most licensees, this meant that the OIP used the current design-basis information for hazard evaluation. Coincident with the issuance of Order EA-12-049, on March 12, 2012, the NRC staff issued a Request for Information pursuant to Title 1O of the Code of Federal Regulations Part 50, Section 50.54(f)

[Reference 19] (hereafter referred to as the 50.54(f) letter), which requested that licensees reevaluate the seismic and flooding hazards at their sites using updated hazard information and current regulatory guidance and methodologies. Due to the time needed to reevaluate the hazards, and for the NRC to review and approve them, the reevaluated hazards were generally not available until after the mitigation strategies had been developed. The NRC staff has developed a proposed rule, titled "Mitigation of Beyond-Design-Basis Events," hereafter called the MBDBE rule, which was published for comment in the Federal Register on November 13, 2015 [Reference 45]. The proposed MBDBE rule would make the intent of Orders EA-12-049 and EA-12-051 generically applicable to all present and future power reactor licensees, while

also requiring that licensees consider the reevaluated hazard information developed in response to the 50.54(f) letter.

The NRC staff requested Commission guidance related to the relationship between the reevaluated flooding hazards provided in response to the 50.54(f) letter and the requirements for Order EA-12-049 and the MBDBE rulemaking (see COMSECY-14-0037, Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards" [Reference 40]). The Commission provided guidance in an SRM to COMSECY-14-0037 [Reference 20]. The Commission approved the staff's recommendations that licensees would need to address the reevaluated flooding hazards within their mitigating strategies for BDBEEs, and that licensees may need to address some specific flooding scenarios that could significantly damage the power plant site by developing scenario-specific mitigating strategies, possibly including unconventional measures, to prevent fuel damage in reactor cores or SFPs. The NRC staff did not request that the Commission consider making a requirement for mitigating strategies capable of addressing the reevaluated flooding hazards be immediately imposed, and the Commission did not require immediate imposition. In a letter to licensees dated September 1, 2015 [Reference 34], the NRC staff informed the licensees that the implementation of mitigation strategies should continue as described in licensee's OIPs, and that the NRC SEs and inspections related to Order EA-12-049 will rely on the guidance provided in JLD-ISG-2012-01, Rev. 0, and the related industry guidance in NEI 12-06, Rev. 0. The hazard reevaluations may also identify issues to be entered into the licensee's corrective action program consistent with the OIPs submitted in accordance with Order EA-12-049.

As discussed above, licensees are reevaluating the site seismic and flood hazards as requested in the NRC's 50.54(f) letter. After the NRC staff approves the reevaluated hazards, licensees will use this information to perform flood and seismic mitigating strategies assessments (MSAs) per the guidance in NEI 12-06, Rev. 2, Appendices G and H [Reference 46]. The NRC staff endorsed Rev. 2 of NEI 12-06 in JLD-ISG-2012-01, Rev. 1[Reference47]. The licensee's MSAs will evaluate the mitigating strategies described in this SE using the revised seismic hazard information and, if necessary, make changes to the strategies or equipment. Licensees will submit the MSAs for NRC staff review.

The licensee developed its OIP for mitigation strategies by considering the guidance in NEI 12-06 and the site's design-basis hazards. Therefore, this SE makes a determination based on the licensee's OIP and FIP. The characterization of the applicable external hazards for the plant site is discussed below.

3.5.1 Seismic In its FIP, the licensee stated that the FLEX strategy has been developed for successful performance during and after the SSE. In its OIP, the licensee noted that the seismic hazard is defined as a SSE with peak ground acceleration of 0.12g in the horizontal plane and 0.08g in the vertical plane, as shown in UFSAR Figure 2.7-1.

As the licensee's seismic reevaluation activities are completed, the licensee is expected to assess the mitigation strategies to ensure they can be implemented under the reevaluated hazard conditions as will potentially be required by the proposed MBDBE rulemaking. The licensee has appropriately screened in this external hazard and identified the hazard levels to be evaluated.

3.5.2 Flooding In its FIP, the licensee stated that the FLEX strategy has been developed for successful performance during a river flood event where the river water level reaches 320 ft. elevation.

The flood is a caused by a Susquehanna River watershed precipitation event. For FLEX performance evaluations, to have some causal relationship with the flood, the ELAP &/loss of normal access to the UHS are assumed to occur when the river level exceeds the protection provided by the dike (elevation 304.5 ft.). The abnormal event operating procedure is assumed to be initiated a maximum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before the river water level exceeds the protection provided by the dike and the period of site inundation is assumed to be at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The FLEX design flood hazard for river flooding is more conservative in all aspects in comparison to the current design basis hazard or the reevaluated flood hazard. The FLEX strategy can be successfully implemented in the event of local intense precipitation. Guidance document NEI 12-06 characterizes in Table 6-1, the external flooding hazard in terms of warning time and persistence and having a warning time in days and persistence in months. The licensee stated based on a re-analysis performed in accordance with NUREG CR-7046, that for the probable maximum flood (PMF) the river level is expected to exceed the level of the dike for approximately 52 hours6.018519e-4 days <br />0.0144 hours <br />8.597884e-5 weeks <br />1.9786e-5 months <br /> and that the FLEX strategy assumes that the site is flooded for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Thus, TMI screens in for the external flood hazard.

As the licensee's flooding reevaluation activities are completed, the licensee is expected to assess the mitigation strategies to ensure they can be implemented under the reevaluated hazard conditions as will potentially be required by the proposed MDBDE rulemaking. The licensee has appropriately screened in this external hazard and identified the hazard levels to be evaluated.

3.5.3 High Winds In NEI 12-06, Section 7, provides the NRG-endorsed screening process for evaluation of high wind hazards. This screening process considers the hazard due to hurricanes and tornadoes.

The screening for high wind hazards associated with hurricanes should be accomplished by comparing the site location to NEI 12-06, Figure 7-1 (Figure 3-1 of U.S. NRG, "Technical Basis for Regulatory Guidance on Design Basis Hurricane Wind Speeds for Nuclear Power Plants,"

NUREG/CR-7005, December, 2009), if the resulting frequency of recurrence of hurricanes with wind speeds in excess of 130 mph exceeds 1E-6 per year, the site should address hazards due to extreme high winds associated with hurricanes using the current licensing basis for hurricanes.

The screening for high wind hazard associated with tornadoes should be accomplished by comparing the site location to NEI 12-06, Figure 7-2, from U.S. NRG, "Tornado Climatology of the Contiguous United States," NUREG/CR-4461, Rev. 2, February 2007; if the recommended tornado design wind speed for a 1E-6/year probability exceeds 130 mph, the site should address hazards due to extreme high winds associated with tornadoes using the current licensing basis for tornados or Regulatory Guide 1.76, Rev. 1.

In its FIP, the licensee stated that the FLEX strategy has been developed for successful performance in the event of a tornado as defined in Regulatory Guide 1. 76 Rev 1 for a plant in Region II. For FLEX performance evaluations, a tornado warning is assumed to occur 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />

prior to the tornado, ELAP and loss of normal access to the UHS. In its OIP, the licensee noted that NE112-06, Figure 7.1 locates TMI between the 130 MPH and 140 MPH curves. NEI 12-06, Figure 7.2, "Recommended Tornado Design Wind Speeds", locates TMI in region 2, 170 MPH.

The TMI design basis tornado generates 300 mph tangential wind velocity with gust of 130 percent. Therefore, the plant screens in for an assessment for high winds and tornados, including missiles produced by these events. Per NEI 12-06 Figure 7-1, the site is beyond the range of high winds from a hurricane; therefore, the licensee did not address hurricane impact in the FIP.

Therefore, high-wind hazards are applicable to the plant site. The licensee has appropriately screened in the high wind hazard and characterized the hazard in terms of wind velocities and wind-borne missiles.

3.5.4 Snow. Ice, and Extreme Cold As discussed in NEI 12-06, Section 8.2.1, all sites should consider the temperature ranges and weather conditions for their site in storing and deploying FLEX equipment consistent with normal design practices. All sites outside of Southern California, Arizona, the Gulf Coast and Florida are expected to address deployment for conditions of snow, ice, and extreme cold. All sites located north of the 35th Parallel should provide the capability to address extreme snowfall with snow removal equipment. Finally, all sites except for those within Level 1 and 2 of the maximum ice storm severity map contained in Figure 8-2 should address the impact of ice storms.

In its FIP, the licensee stated that the FLEX strategy has been developed for successful performance in the event of an extreme cold event where the average daily temperature is -

15°F and there is concurrent 24 inch snowfall. For FLEX performance evaluations, the extreme cold and snow conditions are predicted 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to the occurrence of the ELAP and loss of normal access to the UHS. In its OIP, the licensee noted that NEI 12-06 Figure 8.2 places TMI in a level 4 region for ice storm severity. A level 4 includes severe damage to power lines and/or existence of large amount of ice.

In summary, based on the available local data and Figures 8-1 and 8-2 of NEI 12-06, the plant site does experience significant amounts of snow, ice, and extreme cold temperatures; therefore, the hazard is screened in. The licensee has appropriately screened in the hazard and characterized the hazard in terms of expected temperatures.

3.5.5 Extreme Heat In its FIP, the licensee stated that the FLEX strategy has been developed for successful performance in an extreme heat event where the average daily temperature is 100°F. For FLEX performance evaluations, the extreme hot condition is predicted 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to the occurrence of the ELAP and loss of normal access to the UHS. The highest temperature recorded in the area of TMI is 107°F. The plant site screens in for an assessment for extreme high temperature hazard.

In summary, based on the available local data and the guidance in Section 9 of NEI 12-06, the plant site does experience extreme high temperatures. The licensee has appropriately screened in the high temperature hazard and characterized the hazard in terms of expected temperatures.

3.5.6 Conclusions Based on the evaluation above, the NRG staff concludes that the licensee has developed a characterization of external hazards that is consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order in regard to the characterization of external hazards.

3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards Below are additional details on how FLEX equipment is protected from each of the applicable external hazards.

3.6.1.1 Seismic Exelon is utilizing existing plant structures to house all FLEX installed, pre-staged, and portable equipment. The equipment will be stored in three plant structures/buildings; the Unit 1 turbine building, the Unit 1 control building which is a seismic Category 1 structure, and the FSF, the former Unit 2 ISPH, which was modified to provide portable equipment storage for BDBEE, and is tornado hardened and seismically qualified.

The existing Unit 1 turbine building structure was evaluated for the seismic hazard, design basis SSE as specified in NEI 12-06 Rev. 0, as well as the post-Fukushima reevaluated seismic hazard. In NEI 12-06 Rev. 0, establishes ASCE 7-10, "Minimum Design Loads for Buildings and Other Structures," as an acceptable design code and sets a minimum standard of "serviceability" for structures which provide reasonable protection from applicable external events. The ASCE 7-10 provides performance-based evaluation methodologies to demonstrate structural capability, which includes ASCE Standard 41-13 "Seismic Evaluation and Retrofit of Existing Buildings". The ASCE 41-13 provides acceptance criteria equivalent to ASCE 7-1 O called "Basic Performance Objective Equivalent to New Building Standards". The method of using ASCE 41-13 to demonstrate the serviceability of the turbine building structure after a BDBEE seismic event is an alternate approach to NEI 12-06 Rev. 0. With the modifications completed, the turbine building meets the serviceability requirements equivalent to ASCE 7-10 using ASCE 41-13 for the seismic BDBEE.

3.6.1.2 Flooding The permanently installed FLEX equipment used to implement the FLEX strategies is all located in plant buildings above the 320 ft. elevation. This includes pumps and DGs used for OTSG and RCS makeup and 480 Vac power. The FSF provides protected storage for portable FLEX equipment. The structure (including access) is designed to withstand the forces of the BDBEE tornado or earthquake, however it is not protected from the flood event. Per Section 4.6.1 of the FIP, additional FLEX equipment is moved from the FSF to a location across the river above the

maximum flood level in advance of an external flood to ensure all required equipment remains available when needed. Section 4.6 of the FIP describes the actions that will be taken prior to the flood impacting the site. At least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is available to accomplish these actions.

3.6.1.3 High Winds The permanently installed and pre-staged equipment used to implement the FLEX strategies is all located in plant buildings that are protected from high winds and tornado missiles. This includes the pumps and DGs used for OTSG and RCS makeup. The FSF provides protected storage for portable FLEX equipment. The structure, including access is designed to withstand the forces of the BDBEE tornado.

3.6.1.4 Snow. Ice. Extreme Cold and Extreme Heat FLEX equipment is either permanently installed or pre-staged in the turbine building and the control building, or stored in the FSF and protected from extreme cold or hot temperatures.

Propane heaters are available to heat the hotwell in a cold weather event when the OTSGs are not available. Propane heaters are also provided to heat the ISPH to maintain the ambient temperature above 40 °F. The FSF also has several 5.5 Kw generators to power the block heaters for the FX-P-3A/B pumps which are stored in the FSF. There are also multiple fans staged in the control building, turbine building, and intermediate building to provide cooling during hot weather during a loss of normal HVAC.

3.6.2 Reliability of FLEX Equipment Section 3.2.2 of NEI 12-06 states, in part, that in order to assure reliability and availability of the FLEX equipment, the site should have sufficient equipment to address all functions at all units on-site, plus one additional spare (i.e., an N+ 1 capability, where "N" is the number of units on site). It is also acceptable to have a single resource that is sized to support the required functions for multiple units at a site (e.g., a single pump capable of all water supply functions for a dual unit site). In this case, the N+1 could simply involve a second pump of equivalent capability. In addition, it is also acceptable to have multiple strategies to accomplish a function, in which case the equipment associated with each strategy does not require an additional spare.

All of the pumps and DGs that TMI will use to implement the strategies are 100 percent capacity so that only one is required to meet flow and power requirements for any strategy. Two pumps and DGs are available either pre-staged, installed or stored in protected locations for each function; e.g., RCS makeup, OTSG makeup, SFP makeup, electrical supply, fuel oil transfer operations, or for refilling various water supply tanks.

In its FIP, the licensee provided a list of hoses/cables and spares required to implement the strategies. Spare electrical cables are available in the FSF for cables used for connection of the FLEX DGs that are pre-staged in the turbine building to electrical panels in the control building.

A list of hoses for all applications is also listed in the FIP. Spare hoses are identified for each application where redundancy is needed to meet N+ 1 requirements.

Based on the number of portable FLEX pumps, FLEX DGs, and support equipment identified in the FIP and during the audit review, the NRC staff finds that, if implemented appropriately, the

licensee's FLEX strategies include a sufficient number of portable FLEX pumps, FLEX DGs, and equipment for RCS makeup and boration, SFP makeup, and maintaining containment consistent with the N+ 1 recommendation in Section 3.2.2 of NEI 12-06.

3.6.3 Conclusions Based on this evaluation, the NRG staff concludes that the licensee has developed guidance that, if implemented appropriately, should protect the FLEX equipment during a BDBEE consistent with NEI 12-06 guidance as endorsed by JLD-ISG-2012-01 and should adequately address the requirements of the order.

3.7 Planned Deployment of FLEX Equipment The TMI FLEX strategies utilize permanently installed or pre-staged equipment to implement the strategies. Cable and hose routing in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the event is accomplished inside protected structures, for example cables routed from the DGs staged in the turbine building to electrical panels in the control building. As a backup, TMI will use pumps stored in the FSF that can be deployed to a ramp on the river with hoses routed to various plant components required to implement the strategies.

3.7.1 Means of Deployment A vehicle stored in the FSF (a F750 Ford truck with plow for debris removal) will be used to deploy FLEX equipment that is also stored in the FSF. Other FLEX equipment is either permanently installed or pre-staged in its operational location. The FSF protects the equipment within from BDBEE hazards except for flood. In case of flooding, the truck and essential equipment is moved to a higher ground in advance (across the river at the training facility). The availability of power does not prevent the timely deployment of equipment.

3.7.2 Deployment Strategies The only equipment required to be deployed are the backup water supply pumps, FX-P-3A and 3B, either of which will be moved to a ramp location on the river across from the north office building. Hoses will be routed to various locations inside plant protected areas to supply all FLEX strategy requirements to maintain CST level, OTSG water level, SFP water level, or any concurrent requirements for those functions.

In its FIP, the licensee stated that they had performed an assessment for the potential for earthquake induced liquefaction and associated ground failure at TMI. For this analysis, several scenarios that varied ground shaking and ground water levels were examined to assess the sensitivity of liquefaction under different soil conditions. The primary consequence of liquefaction at the site is expected to be ground settlement. Higher river water levels increase the magnitude of settlement. For a licensing basis flood river level, the magnitude of ground settlement is expected to be 1-in or less. With settlement of this magnitude, the FLEX equipment and the deployment of the temporary FLEX equipment should not be adversely affected during an earthquake.

The TMI flood protection strategy does not rely on active means of water removal, however, key sump pumps can provide defense in depth during external flooding events. The ability to operate key sump pumps is included in the design of the FLEX power system and flood event mitigation procedures.

Also in the FIP, the licensee stated that the failure of the York Haven Dam in a seismic event, located downstream of TMI, is assumed in development of the TMI FLEX strategies. Such a failure could cause river water level to be as low 272 ft. elevation. In this case, submersible pumps, FX-P-6A or FX-P-68, will be used in the Unit 1 ISPH to provide an indefinite condensate supply.

3.7.3 Connection Points 3.7.3.1 Mechanical Connection Points Section 3.2.2.17 of NEI 12-06 states that the portable pumps for core and SFP functions are expected to have primary and alternate connection or delivery points. At a minimum, the primary connection point should be an installed connection suitable for both the on-site and off-site equipment but the secondary connection point can require reconfiguration if the licensee can show that adequate time and resources are available to support the reconfiguration. In addition, NEI 12-06, Table D-1 states that primary and alternate injection points should establish capability to inject through separate divisions/trains (i.e., should not have both connections in one division/train).

As described in Section 2.2.1 of its FIP, the licensee has taken an alternate approach to using portable pumps in accordance with NEI 12-06. The licensee has installed permanent, redundant pumps for use in maintaining or restoring core and SFP cooling during an ELAP. In addition, the licensee has installed permanent hard piping in order to facilitate RCS makeup within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. As a result, the licensee's RCS makeup strategy would not require any mechanical hose connections, with the core and SFP cooling strategies requiring minimal connections. However, each respective strategy's primary and alternate methods for injection share a significant amount of common FLEX piping. As a result, the NRC staff does not consider the newly installed FLEX piping as having sufficient diversity such that the primary and alternate flow path for each respective strategy constitutes separate "trains" in accordance with NEI 12-06. In response to the staff's concerns, the licensee developed contingency strategies described in Sections 4.11.2, 4.11.3 and 4.11.4 of the FIP in order to provide diverse injection flowpaths for each strategy.

Newly Installed FLEX Piping In Section 2.3.1.5 of its FIP, the licensee states that piping and pipe supports relied upon to meet the FLEX system performance requirements in a seismic event are classified Seismic Class I (SI) and designed in accordance with UFSAR Section 5.4.4.1 or are classified Seismic Class I-FLEX (Sit), a licensee-specific designation, and designed in accordance with ECR 13-00208, "FLEX Design Specification," Appendix 6. The installed FLEX piping flowpaths share significant portions of common piping and rely on the use of the FLEX pump FX-P-3A/B to provide flowpath diversity, with one exception, as stipulated in NEI 12-06 and discussed in Section 3.2.3.5 of this SE.

The licensee stated that ECR 13-00208, Appendix 6 requirements would ensure that the functional capability of an SSC to perform its FLEX application is maintained after an SSE. In ECR 13-00208, Appendix 6 states that the Expedited Seismic Evaluation Process (ESEP) evaluations were considered to be appropriate to apply as the standard for determining adequate FLEX piping integrity after an SSE. The specification noted that NEI 12-06, Rev. 1, Section 3.2.1.12 did not stipulate qualification to an extreme environment for SSCs, but that "some basis" be provided regarding the functional capability of the components. The approach in ECR 13-00208 to apply the ESEP evaluations as the standard for determining adequate FLEX piping integrity after a seismic event is the same approach detailed in NEI 12-06, Rev. 2, Appendix H (pg. 183). Based on the above considerations, TMI has provided an adequate justification for the determination that the installed FLEX piping is robust in accordance with NEI 12-06 and will remain intact following an SSE.

FLEX Diesel Generator Fuel Supply The connection used to provide fuel oil from the existing fuel oil tank (DF-T-1) using existing fuel oil pumps (DF-P-1C or DF-P-1 D) to FX-T-3 (or to other FLEX fuel oil tanks) is a low-leakage style quick disconnect isolated by a newly installed FLEX fuel oil system valve. The connection is designed and installed to meet Seismic Class I requirements. The connection is located in the Seismic Class I, tornado protected "B" EOG room. There are two access paths to this connection point with at least one being through only robust structures in accordance with NEI 12-06. For external flood events or if the fuel delivery vehicle cannot access the site and DF-T-1 is nearly depleted, the licensee uses a low-leakage style quick disconnect to refill FX-T-2 using a fuel hose from a portable NSRC fuel container. The connection is located inside the turbine building above the design-basis flood elevation.

OTSG Feedwater The licensee's primary strategy provides cooling water to one or both OTSGs via EFW nozzles.

The licensee uses a portable hose to connect the discharge of the installed FLEX pumps, FX-P-2A/B to an newly installed FLEX header which is directly connected to the EFW system with FLEX piping. Both connections, as well as the FLEX headers and the associated valves and piping are designed to meet Seismic Class Sit requirements, as discussed in Section 2.3.1.5 of the FIP. The connections are located inside of the turbine building. The licensee has evaluated the turbine building and shown that the building will maintain its structural integrity following a seismic event, as well as provide protection from tornado missiles. In addition, the licensee plans to establish this connection prior to flood waters reaching the site. There are two access paths to these connection points with at least one being through only robust structures in accordance with NEI 12-06.

Because of the existence of non-diverse flowpaths associated with the installed FLEX piping, the licensee established a contingency plan to provide cooling water to one or both OTSGs through the main feedwater nozzles via a portable pump and hose connected to existing main feed water piping. (The NRC staff could not confirm the viability of the contingency plan for the case of a downstream dam failure - see Section 3.2.3.5 of this SE.) The connection is designed to meet Seismic Class Sit requirements, as discussed in Section 2.3.1.5 of the FIP.

The connection is located above the design-basis flood elevation on the main feedwater header inside the turbine building. There are two access paths to this connection point with at least one being through only robust structures in accordance with NEI 12-06.

Spent Fuel Pool Makeup The licensee's strategy for providing cooling water to the SFP through existing SFP system piping uses a portable hose to connect the discharge of the installed FLEX pumps, FX-2A/B to a newly installed FLEX header as described above for OTSG makeup. However, for SFP cooling, the licensee connects the header via hose and an additional connection on the FLEX header to newly installed FLEX piping that runs through the fuel handling building and ties in directly to existing SFP piping. The connection, FLEX piping, and associated valves are designed to meet Seismic Class Sit requirements, as discussed in Section 2.3.1.5 of the FIP. The connection is located above the design-basis flood elevation on the main feedwater header inside the turbine building. There are two access paths to this connection point with at least one being through only robust structures in accordance with NEI 12-06.

In order to provide water to the SFP via direct injection in accordance with NEI 12-06, the licensee uses a portable FLEX pump, FX-P-3A/B, portable hose, and an existing standpipe.

The discharge of the portable pump is connect to the bottom of the standpipe via portable hose.

Another portable hose is connected to the top of the standpipe and run directly into the SFP.

The standpipe and associated connections are discussed in Section 3.3.4.1.1 of this SE.

RCS Makeup The licensee has the capability to use high-pressure hose to bypass the installed RCS FLEX piping and connect each FLEX RCS makeup pump to either or both of the existing "A/C" and "BID" high-pressure injection (HPI) trains. The connections are designed to meet Seismic Class Sit requirements, as discussed in Section 2.3.1.5 of the FIP. The connections are located on each respective HPI line inside of the Seismic Category I fuel handling building and are protected from all applicable external hazards.

Long-term condensate supply connection Condensate storage tank CO-T-1 Bis the primary long-term condensate source. An adaptor is connected to a flange on CO-T-1 B to allow the licensee to connect a portable hose with a STORZ connector. This connection is used to add fire service water or river water from FX-P-3 or FX-P-6 to CO-T-18. This connection is located at the top of CO-T-1 Bin the yard outside plant structures. The connection on CO-T-1 Bis designed to meet Seismic Class I requirements and may be used after floodwaters recede from the site. If CO-T-1 B is not available due to tornado damage, the alternate long-term condensate supply path is through EX-T-1 to the hotwell. An inspection port on EX-T-1 can be removed to allow a 3-inch hose, for adding makeup water, to be inserted into the tank and secured. This connection is located inside the turbine building above the design-basis flood elevation and is protected from tornado winds and tornado generated missiles.

3.7.3.2 Electrical Connection Points Electrical connection points are only applicable for Phases 2 and 3 of the licensee's mitigation strategies for a BDBEE.

During Phase 2, the licensee's strategy is to supply power to equipment required to maintain or restore core cooling, containment, and SFP cooling using a combination of permanently installed and portable components. The strategy is to use the pre-staged "N" 480 Vac FLEX DG located inside the Turbine Building. The "N+1" FLEX DG, if required, is located adjacent to the "N" FLEX DG. The cables needed to supply power to required Phase 2 components is pre-installed and contained within conduit. The licensee would maintain selected breakers in the open position with the ES electrical system in its normal lineup. This provides qualified isolation between safety related and non-safety related circuits. In an ELAP event, the feeder breakers to the 1P and 1S 480V Switchgear would be opened prior to use of a FLEX DG to ensure that the ES DG and FLEX DG are not inadvertently paralleled. Procedures OP-TM-919-901, "Repower 1P and 1S 480V SWGR From FX-Y-1 A or FX-Y-1 B," OP-TM-919-902, "Repower 1C ESV From FX-Y-1A or FX-Y-1B," OP-TM-919-903, "Energize 1A ESV, 1A Radwaste, and 1B Radwaste MCC's From FX-Y-1A or FX-Y-1B," and OP-TM- 919-904, "Energize 1A ESF Vent MCC to Supply BWST Immersion Heaters," provide guidance for energizing equipment using a 480 Vac FLEX DG.

The licensee developed contingencies to address failures of pre-installed cables. The equipment used for this contingency is stored and all required actions are within a robust structure that is protected against earthquake or tornado hazards. If the pathway from FX-PNL-FX-XFR (Switch that selects FLEX DG output) to the ES bus where it is routed through the Turbine Building is damaged, then an alternate temporary power scheme will provide power from the DG output (EE-PNL-FX-3A for FX-Y-1 A or EE-PNL-FX-3B for FX-Y-1 B) to the ES 480V power train and to the 480V FLEX MCC in the Turbine Building. Eight (8), 300 ft. portable (two conductors for each phase and the neutral) cables will be routed from the FLEX DG platform at the 322 ft. elevation to 1A ES MCC Unit 15A (Control Building 322 ft. elevation) to provide power to the FLEX Equipment on the ES switchgear and MCCs. A second power jumper (one conductor per phase and a neutral) will be routed on the FLEX platform to supply power to the FLEX 480 Vac MCC. The licensee evaluated the transmission capacity of the temporary cables and determined that an operator will have to raise the voltage regulator setpoint to 103% to ensure that equipment receives adequate voltage. This contingency would be implemented in emergency procedure OP-TM-919-901, "Repower 1P and 1S 480V Swgr from FX-Y-1 A or FX-Y-1 B". The licensee verified proper phase rotation as part of its post-installation testing.

For Phase 3 the licensee can use the NSRC 480 Vac CTG as a backup to the redundant FLEX DGs. The CTG would be staged south of the Turbine Building (primary) or north end of the Machine Shop (alternate). The NSRC CTG can be connected at either EE-PNL-FX-3A or EE-PNL-FX-3B. The connections are above the FLEX design flood elevation. There are at least two access paths to this connection point: (1) through the Turbine Building 305 ft. elevation and up the stairs or (2) through the Turbine Building 322 ft. elevation. The licensee noted that color-coded cables and connectors consistent with the industry standard for FLEX will be used. High level guidance for connection of the 480 Vac NSRC-supplied CTG is provided in OP-TM-919-955, "Connect SAFER Equipment." This procedure includes a step to verify proper phase rotation using an installed phase rotation relay.

In its FIP, the licensee noted that it developed its FLEX strategy for successful performance during a river flood event where the river water level reaches 320-ft. elevation. According to the licensee, the FLEX design flood hazard for river flooding is more conservative in all aspects in comparison to the current design-basis hazard or the reevaluated flood hazard. During a FLEX

design flood hazard, certain power supply cables to FLEX equipment (pumps) will become submerged for approximately 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The cables subjected to submergence (below the 320 ft. elevation) are Firewall 111-J that is jacketed with Chlorosulfonated Polyethylene that is known to have good water resistance. In its FIP, the licensee stated that there are no splices or connections in the FLEX power distribution system below the 321 ft. elevation. Based on this information, the NRC staff finds that submergence of the conduits and cables for the FLEX design flood hazard (up to 320 ft. elevation) period of approximately 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> will not adversely affect the function.

3.7.4 Accessibility and Lighting In its FIP, the licensee stated that all field operators carry a flashlight while on duty. Battery backed emergency lighting is available in most plant areas where action is required during the initial hours. Installed ac emergency lighting will be energized by the FLEX DG. Portable lighting is staged for emergency use. The FLEX DG (FX-Y-1 A or B) has the capacity to handle all FLEX power requirements including emergency lighting.

3.7.5 Access to Protected and Vital Areas In its FIP, the licensee stated that the site security staff will respond to an external event by attempting to communicate with the operations shift manager. If communications systems are not functioning, the security staff will send a representative to the control room. The security staff will assist operations by (1) ensuring access for operators or equipment and (2) opening doors for ventilation.

During the audit process, the licensee provided information describing that access to protected areas should not be hindered. The licensee has contingencies in place to provide access to areas required for the ELAP response if the normal access control systems are without power.

3.7.6 Fueling of FLEX Equipment In its FIP, the licensee stated that after an ELAP, fuel will be transferred from the engineered ES diesel fuel oil tanks (DFO) to FLEX fuel oil tanks FX-T-2, FX-T-3 or FX-T-4 using one of two installed plant fuel oil transfer pumps. One of these pumps is powered from station ES ac power and one is powered from the station de system. Each of these positive displacement pumps has a nominal capacity of 1O gpm.

After the event occurs, operators connect hoses to provide a flow path from two installed ES DFO pumps. The fuel supply from ES DFO tank DF-T-1 to FLEX fuel oil FX-T-3 can be established within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the start of the FLEX DG. The full load fuel consumption rate of FLEX DGs FX-Y-1A or FX-Y-1B is 35 gallons per hour (gph). The standby minimum inventory of 105 gallons in FX-T-3 (greater than 7/8 full) will provide at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> before resupply is required.

In preparation for a flood, FX-T-2 is filled from the ES DFO tank using ES DFO pumps. More than 5,000 gallons will be transferred into FX-T-2 and this action will be completed before the river level exceeds the height of the dike. If operation of FX-Y-1A or Bis required, FX-T-3 level will be maintained by gravity drain and by using FLEX fuel transfer pumps FX-P-5A or 5B.

These pumps have a nominal capacity of 4.5 gpm.

In its FIP, the licensee also stated that fuel supply for portable FLEX equipment is provided as follows:

FX-T-4 (200 gallon fuel tanks in the bed of FLEX truck) is used to distribute fuel to the portable equipment. FX-T-4 can be filled from the ES DFO tanks using ES DFO pumps and hoses to the truck outside the service building. The FX-T-4 fuel oil transfer pump, FX-P-8, has a capacity of at least 15 gpm. The largest portable tank (FX-Y-3 is 200 gallons) can be refilled in less than 15 minutes. This fuel distribution method can be established in time to support all required FLEX functions:

• Portable diesel-driven pumps, FX-P-3A and FX-P-3B, each have a 175 gallon fuel tank and a full load consumption rate of approximately 7.6 gph. One of these pumps is required no sooner than 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> into the event and the initial fuel supply will last 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />.

• Portable DG, FX-Y-3, has a 200 gallon fuel tank and a full load consumption rate of approximately 25 gph. This DG is required no sooner than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> into the event and the initial fuel supply will last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

• Portable diesel-driven pumps, FX-P-4, has an approximately 1 gallon fuel tank and a full load consumption rate of approximately 0.4 gph. This pump is required no sooner than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> into the event. The tank will be maintained empty and filled prior to use.

• Portable DG, FX-Y-4, has a 3.4 gallon fuel tank and a full load consumption rate of approximately 0.6 gph. This DG is required no sooner than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into the event. The diesel fuel tank will be maintained empty and filled from FX-T-4 when required.

In Enclosure 1 to the compliance letter in response to audit question AQ-40, the licensee stated that programmatic controls have been established to maintain the quality of stored fuel. The foundation of the program is the existing controls for the safety related fuel source (DF-T-1) and all fuel used in the FLEX equipment will be obtained from this source. Each storage location has been evaluated to ensure that quality is maintained through one of four approaches: (1) The tank is maintained empty and filled from DF-T-1 when needed (e.g. FX-T-2 and SAFER equipment), (2) The fuel in the tank is consumed in one year or less through required equipment testing (e.g. FX-T-3 and FX-T-4), (3) The fuel stored in the tank is sampled and replaced based on sample results or (4) The fuel stored in the tank is replaced within one year or within period justified through use of fuel stabilizers.

3.7.7 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow deploying the FLEX equipment following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.8 Considerations in Using Offsite Resources 3.8.1 TMI SAFER Plan The industry has collectively established the needed off-site capabilities to support FLEX Phase 3 equipment needs via the SAFER Team. The SAFER team consists of the Pooled Equipment Inventory Company (PEICo) and AREVA Inc. and provides FLEX Phase 3 management and deployment plans through contractual agreements with every commercial nuclear operating company in the United States.

There are two NSRCs, located near Memphis, Tennessee and Phoenix, Arizona, established to support nuclear power plants in the event of a BDBEE. Each NSRC holds five sets of equipment, four of which will be able to be fully deployed to the plant when requested. The fifth set allows removal of equipment from availability to conduct maintenance cycles. In addition, the plant's FLEX equipment hose and cable end fittings are standardized with the equipment supplied from the NSRC.

By letter dated September 26, 2014 [Reference 21], the NRC staff issued its assessment of the NSRCs established in response to Order EA-12-049. In its assessment, the staff concluded that SAFER has procured equipment, implemented appropriate processes to maintain the equipment, and developed plans to deliver the equipment needed to support site responses to BDBEEs, consistent with NEI 12-06 guidance; therefore, the staff concluded in its assessment that licensees can reference the SAFER program and implement their SAFER Response Plans to meet the Phase 3 requirements of Order EA-12-049.

The NRC staff noted that the licensee's SAFER Response Plan contains (1) SAFER control center procedures, (2) NSRC procedures, (3) logistics and transportation procedures, (4) staging area procedures, which include travel routes between staging areas to the site, (5) guidance for site interface procedure development, and (6) a listing of site-specific equipment (generic and non-generic) to be deployed for FLEX Phase 3.

3.8.2 Staging Areas In general, up to four staging areas for NSRC supplied Phase 3 equipment are identified in the SAFER Plans for each reactor site. These are a Primary (Area C) and Alternate (Area D), if available, which are offsite areas (within about 25 miles of the plant) utilized for receipt of ground transported or airlifted equipment from the NSRCs. From Staging Areas C and/or D, the SAFER team will transport the Phase 3 equipment to the on-site Staging Area B for interim staging prior to it being transported to the final location in the plant (Staging Area A) for use in Phase 3. Staging Area C is the Lancaster, PA airport. This is no alternate off-site staging area D. Staging Area Bis the TMI south parking lot.

In its FIP, the licensee stated that staging areas A are as follows: water treatment equipment will be delivered and staged outside of protected area (PA) Gate 12. A mobile boration skid will be also be delivered and staged outside of PA gate 12. In a flooded condition or if TMI is otherwise not accessible, a fuel container with 500 gallons of diesel fuel will be transported by air and placed on the south east area of the control building roof.

Use of helicopters to transport equipment from Staging Area C to Staging Area B is recognized as a potential need within the TMI SAFER Plan and is provided for.

3.8.3 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow utilization of offsite resources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling Following a BDBEE and subsequent ELAP event at TMI, ventilation providing cooling to occupied areas and areas containing FLEX strategy equipment will be lost. Per the guidance given in NEI 12-06, FLEX strategies must be capable of execution under the adverse conditions expected following a BDBEE resulting in an ELAP/LUHS. The primary concern with regard to ventilation is the heat buildup which occurs with the loss of forced ventilation in areas that continue to have heat loads. The licensee performed a technical evaluation to quantify the maximum steady state temperatures expected in specific areas related to FLEX implementation to ensure the environmental conditions remain acceptable for personnel habitability and within equipment design limits.

The key areas identified for all phases of execution of the FLEX strategy activities are the CR (Control Building 355 ft. elevation), the Control Building elevations 322 ft. and 338 ft., Turbine Building - FLEX platform on the 322 ft. elevation, the Intermediate Building, and the RB. The results of the licensee's room heat-up calculations concluded that temperatures remain within acceptable limits based on conservative input heat load assumptions for all rooms/areas using passive and active means of portable ventilation.

The staff reviewed the licensee's technical evaluation, ECR 13-00310, "FLEX Ventilation Plan,"

Rev. 0, which analyzes the habitability of various plant areas needed for FLEX and addressed any compensatory measures required to maintain the implementing strategies indefinitely.

Control Room Ventilation The licensee's strategy to maintain the control room habitability and equipment functionality is to provide temporary ventilation (fans and flexible ducts), to control the ambient temperature. The licensee's approach is to use two fans to establish a "once through" air flow path. The minimum required air flow based on the cooling required is 6068 cubic feet per minute (cfm) to maintain the CR temperature at or below 110°F, and the licensee plans to use 9500 cfm fans. Opening doors and establishing temporary ventilation within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after battery charging has been initiated will maintain temperature control. The procedures to establish this temporary ventilation are listed in technical evaluation ECR 13-00310, Rev. 0.

Based on the CR temperature remaining below 120°F (the temperature limit, as identified in NUMARC-87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1, for equipment to be able to survive indefinitely), the NRG staff finds that the electrical and electronic equipment and components in the Control Room should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Control Building (elevations 322 ft and 338 ft)

The licensee's strategy to maintain the inverter, battery charger, and battery room habitability and equipment functionality is to provide temporary ventilation (fans and flexible ducts), to control the ambient temperature. The licensee's strategy uses a "once through" air flow path.

The NRG staff reviewed technical evaluation ECR 13-00310, Rev. 0, for the 322 ft. and 338 ft.

elevations of the Control Building (inverter, battery, and battery rooms). The minimum required air flow in these rooms is 9472 cfm to maintain either train of the inverter, battery charger, and battery rooms below 120°F during a BDBEE while both batteries are being charged (the conservative case).

The licensee plans to install temporary ventilation with a rated capacity of 13300 cfm for each pair of rooms. Opening doors and establishing temporary ventilation within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after battery charging has been initiated will maintain temperature control. In a condition with an external ambient temperature of 100°F, this flow will maintain the A and B inverter, battery charger, and battery rooms below 110.7 °F with both batteries being charged. Battery charging is a temporary condition. The heat loads will be lower once charging is complete. In external events, other than extreme heat, the inverter and battery room ambient temperature will be maintained below 110°F. The procedures to establish this temporary ventilation are listed in technical evaluation ECR 13-00310, Rev. 0. Although the licensee plans to open doors and provide portable ventilation in the Control Building, periodic monitoring of electrolyte level may be necessary to protect the battery since the battery may gas more at higher temperatures.

Based on the Control Building temperature remaining below 120°F (the temperature limit, as identified in NUMARC-87-00, Rev. 1, for equipment to be able to survive indefinitely), and below the maximum temperature limit (122°F) of the batteries, as specified by the battery manufacturer (C&D Technologies), the NRG staff finds that the electrical and electronic equipment and components in the Control Building (elevations 322' and 338') should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Turbine Building (FLEX platform on 322 ft elevation The licensee's strategy to maintain habitability and functionality of the FLEX DG area and equipment is to provide temporary ventilation (fans and flexible ducts), to control the ambient temperature. The licensee's strategy uses a "once through" air flow path. The licensee's evaluation showed that 2 fans with a combined rated capacity of 32500 cfm is sufficient to maintain the FLEX platform area on the 322 ft. elevation of the Turbine Building below 120°F during a BDBEE.

The licensee plans to install temporary ventilation with a rated capacity of 39000 cfm for this area. Opening doors and establishing temporary ventilation within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after battery charging has been initiated will maintain temperature control. The procedures to establish this temporary ventilation are listed in technical evaluation ECR 13-00310, Rev. 0.

Based on the Turbine Building (FLEX platform on 322' elevation) temperature remaining below 120°F (the temperature limit, as identified in NUMARC-87-00, Rev. 1, for equipment to be able to survive indefinitely), the NRG staff finds that the electrical and electronic equipment and components located near the FLEX platform on the 322 ft. elevation of the Turbine Building should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Intermediate Building The licensee's strategy to maintain habitability and equipment functionality in the Intermediate Building, including the EFW and ADV area, is to initially establish passive ventilation and eventually provide temporary ventilation (fans and flexible ducts), to control the ambient temperature. The licensee's strategy uses a "once through" air flow path. The NRG staff reviewed both Technical Position Paper 2494447-09, "TDEFP Room Post ELAP Evaluation,"

Rev. O, and Technical Evaluation ECR 13-00310, Rev. 0, which showed that the ambient conditions in the EFW and ADV area will remain within acceptable limits without active means, and will be improved by the use of portable fans.

Due to large openings above the area where the FLEX equipment and operator actions are located, the licensee determined that passive natural circulation can effectively minimize the rise in ambient temperature. After the FLEX power system is in operation (Phase 2), the passive ventilation can be supplemented with fans. The turbine and steam supply use local mechanical and pneumatic controls. No active support systems are required. The pump and turbine are designed to function at ambient temperatures below 150°F. Based on its review of the licensee's evaluation, the NRG staff found that the TDEFW Pump room post ELAP is not expected to exceed 110°F. The necessary doors to be opened in order to establish passive ventilation are listed in the technical evaluation ECR 13-00310, Rev. 0, as well as the procedures to establish the temporary ventilation.

Based on the Intermediate Building temperature remaining below 120°F (the temperature limit, as identified in NUMARC-87-00, Rev. 1, for equipment to be able to survive indefinitely), the NRG staff finds that the electrical and electronic equipment and components located in the Intermediate Building, including the EFW and ADV area should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Reactor Building The NRG staff reviewed Technical Evaluation ECR 15-00341, which showed that there was significant margin remaining between equipment qualification test data and impact of post-ELAP temperatures. Based on this information, the NRG staff finds that equipment credited for the success of the licensee's FLEX strategy within the RB should function when exposed to the pressure and temperature conditions during an ELAP. See Section 3.4.4.4 of this SE for additional information pertaining to the licensee's RB strategy during an ELAP.

Based on its review of the essential station equipment required to support the FLEX mitigation strategy, which are primarily located in the CR (Control Building 355 ft. elevation), the Control Building elevations 322 ft. and 338 ft., Turbine Building - FLEX platform on the 322 ft. elevation,

the Intermediate Building, and the RB, the NRG staff finds that the equipment should perform their required functions at the expected temperatures as a result of loss of ventilation during an ELAP/LUHS event.

3.9.1.2 Loss of Heating In the event of an ELAP, the building HVAC will be lost. The building equipment and concrete walls provide a large mass at initial ambient temperature. Without any outside air flow, the insulating value of thick exterior walls and heat input into the battery rooms from the batteries discharging will cause the room temperature to slowly rise. In the initial hour of the ELAP, operators will open the doors between the inverter room, battery room and switchgear room to provide a larger space and thermal mass, but this will not introduce air from outside the building.

Based on its review of the licensee's battery room assessment, the NRG staff finds that the TMI Class 1E station batteries should perform their required functions at the expected temperatures as a result of loss of heating during an ELAP event.

3.9.1.3 Hydrogen Gas Control in Vital Battery Rooms An additional ventilation concern that is applicable to Phases 2 and 3, is the potential buildup of hydrogen in the battery rooms as a result of loss of ventilation during an ELAP event. Off-gassing of hydrogen from batteries is only a concern when the batteries are charging.

The NRG staff reviewed licensee calculation ECR 13-00310, "FLEX Ventilation Plan," Rev. 0.

For the TMI battery rooms, the maximum hydrogen generation rate is 2.46 ctm per battery or approximately 5 ctm per room. The licensee's evaluation showed that 500 ctm of ventilation flow will maintain the hydrogen concentration in the battery rooms below 1 percent assuming two batteries in each room are being charged. Approximately 4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the onset of the ELAP event, TMI plant operators would utilize procedure OP-TM-919-952, "FLEX Ventilation for Control Building," Rev. 0, to deploy temporary fans rated at 13300 CFM for each pair of battery and inverter rooms. Based on these actions, the NRG staff concludes that hydrogen accumulation in the TMI Class 1E station battery rooms should not reach the combustibility limit for hydrogen (4 percent) during an ELAP.

3.9.2 Personnel Habitability 3.9.2.1 Main Control Room As described above in Section 3.9.1.1, technical evaluation ECR 13-00310, Rev. 0 shows that with the use of portable fans to provide cooling and ventilation, the control room temperature is maintained at or below 11 O °F during a BDBEE. Operator actions to establish the portable ventilation strategy is provided in the same technical evaluation ECR 13-00301 O. Based on the licensee being able to maintain the CR temperatures below 110°F (the temperature limit, as identified in NUMARC-87-00, for personnel habitability), the NRG staff finds that personnel in the control room should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

3.9.2.2 Spent Fuel Pool Area See Section 3.3.4.1.1 above for the detailed discussion of ventilation and habitability considerations in the SFP area. In general, the licensee plans to establish a fuel building ventilation path from the SFP area and deploy hoses before the SFP boiling affects habitability.

The licensee also has the ability to add water to the SFP from the installed SFP cooling piping without accessing the refueling floor.

3.9.2.3 Other Plant Areas TDEFW Pump Area In the initial hours after an ELAP, EFW and OTSG pressure control (ADV) will be accomplished from the control room. Between 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> into the event local control will be established and utilized thereafter. As described above in 2494447-09, Technical Position Paper, "TDEFP Room Post ELAP Evaluation," Rev. 0, the ambient conditions in the EFW and ADV area will remain within acceptable habitability limits by establishing passive natural circulation. Colder denser outside air can flow into this area simply by opening doors. Furthermore, as stated earlier, the licensee has procedures in place to establish temporary ventilation to further minimize the rise in ambient temperature.

3.9.3 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore equipment and personnel habitability conditions following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.1 O Water Sources 3.10.1 Once Through Steam Generator Make-Up In its FIP, the licensee stated that condensate is used for OTSG heat removal and makeup.

Either of the CSTs A or B, or the demineralized water storage tank (DWST) will be available depending on the effects of the external event hazard. In any event, the installed condensate sources will provide at least a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> supply. Before the available condensate supplies are depleted, a long term supply will be established. If the river is accessible and level is sufficient, then a portable diesel-driven pump, FX-P-3A or FX-P-3B, will be placed on the ramp adjacent to the river across from the north office building and used to supply river water to CST B or the hotwell. The alternate method is to stage a portable DG, FX-Y-3, outside the ISPH to provide power to a portable electric submersible pumps, FX-P-6A or B, suspended in the ISPH intake channel at 268 ft. elevation. This pump and hose can supply river water to CST B or the hotwell. In addition to this primary function, either FX-P-3A or FX-P-3B is capable of directly supplying feedwater for the OTSG makeup, as described in the contingency strategy for failure of the TDEFW pump or failure of FX-P-2A and FX-P-2B.

3.10.2 Reactor Coolant System Make-Up In its FIP, the licensee stated that the FLEX RCS makeup strategy utilizes the BWST. The BWST is a safety-related seismic Class I structure and is fully protected from all applicable hazards except for high winds. In an extreme cold event, the BWST immersion heater will be energized from the FLEX power supply to maintain this source available. If the BWST is unavailable due to a tornado missile strike, the SFP would be utilized. The SFP is fully protected from all applicable hazards. The SFP is a seismic Class I structure located within the tornado protected and aircraft hardened fuel handling building. Permanently installed FLEX pumps FX-P-1 A or B will be used for this function.

3.10.3 Spent Fuel Pool Make-Up Spent fuel pool makeup will be supplied from the CST's via installed FLEX pumps FX-P-2A or B. Alternately the SFP can be supplied from the river using the same methods as described in OTSG makeup.

3.10.4 Containment Cooling No action is required to maintain containment pressure and temperature limits therefore no water sources are noted for this purpose.

3.10.5 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain satisfactory water sources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.11 Shutdown and Refueling Analyses Order EA-12-049 requires that licensees must be capable of implementing the mitigation strategies in all modes. In general, the discussion above focuses on an ELAP occurring during power operations. This is appropriate, as plants typically operate at power for 90 percent or more of the year. When the ELAP occurs with the plant at power, the mitigation strategy initially focuses on the use of the steam-driven TDEFW pump to provide the water initially needed for decay heat removal. If the plant has been shut down and all or most of the fuel has been removed from the RPV and placed in the SFP, there may be a shorter timeline to implement the makeup of water to the SFP. However, this is balanced by the fact that if immediate cooling is not required for the fuel in the reactor vessel, the operators can concentrate on providing makeup to the SFP. The licensee's analysis shows that following a full core offload to the SFP, about 9.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> are available to implement makeup before the start of SFP boiling. The licensee has stated that they have the ability to implement makeup to the SFP within that time.

When a plant is in a shutdown mode in which steam is not available to operate the TDEFW pump and allow operators to release steam from the SGs (which typically occurs when the RCS has been cooled below about 300 °F), another strategy must be used for decay heat removal.

On September 18, 2013, NEI submitted to the NRC a position paper entitled

"Shutdown/Refueling Modes" [Reference 35], which described methods to ensure plant safety in those shutdown modes. By letter dated September 30, 2013 [Reference 36], the NRC staff endorsed this position paper as a means of meeting the requirements of the order.

The position paper provides guidance to licensees for reducing shutdown risk by incorporating FLEX equipment in the shutdown risk process and procedures. Considerations in the shutdown risk assessment process include maintaining necessary FLEX equipment readily available and potentially pre-deploying or pre-staging equipment to support maintaining or restoring key safety functions in the event of a loss of shutdown cooling. The NRC staff concludes that the position paper provides an acceptable approach for demonstrating that the licensees are capable of implementing mitigating strategies in shutdown and refueling modes of operation. By letter dated December 1, 2016 [Reference 39], the licensee informed the NRC staff of its plans to follow the guidance in this position paper. During the audit process, the NRC staff observed that the licensee had made progress in implementing this position paper.

Based on the licensee's incorporation of the use of FLEX equipment in the shutdown risk process and procedures, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore core cooling, SFP cooling, and containment following a BDBEE in shutdown and refueling modes consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.12 Procedures and Training 3.12.1 Procedures In its FIP, the licensee stated that the procedures for implementing the FLEX strategy are maintained using the standards for emergency procedures. The requirements of the TMI site process for maintaining emergency procedures, 1001 E, "Maintenance Program for EP Usage Level Procedures," have been applied. Three Mile Island performed validation in accordance with industry developed guidance to assure required tasks, manual actions and decisions for FLEX strategies are feasible and may be executed within the constraints identified in the FIP.

The performance of the FLEX mitigating strategy was validated based on the administrative required minimum shift staffing level. The procedures which implement the major elements of the FLEX strategy are provided in the FIP.

3.12.2 Training In its FIP, the licensee stated that licensed and non-licensed operator initial and continuing training programs provide training on FLEX strategy implementing procedures. Continuing training on FLEX strategy implementing procedures will be completed every 2 years.

In Enclosure 1 to the compliance letter, in response to ISE Open Item 6, the licensee stated that the qualified operators will be used to operate all FLEX equipment. All operators have been trained on the modifications made to support implementation of the FLEX strategy. In addition, all operators have completed the initial FLEX training that included classroom training on the strategies and procedures, and a field walkdown of all installed equipment. The FLEX tasks were evaluated for continuing training and used to develop operator long range training plans

that have incorporated required FLEX recurring training. All key Emergency Response Organization personnel have received FLEX overview training and a computer based training program is in place for FLEX overview training as part of new hire inprocessing.

3.12.3 Conclusions Based on the description above, the NRG staff finds that the licensee has adequately addressed the procedures and training associated with FLEX. The procedures have been issued in accordance with NEI 12-06, Section 11.4, and a training program has been established and will be maintained in accordance with NEI 12-06, Section 11.6.

3.13 Maintenance and Testing of FLEX Equipment In its FIP, the licensee stated that periodic maintenance (PM) and testing of equipment relied upon for FLEX strategy is performed to confirm this equipment remains capable of performing its FLEX function. The PM and testing program for FLEX equipment was developed using existing procedures and processes. The program satisfies NEI 12-06 Section 11.5.2 by utilizing the following sources for maintenance and testing requirements:

• EPRI templates which were developed for FLEX equipment (EPRI Report 3002000623 "Nuclear Maintenance Applications Center: Preventive Maintenance Basis for FLEX Equipment," Reference 12.95 in the licensee's FIP.)

• Preventive Maintenance Basis for FLEX Equipment

• Operating Equipment Manufactures Recommendations

• Exelon corporate PM templates which were developed using INPO AP-913 process

• Operating Experience

• Material Aging and Shelf Life (including consumables and fluids)

These requirements were applied to equipment which "directly performs FLEX mitigation strategy for core cooling, containment or spent fuel cooling".

At least once every year, an inspection will be completed to confirm all temporary equipment and materials staged for FLEX are available in the proper location.

As a generic issue, NEI submitted a letter to the NRG dated October 3, 2013 [Reference 37],

which included EPRI Technical Report 3002000623, "Nuclear Maintenance Applications Center:

Preventive Maintenance Basis for FLEX Equipment." By letter dated October 7, 2013

[Reference 38], the NRG endorsed the use of the EPRI report and the EPRI database as providing a useful input for licensees to use in developing their maintenance and testing programs. In its FIP, the licensee stated that the industry letter was utilized in determining the maintenance and testing of the FLEX equipment.

The NRG staff finds that the licensee has adequately addressed equipment maintenance and testing activities associated with FLEX equipment because a maintenance and testing program has been established in accordance with NEI 12-06, Section 11.5.

3.14 Alternatives to NEI 12-06, Rev. O 3.14.1 Permanently installed and pre-staged vs. portable FLEX equipment.

Three Mile Island has proposed an alternative core and containment heat removal strategy to satisfy the requirements of Order EA-12-049. Specifically, TMI will utilize pre-installed FLEX pumps and FLEX DGs to accomplish the mitigating strategies. The Phase 2 FLEX equipment has been permanently pre-staged in existing structures that are designed or have been modified to provide reasonable protection from all applicable hazards. This is an alternative from the guidance in NEI 12-06, Rev. 0, Section 3.2.2. Three Mile Island proposed this approach due to the limitations with regard to maintaining natural circulation of the OTSG used in the B&W Nuclear Steam Supply System design. As a result, the Phase 2 FLEX equipment must be deployed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the start of the ELAP. The approach of utilizing pre-installed FLEX equipment enables the implementation of the Phase 2 mitigating strategies within the relatively short 4-hour time limit on Phase 1.

In Enclosure 1 of its compliance letter, the licensee provided an evaluation regarding the reliability of the FLEX 480 Vac DGs as a result of having pre-staged the N and N+ 1 FLEX DGs in close proximity to one another. The purpose of this evaluation was to determine if this configuration would result in any adverse effects. The licensee's evaluation addressed potential common cause failure modes, which could result in a failure of both FLEX DGs to perform when required. The failure modes included: (1) Catastrophic mechanical failure of one DG potentially impacting the other; and (2) Fire on one FLEX DG affecting the other FLEX DG. The primary concerns tor a "catastrophic mechanical" failure are typically related to either the pistons or the turbocharger. In both cases the licensee contends that engine protective features would result in engine shutdown. The licensee's assessment concluded that if a piston were ejected it would likely travel up and would not be directed at the redundant FLEX DG or associated equipment (cabling, connections etc.). Even if a catastrophic failure occurred that resulted in an ejection of components, the potential energy available in reciprocating components of the size of the TMI FLEX diesel engines is sufficiently small, making it unlikely that ejected parts could adversely affect adjacent equipment. A catastrophic failure of the turbocharger would be prevented by the engine controls and backed up by automatic shutdown features. Based on the specific attributes of the FLEX DG design and TMI installed arrangement, the equipment designer and manufacturer (Cummins) concluded that mechanical failure of one FLEX DG affecting the adjacent FLEX DG was not a credible failure mode.

With regards to a fire, the FLEX DGs will be subject to periodic maintenance, testing and inspection that should reduce the probability of fires occurring. However, in case of a fire, the FLEX DG area is protected by fire suppression sprinklers. The fire service system is supplied by two diesel driven pumps, which are not expected to be affected by an ELAP event. The system and piping was constructed in accordance with the National Fire Protection Association 13 and 24. If the fire suppression system is not available as a result of being damaged by a BDBEE, the licensee stated that the FLEX DG area will be frequently monitored during an ELAP event. Both Carbon Dioxide and dry powder ABC type extinguishers are staged just East and West of the FLEX DGs on the walkway immediately adjacent to the platform such that a fire on the platform would not prevent accessing the extinguisher.

Based on the above, the NRC staff finds that the configuration of TMl's FLEX DGs should not result in any adverse effects from potential common mode failures. Given that the pre-installed

FLEX equipment is located in structures that are designed or have been modified to be robust to the hazards considered within the scope of Order EA-12-049, the NRC staff found the proposed alternative to be acceptable. The NRC staff expects that although the guidance of NEI 12-06 has not been met, if the alternative is implemented as described by the licensee, the requirements of the order should be met.

3.14.2 Analytical approach for the Turbine Building The TMI Turbine Building (TB), a pre-existing, non-safety-related structure, was modified as required to provide reasonable protection from the BDBEE seismic hazard. This was done due to the fact that the TB stores pre-installed, Phase 2 FLEX mitigation equipment. In addition, the TB also protects the OTSG pressure boundary piping which must stay intact to support the FLEX mitigating strategies. Three Mile Island employed an analytical approach that utilized ASCE Standard 41-13, "Seismic Evaluation and Retrofit of Existing Buildings," to demonstrate the serviceability of the TB structure after a BDBEE seismic event. This is an alternative to the guidance in NEI 12-06, Rev. 0, Section 5.3.1, which establishes ASCE Standard 7-10, "Minimum Design Loads for Buildings and Other Structures," as the analytical method to determine the seismic acceptability of FLEX storage structures.

The NRC staff reviewed the licensee's analytical methodology and determined that it provided an acceptable alternative for evaluation of the pre-existing TMI TB. The NRC staff expects that although the guidance of NEI 12-06 has not been met, if the alternative is implemented as described by the licensee, the requirements of the order should be met.

3.14.3 Limited alternate flowpath for RCS injection The licensee's primary strategy for RCS makeup is via installed piping which connects the discharge of the FLEX RCS makeup pumps to the "C" and "D" HPI lines. Guidance document NEI 12-06 prescribes "diverse makeup connections to RCS for long-term RCS makeup and shutdown mode heat removal," whereas this installed connection to the HPI lines is the only fully credited flowpath for RCS makeup. Therefore, the staff considers the lack of a credited, diverse alternate flowpath for RCS makeup to be an alternative to the guidance in NEI 12-06.

Section 4.11 of the FIP describes an additional contingency strategy, which uses FLEX hoses to connect the discharge of the pumps to two parallel %-inch connections on the "C" and "D" HPI lines. The flowpath to the RCS downstream of these %-inch connections is identical to that of the primary strategy. The licensee identifies this method as a contingency only, but also notes that these connections are designed to meet Seismic Class I requirements. Moreover, the licensee has also confirmed that either HPI line ("C" or "D") is independently capable of passing the required volumetric flow to support the licensee's FLEX RCS boration and inventory control strategy. Therefore, the staff believes that this adequately meets the intent of the guidance in NEI 12-06, and that the alternative is acceptable.

3.14.4 Reduced Set of Hoses and Cables As Backup Equipment In its FIP supplement [Reference 39], the licensee took an alternative approach to the NEI 12-06 guidance for hoses and cables. In NEI 12-06, Section 3.2.2 states that in order to assure reliability and availability of the FLEX equipment required to meet these capabilities, the site should have sufficient equipment to address all functions at all units on-site, plus one additional

spare, i.e., an N+ 1 capability, where "N" is the number of units on-site. Thus, a single-unit site would nominally have at least two portable pumps, two sets of portable ac/dc power supplies, two sets of hoses & cables, etc. The NEI on behalf of the industry submitted a letter to the NRG

[Reference 41] proposing an alternative regarding the quantity of spare hoses and cables to be stored on site. The alternative proposed was that that either a) 1O percent additional lengths of each type and size of hoses and cabling necessary for the N capability plus at least one spare of the longest single section/length of hose and cable be provided orb) that spare cabling and hose of sufficient length and sizing to replace the single longest run needed to support any FLEX strategy. The licensee has committed to following the NEI proposal. By letter dated May 18, 2015 [Reference 42], the NRG agreed that the alternative approach is reasonable, but that the licensees may need to provide additional justification regarding the acceptability of various cable and hose lengths with respect to voltage drops, and fluid flow resistance. The NRG staff approves this alternative as being an acceptable method of compliance with the order.

In conclusion, the NRG staff finds that although the guidance of NEI 12-06 has not been met, if these alternatives are implemented as described by the licensee, they will meet the requirements of the order.

3.15 Conclusions for Order EA-12-049 Based on the evaluations above, the NRG staff concludes that the licensee has developed guidance to maintain or restore core cooling, SFP cooling, and containment following a BDBEE which, if implemented appropriately, should adequately address the requirements of Order EA-12-049.

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 By letter dated February 28, 2013 [Reference 22], the licensee submitted its OIP for TMI in response to Order EA-12-051 . By letter dated June 26, 2013 [Reference 23], the N RC staff sent a request for additional information (RAI) to the licensee. The licensee provided a response by letter dated July 24, 2013 [Reference 24]. By letter dated November 13, 2013

[Reference 25], the NRG staff issued an ISE and RAI to the licensee.

By letters dated August 28, 2013 [Reference 26], February 28, 2014 [Reference 27], August 28, 2014 [Reference 28], February 27, 2015 [Reference 29], and August 28, 2015 [Reference 30],

the licensee submitted status reports for the Integrated Plan. The Integrated Plan describes the strategies and guidance to be implemented by the licensee for the installation of reliable SFP level instrumentation which will function following a BDBEE, including modifications necessary to support this implementation, pursuant to Order EA-12-051. By letter dated January 20, 2016

[Reference 31 ], the licensee reported that full compliance with the requirements of Order EA 051 was achieved.

The licensee has installed a SFP level instrument system designed by Westinghouse, LLC. The NRG staff reviewed the vendor's SFP level instrumentation system design specifications, calculations and analyses, test plans, and test reports. The staff issued an audit report on August 18, 2014 [Reference 32].

The staff performed an onsite audit to review the implementation of SFP level instrumentation related to Order EA-12-051. The scope of the audit included verification of (a) site's seismic

and environmental conditions enveloped by the equipment qualifications, (b) equipment installation met the requirements and vendor's recommendations, and (c) program features met the requirements. By letter dated January 11, 2016 [Reference 17], the NRC issued an audit report on the licensee's progress. Refer to Section 2.2 above for the regulatory background for this section.

4.1 Levels of Required Monitoring Three Mile Island has SFP "A" and SFP "B" for storage of spent fuel. The pools are normally connected via a channel and normally open gate. Thus, they are normally operated as a common pool. The bottom of the channel is at plant elevation of 321 ft. O in. The pools are normally interconnected at the same water level when the water level is greater than nominally 1 ft. 11 in. above the top of the spent fuel storage racks in SFP "A", and 1 ft. 8 in. above the top of the spent fuel storage rack in SFP "B". The gate between the pools is closed for limited time periods for maintenance or non-refueling operations.

In its OIP, the licensee identified the SFP levels of monitoring as follows:

• Level 1 is at 340 ft. 4in. plant elevation

• Level 2 is at 329ft. 4in. plant elevation

• Level 3 is at 319ft. 4in. plant elevation In its letter dated January 20, 2016 [Reference 31], the licensee revised the Level 1 from 340ft.

4in. to 343ft. 6in. plant elevation and Level 3 from 319ft. 4in. to 321ft. 3in. plant elevation. Per this letter, for the modified Level 1, the licensee stated that accordance to Calculation C-1101-251-E410-012, "Available NPSH for SF Coolant Pumps," loss of suction by vortexing is as high as 341 ft. 11 in. at the design flow of 1000 gpm. Under saturated conditions, at design flow of 1,000 gpm and 212°F fluid, adequate NPSH exists and suction line voiding will not occur at 343ft. 6in. For the modified Level 3, the licensee stated that Level 3 is slightly above the top of the gate weir that separates the two SFPs, which is elevation 321 ft. Oin., rather than the top of the fuel rack, which is elevation 319ft. 1in. According to the licensee, this change will provide assurance that both the primary and backup SFP level instrument channels can measure the same Level 3 elevation in both SFPs.

In its letter dated January 20, 2016 [Reference 31], the licensee provided a sketch depicting the final SFP levels of monitoring and the measurement ranges for the primary and backup instrument channels as shown in Figure 1, "TMI SFP Levels of Monitoring," below:

SF*T*2A SF*T*2Buv

?4 l j'

,/

Figure 1 - "TMI SFP Levels of Monitoring" The NRC staff's assessment of the licensee selection of the SFP levels of monitoring is as follows: per NEI 12-02, Section 2.3.1, Level 1 will be the higher of two points. The first point is the water level at which suction loss occurs due to uncovering of the spent fuel cooling inlet pipe. This was identified by TMI as elevation 341 ft. 11 in. The second point is the water level at which loss of spent fuel cooling pump NPSH occurs under saturated conditions. This was identified by TMI as below elevation 343ft 6in. The Three Mile Island designated Level 1 (343ft.

6in.) is the HIGHER of the above two points and therefore consistent with NEI 12-02. Level 2 was identified as elevation 329ft. 4in. This level is consistent with the first of the two NEI 12-02 options for Level 2, which is 10 feet(+/- 1 ft.) above the highest point of any fuel rack seated in the SFP. Level 3 is consistent with NEI 12-02 Level 3, which is above the highest point of any fuel rack seated in the SFP.

Based on the evaluation above, the NRC staff finds that the licensee's selection of Levels 1, 2 and 3 appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2 Evaluation of Design Features Order EA-12-051 required that the SFP level instrumentation shall include specific design features, including specifications on the instruments, arrangement, mounting, qualification, independence, power supplies, accuracy, testing, and display. Refer to Section 2.2 above for the requirements of the order in regards to the design features. Below is the staff's assessment of the design features of the SFP level instrumentation.

4.2.1 Design Features: Instruments In its OIP, the licensee stated that the primary instrument channel level sensing components will be permanently mounted in the SFP "A". The backup instrument channel level sensing

components will be permanently mounted in SFP "B". SFPs "A" and "B" are interconnected by a channel and normally open gate. The bottom of this channel is at elevation 321ft. Oin, which is 1 ft. 11 in. above the top of the fuel storage racks in SFP "A" and 1 ft. 8 in. above the top of the fuel storage racks in SFP "B". Both instrument channel sensors will be capable of monitoring level down to the nominal (i.e., +/- 1 'ft.) top of the spent fuel storage racks in the pool in which they are located.

In its letter dated January 20, 2016 [Reference 31 ], the licensee provided a sketch depicting the final SFP levels of monitoring and the instrument measurement ranges (Figure 1 of this evaluation). In this figure, the measurement range for the primary channel is from 347ft. 10in. to 319ft. 4in. plant elevations. The measurement range for the backup channel is from 346ft. 9 1/8in. to 319ft. 4in. plant elevations. The NRC staff noted that the instrument measurement ranges will cover Levels 1, 2, and 3, as described in Section 4.1 above. However, the staff had concerns regarding the possible effects on the reliability of the SFP level instrumentation when the gate is closed. In its letter dated August 28, 2015 [Reference 32], the licensee provided a response to the staff's concern, in which it stated that complete redundant monitoring of the SFPs will not be available when the gate between SFP "A" and "B" is installed. This gate has not been installed for more than 37 years. It was installed to re-rack the SFP "B" at that time.

There is no intention to install the gate in the future. If the gate is installed, there is an existing Procedure 1507-2, "Fuel Handling Building Crane Operation, to install and remove the gate.

According to the licensee, Procedure 1507-2 will be revised to establish administrative guidance/controls to follow the NEI 12-02, Section 4.3 guidance for the 90-day out of service criterion. Furthermore, during the onsite audit, the licensee stated that Procedure CC-TM-118-1001, "TMI Diverse and Flexible Coping Strategy (FLEX) Program Document, will be revised to include SFP instrumentation (SFPI) channel unavailability actions. The staff found that the licensee adequately addressed the staff's concerns with regard to the effects on the reliability of the SFP level instrumentation caused by the gate installation.

Based on the evaluation above, the NRC staff finds that the licensee's design, with respect to the number of SFP instrument channels and instrument range, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.2 Design Features: Arrangement In its letter dated August 28, 2015 [Reference 32], the licensee stated that the primary level probe will be mounted on the North wall of the SFP "A" and the backup probe will be mounted on the South wall of the SFP "B". These probes will be separated by a distance greater than the span of the shortest side of the pool. The licensee further stated that the level sensor enclosures and the electronics/UPS enclosures for the both instrument channels will be installed in the Control Building Patio of TMl-1 maintaining maximum practical separation between the channel cables to meet the NEI 12-02 guidance requirements. In this letter, the licensee also provided a sketch predicting the SFP inside dimensions, the locations of the primary and backup SFP level sensors, and the routing of the cables within the Fuel Handling Building (FHB).

The NRC staff noted, with verification by walkdown during the onsite audit, that there is sufficient channel separation within the SFP area between the primary and backup level instrument channels, sensor electronics, and routing cables to provide reasonable protection against loss of SFP level indication due to missiles that may result from damage to the structure over the SFP.

Based on the evaluation above, the NRC staff finds that the licensee's arrangement for the SFP level instrumentation, if implemented appropriately, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.3 Design Features: Mounting In its letter dated August 28, 2015 [Reference 32], the licensee stated that all SFP instrumentation system equipment is designed in accordance with the TMI SSE design requirements. The level sensor, which is one long probe, will be suspended from the launch plate via a coupler/connector assembly. The launch plate is a subcomponent of the bracket assembly, which will be mounted to the FHB 348ft. floor via anchors at the South end and attached to the North wall with anchors at the North end of the SFP. The vendor, Westinghouse, evaluated the structural integrity of the mounting brackets in calculations CN-PEUS-14-21 and CN-PEUS-14-22. The GTSTRUDL model, used by Westinghouse to calculate the stresses in the bracket assembly, considered load combinations for the dead load, live load and seismic load on the bracket. The reactionary forces calculated from these loads become the design inputs to design the mounting bracket anchorage to the refuel floor to withstand a SSE. The seismic loads are obtained from TMl's response spectra curves. The licensee further stated that the stresses on the bracket assembly were determined by the following methodology:

• Frequency analysis, taking into account the dead weight and the hydrodynamic mass of the structure, is performed to obtain the natural frequencies of the structure in all three directions.

• SSE response spectra analysis is performed to obtain member stresses and support reactions.

• Modal responses are combined using the Ten Percent Method per Regulatory Guide 1.92, Rev. 1, "Combining Modal Responses and Spatial Components in Seismic Response Analysis."

• The seismic loads for each of the three directions are combined by the Square Root of the Sum of Squares (SRSS) method.

• Sloshing analysis is performed to obtain liquid pressure and its impact on bracket design.

• The seismic results are combined with the dead load results and the hydrodynamic pressure results in absolute sum. These combined results are compared with the allowable stress values.

As for the possible hydrodynamic effects on the SFP level probes, in the same letter above, the licensee stated that sloshing forces were obtained by analysis. The approach described in TID-7024, "Nuclear Reactors and Earthquakes, 1963, by the US Atomic Energy Commission, has been used to estimate the wave height and natural frequency. Horizontal and vertical impact force on the bracket components was calculated using the obtained wave height and natural frequency. Sloshing forces were calculated and added to the total reactionary forces that would be applicable for bracket anchorage design. According to the licensee, the analysis also determined that the level probe can withstand a credible design basis seismic event. During the design basis event, the SFP water level is expected to rise and parts of the level sensor probe are assumed to become submerged in borated water. The load impact due to the rising water and submergence of the bracket components has also been considered for the overall sloshing impact. Reliable operation of the level measurement sensor with a submerged interconnecting cable has been demonstrated by analysis of previous Westinghouse testing of the cable, and the vendor's cable qualification. Boron build up on the probe has been analyzed to determine the potential effects on the sensor in WNA-TR-03149-GEN.

As for the SFP electronic equipment mounting design, in the letter dated August 28, 2015

[Reference 32], the licensee stated that TMI station-specific calculations were developed to address the seismic mounting of the readout display in the control building patio 322 ft.

elevation. The design criteria in these calculations meet the requirements to withstand a SSE.

The methods used in the calculations follow Institute of Electrical and Electronics Engineers (IEEE) Standard 344-2004 and IEEE Standard 323-2003 for seismic qualification of the instrument.

Based on the evaluation above, the NRG staff finds the licensee's proposed mounting design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process Appendix A-1 of the guidance in NEI 12 02 describes a quality assurance process for non-safety systems and equipment that are not already covered by existing quality assurance requirements. In JLD-ISG-2012-03, the NRG staff found the use of this quality assurance process to be an acceptable means of meeting the augmented quality requirements of Order EA-12-051.

In its OIP, the licensee stated that reliability will be established through the use of an augmented quality assurance process (e.g., a process similar to that applied to the site fire protection program).

The NRG staff finds that, if implemented appropriately, this approach appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.4.2 Equipment Reliability Section 3.4 of NEI 12-02 states, in part:

The instrument channel reliability shall be demonstrated via an appropriate combination of design, analyses, operating experience, and/or testing of channel components for the following sets of parameters, as described in the paragraphs below:

• conditions in the area of instrument channel component use for all instrument components,

• effects of shock and vibration on instrument channel components used during any applicable event for only installed components, and

• seismic effects on instrument channel components used during and following a potential seismic event for only installed components.

Equipment reliability performance testing was performed to (1) demonstrate that the SFP instrumentation will not experience failures during beyond-design-basis (BOB) conditions of temperature, humidity, emissions, surge, and radiation, and (2) to verify those tests envelope the plant-specific requirements.

During the vendor audit [Reference 32], the NRC staff reviewed the Westinghouse SFP level instrumentation's qualifications and testing for temperature, humidity, radiation, shock and vibration, and seismic. The staff further reviewed the anticipated TMI seismic, radiation, and environmental conditions during the on-site audit [Reference 17]. Below is the staff's assessment of the equipment reliability of TMI SFP level instrumentation.

4.2.4.2.1 Temperature. Humidity. and Radiation The licensee addressed SFP level instrument qualifications with regard to the TMI BOB environment in its letter dated August 28, 2015 [Reference 32]. The licensee stated that components in the SFP area (level sensor probe, coax coupler and connector assembly, launch plate and pool side bracket assembly, coax cable) are designed and qualified to operate reliably subject to the environmental conditions specified in the table below:

Table 1 - SFP Area Environmental and Radiological Conditions Parameter Normal for Exelon Plants BOB Temperature 50-140°F 212°F Humidity 0-95% Relative Humidity (RH) 100% (saturated steam)

Radiation Tl D y 1E03 Rads 1E07 Rads (above pool)

Radiation TIO y 1E09 Rads 1E07 Rads (12 in. above top of fuel (probe and weight only) rack)

According to the licensee, environmental conditions for SFP level instrument components installed in the SFP area are bounded by above test conditions (Table 1), except for radiation Total lntergraded Dose (TIO) 12 in. above top of fuel rack for BOB. The BOB radiation TIO, 12 in. above top of fuel rack for Byron Station is 4.E07 Ry, per Calculation BYR13-051, "NEI 12-02 Spent Fuel Pool Doses". The licensee further stated that Calculation BYR13-187, "Radiation Doses in the vicinity of the Spent Fuel Pool at Reduced Water Level" proves that Calculation BYR 13-051 bounds the Exelon Fleet for these values. The BDBEE radiation value to which the Westinghouse equipment is qualified to is 1.E07 Ry. The radiation value of 4.E07 Ry is higher than 1.E07 Ry to which Westinghouse qualified the instrument. However, this value of 4.E07 R y is applicable only when the water is at Level 3. At Level 2 the TIO reduces to 2.E07 Ry and it further reduces to 8.E06 at Level 1 and above. With SFP water level at Level 3 the only components of SFPI that are exposed to high radiation are the stainless steel probe and the stainless steel anchor. The materials with which the probe and the anchor are manufactured are resistant to radiation effects. The stainless steel anchor and stainless steel probe can withstand a 40 year dose.

For environmental conditions outside of the SFP area, in its letter dated August 28, 2015

[Reference 32], the licensee stated that the level sensor transmitter and bracket, electronics display enclosure and bracket are designed and qualified to operate reliably in the environmental conditions specified below:

Table 2 - Outside of SFP Area Environmental and Radiological Conditions Parameter Normal BOB BOB (Level Sensor Electronics Only)

Temperature 50-120°F 140°F 140°F Humidity 0-95% RH 0-95% 0-95%

(non-condensing) (non-condensing)

Duration 3 days 3 days 3 days Radiation Tl D v s 1E03 RY. s 1E03 RY. s 1E03 RY.

In its letter dated August 28, 2015 [Reference 32], the licensee further stated that the readout display will be located in the control building patio 322 ft. elevation and is not expected to be subject to harsh environmental or radiological conditions seen in the FHB.

The NRC staff noted that the licensee adequately addressed the equipment reliability of SFP level instrumentation with respect to temperature, humidity and radiation. The equipment qualifications envelop the expected TMl's radiation, temperature, and humidity conditions during a postulated BDBEE. The equipment environmental testing demonstrated that the SFP instrumentation should maintain its functionality under expected BOB conditions.

4.2.4.2.2 Shock and Vibration In its letter dated August 28, 2015 [Reference 32], the licensee stated that the SFPI system pool side brackets for both the primary and backup SFP measurement channels will be permanently installed and fixed to rigid refuel floors or walls, which are Seismic Category 1 structures. The SFPI system components, such as the level sensor and its bracket and the display enclosure

and its bracket, were subjected to seismic testing, including shock and vibration test requirements. The level sensor electronics are enclosed in a NEMA-4X housing. The display electronics panel utilizes a NEMA-4X rated stainless steel housing as well. These housings will be mounted to a seismically qualified wall and will contain the active electronics, and aid in protecting the internal components from vibration induced damage.

The NRC staff noted that the licensee adequately addressed the equipment reliability of SFP level instrumentation with respect to shock and vibration. The test parameters envelop TMl's expected shock and vibration conditions during a postulated BDBEE.

4.2.4.2.3 Seismic For TMI SFP lev_el instrument design with respect to seismic, in its letter dated August 28, 2015

[Reference 32], the licensee stated, in parts, that Westinghouse seismically qualified the SFP level instrument and its components. With the instrument seismically qualified and installed, assurance is provided that the instrument response, including the readout display in the control building patio 322 ft. elevation, will maintain reliability and accurate indication when required.

Conduit, conduit supports, and pull box supports for the SFP level instrument modification utilized pre-engineered designs per TMI Specification SP-1101-43-004, "Raceway Routing and Structural Criteria and Raceway Support Installation Criteria". The pre-engineered designs in the Specification are based upon TMI approved analyses C-1101-101-E540-012 and 1.527.1.9.

The NRC staff noted that the licensee adequately addressed the equipment reliability of SFP level instrumentation with respect to seismic. The SFP level instrument was tested to the seismic conditions that envelop TMl's expected highest SSE. The NRC staff also noted that the assumptions, analytical, and conclusion model used in the sloshing analysis for the sensor mounting bracket are adequate. Further seismic qualifications of the SFP level instrumentation mounting is addressed in Subsection 4.2.3, "Design Features: Mounting," of this evaluation.

During the onsite audit, the NRC staff learned that TMI utilizes the 90-degree connectors for the SFPI cables. Depending on the installation configurations, Westinghouse provided two types of SFP cable connectors, a straight connector or a 90-degree connector. Both of them originally were qualified for 15-month life. Westinghouse attempted to get the connectors qualified for 10-year life through testing. The test includes radiation aging, thermal aging and steam tests. While the 90-degree connector passed the initial tests, the straight connector failed the steam test due to leakage caused by the sealant around the connector. The Westinghouse solution was to encapsulate the exposed epoxy of the connector with Raychem boots. The straight connector modification passed the tests recently. However, TMI decided to utilize the 90-degree connectors.

During the onsite audit, the NRC staff enquired as to an assessment of potential susceptibilities of Electromagnetic Interference/Radio Frequency Interference (EMl/RFI) in the areas where the SFP instrument is located and how to mitigate those susceptibilities. The licensee provided a response, in which it stated that TMI will establish a 2 ft. boundary for transmitter and display boxes to address EMl/RFI susceptibilities. Additionally, acceptance criteria 15 of Attachment 1 of ECR 13-00084 will determine whether the radio free zone around the electronics boxes and transmitters needs to be extended beyond two feet.

Based on the evaluations above, the NRC staff finds the licensee's proposed instrument qualification process appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.5 Design Features: Independence With regard to SFP level instrument channel physical independence, in its letter dated August 28, 2015 [Reference 32], the licensee stated that the primary level probe was mounted on the North wall of SFP "A" and the backup probe was mounted on the South wall of SFP "B" and was separated by a distance greater than the span of the shortest side of the pool. The level sensor enclosures and the electronics/UPS enclosures for the instrument channels were installed in the TMI control building patio, maintaining maximum practical separation between the channel cables.

With regard to SFP level instrument channel electrical independence, in its letter dated August 28, 2015 [Reference 32], the licensee stated that the 120 Vac power to the primary and backup instruments was provided from separate non-1 E power panels. The 120 Vac distribution panels for the primary and backup instruments are powered by different 480V buses. Therefore, according to the licensee, the loss of any one bus will not result in the loss of ac power to both instrument channels.

The NRC staff noted, and verified during the walkdown, that the licensee adequately addressed SFP level instrument channel independence. Instrument channel physical separation is further discussed in Subsection 4.2.2, "Design Features: Arrangement". With the licensee's proposed design, the loss of one level instrument channel would not affect the operation of other channel under BDBEE conditions. The staff finds the licensee's proposed design, with respect to instrument channel independence, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.6 Design Features: Power Supplies In its letter dated August 28, 2015 [Reference 32], the licensee stated that the primary and backup SFP level instrument channels will be normally powered from separate non-1 E 120 Vac breaker panels. These are powered from separate 480V buses, which are ultimately powered from separate auxiliary transformers, thus maintaining power source independence. Upon loss of normal ac power, individual batteries installed in each channel's electronics/ UPS enclosure will automatically maintain continuous channel operation for at least 3 days. Additionally, a receptacle and a selector switch are installed in each channel electronics/ UPS enclosure to directly connect emergency power to the SFP level instrument. During an ELAP and before the batteries are discharged, the cabinets will be connected via the above receptacle and selector switch to power provided by the FLEX diesel generators.

With regard to the battery backup duty cycle, in its letter dated August 28, 2015 [Reference 32],

the licensee stated that Westinghouse Report WNA-CN-00300-GEN provides the results of the calculation depicting the battery backup duty cycle. According to the licensee, this calculation demonstrates that battery capacity is 4.22 days to maintain the level indicating function to the display location, located in the patio area of the TMI control building. Therefore, the TMI readout display of level indication will be available for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of operation.

The NRC staff finds the licensee's proposed power supply design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.7 Design Features: Accuracy In its letter dated August 28, 2015 [Reference 32], the licensee stated that according to Westinghouse documents WNA-CN-00301 and WNA-DS-02957-GEN, each instrument channel will be accurate to within +/-3 in. during normal SFP level conditions. The instrument channels will retain this accuracy after BOB conditions, The NRC staff noted that the licensee adequately addressed the SFP level instrumentation accuracy requirements including the expected instrument channel accuracy performance under both normal and BOB conditions. If implemented properly, the instrument channels should maintain the designed accuracy following a power source change or interruption without the need of recalibration.

The NRC staff finds the licensee's proposed instrument accuracy appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.8 Design Features: Testing The licensee stated in its letter dated January 20, 2016 [Reference 31 ], that Westinghouse supplied test equipment that provides the capability to enable periodic testing and calibration of the SFP level sensing equipment. Westinghouse calibration procedure WNA-TP04709-GEN and functional test procedure WNA-TP-04613-GEN provide instructions to use the test equipment to perform periodic testing and calibration, including in-situ testing. The Three Mile Island in-situ test methodology is based on the Westinghouse Two Point Verification Method, LTR-SFPIS-14-55. The level displayed by the channels will be verified per the TMI operating procedures, as recommended by Westinghouse vendor technical manual WNA-G0-00127-GEN. If the level is not within the required accuracy per Westinghouse recommended tolerance in WNA-TP-04709-GEN, channel calibration will be performed.

The licensee stated in its letter dated January 20, 2016 [Reference 31 ], that the functional test and calibration are combined in the same procedure, MA-TM-145-251. The TMI procedure is associated with a PM that establishes the required performance of the procedure 60 days prior to a scheduled refueling outage. These procedures are based on the Westinghouse Two Point Verification Method and procedure WNA-TP-04709-GEN, "Spent Fuel Pool Instrument System Calibration." The procedure establishes the current water level by measuring the distance to the water referenced from the bottom of the launch plate. This measured distance is then compared to the level indication obtaining the As-Found indication value. The probe is then lifted out of the water to a predetermined mark on the probe. The water level at the predetermined mark is then recorded. The probe is lowered back into the water freely suspended from the launch plate. The level indication is recorded. If all three As-Found Level indications are within the tolerance specified, the procedure is exited. If the As-Found values are not within tolerance the calibration is performed to bring the indication within the calibration requirements. The calibration steps in the TMI procedures were taken from Westinghouse Procedure WNATP-04709-GEN.

During the onsite audit, the licensee stated that the new SFPI channel checks (comparison of indicated levels to actual SFP level) will be included in the Control Room Operator Control Tower Round.

The NRC staff finds the licensee's proposed SFP instrumentation design that allows for testing, including functional test and channel check, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.9 Design Features: Display In its letter dated August 28, 2015 [Reference 32], the licensee stated that TMI primary and backup instrument channel displays are located on the second floor of the control building at the south end. This location was selected due to the fact that this area will be manned during any BDBEE where the FLEX RCS makeup pump is located as well. Also, the area is in close proximity to the main control room, and alternate shutdown panel. The display can also be accessed from the main control room on demand if the FLEX RCS makeup station is not being manned. It will take up to 3 minutes for an operator to reach the display location (2 floors below the control room), for both the primary and backup channels.

As for the radiological and environmental habitability of the SFP level instrument display location, in its letter dated August 28, 2015 [Reference 32], the licensee stated that radiological habitability at this location has been evaluated against TMI UFSAR Table 11.A-2 and Figure 11.A- 5. The peak radiation post LOCA is 480 mRem/hr in this location. Also the estimated dose rates from SFP draindown conditions to Level 3 was evaluated. Therefore, the exposure to personnel monitoring SFP levels due to radiation in the display location for both channels would remain less than emergency exposure limits allowable for emergency responders to perform this action. Heat and humidity from SFP boildown conditions have been evaluated for this location. The location is in a different building physically separated by concrete walls, closed air lock/fire doors from the SFP such that heat and humidity from a boiling SFP would not compromise habitability at this location.

The licensee stated in its letter dated August 28, 2015 [Reference 32], that the SFP level will be monitored periodically by Operators once dispatched from the control room. Travel time from the control room to the primary and secondary displays is approximately 3 minutes based on walkdowns performed. The walkthrough to access the display locations is within the robust seismic category I structures, from the control room to the display locations, located near the TMI remote shutdown room. Operators will be able to use the sound powered phone system to communicate to the control room with the display information immediately. According to the licensee, being able to provide the indicated SFP level within approximately 1O minutes is considered adequate.

The NRC staff finds that the licensee's proposed location and design of the SFP instrumentation displays appear to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3 Evaluation of Programmatic Controls 4.3.1 Programmatic Controls: Training In its OIP, the licensee stated that personnel performing functions associated with these SFP level instrumentation channels will be trained to perform the job specific functions necessary for their assigned tasks (maintenance, calibration, surveillance, etc.). This training will be consistent with equipment vendor guidelines, instructions and recommendations. The Systematic Approach to Training (SAT) will be used to identify the population to be trained and to determine the initial and continuing elements of the required training. Training will be completed prior to placing the instrumentation in service. The NRG staff noted that the use of SAT to identify the training population and to determin"e both the elements of the required training is consistent with NEI 12-02.

The NRG staff finds that the licensee's proposed plan to train personnel in the operation, maintenance, calibration, and surveillance of the SFPI and the provision of alternate power to the primary and backup instrument channels, including the approach to identify the population to be trained, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and adequately address the requirements of the order.

4.3.2 Programmatic Controls: Procedures For TMI procedures related to the SFP level instrumentation, in its letter dated August 28, 2015

[Reference 32], the licensee stated that site procedures will be developed for system inspection, calibration and test, maintenance, repair, operation and normal and abnormal responses, in accordance with Exelon's procedure control process. Technical objectives to be achieved in each of the respective procedures are described below:

• System Inspection: To verify that system components are in place, complete, and in the correct configuration, and that the sensor probe is free of significant deposits.

• Calibration and Test: To verify that the system is within the specified accuracy, is functioning as designed, and is appropriately indicating SFP water level.

• Maintenance: To establish and define scheduled and preventive maintenance requirements and activities necessary to minimize the possibility of system interruption.

• Repair: To specify troubleshooting steps and component repair and replacement activities in the event of system malfunction.

• Operation: to provide sufficient instructions for operation and use of the system by plant operation staff.

During the onsite audit, the licensee provided a list of TMI procedures associated with SFP level instrument calibration, testing, maintenance, abnormal responses as shown below:

• OP-TM-AOP-035, "Abnormal Operating Procedure for loss of SFP cooling." This procedure directs the operation of the new system indications as required.

• CRO Control Tower Rounds - this procedure verifies both channels indicate same level and verifies power sources.

• OP-TM-919-901 - FLEX procedure to re-power SFPI system post-ELAP via panel EE-PNL-ATC1 within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

• MA-TM-145-251 - SFPI calibration procedure.

• CC-TM-118-1001 - FLEX/SFPI Program Document: includes actions that must be taken with one or two SFPI channels unavailable including compensatory actions.

The NRC staff noted that the licensee adequately addressed the SFP level instrument procedure requirements. The procedures had been established for the testing, surveillance, calibration, operation, and abnormal responses for the primary and backup SFP level instrument channels. The staff finds that the licensee's proposed procedures appear to be consistent with NEI 12 02, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3.3 Programmatic Controls: Testing and Calibration With regard to SFP level instrument testing and calibration programs, the licensee stated in its letter dated August 28, 2015 [Reference 32], that performance tests (functional checks) are described in the vendor operator's manual and plant operating procedures. Performance tests are planned to be performed periodically as recommended by the vendor. Manual calibration is planned to be performed periodically with additional maintenance on an as-needed basis when flagged by the system's automated diagnostic testing features. Channel calibration tests are planned to be performed at frequencies established in consideration of vendor recommendations. The SFPI channel/equipment maintenance/preventative maintenance and testing program requirements to ensure design and system readiness are planned to be established in accordance with Exelon's processes and procedures and in consideration of vendor recommendations to ensure that appropriate regular testing, channel checks, functional tests, periodic calibration, and maintenance is performed (and available for inspection and audit).

The TMI letter dated August 28, 2015 [Reference 32], also addressed compensatory measures for out-of-service SFP level instrument channel(s). The licensee stated that both primary and backup SFPI channels will incorporate permanent installation (with no reliance on portable, post-event installation) of relatively simple and robust augmented quality equipment.

Permanent installation coupled with stocking of adequate spare parts reasonably diminishes the likelihood that a single channel (and greatly diminishes the likelihood that both channels) is/are out-of-service for an extended period of time. Planned compensatory actions for unlikely extended out-of-service (OOS) events are summarized in Table 3 below.

Table 3 - Compensatory Measures for SFP Level Instrument Channel(s) Out-of-Service

1. Channel(s) OOS Required Restoration Action Compensatory Action if Required Restoration Action not Completed within Specified Time 1 Restore channel to functional Immediately initiate action in status within 90 days (or if channel accordance with Note below restoration not expected within 90 days, then proceed to Compensatory Action) 2 Initiate action within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to Immediately initiate action in restore one channel to functional accordance with Note below status and restore one channel to functional status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Note: Initiate an Issue Report to enter the condition into the Corrective Action Program. Identify the equipment out of service time is greater than the specified allowed out of service time, develop and implement an alternate method of monitoring, determine the cause of the non-functionality, and the plans and schedule for restoring the instrumentation channel(s) to functional status.

The TMI letter dated January 20, 2016 [Reference 31 ], addressed the PM program associated with the SFP level instrumentation. The licensee stated that TMI has developed PM tasks for the SFPI per Westinghouse recommendations identified in the technical manual WNA-G0-00127-GEN to assure that the channels are fully conditioned to accurately and reliably perform their functions when needed.

During the site audit, the NRC staff requested information regarding TMI PM tasks related to SFP level instrumentation to ensure the instrument channels are fully maintained to accurately and reliably perform their functions when needed. In response, the licensee provided a list of PM tasks and associated frequencies as follows:

• SFPI battery replacement - 3 years

• Channel verification - 1 day

• 90 degree and straight connectors, coupler assembly replacements - 28.8 years

• System calibration - within 60 days of refueling & not to exceed 2 years

• Probe replacement - 40 years

• Transmitter replacement - 7 years

• Verify power source - 4 days

• Perform camera inspection of the probe - 1 year

• Coax cable replacement - 40 years The NRC staff finds that the licensee's proposed testing and calibration program appears to be consistent with NEI 12-02, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.4 Conclusions for Order EA-12-051 In its letter dated January 20, 2016 [Reference 31], the licensee stated that they would meet the requirements of Order EA-12-051 by following the guidelines of NEI 12-02, as endorsed by JLD-ISG-2012-03. In the evaluation above, the NRC staff finds that, if implemented appropriately, the licensee has conformed to the guidance in NEI 12-02, as endorsed by JLD-ISG-2012-03. In addition, the NRC staff concludes that if the SFP level instrumentation is installed at Three Mile Island Nuclear Station according to the licensee's proposed design, it should adequately address the requirements of Order EA-12-051.

5.0 CONCLUSION

In August 2013 the NRC staff started audits of the licensee's progress on Orders EA-12-049 and EA-12-051. The staff conducted an onsite audit from August 10 - 13, 2015 [Reference 17].

The licensee reached its final compliance date on April 30, 2016, and has declared that TMI unit 1 is in compliance with the orders. The purpose of this SE is to document the strategies and implementation features that the licensee has committed to. Based on the evaluations above, the NRC staff concludes that the licensee has developed guidance and proposed designs that, if implemented appropriately, should adequately address the requirements of Orders EA-12-049 and EA-12-051. The NRC staff will conduct an onsite inspection to verify that the licensee has implemented the strategies and equipment to demonstrate compliance with the orders.

6.0 REFERENCES

1. SECY-11-0093, "Recommendations for Enhancing Reactor Safety in the 21st Century, the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,"

July 12, 2011 (ADAMS Accession No. ML11186A950)

2. SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," February 17, 2012 (ADAMS Accession No. ML12039A103)

3. SRM-SECY-12-0025, "Staff Requirements - SECY-12-0025 - Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," March 9, 2012 (ADAMS Accession No. ML120690347)

4. Order EA-12-049, "Issuance of Order to Modify Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," March 12, 2012 (ADAMS Accession No. ML12054A736)

5. Order EA-12-051, "Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," March 12, 2012 (ADAMS Accession No. ML12054A679)

6. Nuclear Energy Institute document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Rev. 0, August 21, 2012 (ADAMS Accession No. ML12242A378)

7. JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events,"' August 29, 2012 (ADAMS Accession No. ML12229A174)

8. Nuclear Energy Institute document NEI 12-02, "Industry Guidance for Compliance with NRC Order EA-12-051, To Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," Rev. 1, August 24, 2012 (ADAMS Accession No. ML12240A307)

9. JLD-ISG-2012-03, "Compliance with Order EA-12-051, Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," August 29, 2012 (ADAMS Accession No. ML12221A339)

10. Letter from Exelon to NRC, Three Mile Island, Unit 1 - Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design Basis External Events (Order Number EA-12-049), February 28, 2013 (ADAMS Accession No. ML13059A299)

11. Letter from Exelon to NRC, Three Mile Island, Unit 1, First Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events (Order Number EA-12-049), August 28, 2013 (ADAMS Accession No. ML13241A035)

12. Letter from Exelon to NRC, Three Mile Island Station, Unit 1, Second Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design- Basis External Events (Order Number EA-12-049), February 28, 2014 (ADAMS Accession No. ML14063A221)

13. Letter from Exelon to NRC, TMI, Unit 1 - Third Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design- Basis External Events (Order Number EA 049), August 28, 2014 (ADAMS Accession No. ML14241A251)

14. Letter from Exelon to NRC, Three Mile Island, Unit 1Fourth Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events (Order Number EA-12-049), February 27, 2015 (ADAMS Accession No. ML15058A264)

15. Letter from Jack R. Davis (NRC) to All Operating Reactor Licensees and Holders of Construction Permits, "Nuclear Regulatory Commission Audits of Licensee Responses to Mitigation Strategies Order EA-12-049," August 28, 2013 (ADAMS Accession No. ML13234A503)

16. Letter from Jeremy S. Bowen, NRC, to Exelon, Three Mile Island Nuclear Station, Unit 1

- Interim Staff Evaluation and Audit Report, Relating to Overall Integrated Plan in Response to Order EA-12-049 Mitigation Strategies, December 17, 2013 (ADAMS Accession No. ML13225A552)

17. Letter from John D. Hughey, NRC, to Exelon, Three Mile Island Nuclear Station, Unit 1 -

Report for the Audit Regarding Implementation of Mitigating Strategies and Reliable Spent Fuel Pool Instrumentation Related to Orders EA-12-049 and EA-12-051, January 11 , 2016 (ADAMS Accession No. ML15357A102)

18. Letter from Exelon to NRC, Three Mile Island, Unit 1, Report of Full Compliance with March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA 049) June 29, 2016 (ADAMS Accession No. ML16183A025)

19. NRC, "Request for Information Pursuant to Title 1O of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3, of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident," March 12, 2012 (ADAMS Accession No. ML12053A340)

20. SRM-COMSECY-14-0037, "Staff Requirements - COMSECY-14-0037- Integration of Mitigating Strategies For Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards," March 30, 2015, (ADAMS Accession No. ML15089A236)

21. Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), "Staff Assessment of National SAFER Response Centers Established In Response to Order EA-12-049,"

September 26, 2014 (ADAMS Accession No. ML14265A107)

22. Letter from Exelon to NRC, Three Mile Island Nuclear Station, Unit 1, "Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)," February 28, 2013 (ADAMS Accession No. ML13063A540)

23. Letter from NRC to Exelon, "Three Mile Island Nuclear Station, Unit 1 - Request For Additional Information Regarding Overall Integrated Plan in Response to Order Number EA-12-051, "Reliable Spent Fuel Pool Instrumentation (TAC No. MF0866)," June 26, 2013 (ADAMS Accession No. ML13176A470)

24. Letter from Exelon, Three Mile Island Nuclear Station, Unit 1, to NRC, "Response to Request for Additional Information - Overall Integrated Plan in Response to Commission Order Modifying License Requirements for Reliable Spent Fuel Pool Instrumentation (Order No. EA-12-051)," July 24, 2013 (ADAMS Accession No. ML13205A305)

25. Letter from NRC to Exelon, "Three Mile Island Nuclear Station, Unit 1 - Interim Staff Evaluation and Request For Additional Information Regarding Overall Integrated Plan in Response to Order Number EA-12-051, "Reliable Spent Fuel Pool Instrumentation (TAC MF0866)," dated November 13, 2013 (ADAMS Accession No. ML13308C188)

26. Letter from Exelon to NRC, "Three Mile Island, Unit 1, First Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Spent Fuel Pool Instrumentation (Order Number EA-12-051)," August 28, 2013 (ADAMS Accession No. ML13241A036)

27. Letter from Exelon to NRC, "Three Mile Island, Unit 1 - Second Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Spent Fuel Pool Instrumentation (Order Number EA-12-051) ,"

February 28, 2014 (ADAMS Accession No. ML14059A228)

28. Letter from Exelon to NRC, "Three Mile Island, Unit 1, Third Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Spent Fuel Pool Instrumentation (Order Number EA-12-051)," August 28, 2014 (ADAMS Accession No. ML14241A300)

29. Letter from Exelon to NRC, "Three Mile Island, Unit 1 - Fourth Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Spent Fuel Pool Instrumentation (Order Number EA-12-051),"

February 27, 2015 (ADAMS Accession No. ML15058A255)

30. Letter from Exelon to NRC, "Three Mile Island, Unit 1 - Fifth Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Spent Fuel Pool Instrumentation (Order Number EA-12-051)," August 28, 2015 (ADAMS Accession No. ML15243A104)

31. Letter from Exelon to NRC, "Three Mile Island, Unit 1 - Report of Full Compliance with March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA-12-051 ),"January 20, 2016 (ADAMS Accession No. ML16020A026)

32. NRC letter, "Watts Bar Nuclear Plant, Units 1 and 2 - Report for the Westinghouse Audit in Support of Reliable Spent Fuel Instrumentation Related to Order EA-12-051 (TAC Nos. MF0951 And MF1178)," August 18, 2014 (ADAMS Accession No. ML14211A346)

33. NRC Office of Nuclear Reactor Regulation Office Instruction LIC-111, "Regulatory Audits," December 16, 2008 (ADAMS Accession No. ML082900195)

34. Letter from William Dean (NRC) to Power Reactor Licensees, "Coordination of Requests for Information Regarding Flooding Hazard Reevaluations and Mitigating Strategies for Beyond-Design Bases External Events, dated September 1, 2015 (ADAMS Accession No. ML15174A257)

35. NEI Position Paper: "Shutdown/Refueling Modes", dated September 18, 2013 (Adams Accession No. ML13273A514)

36. Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), regarding NRC endorsement of NEI Position Paper: "Shutdown/Refueling Modes", dated September 30, 2013 (ADAMS Accession No. ML13267A382)

37. Letter from Nicholas Pappas (NEI) to Jack R. Davis (NRC) regarding FLEX Equipment Maintenance and Testing, October 3, 2013 (ADAMS Accession No. ML13276A573)

38. Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), regarding NRC endorsement of the use of the EPRI FLEX equipment maintenance report, October 7, 2013 (ADAMS Accession No. ML13276A224)

39. Letter from Exelon to NRC, "Three Mile Island, Unit 1, Supplemental Information - Final Integrated Plan in Response to the Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events December 1, 2016 (ADAMS Accession No. ML16336A446)

40. COMSECY-14-0037, "Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards," November 21, 2014 (ADAMS Accession No. ML14309A256)

41. Letter from Nicholas Pappas (NEI) to Jack R. Davis (NRC) regarding alternate approach to NEI 12-06 guidance for hoses and cables, May 1, 2015 (ADAMS Accession No. ML15126A135)

42. Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), regarding NRC endorsement of NEl's alternative approach to NEI 12-06 guidance for hoses and cables, May 18, 2015 (ADAMS Accession No. ML15125A442)

43. Letter from Exelon to NRC, Three Mile Island, Unit 1 - Fifth Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events (Order Number EA-12-049), August 28, 2015 (ADAMS Accession No. ML15243A088)

44. Letter from Exelon to NRC, Three Mile Island, Unit 1 - Sixth Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events (Order Number EA-12-049), February 26, 2016 (ADAMS Accession No. ML16057A010)

45. U.S. Nuclear Regulatory Commission, "Mitigation of Beyond-Design-Basis Events,"

Federal Register, Vol. 80, No. 219, November 13, 2015, pp. 70610-70647.

46. Nuclear Energy Institute document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Rev. 2, December 31, 2015 (ADAMS Accession No. ML16005A625)

47. JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," Rev. 1, January 22, 2012 (ADAMS Accession No. ML15357A163)

Principal Contributors: A. Roberts M. McConnell K. Nguyen B. Lee M. Levine J. Hughey D. Johnson (MTS)

Date: February 14, 2017

ML17025A409 *via e-mail OFFICE NRR/JLD/JOMB/PM NRR/JLD/LA NRR/JLD/JERB/BC

• NRR/JLD/JCBB/BC

• NAME JHughey SLent SBailey SBailey DATE 1/ 30/2017 1/27/2017 1/31/2017 1/31/2017 OFFICE NRR/JLD/JOMB/BC(A)

NAME MHalter DATE 2/14/2017