2CAN042301, License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
 
Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:Phil Couture Sr. Manager Fleet Regulatory Assurance - Licensing 601-368-5102 10 CFR 50.90 2CAN042301 April 5, 2023 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001
{{#Wiki_filter:}}
 
==Subject:==
License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4" Arkansas Nuclear One - Unit 2 NRC Docket No. 50-368 Renewed Facility Operating License No. NPF-6
 
==References:==
: 1)  Letter from the Technical Specification Task Force (TSTF) to the Nuclear Regulatory Commission (NRC), "TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, 'Provide Risk-Informed Extended Completion Times' and Submittal of TSTF-505, Revision 2,"
(ML18183A493), July 2, 2018
: 2)  Letter from NRC to the TSTF, "Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b'," (ML18253A085), dated November 21, 2018 In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, "Application for Amendment of License, Construction Permit, or Early Site Permit," Entergy Operations, Inc. (Entergy) is submitting a request for an amendment to the Technical Specifications (TSs) for Arkansas Nuclear One, Unit 2 (ANO-2).
The proposed amendment would modify the ANO-2 TS requirements to permit the use of Risk-Informed Completion Times (RICT) in accordance with TSTF-505, Revision 2, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b" (Attachment 3 of Reference 1). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (Reference 2).
* Attachment 1 provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific variations.
* Attachment 2 provides the existing TS pages marked up to show the proposed changes.
Entergy Operations, Inc., 1340 Echelon Parkway, Jackson, MS 39213
 
2CAN042301 Page 2 of 3
* Attachment 3 provides revised (retyped) TS pages.
* Attachment 4 provides existing TS Bases pages for ANO-2 marked up to show the proposed changes and is provided for information only.
* Attachment 5 provides a cross-reference between the TS included in TSTF-505, Revision 2, and the ANO-2 plant-specific TS.
* Enclosures 1-12 are included in accordance with Section 4.0, "Limitations and Conditions," of the safety evaluation for Nuclear Energy Institute (NEI) 06-09-A (ML071200238).
This letter contains no new regulatory commitments.
Entergy requests approval of the proposed license amendment within 13 months from the date of this submittal with implementation within 180 days following NRC approval.
Entergy has determined that there are no significant hazards considerations associated with the proposed change and that the TS change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9).
In accordance with 10 CFR 50.91, "Notice for Public Comment; State Consultation," Entergy is notifying the State of Arkansas of this amendment request by transmitting a copy of this letter and enclosures to the designated State Official.
If there are any questions or if additional information is needed, please contact Riley Keele, Manager, Regulatory Assurance, Arkansas Nuclear One, at 479-858-7826.
I declare under penalty of perjury that the foregoing is true and correct. Executed on this 5th day of April 2023.
Sincerely, Philip          Digitally signed by Philip Couture Couture          Date: 2023.04.05 08:57:59 -05'00' PC/mar Attachments:
: 1. Evaluation of the Proposed Change
: 2. Technical Specification Page Markups
: 3. Retyped Technical Specification Pages
: 4. Technical Specification Bases Page Markups (Information Only)
: 5. ANO-2 Technical Specification TSTF-505 Cross-Reference
 
2CAN042301 Page 3 of 3
 
==Enclosures:==
: 1. List of Revised Required Actions to Corresponding Probabilistic Risk Analysis (PRA)
Functions
: 2. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2
: 3. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2
: 4. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models
: 5. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)
: 6. Justification of Application of At-Power PRA Models to Shutdown Modes
: 7. PRA Model Update Process
: 8. Attributes of the Real-Time Risk Model
: 9. Key Assumptions and Sources of Uncertainty
: 10. Program Implementation
: 11. Monitoring Program
: 12. Risk Management Action Examples cc:    NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Designated Arkansas State Official
 
Attachment 1 2CAN042301 Evaluation of the Proposed Change 2CAN042301 Page 1 of 11 Evaluation of the Proposed Change 1.0   
 
==SUMMARY==
DESCRIPTION The proposed amendment would modify the Technical Specification (TS) requirements related to Completion Times (CTs) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). A new program, the Risk Informed Completion Time Program, is added to TS Section 5, "Administrative Controls."
The methodology for using the RICT Program is described in Nuclear Entergy Institute (NEI) 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, which was approved by the NRC on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program.
The proposed amendment is consistent with Technical Specification Task Force (TSTF)
TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b;" however, only those Required Actions described in Attachment 5 and Enclosure 1, as reflected in the proposed TS markups provided in Attachment 2, are proposed to be changed, because some of the modified Required Actions in TSTF-505 are not applicable to Arkansas Nuclear One, Unit 2 (ANO-2), and there are some plant-specific Required Actions not included in TSTF-505 that are included in this proposed amendment.
2.0    ASSESSMENT 2.1    Applicability of Published Safety Evaluation Entergy Operations, Inc. (Entergy) has reviewed TSTF-505, Revision 2, and the model safety evaluation (SE) dated November 21, 2018. This review included the supporting information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, Entergy has concluded that the technical basis is applicable to ANO-2 and supports incorporation of this amendment in the ANO-2 TS.
2.2    Verifications and Regulatory Commitments In accordance with Section 4.0, "Limitations and Conditions," of the safety evaluation for NEI 06-09-A, the following is provided:
: 1. Enclosure 1 identifies each of the TS Required Actions to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the probabilistic risk assessment (PRA) of the structures, systems and components (SSCs) subject to those actions.
: 2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as required by Regulatory Guide (RG) 1.200, Section 4.2.
: 3. Enclosure 3 is not applicable because each PRA model used for the RICT Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.
2CAN042301 Page 2 of 11
: 4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.
: 5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.
: 6. Enclosure 6 is not applicable because the RICT Program is not being applied to shutdown modes.
: 7. Enclosure 7 provides a discussion of the licensee's programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.
: 8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified to assess real time configuration risk, and describes the scope of, and quality controls applied to, the real-time model.
: 9. Enclosure 9 provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.
: 10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.
: 11. Enclosure 11 provides a description of the implementation and monitoring program.
: 12. Enclosure 12 provides a description of the process to identify and provide RMAs.
2.3    Optional Changes and Variations Entergy is proposing variations from the TS changes described in TSTF-505, Revision 2, or the applicable parts of the NRC staffs model SE dated November 21, 2018. These options were recognized as acceptable variations in TSTF-505 and the NRC model safety evaluation or are otherwise justified.
The ANO-2 TSs are modeled after the original Combustion Engineering (CE) standard TSs of NUREG-0212 and, therefore, utilize different numbering and titles than the NUREG-1432, "Standard Technical Specification Combustion Engineering Plants" (STS), Revision 3.0, on which TSTF-505 was based. In addition, the Conditions and Required Actions along with the associated Completion Times of the STS are simply referred to as Actions and Allowable Outage Times (AOTs) in the ANO-2 TSs. These differences are administrative and do not affect the applicability of TSTF-505 to the ANO-2 TSs.
A cross-reference of the TSTF-505 STS changes versus the changes to the ANO-2 TSs is provided in Attachment 5. Attachment 5 provides individual dispositions of each STS and ANO-2 change. Where the changes are identical, a disposition of "no variation" is provided.
Where a variation exists, the disposition provides a cross-reference to the paragraph in this attachment that provides justification.
2CAN042301 Page 3 of 11 2.3.1    Administrative Variations The following ANO-2 TS variations from the TSTF-505 template for NUREG-1432 are considered to be administrative in nature. Note that the ANO-2 design includes Core Protection Calculators (CPCs) and Control Element Assembly Calculators (CEACs); therefore, ANO-2 is considered a "digital" plant.
2.3.1.1  ANO-2 TS Limiting Conditions for Operation (LCOs) and Actions with alpha-numeric designations that differ from the corresponding NUREG-1432 LCOs or Required Actions (as applicable), have wording that may be different, and/or have differing existing AOTs with a similar intent are administrative variations from TSTF-505 with no effect on the NRC staff's model SE.
2.3.1.2  For NUREG-1432 LCOs and Required Actions that are not contained in the ANO-2 TS, the corresponding NUREG-1432 markups included in TSTF-505 for these Required Actions and Completion Times are not applicable to ANO-2. These are administrative variations from TSTF-505 with no effect on the NRC staff's model SE.
2.3.1.3  Various TSTF-505, Section 3.3, instrumentation Actions are invoked by instrumentation functions contained in tables. The analogous ANO-2 instrument functions may have different Actions referenced or have different wording. This includes differences in numbering and/or lettering in the tables. These are administrative variations from TSTF-505 that meet the criteria for administering a RICT and have no effect on the NRC staff's model SE.
2.3.1.4  TSTF-505 applies RICT to certain Required Actions that require additional plant-specific justification. In some cases, the ANO-2 design does not support the necessary justification; therefore, a RICT has not been applied. For example, as the proposed ANO-2 RICT Program is applicable in Modes 1 and 2, Entergy will not adopt changes in TSTF-505 for Required Actions that are only applicable in Mode 3 and below.
2.3.1.5  A RICT is not adopted for certain ANO-2 TSs that may be contained in the TSTF-505 markups because the function was not adequately modeled in the PRA or an appropriate surrogate was not available.
2.3.1.6  STS 3.6.3, "Containment Isolation Valves (Atmospheric and Dual)," differentiates between penetrations that have two or more containment isolation valves (CIVs),
CIVs associated with the containment sump supply to the Emergency Core Cooling System (ECCS), and penetrations with one CIV and a closed system. ANO-2 TS 3.6.3.1 does not specify the penetration configuration, but applies the same 4-hour AOT to any penetration having an inoperable CIV. In addition, ANO-2 TS 3.6.3.1, Actions a, b, and c, provide options to restore the CIV, isolate the penetration by a de-activated automatic valve, or isolate the penetration via a manual valve or blind flange, respectively; the STS Actions require isolation but do not state a requirement to restore the CIV. Applying a RICT to ANO-2 TS 3.6.3.1, Actions a, b, and c, meets the intent of the TSTF-505 changes associated with STS 3.6.3. Therefore, this is an administrative variation from TSTF-505 that meets the criteria for administering a RICT and has no effect on the NRC staff's model SE.
2CAN042301 Page 4 of 11 2.3.1.7  The following ANO-2 TS Actions governing combinations of inoperable equipment repeat the associated individual action for each component.
* TS 3.6.2.3, "Containment Cooling System," Action b (associated with two inoperable containment groups), requires restoration of one containment cooling group within 72 hours and the remaining containment cooling group within 7 days (the latter being a repeat of Action a).
* TS 3.6.2.3, Action c (associated with coincident inoperability of one containment group and one containment spray train), requires restoration of the containment spray train within 72 hours and the containment cooling group within 7 days (the latter being a repeat of Action a).
* TS 3.8.1.1, "A.C. Sources," Action c.5 (associated with coincident inoperability of one diesel generator (DG) and one offsite circuit) requires restoration of one of these sources within 12 hours and restoration of the remaining inoperable source within 72 hours (offsite circuit) or 14 days (DG), the latter being a repeat of Actions a and b, respectively.
* TS 3.8.1.1, Action d.4 (associated with two inoperable offsite circuits) requires restoration of one offsite circuit within 24 hours and restoration of the remaining inoperable offsite circuit within 72 hours (the latter being a repeat of Action a).
* TS 3.8.1.1, Action e.3 (associated with two inoperable DGs) requires restoration of one DG within 2 hours and restoration of the remaining inoperable DG within 14 days (the latter being a repeat of Action b).
Application of the NUREG-0212 ANO-2 standard TSs only requires entry into an Action that specifically states the current configuration of the associated equipment, which is why the above Actions for combinations of inoperable equipment repeat Actions associated with inoperability of single component (i.e., prevent resetting the AOT by exiting the combined Action and entering the Action governing single component inoperability). Because TSTF-505 applies a RICT to all of these configurations (single and combined inoperabilities), Entergy proposes to apply the RICT where the Actions for single component inoperabilities are repeated, consistent with the intent of TSTF-505. Entergy considers this an administrative variation from TSTF-505 that meets the criteria for administering a RICT and has no effect on the NRC staff's model SE.
2.3.1.8  TS 3.8.1.1, Actions b.4, c.5, and e.3, are modified by Note 1 which limits the time a DG may remain inoperable from 14 days to 72 hours if the Alternate AC Diesel Generator (AACDG) becomes unavailable during the DG restoration period. Since a RICT can be applied to one inoperable DG, the standard RICT statement is added to Note 1, allowing the 72-hour AOT to be extended, if calculated to be acceptable per the Risk Informed Completion Time Program. Entergy considers this an administrative variation from TSTF-505 that meets the criteria for administering a RICT and has no effect on the NRC staff's model SE.
2CAN042301 Page 5 of 11 2.3.1.9  The TSTF-505 markup of STS 3.8.4, "DC Sources - Operating," applies a RICT to Required Actions B.1 (inoperable battery) and C.1 (DC electrical power subsystem inoperable for other reasons). ANO-2 TS 3.8.2.3 does not contain a separate Action for an inoperable battery; therefore, a RICT will only be applied to Action b (one DC electrical power subsystem inoperable for reasons other than Action a), consistent with the intent of TSTF-505. This is an administrative variation from TSTF-505 that meet the criteria for administering a RICT and has no effect on the NRC staff's model SE.
2.3.1.10 TSTF-505 applies a RICT to the STS 3.8.9, "Distribution Systems - Operating,"
Actions for AC electrical power subsystems, AC vital buses, and DC electrical power subsystems (Required Actions A.1, B.1, and C.1, respectively). ANO-2 TS 3.8.2.1, "A.C. Distribution - Operating," contains only one Action covering the inoperability of any single AC distribution subsystem or bus. The RICT is applied to this single action, consistent with the intent of TSTF-505. Inoperability of a DC electrical power subsystem is addressed in ANO-2 TS 3.8.2.3, "DC Sources - Operating," Action b, to which a RICT is added in association with the TSTF-505 markup for STS 3.8.4, "DC Sources - Operating." These are administrative variations from TSTF-505 that meet the criteria for administering a RICT and have no effect on the NRC staff's model SE.
2.3.1.11 The addition of the RICT Program to Section 6.5.20 of the ANO-2 TSs required information to be included on two pages due to space limitations, creating a new page in this section. This is an administrative variation from TSTF-505 with no effect on the NRC staff's model SE.
2.3.2  Technical Variations The following variations from the TSTF-505 template for NUREG-1432 are considered to be technical in nature.
2.3.2.1  TSTF-505 does not apply a RICT to inoperable CEACs. With one CEAC inoperable both STS 3.3.3, "Control Element Assembly Calculators (CEACs) (Digital)," and ANO-2 TS 3.3.1.1 require restoration within 7 days. The CEACs provide penalty factors to the Core Protection Calculators (CPCs) due to various Control Element Assembly (CEA) deviations. The four CPC channels provide a reactor trip when various parameter limits are exceeded (including receipt of large penalty factors from the CEACs). With one of the two CEACs inoperable, a loss of safety function does not exist since the CPCs will use the higher of the inputs from the operable CEAC and the last remaining valid signal from the inoperable CEAC. Therefore, a RICT may be applied to ANO-2 TS 3.3.1.1, Table 3.3-1, Action 6. A detailed description of the ANO-2 CEACs and interactions with the CPCs and Reactor Protective System (RPS) is included in Enclosure 1.
2.3.2.2  Condition A of the TSTF-505 STS 3.3.4, "Reactor Protective System (RPS) Logic and Trip Initiation (Digital)," markup contains two conditions for which a RICT may be applied: 1) one matrix logic channel inoperable, or 2) three matrix logic channels inoperable due to a common power source failure deenergizing three matrix power supplies. Both the STS and ANO-2 state that there are six matrix logic channels.
ANO-2 TS 3.3.1.1, "Reactor Protective Instrumentation," Table 3.3-1, requires only 2CAN042301 Page 6 of 11 three of the six matrix logic channels to be operable. With only two matrix logic channels operable, the third channel must be restored to an operable status within 48 hours, consistent with the Completion Time of STS 3.3.4, Required Action A.1.
The STS requires remedial action to be completed within 48 hours when three matrix channels are inoperable (due to power supply failure) while remedial action is not required by the ANO-2 TSs until four channels are inoperable. Assuming no single failure at the onset of an accident, two matrix logic channels are sufficient to ensure a reactor trip automatically occurs when one or more parameters exceed the respective trip setpoint. Therefore, assuming no single failure, a loss of safety function does not exist when at least two matrix logic channels remain operable. Subsequently, a RICT may be applied to ANO-2 TS 3.3.1.1, Table 3.3-1, Action 1. A detailed description of the ANO-2 RPS matrix logic channels is included in Enclosure 1.
2.3.2.3 TSTF-505 does not apply a RICT to STS 3.3.6, "Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip (Digital)," Condition A, for an inoperable matrix logic channel. However, TSTF-505 does apply a RICT to an inoperable RPS matrix logic channel. Other than differing parameter inputs, there is no functional difference between the RPS and ESFAS matrix logic designs (both have six channels and input to the four downstream initiation logic channels). Therefore, it is reasonable that a RICT may also be applied to the ESFAS matrix logic channels.
STS 3.3.6, Condition A, covers configurations where one or more functions with one matrix logic channel is inoperable and is modified by a Note stating that the Condition also applies when three matrix logic channels are inoperable due to a common power source failure deenergizing three matrix power supplies. Both the STS and ANO-2 state that there are six matrix logic channels. ANO-2 TS 3.3.2.1, "Engineered Safety Features Actuation System Instrumentation," Table 3.3-3, requires only three of the six matrix logic channels to be operable. With only two matrix logic channels operable, the third channel must be restored to an operable status within 48 hours, consistent with the Completion Time of STS 3.3.6, Required Action A.1.
The STS requires remedial action to be completed within 48 hours when three matrix channels are inoperable (due to power supply failure) while remedial action is not required by the ANO-2 TSs until four channels are inoperable. Assuming no single failure at the onset of an accident, two matrix logic channels are sufficient to ensure a respective ESFAS actuation automatically occurs when one or more parameters exceed the respective trip setpoint. Therefore, assuming no single failure, a loss of safety function does not exist when at least two matrix logic channels remain operable.
Subsequently, a RICT may be applied to ANO-2 TS 3.3.2.1, Table 3.3-3, Action 12.
A detailed description of the ANO-2 ESFAS matrix logic channels is included in Enclosure 1.
2.3.2.4 TSTF-505 does not apply a RICT to the Actions of STS 3.3.7, "Diesel Generator (DG) -
Loss of Voltage Start (LOVS) (Digital)," since Condition A requires remedial action within 1 hour with one or more functions with one channel inoperable. STS LCO 3.3.7 states that four channels of the loss of voltage (LOV) function and four channels of the degraded voltage (DV) function are required to be operable. The ANO-2 design differs significantly from the generic STS design. In addition, ANO-2 TS 3.3.2.1, Table 3.3-3, Actions 9 and 14.b, permit 48 hours to restore an inoperable LOV channel, and Action 14.b permits 48 hours to restore an inoperable DV channel.
2CAN042301 Page 7 of 11 The ANO-2 design consists of two LOV relays on each of the two 4.16 kV vital switchgear. Actuation of either LOV relay on a 4.16 kV vital switchgear will divorce the switchgear from offsite power and auto-start the respective Diesel Generator (DG).
Assuming no single failure, no loss of function on either vital electrical train would exist. While coincident failure of the remaining relay would prevent these automatic actions on the affected train, the remaining vital electrical train would remain available to support specified safety functions. In addition, the affected bus could be manually energized from the respective DG as needed.
The ANO-2 design consists of two TS-required DV relays on each of the two 460 V vital load centers (other non-TS motor start protection relays also are installed which will perform similar automatic actions). Actuation of both DV relays on a given 460 V vital load center will divorce the affected electrical train from offsite power and auto-start the respective DG. Assuming no single failure, no loss of function would exist since the redundant train remains available to perform the associated specified safety functions. Failure of a required DV relay on the redundant train during an actual undervoltage event could result in a temporary loss of all vital 460 VAC power until the load centers are manually connected to its 4.16 kV vital switchgear.
Because a loss of safety function does not exist due to a loss of one or both LOV relays on a single train or one DV relay on a single train, a RICT may be applied to ANO-2 TS 3.3.2.1, Table 3.3-3, Actions 9 and 14.b. Note also that Action 14.a (which applies to both the LOVs and the DVs) requires the respective DG to immediately be declared inoperable, which applies additional remedial actions and associated AOTs.
A detailed description of the ANO-2 LOV and DV relay channels is included in Enclosure 1.
2.3.2.5 The TSTF-505 STS 3.6.6A, "Containment Spray and Cooling Systems (Atmospheric and Dual)," does not apply a RICT to Required Action G.1 (both Containment Spray trains are inoperable). Required Action G.1 requires immediate entry into LCO 3.0.3.
The TSTF-505 STS markups were based on Revision 3 of NUREG 1432. With respect to inoperability of two Containment Spray trains, NUREG 1432, Revision 5 (STS 3.6.6A, Required Action C.2), and ANO-2 TS 3.6.2.1, "Containment Spray System," Action b.2, allow 24 hours to restore at least one of the Containment Spray trains to an operable status. Entergy proposes to apply a RICT to this configuration.
The Containment Spray System (CSS) and the Containment Cooling System (CCS) function to limit the pressure and temperature within the Containment Building during post-accident conditions. The CSS also supports iodine removal from the Containment Building atmosphere during the long-term recirculation phase post-accident. With both Containment Spray trains inoperable, the Containment Cooling System, consisting of two service water supplied containment cooling units per train, is capable of providing the necessary post-accident heat removal function such that design pressure and temperature limits of the Containment Building are not exceeded.
The 24-hour AOT provided is limited by two conditions: 1) both Control Room Emergency Ventilation System (CREVS) trains must be operable, and 2) the 24-hour AOT cannot be applied if the second Containment Spray train was intentionally made inoperable. The AOT is based on WCAP-16125-NP-A, "Justification for Risk-Informed 2CAN042301 Page 8 of 11 Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2 (August 2010), which demonstrated that the 24-hour AOT is acceptable based on the redundant heat removal capabilities afforded by the CCS, the iodine removal capability of the CREVS, the infrequent use of the action, and the small incremental effect on plant risk.
Because 24 hours may be insufficient to restore at least one of the Containment Spray trains to operable status, applying a RICT in this configuration may permit avoiding challenges to remaining safety systems due to inherent transient risks of a TS-required plant shutdown. In addition, ANO-2 TS 3.6.2.3, "Containment Cooling System,"
requires the unit to be shut down if any of the four containment cooling fans are inoperable when both CSS trains are inoperable (i.e., TS 3.6.2.3 does not contain a specific Action for this configuration; therefore, a unit shutdown is required). Based on the above, application of a RICT to ANO-2 TS 3.6.2.1, Action b.2, is acceptable.
2.3.2.6  ANO-2 TS 3.7.1.2, "Emergency Feedwater (EFW) System," Action c, addresses conditions where a turbine-driven EFW train is inoperable due to one inoperable steam supply AND the motor-driven EFW train is also inoperable. In this event, either the inoperable steam supply or the motor-driven EFW train must be restored within 24 hours. TSTF-505 applies a RICT to either of the aforementioned inoperabilities; however, STS 3.7.5 does not contain an action addressing an inoperable steam supply coincident with an inoperable motor-driven EFW pump. Entergy is proposing to apply a RICT to ANO-2 TS 3.7.1.2, Action c.
The risk associated with coincident inoperability of an inoperable steam supply and an inoperable motor-driven EFW pump can be quantified by the ANO-2 PRA model. In addition, assuming no single failure of the remaining steam supply to the turbine-driven EFW pump, a loss of safety function can only occur if a steam line break on the steam generator supplying steam via the remaining operable steam supply valve were to occur. Because the ANO-2 PRA model can also quantify the potential of a steam line break occurring, a RICT may be applied to this unique ANO-2 Action.
2.4    Bases Changes Revised TS Bases are provided in Attachment 4 for NRC information. TS Bases revisions will be incorporated as an implementing action pursuant to TS 6.5.14, "Technical Specifications (TS) Bases Control Program," following issuance of the amendment.
The non-STS ANO-2 TS Bases are not comparable with the STS Bases. Therefore, where Actions are not discussed in an associated TS Bases, no reference to the RICT Program is added. Subsequently, the following ANO-2 TS Bases remain unchanged:
* TS 3.3.1.1 (Reactor Protective System (RPS)), Action 1, Matrix Logic Channels
* TS 3.3.1.1 (RPS), Action 6.a, Control Element Assembly Calculators (CEACS)
* TS 3.3.2.1 (Engineered Safety Features Actuation System (ESFAS)), Action 9, Manual Trip Buttons and Initiation Logic Channels. However, reference to the RICT is added to the Action 9 discussion associated with 4.16 V vital switchgear loss of voltage relays (discussed in Technical Variations Section 2.3.2.4 below).
2CAN042301 Page 9 of 11
* TS 3.3.2.1 (ESFAS), Action 12, Matrix Logic Channels
* TS 3.3.2.1 (ESFAS), Action 13, Automatic Actuation Logic Channels
* TS 3.3.2.1 (ESFAS), Action 14.b, 460 V Degraded Voltage Relays
* TS 3.6.1.3 (Containment Air Locks), Action c.2
* TS 3.6.2.3 (Containment Cooling System), Actions a, b, and c, Containment Cooling Groups and/or Containment Spray Train
* TS 3.6.3.1 (Containment Isolation Valves), Actions a, b, and c
* TS 3.7.3.1 (Service Water), Action a
* TS 3.8.1.1 (AC Sources), Actions a.3, d.3, and d.4, Offsite Circuits
* TS 3.8.1.1 (AC Sources), Actions c.4, and c.5, Offsite Circuit and DG
* TS 3.8.1.1 (AC Sources), Action e.3, DG
* TS 3.8.2.1 (AC Distribution), Action, Vital AC Buses This is an administrative variation from TSTF-505 with no effect on the NRC staff's model SE.
 
==3.0    REGULATORY ANALYSIS==
 
3.1    No Significant Hazards Consideration Entergy Operations, Inc. (Entergy) has evaluated the proposed change to the Technical Specifications (TSs) using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.
Entergy requests Arkansas Nuclear One, Unit 2 (ANO-2) adoption of an approved change to the standard technical specifications (STS) and plant-specific TS to modify the TS requirements related to Completion Times ("allowed outage times" as used in the ANO-2 TSs) for TS Actions, providing an option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Chapter 5, "Administrative Controls," entitled the "Risk Informed Completion Time Program."
2CAN042301 Page 10 of 11 As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:
: 1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?
Response: No.
The proposed change permits the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change does not involve a significant increase in the probability of an accident previously evaluated because the change involves no change to the plant or its modes of operation. The proposed change does not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time are no different from those during the existing Completion Time.
Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.
: 2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?
Response: No.
The proposed change does not change the design, configuration, or method of operation of the plant. The proposed change does not involve a physical alteration of the plant (no new or different kind of equipment will be installed). Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.
: 3. Does the proposed change involve a significant reduction in a margin of safety?
Response: No.
The proposed change permits the extension of Completion Times provided risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change implements a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS.
Therefore, the proposed change does not involve a significant reduction in a margin of safety.
Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.
2CAN042301 Page 11 of 11 3.2    Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with NRC regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.
 
==4.0    ENVIRONMENTAL CONSIDERATION==
 
The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.
 
Attachment 2 2CAN042301 Technical Specification Page Markups (20 Pages)
 
TABLE 3.3-1 (Continued)
TABLE NOTATION
* With the protective system trip breakers in the closed position and the CEA drive system capable of CEA withdrawal.
(a)  Trip may be manually bypassed above 10-4% power; bypass shall be automatically removed before decreasing below 10-4% power.
(b)  Trip may be manually bypassed below 400 psia; bypass shall be automatically removed before pressurizer pressure exceeds 500 psia.
(c)  Trip may be manually bypassed below 10-2% power; bypass shall be automatically removed before exceeding 10-2% power. During testing pursuant to Special Test Exception 3.10.3, trip may be manually bypassed below 1% power; bypass shall be automatically removed before exceeding 1% power.
(d)  Trip may be bypassed during testing pursuant to Special Test Exception 3.10.3.
(e)  See Special Test Exception 3.10.2.
(f)  Each channel shall be comprised of two trip breakers; actual trip logic shall be one-out-of-two taken twice.
ACTION STATEMENTS ACTION 1 -    With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT STANDBY within the next 6 hours and/or open the protective system trip breakers.
ARKANSAS - UNIT 2                            3/4 3-4                  Amendment No. 134,196,
 
TABLE 3.3-1 (Continued)
ACTION STATEMENTS ACTION 4 - With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, verify compliance with the SHUTDOWN MARGIN requirements of Specification 3.1.1.1 or 3.1.1.2, as applicable, within 1 hour and at least once per 12 hours thereafter.
ACTION 5 - With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, place the reactor trip breakers of the inoperable channel in the tripped condition within 1 hour or be in HOT STANDBY within 6 hours; however, one channel may be bypassed for up to 1 hour for surveillance testing per Specification 4.3.1.1.1.
ACTION 6 - a. With one CEAC inoperable, operation may continue for up to 7 days or in accordance with the Risk Informed Completion Time Program provided that at least once per 4 hours, each CEA is verified to be within 7 inches (indicated position) of all other CEAs in its group. After 7 days or after expiration of the Risk Informed Completion Time, whichever is longer, operation may continue provided that ACTION 6.b is met.
: b. With both CEACs inoperable, operation may continue provided that:
: 1. Within 1 hour the margin required by Specification 3.2.4.b (COLSS in service) or Specification 3.2.4.d (COLSS out of service) is satisfied.
: 2. Within 4 hours:
a)  All CEA groups are withdrawn within the limits of Specifications 3.1.3.5 and 3.1.3.6.b, except during surveillance testing pursuant to the requirements of Specification 4.1.3.1.2.
b)  The "RSPT/CEAC Inoperable" addressable constant in the CPCs is set to both CEACs inoperable.
c)  The Control Element Drive Mechanism Control System (CEDMCS) is placed in and subsequently maintained in the "OFF" mode except during CEA motion permitted by a) above, when the CEDMCS may be operated in either the "Manual Group" or "Manual Individual" mode.
ARKANSAS - UNIT 2                          3/4 3-5b          Amendment No. 24,49,79,149,159, 169,244,
 
TABLE 3.3-3 (Continued)
TABLE NOTATION (a) Trip function may be bypassed in this MODE when pressurizer pressure is below 400 psia; bypass shall be automatically removed before pressurizer pressure exceeds 500 psia.
(b) An SIAS signal is first necessary to enable CSAS logic.
(c) Remote manual not provided for RAS. These are local manuals at each ESF auxiliary relay cabinet.
ACTION STATEMENTS ACTION 9 -    With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 10 - With the number of channels OPERABLE one less than the Total Number of Channels, operation in the applicable MODES may continue provided the inoperable channel is placed in the bypassed or tripped condition within 1 hour.
If the inoperable channel is bypassed for greater than 48 hours, the desirability of maintaining this channel in the bypassed condition shall be reviewed as soon as possible but no later than the next regularly scheduled OSRC meeting in accordance with the Quality Assurance Program Manual (QAPM). The channel shall be returned to OPERABLE status prior to startup following the next COLD SHUTDOWN.
If an inoperable Steam Generator P or RWT Level - Low channel is placed in the tripped condition, remove the inoperable channel from the tripped condition within 48 hours or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 30 hours.
With a channel process measurement circuit that affects multiple functional units inoperable or in test, bypass or trip all associated functional units as listed below.
Process Measurement Circuit                    Functional Unit Bypassed
: 1. Containment Pressure - NR                    Containment Pressure - High (RPS)
Containment Pressure - High (ESFAS)
Containment Pressure - High-High (ESFAS)
: 2. Steam Generator 1 Pressure                  Steam Generator 1 Pressure - Low Steam Generator 1 P (ESFAS 1)
Steam Generator 2 P (ESFAS 2)
: 3. Steam Generator 2 Pressure                  Steam Generator 2 Pressure - Low Steam Generator 1 P (ESFAS 1)
Steam Generator 2 P (ESFAS 2)
ARKANSAS - UNIT 2                            3/4 3-14      Amendment No. 134,159,186,195,196, 216,255,289,301,
 
TABLE 3.3-3 (Continued)
TABLE NOTATION ACTION 12 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 13 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours; however, one channel may be bypassed for up to 1 hour for surveillance testing provided the other channel is OPERABLE.
LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 14 - With the number of OPERABLE 460 volt Degraded Voltage (Functional Unit 7.b) channels one less than the Total Number of Channels or with both 4.16 kv Loss of Voltage (Functional Unit 7.a) channels inoperable on a single bus:
: a. Immediately declare the affected diesel generator inoperable, and
: b. Restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ARKANSAS - UNIT 2                        3/4 3-15a                Amendment No. 301,327,
 
EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - Tavg  300 °F LIMITING CONDITION FOR OPERATION 3.5.2    Two independent ECCS subsystems shall be OPERABLE with each sub-system comprised of:
: a. One OPERABLE high-pressure safety injection (HPSI) train,
: b. One OPERABLE low-pressure safety injection (LPSI) train, and
: c. An independent OPERABLE flow path capable of taking suction from the refueling water tank on a Safety Injection Actuation Signal and automatically transferring suction to the containment sump on a Recirculation Actuation Signal.
APPLICABILITY:      MODES 1, 2 and 3 with pressurizer pressure  1700 psia.
ACTION:
: a. With one ECCS subsystem inoperable due to an inoperable LPSI train, restore the inoperable train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT STANDBY within the next 6 hours and reduce pressurizer pressure to < 1700 psia within the following 6 hours.
: b. With one or more ECCS subsystems inoperable due to conditions other than "a" above and 100% of ECCS flow equivalent to a single OPERABLE HPSI and LPSI train is available, restore the inoperable train(s) to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and reduce pressurizer pressure to
        < 1700 psia within the following 6 hours.
: c. With less than 100% ECCS flow equivalent to either the HPSI or LPSI trains within both ECCS subsystems, restore at least one HPSI train and one LPSI train to OPERABLE status within one hour or be in at least HOT STANDBY within the next 6 hours and reduce pressurizer pressure to < 1700 psia within the following 6 hours.
: d. In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the NRC within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date.
ARKANSAS - UNIT 2                            3/4 5-3                  Amendment No. 251,255,
 
CONTAINMENT SYSTEMS CONTAINMENT AIR LOCKS LIMITING CONDITION FOR OPERATION 3.6.1.3    Each containment air lock shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
: a. With one containment air lock door inoperable in one or more containment air locks1,2:
: 1. Verify that at least the OPERABLE air lock door is closed in the affected air lock within one hour and either restore the inoperable air lock door to OPERABLE status within 24 hours or lock the OPERABLE air lock door closed3.
: 2. Operation may then continue provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.
: b. With the containment air lock interlock inoperable in one or more containment air locks1:
: 1. Verify that at least one OPERABLE air lock door is closed in the affected air lock within one hour and restore the inoperable air lock interlock to OPERABLE status within 24 hours or lock an OPERABLE air lock door closed4.
: 2. Operation may then continue provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.
: c. With one or more air locks inoperable for reasons other than those addressed in ACTION a. or b.:
: 1. Immediately initiate action to evaluate overall containment leakage per LCO 3.6.1.2.
: 2. Verify that at least one door in the affected air lock is closed within one hour and restore the affected air lock to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next six hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
1 Separate ACTION entry is allowed for each air lock.
2 With both air locks inoperable, entry and exit is permissible for seven days under administrative controls.
3 Entry and exit is permissible to perform repairs on the affected air lock components.
4 Entry and exit is permissible under the control of a dedicated individual.
ARKANSAS - UNIT 2                              3/4 6-4                      Amendment No. 175,301,
 
CONTAINMENT SYSTEMS 3/4.6.2  DEPRESSURIZATION, COOLING, AND pH CONTROL SYSTEMS CONTAINMENT SPRAY SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.1    Two independent containment spray systems shall be OPERABLE with each spray system capable of taking suction from the RWT on a Containment Spray Actuation Signal (CSAS) and automatically transferring suction to the containment sump on a Recirculation Actuation Signal (RAS). Each spray system flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.
APPLICABILITY:      MODES 1, 2, and 3.
ACTION:
: a. With one containment spray system inoperable, restore the inoperable spray system to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.
: b. With both containment spray systems inoperable (Note 1):
: 1. Within 1 hour verify both CREVS trains are OPERABLE, and
: 2. Restore at least one containment spray system to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.
SURVEILLANCE REQUIREMENTS 4.6.2.1    Each containment spray system shall be demonstrated OPERABLE:
: a. In accordance with the Surveillance Frequency Control Program by:
: 1. Verify each containment spray manual, power operated, and automatic valve in the flow path that is not locked, sealed, or otherwise secured in position is in the correct position.
: 2. Verifying that the system piping is full of water from the RWT to at least elevation 505' (equivalent to > 12.5% indicated narrow range level) in the risers within the containment.
: b. Verify each containment spray pumps developed head at the flow test point is greater than or equal to the required developed head when tested pursuant to the INSERVICE TESTING PROGRAM.
Note 1: ACTION b is not applicable when the second containment spray system is intentionally made inoperable.
ARKANSAS - UNIT 2                            3/4 6-10          Amendment No. 194,233,252,268, 301,304,305,315,
 
CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3    Two independent containment cooling groups shall be OPERABLE with two operational cooling units in each group.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION1:
: a. With one group of the above required containment cooling units inoperable and both containment spray systems OPERABLE, restore the inoperable group of cooling units to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.
: b. With two groups of the above required containment cooling units inoperable and both containment spray systems OPERABLE, restore at least one group of cooling units to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. Restore both above required groups of cooling units to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, of initial loss.
: c. With one group of the above required containment cooling units inoperable and one containment spray system inoperable, restore the inoperable spray system to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. Restore the inoperable group of containment cooling units to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, of initial loss.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 1: The containment spray systems may be considered OPERABLE with respect to ACTIONs a, b, and c above if solely inoperable due to containment accident generated and transported debris exceeding the analyzed limits and LCO 3.6.4.1, ACTION a, is being met.
ARKANSAS - UNIT 2                            3/4 6-14      Amendment No. 16,29,226,301,318,
 
CONTAINMENT SYSTEMS 3/4.6.3    CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3.1      Each containment isolation valve shall be OPERABLE.*
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
Note: Enter applicable ACTION(s) for system(s) made inoperable by containment isolation valves.
With one or more isolation valve(s) inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and within 4 hours or in accordance with the Risk Informed Completion Time Program either:
: a. Restore the inoperable valve(s) to OPERABLE status within 4 hours, or
: b. Isolate each affected penetration within 4 hours by use of at least one deactivated automatic valve secured in the isolation position, or
: c. Isolate the affected penetration within 4 hours by use of at least one closed manual valve or blind flange; or
: d.      Otherwise, bBe in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.6.3.1.1    Each containment isolation valve shall be demonstrated OPERABLE prior to returning the valve to service after maintenance, repair or replacement work is performed on the valve or its associated actuator, control or power circuit by performance of a cycling test and verification of isolation time.
* Locked or sealed closed valves may be opened on an intermittent basis under administrative control.
ARKANSAS - UNIT 2                              3/4 6-16          Amendment No. 121,134,154,255, 301,327,
 
PLANT SYSTEMS EMERGENCY FEEDWATER (EFW) SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.2  Two EFW trains shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, and 3 ACTIONS:1 NOTE 1: Specification 3.0.4.b is not applicable.
NOTE 2: Only applicable if MODE 2 has not been entered following refueling.
NOTE 3: Not applicable when the turbine-driven EFW train is inoperable solely due to one inoperable steam supply.
NOTE 4: LCO 3.0.3 and all other LCO ACTIONS requiring MODE changes are suspended until one EFW train is restored to OPERABLE status.
: a. With the turbine-driven EFW train inoperable in MODE 3 following refueling2, OR with the turbine-driven EFW train inoperable due to one inoperable steam supply, restore the turbine-driven EFW train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.
: b. With one EFW train inoperable for reasons other than ACTION a, restore the inoperable train to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program.
: c. With the turbine-driven EFW train inoperable due to one inoperable steam supply AND the motor-driven EFW train inoperable, restore either the steam supply to the turbine-driven train OR the motor-driven EFW train to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
: d. With ACTION a, b, or c not met, be in HOT SHUTDOWN within the next 12 hours.
: e. With both EFW trains inoperable, immediately initiate action to restore one EFW train to an OPERABLE status.3,4 ARKANSAS - UNIT 2                            3/4 7-5      Amendment No. 51,136,188,233,281, 305,310,
 
PLANT SYSTEMS MAIN STEAM ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.7.1.5  Each main steam isolation valve shall be OPERABLE.
APPLICABILITY:    MODES 1, 2 and 3.
ACTION:
MODE 1    -  With one main steam isolation valve inoperable, POWER OPERATION may continue provided the inoperable valve is either restored to OPERABLE status or closed within 4 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT SHUTDOWN within the next 12 hours.
MODES 2    -  With one main steam isolation valve inoperable, subsequent operation in and 3          MODES 1, 2 or 3 may proceed provided the isolation valve is maintained closed; otherwise, be in HOT SHUTDOWN within the next 12 hours.
SURVEILLANCE REQUIREMENTS 4.7.1.5  Each main steam isolation valve shall be demonstrated OPERABLE by verifying full closure within 3 seconds when tested pursuant to the INSERVICE TESTING PROGRAM.
ARKANSAS - UNIT 2                        3/4 7-10          Amendment No. 233,281,305,323, Next page is 3/4 7-15
 
PLANT SYSTEMS 3/4.7.3    SERVICE WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.3.1      At least two independent service water loops shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
Notes:
: 1. Enter applicable ACTION(s) of LCO 3.8.1.1, "AC Sources - Operating," for diesel generator made inoperable by service water system.
: 2. Enter applicable ACTION(s) of LCO 3.4.1.3, "Reactor Coolant System - Shutdown," if a required shutdown cooling loop is made inoperable by service water system.
With only one service water loop OPERABLE, restore at least two loops to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.7.3.1      At least two service water loops shall be demonstrated OPERABLE:
: a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power operated or automatic) servicing safety related equipment that is not locked, sealed, or otherwise secured in position, is in its correct position.
: b. In accordance with the Surveillance Frequency Control Program during shutdown, by verifying that each automatic valve servicing safety related equipment actuates to its correct position on CCAS, MSIS and RAS test signals.
ARKANSAS - UNIT 2                              3/4 7-15              Amendment No. 301,315,327,
 
3/4.8  ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION 3.8.1.1    As a minimum, the following A.C. electrical power sources shall be OPERABLE:
: a. Two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system and
: b. Two separate and independent diesel generators each with:
: 1. A day fuel tank containing a minimum volume of 300 gallons of fuel,
: 2. A separate fuel storage system, and
: 3. A separate fuel transfer pump.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
NOTE: Specification 3.0.4.b is not applicable to diesel generators.
: a. With one offsite A.C. circuit of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of the remaining offsite A.C. circuit by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Within 24 hours from discovery of no offsite power to one train concurrent with inoperability of redundant required features(s), declare required features(s) with no offsite power available inoperable when its redundant required features(s) is inoperable, and
: 3. Restore the offsite A.C. circuit to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN. Startup Transformer No. 2 may be removed from service for up to 30 days as part of a preplanned preventative maintenance schedule. The 30-day allowance may be applied not more than once in a 10-year period.
ARKANSAS - UNIT 2                              3/4 8-1    Amendment No. 141,215,234,249,255, 281,301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: b. With one diesel generator of the above required A.C. electrical power source inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of both the offsite A.C. circuits by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Within 4 hours from discovery of one required diesel generator inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) supported by the inoperable diesel generator inoperable when its redundant required feature(s) is inoperable, and
: 3. Demonstrate the OPERABILITY of the remaining OPERABLE diesel generator within 24 hours by:
: i. Determining the OPERABLE diesel generator is not inoperable due to a common cause failure, or ii. Perform Surveillance Requirement 4.8.1.1.2.a.4 unless:
: a. The remaining diesel generator is currently in operation, or
: b. The remaining diesel generator has been demonstrated OPERABLE within the previous 24 hours, and
: 4. Restore the diesel generator to OPERABLE status within 14 days (See Note 1) or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 1 - If the Alternate A.C. Diesel Generator (AACDG) is determined to be inoperable during this period, then a 72 hour restoration or Risk Informed Completion Time period is applicable until either the AACDG or the diesel generator is returned to operable status (not to exceed 14 days or the Risk Informed Completion Time from the initial diesel generator inoperability).
ARKANSAS - UNIT 2                            3/4 8-1a              Amendment No. 249,301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: c. With one offsite A.C. circuit and one diesel generator of the above required A.C. electrical power sources inoperable (see Note 2), perform the following:
: 1. Demonstrate the OPERABILITY of the remaining offsite A.C. circuit by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter; and,
: 2. Within 4 hours from discovery of one required diesel generator inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) supported by the inoperable diesel generator inoperable if its redundant required feature(s) is inoperable, and
: 3. If the diesel generator became inoperable due to any cause other than preplanned preventative maintenance or testing, then
: i. Demonstrate the OPERABILITY of the remaining OPERABLE diesel generator by performing Surveillance Requirement 4.8.1.1.2.a.4 within 8 hours, except when:
: a. The remaining diesel generator is currently in operation, or
: b. The remaining diesel generator has been demonstrated OPERABLE within the previous 8 hours, and
: 4. Restore at least one of the inoperable sources to OPERABLE status within 12 hours or in accordance with the Risk Informed Completion Time Program, and
: 5. Restore the remaining inoperable A.C. Source to an OPERABLE status (Offsite A.C.
Circuit within 72 hours or in accordance with the Risk Informed Completion Time Program, or Diesel Generator within 14 days or in accordance with the Risk Informed Completion Time Program (see b.4, Note 1)), based on the time of the initiating event that caused the inoperability.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 2 - Enter applicable ACTIONs of LCO 3.8.2.1, "A.C. Distribution - Operating," when ACTION c is entered with no AC power to any train.
ARKANSAS - UNIT 2                              3/4 8-2          Amendment No. 141,234,249,255, 301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: d. With two offsite A.C. circuits of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Perform Surveillance Requirement 4.8.1.1.2.a.4 on the diesel generators within the next 8 hours except when:
: i. The diesel generators are currently in operation, or ii. The diesel generators have been demonstrated OPERABLE within the previous 8 hours, and
: 2. Within 12 hours from discovery of two required offsite A.C. circuits inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) inoperable when its redundant required feature(s) is inoperable, and
: 3. Restore one of the inoperable offsite A.C. circuits to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program, and
: 4. Restore both A.C. circuits within 72 hours or in accordance with the Risk Informed Completion Time Program of the initiating event, Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
: e. With two diesel generators of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of the two offsite A.C. circuits by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Restore one of the inoperable diesel generators to OPERABLE status within 2 hours, and
: 3. Restore the remaining inoperable diesel generator within 14 days or in accordance with the Risk Informed Completion Time Program (see b.4, Note 1) of the initiating event.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ARKANSAS - UNIT 2                              3/4 8-2a          Amendment No. 141,234,249,255, 301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.2  ONSITE POWER DISTRIBUTION SYSTEMS A.C. DISTRIBUTION - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.1    The following A.C. electrical busses shall be OPERABLE and energized with tie breakers open between redundant busses:
4160 volt Emergency Bus # 2A3 4160 volt Emergency Bus # 2A4 480 volt Emergency Bus # 2B5 480 volt Emergency Bus # 2B6 120 volt A.C. Vital Bus # 2RS1 120 volt A.C. Vital Bus # 2RS2 120 volt A.C. Vital Bus # 2RS3 120 volt A.C. Vital Bus # 2RS4 APPLICABILITY:      MODES 1, 2, 3 and 4.
ACTION:
Note: Enter applicable ACTIONs of LCO 3.8.2.3, "DC Sources - Operating" for DC train(s) made inoperable by inoperable power distribution subsystems.
With less than the above complement of A.C. busses OPERABLE, restore the inoperable bus to OPERABLE status within 8 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.
SURVEILLANCE REQUIREMENTS 4.8.2.1    The specified A.C. busses shall be determined OPERABLE with tie breakers open between redundant busses in accordance with the Surveillance Frequency Control Program by verifying correct breaker alignment and indicated power availability.
ARKANSAS - UNIT 2                            3/4 8-6                  Amendment No. 315,327,
 
ELECTRICAL POWER SYSTEMS DC SOURCES - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.3    The Train A and Train B DC electrical power subsystems shall be OPERABLE.
APPLICABILITY:          MODES 1, 2, 3 and 4.
ACTION:
: a. With one of the required full capacity chargers inoperable:
: i.      Restore the battery terminal voltage to greater than or equal to the minimum established float voltage within 2 hours, and ii. Verify battery float current  2 amps once per 12 hours.
: b. With one DC electrical power subsystem inoperable for reasons other than ACTION a above, restore the inoperable DC electrical power subsystem to OPERABLE status within 2 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.8.2.3.1      In accordance with the Surveillance Frequency Control Program by verifying that the battery terminal voltage is greater than or equal to the minimum established float voltage.
ARKANSAS - UNIT 2                                3/4 8-8        Amendment No. 54,75,94,297,301, 315,
 
ADMINISTRATIVE CONTROLS 6.5.19 Safety Function Determination Program (SFDP)
This program ensures loss of safety function is detected and appropriate actions taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other appropriate limitations and remedial or compensatory actions may be identified to be taken as a result of the support system inoperability and corresponding exception to entering supported system ACTIONs.
This program implements the requirements of LCO 3.0.6. The SFDP shall contain the following:
: a. Provisions for cross train checks to ensure a loss of the capability to perform the safety function assumed in the accident analysis does not go undetected,
: b. Provisions for ensuring the plant is maintained in a safe condition if a loss of function condition exists,
: c. Provisions to ensure that an inoperable supported system's allowed outage time is not inappropriately extended as a result of multiple support system inoperabilities, and
: d. Other appropriate limitations and remedial or compensatory actions.
A loss of safety function exists when, assuming no concurrent single failure, no concurrent loss of offsite power, or no concurrent loss of onsite diesel generator(s), a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:
: a. A required system redundant to the system(s) supported by the inoperable support system is also inoperable, or
: b. A required system redundant to the system(s) in turn supported by the inoperable supported system is also inoperable, or
: c. A required system redundant to the support system(s) for the supported systems (a) and (b) above is also inoperable.
The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate ACTIONs of the LCO in which the loss of safety function exists are required to be entered. When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate ACTIONs to enter are those of the support system.
6.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:
: a. The RICT may not exceed 30 days;
: b. A RICT may only be utilized in MODE 1 and 2; ARKANSAS - UNIT 2                            6-18b                          Amendment No. 327,
 
6.5.20 Risk Informed Completion Time Program (continued)
: c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.
: 1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
: 2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less.
: 3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.
: d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:
: 1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or
: 2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.
: e. The risk assessment approaches and methods shall be acceptable to the NRC.
The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.
ARKANSAS - UNIT 2                            6-18c                              Amendment No.
 
Attachment 3 2CAN042301 Retyped Technical Specification Pages (20 Pages)
 
TABLE 3.3-1 (Continued)
TABLE NOTATION
* With the protective system trip breakers in the closed position and the CEA drive system capable of CEA withdrawal.
(a)  Trip may be manually bypassed above 10-4% power; bypass shall be automatically removed before decreasing below 10-4% power.
(b)  Trip may be manually bypassed below 400 psia; bypass shall be automatically removed before pressurizer pressure exceeds 500 psia.
(c)  Trip may be manually bypassed below 10-2% power; bypass shall be automatically removed before exceeding 10-2% power. During testing pursuant to Special Test Exception 3.10.3, trip may be manually bypassed below 1% power; bypass shall be automatically removed before exceeding 1% power.
(d)  Trip may be bypassed during testing pursuant to Special Test Exception 3.10.3.
(e)  See Special Test Exception 3.10.2.
(f)  Each channel shall be comprised of two trip breakers; actual trip logic shall be one-out-of-two taken twice.
ACTION STATEMENTS ACTION 1 -    With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT STANDBY within the next 6 hours and/or open the protective system trip breakers.
ARKANSAS - UNIT 2                            3/4 3-4                  Amendment No. 134,196,
 
TABLE 3.3-1 (Continued)
ACTION STATEMENTS ACTION 4 - With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, verify compliance with the SHUTDOWN MARGIN requirements of Specification 3.1.1.1 or 3.1.1.2, as applicable, within 1 hour and at least once per 12 hours thereafter.
ACTION 5 - With the number of channels OPERABLE one less than required by the Minimum Channels OPERABLE requirement, place the reactor trip breakers of the inoperable channel in the tripped condition within 1 hour or be in HOT STANDBY within 6 hours; however, one channel may be bypassed for up to 1 hour for surveillance testing per Specification 4.3.1.1.1.
ACTION 6 - a. With one CEAC inoperable, operation may continue for up to 7 days or in accordance with the Risk Informed Completion Time Program provided that at least once per 4 hours, each CEA is verified to be within 7 inches (indicated position) of all other CEAs in its group. After 7 days or after expiration of the Risk Informed Completion Time, whichever is longer, operation may continue provided that ACTION 6.b is met.
: b. With both CEACs inoperable, operation may continue provided that:
: 1. Within 1 hour the margin required by Specification 3.2.4.b (COLSS in service) or Specification 3.2.4.d (COLSS out of service) is satisfied.
: 2. Within 4 hours:
a)  All CEA groups are withdrawn within the limits of Specifications 3.1.3.5 and 3.1.3.6.b, except during surveillance testing pursuant to the requirements of Specification 4.1.3.1.2.
b)  The "RSPT/CEAC Inoperable" addressable constant in the CPCs is set to both CEACs inoperable.
c)  The Control Element Drive Mechanism Control System (CEDMCS) is placed in and subsequently maintained in the "OFF" mode except during CEA motion permitted by a) above, when the CEDMCS may be operated in either the "Manual Group" or "Manual Individual" mode.
ARKANSAS - UNIT 2                          3/4 3-5b          Amendment No. 24,49,79,149,159, 169,244,
 
TABLE 3.3-3 (Continued)
TABLE NOTATION (a) Trip function may be bypassed in this MODE when pressurizer pressure is below 400 psia; bypass shall be automatically removed before pressurizer pressure exceeds 500 psia.
(b) An SIAS signal is first necessary to enable CSAS logic.
(c) Remote manual not provided for RAS. These are local manuals at each ESF auxiliary relay cabinet.
ACTION STATEMENTS ACTION 9 -    With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 10 - With the number of channels OPERABLE one less than the Total Number of Channels, operation in the applicable MODES may continue provided the inoperable channel is placed in the bypassed or tripped condition within 1 hour.
If the inoperable channel is bypassed for greater than 48 hours, the desirability of maintaining this channel in the bypassed condition shall be reviewed as soon as possible but no later than the next regularly scheduled OSRC meeting in accordance with the Quality Assurance Program Manual (QAPM). The channel shall be returned to OPERABLE status prior to startup following the next COLD SHUTDOWN.
If an inoperable Steam Generator P or RWT Level - Low channel is placed in the tripped condition, remove the inoperable channel from the tripped condition within 48 hours or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 30 hours.
With a channel process measurement circuit that affects multiple functional units inoperable or in test, bypass or trip all associated functional units as listed below.
Process Measurement Circuit                    Functional Unit Bypassed
: 1. Containment Pressure - NR                    Containment Pressure - High (RPS)
Containment Pressure - High (ESFAS)
Containment Pressure - High-High (ESFAS)
: 2. Steam Generator 1 Pressure                  Steam Generator 1 Pressure - Low Steam Generator 1 P (ESFAS 1)
Steam Generator 2 P (ESFAS 2)
: 3. Steam Generator 2 Pressure                  Steam Generator 2 Pressure - Low Steam Generator 1 P (ESFAS 1)
Steam Generator 2 P (ESFAS 2)
ARKANSAS - UNIT 2                            3/4 3-14      Amendment No. 134,159,186,195,196, 216,255,289,301,
 
TABLE 3.3-3 (Continued)
TABLE NOTATION ACTION 12 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 13 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours; however, one channel may be bypassed for up to 1 hour for surveillance testing provided the other channel is OPERABLE.
LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ACTION 14 - With the number of OPERABLE 460 volt Degraded Voltage (Functional Unit 7.b) channels one less than the Total Number of Channels or with both 4.16 kv Loss of Voltage (Functional Unit 7.a) channels inoperable on a single bus:
: a. Immediately declare the affected diesel generator inoperable, and
: b. Restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ARKANSAS - UNIT 2                        3/4 3-15a                Amendment No. 301,327,
 
EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - Tavg  300 &deg;F LIMITING CONDITION FOR OPERATION 3.5.2    Two independent ECCS subsystems shall be OPERABLE with each sub-system comprised of:
: a. One OPERABLE high-pressure safety injection (HPSI) train,
: b. One OPERABLE low-pressure safety injection (LPSI) train, and
: c. An independent OPERABLE flow path capable of taking suction from the refueling water tank on a Safety Injection Actuation Signal and automatically transferring suction to the containment sump on a Recirculation Actuation Signal.
APPLICABILITY:      MODES 1, 2 and 3 with pressurizer pressure  1700 psia.
ACTION:
: a. With one ECCS subsystem inoperable due to an inoperable LPSI train, restore the inoperable train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT STANDBY within the next 6 hours and reduce pressurizer pressure to < 1700 psia within the following 6 hours.
: b. With one or more ECCS subsystems inoperable due to conditions other than "a" above and 100% of ECCS flow equivalent to a single OPERABLE HPSI and LPSI train is available, restore the inoperable train(s) to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and reduce pressurizer pressure to
        < 1700 psia within the following 6 hours.
: c. With less than 100% ECCS flow equivalent to either the HPSI or LPSI trains within both ECCS subsystems, restore at least one HPSI train and one LPSI train to OPERABLE status within one hour or be in at least HOT STANDBY within the next 6 hours and reduce pressurizer pressure to < 1700 psia within the following 6 hours.
: d. In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the NRC within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date.
ARKANSAS - UNIT 2                            3/4 5-3                  Amendment No. 251,255,
 
CONTAINMENT SYSTEMS CONTAINMENT AIR LOCKS LIMITING CONDITION FOR OPERATION 3.6.1.3    Each containment air lock shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
: a. With one containment air lock door inoperable in one or more containment air locks1,2:
: 1. Verify that at least the OPERABLE air lock door is closed in the affected air lock within one hour and either restore the inoperable air lock door to OPERABLE status within 24 hours or lock the OPERABLE air lock door closed3.
: 2. Operation may then continue provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.
: b. With the containment air lock interlock inoperable in one or more containment air locks1:
: 1. Verify that at least one OPERABLE air lock door is closed in the affected air lock within one hour and restore the inoperable air lock interlock to OPERABLE status within 24 hours or lock an OPERABLE air lock door closed4.
: 2. Operation may then continue provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.
: c. With one or more air locks inoperable for reasons other than those addressed in ACTION a. or b.:
: 1. Immediately initiate action to evaluate overall containment leakage per LCO 3.6.1.2.
: 2. Verify that at least one door in the affected air lock is closed within one hour and restore the affected air lock to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next six hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
1 Separate ACTION entry is allowed for each air lock.
2 With both air locks inoperable, entry and exit is permissible for seven days under administrative controls.
3 Entry and exit is permissible to perform repairs on the affected air lock components.
4 Entry and exit is permissible under the control of a dedicated individual.
ARKANSAS - UNIT 2                              3/4 6-4                      Amendment No. 175,301,
 
CONTAINMENT SYSTEMS 3/4.6.2  DEPRESSURIZATION, COOLING, AND pH CONTROL SYSTEMS CONTAINMENT SPRAY SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.1    Two independent containment spray systems shall be OPERABLE with each spray system capable of taking suction from the RWT on a Containment Spray Actuation Signal (CSAS) and automatically transferring suction to the containment sump on a Recirculation Actuation Signal (RAS). Each spray system flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.
APPLICABILITY:      MODES 1, 2, and 3.
ACTION:
: a. With one containment spray system inoperable, restore the inoperable spray system to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.
: b. With both containment spray systems inoperable (Note 1):
: 1. Within 1 hour verify both CREVS trains are OPERABLE, and
: 2. Restore at least one containment spray system to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.
SURVEILLANCE REQUIREMENTS 4.6.2.1    Each containment spray system shall be demonstrated OPERABLE:
: a. In accordance with the Surveillance Frequency Control Program by:
: 1. Verify each containment spray manual, power operated, and automatic valve in the flow path that is not locked, sealed, or otherwise secured in position is in the correct position.
: 2. Verifying that the system piping is full of water from the RWT to at least elevation 505' (equivalent to > 12.5% indicated narrow range level) in the risers within the containment.
: b. Verify each containment spray pumps developed head at the flow test point is greater than or equal to the required developed head when tested pursuant to the INSERVICE TESTING PROGRAM.
Note 1: ACTION b is not applicable when the second containment spray system is intentionally made inoperable.
ARKANSAS - UNIT 2                            3/4 6-10          Amendment No. 194,233,252,268, 301,304,305,315,
 
CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3    Two independent containment cooling groups shall be OPERABLE with two operational cooling units in each group.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION1:
: a. With one group of the above required containment cooling units inoperable and both containment spray systems OPERABLE, restore the inoperable group of cooling units to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.
: b. With two groups of the above required containment cooling units inoperable and both containment spray systems OPERABLE, restore at least one group of cooling units to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. Restore both above required groups of cooling units to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, of initial loss.
: c. With one group of the above required containment cooling units inoperable and one containment spray system inoperable, restore the inoperable spray system to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. Restore the inoperable group of containment cooling units to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, of initial loss.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 1: The containment spray systems may be considered OPERABLE with respect to ACTIONs a, b, and c above if solely inoperable due to containment accident generated and transported debris exceeding the analyzed limits and LCO 3.6.4.1, ACTION a, is being met.
ARKANSAS - UNIT 2                            3/4 6-14      Amendment No. 16,29,226,301,318,
 
CONTAINMENT SYSTEMS 3/4.6.3    CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3.1      Each containment isolation valve shall be OPERABLE.*
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
Note: Enter applicable ACTION(s) for system(s) made inoperable by containment isolation valves.
With one or more isolation valve(s) inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and within 4 hours or in accordance with the Risk Informed Completion Time Program either:
: a. Restore the inoperable valve(s) to OPERABLE status, or
: b. Isolate each affected penetration by use of at least one deactivated automatic valve secured in the isolation position, or
: c. Isolate the affected penetration by use of at least one closed manual valve or blind flange; or Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.6.3.1.1    Each containment isolation valve shall be demonstrated OPERABLE prior to returning the valve to service after maintenance, repair or replacement work is performed on the valve or its associated actuator, control or power circuit by performance of a cycling test and verification of isolation time.
* Locked or sealed closed valves may be opened on an intermittent basis under administrative control.
ARKANSAS - UNIT 2                              3/4 6-16          Amendment No. 121,134,154,255, 301,327,
 
PLANT SYSTEMS EMERGENCY FEEDWATER (EFW) SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.2  Two EFW trains shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, and 3 ACTIONS:1 NOTE 1: Specification 3.0.4.b is not applicable.
NOTE 2: Only applicable if MODE 2 has not been entered following refueling.
NOTE 3: Not applicable when the turbine-driven EFW train is inoperable solely due to one inoperable steam supply.
NOTE 4: LCO 3.0.3 and all other LCO ACTIONS requiring MODE changes are suspended until one EFW train is restored to OPERABLE status.
: a. With the turbine-driven EFW train inoperable in MODE 3 following refueling2, OR with the turbine-driven EFW train inoperable due to one inoperable steam supply, restore the turbine-driven EFW train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.
: b. With one EFW train inoperable for reasons other than ACTION a, restore the inoperable train to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program.
: c. With the turbine-driven EFW train inoperable due to one inoperable steam supply AND the motor-driven EFW train inoperable, restore either the steam supply to the turbine-driven train OR the motor-driven EFW train to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program.
: d. With ACTION a, b, or c not met, be in HOT SHUTDOWN within the next 12 hours.
: e. With both EFW trains inoperable, immediately initiate action to restore one EFW train to an OPERABLE status.3,4 ARKANSAS - UNIT 2                            3/4 7-5        Amendment No. 51,136,188,233,281, 305,310,
 
PLANT SYSTEMS MAIN STEAM ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.7.1.5  Each main steam isolation valve shall be OPERABLE.
APPLICABILITY:    MODES 1, 2 and 3.
ACTION:
MODE 1    -  With one main steam isolation valve inoperable, POWER OPERATION may continue provided the inoperable valve is either restored to OPERABLE status or closed within 4 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in HOT SHUTDOWN within the next 12 hours.
MODES 2    -  With one main steam isolation valve inoperable, subsequent operation in and 3          MODES 1, 2 or 3 may proceed provided the isolation valve is maintained closed; otherwise, be in HOT SHUTDOWN within the next 12 hours.
SURVEILLANCE REQUIREMENTS 4.7.1.5  Each main steam isolation valve shall be demonstrated OPERABLE by verifying full closure within 3 seconds when tested pursuant to the INSERVICE TESTING PROGRAM.
ARKANSAS - UNIT 2                        3/4 7-10          Amendment No. 233,281,305,323, Next page is 3/4 7-15
 
PLANT SYSTEMS 3/4.7.3    SERVICE WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.3.1      At least two independent service water loops shall be OPERABLE.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
Notes:
: 1. Enter applicable ACTION(s) of LCO 3.8.1.1, "AC Sources - Operating," for diesel generator made inoperable by service water system.
: 2. Enter applicable ACTION(s) of LCO 3.4.1.3, "Reactor Coolant System - Shutdown," if a required shutdown cooling loop is made inoperable by service water system.
With only one service water loop OPERABLE, restore at least two loops to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.7.3.1      At least two service water loops shall be demonstrated OPERABLE:
: a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power operated or automatic) servicing safety related equipment that is not locked, sealed, or otherwise secured in position, is in its correct position.
: b. In accordance with the Surveillance Frequency Control Program during shutdown, by verifying that each automatic valve servicing safety related equipment actuates to its correct position on CCAS, MSIS and RAS test signals.
ARKANSAS - UNIT 2                              3/4 7-15              Amendment No. 301,315,327,
 
3/4.8  ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION 3.8.1.1    As a minimum, the following A.C. electrical power sources shall be OPERABLE:
: a. Two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system and
: b. Two separate and independent diesel generators each with:
: 1. A day fuel tank containing a minimum volume of 300 gallons of fuel,
: 2. A separate fuel storage system, and
: 3. A separate fuel transfer pump.
APPLICABILITY:        MODES 1, 2, 3 and 4.
ACTION:
NOTE: Specification 3.0.4.b is not applicable to diesel generators.
: a. With one offsite A.C. circuit of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of the remaining offsite A.C. circuit by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Within 24 hours from discovery of no offsite power to one train concurrent with inoperability of redundant required features(s), declare required features(s) with no offsite power available inoperable when its redundant required features(s) is inoperable, and
: 3. Restore the offsite A.C. circuit to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN. Startup Transformer No. 2 may be removed from service for up to 30 days as part of a preplanned preventative maintenance schedule. The 30-day allowance may be applied not more than once in a 10-year period.
ARKANSAS - UNIT 2                              3/4 8-1    Amendment No. 141,215,234,249,255, 281,301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: b. With one diesel generator of the above required A.C. electrical power source inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of both the offsite A.C. circuits by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Within 4 hours from discovery of one required diesel generator inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) supported by the inoperable diesel generator inoperable when its redundant required feature(s) is inoperable, and
: 3. Demonstrate the OPERABILITY of the remaining OPERABLE diesel generator within 24 hours by:
: i. Determining the OPERABLE diesel generator is not inoperable due to a common cause failure, or ii. Perform Surveillance Requirement 4.8.1.1.2.a.4 unless:
: a. The remaining diesel generator is currently in operation, or
: b. The remaining diesel generator has been demonstrated OPERABLE within the previous 24 hours, and
: 4. Restore the diesel generator to OPERABLE status within 14 days (See Note 1) or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 1 - If the Alternate A.C. Diesel Generator (AACDG) is determined to be inoperable during this period, then a 72 hour restoration or Risk Informed Completion Time period is applicable until either the AACDG or the diesel generator is returned to operable status (not to exceed 14 days or the Risk Informed Completion Time from the initial diesel generator inoperability).
ARKANSAS - UNIT 2                            3/4 8-1a              Amendment No. 249,301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: c. With one offsite A.C. circuit and one diesel generator of the above required A.C. electrical power sources inoperable (see Note 2), perform the following:
: 1. Demonstrate the OPERABILITY of the remaining offsite A.C. circuit by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter; and,
: 2. Within 4 hours from discovery of one required diesel generator inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) supported by the inoperable diesel generator inoperable if its redundant required feature(s) is inoperable, and
: 3. If the diesel generator became inoperable due to any cause other than preplanned preventative maintenance or testing, then
: i. Demonstrate the OPERABILITY of the remaining OPERABLE diesel generator by performing Surveillance Requirement 4.8.1.1.2.a.4 within 8 hours, except when:
: a. The remaining diesel generator is currently in operation, or
: b. The remaining diesel generator has been demonstrated OPERABLE within the previous 8 hours, and
: 4. Restore at least one of the inoperable sources to OPERABLE status within 12 hours or in accordance with the Risk Informed Completion Time Program, and
: 5. Restore the remaining inoperable A.C. Source to an OPERABLE status (Offsite A.C.
Circuit within 72 hours or in accordance with the Risk Informed Completion Time Program, or Diesel Generator within 14 days or in accordance with the Risk Informed Completion Time Program (see b.4, Note 1)), based on the time of the initiating event that caused the inoperability.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
Note 2 - Enter applicable ACTIONs of LCO 3.8.2.1, "A.C. Distribution - Operating," when ACTION c is entered with no AC power to any train.
ARKANSAS - UNIT 2                              3/4 8-2          Amendment No. 141,234,249,255, 301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.1  A.C. SOURCES LIMITING CONDITION FOR OPERATION
: d. With two offsite A.C. circuits of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Perform Surveillance Requirement 4.8.1.1.2.a.4 on the diesel generators within the next 8 hours except when:
: i. The diesel generators are currently in operation, or ii. The diesel generators have been demonstrated OPERABLE within the previous 8 hours, and
: 2. Within 12 hours from discovery of two required offsite A.C. circuits inoperable concurrent with inoperability of redundant required feature(s), declare required feature(s) inoperable when its redundant required feature(s) is inoperable, and
: 3. Restore one of the inoperable offsite A.C. circuits to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program, and
: 4. Restore both A.C. circuits within 72 hours or in accordance with the Risk Informed Completion Time Program of the initiating event, Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
: e. With two diesel generators of the above required A.C. electrical power sources inoperable, perform the following:
: 1. Demonstrate the OPERABILITY of the two offsite A.C. circuits by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour and at least once per 8 hours thereafter, and
: 2. Restore one of the inoperable diesel generators to OPERABLE status within 2 hours, and
: 3. Restore the remaining inoperable diesel generator within 14 days or in accordance with the Risk Informed Completion Time Program (see b.4, Note 1) of the initiating event.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
ARKANSAS - UNIT 2                              3/4 8-2a          Amendment No. 141,234,249,255, 301,327,
 
ELECTRICAL POWER SYSTEMS 3/4.8.2  ONSITE POWER DISTRIBUTION SYSTEMS A.C. DISTRIBUTION - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.1    The following A.C. electrical busses shall be OPERABLE and energized with tie breakers open between redundant busses:
4160 volt Emergency Bus # 2A3 4160 volt Emergency Bus # 2A4 480 volt Emergency Bus # 2B5 480 volt Emergency Bus # 2B6 120 volt A.C. Vital Bus # 2RS1 120 volt A.C. Vital Bus # 2RS2 120 volt A.C. Vital Bus # 2RS3 120 volt A.C. Vital Bus # 2RS4 APPLICABILITY:      MODES 1, 2, 3 and 4.
ACTION:
Note: Enter applicable ACTIONs of LCO 3.8.2.3, "DC Sources - Operating" for DC train(s) made inoperable by inoperable power distribution subsystems.
With less than the above complement of A.C. busses OPERABLE, restore the inoperable bus to OPERABLE status within 8 hours or in accordance with the Risk Informed Completion Time Program; otherwise, be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.
SURVEILLANCE REQUIREMENTS 4.8.2.1    The specified A.C. busses shall be determined OPERABLE with tie breakers open between redundant busses in accordance with the Surveillance Frequency Control Program by verifying correct breaker alignment and indicated power availability.
ARKANSAS - UNIT 2                            3/4 8-6                  Amendment No. 315,327,
 
ELECTRICAL POWER SYSTEMS DC SOURCES - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.3    The Train A and Train B DC electrical power subsystems shall be OPERABLE.
APPLICABILITY:          MODES 1, 2, 3 and 4.
ACTION:
: a. With one of the required full capacity chargers inoperable:
: i.      Restore the battery terminal voltage to greater than or equal to the minimum established float voltage within 2 hours, and ii. Verify battery float current  2 amps once per 12 hours.
: b. With one DC electrical power subsystem inoperable for reasons other than ACTION a above, restore the inoperable DC electrical power subsystem to OPERABLE status within 2 hours or in accordance with the Risk Informed Completion Time Program.
Otherwise, be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. LCO 3.0.4.a is not applicable when entering HOT SHUTDOWN.
SURVEILLANCE REQUIREMENTS 4.8.2.3.1      In accordance with the Surveillance Frequency Control Program by verifying that the battery terminal voltage is greater than or equal to the minimum established float voltage.
ARKANSAS - UNIT 2                                3/4 8-8        Amendment No. 54,75,94,297,301, 315,
 
ADMINISTRATIVE CONTROLS 6.5.19 Safety Function Determination Program (SFDP)
This program ensures loss of safety function is detected and appropriate actions taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other appropriate limitations and remedial or compensatory actions may be identified to be taken as a result of the support system inoperability and corresponding exception to entering supported system ACTIONs.
This program implements the requirements of LCO 3.0.6. The SFDP shall contain the following:
: a. Provisions for cross train checks to ensure a loss of the capability to perform the safety function assumed in the accident analysis does not go undetected,
: b. Provisions for ensuring the plant is maintained in a safe condition if a loss of function condition exists,
: c. Provisions to ensure that an inoperable supported system's allowed outage time is not inappropriately extended as a result of multiple support system inoperabilities, and
: d. Other appropriate limitations and remedial or compensatory actions.
A loss of safety function exists when, assuming no concurrent single failure, no concurrent loss of offsite power, or no concurrent loss of onsite diesel generator(s), a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:
: a. A required system redundant to the system(s) supported by the inoperable support system is also inoperable, or
: b. A required system redundant to the system(s) in turn supported by the inoperable supported system is also inoperable, or
: c. A required system redundant to the support system(s) for the supported systems (a) and (b) above is also inoperable.
The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate ACTIONs of the LCO in which the loss of safety function exists are required to be entered. When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate ACTIONs to enter are those of the support system.
6.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:
: a. The RICT may not exceed 30 days;
: b. A RICT may only be utilized in MODE 1 and 2; ARKANSAS - UNIT 2                            6-18b                          Amendment No. 327,
 
6.5.20 Risk Informed Completion Time Program (continued)
: c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.
: 1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
: 2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less.
: 3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.
: d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:
: 1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or
: 2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.
: e. The risk assessment approaches and methods shall be acceptable to the NRC.
The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.
ARKANSAS - UNIT 2                            6-18c                              Amendment No.
 
Attachment 4 2CAN042301 Technical Specification Bases Page Markups (Information Only)
(10 Pages)
 
3/4.3    INSTRUMENTATION BASES The bistable for the operating bypasses for the CPC and Logarithmic Power Level - High trips is required to be set within the two decade range allowed by Table 3.3-1 notations (a) and (c) and Table 2.2-1 notations (1) and (5). These limits provide the bistable with the appropriate range to account for the bistable hysteresis and to provide margin for the applicable uncertainties.
Regardless of the actual bistable setpoint within the two decade band, the single bistable design ensures that either the CPC or the Logarithmic Power Level - High trips are available to provide reactor trip protection. During testing pursuant to Special Test Exception 3.10.3, the bistable setpoint for these operating bypasses is increased to automatically remove the CPCs from bypass before the logarithmic power level exceeds 1% power.
Tables 2.2-1 notation (2), 3.3-1 notation (b), 3.3-3 notation (a), and 3.3-4 notation (1) allow the Pressurizer Pressure - Low function to be manually bypassed below 400 psia when the operating bypass permissive has been enabled. The margin between the pressurizer pressure and the setpoint is maintained  200 psia as pressurizer pressure is reduced during controlled plant cooldowns. This allows for controlled depressurization of the RCS while still maintaining an active trip setpoint until the trip is no longer needed to protect the plant. Since the Pressurizer Pressure - Low bistable is shared with RPS, SIAS, and CCAS an inadvertent actuation of these systems due to low pressurizer pressure is prevented while bypassed. The Pressurizer Pressure - Low bypass is required to be automatically removed before RCS pressure exceeds 500 psia. The difference between the 400 psia allowance for the manual bypass and 500 psia automatic bypass removal feature allows for the bistable hysteresis.
The Table 3.3-4 Allowable Values associated with the Loss of Power relays ensure automatic system response is initiated as presented in the SAR, Section 8.3.1.1.8.8. The selection of these values is such that adequate protection is provided when all sensor and processing time delays are taken into account. A channel is inoperable if its actuation trip setpoint is not within its required Allowable Value or within as-found OPERABILITY limits established in procedures.
The as-found OPERABILITY limits contained in the associated plant procedures may be required to account for the method of relay testing, which is performed on the bench instead of in the normal installed configuration. To ensure OPERABILITY between calibrations, the as-left setting established in procedures accounts for all other instrument uncertainties such as instrument drift/tolerances and MT&E accuracy.
Because only one of the two Loss of Voltage (LOV) relays on a given 4.16 kv bus is required to actuate, Table 3.3-3, Action 9, requires permits up to 48 hours to restore an inoperable relay to be restored to OPERABLEoperable status within 48 hours or in accordance with the Risk Informed Completion Time (RICT) Program, since the remaining relay is capable of performing the specified design function. If both relays on a given 4.16 kv bus are inoperable, the function has been lost. Therefore, in addition to restoring the relays to an OPERABLE status within 48 hours or in accordance with the Risk Informed Completion Time Program, the respective Emergency Diesel Generator (EDG) must be immediately declared inoperable in accordance with Action 14 of Table 3.3-3. Action 14 is also applicable to the loss of any Degraded Voltage (DV) channel since both DV relays on a given 460 volt bus must actuate to satisfy the specified safety function. Entry into the EDG LCO ensures appropriate cross-train checks will be performed in order to identify the potential for a loss of safety function.
ARKANSAS - UNIT 2                                B 3/4 3-2 Amendment No. 33,110,130,163,191,206 Rev. 10,11,17,40,56,60,83,
 
EMERGENCY CORE COOLING SYSTEMS BASES NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements,"
Section 7.4 discusses surveillance requirements for the instrumentation channels used in the measurement of water level and pressure in SITs. It is the recommendation of the NUREG that when one SIT is inoperable due only to the inability to verify water level and pressure, 72 hours be allowed to restore SIT to an OPERABLE status.
If one SIT is inoperable, for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours. In this condition, the total contents of the three remaining SITs cannot be assumed to reach the core during a LOCA, contrary to the assumptions of 10 CFR 50, Appendix K.
CEOG "Joint Applications Report for Safety Injection Tank AOT/STI Extension," CE NPSD-994, provides a series of deterministic and probabilistic findings that support 24 hours as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. The report discusses best-estimate analysis that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one LPSI pump or the operation of one HPSI pump and a single SIT.
3/4.5.2 and 3/4.5.3      ECCS SUBSYSTEMS The OPERABILITY of two separate and independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the safety injection tanks is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double-ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long term core cooling capability in the recirculation mode during the accident recovery period.
With one LPSI train inoperable per Action "a", action must be taken to restore the train to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this condition, the remaining OPERABLE ECCS subsystem is adequate to perform the heat removal function. The 7-day AOT is based on the findings of the deterministic and probabilistic analysis in CE NPSD-995, "Low Pressure Safety Injection System AOT Extension,"
April 1995, which concluded that 7 days for an inoperable LPSI train provides plant operational flexibility while simultaneously reducing overall plant risk. Prior to exceeding 72 hours when one LPSI train is inoperable, the following actions are required (reference NRC Safety Evaluation (letter 2CNA090302) and OP-2104.040):
: 1)    All safety injection tanks (SITs) will be verified to be OPERABLE.
: 2)    All emergency feedwater (EFW) sources will be verified to be OPERABLE.
: 3)    Operations will perform a briefing with the appropriate maintenance personnel in attendance to discuss the impact associated with unavailable components and flow paths.
The brief will also include consideration of the actions that would need to be taken to return the affected LPSI train to functional use should the need arise.
: 4)    Parts and tools will be pre-staged, when appropriate, to minimize outage time.
ARKANSAS - UNIT 2                              B 3/4 5-2          Amendment No. 82,148,152,192 Rev. 2,5,50,
 
EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.2 and 3/4.5.3      ECCS SUBSYSTEMS (continued)
In accordance with the NRC Safety Evaluation, "generally the LPSI AOT will not be entered unless these actions are satisfied. However, it should be recognized that unforeseen circumstances may arise that prohibit complying with these actions." In addition, it is standard operational practice to verify redundant train OPERABILITY, along with the required support systems, prior to removing any TS component from service, regardless of the length of time a TS component will be removed from service. Therefore, if the redundant LPSI train is not OPERABLE, the maintenance activity will not be performed.
In Action "b", if one or more HPSI or LPSI trains are inoperable except for reasons other than Action "a" and at least 100% of the ECCS flow equivalent to at least one of the individual HPSI and LPSI trains is available, the individual ECCS trains may be inoperable for up to 72 hours or in accordance with the Risk Informed Completion Time (RICT) Program. The 72-hour AOT or RICT is based on a reasonable amount of time to effect repairs. A HPSI or LPSI train is inoperable if it is not capable of delivering its design flow to the RCS. The individual components within a HPSI or LPSI train are inoperable if they are not capable of performing their design function, or if supporting systems are not available. Due to the redundancy of trains within the ECCS subsystems, the inoperability of one component in a train does not necessarily render the ECCS incapable of performing its function. Similarly, the inoperability of two different components, each in a different HPSI or LPSI train does not make the ECCS subsystem inoperable as long as at least one HPSI and LPSI train is capable of performing its required safety function to deliver at least 100% of its ECCS flow equivalent. This allows increased flexibility in plant operations when components in opposite trains are inoperable.
ARKANSAS - UNIT 2                              B 3/4 5-2a            Amendment No. 82,148,152,192 Rev. 2,5,50,
 
CONTAINMENT SYSTEMS BASES 3/4.6.2.1    CONTAINMENT SPRAY SYSTEM (continued)
The CSS and the Containment Cooling System (CCS) provide post-accident cooling and mixing of the containment atmosphere; however, the CCS is not redundant to the CSS. The CSS also provides a mechanism for removing iodine from the containment atmosphere and therefore the time requirements for restoring an inoperable spray system to OPERABLE status have been maintained consistent with that assigned other inoperable ESF equipment.
If one inoperable CSS train cannot be restored to an OPERABLE status within the allowable outage time (AOT) or in accordance with the Risk Informed Completion Time (RICT) Program, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within the following 6 hours. Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (reference CE NPSD-1186-A, Technical Justification for the Risk Informed Modification to Selected Required Action End States for CEOG PWRs, October, 2001). In MODE 4 there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
With two required CSS trains inoperable, at least one of the required CSS trains must be restored to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. Both trains of CCS must be OPERABLE (refer to LCO 3.6.2.3) and both CREVS trains must be verified to be OPERABLE within 1 hour (refer to LCO 3.7.6.1).
ACTION b is modified by a Note stating it is not applicable if the second CSS train is intentionally declared inoperable. The ACTION does not apply to voluntary removal of redundant systems or components from service. The ACTION is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. The components in this degraded condition are capable of providing greater than 100% of the heat removal needs after an accident. The AOT is based on WCAP-16125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010, which demonstrated that the 24-hour AOT is acceptable based on the redundant heat removal capabilities afforded by the CCS, the iodine removal capability of the CREVS, the infrequent use of the ACTION, and the small incremental effect on plant risk. If at least one CSS train is not restored to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program, the plant must be shut down as described above.
SR 4.6.2.1.a.2 requires verification of the CSS header level in accordance with the Surveillance Frequency Control Program. Verifying that the CSS header piping is full of water to the Elevation 505' level minimizes the time required to fill the header upon a Containment Spray Actuation Signal (CSAS). This ensures that spray flow will be admitted to the Containment Building atmosphere within the time frame assumed in the accident analysis. This SR is not associated with subject matter related to gas accumulation. TS-required systems must always be maintained sufficiently full of water to ensure the specified safety function will be performed when called upon.
ARKANSAS - UNIT 2                            B 3/4 6-4                  Rev. 23,27,30,53,56,63,73,
 
PLANT SYSTEMS BASES 3/4.7.1.2    EMERGENCY FEEDWATER SYSTEM The OPERABILITY of the emergency feedwater (EFW) system ensures that the Reactor Coolant System can be cooled down to Shutdown Cooling (SDC) entry conditions from normal operating conditions in the event of a total loss of off-site power.
The EFW system is designed to supply sufficient water to the steam generator(s) (SGs) to remove decay heat with SG pressure at the setpoint of the Main Steam Safety Valves (MSSVs).
Subsequently, the EFW system supplies sufficient water to cool the unit to SDC entry conditions, and steam is released through the Atmospheric Dump Valves (ADVs).
The EFW System is considered to be OPERABLE when the motor-driven EFW pump is OPERABLE and the turbine-driven EFW pump is OPERABLE with redundant steam supplies from each of the two main steam lines upstream of the Main Steam Isolation Valves (MSIVs).
The pumps must be capable of supplying required EFW to either SG.
ACTIONs A Note prohibits the application of LCO 3.0.4.b to an inoperable EFW train. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an EFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
ACTION a If the turbine-driven EFW pump is inoperable due to one inoperable steam supply, or if a turbine driven-pump is inoperable for any reason while in MODE 3 immediately following refueling, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time (RICT) Program. The 7-day AOT is reasonable based on the following reasons:
: a. For the inoperability of the turbine-driven EFW pump due to one inoperable steam supply, the 7-day AOT is reasonable since there is a redundant steam supply line for the turbine-driven pump and the turbine-driven train is still capable of performing its specified function for most postulated events.
: b. For the inoperability of a turbine driven EFW pump while in MODE 3 immediately subsequent to a refueling outage, the 7-day AOT is reasonable due to the minimal decay heat levels in this situation.
: c. For both the inoperability of the turbine-driven pump due to one inoperable steam supply and an inoperable turbine driven EFW pump while in MODE 3 immediately following a refueling outage, the 7-day AOT is reasonable due to the availability of redundant OPERABLE motor-driven EFW pump; and due to the low probability of an event requiring the use of the turbine-driven EFW pump.
ARKANSAS - UNIT 2                              B 3/4 7-2              Amendment No. 150,188,232 Rev. 33,46,68
 
PLANT SYSTEMS BASES 3/4.7.1.2    EMERGENCY FEEDWATER SYSTEM (continued)
ACTION a (continued)
ACTION a is modified by a Note which limits the applicability of the ACTION for an inoperable turbine-driven EFW pump in MODE 3 to when the unit has not entered MODE 2 following refueling. ACTION a allows one EFW train to be inoperable for 7 days vice the 72-hour AOT of ACTION b. This longer AOT is based on the reduced decay heat following refueling and prior to the reactor being critical.
ACTION b With one of the required EFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than ACTION a, action must be taken to restore the inoperable train to an OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time (RICT) Program. This ACTION includes the loss of two steam supply lines to the turbine-driven EFW pump. The 72-hour AOT or RICT is reasonable based on the redundant capabilities afforded by the EFW System, the time needed for repairs, and the low probability of a Design Basis Accident (DBA) event occurring during this period. The redundant EFW pump and flow path remains to supply feedwater to the SGs.
ACTION c With the motor-driven EFW train inoperable and the turbine-driven EFW train inoperable due to one inoperable steam supply, action must be taken to restore the affected equipment to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. Assuming no single active failures when in this condition, the accident (a Main Feedwater Line Break (MFLB) or Main Steam Line Break (MSLB)) could result in the loss of the remaining steam supply to the turbine-driven EFW pump due to the faulted SG. In this condition, the EFW system may no longer be able to meet the required flow to the SGs assumed in the safety analysis. The 24-hour AOT or RICT is reasonable based on the remaining OPERABLE steam supply to the turbine-driven EFW pump and the low probability of an event occurring that would require the inoperable steam supply to be available for the turbine-driven EFW pump.
ACTION d When ACTIONs a, b, or c cannot be completed within the AOT, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 4 within12 hours. The AOT is reasonable based on operating experience to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
ACTION e ACTION e is modified by a Note to clarify that it is not applicable when the turbine-driven EFW train is inoperable solely due to an inoperable steam supply. This Note is necessary to differentiate between the inoperable configurations described in ACTION c as compared to the configuration intended to be encompassed by ACTION e. With one steam supply available to the turbine-driven EFW pump, and assuming neither EFW train is restored to an OPERABLE status within 24 hours, the EFW system can still support a plant shutdown as required by ACTION d.
ARKANSAS - UNIT 2                          B 3/4 7-2a                                    Rev. 68,
 
3/4.8      ELECTRICAL POWER SYSTEMS BASES TS 3.8.1.1 ACTION b.4 allows for the extension of the EDG AOT up to 14 days or in accordance with the Risk Informed Completion Time (RICT) Program. Typically, use of the extended AOT will be restricted to once per 18-month cycle per EDG for voluntary planned maintenance or inspections, but it may be used for failures or other corrective maintenance activities provided plant risk is managed. The following contingencies shall be met prior to entering the extended EDG AOT (not applicable to 14-day AOT for Pressurizer Proportional Heater bank inoperability, with the exception of AACDG availability) when pre-planned maintenance activities are scheduled or within 72 hours if unplanned entry into the action is required:
: 1. The local area weather conditions will be evaluated prior to entering the extended EDG AOT for voluntary planned maintenance. An extended EDG AOT will not be entered for voluntary planned maintenance purposes if weather forecasts for the local area are predicting severe weather conditions that could affect the switchyard or offsite power supply during the AOT.
: 2. The condition of the switchyard, offsite power supply, and the grid will be evaluated prior to entering the extended AOT for elective maintenance. An extended EDG AOT will not be entered to perform elective maintenance when grid stress conditions are high such as during extreme summer temperatures and/or high demand.
: 3. No discretionary switchyard maintenance will be allowed. In addition, no discretionary maintenance will be allowed on the main, auxiliary, or startup transformers associated with the unit.
: 4. No maintenance or testing that affects the reliability of the ANO-2 train associated with the OPERABLE EDG will be scheduled during the extended AOT. If any testing and maintenance activities must be performed while the extended AOT is in effect, a 10 CFR 50.65(a)(4) evaluation will be performed.
: 5. The Alternate AC Diesel Generator (AACDG) will be available as a backup to the inoperable EDG and will not be used for non-safety functions such as power peaking to the grid. After entering the extended AOT, the AACDG will be verified available every 8 hours and treated as protected equipment.
: 6. ANO-1 personnel will be notified to ensure no elective maintenance activities will be scheduled on the ANO-1 EDGs and will be made aware of the dedication of the AACDG to ANO-2.
: 7. The steam driven EFW pump will not be taken out of service for planned maintenance activities and will be treated as protected equipment.
: 8. The system dispatcher will be contacted once per day and informed of the EDG status, along with the power needs of the facility.
: 9. Should a severe weather warning be issued for the local area that could affect the switchyard or offsite power supply during the AOT, an operator will be available locally at the AACDG should local operation of the AACDG be required as a result of on-site weather-related damage.
: 10. ANO-2 on-shift Operations crews will discuss and review appropriate normal and emergency operating procedures upon or prior to assuming the watch for the first time after having scheduled days off while the AOT is in effect.
ARKANSAS - UNIT 2                              B 3/4 8-3          Amendment No. 146,198,204,215 Rev. 1,6,17,54,56,63,78,83,
: 11. ANO-2 on-shift Operations crews will be briefed concerning the ANO-2 EDG activities, including compensatory measures established and the importance of promptly starting and aligning the AACDG following instruction of the ANO-2 Shift Manager upon a loss of offsite power event. This briefing will be performed upon or prior to assuming the watch for the first time after having scheduled days off while the AOT is in effect.
: 12. During the EDG outage, welding and transient combustibles will be controlled and continuous fire watch(es) established in the vicinity of the Turbine Building Switchgear (2A1/2A2/2A9).
: 13. During the EDG outage, welding and transient combustibles in the following areas will be controlled: the transformer yard; the south Switchgear Room (SS/2100-Z); the Cable Spreading Room (G/2098-L); Intake Structure (OO/IS); Diesel Corridor (JJ/2109-U); Lower South Electrical/Piping Penetration Room (EE/2055SC); and Electrical Equipment Room (TT/2108-S).
: 14. Prior to the EDG outage, the ANO-2 Operations personnel and ANO-1 fire brigade personnel will be briefed on information related to fighting electrical fires and fires that may occur in the transformer yard. The briefing will include relevant industry operating experience related to fires in these areas and will also include a discussion of equipment restoration.
: 15. Prior to the EDG outage, the operability of the fire suppression in the transformer yard will be confirmed. This will be accomplished by verifying that surveillances are current and the system is not isolated. If the system is isolated, then fire hoses will be staged to the transformer yard area during the EDG maintenance outage.
Note 1 of TS 3.8.1.1 ACTION "b" requires availability of the AACDG when an EDG is removed from service. If the AACDG becomes unavailable, then the AOT is reduced to 72 hours or in accordance with the Risk Informed Completion Time (RICT) Program from the time the AACDG becomes unavailable, not to exceed 14 days or the RICT from the initial entry related to the inoperable EDG. Either the AACDG or the EDG may be restored within the 72 hours or, for the EDG, in accordance with the RICT. If the EDG is restored, then TS 3.8.1.1, ACTION "b" is exited. If the AACDG is restored within the 72 hours, then restoration of the EDG must be accomplished within the initial 14-day AOT or the RICT (i.e. 14 days or the RICT from the time the EDG was initially declared inoperable and ACTION "b" was entered). For the purposes of this specification, AACDG availability (OPERABILITY) is demonstrated by its last test performance and no known AACDG deficiencies that bring into question its ability to accept loads as described in the SAR).
Pursuant to LCO 3.0.6, the distribution system ACTIONs would not be entered even if all AC sources were inoperable resulting in de-energization of buses. Therefore, ACTION c is modified by a Note to indicate that with no AC source to any train (i.e., one or both trains de-energized), the ACTIONs for LCO 3.8.2.1, "A.C. Distribution - Operating," must be immediately entered. This allows ACTION "c" to provide requirements for the loss of one offsite circuit and one EDG without regard to whether a train is de-energized. LCO 3.8.2.1 provides the appropriate restrictions for a deenergized train.
ARKANSAS - UNIT 2                              B 3/4 8-4          Amendment No. 146,198,204,215 Rev. 1,11,15,17,48,54,56,63,83,
 
3/4.8      ELECTRICAL POWER SYSTEMS BASES TS 3.8.2.3 DC Sources - Operating ACTION "a" represents one subsystem with one battery charger inoperable (e.g., the voltage limit of SR 4.8.2.3.1 is not maintained). The ACTION provides a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. ACTION "a.i" requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (ACTION "a.ii") from any discharge that might have occurred due to the charger inoperability.
A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 2 hours, that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (ACTION "a.ii").
ACTION "a.ii" requires that the battery float current be verified as less than or equal to 2 amps.
This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it is now fully capable of supplying the maximum expected load requirement. The 2-amp value is based on returning the battery to 98% charge and assumes a 2% design margin for the battery. If at the expiration of the initial 12-hour period the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.
ACTION "b" represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected subsystem. The 2-hour limit or restoring the affected subsystem in accordance with the Risk Informed Completion Time (RICT) Program is consistent with the allowed time for an inoperable DC distribution subsystem.
ARKANSAS - UNIT 2                                B 3/4 8-9                                  Rev. 54,63,
 
3/4.8      ELECTRICAL POWER SYSTEMS BASES If one of the required DC electrical power subsystems is inoperable for reasons other than ACTION "a" (e.g., inoperable battery charger), the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of the minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours or in accordance with the Risk Informed Completion Time (RICT) Program. The 2-hour AOT is based on Regulatory Guide (RG) 1.93 and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required AOT, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within the following 30 hours. The AOTs are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. The AOT to bring the unit to MODE 5 is consistent with the time required in RG 1.93.
Cascading to other TSs is not required solely due to a single station battery inoperability. In accordance with TS 3.0.5, the DC bus remains OPERABLE if its redundant power source (vital AC source via its battery charger) is OPERABLE and the redundant DC bus is fully OPERABLE (both vital AC and DC are available to supply the bus). Therefore, all DC loads associated with the affected train, including the respective EDG, remain OPERABLE. The 2-hour restoration period sufficiently takes into account the importance of the battery source and the vulnerability of supported equipment when a battery bank is out of service.
Surveillance Requirement (SR) 4.8.2.3.1 requires verifying battery terminal voltage while on float charge. This helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady-state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.20 Vpc times the number of connected cells or 127.6 V for a 58 cell battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life. The Surveillance Frequency is consistent with manufacturer recommendations.
SR 4.8.2.3.2 verifies the design capacity of the chargers. According to Regulatory Guide 1.32, the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied.
ARKANSAS - UNIT 2                              B 3/4 8-10                            Rev. 54,63,73,
 
Attachment 5 2CAN042301 ANO-2 Technical Specification TSTF-505 Cross-Reference 2CAN042301 Page 1 of 10 ANO-2 Technical Specification TSTF-505 Cross-Reference TSTF-505 TS Section /          TSTF-505 TS /      ANO-2 /                                  Attachment 1 Disposition Condition Description        Required Action      Action                                Variation Reference Completion Times                              1.3              N/A No change - Arkansas Nuclear One, Unit 2 Administrative Variation Example 1.3-8                            Example 1.3-8        N/A      (ANO-2) Technical Section 2.3.1.2 Specifications (TSs) do not contain this section Control Element Assembly Calculators 3.3.3          3.3.1.1      (system description provided in Enclosure 1)
(CEACs) (Digital)
Technical Specification Task Force (TSTF)
TSTF-505 does not apply a Risk-Informed A. One CEAC inoperable                        A.2              6.a    RICT added to Action 6.a  Completion Time (RICT) to the CEACs.
Technical Variation Section 2.3.2.1 Reactor Protective System (RPS) Logic 3.3.4          3.3.1.1      (system description provided in Enclosure 1) and Trip Initiation (Digital) 2CAN042301 Page 2 of 10 TSTF-505 TS Section /            TSTF-505 TS /  ANO-2 /                                Attachment 1 Disposition Condition Description            Required Action Action                              Variation Reference A. One matrix logic channel inoperable OR Technical Variation Three channels inoperable due to a          A.1          1    RICT added to Action 1 Section 2.3.2.2 common power source failure deenergizing three matrix power supplies Engineered Safety Feature Actuation System (ESFAS) Logic and Manual Trip            3.3.6      3.3.2.1    (system description provided in Enclosure 1)
(Digital)
A. One or more Functions with one matrix logic channel inoperable (also                                                      TSTF-505 does not applies when three matrix logic                                                          apply a RICT to ESFAS channels are inoperable due to a            A.1        12    RICT added to Action 12    matrix logic channels.
common power source failure                                                                Technical Variation deenergizing three matrix power                                                              Section 2.3.2.3 supplies)
B. One or more Functions with one Manual Trip or Initiation Logic            B.1          9    RICT added to Action 9          No Variation channel inoperable.
D. One or more Functions with one D.1        13    RICT added to Action 13          No Variation Actuation Logic channel inoperable Diesel Generator (DG) - Loss of Voltage 3.3.7      3.3.2.1    (system description provided in Enclosure 1)
Start (LOVS) (Digital) 2CAN042301 Page 3 of 10 TSTF-505 TS Section /          TSTF-505 TS /  ANO-2 /                            Attachment 1 Disposition Condition Description          Required Action Action                          Variation Reference TSTF-505 does not apply a RICT to DG A. One or more Functions with one                              RICT added to Action 9        LOVS.
A.1      9, 14.b channel per DG inoperable                                      and Action 14.b Technical Variation Section 2.3.2.4 RCS Loops - MODE 3                          3.4.5      3.4.1.2 No change -
A. One Reactor Coolant System (RCS)                              Probabilistic Risk  Administrative Variation A.1          a loop inoperable                                              Analysis (PRA) not      Section 2.3.1.4 applicable in Mode 3 Pressurizer                                  3.4.9      3.4.4 No change - not B. One [required] group of pressurizer                                                Administrative Variation B.1          b    quantifiable by ANO-2 heaters inoperable                                                                    Section 2.3.1.5 PRA model Pressurizer Power Operated Relief 3.4.11        N/A Valves (PORVs)
B. One PORV inoperable and not                                  No change - ANO-2    Administrative Variation B.3        N/A capable of being manually cycled                            does not have PORVs        Section 2.3.1.2 No change - ANO-2    Administrative Variation C. One block valve inoperable                C.3        N/A does not have PORVs        Section 2.3.1.2 Emergency Core Cooling System (ECCS) 3.5.2      3.5.2
- Operating 2CAN042301 Page 4 of 10 TSTF-505 TS Section /            TSTF-505 TS /  ANO-2 /                                Attachment 1 Disposition Condition Description          Required Action Action                              Variation Reference A. One low pressure injection (LPI)
A.1          a    RICT added to Action a        No Variation subsystem inoperable No Variation B. One or more trains inoperable for B.1          b    RICT added to Action b  (additional justification reasons other than Condition A provided in Enclosure 1)
Containment Air Locks                        3.6.2      3.6.1.3 C. One or more containment air locks                                                            No Variation inoperable for reasons other than          C.3          c.2  RICT added to Action c.2  (additional justification Condition A or B                                                                      provided in Enclosure 1)
Containment Isolation Valves                  3.6.3      3.6.3.1 A. One or more penetration flow paths with one containment isolation valve inoperable (Only applicable to the                                  RICT added to      Administrative Variation A.1        a, b, c
[containment sump supply valves to                                Actions a, b, and c      Section 2.3.1.6 the ECCS and containment spray pumps])
A. One or more penetration flow paths                              No change - ANO-2 with one containment isolation valve                          does not have a 31-day inoperable (Only applicable to the                                re-verification of  Administrative Variation A.2        N/A
[containment sump supply valves to                            Containment Isolation      Section 2.3.1.2 the ECCS and containment spray                                Valves (CIVs) closed as pumps])                                                          required by Actions 2CAN042301 Page 5 of 10 TSTF-505 TS Section /            TSTF-505 TS /  ANO-2 /                                Attachment 1 Disposition Condition Description            Required Action Action                              Variation Reference B. One or more penetration flow paths with one containment isolation valve RICT added to      Administrative Variation inoperable (applicable to penetration      B.1        a, b, c Actions a, b, and c      Section 2.3.1.6 flow paths with two [or more]
containment isolation valves)
B. One or more penetration flow paths                              No change - ANO-2 with one containment isolation valve                          does not have a 31-day Administrative Variation inoperable (applicable to penetration      B.2        N/A    re-verification of CIVs Section 2.3.1.2 flow paths with two [or more]                                  closed as required by containment isolation valves)                                          Actions C. One or more penetration flow paths with one containment isolation valve RICT added to      Administrative Variation inoperable (applicable to penetration      D.1        a, b, c Actions a, b, and c      Section 2.3.1.6 flow paths with only one containment isolation valve and a closed system)
C. One or more penetration flow paths                                No change - ANO-2 with one containment isolation valve                          does not have a 31-day Administrative Variation inoperable (applicable to penetration      D.2        N/A    re-verification of CIVs Section 2.3.1.2 flow paths with only one containment                            closed as required by isolation valve and a closed system)                                    Actions Containment Spray and Cooling Systems        3.6.6A      3.6.2.1 Administrative Variation A. One containment spray train                                                                Section 2.3.1.1 A.1          a    RICT added to Action a inoperable                                                                              (additional justification provided in Enclosure 1) 2CAN042301 Page 6 of 10 TSTF-505 TS Section /          TSTF-505 TS /  ANO-2 /                              Attachment 1 Disposition Condition Description          Required Action Action                            Variation Reference TSTF-505 does not apply a RICT in this A. Two containment spray trains                                                                  condition G.1        b.2  RICT added to Action b.2 inoperable Technical Variation Section 2.3.2.5 Containment Spray and Cooling Systems        3.6.6A      3.6.2.3 Administrative Variation C. One [required] containment cooling                                                          Section 2.3.1.1 C.1          a    RICT added to Action a train inoperable                                                                      (additional justification provided in Enclosure 1)
D. One containment spray train and one                                                    Administrative Variation
[required] containment cooling train      D.1          c    RICT added to Action c    Section 2.3.1.1 and inoperable                                                                                Section 2.3.1.7 Administrative Variation Section 2.3.1.1 and E. Two [required] containment cooling E.1          b    RICT added to Action b      Section 2.3.1.7 trains inoperable (additional justification provided in Enclosure 1)
Main Steam Isolation Valves (MSIVs)          3.7.2      3.7.1.5 No Variation RICT added to Action A. One MSIV inoperable in MODE 1              A.1      MODE 1                            (additional justification MODE 1 provided in Enclosure 1)
Atmospheric Dump Valves (ADVs)                3.7.4        N/A 2CAN042301 Page 7 of 10 TSTF-505 TS Section /          TSTF-505 TS /  ANO-2 /                              Attachment 1 Disposition Condition Description          Required Action Action                            Variation Reference No change - ADVs not    Administrative Variation A. One required ADV line inoperable          A.1        N/A governed by ANO-2 TSs        Section 2.3.1.2 Auxiliary Feedwater (AFW) System              3.7.5      3.7.1.2 A. One steam supply to turbine driven Auxiliary Feedwater (AFW) pump inoperable OR                                        A.1          a    RICT added to Action a        No Variation One turbine driven AFW pump inoperable in MODE 3 following refueling B. One Emergency Feedwater (EFW) train inoperable [for reasons other        B.1          b    RICT added to Action b        No Variation than Condition A] in MODE 1, 2, or 3
[C. Turbine driven EFW train inoperable RICT added to Action c due to one inoperable steam supply (Required Action similar  Technical Variation N/A          c AND                                                            to Action c does not      Section 2.3.2.6 appear in the STS)
Motor driven EFW train inoperable]
Component Cooling Water (CCW) 3.7.7        N/A System No change - CCW not    Administrative Variation A. One CCW train inoperable                  A.1        N/A governed by ANO-2 TSs        Section 2.3.1.2 Service Water System (SWS)                    3.7.8      3.7.3.1 2CAN042301 Page 8 of 10 TSTF-505 TS Section /          TSTF-505 TS /  ANO-2 /                                Attachment 1 Disposition Condition Description          Required Action Action                              Variation Reference A. One SWS train inoperable                  A.1        Action  RICT added to Action            No Variation Ultimate Heat Sink (UHS)                      3.7.9      3.7.4.1 No change - no restore A. One or more cooling towers with one                                                    Administrative Variation A.1        N/A  time provided within the cooling tower fan inoperable                                                                Section 2.3.1.2 ANO-2 TSs Essential Chilled Water (ECW)                3.7.10        N/A No change - ANO-2        Administrative Variation A. One ECW train inoperable                  A.1        N/A does not have ECW            Section 2.3.1.2 AC Sources - Operating                        3.8.1      3.8.1.1    (system description provided in Enclosure 1)
A. One [required] offsite circuit A.3        a.3  RICT added to Action a.3          No Variation inoperable B. One [required] DG inoperable              B.4        b.4  RICT added to Action b.4          No Variation C. Two [required] offsite circuits                      d.3 and      RICT added to        Administrative Variation C.2 inoperable                                            d.4      Actions d.3 and d.4          Section 2.3.1.7 D. One [required] offsite circuit inoperable.
c.4        RICT added to        Administrative Variation D.1 and D.2 AND                                                and c.5    Actions c.4 and c.5          Section 2.3.1.7 One [required] DG inoperable No change - sequencers F. One [required] [automatic load                                                          Administrative Variation F.1        N/A  not governed by ANO-2 sequencer] inoperable                                                                      Section 2.3.1.2 TSs 2CAN042301 Page 9 of 10 TSTF-505 TS Section /            TSTF-505 TS /  ANO-2 /                                Attachment 1 Disposition Condition Description          Required Action Action                              Variation Reference This Note does not appear in the TSTF-505
[Note 1: limits time of Diesel Generator                                                        Standard Technical RICT added to Note 1 (DG) inoperability if the                      Actions                              Specifications (STS)
N/A                    associated with Alternate AC Diesel Generator                  Note 1                                      markup.
Actions b.4, c.5, and e.3 (AACDG) becomes unavailable]
Administrative Variation Section 2.3.1.8 DC Sources - Operating                          3.8.4      3.8.2.3    (system description provided in Enclosure 1)
No change - no restore A. One [or two] battery charger[s on one                                                    Administrative Variation A.3          a    time provided within the train] inoperable                                                                            Section 2.3.1.2 ANO-2 TSs B. One [or two] batter[y][ies on one                                                        Administrative Variation B.1          b    RICT added to Action b train] inoperable                                                                            Section 2.3.1.9 C. One DC electrical power subsystem Administrative Variation inoperable for reasons other than          C.1          b    RICT added to Action b Section 2.3.1.9 Condition A [or B]
Inverters - Operating                          3.8.7        N/A No change - inverters Administrative Variation A. One [required] inverter inoperable          A.1        N/A  not governed by ANO-2 Section 2.3.1.2 TSs Distribution Systems - Operating                3.8.9      3.8.2.1    (system description provided in Enclosure 1)
A. One or more AC electrical power                                                          Administrative Variation A.1        Action  RICT added to Action distribution subsystems inoperable                                                          Section 2.3.1.10 2CAN042301 Page 10 of 10 TSTF-505 TS Section /        TSTF-505 TS /  ANO-2 /                              Attachment 1 Disposition Condition Description        Required Action Action                            Variation Reference B. One or more AC vital buses                                                          Administrative Variation B.1        Action  RICT added to Action inoperable                                                                              Section 2.3.1.10 Distribution Systems - Operating            3.8.9      3.8.2.3  (system description provided in Enclosure 1)
C. One or more DC electrical power                                                        Administrative Variation C.1          b  RICT added to Action b distribution subsystems inoperable                                                      Section 2.3.1.10 Programs and Manuals                          5.5        6.5 Administrative Variation Risk Informed Completion Time Program      5.5.18      6.5.20    Program added Section 2.3.1.1
 
Enclosure 1 2CAN042301 List of Revised Required Actions to Corresponding Probabilistic Risk Analysis (PRA)
Functions 2CAN042301 Page 1 of 37 List of Revised Required Actions to Corresponding Probabilistic Risk Analysis (PRA)
Functions
: 1. Introduction Section 4.0, Item 2 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)
Guidelines, (Reference 2) identifies the following needed content when submitting a license amendment request to adopt Technical Specification (TS) Risk-Informed Completion Times (RICT):
* The License Amendment Request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.
* The LAR will provide a comparison of the TS functions to the probabilistic risk assessment (PRA) modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.
* The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 50.46 ECCS flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.
This enclosure provides confirmation that the Arkansas Nuclear One, Unit 2 (ANO-2) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The ANO-2 PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.
Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:
  - Column " TS and Condition Description": Lists all of the LCOs and condition statements within the scope of the RICT Program.
  - Column "SSCs Covered by TS LCO Condition": The SSCs addressed by each action requirement.
  - Column "SSCs in PRA Model": Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.
  - Column "Function Covered by TS LCO Condition": A summary of the required functions from the design basis analyses.
  - Column "Design Success Criteria": A summary of the success criteria from the design basis analyses.
  - Column "PRA Success Criteria": The function success criteria modeled in the PRA.
2CAN042301 Page 2 of 37
    - Column "Disposition": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria.
Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events.
Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09 Revision 0-A.
The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to accurately model the as-built as-operated plant, and to conform to capability Category II of the PRA standard (as required by NEI 06-09 Revision 0-A).
Table E1-1 provides a list of candidate TS Actions to which a RICT may be applied and how the associated SSC is addressed in the PRA. The referenced ANO-2 TS is followed by the associated standard TS numbering (referred to in the table as the improved technical specification or "ITS" number) obtained from the appropriate markup pages of Technical Specification Task Force (TSTF) TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2. In addition, the LCO and Action descriptions are not necessarily direct quotes from the TS but are summarized to reduce repetition.
The following TSTF-505 specifications for which RICT is applied are not included in Table E1-1 because the TS is not applicable in Modes 1 or 2, or the ANO-2 TSs do not contain these specifications, except as noted below:
1.3      Example 1.3-8 3.4.5    Reactor Coolant System (RCS) Loops - MODE 3 3.4.11    Pressurizer Power Operated Relief Valves (PORVs) 3.7.4    Atmospheric Dump Valves (ADVs) 3.7.7    Component Cooling Water (CCW) 3.7.10    Essential Chilled Water (ECW) 3.8.7    Inverters - Operating Examples of calculated RICT are provided in Table E1-2 for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). These example calculations demonstrate the scope of the SSCs covered by technical specifications 2CAN042301 Page 3 of 37 modeled in the PRA. Note that the more limiting of the core damage frequency (CDF) and large early release frequency (LERF) RICT result is shown.
Following implementation, the RICT values will be calculated using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09, Revision 0-A, and the NRC safety evaluation, and may differ from the RICTs presented.
Section 2 lists the TSTF-505, Revision 2, Table 1, TSs that require additional justification along with a description of how the additional justification is provided in the LAR. Finally, Section 3 of this enclosure contains information regarding the diversity and redundancy of instrumentation and controls associated with ANO-2 TS Section 3.3 and vital electrical system capabilities associated with TS Section 3.8.
2CAN042301 Page 4 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs          SSC in      Functions          Design        PRA TS and Condition Description        Covered by        PRA      Covered by        Success      Success                Disposition TS Condition      Model    TS Condition        Criteria    Criteria 3.3.1.1, Reactor Protective Instrumentation Functional Unit 11.A - Minimum of three channels of Reactor        Matrix Logic Protection System (RPS) Matrix  assesses RPS                                    Actuation of Logic shall be operable                                                                                  RPS logic is de-energized to trip; inputs and will                                two of the therefore, loss of a Matrix Logic Action 1                          open contacts                                  six Matrix channel will result in opening in the Initiation                              Logic With the number of channels                                                                              contacts in the respective Initiation Logic                                    channels will  Same as operable one less than required                        Not      Reactor trip                            Logic path (fail safe). Matrix Logic is channels                                  initiate a    Design by the Minimum channels                              explicitly    initiation                            not explicitly modeled in the PRA.
when limits                                  reactor trip  Criteria operable, restore within                                                                                  Modeling the RICT component are exceeded                                  via input to 48 hours                                                                                                  failure to the downstream trip path on two of the                                the Initiation solid state relays can be used as a (ITS 3.3.4, Required Action A.1,  RPS inputs for                                Logic conservative surrogate.
for one inoperable channel or 3        a given                                  channels inoperable channels due to          parameter power supply failure) 2CAN042301 Page 5 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in      Functions        Design          PRA TS and Condition Description      Covered by      PRA      Covered by      Success        Success                Disposition TS Condition    Model    TS Condition      Criteria      Criteria The CEACS                                The CEACS assess core                              provide Functional Unit 14 - Two            conditions                              input to the Control Element Assembly            based on                                CPCs which Calculators (CEACs) shall be        Control                                act to initiate operable                                                                                              CEACs system components are not Element                                a reactor trip explicitly modeled in the PRA.
Action 6.a                          Assembly                Reactor trip  on high local  Same as Not                                                Modeling the RICT component (CEA)                  initiation via power          Design With one CEAC inoperable,                        explicitly                                          failure to the downstream trip path configurations              the CPCs      density        Criteria restore within 7 days                                                                                solid state relays can be used as a and input                              (LPD) or low conservative surrogate.
[TSTF-505 does not apply the    penalty factors                            departure RICT to Improved Technical        to the Core                              from Specifications (ITS) 3.3.3]        Protection                              nucleate Calculators                              boiling ratio (CPCs)                                (DNBR) 2CAN042301 Page 6 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in      Functions          Design        PRA TS and Condition Description        Covered by      PRA      Covered by        Success      Success              Disposition TS Condition    Model    TS Condition        Criteria    Criteria 3.3.2.1, Engineered Safety Features Actuation System (ESFAS) Instrumentation Depressing Functional Units 1.a, 2.a, 3.a,                                                  two Manual 4.a, 5.a, and 6.a - Two sets of                                                  Trip two Manual Trip buttons shall                                    ESF SSC        pushbuttons be operable                                                      actuations      or actuation            Manual initiation is not explicitly Actuation of of two                  modeled. ESF master relays, Functional Unit 8.a - Two sets      Engineered                (reactivity, fuel Initiation              "successful" operator actions, or the of two Manual Trip buttons per          Safety                integrity, RCS    Logic        Same as  automatic actuations for the affected Steam Generator (SG) shall be          Features      Not      pressure, RCS    channels will Design    functions are modeled and can be operable                            (ESF) SSCs    explicitly    inventory,    result in the Criteria  used as surrogates for calculating a except                    RCS heat Action 9                                                                        desired ESF            conservative RICT estimate for Function 7,                  removal,      actuation via          functions that require manual With one channel inoperable,        Loss of Power              Containment      the                    operation in the PRA.
restore channel within 48 hours                                    integrity)    Automatic (ITS 3.3.6, Required Action B.1,                                                Actuation for one inoperable channel)                                                      Logic channels 2CAN042301 Page 7 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions          Design        PRA TS and Condition Description        Covered by    PRA      Covered by        Success      Success                Disposition TS Condition  Model    TS Condition        Criteria    Criteria Depressing two Manual Trip Functional Units 1.d.2, 2.c.2,                                  ESF SSC        pushbuttons 3.c.2, 4.c.2, 5.d.2, 6.c.2, and                                actuations      or actuation Actuation of 8.d.2 - Four channels of                                                      of two Engineered              (reactivity, fuel Initiation Logic shall be operable                                            Initiation Safety              integrity, RCS                            SSCs are modeled consistent with Logic        Same as Action 9                              Features              pressure, RCS                            the TS scope and can be directly Yes                        channels will Design (ESF) SSCs                inventory,                            included in the CRMP tool for the With one channel inoperable,                                                  result in the Criteria except                  RCS heat                              RICT program.
restore channel within 48 hours                                                desired ESF Function 7,                removal,      actuation via (ITS 3.3.6, Required Action B.1,    Loss of Power            Containment      the for one inoperable channel)                                      integrity)    Automatic Actuation Logic channels Actuation of Functional Units 1.d.1, 2.c.1,                                                two of the 3.c.1, 4.c.1, 5.d.1, 6.c.1, and                                ESF SSC        six Matrix              ESF logic is de-energized to actuate; 8.d.1 - Minimum of three ESF        Actuation of              actuations      Logic                  therefore, loss of a Matrix Logic Matrix Logic channels shall be      Engineered                                channels will          channel will result in opening (reactivity, fuel operable                                Safety                                initiate                contacts in the respective Initiation integrity, RCS                  Same as Action 12                              Features    Not      pressure, RCS    actuation of            Logic path (fail safe). Matrix Logic is Design (ESF) SSCs  explicitly    inventory,    an ESF SSC              not explicitly modeled in the PRA.
With one channel inoperable,                                                                Criteria except                  RCS heat      via the ESF            Modeling the RICT component restore channel within 48 hours      Function 7,                              Initiation              failure to the downstream trip path removal, (TSTF-505 does not apply the        Loss of Power            Containment      Logic and              ESF solid state relays can be used RICT to ITS 3.3.6 matrix logic                                  integrity)    Actuation              as a conservative surrogate.
channels)                                                                      Logic channels 2CAN042301 Page 8 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in      Functions          Design      PRA TS and Condition Description        Covered by      PRA      Covered by        Success    Success                Disposition TS Condition    Model    TS Condition        Criteria  Criteria ESF SSC        Actuation of Functional Units 1.e, 2.d, 3.d,                                                one Actuation of              actuations 4.d, 5.e, 6.d, and 8.e - Two                                                  Automatic ESF Automatic Actuation Logic      Engineered              (reactivity, fuel Actuation channels shall be operable            Safety                integrity, RCS                          SSCs are modeled consistent with Logic        Same as Features              pressure, RCS                            the TS scope and can be directly Action 13                                          Yes                        channel will Design (ESF) SSCs                  inventory,                            included in the CRMP tool for the initiate    Criteria With one channel inoperable,          except                  RCS heat                              RICT program.
actuation of restore channel within 48 hours      Function 7,                removal,      the Loss of Power              Containment (ITS 3.3.6, Required Action D.1)                                              associated integrity)    ESF SSC Vital electrical power trains (two trains Functional Unit 7.a - Two                                    each supplied    At least one 4.16 kV Loss of Voltage (LOV)                                    by offsite    of the two channels per bus shall be                                        power or      LOV relays operable                                                      respective      on a given            The PRA model only includes credit AC electrical                  Diesel Action 9                                                                      bus is                for a single under voltage relay per power to                  Generator                  Same as Not                        required to            vital bus. The modeling of a single With one channel inoperable,        associated                    (DG)                    Design explicitly                  perform the            actuation train will provide a restore channel within 48 hours    TS-required                                            Criteria (reactivity, fuel safety                conservative RICT estimate in the SSCs (TSTF-505 does not contain a                                integrity, RCS    function for          PRA.
48-hour restore time and,                                    pressure, RCS    associated therefore, does not apply a                                    inventory,    electrical RICT to ITS 3.3.7)                                              RCS heat      train removal, Containment integrity) 2CAN042301 Page 9 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in      Functions          Design        PRA TS and Condition Description        Covered by    PRA      Covered by        Success    Success                Disposition TS Condition  Model    TS Condition        Criteria  Criteria Vital electrical power trains Functional Unit 7.b - One 460 V                              (two trains Degraded Voltage (DV) channel                              each supplied    Both DV per bus (load center or LC) shall                              by offsite    relays on a be operable                                                    power or      given bus The PRA model only includes credit AC electrical              respective      must Action 14.b                                                                                          for a single under voltage relay per power to                      DG)        actuate to  Same as Not                                              vital bus. The modeling of a single With one channel inoperable,        associated                                perform the  Design explicitly (reactivity, fuel                        actuation train will provide a restore channel within 48 hours    TS-required                              safety      Criteria integrity, RCS                          conservative RICT estimate in the SSCs                                    function for (TSTF-505 does not contain a                                pressure, RCS                            PRA.
associated 48-hour restore time and,                                      inventory,    electrical therefore, does not apply a                                    RCS heat      train RICT to ITS 3.3.7)                                              removal, Containment integrity) 3.5.2, Emergency Core Cooling Systems One LPSI Two emergency core cooling                                                    train is subsystems shall be operable                                                  required to Action a                                                                      satisfy the            SSCs are modeled consistent with Same as RCS inventory    large break            the TS scope and can be directly With one inoperable low                LPSI        Yes                                    Design control      loss of                included in the CRMP tool for the pressure safety injection (LPSI)                                                          Criteria coolant                RICT program.
train, restore within 7 days                                                  accident (ITS 3.5.2, Required Action A.1)                                              (LOCA) analyses 2CAN042301 Page 10 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions      Design        PRA TS and Condition Description        Covered by    PRA        Covered by    Success      Success              Disposition TS Condition  Model      TS Condition    Criteria    Criteria One LPSI and one Two emergency core cooling                                                HPSI train is subsystems shall be operable                                              required to Action b                          High Pressure                          satisfy the            SSCs are modeled consistent with Same as Safety              RCS inventory  accident                the TS scope and can be directly One subsystem inoperable for                      Yes                                  Design Injection                  control  analyses                included in the CRMP tool for the other reasons, restore within                                                            Criteria (HPSI), LPSI                            (HPSI also              RICT program.
72 hours                                                                  required for (ITS 3.5.2, Required Action B.1)                                          hot leg injection capability) 3.6.1.3, Containment Air Locks Each Containment air lock shall be operable Action c.2                                                                At least one            SSCs are not modeled in the PRA.
door in each  Same as  A pre-existing containment failure for One or more air locks                              Not      Containment Containment                            air lock      Design    large leaks can be modeled as a inoperable for reasons other                    explicitly    integrity closed and    Criteria  conservative surrogate in the PRA than Actions a or b, restore                                              sealed                  LERF assessment.
affected air lock within 24 hours (ITS 3.6.2, Required Action C.3) 2CAN042301 Page 11 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions      Design      PRA TS and Condition Description        Covered by    PRA        Covered by    Success    Success                Disposition TS Condition  Model      TS Condition    Criteria  Criteria 3.6.2.1, Containment Spray System Both CSS trains OR one CSS Two Containment Spray                                                                At least train and Systems (CSS) shall be operable                                                      one one Contain-Action a                                                                  Containment            SSCs are modeled consistent with ment Spray Containment              Containment  Cooling                the TS scope and can be directly With one Containment Spray                        Yes                                System OR Spray                    integrity  System                  included in the CRMP tool for the System inoperable, restore                                                            one of four (CCS) train            RICT program.
within 72 hours                                                                      cooling required to units (ITS 3.6.6, Required Action A.1)                                          meet required accident analyses assumptions Two Containment Spray Systems (CSS) shall be operable Both CSS Action b.2                                                                trains OR  At least With both Containment Spray                                              one CSS    one Systems inoperable, restore                                              train and  Contain-SSCs are modeled consistent with within 24 hours                                                          one CCS    ment Spray Containment              Containment                          the TS scope and can be directly Yes                    train      System OR (ITS 3.6.6, Required Action G.1      Spray                    integrity                          included in the CRMP tool for the required to one of four in NUREG 1432, Revision 5.                                                                        RICT program.
meet        cooling TSTF-505 (based on                                                        accident    units NUREG 1432, Revision 3,)                                                  analyses    required does not contain a restore time                                          assumptions and, therefore, does not apply a RICT to ITS 3.6.6) 2CAN042301 Page 12 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions      Design      PRA TS and Condition Description        Covered by    PRA        Covered by    Success    Success                Disposition TS Condition  Model      TS Condition    Criteria  Criteria 3.6.2.3, Containment Cooling System Two Containment cooling groups shall be operable with                                            Both CSS two cooling units in each group                                          trains OR  At least SSCs are modeled consistent with one CSS    one Action a                                                                                          the TS scope and can be directly train and  Contain-included in the CRMP tool for the With one cooling group                                                    one CCS    ment Spray Containment              Containment                          RICT program. Note, the Fire PRA inoperable and both CSSs                          Yes                    train      System OR cooling groups              integrity                          (FPRA) does not have circuits operable, restore cooling group                                          required to one of four selected for the CCS and uses the within 7 days                                                            meet        cooling CSS as a surrogate for containment accident    units (ITS 3.6.6, NUREG 1432,                                                                          heat removal.
analyses    required Revision 5,                                                              assumptions Required Action C.1)
Two Containment cooling groups shall be operable with                                            Both CSS two cooling units in each group                                          trains OR  At least SSCs are modeled consistent with one CSS    one Action b                                                                                          the TS scope and can be directly train and  Contain-included in the CRMP tool for the With two cooling groups                                                  one CCS    ment Spray Containment              Containment                          RICT program. Note, the FPRA inoperable and both CSSs                          Yes                    train      System OR cooling groups              integrity                          does not have circuits selected for operable, restore at least one                                            required to one of four the CCS and uses the CSS as a cooling group within 72 hours;                                            meet        cooling surrogate for containment heat restore both cooling groups                                              accident    units removal.
within 7 days                                                            analyses    required assumptions (ITS 3.6.6, Required Action E.1) 2CAN042301 Page 13 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in  Functions      Design      PRA TS and Condition Description      Covered by    PRA    Covered by    Success    Success                Disposition TS Condition  Model  TS Condition    Criteria  Criteria Two Containment cooling                                              Both CSS groups shall be operable with                                        trains OR  At least SSCs are modeled consistent with two cooling units in each group                                      one CSS    one the TS scope and can be directly train and  Contain-Action c                                                                                      included in the CRMP tool for the one CCS    ment Spray Containment          Containment                          RICT program. Note, the FPRA With one cooling group AND                        Yes                train      System OR cooling groups          integrity                          does not have circuits selected for one CSS inoperable, restore                                          required to one of four the CCS and uses the CSS as a CCS within 72 hours; restore                                          meet        cooling surrogate for containment heat cooling group within 7 days                                          accident    units removal.
analyses    required (ITS 3.6.6, Required Action D.1)                                      assumptions 2CAN042301 Page 14 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions        Design        PRA TS and Condition Description      Covered by    PRA        Covered by      Success    Success                Disposition TS Condition  Model      TS Condition      Criteria  Criteria 3.6.3.1, Containment Isolation Valves The containment isolation function is a PRA modeled function.
SSCs for penetrations that exceed the PRA success criteria for LERF (2 inches or larger) are modeled consistent with the TS scope and can be directly included in the CRMP tool for the RICT program.
Any containment isolation valve that Each Containment isolation                                                                      is screened due to size (< 2 inches)
At least one          from the PRA model, has no valve (CIV) shall be operable                                            CIV in each            contribution to CDF or LERF and the Actions a, b, and c                                                      penetration            delta risk calculation is limited to the is assumed            seismic and high winds penalty With one or more CIV(s)                                                                Same as Containment    to be closed          factors.
inoperable in one or more        Containment    Yes                                  Design integrity    following penetrations, restore CIV within                                                      Criteria  SSCs for penetrations that are receipt of 4 hours                                                                  associated            2 inches or larger that have been ESFAS                  screened from the PRA due to (ITS 3.6.3, Required signal                closed system or design features Actions A.1, B.1, and D.1) can be evaluated using a modeled penetration as a surrogate.
For conditions where multiple screened penetrations are open (exceeding the 2 inches or larger criteria), a representative surrogate will be selected, such as the use of a modeled containment pathway that represents the bypass of containment.
2CAN042301 Page 15 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in    Functions      Design        PRA TS and Condition Description      Covered by      PRA      Covered by    Success    Success                Disposition TS Condition    Model    TS Condition    Criteria    Criteria 3.7.1.2, Emergency Feedwater (EFW) System One EFW train is required to Two EFW trains shall be                                                  meet operable                                                                  accident Action a                                                                  analyses SSCs are modeled consistent with assumptions  Same as With the turbine-driven EFW                                  RCS heat                            the TS scope and can be directly EFW          Yes                  (turbine    Design train inoperable due to one                                    removal                            included in the CRMP tool for the driven pump  Criteria inoperable steam supply,                                                                          RICT program.
requires restore within 7 days                                                    only one of (ITS 3.7.5, Required Action A.1)                                          the two steam supplies to function)
Two EFW trains shall be operable                                                                  One EFW train is Action b                                                                                          SSCs are modeled consistent with required to  Same as RCS heat                            the TS scope and can be directly One EFW train inoperable for          EFW          Yes                  meet        Design removal                            included in the CRMP tool for the reasons other than Action a,                                              accident    Criteria RICT program.
restore within 72 hours                                                  analyses assumptions (ITS 3.7.5, Required Action B.1) 2CAN042301 Page 16 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs        SSC in      Functions        Design        PRA TS and Condition Description        Covered by      PRA      Covered by      Success      Success                Disposition TS Condition    Model    TS Condition      Criteria    Criteria Two EFW trains shall be operable Action c With the turbine-driven EFW                                                  One EFW train inoperable due to one                                                  train is SSCs are modeled consistent with inoperable steam supply AND                                                  required to  Same as the TS scope and can be directly the motor-driven EFW train            EFW          Yes      RCS cooling    meet        Design included in the CRMP tool for the inoperable, restore either the                                              accident    Criteria RICT program.
inoperable steam supply or the                                              analyses motor-driven EFW train within                                                assumptions 24 hours (ITS 3.7.5 does not contain this combined condition) 3.7.1.5, Main Steam Isolation Valves (MSIVs)
Each MSIV shall be operable                                                  At least one MSIV is Action a                                                    RCS pressure,  assumed to              SSCs are modeled consistent with Same as With one MSIV inoperable,                                    temperature,  isolate its              the TS scope and can be directly MSIVs, SGs      Yes                                  Design restore (or close the MSIV)                                  and inventory  respective              included in the CRMP tool for the Criteria within 4 hours                                                  control    SG, allowing            RICT program.
blowdown of (ITS 3.7.2, Required Action A.1)                                            only one SG 2CAN042301 Page 17 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions        Design        PRA TS and Condition Description        Covered by    PRA        Covered by        Success      Success              Disposition TS Condition  Model      TS Condition        Criteria    Criteria 3.7.3.1, Service Water System HPSI, LPSI, and CSS pump and Two Service Water (SW) loops                                room cooling    At least one shall be operable                                                            SW loop is Containment                            SSCs are modeled consistent with Action a                                                    cooling groups  required to  Same as the TS scope and can be directly SW        Yes                      meet          Design With one SW loop inoperable,                                EFW pumps,                              included in the CRMP tool for the accident      Criteria restore within 72 hours                                      supply, and                            RICT program.
analyses room cooling    assumptions (ITS 3.7.8, Required Action A.1)
Vital electrical bus room cooling 3.8.1.1, AC Sources At least one AC electrical Two offsite circuits and two DGs                                            train, shall be operable                                                            powered by AC electrical Action a.3                                                                  an offsite              SSCs are modeled consistent with Vital AC                  power to                  Same as circuit or an          the TS scope and can be directly With one offsite circuit            electrical    Yes        associated                  Design DG, is                  included in the CRMP tool for the inoperable, restore within        power sources              TS-required                  Criteria required to            RICT program.
72 hours                                                          SSCs meet (ITS 3.8.1, Required Action A.3)                                            accident analyses assumptions 2CAN042301 Page 18 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in  Functions      Design        PRA TS and Condition Description        Covered by    PRA    Covered by    Success      Success              Disposition TS Condition  Model  TS Condition    Criteria    Criteria At least one AC electrical Two offsite circuits and two DGs                                      train, shall be operable                                                      powered by AC electrical Actions b.4, e.3, and Note 1                                          an offsite              SSCs are modeled consistent with Vital AC              power to                  Same as circuit or an          the TS scope and can be directly With one DG inoperable,              electrical    Yes    associated                Design DG, is                  included in the CRMP tool for the restore within 72 hours (or      power sources          TS-required                Criteria required to            RICT program.
14 days if AACDG available)                                SSCs meet (ITS 3.8.1, Required Action B.4)                                      accident analyses assumptions Two offsite circuits and two DGs shall be operable                                                      At least one AC electrical Action c.4 and c.5                                                    train, With one offsite circuit AND one                                      powered by AC electrical DG inoperable, restore at least                                        an offsite              SSCs are modeled consistent with Vital AC              power to                  Same as one source within 12 hours;                                            circuit or an          the TS scope and can be directly electrical    Yes    associated                Design restore remaining source within                                        DG, is                  included in the CRMP tool for the power sources          TS-required                Criteria 72 hours (or for DG, 14 days if                                        required to            RICT program.
SSCs AACDG is available) from initial                                      meet entry                                                                  accident analyses (ITS 3.8.1, Required Action D.1                                        assumptions and D.2) 2CAN042301 Page 19 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions        Design        PRA TS and Condition Description        Covered by    PRA        Covered by      Success      Success              Disposition TS Condition  Model      TS Condition      Criteria    Criteria At least one Two offsite circuits and two DGs                                            AC electrical shall be operable                                                          train, powered by Action d.3 and d.4                                          AC electrical an offsite              SSCs are modeled consistent with Vital AC                  power to                  Same as With two offsite circuits                                                  circuit or an          the TS scope and can be directly electrical    Yes        associated                  Design inoperable, restore at least one                                            DG, is                  included in the CRMP tool for the power sources              TS-required                  Criteria within 24 hours and second with                                            required to            RICT program.
SSCs 72 hours of initial entry                                                  meet accident (ITS 3.8.1, Required Action C.2)                                            analyses assumptions 3.8.2.1, AC Distribution - Operating Two 4160 V, two 480 V, and four 120 V vital AC buses shall                                            At least one be operable                                                                AC electrical Vital AC                AC electrical Action                                                                      train is                SSCs are modeled consistent with electrical                power to                  Same as required to            the TS scope and can be directly With less than the number of        switchgear,    Yes        associated                  Design meet                    included in the CRMP tool for the listed buses operable, restore      buses, and              TS-required                  Criteria accident                RICT program.
affected bus within 8 hours          panels                    SSCs analyses (ITS 3.8.9, Required Action A.1                                            assumptions and B.1) 2CAN042301 Page 20 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs      SSC in      Functions        Design        PRA TS and Condition Description      Covered by    PRA        Covered by      Success      Success              Disposition TS Condition  Model      TS Condition      Criteria    Criteria 3.8.2.3, DC Distribution - Operating Train A and Train B DC electrical power subsystems shall be operable Vital DC                              At least one Action b                            electrical            DC electrical  DC electrical SSCs are modeled consistent with With one DC electrical power    power sources                power to    train is      Same as the TS scope and can be directly subsystem inoperable for          (chargers and  Yes        associated    required to  Design included in the CRMP tool for the reasons other than Action a,        batteries),            TS-required    meet          Criteria RICT program.
restore affected subsystem          buses, and                SSCs        accident within 2 hours                        panels                              analyses (ITS 3.8.4, Required Action B.1 and C.1) 2CAN042301 Page 21 of 37 Table E1-2: In Scope TS/LCO Conditions RICT Estimate RICT TS            LCO Condition              Required Action Estimate1,2 Action 1 3.3.1.1, Reactor  Three Matrix Logic With only two channels operable, Protective      Channels shall be                                        30 Days restore within 48 hours Instrumentation    operable (STS 3.3.4, Required Action A.1)
Action 6.a With one CEAC inoperable, restore 3.3.1.1, Reactor Two CEACs shall be    in 7 days (or take additional Protective                                                                30 Days operable              actions)
Instrumentation (TSTF-505 does not apply a RICT to STS 3.3.3, Required Action A.2)
Action 9 3.3.2.1, Engineered Two sets of two Safety Feature                          With one channel inoperable, Manual Trip Buttons                                      30 Days Actuation System                          restore channel within 48 hours shall be operable Instrumentation (ITS 3.3.6, Required Action B.1)
Action 9 3.3.2.1, Engineered Four Initiation Logic Safety Feature                          With one channel inoperable, channels shall be                                        28.1 Days Actuation System                          restore channel within 48 hours operable Instrumentation (ITS 3.3.6, Required Action B.1)
Action 12 3.3.2.1, Engineered Three Matrix Logic    With only two channels operable, Safety Feature Channels shall be    restore within 48 hours            28.1 Days Actuation System operable Instrumentation                          (TSTF-505 does not apply a RICT to STS 3.3.6, Required Action A.1)
Action 13 3.3.2.1, Engineered  Two Automatic Safety Feature    Actuation Logic      With one channel inoperable, 28.1 Days Actuation System    channels shall be    restore channel within 48 hours Instrumentation    operable (ITS 3.3.6, Required Action D.1) 2CAN042301 Page 22 of 37 RICT TS          LCO Condition              Required Action Estimate1,2 Action 9 Two Loss of Voltage With one channel inoperable, 3.3.2.1, Engineered (LOV) relays per bus restore channel within 48 hours Safety Feature  and two Degraded 27.9 Days Actuation System  Voltage (DV) relays  (TSTF-505 does not contain a Instrumentation  per bus shall be    48-hour restore time and, operable            therefore, does not apply a RICT to ITS 3.3.7)
Action 14.b Two Loss of Voltage With one channel inoperable, 3.3.2.1, Engineered (LOV) relays per bus restore channel within 48 hours Safety Feature  and two Degraded 27.9 Days Actuation System  Voltage (DV) relays  (TSTF-505 does not contain a Instrumentation  per bus shall be    48-hour restore time and, operable            therefore, does not apply a RICT to ITS 3.3.7)
Action a 3.5.2, [Emergency                      With one ECCS subsystem Core Cooling    Two ECCS            inoperable due to an inoperable Systems] ECCS    subsystems shall be  LPSI [Low Pressure Safety            30 Days Subsytems - Tavg  operable            Injection] train, restore LPSI train 300 &deg;F                          within 7 days (ITS 3.5.2, Required Action A.1)
Action b With one or more ECCS 3.5.2,      Two ECCS subsystems inoperable for reasons ECCS Subsytems    subsystems shall be                                        30 Days other than Action a, restore
    - Tavg  300 &deg;F  operable subsystem[s] within 72 hours (ITS 3.5.2, Required Action B.1)
Action c With one or more containment air 3.6.1.3,    Each containment air locks inoperable for reasons other Containment Air  lock shall be                                              7.7 Days than Actions a or b, restore within Locks      operable 24 hours (ITS 3.6.2, Required Action C.3) 2CAN042301 Page 23 of 37 RICT TS          LCO Condition                Required Action Estimate1,2 Actions a, b, and c With one or more penetration flow paths with one containment isolation valve inoperable, restore, 3.6.3.1,    Each containment isolate via a deactivated automatic Containment    isolation valve shall                                      7.9 Days valve, or isolate via manual valve /
Isolation Valves be operable blind flange within 4 hours (Actions a, b, and c, respectively)
(ITS 3.6.3, Required Actions A.1, B.1, and D.1)
Action a 3.6.2.1,    Two containment With one containment spray train Containment Spray spray trains shall be                                        30 Days inoperable, restore within 72 hours System      operable (ITS 3.6.5, Required Action A.1)
Action b.2 With both containment spray trains 3.6.2.1,    Two containment inoperable, restore within 24 hours Containment Spray spray trains shall be                                      1.8 Days3 System      operable              (TSTF-505 does not apply a RICT to STS 3.6.6A, Required Action G.1)
Action a With one containment cooling 3.6.2.3,    Two containment      group inoperable and both Containment    cooling groups shall  containment spray systems              30 Days Cooling System  be operable          operable, restore cooling group within 7 days (ITS 3.6.5, Required Action C.1)
Action b 3.6.2.3,    Two containment      With two containment cooling Containment    cooling groups shall  groups inoperable, restore at least    30 Days Cooling System  be operable          one cooling group within 72 hours (ITS 3.6.5, Required Action E.1) 2CAN042301 Page 24 of 37 RICT TS          LCO Condition                Required Action Estimate1,2 Action c With one containment cooling group and one containment spray 3.6.2.3,    Two containment system inoperable, restore Containment    cooling groups shall                                      30 Days containment spray system within Cooling System  be operable 72 hours and the cooling group within 7 days (ITS 3.6.5, Required Action D.1)
MODE 1 Action 3.7.1.5, Main Each MSIV shall be  With one MSIV inoperable, restore Steam Isolation                                                          24.6 Days operable            MSIV within 4 hours Valves [MSIVs]
(ITS 3.7.2, Required Action A.1)
Action a 3.7.1.2, Emergency                      With the turbine driven EFW train Two EFW trains shall Feedwater (EFW)                        inoperable due to one inoperable    30 Days be operable System                            steam supply, restore within 7 days (ITS 3.7.5, Required Action A.1)
Action b 3.7.1.2, Emergency                      One EFW train inoperable for Two EFW trains shall Feedwater (EFW)                        reasons other than Action a,        30 Days be operable System                            restore EFW train within 72 hours (ITS 3.7.5, Required Action B.1)
Action c Turbine driven EFW train inoperable due to one inoperable steam supply AND motor driven 3.7.1.2, Emergency Two EFW trains shall EFW train inoperable, restore Feedwater (EFW)                                                            30 Days be operable          either the inoperable steam supply System or the motor driven EFW train within 24 hours (STS 3.7.5 does not contain this Action) 2CAN042301 Page 25 of 37 RICT TS          LCO Condition                Required Action Estimate1,2 Action a 3.7.3.1, Service Two SWS loops shall    With one SWS loop inoperable, Water System                                                                13.3 Days be operable            restore within 72 hours
[SWS]
(ITS 3.7.8, Required Action A.1)
Action a.3 Two offsite circuits 3.8.1.1, A.C.                        One offsite circuit inoperable, and two DGs shall                                            8.8 Days Sources                            restore within 72 hours be operable (ITS 3.8.1, Required Action A.3)
Actions b.4, e.3, and Note 1 Two offsite circuits 3.8.1.1, A.C.                        One DG inoperable, restore within and two DGs shall                                          27.9 Days Sources                            14 days be operable (ITS 3.8.1, Required Action B.4)
Actions c.4, c.5, and Note 1 One offsite circuit AND one DG Two offsite circuits 3.8.1.1, A.C.                        inoperable, restore at least one and two DGs shall                                            2 Days3 Sources                            source within 12 hours be operable (ITS 3.8.1, Required Actions D.1 and D.2)
Actions d.3 and d.4 Two offsite circuits 3.8.1.1, A.C.                        Two offsite circuits inoperable, and two DGs shall                                            8.8 Days Sources                            restore within 24 hours be operable (ITS 3.8.1, Required Action C.2)
Action One or more required A.C.
3.8.2.1, A.C. The listed A.C.
electrical buses inoperable, restore Distribution - electrical buses shall                                      0.3 Days3 bus within 8 hours Operating    be operable (ITS 3.8.9, Required Actions A.1 and B.1) 2CAN042301 Page 26 of 37 RICT TS              LCO Condition                  Required Action Estimate1,2 Action b With one DC electrical power Train A and Train B      subsystem inoperable for reasons 3.8.2.3, DC                                  other than Action a, restore the DC electrical power Sources -                                  subsystem within 2 hours                0.8 Days3 subsystems shall be Operating operable                (ITS 3.8.4, Required Actions B.1 and C.1)
(ITS 3.8.9, Required Action C.1)
Notes to Table E1-2:
(1)  Estimated RICTs are listed. Following program implementation, the actual RICT values will be calculated on a plant-specific basis, using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09, Revision 0-A (Reference 2), and the NRC safety evaluation, and may differ from the RICTs presented. RICT evaluations utilize the internal events, internal flood, and internal fire PRA model calculations with seismic and high winds CDF and LERF penalties applied. See PRA Calculation PSA-ANO2-06-4B-EST, "ANO-2 PRA - RICT Estimates for TSTF-505 (RICT) Program LAR Submittal" (Reference 4).
(2)  RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09, Revision 0-A (Reference 2).
(3)  Per NEI 06-09, Revision 0-A (Reference 2), for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered for preplanned maintenance activities.
Table E1-2 above lists the calculated RICTs for each TS condition using the method outlined in NEI 06-09, Revision 0-A (Reference 2), shown below. The same equation was used to calculate the LERF RICT by simply using the RICT ICLERP Limit and LERF instead.
                            =                        x 365(      )
1 The RICT incremental conditional core damage probability (ICCDP) limit is 1.00E-05, while the RICT incremental conditional large early release probability ICLERP limit is 1.00E-06. The RICTs are limited to a maximum of thirty (30) days and to a minimum of the original TS completion time.
Table E1-2 provides example RICT calculations for the purposes of this enclosure. Following implementation, the RICT will be calculated using the actual plant configuration and may deviate from the example values.
2CAN042301 Page 27 of 37
: 2. Additional Justification for Specific Actions This section contains the additional technical justification for the list of Required Actions from Table 1, "Conditions Requiring Additional Technical Justification," of TSTF-505, Revision 2.
Entergy's additional justification for each of the identified ANO-2 TS is provided below:
2.1    TS 3.3.2.1 - Engineered Safety Feature Actuation System Instrumentation LCO: [derived from TS Table 3.3-3, Functional Unit 7] Two 4.16 kV Loss of Voltage (LOV) relays and two 460 V Degraded Voltage (DV) relays per vital bus shall be operable.
Action 9:    With one LOV relay inoperable, restore the relay to operable status within 48 hours.
Action 14: With one DV relay or both LOV relays on a single bus inoperable, declare the affected DG inoperable and restore relay(s) to operable status within 48 hours.
JUSTIFICATION Each of the two ANO-2 vital AC trains can be powered from one of two qualified offsite power sources, an associated DG, or the station Alternate AC Diesel Generator (AACDG). The two DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow operation of safety related loads. The required undervoltage protection will result in divorcing the affected vital electrical train from offsite power and automatically start the respective DG.
Two LOV relays are provided on each of the two 4.16 kV Class 1E bus for the purpose of detecting a loss of bus voltage. Upon loss of power to either of these relays, load shedding and starting of the associated DG are initiated. Isolation of the safety related buses is delayed slightly to allow an automatic transfer to offsite power, if available.
Two DV relays are provided on each of the two 480 V Class 1E buses for the purposed of detecting degraded voltage conditions. Actuation of both relays is required to initiate load shedding and automatic start of the respect DG.
Two non-TS motor start protection (MSP) relays are also provided on each 480 V Class 1E bus with a coincident trip logic (2 out of 2) for the purpose of detecting a sustained undervoltage condition while a safety injection actuation signal (SIAS) is present. With an SIAS present, upon voltage degradation to < 395.4 V and after a delay of 3.3 seconds, both relays must operate to isolate the associated safety related 4.16 kV bus from offsite power, and start and connect the associated DG. The relays are delayed 3.3 seconds to prevent spurious operation of the relays when large motors start on the safety related 4.16 kV and 480 V buses.
With one DV or both LOV relays on a single vital electrical train inoperable, the redundant vital electrical train remains available to support required safety functions. If a DV relay is inoperable on one train and both LOVs are inoperable on the redundant train, both vital electrical trains remain capable of automatically providing emergency power to safety related buses (one train maintains operable degraded voltage protection and one train maintains operable loss of voltage protection). Because the ANO-2 TSs do not permit more than one DV relay and two 2CAN042301 Page 28 of 37 LOV relays (on a single bus) to be inoperable, a loss of safety function does not exist while applying the associated TS Actions. The proposed configuration is acceptable because the RICT will consider the risk of a potential loss of additional relays or redundant safety related equipment before being applied.
2.2    TS 3.3.2.1 - Engineered Safety Feature Actuation System Instrumentation LCO: [derived from TS Table 3.3-3, Functional Unit 7] Two sets of two manual trip switches per Steam Generator (SG) shall be operable.
Action 9:    With one channel inoperable, restore channel to operable status within 48 hours.
JUSTIFICATION For all ESFAS functions having manual trip switches, there are four switches per function. Two switches are located on one control room panel and two switches are located on a different control room panel. Both switches on either panel must be actuated to perform the associated ESFAS function.
The ESFAS manual initiation switches provide the operator with the capability to actuate ESFAS functions from the control room in the absence of any other initiation condition. These functions are provided in the event the operator determines that an ESFAS function is needed prior to automatic actuation or in the event that actuation does not automatically occur when required.
These are backup functions to those performed automatically with the ESFAS channels.
As shown in TS Table 3.3-3, a "channel" consists of 2 sets of 2 manual trip switches for all associated ESFAS functions. With respect to Functional Unit 7, there are 2 sets of 2 manual trip switches for each SG. Inoperability of a single manual trip switch constitutes inoperability of a "channel". TS Table 3.3-3, Action 9, permits only one channel to be inoperable. With the remaining "channel" for a given ESFAS function operable, manual initiation remains available and no loss of function will result. In addition, loss of both manual trip channels of a given ESFAS function has no impact on the automatic features of the ESFAS logic (the accident analyses assume ESFAS will actuate automatically and that associated systems will respond within an assumed time period). Manual actuation is an operator aid and is not relied upon in the accident analyses. Therefore, the proposed configuration is acceptable because the RICT will consider the risk of a potential loss of automatic features before being applied.
2.3    TS 3.5.2 - ECCS Subsystems - Tavg  300 &deg;F LCO: Two ECCS subsystems shall be operable.
Action b:    With one ECCS subsystem inoperable for reasons other than Action a and 100% of ECCS flow equivalent to a single operable HPSI [high pressure injection pump] and LPSI [low pressure injection pump] train is available, restore subsystem to operable status within 72 hours.
2CAN042301 Page 29 of 37 JUSTIFICATION ANO-2 TS Section 3.5 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 5), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." The LCOs also support meeting the requirements of GDC-35, "Emergency Core Cooling."
The HPSI, LPSI, and Core Flooding Systems are collectively designated as an ECCS. The function of the ECCS is to provide core cooling to ensure that the reactor core is protected following an accident. Two redundant, 100% capacity trains are provided. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two diverse components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in unit operations under circumstances when diverse components in opposite trains are inoperable, i.e., a HPSI subsystem in one train and a LPSI subsystem in the opposite train.
Application of the RICT to TS 3.5.2, Action b, is acceptable because Action c prevents continued operation when 100% of the flow equivalent to a single operable ECCS train is not available. In such cases, affected equipment must be restored within one hour or a plant shutdown initiated (equivalent to LCO 3.0.3), ensuring the unit is placed in a safe condition when a loss of safety function exists.
2.4    TS 3.6.1.3 - Containment Air Locks LCO: Each containment air lock shall be operable.
Action c:    With one or more air locks inoperable for reasons other than Actions a or b, immediately initiate action to evaluate overall containment leakage per LCO 3.6.1.2, close at least one door in the affected air lock within one hour, and restore the air lock to operable status within 24 hours.
JUSTIFICATION ANO-2 TS Section 3.6 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 5), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." These LCOs also support meeting the requirements of GDC-16, "Containment Design," GDC 38, "Containment Heat Removal,"
and GDC 50, "Containment Design Basis."
ANO-2 TS 3.6.1.3, Action c, states, in part, that with one or more containment air locks inoperable for reasons other than Action a (one air lock door inoperable in one or more air locks) or Action b (inoperable air lock interlock mechanism), restore the air lock to operable status within 24 hours (Action c.2).
2CAN042301 Page 30 of 37 Containment air locks, also known as the personnel air lock and the emergency (or escape) air lock, form part of the containment building pressure boundary and provide a means for personnel access during all modes of operation. Each air lock door has been designed and is tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a design basis accident (DBA) in the containment building. As such, closure of a single door supports containment building operability. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To ensure a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in the containment building internal pressure results in increased sealing force on each door).
Application of the RICT to TS 3.6.1.3, Action c.2, is acceptable because when both doors in one or more air locks are inoperable, containment building leakage must be assessed in accordance with Action c.1. If leakage limits are exceeded, LCO 3.6.1.2, "Containment Leakage," requires restoration within 1 hour or a unit shutdown must be performed, ensuring the unit is placed is a safe condition. Therefore, application of a RICT to TS 3.6.1.3, Action c.2, will not result in a loss of safety function.
2.5    TS 3.6.2.1 - Containment Spray System LCO: Two containment spray trains shall be operable.
Action a:    With one containment spray train inoperable, restore the train to operable status within 72 hours.
Action b:    With both containment spray trains inoperable, verify both Control Room Emergency Ventilation System (CREVS) trains operable within 1 hour and restore at least one containment spray train to operable status within 24 hours.
JUSTIFICATION ANO-2 TS 3.6.2.1, Actions a and b, govern conditions where one or more containment spray trains are inoperable. The containment spray and containment cooling systems provide containment building atmosphere cooling to limit post-accident pressure and temperature in the containment building to less than the design values. In the event of a DBA, reduction of containment building pressure reduces the release of fission products from the containment building to the environment. The containment spray and containment cooling systems provide redundant methods to limit and maintain post-accident conditions to less than the containment building design values. During a DBA, both containment spray trains, or one containment spray train and one containment cooling group is sufficient to reduce the containment building pressure and temperature.
The containment spray train also aids in reducing iodine levels in the post-accident containment building atmosphere upon entry into the long-term recirculation phase by taking suction from the containment building sump. The sump water by this time contains sodium tetraborate (NaTB) decahydrate dissolved from the NaTB baskets located on the containment building floor (reference ANO-2 TS 3.6.2.2, "Containment Sump Buffering Agent").
TSTF-505 requires licensees to justify the ability to calculate a RICT for the aforementioned conditions, including how the system is modeled in the PRA, whether all functions of the system are modeled, and, if a surrogate is used, why the modeling is conservative.
2CAN042301 Page 31 of 37 The Containment Cooling System and Containment Spray System are both modeled in the ANO-2 PRA. The Containment Spray System, which scrubs radioactive iodine from the containment building atmosphere and reduces the concentration of fission products in the containment building leakage is modeled in the LERF analysis. Both the containment coolers and the Containment Spray System are modeled for reducing post-accident containment building pressure following a loss of coolant accident (LOCA) in the CDF and LERF models. In summary, no surrogate modeling is required and the SSCs are modeled consistent with the TS scope and can be directly included in the CRMP tool for the RICT program.
2.6    TS 3.7.1.5 - Main Steam Isolation Valves LCO: Each main steam isolation valve [MSIV] shall be operable.
MODE 1 Action:      With one MSIV inoperable, close or restore the MSIV to operable status within 4 hours.
JUSTIFICATION The MSIVs isolate steam flow from the secondary side of the SGs following a main steam line break (MSLB). MSIV closure terminates flow from the unaffected (intact) SG. One MSIV is located in each main steam line outside of, but close to, the containment building. The MSIVs are downstream from the main steam safety valves (MSSVs) and turbine-driven EFW pump's steam supply to prevent these being isolated from the SGs by MSIV closure. Closing the MSIVs isolates each SG from the other, and isolates the main turbine, Steam Dump and Bypass Control System (SDBCS), and other auxiliary steam supplies from the SGs.
Application of a RICT for one inoperable MSIV is acceptable because the failure of a single MISV to close will not result in a loss of safety function. The accident analysis assumes blowdown is limited to one SG following a MSLB. The following examples assume the MSIV on SG A fails to close following a MSLB.
: 1. With a MSLB on SG A (or it's respective main steam line), the SG B MSIV will close, preventing the blowdown of SG B. SG A will blowdown as assumed in the accident analysis.
: 2. With a MSLB downstream of the SG B MSIV, closure of the SG B MSIV will prevent blowdown of SG B. SG A may blowdown depending on whether any cross-tie between main steam lines exists downstream of the SG A MSIV; however, SG B remains intact.
: 3. With a MSLB upstream of the SG B MSIV, blowdown will be limited to SG B following closure of the SG B MSIV. RCS heat removal will be controlled thereafter via the SG A main steam line atmospheric dump valves, which are located upstream of the MSIVs, or the downstream SDBCS valves.
: 4. With an unisolable break in either turbine-driven EFW pump steam supply, check valves in each EFW pump steam supply line prevent cross-connect of the two main steam lines once pressure in one main steam line exceeds that of the other. This ensure the turbine driven EFW pump remains available and that any subsequent blowdown is limited to one SG.
2CAN042301 Page 32 of 37 Based on the above, a loss of safety function (i.e., blowdown of both SGs) is not assumed provided at least one MSIV performs its specified safety function to close following a MSLB.
: 3. Additional Information Regarding Design of Protective Instrumentation and Vital Electrical Systems The following provides a summary description of relevant protective instrumentation and vital electrical system designs not previously discussed in Section 2 of this enclosure.
3.1    Protective Instrumentation ANO-2 TS Section 3.3 Limiting Conditions for Operation (LCOs) were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 5), and the diversity requirements as defined in 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants" (GDC), GDC-22, "Protection System Independence."
3.1.1    Reactor Protective System (RPS) Instrumentation - Matrix Logic Channels (TS 3.3.1.1)
The RPS and Engineered Safety Feature (ESF) instrumentation systems and bypasses ensure that 1) the associated ESF action and/or reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its setpoint, 2) the specified coincidence logic is maintained, 3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and 4) sufficient system functional capability is available for protective and ESF purposes from diverse parameters. LCO 3.3.1.1 provides requirements for the individual measurement channels and logics. These channels encompass all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string.
There are four measurement channels per Function (parameter), six Matrix Logic channels, and four Initiation Logic channels. Each Matrix Logic channel receives input from two of the four measurement channels such that all combinations of any two measurement channels are captured in the six-channel Matrix Logic design. The RPS instrumentation measures critical unit parameters and compares these to predetermined setpoints. If the setpoint is exceeded, contacts in the associated Matrix Logic Channels open. When two measurement channels of the same parameter exceed the respective setpoint, sufficient contacts in the associated Matrix Logic channel will open, de-energizing the four relays associated with that Matrix Logic channel.
Each Matrix Logic channel has four relays which, when de-energized, open contacts in each of the four Initiation Logic paths. Subsequently, the reactor trip circuit breakers open, resulting in a reactor trip. In summation, any two of the four measurement channels will result in the associated Matrix Logic channel relays de-energizing, opening contacts in all four Initiation Logic channels, resulting in a reactor trip.
Consistent with TSTF-505, Entergy proposes apply a RICT to ANO-2 TS 3.3.1.1, Table 3.3-1, Functional Unit 11.a (RPS Matrix Logic channels), Action 1. This Action applies when only two Matrix Logic channels remain operable. In this configuration, only three of the measurement channels would be capable of providing the trip function. For example, if Matrix Logic Channels 2CAN042301 Page 33 of 37 AB and AC remain operable, a reactor trip will still occur if the setpoints are exceeded on measurement channels A and B, or A and C (measurement channel D would no longer provide a reactor trip since its corresponding Matrix Logic channels are inoperable). This is basically equivalent to one measurement channel being inoperable, which is governed by ANO-2 TS 3.3.1.1, Table 3.3-1, Action 2. In addition, a valid plant transient is expected to exceed the setpoints for the parameters associated with the transient on all four measurement channels, further providing reasonable assurance that the safety function will continue to be met.
Therefore, while redundancy is reduced, a loss of safety function does not exist with only two Matrix Logic channels operable since an automatic reactor trip will still be reasonably achieved.
All RPS logics are de-energize to actuate (fail safe). Because it is unlikely four of the six Matrix Logic channels could fail in such a manner as to maintain the respective Matrix Logic relays energized, the likelihood that a reactor trip has not already occurred is low. Finally, the PRA takes into consideration common cause failure when applying a RICT. Based on the RPS fail-safe design, no loss of safety function, and the PRA capability, it is acceptable to apply a RICT to ANO-2 TS 3.3.1.1, Table 3.3-1, Functional Unit 11.a (RPS Matrix Logic channels),
Action 1.
3.1.2    Reactor Protective System (RPS) Instrumentation - CEACs (TS 3.3.1.1)
Two CEACs assess core conditions based on CEA configurations and input penalty factors to the CPCs. The four CPC channels provide reactor trip signals on high LPD and low DNBR.
Both CEACS monitor all 81 CEAs. ANO-2 TS 3.3.1.1, Table 3.3-1, Functional Unit 14 (CEACs),
Action 6.a, permits operation with an inoperable CEAC for 7 days provided the CEAs are verified to be aligned within 7 inches of one another every 4 hours. After 7 days, Action 6.b must be entered (if operation is to continue) which requires several additional compensatory measures to be performed. Entergy has proposed applying a RICT to Action 6.a.
An inoperable CEAC is digitally placed in an "inop" condition, at which time the CPCs will use the higher of the inputs from the operable CEAC and the last remaining valid signal from the inoperable CEAC. Failure of the remaining CEAC while one CEAC is in "inop" (or failed) for
> 90 minutes will send a large penalty factor to the CPCs resulting in a reactor trip. If both CEACs are inoperable, compliance with ANO-2 TS 3.3.1.1, Table 3.3-1, Action 6.b is required.
With both CEACS inoperable, CEA configurations remain monitored by the CPC channels; however, each CPC channel monitors only one quarter of the CEAs. Action 6.b states:
With both CEACs inoperable, operation may continue provided that:
: 1. Within 1 hour the margin required by Specification 3.2.4.b (COLSS [Core Operating Limits Supervisory System] in service) or Specification 3.2.4.d (COLSS out of service) is satisfied.
: 2. Within 4 hours:
a)  All CEA groups are withdrawn within the limits of Specifications 3.1.3.5 and 3.1.3.6.b, except during surveillance testing pursuant to the requirements of Specification 4.1.3.1.2.
b)  The "Reed Switch Position Transmitter (RSPT)/CEAC Inoperable" addressable constant in the CPCs is set to both CEACs inoperable.
2CAN042301 Page 34 of 37 c)    The Control Element Drive Mechanism Control System (CEDMCS) is placed in and subsequently maintained in the "OFF" mode except during CEA motion permitted by a) above, when the CEDMCS may be operated in either the "Manual Group" or "Manual Individual" mode.
: 3. At least once per 4 hours, all CEAs are verified fully withdrawn, except during surveillance testing pursuant to the requirements of Specification 4.1.3.1.2, or as permitted by Specification 3.1.3.6.b, then verify at least once per 4 hours that the inserted CEAs are aligned within 7 inches (indicated position) of all other CEAs in their group.
CEACs are governed by STS 3.3.3 which has similar actions to those of the ANO-2 custom TSs. However, TSTF-505 did not apply a RICT to STS 3.3.3, Condition A (one CEAC inoperable) since individual plant PRA models may not be capable of quantifying risk with one CEAC inoperable. The PRA does not explicitly model the CEACs nor all the diverse functions of the RPS. However, the PRA can simulate a degraded signal/function of the RPS system as a modeling surrogate for calculating the RICT.
Given that the CPCs will use the greater of the last valid input from the inoperable CEAC or the input from the remaining operable CEAC, each CPC channel also monitors a portion of the CEAs, and assuming no operator action, a reactor trip will occur 90 minutes after failure of the remaining CEAC, no loss of safety function is realized with one or both CEACs inoperable.
Therefore, application of a RICT to ANO-2 TS 3.3.1.1, Table 3.3-1, Functional Unit 14 (CEACs),
Action 6.a is acceptable.
3.1.3    Engineered Safety Feature Actuation System [ESFAS] Instrumentation - Matrix, Initiation, and Automatic Actuation Logic Channels (TS 3.3.2.1)
The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and to mitigate accidents. The Matrix Logic and Initiation Logic channels function similarly to the RPS logics described in Section 3.1.1 above. While the RPS Initiation Logic channels act to open the reactor trip circuit breakers, the ESFAS Initiation Logic channels open contacts in two Automatic Actuation Logic channels, each having four normally energized relays which de-energize when two or more parameter setpoints are exceeded. The Automatic Actuation Logic relays are associated with specific ESF equipment and, upon de-energization, will result in actuation of the related ESF component(s).
TSTF-505 applies a RICT to the ESFAS Initiation Logic and Automatic Actuation Logic channels but does not apply a RICT to the ESFAS Matrix Logic channels. However, because the ANO-2 Matrix Logic channels function similarly to the RPS Matrix Logic channels and all ESFAS logics are de-energize to actuate (fail safe), Entergy proposes to apply a RICT to the ESFAS Matrix Logic channels. Because it is unlikely four of the six Matrix Logic channels could fail in such a manner as to maintain the respective Matrix Logic relays energized, the likelihood that equipment actuation has not already occurred is low. Finally, the PRA takes into consideration common cause failure when applying a RICT. Based on the ESFAS fail-safe design, no loss of safety function (see discussion under Section 3.1.1 above), and the PRA capability, it is acceptable to apply a RICT to ANO-2 TS 3.3.2.1, Table 3.3-1 Functions associated with ESFAS Matrix Logic channels, Action 12.
2CAN042301 Page 35 of 37 3.2    Vital Electrical Systems ANO-2 TS Section 3.8 LCOs were developed to assure that the necessary redundancy and diversity is maintained, including compliance with "single failure" design criterion as defined in IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (Reference 5), and the diversity requirements as defined in 10 CFR 50, Appendix A, GDC-29, "Protection Against Anticipated Operational Occurrences." These LCOs also support meeting the requirements of GDC-17, "Electrical Power Systems."
Included below is a description of the redundant and diverse means available to mitigate accidents for each required electrical system for which a RICT is proposed. This information is not required by TSTF-505 but is provided only for completeness.
Consistent with TSTF-505, a RICT is proposed for electrical system inoperabilities associated with offsite power sources, DGs, vital DC subsystems, vital AC and DC distribution subsystems, and vital inverters. A design summary of the two 4.16 kV and 480 V vital AC trains is provided under discussion of Section 2.1 above.
The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and 120 VAC vital buses (via inverters). The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems. Each subsystem consists of one 125 VDC battery, the associated battery charger for each battery, and all the associated control equipment and interconnecting cabling. Additionally, there is one spare battery charger per subsystem, which provides backup service in the event that a battery charger is out of service. When the spare battery charger is substituted, the requirements of independence and redundancy between subsystems are maintained. During normal operation, each 125 VDC subsystem is powered from the in-service battery charger with the battery floating on the system. In case of a loss of normal power to the battery charger, the DC load is automatically powered from the station battery. This results in a discharge of the associated battery (and may affect both the system and cell parameters).
The onsite Class 1E AC, DC, and 120 VAC bus electrical power distribution systems are divided by train into two redundant and independent AC, DC, and 120 VAC bus electrical power distribution subsystems. Each AC electrical power subsystem consists of a vital 4.16 kV bus, a 480 V load center, and 480 V motor control centers (MCCs). There are two independent 125 VDC electrical power distribution subsystem trains.
Four inverters are the preferred source of power for the 120 VAC buses because of the stability and reliability achieved. The function of the inverter is to provide AC electrical power to the four vital 120 VAC buses. The inverters are normally powered from 125 VDC vital electrical power.
The inverters provide an uninterruptible power source for the safety significant instrumentation and controls, including the RPS and ESFAS. There are two RPS/ESFAS related inverters per train. Additionally, there are two swing inverters (one per train) which provide backup service in the event that an RPS/ESFAS related inverter is out of service. When the swing inverter is placed in service, the requirements of independence and redundancy between trains are maintained. The 120 VAC distribution panels are arranged in two load groups per subsystem and are normally powered from the inverters. Upon loss of the DC supply, or in the event of an inverter failure, a static transfer switch automatically transfers the 120 VAC vital load to a vital MCC (alternate source).
2CAN042301 Page 36 of 37 With respect to uniform loading, each train is relatively balanced with the other, with the significant exception being the motor-driven EFW pump, which is powered from red train 4.16 kV switchgear 2A3. This pump is an additional load of approximately 500 kW. The combined accident loading is within the DG's continuous load rating. In addition, the PRA model considers those SSCs which are affected by inoperability of a given electrical train.
Table E1-3: Vital 4.16 kV Switchgear SSC                                    2A3 (Red Train)                  2A4 (Green Train)
Vital 480 V Load Centers                      2B5                              2B6 SWS Pumps                                    2P-4A                            2P-4C SWS Pump                                2P-4B (swing)                    2P-4B (swing)
Containment Spray Pumps                      2P-35A                          2P-35B LPSI Pumps                                  2P-34A                          2P-34B HPSI Pumps                                  2P-89A                          2P-89B HPSI Pumps                              2P-89C (swing)                    2P-89C (swing)
EFW Pump                                      2P-7B                              x Table E1-4: Vital 480 V Load Centers SSC                                    2B5 (Red Train)                  2B6 (Green Train)
Vital 480 V MCCs                  2B51, 2B52, 2B53, 2B54            2B61, 2B62, 2B63, 2B64 Proportional Heaters                        Group 1                          Group 2 Hydrogen Recombiner                          2M-55A                          2M-55B The AACDG (commonly referred to as the station blackout diesel generator) can also be started and connected, from the Control Room, to power either 4.16 kV switchgear. The AACDG is a non-seismic backup power source with a higher rating than the safety-related DGs.
2CAN042301 Page 37 of 37
: 4. References
: 1. Letter from the NRC to NEI, "Final Safety Evaluation for Nuclear Energy Institute (NEI)
Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines' (TAC No. MD4995)," (ADAMS Accession No. ML071200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)
Guidelines," (ADAMS Accession No. ML12286A322), November 2006
: 3. American Society of Mechanical Engineers (ASME) - ASME Standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," dated February 2, 2009
: 4. Entergy - PSA-ANO2-06-4B-EST, "ANO-2 PRA - RICT Estimates for TSTF-505 (RICT)
Program LAR Submittal," Revision 0
: 5. Institute of Electrical and Electronics Engineers (IEEE) - IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations," April 1972
 
Enclosure 2 2CAN042301 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 2CAN042301 Page 1 of 5 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2
: 1. Introduction This enclosure provides information on the technical adequacy of the Arkansas Nuclear One Unit 2 (ANO-2) probabilistic risk assessment (PRA) internal events model (including flooding) and the ANO-2 Fire PRA model in support of the license amendment request to revise Technical Specifications to implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1).
Topical Report NEI 06-09, Revision 0-A, as clarified by the NRC final safety evaluation of this report (Reference 2), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool, presently referred to as the Real Time Risk (RTR) tool, required to implement the risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"
Revision 3 (Reference 3) requirements for risk-informed plant-specific changes to a plant's licensing basis.
ANO-2 employs a multi-faceted approach to establishing and maintaining the technical acceptability and fidelity of its PRA models. This approach includes both a proceduralized PRA maintenance and update process and the use of self-assessments and independent peer reviews.
Section 2 outlines requirements related to the scope of the ANO-2 PRA Models. Section 3 outlines the technical adequacy of the Full Power Internal Events (FPIE) model, including internal flooding. Section 4 describes the technical adequacy of the Fire PRA (FPRA) model used in the respective license amendment applications.
: 2. Requirements Related to Scope of ANO-2 PRA Models The PRA models discussed in this enclosure have been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 4) consistent with NRC Regulatory Issue Summary (RIS) 2007-06, "Regulatory Guide 1.200 Implementation" (Reference 5).
Finding and Observation (F&O) closure reviews were conducted on the PRA models discussed in this enclosure. All closed findings were reviewed and resolved using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) (Reference 6) as accepted by NRC in the {{letter dated|date=May 3, 2017|text=letter dated May 3, 2017}} (Reference 7).
Note that this portion of the ANO-2 PRA model does not incorporate the risk impacts of external events. The treatment of seismic risk and other external hazards for this application are discussed in Enclosure 4.
2CAN042301 Page 2 of 5
: 3. Scope and Technical Adequacy of ANO-2 Internal Events and Internal Flooding PRA Model The ANO-2 PRA FPIE model including internal flooding has been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 4), consistent with NRC RIS 2007-06 (Reference 5).
The Internal Events PRA model was subject to a self-assessment and a full-scope peer review conducted in July 2008 (Reference 17). Since the peer review of the Internal Events PRA model was performed prior to the publication of RG 1.200, Revision 2, a self-assessment was conducted to assess the differences between RG 1.200, Revision 2, and RG 1.200, Revision 1 (Reference 8). The following conclusion is provided in Section 4 of the ANO-2 license amendment application to relocate surveillance frequency requirements to a licensee-controlled program [Technical Specification Task Force (TSTF) TSTF-425] (Reference 9). The conclusion confirms that the Internal Events PRA model meets the requirements of RG 1.200, Revision 2.
    "The information presented herein demonstrates that the ANO-2 PRA technical adequacy and capability evaluations, as well as the maintenance and update processes conform to the ASME/ANS PRA Standard, which satisfies the guidance of RG 1.200, Revision 1. In Entergy letter 2CAN061406 (Reference 18), the response to PRA RAI 20 explains that, after a detailed review was performed, the changes in the SRs [Supporting Requirements]
between ASME RA-Sb-2005 and ASME/ANS RA-SA-2009, and changes between RG 1.200, Revision 1 and 2, do not invalidate the ANO-2 peer review or change any of the findings and observations."
(Note: Reference 18 in the quoted text above is provided as Reference 9 in the reference list in this enclosure.)
The Large Early Release Frequency (LERF) PRA model was subject to a self-assessment and a focused-scope peer review and was conducted in August 2019 (Reference 15) against American Society of Mechanical Engineers / American Nuclear Society (ASME/ANS)
ASME/ANS RA-SA-2009 and RG 1.200, Revision 2.
The Internal Flooding PRA model was subject to a self-assessment and a focused-scope peer review conducted in February-March 2017 (Reference 16) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 2.
In September/October of 2019 an F&O Closure Review (Reference 10) was conducted for ANO-2. The scope of the review included the Internal Events and Internal Flooding PRA model.
The F&O Independent Assessment Team closed all 37 of the Finding level F&Os related to the Internal Events and Internal Flooding model. An additional F&O Closure by Independent Assessment (Reference 11) was held in December 2021 to perform an independent assessment to review Supporting Requirements (SRs) that were not assessed with a minimum of CC-II or greater and were not reassessed during the previous F&O Closure. This lack of reassessment was due to either not having an associated Finding-level F&O or being linked to a Finding-level F&O originating in another SR where that SR was reassessed, but the linked SR was not reassessed. One SR from the Internal Events PRA was also assessed as CC-II or greater during the review.
2CAN042301 Page 3 of 5 The Internal Events PRA model was subject to a focused scope peer review conducted in December 2021 (Reference 22) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 3.
A total of eleven F&Os were issued. Five were Findings, of which three were unique with two being linked.
In May of 2022, an additional F&O Closure by Independent Assessment (Reference 13) was conducted for ANO-2. The scope of the review included the Internal Events PRA model. The F&O Independent Assessment Team closed all three of the Finding level F&Os related to the Internal Events model.
All findings for the ANO-2 Internal Events and Internal Flooding model were closed. There are no open peer review findings for the Internal Events and Internal Flooding model and no unreviewed upgrades to PRA methods.
Given there are no partially resolved or open findings that may impact Risk-Informed Completion Time (RICT) calculations, the ANO-2 Internal Events PRA is of adequate technical capability to support the TSTF-505-A (Reference 14) program.
: 4. Scope and Technical Adequacy of ANO-2 Fire PRA Model The FPRA Model was subject to a self-assessment, and a full-scope peer review was conducted in June 2009 (Reference 23) against ASME/ANS RA-SA-2009 and RG 1.200, Revision 2. In addition, focused scope peer reviews were performed in 2011 (Reference 18),
2012 (Reference 19), 2014 (Reference 20), and 2016 (Reference 21) on the Fire Scenario Selection (FSS), fire modeling, and Human Reliability Analysis (HRA) elements of the FPRA, resulting in a limited number of additional finding-level F&Os. Since then, a model revision was completed which ensured all the Finding-level F&Os from these peer reviews were addressed properly.
In September/October of 2019 an F&O Closure Review (Reference 10) was conducted for ANO-2. The scope of the review included the Fire PRA model. The F&O Independent Assessment Team closed all 38 of the Finding level F&Os related to the Fire PRA model.
An additional F&O Closure by Independent Assessment (Reference 11) was held in December 2021 to perform an independent assessment to review close out SRs that were not originally assessed with a minimum of CC-II or greater and were not reassessed during the previous F&O Closure. This lack of reassessment was due to either not having an associated Finding-level F&O or being linked to a Finding-level F&O originating in another SR where that SR was reassessed, but the linked SR was not reassessed. All 10 supporting requirements from the Fire PRA were assessed as CC-II or greater during the review.
All findings for the ANO-2 FPRA model were closed. There are no open peer review findings for the FPRA model and no unreviewed upgrades to PRA methods. The FPRA utilizes NRC-endorsed methodologies in the development of the FPRA and does not use any unapproved methods.
Given there are no partially resolved or open findings that may impact RICT calculations, the ANO-2 FPRA is of adequate technical capability to support the TSTF-505-A program.
2CAN042301 Page 4 of 5
: 5. References
: 1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), dated October 12, 2012
: 2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 3. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, (ADAMS Accession No. ML17317A256), January 2018
: 4. NRC Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, (ADAMS Accession No. ML090410014), March 2009
: 5. NRC Regulatory Issue Summary (RIS) 2007-06, "Regulatory Guide 1.200 Implementation,"
(ADAMS Accession No. ML070650428), dated May 22, 2007
: 6. Nuclear Energy Institute (NEI) Letter to NRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," (ADAMS Accession No. ML17086A431), dated February 21, 2017
: 7. NRC Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," (Accession Number ML17079A427), dated May 3, 2017
: 8. NRC Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1, January 2007
: 9. Entergy Letter to NRC, "Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (TSTF-425)," (2CAN021802), (ADAMS Accession No. ML18038B354), dated February 6, 2018
: 10. Entergy - PSA-ANO2-08-FNO-CL, "ANO-2 PRA Finding Level Fact and Observation Independent Assessment," Revision 0, 2020
: 11. Entergy - PSA-ANO2-08-FNO-CL-01, "ANO-2 PRA - Fact and Observation Closure by Independent Assessment," Revision 0, (ADAMS Accession No. ML20238B871), 2021
: 12. NRC Regulatory Guide (RG) 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3, December 2020 2CAN042301 Page 5 of 5
: 13. Entergy - PSA-ANO2-08-FNO-CL-02, "ANO-2 PRA - Fact and Observation Closure by Independent Assessment Supporting [Station Blackout / Loss of Offsite Power] SBO/LOOP Event," Revision 0, 2022
: 14. Technical Specification Task Force (TSTF) Traveler TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2, (ADAMS Accession No. ML18253A085), dated November 21, 2018
: 15. Entergy - ENTGS009-ANO2-PR-1000, "ANO-2 Power Plant Probabilistic Risk Assessment Focused-Scope Peer Review (LERF)," Revision 0, 2019
: 16. Entergy - ENTGANO150-REPT-002, "Arkansas Nuclear One Unit 2 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, 2017
: 17. Westinghouse - LTR-RAM-II-08-020, "RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for The Arkansas Nuclear One, Unit 2 Probabilistic Risk Assessment," 2008
: 18. Westinghouse - LTR-RAM-I-11-064, "Focused Scope Fire PRA Peer Review for Arkansas Nuclear One Unit 2," 2011
: 19. Kazarians & Associates, Inc. - "Focused Scope Peer Review ANO-2 Fire PRA FSS-A, C, D, E and H," 2012
: 20. Curtiss-Wright - "Arkansas Nuclear One Unit 2 Fire HRA Peer Review Report Using ASME/ANS PRA Standard Requirements," 2014
: 21. Entergy - "Arkansas Nuclear One, Unit 2 Fire PRA Focus Scope Peer Review Report,"
Revision 0, 2016
: 22. Entergy - PSA-ANO2-08-FSPR-01, "ANO-2 PRA Finding Level Fact and Observation Independent Assessment Risk Management Focused-Scope Peer Review," Revision 0, 2021
: 23. Westinghouse - LTR-RAM-II-09-046, "Fire PRA Peer Review against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications for the Arkansas Nuclear One, Unit 2 Fire Probabilistic Risk Assessment,"
2009
 
Enclosure 3 2CAN042301 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 2CAN042301 Page 1 of 1 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2  is not applicable because each probabilistic risk assessment (PRA) model used for the Risk Informed Completion Time (RICT) Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.
 
Enclosure 4 2CAN042301 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models 2CAN042301 Page 1 of 45 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models
: 1. Introduction and Scope Topical Report NEI 06-09, Revision 0-A (Reference 1), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference 2), requires that the License Amendment Request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on the insignificance to the calculation of configuration risk as well as discuss conservative or bounding analyses applied to the configuration risk calculation.
This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources. This enclosure also provides the Arkansas Nuclear One, Unit 2 (ANO-2) specific results of the application of the generic methodology and the disposition of impacts on the ANO-2 Risk Informed Completion Time (RICT) Program.
Section 3 of this enclosure presents the plant-specific analysis of seismic risk to ANO-2.
Section 4 of this enclosure presents the justification for excluding analysis of high wind risk to ANO-2. Section 5 of this enclosure presents the justification for excluding analyses of other external hazards from the ANO-2 PRA.
Topical Report NEI 06-09 does not provide a specific list of hazards to be considered in a RICT Program. However, non-mandatory Appendix 6-A in the American Society of Mechanical Engineers / American Nuclear Society (ASME/ANS) PRA Standard (Reference 3) provides a guide for identification of most of the possible external events for a plant site. Additionally, NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making" (Reference 4), provides a discussion of hazards that should be evaluated to assess uncertainties in plant PRAs and support the risk-informed decision-making process. This information was reviewed for the ANO-2 site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The information in the Safety Analysis Report (SAR) regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well as present and projected industrial activities in the vicinity of the plant were also reviewed for this purpose.
No new site-specific and plant-unique external hazards were identified through this review. The list of hazards in Appendix 6-A of the PRA Standard were considered for ANO-2 as summarized in Table E4-5.
The scope of this enclosure is consideration of the hazards in Table E4-5 for ANO-2. As explained in subsequent sections of this enclosure, risk contribution from seismic events is evaluated quantitatively, and the other listed external hazards are evaluated and screened as having low risk. Although the tornado missiles hazard screened for total risk, it does not screen for all configurations; therefore, a "penalty factor" is developed to account for tornado missile risk in the RICT.
: 2. Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the 2CAN042301 Page 2 of 45 Technical Specification (TS) Limiting Conditions for Operation (LCOs) selected to be part of the RICT Program.
Consistent with NUREG-1855 (Reference 4), external hazards may be addressed by:
: 1)  Screening the hazard based on a low frequency of occurrence,
: 2)  Bounding the potential impact and including it in the decision-making, or
: 3)  Developing a PRA model to be used in the RMAT/RICT calculation.
The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.
* The first is the contribution from the occurrence of beyond design basis conditions, e.g.,
winds greater than design, seismic events greater than the design basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the structures, systems, and components (SSCs) to maintain functionality and support safe shutdown of the plant.
* The second aspect addressed is the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power (LOOP), etc. While the plant design basis assures that the safety related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems that present a risk.
Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the NRCs 1975 Standard Review Plan (SRP)
(Reference 5), which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance (Reference 6) as assuring a bounding CDF of less than 1E-6/yr for each hazard. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. If the bounding CDF for the hazard can be shown to be less than 1E-6/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program.
The basis for this is as follows:
* The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-5.
* The maximum time interval allowed for the RICT is 30 days.
* If the maximum CDF contribution from a hazard is < 1E-6/yr, then the maximum ICDP from the hazard is < 1E-7 (1E-6/yr
* 30 days/365 days/yr).
2CAN042301 Page 3 of 45
* The bounding ICDP contribution from the hazard is shown to be less than 1% of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.
The ANO-2 Individual Plant Examination of External Events (IPEEE) hazard screening analysis (Reference 7) has been updated to reflect current ANO-2 site conditions. The results are discussed in Section 5 and show that all the events listed in Table E4-5 can be screened except seismic events for ANO-2.
Hazard Analysis - CDF There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-6/yr. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard.
Evaluate Bounding LERF Contribution The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the large early release frequency (LERF) considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as follows:
ILERFHazard = ICDFHazard
* CLERPHazard The approach used for seismic LERF is described in Section 3.7.
Risks from Hazard Challenges Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out of service equipment. For ANO-2, as discussed in Section 3, the only beyond design basis hazard that could not be screened out is the seismic hazard, and the approach used considers that the change in risk with equipment out of service will not be higher than the estimated seismic CDF.
In addition, while the tornado missile hazard for ANO-2 was screened for the average test and maintenance conditions, it could not be screened under different configuration-specific conditions.
The above steps address the direct risks from damage to the facility from external hazards.
While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using these steps without a full PRA, there are risks that may be addressed.
These risks are related to the fact that some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events below the design basis levels can cause extended loss of offsite 2CAN042301 Page 4 of 45 power conditions. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms.
The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or are not significant to risk.
: 3. Seismic Risk Contribution Analysis 3.1    Introduction Technical Specification Task Force (TSTF) Traveler TSTF-505-A, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2, requires accounting for seismic risk contribution in calculating an extended risk informed Technical Specification (TS)
Completion Time (CT), also referred to as Allowed Outage Time (AOT).
Since a seismic PRA (SPRA) does not exist for ANO-2 (i.e., an SPRA was not submitted for either the ANO-2 IPEEE [Individual Plant Examination for External Events] (Reference 8), or in response to the NRC Near-Term Task Force (NTTF) 2.1 seismic requests, (References 9 and 10), an alternative approach is taken here to provide an estimate of seismic CDF (SCDF) for use in the RICT Program. This alternative SCDF estimation approach is based on the current ANO-2 seismic hazard curve, (Reference 11) and using a plant level seismic fragility based on the ANO-2 IPEEE seismic margins assessment (SMA) (Reference 8), and NRC Generic Issue (GI)-199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," (Reference 12).
The calculation of seismic LERF (SLERF) is performed by convolving the plant seismic core damage estimate described above with an assumed independent containment integrity seismic high confidence of low probability of failure (HCLPF) to estimate SLERF. That is, the SLERF can be estimated by convolving the plant seismic hazard with the plant limiting HCLPF for core damage and the limiting HCLPF for reactor building integrity.
3.2    Assumptions and Ground Rules
: 1. Hazard Curve: The ANO-2 seismic hazard is defined by the seismic hazard curve (SHC) provided to the NRC in Reference 13 and developed per the seismic hazard analysis documented in Reference 11.
: 2. PGA Metric: The ground motion metric used to define the seismic hazard in this analysis is peak ground acceleration (PGA). PGA is a common ground motion metric used in seismic risk assessment analyses for nuclear power plants (Reference 14). Based on review of NRC requests for additional information (RAIs) associated with industry RICT License Amendment Requests (LARs) adopting a RICT Program, this analysis also assesses other hazard metrics (1.0 Hz, 2.5 Hz, 5 Hz, and 10 Hz) and concludes the PGA hazard is reasonable for use in RICT seismic risk estimation.
2CAN042301 Page 5 of 45
: 3. Plant Level Seismic Fragility: The assumed limiting plant seismic capacity used in the ANO-2 seismic penalty calculation has a HCLPF value of 0.30g PGA. The HCLPF capacity is defined as the earthquake level in which there is 95% confidence of less than 5%
seismic-induced failure probability. The bases for this value are:
    -  ANO-2 IPEEE SMA (Reference 8).
    -  NRC staff evaluation report of the ANO-2 IPEEE (Reference 15) which acknowledges that following completion of proposed seismic IPEEE-identified improvements (e.g., additional bolting, enhanced anchorage) the seismic capacity of all SSCs on the IPEEE SMA safe shutdown equipment list (SSEL) will meet or exceed the 0.30g PGA SMA review level earthquake (RLE).
    -  The Reference 16 Entergy Operations, Inc. (Entergy) post-IPEEE submittal fragility calculation determined that the anchorage capacity of the ANO-2 2T-57A and B (and ANO-1 T-57A and B) Diesel Generator (DG) fuel oil storage tanks meets the IPEEE 0.3g PGA RLE. The Reference 17 letter to the NRC documents completion of the IPEEE and Seismic Quality Utility Group (SQUG) seismic commitments.
The ANO-2 IPEEE SMA assessed SSEL SSCs to a review level earthquake value of 0.30g PGA in accordance with NRC guidance in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Reference 6). Electric Power Research Institute (EPRI) NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin", Revision 1 (Reference 18), was used for the ANO-2 IPEEE seismic analysis.
The ANO-2 IPEEE (Reference 8) and the Reference 15 NRC safety evaluation report (SER) were reviewed for insights to determine the limiting plant HCLPF. For ANO-2, the RLE shape assigned by the NRC is the median NUREG/CR 0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants" (Reference 19), spectrum anchored at 0.30g PGA. The IPEEE included a review of the integrity of the containment building itself, containment isolation systems such as valves, mechanical and electrical penetrations, bypass systems, and plant-unique systems such as the Containment Cooling System (CCS), Containment Spray System (CSS), and Containment Isolation System (CIS). Failure of the containment structure was assessed as seismically rugged at meeting the 0.3g PGA RLE. The IPEEE did not identify any containment building vulnerabilities with respect to seismic events.
The uncertainty parameter for the plant level seismic capacity in this analysis is represented by a composite beta factor (c) of 0.4. This is a commonly-accepted approximation and is consistent with the value used in GI-199, Table C.1, "Bases for Establishing Plant-Level Fragility Curves Parameters from IPEEE Information" (Reference 12). Refer to Section 4 of the EPRI Seismic Probabilistic Risk Assessment Implementation Guide (Reference 14), for further discussion of fragility uncertainty parameters.
2CAN042301 Page 6 of 45
: 4. Convolution to Determine SCDF: The estimation of SCDF in this calculation is performed by a mathematical convolution of various ANO-2 seismic hazard curves (i.e., PGA and other spectral acceleration curves from Reference 11) and the SMA-based plant level seismic fragility. This convolution estimation approach is a common analysis in approximating an SCDF for use in risk-informed decision making (e.g., it is commonly used in RICT seismic penalty calculations; the NRC used this approach in the GI-199 risk assessment in Reference 12) in absence of a current full-scope SPRA.
: 5. Convolution to Determine SLERF: The estimation of SLERF in this calculation is performed by a second mathematical convolution in parallel with the SCDF convolution of the PGA-based seismic hazard curve and using a PGA-based seismic HCLPF for the containment function based on the conclusions of the ANO-2 IPEEE SMA (Reference 8).
This convolution estimation approach has been used in RICT seismic penalty calculations and accepted by the NRC in the absence of a full-scope SPRA.
3.3    Calculations The general approach to estimation of the SCDF is to use the plant level seismic fragility and convolve the corresponding failure probabilities as a function of seismic hazard level with the seismic hazard curve frequencies of occurrence. This is a commonly used approach to estimate SCDF when a seismic PRA is not available. This approach is the same as that used in previous TSTF-505 submittals, such as the Vogtle pilot TSTF-505 LAR (Reference 20) and the Calvert Cliffs TSTF-505 LAR (Reference 21).
The key elements of the SCDF convolution calculation (i.e., seismic hazard curve and associated hazard intervals used in the convolution calculation, plant level seismic-induced failure probabilities based on the plant level seismic fragility, and the resulting SCDF from the convolution calculation) and the SLERF calculations are discussed below.
3.4    Seismic Hazard and Intervals The seismic hazard in units of g (PGA, peak ground acceleration) is shown in Table E4-1 (from Reference 13; the relevant hazard curves in that report were developed per the seismic hazard analysis from Reference 11). The mean fractile occurrence frequencies of Table E4-1 are used in the calculations here; use of mean values is a typical and expected PRA practice.
To facilitate calculation of the ANO-2 plant fragility probability at each seismic hazard interval, a representative point value acceleration (g PGA) is calculated for each interval. The representative g value for the seismic hazard intervals is calculated using a geometric mean approach (i.e., the square root of the product of the g values at the beginning and end of a given interval). For the last open-ended seismic interval greater than 10g, the representative acceleration is estimated as 11g PGA. However, the precision of the representative magnitude used for the final open-ended seismic interval in the SCDF convolution is immaterial given that the calculated conditional failure probability of the final hazard interval (as well as the preceding three hazard intervals) is 1.0 and the contribution from this final interval has a negligible contribution to the overall SCDF estimate.
2CAN042301 Page 7 of 45 The seismic hazard interval annual initiating event frequency is calculated (except for the final interval) by subtracting the mean exceedance frequency associated with the g-interval (high) end point from the mean exceedance frequency associated with the g-interval beginning point.
The frequency of the last seismic hazard interval is the exceedance frequency at the beginning point of that interval. This is common practice in industry SPRAs (Reference 14).
Table E4-1: Seismic Hazard Data for ANO-2 (From Reference 11 Table A-1a - Mean and Fractile Seismic Hazard Curves for PGA (100 Hz) at ANO-2)
AMPS(g)        MEAN            0.05        0.16        0.50          0.84          0.95 0.0005        8.02E-02      4.31E-02    6.64E-02    8.12E-02      9.51E-02      9.93E-02 0.001        6.09E-02      2.76E-02    4.77E-02    6.09E-02      7.66E-02      8.72E-02 0.005        1.83E-02      7.77E-03    1.16E-02    1.69E-02      2.29E-02      3.84E-02 0.01        9.30E-03      3.73E-03    5.35E-03    8.23E-03      1.20E-02      2.25E-02 0.015        6.06E-03      2.10E-03    3.05E-03    5.27E-03      8.23E-03      1.51E-02 0.03        2.60E-03      5.50E-04    8.60E-04    1.92E-03      4.25E-03      7.34E-03 0.05        1.22E-03      1.77E-04    2.92E-04    6.93E-04      2.16E-03      4.19E-03 0.075        6.12E-04      7.45E-05    1.27E-04    2.96E-04      9.93E-04      2.32E-03 0.1        3.57E-04      4.07E-05    7.34E-05    1.67E-04      5.20E-04      1.38E-03 0.15        1.55E-04      1.74E-05    3.42E-05    7.66E-05      2.04E-04      5.75E-04 0.3        3.21E-05      3.47E-06    7.77E-06    1.92E-05      4.50E-05      1.04E-04 0.5        9.43E-06      7.89E-07    2.01E-06    5.91E-06      1.51E-05      2.92E-05 0.75        3.38E-06      1.82E-07    5.42E-07    1.98E-06      5.66E-06      1.11E-05 1        1.55E-06      5.35E-08    1.84E-07    8.23E-07      2.68E-06      5.42E-06 1.5        4.76E-07      7.03E-09    3.19E-08    1.98E-07      8.12E-07      1.82E-06 3        4.66E-08      2.39E-10    9.11E-10    1.02E-08      7.23E-08      2.10E-07 2CAN042301 Page 8 of 45 AMPS(g)            MEAN            0.05          0.16        0.50          0.84        0.95 5          6.22E-09      1.42E-10        1.84E-10  8.35E-10        8.12E-09    3.01E-08 7.5          1.02E-09      1.32E-10        1.60E-10  2.13E-10        1.20E-09    5.12E-09 10          2.51E-10      1.21E-10        1.32E-10  1.82E-10        3.57E-10    1.36E-09 3.5    Seismic Failure Probabilities The seismic failure probability of the ANO-2 limiting plant fragility for each seismic hazard interval is calculated using the following fragility equations (this is for the Mean confidence level). These are the typical lognormal fragility equations used in most hazard PRAs (Reference 14).
Fragility (i.e., failure probability) =  [ln(A/Am)/c],
Where:
is the standard lognormal distribution function A is the g level in question, Am is the median seismic capacity, and the uncertainty parameters (betas) are related as follows:
c = (u^2 + r^2)^0.5.
HCLPF and Am are related as follows:
Am = HCLPF / (exp -2.33c)
As discussed previously, the HCLPF point of the ANO-2 IPEEE plant level seismic fragility curve is 0.30g PGA. The uncertainty variable c for the ANO-2 plant level fragility is set to a value of 0.4; this uncertainty variable value is consistent with that used by the NRC for the ANO-2 plant in Reference 12 as well as it is typical for use as a representative composite uncertainty (refer to Section 6.4 of Reference 22).
3.6    Seismic Core Damage Frequency The SCDF for each hazard interval is computed as the product of the hazard interval initiating event frequency (/yr) and the plant level seismic fragility failure probability for that same hazard interval. The results per hazard interval are then straight summed to produce the overall total SCDF across the entire hazard curve. The SCDF convolution calculation is summarized in Table E4-2 and shows the total estimated SCDF is 5.45E-6/yr. Table E4-2 provides the following information:
2CAN042301 Page 9 of 45
* Seismic hazard intervals and the associated initiating event frequencies (Mean) and representative magnitudes
* Plant level HCLPF fragility failure probabilities (Mean) per hazard interval
* Convolved SCDF per interval and total SCDF To evaluate the effect of using the different available hazard curves from the ANO-2 probabilistic seismic hazards analysis (PSHA), the seismic penalty calculation has been re-performed with different hazard curves in the 1 Hz to 10 Hz range (i.e., the range of spectral values that would be used in an SPRA as an alternative to PGA). The plant-level fragility median (Am) value is adjusted per the ANO-2 2013 ground motion response spectra shape (Table 2.4-1 of Reference 11) for each convolution sensitivity case (keeping c=0.4 for each case). The convolved SCDF result from each hazard curve is summarized below:
PGA        10 Hz        5 Hz        2.5 Hz      1 Hz Plant-Level Fragility (Am):        0.76g        1.57g      1.27g        0.78g      0.49g Convolved SCDF:                    5.45E-6    5.58E-6      5.17E-6      5.01E-6    5.03E-6 As can be seen, from 1 Hz to PGA (100 Hz) the resulting convolved SCDF estimates are very similar (differing by less than 10% from the PGA result). The 2.5 Hz and 1 Hz hazards produce the lowest SCDF estimates and the PGA and 10 Hz hazards produce the highest (the 10 Hz SCDF estimate is 2% higher than the PGA based SCDF estimate). These are small differences in such approximation calculations and considering the uncertainties in seismic hazard and response. The ANO-2 seismic penalty used in the RICT calculations is the PGA-based value; this is reasonable given these sensitivities.
3.7    Seismic Large Early Release Frequency The estimation of SLERF is performed here as a double convolution of the ANO-2 seismic hazard curve (refer to Section 3.4), the plant level fragility (refer to Section 3.5), and a separate independent seismic fragility for containment integrity. The results per hazard interval are then straight summed to produce the overall total SLERF across the hazard curve. This conservative approach typically produces a seismic CLERP (SCLERP) value of approximately 0.5 (a comparatively high value for a pressurized water reactor (PWR)). This approach has been used in past RICT LARs (e.g., Reference 23) and is an acceptable NRC approach as evidenced in recent (2020 - 2022) audits and RAIs associated with industry RICT LARs.
The assumed seismic capacity for containment integrity used in the ANO-2 SLERF calculation has a HCLPF value of 0.3g PGA (and, same as SCDF plant level fragility, with a composite beta factor (c) of 0.4), as described below:
* The assumed 0.3g PGA HCLPF for ANO-2 containment integrity is based on the results of the ANO-2 IPEEE SMA (Reference 8).
* The ANO-2 IPEEE SMA was performed to a 0.3g PGA RLE.
2CAN042301 Page 10 of 45
* The ANO-2 IPEEE did not identify any containment vulnerabilities. The IPEEE SMA evaluated containment performance from structural, isolation, and bypass perspectives. The structure was found to be seismically rugged. The isolation valves and associated relays are seismically rugged, or the outside systems are seismically rugged and designed for high pressure.
* All containment related SSCs were assessed to meet the 0.3g PGA RLE.
The SLERF convolution calculation is summarized in Table E4-3. Table E4-3 provides the following information:
* Hazard intervals and the associated initiating event frequencies (Mean) and representative magnitudes.
* Plant level fragility failure probabilities (Mean) per hazard interval.
* Containment fragility failure probabilities (Mean) per hazard interval.
* Convolved SLERF per interval and total SLERF.
The following equation applies to each hazard interval in Table E4-3 (the total SLERF is the sum of the SLERF i results for all of the hazard intervals):
SLERF_i = (Hazard_Interval_Plant Level Fragility Failure Prob_i) x (Hazard_Interval_Containment_Fragility Failure Prob_i) x (Hazard_Interval_Occurrence_Frequency_i)
As shown in Table E4-3, the total estimated SLERF is 2.59E-06/yr.
2CAN042301 Page 11 of 45 Table E4-2: Convolution Calculation Summary of ANO-2 Seismic CDF Hazard Interval Mean          Representative      Hazard Interval  Hazard Interval Peak Ground    Exceedance          Magnitude            Plant-Level      Occurrence      Convolved Acceleration (g) Frequency (/yr)  (geo. mean, g PGA)    Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.0005        8.02E-02              0.0007            1.55E-68        1.93E-02        3.00E-70 0.001        6.09E-02              0.0022            1.95E-48        4.26E-02        8.30E-50 0.005        1.83E-02              0.0071            6.42E-32        9.00E-03        5.77E-34 0.01        9.30E-03              0.0122            2.68E-25        3.24E-03        8.69E-28 0.015        6.06E-03              0.0212            1.73E-19        3.46E-03        5.99E-22 0.03        2.60E-03              0.0387            4.74E-14        1.38E-03        6.54E-17 0.05        1.22E-03              0.0612            1.46E-10        6.08E-04        8.90E-14 0.075        6.12E-04              0.0866            2.72E-08        2.55E-04        6.94E-12 0.1        3.57E-04              0.1225            2.44E-06        2.02E-04        4.93E-10 0.15        1.55E-04              0.2121            6.96E-04        1.23E-04        8.55E-08 0.3        3.21E-05              0.3873            4.54E-02        2.27E-05        1.03E-06 2CAN042301 Page 12 of 45 Hazard Interval Mean        Representative      Hazard Interval Hazard Interval Peak Ground    Exceedance        Magnitude          Plant-Level      Occurrence          Convolved Acceleration (g) Frequency (/yr) (geo. mean, g PGA)  Fragility (Mean) Frequency (/yr)    Frequency (/yr) 0.5        9.43E-06            0.6124            2.92E-01        6.05E-06            1.77E-06 0.75        3.38E-06            0.8660            6.26E-01        1.83E-06            1.14E-06 1          1.55E-06            1.2247            8.82E-01        1.07E-06            9.48E-07 1.5        4.76E-07            2.1213            9.95E-01        4.29E-07            4.27E-07 3          4.66E-08            3.8730          1.00E+00        4.04E-08            4.04E-08 5          6.22E-09            6.1237          1.00E+00        5.20E-09            5.20E-09 7.5        1.02E-09            8.6603          1.00E+00        7.69E-10            7.69E-10 10          2.51E-10          11.0000          1.00E+00        2.51E-10            2.51E-10 Total Convolved SCDF Across PGA Hazard Curve (1/yr): 5.45E-6 2CAN042301 Page 13 of 45 Table E4-3: Convolution Calculation Summary of ANO-2 Seismic LERF Hazard Interval      Hazard Mean          Representative      Interval Exceedance          Magnitude      Plant-Level Hazard Interval  Hazard Interval Peak Ground      Frequency        (geo. mean,        Fragility  Reactor Bldg      Occurrence      Convolved Acceleration (g)    (/yr)            g PGA)            (Mean)  Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.0005        8.02E-02            0.0007          1.55E-68      1.55E-68        1.93E-02        4.65E-138 0.001        6.09E-02            0.0022          1.95E-48      1.95E-48        4.26E-02        1.62E-97 0.005        1.83E-02            0.0071          6.42E-32      6.42E-32        9.00E-03        3.70E-65 0.01        9.30E-03            0.0122          2.68E-25      2.68E-25        3.24E-03        2.33E-52 0.015        6.06E-03            0.0212          1.73E-19      1.73E-19        3.46E-03        1.04E-40 0.03        2.60E-03            0.0387          4.74E-14      4.74E-14        1.38E-03        3.10E-30 0.05        1.22E-03            0.0612          1.46E-10      1.46E-10        6.08E-04        1.30E-23 0.075        6.12E-04            0.0866          2.72E-08      2.72E-08        2.55E-04        1.89E-19 0.1        3.57E-04            0.1225          2.44E-06      2.44E-06        2.02E-04        1.20E-15 0.15        1.55E-04            0.2121          6.96E-04      6.96E-04        1.23E-04        5.95E-11 0.3        3.21E-05            0.3873          4.54E-02      4.54E-02        2.27E-05        4.67E-08 2CAN042301 Page 14 of 45 Hazard Interval    Hazard Mean  Representative      Interval Exceedance  Magnitude      Plant-Level Hazard Interval  Hazard Interval Peak Ground      Frequency  (geo. mean,      Fragility  Reactor Bldg      Occurrence      Convolved Acceleration (g)    (/yr)    g PGA)            (Mean)  Fragility (Mean) Frequency (/yr) Frequency (/yr) 0.5        9.43E-06    0.6124        2.92E-01      2.92E-01        6.05E-06        5.18E-07 0.75        3.38E-06    0.8660        6.26E-01      6.26E-01        1.83E-06        7.16E-07 1          1.55E-06    1.2247        8.82E-01      8.82E-01        1.07E-06        8.36E-07 1.5        4.76E-07    2.1213        9.95E-01      9.95E-01        4.29E-07        4.25E-07 3          4.66E-08    3.8730        1.00E+00      1.00E+00        4.04E-08        4.04E-08 5          6.22E-09    6.1237        1.00E+00      1.00E+00        5.20E-09        5.20E-09 7.5        1.02E-09    8.6603        1.00E+00      1.00E+00        7.69E-10        7.69E-10 10          2.51E-10    11.0000        1.00E+00      1.00E+00        2.51E-10        2.51E-10 Total Convolved SLERF Across PGA Hazard Curve (1/yr): 2.59E-6 2CAN042301 Page 15 of 45 Containment Isolation The following discussions regarding random and seismic-induced failure of containment isolation are provided to support the reasonableness of the average SLERF estimation (e.g.,
there are no normally-open AC-powered motor-operated containment isolation valves (CIVs) that would lead directly to an unscrubbed release and a LERF end state):
Containment Isolation Random Failure: Random failure of containment isolation is already inherently included in the SLERF estimation discussed previously. The average SCLERP from the SLERF estimation is 0.47 (i.e., 2.59E-6/5.45E-6 = 0.47) whereas the non-seismic conditional probability of containment isolation failure is more than two orders of magnitude lower (dominated by the pre-existing leakage basic event L2TEAR in the containment isolation fault tree of the ANO-2 Full Power Internal Events (FPIE) Level 2 PRA Model (References 24 and 25).
Containment Isolation Fragility: Seismic-induced failure of containment isolation is very low likelihood and encompassed by the previously calculated SLERF. The CIVs of interest to the LERF risk metric are primarily air-operated valves (AOVs) and motor-operated valves (MOVs), all normally-closed at-power. The AOVs (whether initially open or not) would fail-safe (close) upon on loss of pneumatic or electric power (e.g., seismic-induced LOOP). The MOVs are supplied by onsite vital power and, assuming the failure of one vital power train, at least one containment isolation in each containment penetration would close as designed (the redundant valve being an MOV powered from the redundant vital electrical train, a check valve, or an AOV). Successful containment isolation in preventing a LERF release for seismic-induced accidents is not dependent upon pneumatic supply, electric power, or containment isolation signals (i.e., ~99% of SCDF involves seismic-induced LOOP and the CIVs fail-safe closed under such conditions).
The CIVs have very high seismic capacities such that seismic loading will have a negligible likelihood of failing the CIVs in the open position. The AOV CIVs fail-safe (close) via internal spring force inside the AOV operator. Once closed, these valves do not need to open again during or after the seismic event.
Therefore, AOVs do not meet the definition of an "active" valve per the AOV equipment class (per the EPRI SQUG Generic Implementation Procedure, GIP, and EPRI NP-7149, "Seismic Adequacy of Equipment Classes"). The spring will successfully cause the CIVs to shut at accelerations much greater than those associated with the functional failure capacity used to determine the fragility of active valves. As such, these CIVs are essentially inactive valves, which are inherently rugged as there is not a credible seismic failure mechanism that would prevent the valves from failing shut as desired. In addition, both in-series CIVs in a penetration line would have to seismically fail open to result in an open release pathway.
2CAN042301 Page 16 of 45 Some penetrations use MOVs for containment isolation which would require electric power for closure. However, such containment isolation MOVs are not significant to SLERF for one or more of the following reasons:
* MOV is in closed position during at-power operation (or very low likelihood of being open) at the time of the seismic event (e.g., equipment drains)
* Very small line (e.g., 1" diameter instrument gas line)
* AOV or check valve CIV in-series with the MOV
* Penetration is a closed-loop system or otherwise scrubbed that would not represent a LERF (i.e., "large" magnitude release).
* At least one in-series MOV in a penetration consisting of two redundantly vital-powered MOVs, an MOV and an AOV, or an MOV and a check valve, will close as designed (assuming loss of one onsite vital electrical train).
Application of SLERF in RICT Calculations The SLERF estimate documented above is conservatively used in the RICT process.
Conservatism in the RICT process derived from the proposed approach applies the total estimated annual SLERF as a delta SLERF in each RICT calculation, regardless of the duration of the RICT. The total estimated annual SCDF and SLERF will be applied starting at time zero for each RICT calculation.
3.8    Evaluation of Seismic Induced LOOP Past TSTF-505 applications have also included separate discussion and evaluation of incremental risk associated with challenges to the facility that do not exceed the design capacity and the past submittals have focused on the challenge of seismically-induced LOOP. The ANO-2 seismic penalty calculation already encompasses seismic events within (i.e., at or below) the design basis by conservatively including very low magnitude seismic events (as low as 0.0005g peak ground acceleration, PGA, i.e., significantly lower than the ANO-2 Safe Shutdown Earthquake (SSE) of 0.20g PGA) in the SCDF and SLERF convolution calculations.
These very low magnitudes are also well below the ANO-2 Operating Basis Earthquake (OBE) of 0.1g, half of the SSE); the plant is reasonably expected to remain online for seismic events below the OBE. Additional discussions and calculations are provided here regarding the inconsequential impact on RICT calculations from plant challenges associated with seismic-induced LOOP from earthquakes within the design basis.
The approach used in the discussion below is the same as used in past LARs that have explicitly discussed this topic, i.e., 1) estimate the annual frequency of seismic-induced LOOP;
: 2) assume no offsite AC recovery within 24 hours; and 3) compare the result with the internal events PRA frequency estimate for non-recovered LOOP. The methodology used for computing the seismically-induced LOOP frequency is to convolve the ANO-2 mean PGA seismic hazard curve with an offsite power seismic fragility. Some previous TSTF-505 applications have approached this discussion conservatively by performing the seismic-induced LOOP convolution calculation over the entire hazard curve (not just the portion of the hazard curve below the design basis). That same approach is used here but the result for seismic events within the design basis is also provided.
2CAN042301 Page 17 of 45 Table E4-4 provides the ANO-2 mean PGA seismic hazard data and the LOOP seismic-induced failure probability (increasing with increasing seismic magnitude) based on the seismic fragility of offsite power. The seismic-induced LOOP convolution calculation in Table E4-4 includes the entire seismic hazard curve from earthquakes magnitudes well below the ANO-2 OBE to well beyond the ANO-2 SSE.
The failure probabilities for seismic-induced LOOP are represented by seismic induced failure of ceramic insulators in the offsite AC power distribution system, based on the following seismic fragility data from Table A-0-4 of the NRC RASP Handbook, Volume 2 (Reference 26). This is a common offsite power seismic fragility used for Central and Eastern US SPRAs and seismic risk calculations:
Offsite Power Seismic Capacity (ceramic insulators):
* Median Acceleration Capacity, Am = 0.30g PGA
* Randomness uncertainty, R = 0.30
* Modeling uncertainty, U = 0.45 Given the mean frequency and failure probability for each seismic hazard interval, it is straightforward to compute the estimated frequency of seismically-induced LOOP for the ANO-2 site by multiplying the hazard interval occurrence frequency and the offsite power fragility failure probability. As shown in Table E4-4, the total seismic-induced LOOP frequency across the entire seismic hazard curve is estimated at 6.9E-5/yr. Note that this overstates the "within design basis" challenge frequency but is conservative for this purpose.
The ANO-2 FPIE PRA models LOOP from plant-centered, switchyard-centered, grid-related, and weather-related events. Based on the ANO-2 FPIE PRA, the total 24-hour non-recovered LOOP frequency is 1.3E-3/yr.
Assuming offsite AC recovery failure probability of 1.0 for 24 hours for seismic-induced LOOP, the total (i.e., across the entire hazard curve) 24-hour non-recovered seismic-induced LOOP frequency is 5.2% (i.e., 6.9E-05 / 1.3E-03 = 5.2%: single significant digit frequencies typed here, but all significant digits used in the calculations) of the total 24-hour non-recovered LOOP frequency already addressed in the FPIE PRA. The "within design basis" (i.e., up to the 0.2g PGA SSE) 24-hour non-recovered seismic-induced LOOP frequency is 1.7% (i.e., 2.3E-05 /
1.3E-03 = 1.7%: single significant digit frequencies typed here, but all significant digits used in the calculations) of the total 24-hour non-recovered LOOP frequency already addressed in the FPIE PRA.
As can be seen, the 24-hour non-recovered seismic-induced LOOP frequency with the design basis is a very small percentage of the frequency of such challenges already captured in the FPIE PRA (which is explicitly used in RICT calculations) such that it will not significantly impact the RICT Program calculations and it can be omitted from explicit analysis in RICT calculations.
In addition, the ANO-2 seismic penalty calculation already addresses the fraction of seismic-induced LOOP events within (i.e., at or below) the design basis by conservatively including very low magnitude seismic events in the seismic penalty convolution calculation.
2CAN042301 Page 18 of 45 Table E4-4: ANO-2 Seismic-Induced LOOP Frequency Estimate (Across Entire Seismic Hazard Curve)
ANO-2 Offsite Power    ANO-2 Seismic Hazard                            Convolution Calculation HCLPF                  Curve (PGA)              (ANO-2 Offsite Power HCLPF Fragility with Seismic Hazard)
Mean      Hazard Interval Peak Ground    Exceedance    Representative                    Hazard Interval  Convolved HCLPF      Am            Acceleration    Frequency    Magnitude (geo. Hazard Interval  Occurrence      Frequency (g,PGA)  (g,PGA)    C        (q)          (/yr)      mean, g PGA)    Fragility (Mean) Frequency (/yr)      (/yr) 0.09      0.30    0.54    0.0005        8.02E-02          0.0007          1.89E-29        1.93E-02        3.64E-31 0.001        6.09E-02          0.0022          5.52E-20        4.26E-02        2.35E-21 0.005        1.83E-02          0.0071          1.83E-12        9.00E-03        1.65E-14 0.01          9.30E-03          0.0122          1.48E-09        3.24E-03        4.80E-12 0.015        6.06E-03          0.0212          4.37E-07        3.46E-03        1.51E-09 0.03          2.60E-03          0.0387          7.09E-05        1.38E-03        9.78E-08 0.05          1.22E-03          0.0612          1.55E-03        6.08E-04        9.42E-07 0.075        6.12E-04          0.0866          1.02E-02        2.55E-04        2.61E-06 0.1          3.57E-04          0.1225          4.68E-02        2.02E-04        9.46E-06 0.15          1.55E-04          0.2121          2.54E-01        1.23E-04        3.13E-05 0.3          3.21E-05          0.3873        6.75E-01        2.27E-05        1.53E-05 0.5          9.43E-06          0.6124          9.03E-01        6.05E-06        5.46E-06 0.75          3.38E-06          0.8660          9.74E-01        1.83E-06        1.78E-06 1            1.55E-06          1.2247          9.95E-01        1.07E-06        1.07E-06 1.5          4.76E-07          2.1213        1.00E+00        4.29E-07        4.29E-07 3            4.66E-08          3.8730        1.00E+00        4.04E-08        4.04E-08 5            6.22E-09          6.1237        1.00E+00        5.20E-09        5.20E-09 7.5          1.02E-09          8.6603        1.00E+00        7.69E-10        7.69E-10 10            2.51E-10        11.0000        1.00E+00        2.51E-10        2.51E-10 Total Convolved Seismic LOOP Across Hazard Curve (1/yr):      6.85E-05 2CAN042301 Page 19 of 45 3.9    Summary Estimates of SCDF and SLERF have been derived for use in the ANO-2 RICT Program. Since the estimates are intended to be treated as conservative values in the RICT calculations for that program, the results (listed below) for the case of plant level fragility HCLPF = 0.30g PGA (and reactor building fragility HCLPF of 0.30g PGA) with c = 0.4 will be used:
Seismic CDF = 5.45E-6/yr Seismic LERF = 2.59E-6/yr
: 4. Extreme Winds Analysis This section describes the extreme wind hazard analysis for ANO-2.
As background to the screening analysis for high winds and tornados at ANO-2, Section 5.1.1 of the IPEEE (Reference 7) notes that the design and construction of the ANO units was initiated several years prior to the NRCs issuance of the 1975 SRP. Structures and components were designed using the guidance provided in American Society of Civil Engineers (ASCE)
Paper 3269, "Wind Forces on Structures." Thus, there are some differences in the ANO design compared to the SRP requirements.
4.1    Wind Pressure Section 5.1.1 of the IPEEE (Reference 7) documents the screening of High Winds. It was determined that the ANO-2 design basis is mostly consistent with the 1975 SRP requirements (Reference 5) for non-tornadic winds. The differences with the SRP were determined to be insignificant, primarily because the ANO-2 design is controlled by tornadic and not straight winds.
Table 5.1-1 of the IPEEE provides a comparison of the ANO-2 design basis tornado parameters to the requirements in Regulatory Guide (RG) 1.76, "Design-basis Tornado and Tornado Missiles for Nuclear Power Plants" (Reference 27). Key equipment and structures are designed to withstand a maximum wind speed of 300 mph, external pressure drop of 3 psi, and rate of pressure drop of 1 psi/sec. Additionally, key Category I components outside of Category I structures (e.g., diesel exhausts and certain tanks) were determined to be capable of withstanding the tornado effects (Reference 7).
The RG 1.76 criteria are higher for wind speed (360 mph) and rate of pressure drop (2 psi/sec).
The ANO-2 design considers all Category I structures unvented; therefore, the rate of pressure drop is not relevant to the design (Reference 7). However, the ANO-2 design does not meet the criteria for the maximum wind speed. Tornado wind speed hazard curve information for ANO-2 is provided in Table 6-1 of NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2 (Reference 28). The wind speed for the 1E-7 annual exceedance probability is 297 mph, using the Fujita Scale (F-Scale). Therefore, the frequency of the design tornado wind speed for ANO-2 is approximately equal to the 1E-7/yr (based on the conservative F-Scale), which is much less than 1E-6/yr.
2CAN042301 Page 20 of 45 Tropical storms (i.e., hurricanes) are not a concern at ANO-2 due its location (i.e., approximately 400 miles inland). Straight winds (e.g., due to thunderstorms) are typically in the 50 - 70 mph range, although in rare cases may be over 100 mph. However, the hazard curve for straight winds tails off very quickly, such that below approximately 1.0E-03/yr, straight winds do not affect the overall wind hazard for areas with hurricane and/or tornado hazards (Reference 29).
Therefore, the CDF contribution from wind speeds greater than 300 mph is less than 1E-6/yr, and wind pressure effects from high winds and tornados are screened from further evaluation.
4.2    Tornado Missiles Section 5.1.3 of the IPEEE estimated that the contribution of tornado missiles to CDF was less than 1E-6/yr. This was based on the following:
* The minimum 1'-6" thick reinforced concrete barrier (walls) utilized at ANO-2 are sufficient to preclude perforation or spalling damage from postulated SRP tornado missiles.
* Although exposed tanks (e.g., condensate storage tank, refueling water tank) are susceptible to perforation from tornado missiles, the contribution from tornado missile failure of each tank to CDF was estimated to be less than 1E-8/yr.
* The diesel exhausts are exposed and could potentially be damaged due to missile perforation. The IPEEE stated that a missile large enough to crush or significantly block the flow of exhaust gases was not credible.
Subsequent to the IPEEE, some SSCs required to be protected against tornado missiles were found to be susceptible to tornado missiles and not in conformance with the ANO-2 current licensing basis. Analyses were performed to determine the risk associated with these non-conformances. During walkdowns in support of the risk evaluation of the non-conforming SSCs, additional vulnerable SSCs were identified. Several plant modifications were made to protect vulnerable SSCs (e.g., installation of missile barriers and steel reinforcement for certain walls).
A conservative risk model was developed to calculate the contribution of tornado missile risk to the ANO-2 CDF and LERF and was reviewed in the Tornado Missile Penalty Factor Evaluation (Reference 30) to determine the impact for the TSTF-505 application.
The results of the base (average maintenance with average plant availability factor) conservative tornado risk model (CTRM) are:
CDF      5.0E-7/yr LERF      1.5E-8/yr These results are significantly less than 1E-6/yr and 1E-7/yr for CDF and LERF, respectively.
Therefore, tornado missile hazard average risk can be screened from consideration for TSTF-505 application, based on Criterion PS4 of Table E4-6.
However, the CDF due to tornado missiles for certain maintenance or LCO configurations is determined to be above 1E-6/yr, requiring a tornado missile (TM) penalty factor to be established for RICT calculations. The ANO-2 Tornado Missile Penalty Factor Calculations report (Reference 30) documents the calculations used to determine the TM penalty factors (CDF and LERF).
2CAN042301 Page 21 of 45 The CTRM was quantified for configurations associated with RICT LCO configurations, including risk significant combinations of unavailable SSCs (i.e., multiple concurrent LCOs). All other maintenance terms were set to FALSE for these quantifications.
For the CDF penalty factor:
* Single LCOs with high CDF and CDF involve red train equipment, including 4160 VAC switchgear 2A-3 (LCO 3.8.1.1, Action c, and LCO 3.8.2.1), switchgear 2A-1 (LCO 3.8.1.1, Action c), and DG #1 (LCO 3.8.1.1, Action c). These LCO configurations have CDF of 4.2E-6/yr and CDF of 3.7E-6/yr.
* The configuration with the following multiple simultaneous LCOs has a CDF and CDF of 4.8E-6/yr and 4.3E-6/yr, respectively: Red (A) train SSCs switchgear 2A-3 (LCOs 3.8.1.1, Action c, and LCO 3.8.2.1), DG #1 (LCO 3.8.1.1, Action b), SWS Loop 1 (LCO 3.7.3.1), and EFW Train B with EFW Train A Steam Supply Valve 2CV-1000 (LCO 3.7.1.2 Action c).
* CDF for other LCO configurations are less than 4E-6/yr.
* CDF and CDF for many LCOs and SSCs are less than 1E-6/yr.
For the LERF penalty factor:
* The most limiting is configuration is LCO 3.6.1.3, Action c, which is associated with the containment door air locks that are not explicitly modeled in the PRA. For the RICT calculations, the PRA model uses a surrogate event that is associated with a large pre-existing containment flaw (opening) that results in failure to isolate containment (i.e.,
core damage leads directly to large early release with a probability of 1.0). It is expected that this would result in the most significant LERF increase due to this assumed containment failure; therefore, it is considered bounding for all LCOs for LERF. The resulting LERF and LERF for this case is 5.1E-7/yr and 5.0E-7/yr, respectively.
* LERF and LERF for LCO 3.6.3.1 (containment isolation valves) are 4.3E-7/yr and 4.2E-7/yr, respectively.
* LERF and LERF for all other LCOs and combinations of LCOs are less than 4E-7/yr; many are below 1E-7/yr.
Based on the evaluation of configurations involving single and multiple LCOs, the conservative TM penalty factors chosen to be applied to all RICT configurations are:
CDF      5E-6/yr LERF      5E-7/yr Note that configurations involving LCO 3.8.2.3.b for the red train DC have a CDF and CDF for the high wind tornado missile hazard as high as 6.3E-6/yr and 5.8E-6/yr, respectively. Thus, the CDF for these configurations is higher than the penalty factor of 5E-6/yr. These are the only configurations with CDF greater than 5E-6/yr. These cases were not considered in the penalty factor development, because the total instantaneous CDF from fire, internal, and seismic events is approximately 4E-3/yr. Since this is above the instantaneous threshold for voluntary entry into a RICT, it is unlikely that configurations involving this LCO will be entered. In the event that 2CAN042301 Page 22 of 45 this LCO is involved in a RICT configuration, the RICT calculated with the 5E-6/yr penalty factor is essentially the same as it would be if the penalty factor were 5.8E-6/yr (i.e., the difference is less than 1 minute).
: 5. Evaluation of External Event Challenges and IPEEE Update Results This Section provides an evaluation of other external hazards. The results of the assessment of these hazards are provided in Table E4-5. Table E4-6 provides the summary criteria for screening of the hazards listed in Table E4-5.
Hazard Screening The IPEEE for ANO-2 provides an assessment of the risk to ANO-2 associated with these hazards. Additional analyses have been performed since the IPEEE to provide updated risk assessments of various hazards, such as aircraft impacts, industrial facilities and pipelines, and external flooding. These analyses are documented in the SAR (Reference 31). Table E4-5 reviews and provides the bases for the screening of external hazards, identifies any challenges posed, and identifies any additional treatment of these challenges, if required. The conclusions of the assessment, as documented in Table E4-5, assure that the hazard either does not present a design-basis challenge to ANO-2, or is adequately addressed in the PRA.
In the application of RICTs, a significant consideration in the screening of external hazards is whether particular plant configurations could impact the decision on whether a particular hazard that screens under the normal plant configuration and the base risk profile would still screen given the particular configuration. The external hazards screening evaluation for ANO-2 has been performed accounting for such configuration-specific impacts. The process involves several steps.
As a first step in this screening process, hazards that screen out for one or more of the following criteria (as defined in Table E4-6) still screen out regardless of the configuration, as these criteria are not dependent on the plant configuration.
* The occurrence of the event is of sufficiently low frequency that its impact on plant risk does not appreciably impact CDF or LERF. (Criterion C2)
* The event cannot occur close enough to the plant to affect it. (Criterion C3)
* The event which subsumes the external hazard is still applicable and bounds the hazard for other configurations. (Criterion C4)
* The event develops slowly, allowing adequate time to eliminate or mitigate the hazard or its impact on the plant. (Criterion C5)
The next step in the screening process is to consider the remaining hazards (i.e., those not screened per the above criteria) to consider the impact of the hazard on the plant given particular configurations for which a RICT is allowed. For hazards for which the ability to achieve safe shutdown may be impacted by one or more such plant configurations, the impact of the hazard to particular SSCs is assessed and a basis for the screening decision applicable to configurations impacting those SSCs is provided.
As noted above, the configurations to be evaluated are those involving unavailable SSCs whose LCOs are included in the RICT program.
2CAN042301 Page 23 of 45 Table E4-5: Other External Hazards Disposition1 Screening Hazard                    Definition                                                ANO-2 Disposition for TSTF-505 Criteria Acceptance Criterion 1.A of SRP 3.5.1.6 (Reference 32) states the An aircraft (either a portion of              probability is considered to be less than an order of magnitude of 10-7 per (e.g., missile) or the entire                  year by inspection if the plant-to-airport distance D is between 5 and aircraft) that collides either                10 statute miles, and the projected annual number of operations is less than directly or indirectly (i.e.,                  500 D2, or the plant-to-airport distance D is greater than 10 statute miles, skidding impact with one or                    and the projected annual number of operations is less than 1000 D2.
more SSCs at or in the                        Per the ANO-2 SAR (Reference 31), there is no major airport with a control Aircraft Impact    plants analyzed area              PS2, PS4  tower within 50 miles of the plant site. The closest airports are the causing functional failure.                    Russellville Municipal Airport (8 miles) and the Clarksville Municipal Airport Secondary hazards resulting                    (15 miles). None of these airports has any regularly scheduled air traffic.
from an aircraft impact                        Based on this review, the aircraft impact hazard is considered to be include, but are not                          negligible.
necessarily limited to, fire.                  There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Rapid flow of a large mass of accumulated frozen precipitation and other debris down a sloped surface                          Per the IPEEE Report (Reference 7), the topography is such that no resulting in dynamic loading                  avalanche is possible.
Avalanche        of SSCs at or in the plants          C3      Based on this review, the avalanche hazard is considered to be negligible.
analyzed area causing                          There are no configuration specific considerations for this hazard. This functional failure or adverse                  hazard can be excluded from the RICT Program evaluation.
impact on natural water supplies used for heat rejection.
1 The list of hazards and their potential impacts considered those items listed in Tables D-1 and D-2 in Appendix D of RG 1.200, Revision 3 (Reference 39).
2CAN042301 Page 24 of 45 Screening Hazard                  Definition                                            ANO-2 Disposition for TSTF-505 Criteria Per ANO-2 SAR, Section 9.2.1 (Reference 31), to help limit biological fouling such as flow blockage from bivalve mollusks, Corbicula (Asiatic clams), a biocide is added at the intake structure in sufficient concentration to kill the mollusks.
Accumulation or deposition of            Station procedures provide for addition of biocide in the SWS and vegetation or organisms                  Emergency Cooling Pond (ECP). The SWS intake bays are also inspected (e.g., zebra mussels, clams,            and cleaned at least once every refueling outage to prevent clam buildup fish, algae) on an intake                and fouling.
Biological Events structure or internal to a        C5 Flow measurement orifices and instrumentation has been added to several system that uses raw cooling of the auxiliary building coolers. Flow measurements are periodically taken water from a source of and trended to detect any possible developing flow blockage from biological surface water, causing its fouling.
functional failure.
Based on this review, the biological event hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Removal of material from a              Per the IPEEE Report (Reference 7), the site is located 6 miles W-NW of shoreline of a body of water            Russellville, Arkansas, on the peninsula formed by the Dardanelle Reservoir (e.g., river, lake, ocean) due          on the Arkansas River. There are several flood control dams upstream and to surface processes (e.g.,              downstream of the plant; therefore, erosion is not a significant concern.
wave action, tidal currents,            In addition, per ANO-2 SAR, Section 2.4 (Reference 31), the ECP is wave currents, drainage, or              excavated in natural soil; therefore, erosion is limited by the natural Coastal Erosion                                  C1, C3 winds and including river bed            topography of the site.
scouring) that results in damage to the foundation of              Based on this review, the coastal erosion hazard is considered to be SSCs at or in the plants                negligible.
analyzed area, causing                  There are no configuration specific considerations for this hazard. This functional failure.                      hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 25 of 45 Screening Hazard            Definition                                          ANO-2 Disposition for TSTF-505 Criteria A shortage of surface water              Per the IPEEE Report (Reference 7), drought is not a concern at ANO-2.
supplies due to a period of              Cooling water is provided by the Dardanelle Reservoir and ECP. In addition, below-average precipitation              drought is a slowly developing hazard allowing time for orderly plant in a given region, thereby              reductions, including shutdowns.
Drought                                  C1, C5 depleting the water supply Based on this review, the drought hazard is considered to be negligible.
needed for the various water-cooling functions at the          There are no configuration specific considerations for this hazard. This facility.                                hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 26 of 45 Screening Hazard                Definition                                            ANO-2 Disposition for TSTF-505 Criteria The evaluation of the impact of the external flooding hazard at the site was updated as a result of the NRC's post-Fukushima 50.54(f) Request for Information.
The ANO Units 1 and 2 flood hazard reevaluation report (FHRR) was submitted to NRC for review on September 14, 2016 (Reference 33). The FHRR determined that the only location where water ingress may have potential to impact key SSCs was via the turbine building train bay doors due to local intense precipitation (LIP).
By {{letter dated|date=May 31, 2017|text=letter dated May 31, 2017}}, ANO submitted its focused evaluation (FE)
An excess of water outside                (Reference 34) for ANO Units 1 and 2. The FE demonstrated that no doors, the plant boundary that                  buildings, or propagation pathways that contain key SSCs are impacted by causes functional failure to              floodwaters during the LIP event. The calculated ponding levels were below plant SSCs. External flood                the controlling current design bases (CDB) event, which is a probable causes include, but may not              maximum flood (PMF) from the Arkansas River coincident with upstream be limited to, flooding due to            dam failure and wind-generated waves.
External Flood dam failure, high tide,            C1    Any other buildings that are inundated by floodwaters or the propagation of hurricane (tropical cyclone),            floodwaters do not contain any SSCs or equipment that would affect the ice cover, local intense                  ability to maintain any of the key safety functions required to achieve and precipitation, river diversion,          maintain safe shutdown. This includes the Turbine Building.
river and stream overflow,                All vulnerabilities due to the unbounded LIP mechanism were addressed by seiche, storm surge, and                  permanent flooding protection and available physical margin was tsunami.                                  demonstrated to be adequate to protect SSCs required to achieve and maintain safe shutdown. After its review of the ANO FE (Reference 35), the NRC concluded that the station demonstrated effective flood protection from the reevaluated flood hazards.
Attachment B of OP-2203.008, "Natural Emergencies," is used to ensure flood barriers are intact prior to the onset of flooding at the site.
Based on this review, the external flooding hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 27 of 45 Screening Hazard                Definition                                          ANO-2 Disposition for TSTF-505 Criteria Strong winds resulting in dynamic loading or missile impacts on SCCs causing functional failure.
Hazards that could potentially result in high wind include the following:
* hurricane - severe winds developed from a tropical depression resulting in missiles or dynamic loading on SSCs.
Secondary hazards Extreme Winds resulting from a hurricane,    N/A    See Section 4 of this enclosure.
and Tornadoes include, but are not necessarily limited to tornado
* straight wind - a strong wind resulting in missiles or dynamic loading on SSCs that is not associated with either hurricanes or tornadoes
* tornado - a strong whirlwind that results in missiles or dynamic loading on SSCs 2CAN042301 Page 28 of 45 Screening Hazard                Definition                                            ANO-2 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), fog can increase the frequency of Low-lying water vapor in the              occurrence for other events such as aircraft, railway, and highway accidents.
form of a cloud or obscuring              Fog is implicitly included in data for other events such as aircraft, railway, haze of atmospheric dust or                and highway accidents which are discussed elsewhere in this external Fog      smoke resulting in impeded          C4    hazards evaluation.
visibility that could result in, Based on this review, the fog hazard is considered to be negligible.
for example, a transportation accident.                                  There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Direct (e.g., thermal effects) and indirect effects (e.g.,
generation of combustion products, transport of                    Per the IPEEE Report (Reference 7), the ANO site is cleared of significant firebrand) of a forest fire                forestry and brush, and therefore, forest or brush fire do not pose any outside the plant boundary                danger.
Forest Fire that causes functional failure      C3    Based on this review, the forest or range fire hazard is considered to be of plant SSCs.                            negligible.
Hazards that could cause or                There are no configuration specific considerations for this hazard. This be caused by a forest fire                hazard can be excluded from the RICT Program evaluation.
include, but may not be limited to, wildfires and grass fires.
A thin layer of ice crystals              There is negligible impact on the plant due to frost. The worst-case impact that form on the ground or                is frost induced freezing leading to a LOOP event which is addressed in the the surface of an earthbound              weather-related LOOP initiating event in the ANO-2 FPIE PRA.
Frost    object when the temperature      C1, C4 Based on this review, the frost hazard is considered to be negligible.
of the ground or surface of the object falls below                    There are no configuration specific considerations for this hazard. This freezing.                                  hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 29 of 45 Screening Hazard              Definition                                          ANO-2 Disposition for TSTF-505 Criteria Hail is bounded by other events for which the plant is designed. Per the A shower of ice or hard snow            IPEEE Report (Reference 7), hail is less damaging than the tornado missile that could result in                    hazard. In addition, the principal effects of such events would be to cause a transportation accidents or              LOOP and are addressed in the weather-related LOOP initiating event in the Hail                                    C4    ANO-2 FPIE PRA model.
directly causes dynamic loading or freezing conditions          Based on this review, the hail hazard is considered to be negligible.
as a result of ice coverage.            There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Effects on SSC operation                Per NUREG-1407 (Reference 6), the capacity reduction of the ultimate heat due to abnormally high                  sink would be a slow process that allows plant operators sufficient time to ambient temperatures                    take proper actions such as reducing power output level or achieving and resulting from weather                  maintaining safe shutdown.
High Summer phenomena. Secondary                    In addition, should the ECP average water temperature reach 100 &deg;F, C1, C5  ANO-2 TS 3.7.4.1 requires action to shut down the plant.
Temperature hazards resulting from high ambient temperatures,                    Based on this review, the high summer temperature hazard is considered to include, but are not                    be negligible.
necessarily limited, to low              There are no configuration specific considerations for this hazard. This lake or river water levels.              hazard can be excluded from the RICT Program evaluation.
Per the IPEEE Report (Reference 7), the site is located 6 miles W-NW of Russellville, Arkansas, on the peninsula formed by the Dardanelle Reservoir The periodic maximum rise of            on the Arkansas River. There are several flood control dams upstream and sea level resulting from the            downstream of the plant.
combined effects of the tidal            See also "External Flooding."
High Tide                                  C4 gravitational forces exerted by the moon and sun and the              Based on this review, the high tide, lake level, or river stage hazard is rotation of the Earth.                  considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 30 of 45 Screening Hazard                  Definition                                            ANO-2 Disposition for TSTF-505 Criteria Flooding that results from the            Per the IPEEE Report (Reference 7), hurricanes are bounded by the intense rain fall from a                  external flooding hazard and the high winds or tornados hazard.
hurricane (tropical cyclone).            Additionally, hurricanes, lose strength when moving inland and the greatest Hurricane      Secondary hazards resulting              concern is possible damage from winds or flooding due to excessive rainfall.
from a hurricane include, but      C4 (Tropical Cyclone)                                          See External Flooding and Extreme Winds and Tornado Assessment.
are not necessarily limited to, dam failure, high tide, river            Based on this review, the hurricane hazard is considered to be negligible.
and stream overflow, seiche,              There are no configuration specific considerations for this hazard. This storm surge, and waves.                  hazard can be excluded from the RICT Program evaluation.
Per the IPEEE (Reference 7), ice formation in this portion of the Arkansas River basin is light and infrequent.
Flooding due to downstream                Per ANO-2 SAR, Section 2.4.7 (Reference 31), the general climate in the blockages of ice on a river.              area surrounding the Dardanelle Reservoir is not conducive to significant ice Secondary hazards resulting              formation. Historically, ice formation has been so negligible that the Corps Ice Cover      from an ice blockage include,      C1    of Engineers does not maintain records of ice formation. In addition, the flow but are not necessarily                  of the river during periods of freezing temperatures is sufficiently large that limited to, river and stream              ice formation is not probable in the main stream.
overflow.                                Based on this review, the ice cover hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 31 of 45 Screening Hazard                  Definition                                            ANO-2 Disposition for TSTF-505 Criteria SRP Chapters 2.2.1-2.2.2 (Reference 36) describe acceptance criteria for this hazard and states that NRC reviews should include all identified facilities and activities within 8 kilometers (5 miles) of the plant and that facilities and activities at distances greater than 8 kilometers (5 miles) should be considered if they have the potential for affecting plant safety-related features.
An accident at an offsite                Per IPEEE (Reference 7), there are no military bases, missile sites, chemical industrial or military facility          plants and storage facilities, oil pipelines, or airports within a 5-mile radius of that results in a release of              the centerline of the ANO-2 containment building.
Industrial or toxic gases, a release of Military Facility                                  C3, PS2  Stationary offsite sources of hazardous materials were recently evaluated combustion products, a Accident                                                (Reference 39). Based on communication with the four counties within the release of radioactivity, an 5-mile radius of the plant site (Pope, Johnson, Yell, and Logan counties),
explosion, or the generation four facilities storing hazardous chemicals were identified in Pope County of missiles.
and the chemical information was obtained. All chemicals screened out as being non-toxic, non-volatile, or were solid materials.
Based on this review, the industrial or military facility accident hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
The ANO-2 Internal Events and Internal Flooding PRA model addresses risk Internal Flood                                      N/A from internal flooding events.
Internal Fire                                      N/A    The ANO-2 Internal Fire PRA model addresses risk from internal fires.
2CAN042301 Page 32 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Per ANO-2 SAR, Section 2.5.1.1.6 (Reference 31), the site is located on a Dynamic loading of SSCs or              gently rolling plain adjacent to the Dardanelle Reservoir. Natural slopes in impacts on natural water                the vicinity of the site are gentle and no high ridges occur within at least two supplies used for heat                  miles of the site. Potential landslides are not a problem at the plant site.
rejection due to the                    Additional data on stability of subsurface materials is presented in Landslide                                      C3 movement of rock, soil, and            Section 2.5.4 of the ANO-2 SAR.
mud down a sloped surface Based on this review, the landslide hazard is considered to be negligible.
(does not include frozen precipitation).                        There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Lightning strikes may result in a LOOP or plant trip. These events are Effects on SSCs due to                  addressed in the plant design basis and are modeled in the ANO-2 Internal a sudden electrical discharge          Events PRA model.
Lightning                                    C1, C4 from a cloud to the ground or          Based on this review, the lightning hazard is considered to be negligible.
Earth-bound object.                    There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Per the IPEEE (Reference 7), the station can obtain the required minimum cooling water from the Dardanelle Reservoir through the canals based on the low water level of 336 ft. At a water level of 335 ft., the plant will be shut down and the water source shifted to the ECP.
In addition, per the ANO-2 SAR, Section 2.4.11 (Reference 31, according to information obtained from the Little Rock District of the U.S. Army Corps of A decrease in the water level          Engineers, it is possible for the inflow to the reservoir to be zero under very Low Lake or River of the lake or river used for  C1, C5  exceptional circumstances, but these conditions would exist for only a few Water Level power generation.                      hours, during which time there would be more than enough water in storage in the reservoir to supply the consumptive use of the plant.
Based on this review, the low lake level or river stage hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 33 of 45 Screening Hazard                    Definition                                          ANO-2 Disposition for TSTF-505 Criteria Effects on SSC operation due to abnormally low ambient temperatures                      Per the IPEEE (Reference 7), for winter operation, the ECP is designed to resulting from weather                    perform its safety function with an initial ice layer on the pond surface.
Low Winter      phenomena.                                Based on this review, the low winter temperature hazard is considered to be C1, C5 Temperature      Secondary hazards resulting              negligible.
from low ambient                          There are no configuration specific considerations for this hazard. This temperatures include, but are            hazard can be excluded from the RICT Program evaluation.
not necessarily limited to, frost, ice cover, and snow.
A release of energy due to the impact of a space object such as a meteoroid, comet, or human-caused satellite falling within the Earths atmosphere, a direct impact              Per the IPEEE Report (Reference 7), this event has a very low annual with the Earths surface, or a            probability of occurrence, less than 1E-9 (Section 2.10, NUREG-1407, combination of these effects.            Reference 6); therefore, is eliminated on the basis of low frequency.
Meteorite/Satellite This hazard is analyzed with      PS4    Based on this review, the meteorite or satellite hazard is considered to be Strikes respect to direct impacts of              negligible.
an SSC and indirect impact                There are no configuration specific considerations for this hazard. This effects such as thermal                  hazard can be excluded from the RICT Program evaluation.
effects (e.g., radiative heat transfer), overpressure effects, seismic effects, and the effects of ejecta resulting from a ground strike.
2CAN042301 Page 34 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), there are no military installations, chemical plants, oil pipeline, or airports within 5 miles of the centerline of the A release of hazardous                    containment building. However, there is a natural gas pipeline located material, a release of                    600 feet from the ANO-1 reactor building, which has been evaluated.
combustion products, an                  Per ANO-2 SAR, Section 2.2.2 (Reference 31), the probability of a rupture of explosion, or the generation              this gas pipeline and subsequent ignition of the gas is of the order of 1E-7 Pipeline Accident                                  C1, PS4 of missiles due to an accident            per year.
involving the rupture of a pipeline carrying hazardous              Based on this review, the pipeline accident hazard is considered to be materials.                                negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
By {{letter dated|date=May 31, 2017|text=letter dated May 31, 2017}}, ANO submitted its focused evaluation (FE)
(Reference 34) for ANO-1 and ANO-2. The FE demonstrated that no doors, Flooding that results from                buildings, or propagation pathways that contain key SSCs are impacted by local intense precipitation.              floodwaters during the LIP event. The calculated ponding levels were below the controlling current design bases (CDB) event, which is a probable Secondary hazards resulting Precipitation,                                            maximum flood (PMF) from the Arkansas River coincident with dam failure from local intense                C1 Intense                                                and wind-generated waves.
precipitation, include, but are not necessarily limited to,              See also "External Flooding."
dam failure and river and                Based on this review, the Intense precipitation hazard is considered to be stream overflow.                          negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 35 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Per the IPEEE Report (Reference 7), chemicals stored onsite were A release of hazardous                    evaluated. An updated chemical hazardous survey was completed in material including, but not                February 2020 (Reference 37).
limited to liquids, combustion            As stated in the updated survey, in the original plant design, chlorine was products, or radioactivity.                stored onsite in one-ton cylinders for use as a water biocide. All chlorine has Such releases may be                      since been removed from the site since biocides based upon use of Release of    concurrent with or induce an              hypochlorite or bromine are now used.
C4, PS1, Chemicals from  explosion or the generation                All chemicals stored onsite were evaluated in the updated survey and PS2 Onsite Storage  of missiles.                              screened out consistent with RG 1.78 (Reference 38).
In this context, an onsite                See also "Toxic Gas."
release of radioactivity is assumed to be associated                  Based on this review, the release of chemicals in onsite storage hazard is with low-level radioactive                considered to be negligible.
waste.                                    There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Per the IPEEE Report (Reference 7), upstream diversion/damming by land slide, ice blockage, or other cause is unlikely.
The redirection of all or a                Per the ANO-2 SAR Section 2.4.9 (Reference 31), in the unlikely event of portion of river flow by natural          upstream diversion or natural damming of the Arkansas River by landslide, causes (e.g., a riverine                  ice blockage, or other causes, there would be sufficient storage in River Diversion                                    C1, C3  Dardanelle Reservoir to permit normal plant shutdown.
embankment landslide) or intentionally (e.g., power                Based on this review, the river diversion hazard is considered to be production, irrigation).                  negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Persistent heavy winds                    Per the IPEEE Report (Reference 7), a sandstorm hazard is not relevant at transporting sand or dust that            the ANO site.
Sandstorm    infiltrate SSCs at or in the        C3    Based on this review, the sandstorm hazard is considered to be negligible.
plants analyzed area                      There are no configuration specific considerations for this hazard. This causing functional failure.                hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 36 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Flooding from water                      Per IPEEE Report (Reference 7), the Dardanelle Reservoir is not of displaced by an oscillation of          sufficient size to be affected by surge or seiche flooding.
the surface of a landlocked              See also "External Flooding."
Seiche      body of water, such as a          C3 lake, that can vary in period            Based on this review, the seiche hazard is considered to be negligible.
from minutes to several                  There are no configuration specific considerations for this hazard. This hours.                                  hazard can be excluded from the RICT Program evaluation.
Sudden ground motion or vibration of the Earth as produced by a rapid release of stored-up energy along an active fault.
Secondary hazards resulting Seismic Activity from seismic activity include,    N/A    See Section 3 of this enclosure.
but are not necessarily limited to, avalanche (both rock and snow), dam failure, industrial accidents, landslide, seiche, tsunami, and vehicle accidents.
Per IPEEE Report (Reference 7), the roofs of all structures are designed for a conservative snow load of 20 psf.
The accumulation of snow                Snow storms may also result in a LOOP or plant trip. These events are could result in transportation          addressed in the plant design basis and are modeled in the ANO-2 Internal accidents or directly cause              Events PRA model.
Snow                                        C1, C4 dynamic loading or freezing See also "External Flooding."
conditions as a result of snow cover.                                  Based on this review, the snow hazard is considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 37 of 45 Screening Hazard                  Definition                                            ANO-2 Disposition for TSTF-505 Criteria Per the ANO-2 SAR, Section 2.5 (Reference 31), various investigations were performed to define site foundation conditions and regional and site Dynamic forces on                          geologic, geohydrologic, and seismological conditions.
structures foundations due to            As a result of the investigations performed, it was concluded that geologic, the expansion (swelling) and              seismologic, and foundation conditions at the ANO site are adequate in all Soil Shrink-Swell                                    C1    respects.
contraction (shrinking) of soil resulting from changes in the              Based on this review, the soil shrink-swell consolidation hazard can be soil moisture content.                    considered to be negligible.
There are no configuration specific considerations for this hazard. This hazard can be excluded from the RICT Program evaluation.
Flooding that results from an abnormal rise in sea level due to atmospheric pressure                Per IPEEE Report (Reference 7), the ANO site located on a peninsula of the changes and strong wind                    Dardanelle Reservoir is not of sufficient size to be affected by surge or generally accompanied by an                seiche flooding.
Storm Surge      intense storm.                      C3 Based on this review, the storm surge hazard is considered to be negligible.
Secondary hazards resulting from a storm surge include,                There are no configuration specific considerations for this hazard. This but are not necessarily                    hazard can be excluded from the RICT Program evaluation.
limited to, high tide, river and stream overflow, and waves.
2CAN042301 Page 38 of 45 Screening Hazard                Definition                                            ANO-2 Disposition for TSTF-505 Criteria A release of hazardous toxic or asphyxiant gases.
Such releases may be                    Toxic gas is covered under release of chemicals in onsite storage, industrial concurrent with or induce an            or military facility accident, and transportation accident.
explosion or the generation              In addition, station procedures are established to address periodic control Toxic Gas  of missiles.                      C4    room habitability self-assessments.
In this context, an onsite              Based on this review, the toxic gas hazard is considered to be negligible.
release of radioactivity is              There are no configuration specific considerations for this hazard. This assumed to be associated                hazard can be excluded from the RICT Program evaluation.
with low-level radioactive waste.
Accidents involving transportation resulting in collision with SSCs, a release of hazardous materials or combustion products, an                  An updated evaluation was performed for transportation (mobile) accidents explosion, or a generation of            that could impact the site (Reference 37). Mobile offsite sources evaluated missiles causing functional              include barge traffic, rail traffic, and highway traffic. The total release failure of SSCs.                        frequency was less than 1E-6/yr.
Transportation Hazards that could potentially          No specific plant vulnerabilities were identified.
PS2, PS4 Accidents  result in transportation Based on this review, the transportation accidents hazard is considered to accidents include, for be negligible example, a vehicle, railcar or ship (boat) accident that                There are no configuration specific considerations for this hazard. This involves a collision or                  hazard can be excluded from the RICT Program evaluation.
derailment, potentially resulting in fire, explosions, toxic releases, missiles, or other hazardous conditions.
2CAN042301 Page 39 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Flooding that results from a series of long-period sea waves that displaces massive amounts of water as              The location of ANO site located on a peninsula in Lake Dardanelle a result of an impulsive                  (Dardanelle Reservoir) precludes the possibility of a tsunami.
Tsunami      disturbance, such as a major      C3    Based on this review, the tsunami hazard is considered to be negligible.
submarine slide or landslide.            There are no configuration specific considerations for this hazard. This Secondary hazards resulting              hazard can be excluded from the RICT Program evaluation.
from a tsunami include, but are not necessarily limited to, river and stream overflow.
Damage to safety-related SSCs from a missile                      Per the IPEEE Report (Reference 7), the annual probability of turbine generated internal or external            generated missiles is less than 1.1E-08. In addition, ANO-2 SAR, to the plant PRA boundary                Section 3.5.2.2.2.1 (Reference 31), discusses the probability of missiles from rotating turbines or                generated due to failure of the Unit 1 and Unit 2 turbines at or near rated Turbine-Generated other external sources (e.g.,            speed and during destructive overspeed. The probabilities were shown to high-pressure gas cylinders). C1, PS4  be much less than 1E-06/yr.
Missiles Damage may result from a                  Based on this review, the turbine-generated missiles hazard is considered to falling missile or a missile              be negligible.
ejected directly toward                  There are no configuration specific considerations for this hazard. This safety-related SSCs (i.e.,                hazard can be excluded from the RICT Program evaluation.
low-trajectory missiles).
2CAN042301 Page 40 of 45 Screening Hazard                  Definition                                          ANO-2 Disposition for TSTF-505 Criteria Opening of Earths crust resulting in tephra (i.e., rock fragments and particles ejected by volcanic eruption),
lava flows, lahars (i.e., mud flows down volcano slopes),
volcanic gases, pyroclastic flows (i.e., fast-moving flow of          Per the IPEEE (Reference 7), there are no active or dormant volcanoes hot gas and volcanic matter                located near the plant site.
moving down and away from                  Based on this review, the volcanic activity hazard is considered to be Volcanic Activity a volcano), and landslides.        C3 negligible.
Indirect impacts include                  There are no configuration specific considerations for this hazard. This distant ash fallout (e.g., tens            hazard can be excluded from the RICT Program evaluation.
to potentially thousands of miles away).
Secondary hazards resulting from volcanic activity, include, but are not necessarily limited to, seismic activity and fire.
An area of moving water that              Waves are bounded by other hazards that are considered and screen out.
is raised above the main                  See also "External Flooding."
Waves        surface of a body of water as    C1, C4  Based on this review, the waves hazard is considered to be negligible.
a result of the wind blowing              There are no configuration specific considerations for this hazard. This over an area of fluid surface.            hazard can be excluded from the RICT Program evaluation.
2CAN042301 Page 41 of 45 Table E4-6: Progressive Screening Approach for Addressing External Hazards Event Analysis                  Criterion                      Source C1. Event damage potential is NUREG/CR-2300 and ASME/ANS less than events for which plant is Standard RA-Sa-2009 designed.
C2. Event has lower mean frequency and no worse              NUREG/CR-2300 and ASME/ANS consequences than other events          Standard RA-Sa-2009 analyzed.
Initial Preliminary Screening      C3. Event cannot occur close        NUREG/CR-2300 and ASME/ANS enough to the plant to affect it.      Standard RA-Sa-2009 C4. Event is included in the        NUREG/CR-2300 and ASME/ANS definition of another event.            Standard RA-Sa-2009 C5. Event develops slowly, allowing adequate time to          ASME/ANS Standard RA-Sa-2009 eliminate or mitigate the threat.
Progressive      PS1. Design basis hazard cannot ASME/ANS Standard RA-Sa-2009 Screening      cause a core damage accident.
PS2. Design basis for the event NUREG-1407 and ASME/ANS meets the criteria in the NRC Standard RA-Sa-2009 1975 SRP.
PS3. Design basis event mean frequency is < 1E-5/y and the        NUREG-1407 as modified in mean conditional core damage        ASME/ANS Standard RA-Sa-2009 probability is < 0.1.
PS4. Bounding mean CDF is            NUREG-1407 and ASME/ANS
                    < 1E-6/y.                              Standard RA-Sa-2009 Screening not successful. PRA NUREG-1407 and ASME/ANS Detailed PRA      needs to meet requirements in the Standard RA-Sa-2009 ASME/ANS PRA Standard.
2CAN042301 Page 42 of 45
: 6. Conclusions Based on this analysis of external hazards for ANO-2, no additional external hazards other than seismic and extreme high wind events need to be added to the existing PRA model. The evaluation concluded that the hazards either do not present a design-basis challenge to ANO-2, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.
ANO-2 will apply a seismic and high wind penalty in the risk evaluations performed as part of the process to calculate a RICT. In this application, all other external hazards are considered to be insignificant and will not be included in the RICT calculation.
The Incremental Core Damage Probability / Incremental Large Early Release Probability (ICDP/ILERP) acceptance criteria of 1E-5/1E-6 will be used within the PHOENIX framework to calculate the resulting RICT and RMAT based on the total configuration-specific delta CDF/LERF attributed to internal events and internal fire, plus the seismic and tornado missile risk delta CDF/LERF values.
: 7. References
: 1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), 2012November 2006
: 2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 3. American Society of Mechanical Engineers (ASME) - ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," Addendum A to RAS-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009
: 4. NRC NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," Revision 1, (ADAMS Accession No. ML17062A466),
March 2017
: 5. NRC NUREG-75/087, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, [Light Water Reactor] LWR Edition," (ADAMS Accession No. ML042080088), 1975
: 6. NRC NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," (ADAMS Accession No. ML063550238), June 1991
: 7. Entergy R-0016-01, "IPEEE Other Events", Revision 1, May 1995
: 8. Entergy R-1006-02, "Individual Plant Examination for External Events (IPEEE) for Seismic Margins Assessment (SMA) at ANO-01," Revision 0, May 1996 2CAN042301 Page 43 of 45
: 9. NRC letter to Entergy, "Arkansas Nuclear One, Units 1 and 2 - Documentation of the Completion of Required Actions Taken in Response to the Lessons Learned from the Fukushima Dai-ichi Accident," (0CNA071801), (ADAMS Accession No. ML18163A418),
dated July 11, 2018
: 10. NRC Letter to Power Reactor Licensees, "Final Determination of Licensee Seismic Probabilistic Risk Assessments Under the Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 'Seismic' of the Near Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident,"
(ADAMS Accession No. ML15194A015), dated October 27, 2015
: 11. Areva - Attachment 3.4 to Reference 41, Unit 2 Areva Report 51-9220657-000, "Seismic Hazard Report - Arkansas Nuclear One Unit 2," March 18, 2014
: 12. NRC Generic Issue (GI) 199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," U.S. NRC Information Notice (IN) 2010-18, Tables B.2, C.1 and C-2, (ADAMS Accession No. ML100270582),
dated September 2, 2010
: 13. Entergy letter to NRC, "Seismic Hazard and Screening Report [Central Eastern United States (CEUS) Sites], Response to NRC Request for Information (RFI) Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force (NTTF)
Review of Insights from the Fukushima Dai-ichi Accident Arkansas Nuclear One - Units 1 and 2," (0CAN031404), (ADAMS Accession No. ML14092A021), dated March 28, 2014
: 14. EPRI - Seismic Probabilistic Risk Assessment Implementation Guide, Palo Alto, CA: 2013, 3002000709
: 15. NRC letter to Entergy, Arkansas Nuclear One, Units 1 and 2, "Individual Plant Examination of External Events (Tac Nos. M83588 and M83589)," Enclosure, "Staff Evaluation Report of Individual Plant Examination of External Events (IPEEE) Submittal on Arkansas Nuclear One, Units 1 and 2," (0CNA020113), dated February 27, 2001
: 16. Entergy SQ-2521-01, "Anchor Bolt Shear Capacity Evaluation of the T57 and 2T57 Emergency Diesel Fuel Tanks," Revision 0, January 1999
: 17. Entergy letter to NRC, Arkansas Nuclear One - Units 1 and 2 Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6, "Generic Letter 87-02 Completion Letter,"
TAC Nos. M69426 and M69427, (0CAN119901), (ADAMS Accession No. ML993350052),
dated November 18, 1999
: 18. Electric Power Research Institute (EPRI) - NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Revision 1, August 1991
: 19. NRC NUREG/CR-0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," (ADAMS Accession No. ML061880412), May 1978 2CAN042301 Page 44 of 45
: 20. Southern Nuclear Operating Company letter to NRC, "Vogtle Electric Generating Plant -
Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'" (Enclosure E3), (ADAMS Accession No. ML12258A055), dated September 13, 2012
: 21. Exelon Generation Company, LLC letter to NRC, "Calvert Cliffs Nuclear Power Plant, Units 1 and 2 - License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b,'" (ADAMS Accession No. ML16060A223), dated February 25, 2016
: 22. Electric Power Research Institute (EPRI) - "Seismic Evaluation Guidance, Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic," EPRI Report 1025287, (ADAMS Accession No. ML12333A170), November 2012
: 23. NRC letter to Exelon Generation Company, LLC, "Braidwood Station, Units 1 and 2, and Byron Station, Unit Nos. 1 and 2 - Issuance of Amendments Nos. 206, 206, 212, and 212 RE: 'Adoption of TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B' (EPID L-2018-LLA-0727),'" (ADAMS Accession No. ML20037B221), dated March 30, 2020
: 24. Entergy - PSA-ANO2-01-LE, Revision 2, "ANO-2 Level 2 LERF Analysis Notebook,"
January 2020
: 25. Entergy - PSA-ANO2-01-SY-04, Revision 1, "ANO-2 PRA System Notebook - Appendix 4, Containment Isolation System (CIS)," February 2019
: 26. NRC - "Risk Assessment of Operational Events, Volume 2 - External Events - Internal Fires - Internal Flooding - Seismic - Other External Events - Frequencies of Seismically-Induced LOOP Events (RASP Handbook)," Revision 1.02, (ADAMS Accession No. ML17349A301), November 2017
: 27. NRC Regulatory Guide (RG) 1.76, "Design-basis Tornado and Tornado Missiles for Nuclear Power Plants," (ADAMS Accession No. ML003740273), April 1974
: 28. NRC NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2, February 2007
: 29. EPRI - High-Wind Risk Assessment Guidelines, Palo Alto, CA: 2015. 3002003107
: 30. Entergy - PSA-A2-06-4B-TMPF, "ANO-2 Tornado Missile Penalty Factor Calculations for RICT Application," Revision 0
: 31. Entergy - Safety Analysis Report, Amendment 30, Arkansas Nuclear One - Unit 2.
: 32. NRC NUREG-0800, "Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants," Chapter 3.5.1.6, "Aircraft Hazards," Revision 4, (ADAMS Accession No. ML100331298), March 2010 2CAN042301 Page 45 of 45
: 33. Entergy letter to NRC, "Flooding Hazard Re-evaluation Report - Required Response for Near-Term Task Force (NTTF) Recommendation 2.1," (0CAN091602), (ADAMS Accession No. ML16260A060), dated September 14, 2016
: 34. Entergy letter to NRC, "Focused Evaluation for External Flooding," (0CAN051704),
(ADAMS Accession No. ML17153A212), dated May 31, 2017
: 35. NRC letter to Entergy, "Arkansas Nuclear One, Units 1 and 2 - Staff Assessment of Flooding Focused Evaluation (CAC NOS. MF9809 AND MF9810; EPID L-2017-JLD-0011)," (0CNA021803), (ADAMS Accession No. ML17214A029), dated February 12, 2018
: 36. NRC NUREG-0800, "Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants," Chapters 2.2.1-2.2.2, "Identification of Potential Hazards in Site Vicinity," Revision 3, (ML070460330), March 2007
: 37. Entergy - Calc 96-E-009-01, Revision 1, "Offsite Toxic Gas Release Probabilistic Safety Assessment," February, 2020
: 38. NRC Regulatory Guide (RG) 1.78, "Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," Revision 1, (ADAMS Accession No. ML013100014), December 2001
: 39. NRC Regulatory Guide (RG) 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3, (ADAMS Accession No. ML20238B871),
December 2020
 
Enclosure 5 2CAN042301 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) 2CAN042301 Page 1 of 2 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)
: 1. Introduction Section 4.0, Item 6, of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," (Reference 2) requires that the license amendment request (LAR) provide the plant-specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm applicability of the limits of Regulatory Guide (RG) 1.174, Revision 1 (Reference 3). (Note that RG 1.174, Revision 3 (Reference 4),
issued by the NRC in January 2018, did not revise these limits.)
The purpose of this enclosure is to demonstrate that the Arkansas Nuclear One, Unit 2 (ANO-2) total CDF and total LERF are below the guidelines established in RG 1.174. RG 1.174 does not establish firm limits for total CDF and LERF, but it recommends that risk-informed applications be implemented only when the total plant risk is no more than about 1E-4/year for CDF and 1E-5/year for LERF. Demonstrating that these limits are met confirms that the risk metrics of NEI 06-09 can be applied to the ANO-2 Risk Informed Completion Time (RICT) Program.
: 2. Technical Approach Table E5-1 lists the CDF and LERF point estimate values that resulted from a quantification of the baseline internal events (including internal flooding) and fire probabilistic risk assessment (PRA) models (References 5 and 6, respectively). This table also includes an estimate of the seismic contribution to CDF and LERF based on the methodology detailed in Enclosure 4, Section 3. Other external hazards are below accepted screening criteria; therefore, do not contribute significantly to the totals.
Table E5-1 Total Baseline CDF/LERF ANO-2 Baseline CDF                              ANO-2 Baseline LERF Source              Contribution                Source              Contribution Internal Events PRA          8.5E-06            Internal Events PRA            4.7E-07 Fire PRA                4.4E-05                  Fire PRA                2.3E-06 Seismic                5.5E-06                  Seismic                  2.6E-06 No significant                                  No significant Other External Events                            Other External Events contribution                                      contribution Total CDF                5.8E-05                Total LERF                5.4E-06 As demonstrated in Table E5-1, the total CDF and total LERF are within the guidelines set forth in RG 1.174 and support small changes in risk that may occur during RICT entries following implementation of Technical Specification Task Force (TSTF) Traveler TSTF-505, 2CAN042301 Page 2 of 2 Revision 2, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b."
Therefore, ANO-2 TSTF-505 implementation is consistent with NEI 06-09-A guidance.
Procedures will require a check of the overall PRA results against the RG 1.174 thresholds in the PRA model update procedures.
: 3. References
: 1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)
Guidelines," Revision 0, (ADAMS Accession No. ML12286A322), November 2006
: 3. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (ADAMS Accession No. ML023240437), November 2002
: 4. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, (ADAMS Accession No. ML17317A256), January 2018
: 5. Entergy - PSA-ANO2-01-FSPR-01, Revision 0, "ANO-2 PRA - Model Documentation for 2021 Focused Scope Peer Review Supporting [Station Black Out / Loss of Offsite Power]
SBO/LOOP Event Trees and FLEX," November 2021
: 6. Entergy - PSA-ANO2-03, Revision 0, "ANO-2 Fire Probabilistic Risk Assessment (FPRA)
Summary Report," February 2021
 
Enclosure 6 2CAN042301 Justification of Application of At-Power Probabilistic (PRA) Models to Shutdown Modes 2CAN042301 Page 1 of 1 Justification of Application of At-Power PRA Models to Shutdown Modes  is not applicable because the Risk Informed Completion Time (RICT) Program is not being applied to shutdown modes.
 
Enclosure 7 2CAN042301 PRA Model Update Process 2CAN042301 Page 1 of 3 PRA Model Update Process
: 1. Introduction Section 4.0, Item 8 of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 2), requires that the license amendment request (LAR) provide a discussion of the licensees programs and procedures which assure the probabilistic risk assessment (PRA) models which support the RMTS are maintained consistent with the as-built/as-operated plant.
This enclosure describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT)
Program, which will be in place to ensure that these models reflect the as-built/as-operated plant.
Plant changes, including physical modifications, will be identified and reviewed prior to implementation to determine if the changes could impact the PRA models per EN-DC-151, "PRA Maintenance and Update" (Reference 3). The configuration control program will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models.
Should a plant change or a discovered condition be identified that has a significant impact to the RICT Program calculations as defined by the above procedures, an unscheduled update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until the changes are fully implemented into the PRA models. Periodic updates will be performed every two refueling cycles in accordance with the requirements of NEI 06-09.
: 2. PRA Model Update Process Internal Event, Internal Flood, and Fire PRA Model Maintenance and Update The Entergy Operations, Inc. (Entergy) fleet PRA maintenance process ensures that the applicable PRA model used for the RICT Program reflects the as-built/as-operated plant for Arkansas Nuclear One - Unit 2 (ANO-2). The PRA configuration control process delineates the responsibilities and guidelines for updating the full power internal events, internal flood, and fire PRA models, and includes both periodic and unscheduled PRA model updates.
The process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the real time risk model.
The Entergy PRA maintenance and update processes are governed by procedures. Industry best practices and consensus modeling techniques are also reviewed and monitored to ensure Entergy PRA is using state of the art processes and methods.
2CAN042301 Page 2 of 3 Review of Plant Changes for Incorporation into the PRA Model The Entergy governing procedure for PRA updates is EN-DC-151 "PSA Maintenance and Update" (Reference 3). This procedure provides governance for periodic and interim model updates. Periodic model updates are performed every two refueling cycles while interim model updates are determined to be necessary if a model change is identified of sufficient importance to the model such that a special update is required.
EN-DC-151 lists the ways that a change to the PRA can be initiated (including engineering changes, procedure revisions, Nuclear Licensing revisions, model improvements, plant-specific data changes, and industry research). Each change is evaluated as having an effect on the PRA results in the initiation of a model change request (MCR). The MCR is entered into the fleet MCR database and tracked to completion there. Each MCR is graded per the criteria and any MCR that receives a grade of "A" requires an interim model update. MCR Grade "A" is defined as "Extremely important and necessary to assure the technical adequacy of the PRA or quality of the PRA."
As part of the implementation of the RICT program, EN-DC-151 will be updated to include more specific criteria for significant model change requests requiring interim model updates (Grade A MCRs). Significant model change requests will be defined as greater than 25% increase in core damage frequency (CDF) or large early release frequency (LERF). If the 25% increase in CDF or LERF criteria is exceeded, then use of the RICT program is suspended until the issue can be addressed, except when the deviation is such that impacted RICTs remain conservative. The PRA engineer may also perform and document a standalone, interim analysis that justifies continued use of the RICT program if the results of the analysis bound the issue documented in the MCR database. For example, the interim analysis could involve additional PRA refinement to model the system and/or issue in greater detail. The station will move forward with an unscheduled PRA update if the 25% CDF or LERF increase criteria are exceeded regardless of whether interim analyses justify continued use of the RICT program (i.e., interim analyses do not allow deferring an unscheduled PRA update when the criteria are exceeded, but these analyses can defend continued use of the program while the unscheduled PRA update is being implemented).
If it is not practical to assess the impact quantitatively, then a qualitative assessment, utilizing the experience and judgment of the PRA engineer, is performed considering the potential change in basic event importance measures for each application. This assessment utilizes the experience and judgment of the PRA engineer to determine if there are any issues that are individually negligible but could collectively impact the RICT program.
If a PRA model change is required for the Configuration Risk Management Program (CRMP) model, but cannot be immediately implemented for a significant plant change or discovered condition, either one of the following is applied:
* Analysis to address the expected risk impact of the change will be performed. In such a case, these interim analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A.
OR 2CAN042301 Page 3 of 3
* Appropriate administrative restrictions on the use of the RICT program for extended Completion Time are put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.
: 3. References
: 1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
: 3. Entergy - EN-DC-151, Revision 9, "PRA Maintenance and Update"
 
Enclosure 8 2CAN042301 Attributes of the Real-Time Risk Model 2CAN042301 Page 1 of 5 Attributes of the Real-Time Risk Model
: 1. Introduction Section 4.0, Item 9, of the Nuclear Regulatory Commissions (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 2), requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support the RMTS. This includes identification of how the baseline PRA model is modified for use in the configuration risk management program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. NEI 06-09, Revision 0-A, uses the term CRMP for the program controlling the use of RMTS. This term is also used to designate the program implementing 10 CFR 50.65(a)(4) and the monitoring program for other risk informed LARs. To avoid confusion, the term Risk-Informed Completion Time (RICT) Program is used to indicate the program required by NEI 06-09, Revision 0-A, in lieu of the term CRMP. This item should also confirm that the RICT Program tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant-specific submittal.
This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the real time risk (RTR) tool to support the RICT Program. The process employed to adapt the baseline models is demonstrated:
: 1. to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results;
: 2. to maintain the quality of the peer-reviewed PRA models; and
: 3. to correctly accommodate changes in risk due to configuration-specific considerations.
Quality controls and training programs applicable for the RICT Program are also discussed in this enclosure.
: 2. Translation of Baseline PRA Model for Use in Configuration Risk The models that will be used to analyze the internal events, internal flood, and internal fire hazards for the RICT Program are the peer reviewed, baseline PRA models. These models are updated when necessary to incorporate plant changes to reflect the as-built/as-operated plant. The models may be optimized for quantification speed but are verified to provide the same result as the baseline models in accordance with approved procedures. Additionally, a single top fault tree model will be developed for calculation of CDF and LERF. The single-top model will calculate the total average annual CDF and LERF from internal events, internal floods, and internal fires and combine the numerical risk results for use in the RICT program.
The results obtained from the integrated single-top model are validated against the baseline model results to ensure the single-top model is properly calculating CDF and LERF.
2CAN042301 Page 2 of 5 The RTR tool will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. The PRA models utilize system initiator event fault trees so equipment unavailability can be captured explicitly in these system initiator fault trees.
Therefore, no adjustment to initiating event frequencies are required within the RTR tool.
The baseline PRA models are modified as follows for use in configuration risk calculations:
* The unit availability factor is set to 1.0 (unit available).
* Maintenance unavailability is set to zero/false unless unavailable due to the actual (at the time) configuration.
* Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.
* Plant-specific configurations will be evaluated as needed. For systems where some trains or components are in service and some in standby (system alignments), or there are seasonal dependencies, the RTR tool addresses the average configuration of the plant. The RTR model used for the RICT Program is required to either conservatively model these variations or include the capability to account for the variations given configuration-specific equipment alignments in effect at the time of a RICT calculation if system alignment is determined to impact the calculated RICT time.
* Changes in success criteria based on the time in the core operating cycle (i.e., impact on anticipated transient without scram (ATWS) pressure relief) will be addressed in the RTR model.
The configuration risk software is designed to quantify the specific configuration for internal events (including internal flooding) and fire, while including the contribution from seismic and high winds penalty when calculating the Risk Management Action Times (RMAT) and RICT.
Full quantifications will be used for each configuration. If there are any changes in the underlying PRA, the PRA results database in the RTR tool will be updated in accordance with the RTR update procedure. The unique aspect of the configuration risk software for the RICT Program is the quantification of fire risk and the inclusion of the seismic and high winds penalty. The other adjustments above are those used for the evaluation of risk under the 10 CFR 50.65(a)(4) program.
Systems with shared components or capability across units which are credited in the RTR models are able to be represented in both unit PRA models simultaneously, reflecting availability or unavailability of the shared system to each unit based on the actual plant configuration. For a RICT program entry, the unit RTR tool will reflect the actual configuration of the plant, including availability or unavailability of shared systems and components.
: 3. Quality Requirements and Consistency of PRA Model and Configuration Risk Tools The approach for establishing and maintaining the quality of the PRA models, including the configuration risk model, includes both a PRA maintenance and update process (described in ), and the use of self-assessments and independent peer reviews (described in ).
2CAN042301 Page 3 of 5 The information provided in Enclosure 2 demonstrates that the sites internal event, internal flood, and internal fire PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 3). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.
For maintenance of an existing configuration risk model, changes made to the baseline PRA model in translation to the configuration risk model will be controlled and documented. An acceptance test is performed after every configuration risk model update. This testing also verifies correct mapping of plant components to the basic events in the configuration risk model.
These actions are directed via the Risk Monitor Model Development and Control guide (Reference 7).
The RTR model documentation will include changes made to the model of record (MOR) files to work with the RTR model software (e.g., quantification settings) along with verification that results are consistent between the RTR and PRA zero maintenance results (per guidance in Reference 7). In addition, the RTR update for the MOR will include quantifying the RTR model for representative maintenance configurations and examining the results for appropriateness.
These actions will be procedurally controlled. Generally, updates are expected on a frequency of once every two fuel cycles in accordance with the scheduled PRA model update frequency, but the RTR updates may be performed on a more frequent basis, or to align with an emergent MOR update.
: 4. Training and Qualification The PRA staff is responsible for development and maintenance of the configuration risk model.
Operations and Work Control staff will use the configuration risk tool under the RICT Program.
PRA Staff and Operations are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is also accredited by the Institute of Nuclear Power Operations (INPO).
: 5. Application of the Configuration Risk Tool to the RICT Program Scope The Electric Power Research Institute (EPRI) PHOENIX software will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. This program is specifically designed to support implementation of RMTS. PHOENIX will permit the user to evaluate all configurations within the scope of the RICT Program using appropriate mapping of equipment to PRA basic events. The RICT program will meet RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1 (Reference 4), and Entergy software quality assurance requirements.
: 6. Treatment of Common Cause Events The PRA models calculate Common Cause Basic Event (CCBE) probabilities from alpha factors and places the basic events under appropriate gates in the fault tree.
2CAN042301 Page 4 of 5 Adjustments to the common cause failure (CCF) grouping or CCF probabilities are not necessary when a component is taken out-of-service for preventative maintenance:
* The component is not out-of-service for reasons subject to a potential CCF, and, therefore the in-service components are not subject to increases in common cause probabilities.
* CCF relationships are retained for the remaining in-service components.
* The net failure probability for the in-service components includes the CCF contribution of the out-of-service component.
As described in RG 1.177, "An Approach for Plant Specific, Risk Informed Decision making:
Technical Specifications," Revision 2 (Reference 6), Section A-1.3.2.2, the CCF term should be treated differently when a component is removed from service for preventive maintenance (PM) than as described for failure of a component. For PMs, the CCF is changed so that the model represents the unavailability of the remaining component. In the example provided in RG 1.177 for a two-train system, the CCF event can be set to zero for PMs. This is done so that the model represents the unavailability of the remaining component, and not the common cause multiplier. The ANO-2 approach is conservative in that for a two-train system, the CCF event is retained for the component removed from service. Likewise, for systems with three or more trains, the CCF events that are related to the out-of-service component are retained.
The Vogtle RICT Safety Evaluation (SE) (Reference 5) describes the Vogtle approach for modeling common cause events with planned inoperability: "For planned inoperability, the licensee sets the appropriate independent failure to 'true' and makes no other changes while calculating a RICT." The ANO-2 approach is the same as this Vogtle approach.
It is recognized that other modifications could be made to CCF factors for planned maintenance, particularly for common cause groups of three or more components. For example, in the Vogtle RICT SE (Reference 5), the NRC identifies a possible planned maintenance CCF modification to "modify all the remaining basic event probabilities to reflect the reduced number of redundant components."
Like Vogtle, the ANO-2 CCF approach is a straightforward simplification that has inherent uncertainties. In the context of modifying CCF basic events for PMs, the Vogtle SE states the following:
    "The NRC staff also notes that common cause failure probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce non-conservative results and because the calculations reasonably include common cause failures consistent with the accuracy of the estimates." (Reference 5)
The ANO-2 approach for CCF during PMs is the same as the Vogtle approach; therefore, the ANO-2 CCF approach is acceptable for RICT calculations, and adjusting the common cause grouping is not necessary for PMs. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.
2CAN042301 Page 5 of 5 For emergent conditions where the extent of condition is not completed prior to entering into the RMAT or the extent of condition cannot rule out the potential for CCF, common cause Risk Management Actions (RMAs) are expected to be implemented to mitigate CCF potential and impact, in accordance with ANO-2 procedures. This is consistent with the guidance of NEI 06-09 and precludes the need to adjust CCF probabilities. However, if a numeric adjustment is performed to account for CCFs, the RICT calculation is adjusted to numerically account for the increased possibility of CCFs in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.
: 7. References
: 1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
: 3. NRC Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, (ADAMS Accession No. ML090410014), March 2009
: 4. NRC Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, (ADAMS Accession No. ML17317A256), January 2018
: 5. Southern Nuclear Operating Company letter to NRC, "Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Regarding Implementation of Topical Report Nuclear Energy Institute NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specification (RMTS) Guidelines,'" Revision 0-A (CAC NOS.
ME9555 and ME9556), (ADAMS Accession No. ML15127A669), dated August 8, 2017
: 6. NRC Regulatory Guide 1.177, "An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications," Revision 2, (ADAMS Accession No. ML20164A034),
January 2021
: 7. Entergy - EN-NE-G-015, "Risk Monitor Model Development and Control," Revision 5, February 2022
 
Enclosure 9 2CAN042301 Key Assumptions and Sources of Uncertainty 2CAN042301 Page 1 of 50 Key Assumptions and Sources of Uncertainty
: 1. Introduction The purpose of this enclosure is to disposition the impact of probabilistic risk assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.
Topical Report NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1), Section 2.3.4, Item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties. The baseline internal events/internal flooding PRA (IE/IF PRA) and fire PRA (FPRA) models have assumptions and sources of uncertainty, and these were reviewed during the model peer reviews. The approach taken was, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results, and to provide dispositions for the RICT Program.
The epistemic uncertainty analysis approach applies to the internal events PRA and any epistemic uncertainty impacts that are unique to the internal flood and fire PRAs. In addition, Topical Report NEI 06-09-A requires that the uncertainty be addressed in the RICT Program Configuration Risk Management Program (CRMP), otherwise referred to as the Real-Time Risk (RTR), by consideration of the translation from the PRA model to the RTR model. The RTR model discussed in Enclosure 8, also referred to as the PHOENIX model, includes internal events, flooding events, and fire events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the RTR tool during RICT Program calculations.
: 2. Assessment of Internal Events/Internal Flooding (IE/IF) PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty, the internal events baseline PRA model uncertainty report was developed, based on the guidance in NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making" (Reference 2), and EPRI 1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments" (Reference 3). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.
The State of Knowledge Correlation (SOKC), included within the parametric uncertainty evaluation, was addressed as part of the Arkansas Nuclear One, Unit 2 (ANO-2) baseline PRA model quantification. The parametric uncertainty evaluation for the IE/IF PRA model is documented in PSA-ANO2-01-QU-01, "ANO-2 PSA Uncertainty and Sensitivity Analysis" (Reference 4). The ANO-2 database uses type codes to perform the SOKC. Generic failure rates use variables so that correlations are maintained and the UNCERT computer code was ran to propagate the probability distributions using a Monte Carlo analysis. The results of this analysis confirmed little variability in the overall results and, therefore, parametric uncertainty is not a source of uncertainty in the RICT program.
2CAN042301 Page 2 of 50 Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions made for each of the ANO-1 IE/IF PRA technical elements are noted in the respective Source of Uncertainty Notebooks, References 5 and 6. The IE/IF PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty, and characterizing that uncertainty, as necessary. The Electric Power Research Institute (EPRI) compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 3), and the evaluation performed for ANO-2 considered each of the generic sources of modeling uncertainty as well as the plant-specific sources.
Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for the impact on a specific application. No specific issues of PRA completeness have been identified relative to the RICT application, based on the results of the IE/IF PRA and FPRA peer reviews.
Based on following the methodology in EPRI TR-1016737 (Reference 3) for a review of sources of uncertainty, the impact of potential sources of uncertainty on the RICT application is discussed in Table E9-1, which identifies those potential sources that may be key sources of uncertainty for the RICT program. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.
All generic and plant specific sources of uncertainty in the full power IE/IF (FPIE/IF) PRA have been reviewed and assessed for the RICT program and are documented in PSA-ANO2-06-4B-SOU, "ANO-2 PRA - Assessment of Key Assumptions and Sources of Uncertainty for [Technical Specification Task Force (TSTF)] TSTF-505 (RICT) Submittal" (Reference 7).
Digital subcomponents for the Engineered Safety Feature Actuation System (ESFAS) are implicitly modeled in the PRA. The ESFAS in the PRA models the analogue inputs and the associated relays used to initiate the ESFAS signals. The digital subcomponents are not modeled and, therefore, are not a key source of uncertainty in the RICT application.
2CAN042301 Page 3 of 50 Table E9-1: Internal Events Characterization of Generic Sources of Modeling Uncertainty Part of Model Topic (QU-E1) from        Discussion of Issue Affected from  Plant-Specific Approach Taken          Assumptions Made (QU-E2)            Impact on Model (QU-E4)    Characterization Assessment EPRI TR-10167371      from EPRI TR-1016737 EPRI TR-1016737 Initiating Event Analysis (IE)
The overall approach for the LOOP frequency estimation generally follows industry best-The loss of offsite power practice PRA methods but (LOOP) frequency is a                          The LOOP notebook presents the                                                                        merging the LOOP categories is function of several factors                    LOOP frequency calculation for    The generic industry frequencies for                              not a consensus approach.
including switchyard design,                    each of the LOOP events            the four LOOP event categories                                    Based on the importance results, the number and                                  (plant-centered, switchyard,      developed in NUREG/CR-6890,                                        LOOP frequency may be a independence of offsite                        weather-related and grid-related). "Reevaluation of Station Blackout                                  potential source of uncertainty.
power feeds, the local power                    The analysis utilizes the          Risk at Nuclear Power Plants" The four LOOP event          Applications pertaining to or production and consumption                      NUREG/CR-6890 LOOP                (Reference 24), are applicable to the
: 1. Grid stability                                      LOOP sequences                                                                          categories are merged into a affected by LOOP scenarios environment, and the degree                    database. The raw data was        ANO site. The generic industry single LOOP frequency event. should further evaluate plant-of plant control of the local                  analyzed to consider removing      frequencies are appropriate to use as                              specific LOOP frequency as a grid and grid maintenance.                      events that would not apply to    priors to develop a plant-specific                                potential source of uncertainty.
Three different aspects                        ANO-2. The resulting generic      LOOP frequency. The plant-specific relate to this issue:                          data population was                data is sufficient for the Bayesian                                The overall approach for the Bayesian-updated using ANO-2      update.                                                            LOOP frequency and failure to 1a. LOOP initiating event plant-specific experience.                                                                            recover probabilities utilized is frequency values and consistent with industry practice.
recovery probabilities Therefore, this does not represent a key source of uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 4 of 50 The approach and data for consequential LOOP frequency estimation generally follows industry best-practice PRA methods, but is not yet considered a consensus model approach.
Consequential LOOP scenarios may be a potential source of uncertainty. Applications pertaining to or affected by these scenarios should further evaluate consequential LOOP as a potential source of uncertainty.
A realistic with slight conservative bias slant on the consequential The possibility that offsite power                                      The frequency for            LOOP probabilities is utilized.
is lost as a result of the        The generic industry data for consequential LOOP is        Conditional LOOP probabilities reactor/turbine trip is modeled. consequential LOOP developed in calculated for an ECCS signal can impact important sequences 1b. Conditional LOOP      Consequential  Consequential LOOP frequencies    NUREG/CR-6890 (Reference 24) is and general plant trips:      and is considered a potential probability          LOOP sequences are calculated following an          applicable to the ANO-2 site.
source of uncertainty for the PRA.
Emergency Core Cooling System      The consequential LOOP events are    LOSP-ECCS = 2.4E-02          However, there is no justifiable (ECCS) signal or a plant trip in  similar to other loss of grid events.                              alternative, i.e., an industry the LOOP notebook.                                                      LOSP-EPRI = 1.1E-03 standard approach per NUREG/CR-6890 (Reference 24) has been used. For example, assuming higher or lower probabilities would represent a sensitivity but there would be no basis for deviating from the best-estimate values currently used in the PRA.
Conditional LOOP has been included as a sensitivity in Sensitivity #5 in Section 8.5 of PSA-ANO2-06-4B (Reference 7) and is not a key source of uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 5 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from      Plant-Specific Approach Taken          Assumptions Made (QU-E2)          Impact on Model (QU-E4)  Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 Availability of DC power to perform restoration actions is judged to not be a source of model uncertainty.
The batteries are assumed to be LOOP or      required for their associated                                                                      Credit for skill-of-the-trade actions 1c. Availability of DC power  consequential    diesel generator to be started (at Long term DC power to perform                                  would not provide a significant to perform restoration  LOOP sequences    least to close the diesel generator restoration actions is provided from N/A                      reduction in LOOP and station actions                with offsite power (DG) output circuit breaker or to  the batteries.                                                blackout (SBO) sequences, and recovered      flash the field on the DG when                                                                    such credit for recovery of offsite required).                                                                                        power without DC power would introduce other uncertainties.
Therefore, this is not considered a Key Source of Uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 6 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from  Plant-Specific Approach Taken          Assumptions Made (QU-E2)          Impact on Model (QU-E4)  Characterization Assessment EPRI TR-10167371      from EPRI TR-1016737 EPRI TR-1016737 The modeling of support system initiating events follows industry best-practice PRA methods. No modeling uncertainties are judged Support System Initiating Event to exist.
fault trees are developed for losses of AC and DC buses, loss                                                                    2a. This should not be a source of Feedwater/Condensate, loss of                                                                        of model uncertainty in most Increasing use of plant-                        Service Water, Loss of Instrument                                                                        applications. The ANO-2 specific models for support                      Air, and Loss of Component                                                                              PRA employs a realistic, system initiators (e.g., loss of                Cooling Water.                                                                                          reasonable approach.
CL, CC, or IA, and loss of                                                                                                                                Therefore, this does not AC or DC buses) have led to                      All of the initiating event represent a key source of inconsistencies in                              frequencies were developed uncertainty for the ANO-2 approaches across the                            using system fault tree models. Common cause failures and the PRA.
: 2. Support System    industry. A number of            Support system For normally-operating systems,    potential for recovery are treated N/A Initiating Events challenges exist in modeling    event sequences one train was assigned a run time  explicitly in the modeling of support                          2b. No recovery assumption of support system initiating                    of one year. The standby train    system initiating events.                                            judged reasonable and is a events:                                          was assigned a mission time of                                                                          standard industry practice the mean time to repair (MTTR)                                                                          albeit slightly conservative.
2a. Treatment of common                          for that train, or the allowable                                                                        This should not be a source cause failures (CCFs)                      Limiting Condition for Operation                                                                        of model uncertainty in most (LCO) Completion Time.                                                                                  applications. Any potential 2b. Potential for recovery revision to recovery credit Recovery of the failed system or would impact all sequences train through human intervention uniformly and would have was credited as appropriate in the little impact on any RICT fault tree models.
deltas. Therefore, this is not considered a key source of uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 7 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from  Plant-Specific Approach Taken          Assumptions Made (QU-E2)          Impact on Model (QU-E4)  Characterization Assessment EPRI TR-10167371      from EPRI TR-1016737 EPRI TR-1016737
: a. The initiating event frequency a. Published frequency used for this for pressure vessel rupture      extremely rare event. No                                    No modeling uncertainties are (excessive LOCA) is based on      significant assumptions were                                judged to exist for LOCA initiating PWR Owners Group Project          made.                                                      event frequencies for the base It is difficult to establish                    PA-RMSC-0463, "White Paper                                                                    model. The LOCA modeling and values for events that have                      on Consideration of Reactor                                                                  frequency values represent never occurred or have                          Vessel Failure in Plant-                                                                      present state-of-the-art modeling rarely occurred with a high                      Specific PRA Models for                                                                      and their use is considered an level of confidence. The                        PWRs" (Reference 25).                                                                        industry good practice, which has
: 3. LOCA initiating  choice of available data sets                                                                                                                  been used in Peer Reviewed event            or use of specific            LOCA sequences b. The large-, medium-, and        b. Industry consensus approach      N/A                      industry PRAs. As such, this frequencies      methodologies in the                            small-break LOCA mean            used. No significant assumptions.                          meets the intent of consensus determination of loss of                        frequency from                                                                                model approach as defined in coolant accident (LOCA)                          NUREG/CR-6928,                                                                                Regulatory Guide (RG) 1.200, frequencies could impact                        "Industry-Average                                                                            Reference 27), and is not required base model results and                          Performance for Components                                                                    to be retained as a candidate some applications.                              and Initiating Events at U.S.                                                                modeling uncertainty. Therefore, Commercial Nuclear Power                                                                      this does not represent a key Plants" (Reference 9), was                                                                    source of uncertainty for the used for the LOCA                                                                            ANO-2 RICT application.
frequencies.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 8 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from      Plant-Specific Approach Taken        Assumptions Made (QU-E2)            Impact on Model (QU-E4)        Characterization Assessment EPRI TR-10167371      from EPRI TR-1016737 EPRI TR-1016737 Accident Sequence Analysis (AS)
No credit for equipment operation after battery depletion may SBO events are important                                                                                                                                    represent a slight conservative contributors to baseline core                                                                                                                              treatment. Realistic assumptions damage frequency (CDF) at                          Because there are no ANO-2                                                                              are made for systems that allow Systems that normally require operation without control power nearly every U.S. nuclear                          procedures for recovering power Operation of systems without DC        DC power for operation are not (EFW) as directed by procedures.
power plant. In many cases, Credit for continued    after the batteries are depleted, power that normally require DC power credited for continued          This should not be a source of battery depletion may be        operation of these  no credit is taken for continued for operation is not readily viable,  operation upon battery        model uncertainty in most
: 4. Operation of      assumed to lead to loss of all      systems in    operation of any systems that except in situations where the design depletion in the event          applications.
equipment after system capability. Some            sequences with    normally require DC power for allows operators to manually control  sequence modeling. The only battery depletion PRAs have credited manual batteries depleted        operation. The only exception is the system. This is only applicable to exception is turbine-driven    No credit for equipment operation operation of systems that        (e.g., long term  manual control of turbine-driven turbine-driven EFW flow to SGs A      EFW flow to SG A or B, which after battery depletion may normally require DC power      SBO sequences)      EFW flow to Steam Generators or B.                                  may be operated successfully represent a slight conservatism for successful operation                            (SGs) A or B after battery without control power.        but this approach is consistent (e.g., turbine driven systems                      depletion.
with standard industry practice.
such as Emergency Feedwater (EFW)).                                                                                                                                          Therefore, this does not represent a key source of uncertainty for the ANO-2 RICT application.
Accident                                                                                                              The modeling of RCP seal LOCAs
: 5. Reactor Coolant The assumed timing and              sequences      This event represents a          ANO-2 uses the RCP seal failure                                      uses an industry consensus model Pump (RCP) magnitude of RCP seal            involving loss of  catastrophic RCP seal LOCA (i.e., model of WCAP-16175-P-A                                              which was reviewed and approved seal LOCA LOCAs given a loss of seal          seal cooling. leak greater than 100 gpm). The  (Reference 11) which is an industry                                  by the NRC. Therefore, there is treatment -                                                                                                                                    None cooling can have a            Failure of RCP seal  RCP seal LOCA can be              consensus model for RCP seal failure                                  no impact on overall results and Pressurized substantial influence on the  cooling could result considered a form of a small      on Combustion Engineering (CE)                                        does not represent a key source Water Reactors risk profile.                    in an RCP seal    LOCA.                            plants.                                                              of uncertainty for the ANO-2 RICT (PWRs)
LOCA.                                                                                                                application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 9 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from      Plant-Specific Approach Taken      Assumptions Made (QU-E2)  Impact on Model (QU-E4)  Characterization Assessment EPRI TR-10167371        from EPRI TR-1016737 EPRI TR-1016737 Success Criteria (SC)
Loss of containment heat removal leading to long-term containment over-pressurization and failure can be a significant contributor in some PRAs.
Consideration of the containment failure mode                                                                                                                  There are not significant might result in additional                        The environmental conditions                                                            assumptions or impact on the
: 8. Core cooling        mechanical failures of            Core cooling    resulting from each sequence is                                                        model. Therefore, the impact of success            credited systems.              success following explicitly discussed in the                                                              Reactor Building (RB) failure on following          Containment venting through  containment failure. Accident Sequence notebook.                                                            core cooling is not a source of containment        "soft" ducts or containment                        Conditions that can impact the  No significant assumptions. No impact on model.      uncertainty for the ANO-2 base failure or venting failure can result in loss of  Long term loss of system models, are included                                                              PRA and for applications.
through non-hard core cooling due to            decay heat removal (e.g., impact of feedline break on pipe vent paths environmental impacts on          (DHR) sequences. system operation is capture in the                                                        Therefore, this does not represent equipment in the                                  fault tree).                                                                            a key source of uncertainty for the reactor/auxiliary building,                                                                                                                ANO-2 RICT application.
loss of NPSH on ECCS pumps, steam binding of ECCS pumps, or damage to injection piping or valves.
There is no definitive reference on the proper treatment of these issues.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 10 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from    Plant-Specific Approach Taken          Assumptions Made (QU-E2)              Impact on Model (QU-E4)        Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 Loss of heating, ventilation, and air conditioning (HVAC) can result in room temperatures exceeding equipment qualification                                                                                                                                      Room heat-up and associated limits. Treatment of HVAC                                                                                                                                    equipment failures are not a ECCS room cooling is assumed to be requirements varies across                                                                                                                                    source of uncertainty. PRA required for the recirculation modes of the industry and often varies    Dependency on                                                                                                                modeling is realistic and based on Room heat-up calculations and      high-pressure safety injection (HPSI) within a PRA. There are two HVAC for system                                                                                    Components required to        supporting calculations. The the impact of HVAC losses are      and containment spray (CS), as well aspects to this issue. One        modeling and                                                                                provide room cooling to the    modeled HVAC dependencies
: 9. Room heat-up                                                        explicitly analyzed where          as the shutdown cooling (SDC) mode involves whether the            timing of accident                                                                            ECCS and DG rooms              may be slightly conservative and calculations                                                      necessary and are judged to not of the low-pressure safety injection                                      result in a slight increase in risk structures, systems, or        progressions and                                                                              contribute to failure of HPSI, be a source of uncertainty for the (LPSI) system.                                                          but is not judged to be significant components (SSCs) affected associated success                                                                                  LPIS, CS and DG systems.
base PRA and applications.        The failure of fans or the air louver in                                enough to affect the results.
by loss of HVAC are                  criteria.
assumed to fail (i.e., there is                                                      the DG rooms is assumed to fail the Therefore, this does not represent uncertainty in the fragility of                                                      affected DG.
a key source of uncertainty for the the components). The other                                                                                                                                    ANO-2 RICT application.
involves how the rate of room heat-up is calculated and the assumed timing of the failure.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 11 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from    Plant-Specific Approach Taken          Assumptions Made (QU-E2)          Impact on Model (QU-E4)      Characterization Assessment EPRI TR-10167371      from EPRI TR-1016737 EPRI TR-1016737 Battery depletion times and SBO events are important                                                                                                                                    associated accident sequence contributors to baseline CDF                                                                                                                                timing and related success criteria at nearly every U.S. nuclear                                                                                                                                are not a source of uncertainty.
power plant. Battery life is                                                                                                                                PRA modeling is realistic and an important factor in                              The analysis assumes that the                                                                          based on supporting calculations.
assessing a plants ability to                      battery chargers or the batteries                                                                      The analysis assumes that the Determination of cope with an SBO. Many                              can carry the required loads at                                                                        battery chargers or the batteries battery depletion plants only have Design                              any time during the mission time                                        No impact on model.          can carry the required loads at time(s) and the                                      The battery depletion time of eight
: 10. Battery life    Basis calculations for battery                      such that they are redundant.                                            Assumptions judged to be      any time during the mission time associated                                        hours is used for success criteria calculations    life. Other plants have very                                                                                                  reasonable based on realistic such that the two are redundant.
accident sequence    The results of detailed battery    purposes.
plant/condition-specific                                                                                                      assessments of battery life. The results of detailed battery timing and related  discharge calculations indicate calculations of battery life.                                                                                                                              discharge calculations indicate success criteria. battery depletion time for the PRA Failing to fully credit battery                                                                                                                            battery depletion time for the PRA capability can overstate risks                      is eight hours.                                                                                        is eight hours, which is used for and mask other potentially                                                                                                                                  success criteria purposes.
contributors and insights.
Realistically assessing                                                                                                                                    Therefore, this does not represent battery life can be complex.                                                                                                                                a key source of uncertainty for the ANO-2 RICT application.
PWR Emergency Operating System logic Procedures (EOPs) direct                                                                                                                                    ANO-2 has ECCS and LTOP modeling opening of all PORVs to                                                                                                                                    valves that are used to representing
: 11. Number of        reduce Reactor Coolant                                                                                                                                      depressurize the primary side for success criterion power-operated System (RCS) pressure for                              ANO-2 has ECCS and low                                                                                feed and bleed cooling. ANO-2 and accident relief valves    initiation of bleed and feed                        temperature overpressure (LTOP)                                                                        does not rely on PORVs for bleed sequence timing for                                    No significant assumptions pertaining ANO-2 does not rely on (PORVs)          cooling. Some plants have                            valves that are used to                                                                                and feed and no assumptions performance of                                      to feed and bleed.                    PORVs for bleed and feed.
required for    performed plant-specific                            depressurize the primary side for                                                                      were made.
bleed and feed and bleed and feed - analysis that demonstrates                          feed and bleed cooling.
sequences                                                                                                            Therefore, this does not represent PWRs            that less than all PORVs involving success                                                                                                          a key source of uncertainty for the may be sufficient depending or failure of feed                                                                                                        ANO-2 RICT application.
on ECCS characteristics and and bleed.
initiation timing.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 12 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from    Plant-Specific Approach Taken      Assumptions Made (QU-E2)                Impact on Model (QU-E4)          Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 Recirculation from the sump and                                                                                                                  An industry-accepted approach is sequences                                                                                                                  used; however, the treatment of involving flow from                                                                                                              RB sump / strainer performance these sources.                                                                                                                may be a potential source of (Note that the                                                                                                                model uncertainty. Applications modeling should be                                  ANO-2  increases  sump  strainer failure                                  pertaining to or affected by sump relatively                                    rates by 100  for large and  medium                                          recirculation should consider the All PWRs are improving                                                                                                                                      further evaluate those events as a
: 12. Containment    ECCS sump management      straightforward, the The PRA models potential for RB LOCAs to account for Generic Safety The strainer failure uncertainty is                                  Issue (GSI)-191,  "The Impact  of        probabilities are affected by the potential source of uncertainty.
sump / strainer practices including                            sump blockage depending on the related to the                                  Debris Induced Loss of ECCS                method used to determine performance    installation of new sump                      size of the LOCA.                                                                                            There is no basis to justify any methods or                                    Recirculation on PWR Core Damage strainer performance.
strainers at most plants.                                                                                                                                  other level of credit without references used to                                  Frequency (NUREG/CR-6771)"
introducing other uncertainties.
determine the                                    (Reference 28) considerations.
Model includes the PRA standard likelihood of                                                                                                                and latest level of guidance.
plugging the sump strainer, and                                                                                                                Therefore, this does not represent common cause                                                                                                                    a key source of uncertainty for the failure by blockage                                                                                                              ANO-2 RICT application.
of the strainers.)
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 13 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from    Plant-Specific Approach Taken        Assumptions Made (QU-E2)            Impact on Model (QU-E4)          Characterization Assessment EPRI TR-10167371        from EPRI TR-1016737 EPRI TR-1016737 Success criterion Certain scenarios can lead    for prevention of A portion of transient initiators to RCS / reactor pressure    RPV overpressure that result in RCS The impact of pressure relief vessel (RPV) pressure                            overpressurization due to relief (Note that                                      For a portion of transients, it is                                      during transients is judged to not transients requiring pressure                    valves failing to open have been uncertainty exists neglected.                        assumed that failure to provide                                          be a source of model uncertainty relief. Usually, there is          in both the                                      adequate pressure relief has                                            based on negligible impact to risk sufficient capacity to          determination of For anticipated transients without negligible probability, and failure to  The impact of pressure relief    profile. Based on the conservative
: 13. Impact of failure accommodate the pressure        the global CCF    scram (ATWS), 2 of 2 code safety  open is not modeled (only failure to    during transients is expected to criteria, pressure relief for ATWS of pressure relief transient. However, in some    values that may relief valves are required to      reclose is considered).                have a negligible impact to risk is judged not to be a source of scenarios, failure of            lead to RPV    prevent RCS overpressurization.                                          profile.                        model uncertainty.
adequate pressure relief can                                                        For ATWS, if the peak RCS pressure overpressure and A value of 3700 psia for the RCS be a consideration. Various                                                        is not relieved, it is assumed that the                                  Therefore, this does not represent what is done with pressure integrity limit is assumptions can be taken                                                            event leads to core damage.                                              a key source of uncertainty for the the subsequent conservatively selected.
on the impact of inadequate                                                                                                                                  ANO-2 RICT application.
RPV overpressure Overpressurization is assumed to pressure relief.                    sequence      result in core damage.
modeling.)
Systems Analysis (SY)
Due to the scope of PRAs,                                                                                                                                    Environmental factors are scenarios may arise where                                                                                                                                    considered in systems and System and                                                                                                                accident sequence modeling.
: 14. Operability of    equipment is exposed to accident sequence                                                                                                              Generally, credit for operation of equipment in      beyond design basis                              Environmental factors are        No credit given for operation of modeling of                                                                                                                systems beyond the design-basis beyond design      environments (no room                            considered in systems and        systems if conditions exceed            No impact.
available systems                                                                                                              environment is not taken.
basis              cooling, no component                            accident sequence modeling.      environmental design limits.
and required environments      cooling, deadheading, in the                                                                                                                                Therefore, this does not represent support systems presence of an unisolated                                                                                                                                    a key source of uncertainty for the LOCA in the area, etc.)                                                                                                                                      ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 14 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from    Plant-Specific Approach Taken            Assumptions Made (QU-E2)            Impact on Model (QU-E4)      Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 Human Reliability Analysis (HR)
Most PRAs do not give much, if any credit, for initiation of the Emergency                      Credit for additional resources Response Organization                            and capabilities provided by the System and    SAMGs is not taken in the Level 1 (ERO), including actions                                                                                                    The HFEs for the SAMG-based accident sequence core damage sequence analysis. No credit for SAMGs for the Level 1                                          Based on industry-accepted included in plant-specific                                                            human reliability assessment (HRA)    emergency actions are models with                                                                                                              approach and the negligible Severe Accident                                                                                                            included in the Level 2 model.
incorporation of It is assumed that the probability represents a potential conservatism.                                    impact to risk profile, application of Management Guidelines                            of the operator failing to isolate                                        The assumptions made may human failure                                        Incorporation of the SAMG-based                                      credit for ERO is judged not to be (SAMGs) and Section B5b of                                                                                                  be conservative and slightly
: 15. Credit For ERO                              events (HFEs), and the SG is 1.0. This is                emergency include actions for                                        a source of model uncertainty.
the NRC's "Interim                              conservative, but there is not                                            overestimate the frequency of human error                                        isolating SG for thermally induced SG Compensatory Measures for                                                                                                  large early releases. However,  Therefore, this does not represent probability (HEP) instruction in the EOPs to close    tube rupture (TI-SGTR) and High Threat Environment"                                                                                                    it is not expected that the    a key source of uncertainty for the value determination the Main Steam Isolation Valves depressurizing the RCS post core mitigation strategies. The                      (MSIVs). It is also assumed  that                                      overall results are impacted by ANO-2 RICT application.
in the Level 1 and                                      damage.
additional resources and                                                                                                    these assumptions.
Level 2 models. the probability of operators capabilities brought to bear                    depressurizing the RCS post-via the ERO can be                              cooldown is 0.50.
substantial, especially for long-term events.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 15 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from      Plant-Specific Approach Taken            Assumptions Made (QU-E2)              Impact on Model (QU-E4)        Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 In general, for procedure-directed                                                                          An industry-accepted approach is actions, the cognitive part of the                                                                          used; however, the sensitivity post-initiator HEP is quantified                                                                            results indicate that the treatment using the Cause Based Decision                                                                              of pre-initiator and post-initiator Tree Methodology (CBDTM). For                                                                                human errors may be a potential immediate, memorized actions or                                                                              source of model uncertainty.
time-critical actions, the cognitive                                                                        Applications pertaining to or There is not a consistent                          portion is quantified using the                                                                              affected by specific HFEs should method for the treatment of System or accident HCR/ORE methodology                      Detailed analyses are only performed                                    evaluate further those events as a for the risk significant, post-initiator Standard sensitivity cases for potential source of uncertainty.
pre-initiator and post-initiator sequence models The  execution  part  of the post-  HFEs.                                    HFEs are performed as part of The ANO-2 PRA model is based human errors. However,          with incorporation
: 24. Basis for HEPs                                                                                                                                    the quantification in order to on industry consensus modeling HFEs are typically significant of HFEs, and HEP initiator HEP is quantified using        No significant assumptions. HRA THERP.                                                                        determine the impact of        approaches for its HEP contributors to CDF and                value                                            employs industry-accepted                assumptions.                  calculations; therefore, this is not large early release frequency    determination. The THERP analysis and              methodologies.
(LERF).                                                                                                                                                          considered a significant source of quantification for pre-initiators is                                                                        epistemic uncertainty for the PRA similar to that done for post-                                                                              but may be important to certain initiators. In addition, for                                                                                applications. The RICT Program pre-initiators periodic testing is                                                                          includes operator action RMAs.
credited as a recovery factor.
Therefore, this does not represent The HRA Calculator is used for                                                                              a key source of uncertainty for the calculation of realistic HEPs.                                                                              ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 16 of 50 Part of Model Topic (QU-E1) from        Discussion of Issue Affected from      Plant-Specific Approach Taken          Assumptions Made (QU-E2)              Impact on Model (QU-E4)          Characterization Assessment EPRI TR-10167371        from EPRI TR-1016737 EPRI TR-1016737 Internal Flooding (IF)
Flood initiator frequencies are based on plant-specific          Considered an industry consensus estimates of pipe lengths and    model approach.
One of the most important,                                                            1) The use of generic flood The internal flooding analysis        frequencies  updated  to account  for generic flood frequencies (per    a) Realistic in that procedures and uncertain, inputs to an      Likelihood and                                                                                  foot) for different categories of explicitly models floods of various    plant-specific operating                                                    direct that a faulted system be internal flooding analysis is  characterization of                                                                              piping from the EPRI magnitudes from various sources        experience,  design, and  operating                                        secured.
the frequency of floods of      internal flooding                                                                                methodology.
(for example, fire protection          practices  in conjunction with plant-various magnitudes (e.g.,        sources and                                                                                                                      b) Slight conservative bias water, and cooling water) using        specific estimates  of pipe lengths
: 16. Piping failure    small, large, catastrophic)  internal flood event                                                                              a) Spray initiator scenario          treatment in that the system the most current EPRI pipe break      is suitable for representation of the mode              from various sources (e.g.,  sequences and the                                                                                      impacts are limited to the        may not be totally disable in frequency data. Multiple              flood frequencies at the site.
clean water, untreated water, timing associated                                                                                      local effects of the spray.      all cases. This should not be scenarios are developed for salt water, etc.). EPRI has  with human actions                                      2) Unless specifically noted, all flood b) Flood and major flood                a source of model uncertainty different break size categories developed some data, but      involved in flooding                                        events are assumed to totally                                                in most applications.
when the break size affects the                                                  initiator scenarios include the NRC has not formally          mitigation.                                            disable the system and/or train accident progression and timing.                                                  failure of the source system  Therefore, this does not represent endorsed its use.                                                                        from which the flood initiated from.      as well as the components    a key source of uncertainty for the that are failed due to the    ANO-2 RICT application.
flood event.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 17 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from    Plant-Specific Approach Taken          Assumptions Made (QU-E2)          Impact on Model (QU-E4)        Characterization Assessment EPRI TR-10167371    from EPRI TR-1016737 EPRI TR-1016737 Data Analysis (DA)
Based on industry-accepted ANO-2 uses the alpha factor                                                                            approach and the sensitivity method for developing CCF                                                                              results, intra-system common CCFs have been shown to                        probabilities.                    Consensus model and approach was                                      cause is judged not to be a source be important contributors in                                                      utilized. No significant assumptions                                  of model uncertainty.
PRAs. As limited plant-                        The data used to develop the      were made.
CCF parameter values is taken                                            Standard sensitivity cases for Generic uncertainty applied, but specific data is available,  CCF data values
: 26. Intra-system                                                    from the CCF Parameter            In accordance with Supporting          CCFs are performed as part of  not expected to be a source of generic common cause          and associated common cause                                                    Estimations, 2010 update, or      Requirement DA-D6, generic CCF        the quantification in order to model uncertainty in most factors are commonly used. system model events                                                          WCAP-16883-P (Reference 12).      probabilities from the NRC website for determine the impact of        applications. The approach is Sometimes, plant-specific    representations The CCF Parameter database is    "CCF Parameter Estimations, 2007      assumptions.                  considered realistic. No alternative evidence can indicate that based on NUREG/CR-6928            Update" satisfy the requirement for                                  approaches are judged reasonable the generic values are (Reference 26), which is updated  meeting Capability Category II.                                      to justify.
inappropriate.
by the Idaho National Laboratory                                                                        Therefore, this does not represent (INL) for the NRC.                                                                                      a key source of uncertainty for the ANO-2 RICT application.
Quantification (QU)
The ANO-2 PRA model is based on industry consensus modeling The methods used to address      No significant assumptions.                                          approaches for its HEP There is not a consistent HFE dependencies are integrated method for the treatment of                                                      This treatment is consistent with      Standard sensitivity cases for calculations; therefore, this is not into the HRA Calculator, which is
: 25. Treatment of    potentially dependent        Quantification of                                  industry practices, the NRCs Good    HFEs are performed as part of considered a significant source of designed to comply with the                                                                            epistemic uncertainty for the PRA.
HFE            post-initiator human errors. dependent human                                      Practices for Implementing Human      the quantification in order to American Society of Mechanical                                                                          The RICT Program includes dependencies    SPAR models do not                errors                                        Reliability Analysis (HRA),            determine the impact of Engineers / American Nuclear                                                                            operator action RMAs generally include                                                                (NUREG-1792), and the ASME PRA        assumptions.
Society (ASME/ANS) dependencies.                                                                    Standard.                                                            Therefore, this does not represent requirements.
a key source of uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
2CAN042301 Page 18 of 50 Part of Model Topic (QU-E1) from      Discussion of Issue Affected from  Plant-Specific Approach Taken        Assumptions Made (QU-E2)            Impact on Model (QU-E4)      Characterization Assessment EPRI TR-10167371,2    from EPRI TR-1016737 EPRI TR-1016737 LERF Analysis (LE)
Based on industry-accepted Inter-system LOCA                                                                                                                                  approach the application of (ISLOCA) is often a                                                                                                                                ISLOCA is judged not to be a significant contributor to                                                                                                                        source of model uncertainty.
LERF. One key input to the                                                                                                                        Applications with a focus on The plant-specific ISLOCA                                                                            ISLOCA should take into ISLOCA analysis are the screening and modeling for                                                                          consideration the uncertainty assumptions related to ANO-2 is based on the guidelines                                                                    associated with ISLOCA common cause failure of in Nuclear Science Advisory                                              Failure of the low-pressure frequencies.
: 22. ISLOCA IE      isolation valves between the                                                    Industry-accepted approach utilized to Committee (NSAC) 154                                                    pipe upon exposure to RCS Frequency      RCS/RPV and low-pressure ISLOCA sequences                                      address CCFs. No significant (Reference 13). The ISLOCA                                              pressure depends on        The approach for the ISLOCA Determination  piping. There is no                                                            assumptions made.
fault tree models are quantified                                        individual cases.          frequency determination is consensus approach to the dynamically within the single-top                                                                    considered an industry good data or treatment of this model fault tree models for CDF                                                                      practice. No alternative issue. Additionally, given an and LERF for each unit.                                                                              approaches are judged reasonable overpressure condition in to justify.
low pressure piping, there is uncertainty surrounding the                                                                                                                        Therefore, this does not represent failure mode of the piping.                                                                                                                        a key source of uncertainty for the ANO-2 RICT application.
: 1. Generic issues from EPRI-TR-1016737, items 6, 7 and 23 are not applicable to ANO-2.
: 2. Generic issues from EPRI-TR-1016737, items 17-21 are included in PSA-ANO2-06-4B-SOU, Section 4, Level 2 Related Epistemic Uncertainty Impact Assessment.
2CAN042301 Page 19 of 50
: 3. Assessment of Supplementary Fire PRA (FPRA) Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the ANO-2 FPRA. The FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA, and because the state of knowledge in these elements continues to evolve. The development of the FPRA was guided by NUREG/CR-6850 (Reference 8). The FPRA model used consensus models described in NUREG/CR-6850. Enclosure 2 provides a detailed discussion of the Peer Review facts and observations (F&Os) and resolutions.
The SOKC, included within the parametric uncertainty evaluation, was addressed as part of the ANO-2 baseline PRA model quantification. The parametric uncertainty evaluation for the FPRA model is documented in PSA-ANO2-03-FQ-01 R1, "ANO-2 Fire PRA Uncertainty/ Sensitivity Analysis" (Reference 14). The ANO-2 database uses type codes to perform the SOKC.
Generic failure rates use variables so that correlations are maintained and the UNCERT computer code was run to propagate the probability distributions using a Monte Carlo analysis.
The results of this analysis confirmed little variability in the overall results and, therefore, parametric uncertainty is not a source of uncertainty in the RICT program.
In order to identify key sources of uncertainty for the RICT Program application, an evaluation of FPRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and EPRI Technical Report (TR)-1026511 (Reference 15).
As stated in Section 1.3 of NUREG-1855:
    "Although the guidance in the this [sic] report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards."
NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions:
    "A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time.
In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time."
2CAN042301 Page 20 of 50 Section 2.1.3 of NUREG-1855 defines consensus model as:
          "Consensus model - In the most general sense, a consensus model is a model that has a publicly available published basis(2) and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRC has used or accepted for the specific risk-informed application for which it is proposed."
The potential sources of model uncertainty in the ANO-2 FPRA model were evaluated for the 71 FPRA topics outlined in EPRI TR-1026511 (Reference 15). This guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850 and was used to evaluate the baseline FPRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations. Table E9-2 summarizes the results of the EPRI TR-1026511 review within the Topic Areas outlined by NUREG/CR-6850.
As noted above, the ANO-2 FPRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. FPRA methods were based on NUREG/CR-6850, other more recent NUREGs, e.g., NUREG-7150 (Reference 16), and published "frequently asked questions" (FAQs) for the FPRA.
It has been concluded that the uncertainties outlined in EPRI TR-1026511 do not present a significant impact on the ANO-2 RICT calculations. Note that RMAs will be developed when appropriate using insights from the FPRA model results specific to the configuration.
All generic and plant specific sources of uncertainty in the fire PRA have been reviewed and assessed for the RICT Program and are documented in PSA-ANO2-06-4B-SOU (Reference 7).
2 It is anticipated that most consensus models would be available in the open literature. However, under the requirements of 10 CFR 2.390, there may be a compelling reason, for exempting a consensus model from public disclosure.
2CAN042301 Page 21 of 50 Table E9-2: Fire PRA Sources of Model Uncertainty Topic (To Item                            FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
Based on a review of the assumptions and potential sources This task poses a limited source  of uncertainly associated with this of uncertainty beyond the credit  element, it is concluded that the taken for boundaries and          methodology for the Analysis partitions. Task 1 establishes    Boundary and Partitioning task Plant Boundary  the overall spatial scope of the  does not introduce any epistemic 1      Definition and  analysis and provides a            uncertainties that would require Partitioning    framework for organizing the      sensitivity treatment.
data for the analysis. The partitioning features credited are Therefore, this does not represent a required to satisfy established    key source of uncertainty for the industry standards.                ANO-2 TSTF-505 application and no RMAs are required to address this item.
This task involves the selection In the context of the FPRA, the of components to be treated in uncertainty that is unique to the the analysis in the context of analysis is related to initiating event initiating events and mitigation.
identification. However, that impact The potential sources of is minimized through use of the uncertainty include those Pressurized Water Reactor Owners inherent in the internal events Group (PWROG) Generic MSO list PRA model as that model and the process used to identify provides the foundation for the and assess potential MSOs.
FPRA. The mapping of basic FPRA            events to components requires      Based on the discussion of sources 2      Component        not only the consideration of      of uncertainty and the discussion Selection        failure modes (active versus      above, it is concluded that the passive) but an understanding of  methodology for the Component the fire function / PRA            Selection task does not introduce component functions not            any epistemic uncertainties that previously considered risk        would require sensitivity treatment.
significant in the FPIE model.
Therefore, this does not represent a When performed correctly, the key source of uncertainty for the only uncertainty not already ANO-2 TSTF-505 application and captured in the FPIE model is no RMAs are required to address related to the Multiple Spurious this item.
Operation (MSO) process.
2CAN042301 Page 22 of 50 Topic (To Item                        FPRA Key Assumptions                Disposition For RICT Meet QU-E1)
As part of the FPRA, some components were conservatively assumed to be failed in certain locations based on the high likelihood of cables being present in the physical analysis unit (PAU).
Components in this category are referred to as Unknown Location (UNL) components because specific cables were not identified for the components. These components are documented in the The selection of cables to be    ANO-2 FPRA Fire Scenario considered in the analysis is    Development Notebook and identified using industry        assigned to a surrogate PAU guidance documents. No          (UNL) for fire risk quantification.
treatment of uncertainty is      As part of the analysis, components typically required for Task 3    that were determined to significantly beyond the understanding of the  contribute to risk had their cables cable selection approach (i.e.,  routed. A sensitivity analysis was mapping an active basic event to performed and documented in a passive component for which    Appendix D of the Summary Report FPRA Cable 3                    power cables were not selected). to measure the risk associated with Selection Additionally, PRA credited      the assumption that these components for which cable      components fail in select fire routing information was not      scenarios. The sensitivity removed provided represent a source of  all UNL components from every fire uncertainty (conservatism) in    scenario. Based on the results, the those components whose cable    inclusion of the UNL components locations are not explicitly    introduces small risk to both fire modeled (i.e., "UNL"            CDF and LERF. The FPRA is the components) could be assumed    limiting condition for LCO 3.6.2.1, failed unnecessarily.            with two Containment Spray trains inoperable. The containment coolers are assumed failed in the FPRA model resulting in a RICT that is conservatively high for this LCO. Future model improvements can enhance the allowed outage time for this LCO condition.
To understand the impact on masking, a RICT specific sensitivity is provided in PSA-ANO2-06-4B-SOU (Reference 7), Section 8.1.
2CAN042301 Page 23 of 50 Topic (To Item                        FPRA Key Assumptions                Disposition For RICT Meet QU-E1)
In the event a structure (location) which could result in a plant trip was incorrectly excluded, its contribution to CDF would be small (with a conditional core damage probability (CCDP) commensurate with base risk). Such a location Qualitative screening was not would have a negligible risk performed; however, structures contribution to the overall FPRA.
were eliminated from the global analysis boundary and ignition  Based on a review of the sources deemed to have no        assumptions and potential sources Qualitative 4                    impact on the FPRA were          of uncertainty related to this Screening excluded from the quantification element and the discussion above, based on qualitative screening  it is concluded that the methodology criteria. The only criterion    for the Qualitative Screening task subject to uncertainty is the    does not introduce any epistemic potential for plant trip.        uncertainties that would affect the ANO-2 RICT Program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 24 of 50 Topic (To Item                        FPRA Key Assumptions                    Disposition For RICT Meet QU-E1)
The identified source of uncertainty could result in the over-estimation of fire risk. In general, the FPRA development process would have reviewed significant fire initiating events and performed supplemental The methodology used to            assessments to address this develop the FPRA Plant              possible source of uncertainty.
Response Model (PRM) is consistent with the standard that  Based on a review of the used for the internal events PRA    assumptions and potential sources model development and was          of uncertainty related to this subjected to industry Peer          element and the discussion above, Review.                            it is concluded that the methodology for the Fire-Induced Risk Model The PRM model is applied in        task does not introduce any Fire-Induced such a fashion that all postulated 5                                                        epistemic uncertainties that would Risk Model  fires are assumed to generate a    affect the ANO-2 RICT Program.
plant trip. This represents a      An update to the ANO-2 FPRA is source of uncertainty, as it is not planned to update the model failure necessarily clear that fires would  rates to the PWROG-18042-NP result in a trip. In the event the  (Reference 19) values defined for fire results in damage to cables    portable equipment in 2023.
and/or equipment identified in Task 2, the PRA model includes      Sensitivity analysis have been structure to translate them into    performed by setting the failure the appropriate induced initiator. rates to the PWROG-18042-NP (Reference 19) and the 95th percentile in Section 8.2 of PSA-ANO-2-4B-SOU (Reference 7) and the current modeling is a source of uncertainty for the RICT application.
2CAN042301 Page 25 of 50 Topic (To Item                        FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
The ANO-2 FPRA utilized the bin frequencies from NUREG-2169 Ignition source counting is an (Reference 17). Consensus area with inherent uncertainty; approaches are employed in the however, the results are not model.
particularly sensitive to changes in ignition source counts. The    Based on a review of the primary source of uncertainty for  assumptions and potential sources this task is associated with the  of uncertainty related to this frequency values from              element it is concluded that the Fire Ignition 6                    NUREG-2169 (Reference 17)          methodology for the Fire Ignition Frequencies which result in uncertainty due to Frequency task does not introduce variability among plants along    any epistemic uncertainties that with some significant              would affect the ANO-2 RICT conservatism in defining the      program.
frequencies, and the associated Therefore, this does not represent a heat release rates, based on key source of uncertainty for the limited fire events and fire test ANO-2 TSTF-505 application and data.
no RMAs are required to address this item.
Quantitative screening criteria was defined for the ANO-2 FPRA as the CDF/LERF contribution of zero, such that all quantified fire scenarios are retained. All of the results were retained in the cumulative CDF/LERF; therefore, no uncertainty was introduced as a Other than screening out          result of this task.
potentially risk significant Quantitative                                    Based on the discussion above, it is 7                    scenarios (ignition sources), this Screening                                        concluded that the methodology for task is not a source of the Quantitative Screening task uncertainty.
does not introduce any epistemic uncertainties that would affect the ANO-2 RICT program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 26 of 50 Topic (To Item                        FPRA Key Assumptions                Disposition For RICT Meet QU-E1)
Detailed fire modeling was applied The approach taken for this task to risk significant scenarios where included: 1) the use of generic  the reduction in conservatism was fire modeling treatments in lieu likely to have a measurable impact.
of conservative scoping analysis Consensus modeling approach is techniques; and, 2) limited used for the Fire Modeling tasks detailed fire modeling was and it is concluded that the Fire Scoping performed to refine the 8                                                    methodology does not introduce Model        scenarios developed using the any epistemic uncertainties that generic fire modeling solutions.
would require sensitivity treatment.
The primary conservatism introduced by this task is      Therefore, this does not represent a associated with the heat release key source of uncertainty for the rates specified in              ANO-2 TSTF-505 application and NUREG/CR-6850 (Reference 8). no RMAs are required to address this item.
2CAN042301 Page 27 of 50 Topic (To Item                            FPRA Key Assumptions                    Disposition For RICT Meet QU-E1)
Circuit analysis was performed as part of the deterministic post fire safe shutdown analysis.
Refinements in the application of the circuit analysis results to the FPRA were performed on a case-by-case basis where the scenario The circuit analysis is performed risk quantification was large enough using standard electrical to warrant further detailed analysis.
engineering principles.
Hot short probabilities and hot short However, the behavior of duration probabilities as defined in electrical insulation properties NUREG-7150 (Reference 16),
and the response of electrical Volume 2, based on actual fire test circuits to fire induced failures is data, were used in the ANO-2 a potential source of uncertainty.
FPRA. The uncertainty This uncertainty is associated (conservatism) which may remain in with the dynamics of fire and the the FPRA is associated with Detailed Circuit inability to ascertain the relative 9                                                            scenarios that do not contribute Analysis        timing of circuit failures. The significantly to the overall fire risk.
analysis methodology assumes failures would occur in the worst    Based on a review of the possible configuration, or if        assumptions and potential sources multiple circuits are involved, at  of uncertainty related to this whatever relative timing is          element and the discussion above, required to cause a bounding        it is concluded that the methodology worst-case outcome. This            for the Detailed Circuit Failure results in a skewing of the risk    Analysis task does not introduce estimates such that they are        any epistemic uncertainties that over-estimated.                      would affect the ANO-2 RICT program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 28 of 50 Topic (To Item                          FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
The use of hot short failure probability and duration probability is based on fire test data and associated consensus methodology For the Circuit Failure Model      published in NUREG-7150, Likelihood Analysis, one of the    Volume 2 (Reference 16). Based failure modes for a circuit (cable) on a review of the assumptions and given fire induced failure is a hot potential sources of uncertainty short. A conditional probability    related to this element and the Circuit Failure and a hot short duration            discussion above, it is concluded Mode 10                      probability are assigned using      that the methodology for the Circuit Likelihood industry guidance published in      Failure Mode Likelihood Analysis Analysis NUREG-7150, Volume 2                task does not introduce any (Reference 16). The uncertainty    epistemic uncertainties that would values specified in                affect the ANO-2 RICT program.
NUREG-7150, Volume 2, are based on fire test data.            Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 29 of 50 Topic (To Item                        FPRA Key Assumptions                    Disposition For RICT Meet QU-E1)
The application of fire modeling technology is used in the FPRA to translate a fire initiating event into a set of consequences (fire induced failures). The performance of the analysis requires a number of key input parameters. These input parameters include the heat release rate (HRR) for the fire, the growth rate, the damage threshold for the targets, and response of plant staff (detection, fire control, fire suppression).
The fire modeling methodology itself is largely empirical in some respects and consequently is another source of uncertainty.
For a given set of input            Consensus modeling approach is parameters, the fire modeling        used for Detailed Fire Modeling, results (temperatures as a          and it is concluded that the function of distance from the fire)  methodology for the Detailed Fire are characterized as having          Modeling task does not introduce Detailed Fire some distribution (aleatory          any epistemic uncertainties that 11                                                        would require sensitivity treatment.
Modeling      uncertainty). The epistemic uncertainty arises from the          Therefore, this does not represent a selection of the input parameters    key source of uncertainty for the (specifically the HRR and growth    ANO-2 TSTF-505 application and rate) and how the parameters        no RMAs are required to address are related to the fire initiating  this item.
event. While industry guidance is available, that guidance is derived from laboratory tests and may not necessarily be representative of randomly occurring events.
The fire modeling results using these input parameters are used to identify a zone of influence (ZOI) for the fire and cables/equipment within that ZOI are assumed to be damaged. In general, the guidance provided for the treatment of fires is conservative and the application of that guidance retains that conservatism. The resulting risk estimates are also conservative.
2CAN042301 Page 30 of 50 Topic (To Item                      FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
The HEPs include the consideration of degradation or loss of necessary cues due to fire. The fire risk importance measures indicate that the results are somewhat sensitive to HRA model and parameter values. The ANO-2 FPRA model HRA is based on industry HEPs represent a potentially      consensus modeling approaches large uncertainty for the FPRA    for its HEP calculations and utilizes given the importance of human    a flood value of 1E-05 joint HEP actions in the base model.        probabilities.
Since many of the HEP values It is concluded that the were adjusted for fire, the joint methodology for the Post-Fire dependency multipliers Post-Fire                                      Human Reliability Analysis task developed for the FPIE model Human                                          does not introduce any epistemic 12                  also represent a potential for Reliability                                    uncertainties that would require introducing a degree of Analysis                                      sensitivity treatment. However, it is conservatism. The HEPs noted that the methodology for included the consideration of calculating HEPs for operating and degradation or loss of necessary aligning diverse and flexible coping cues due to fire. Given the strategies (FLEX) portable methodology used, the impact of equipment is a potential source of any remaining uncertainties is uncertainty for the ANO-2 expected to be small.
TSTF-505 application.
Therefore, a sensitivity for the RICT Program is provided by setting the HEPs associated with operating and aligning FLEX portable equipment to their 95th percentile.
See Section 8.3 of PSA-ANO2                                                            4B-SOU (Reference 7).
2CAN042301 Page 31 of 50 Topic (To Item                          FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
The qualitative assessment of seismic-induced fires should not be a source of model uncertainty as it is not expected to provide changes to the quantified FPRA model.
Based on the discussion above, it is concluded that the methodology for Since this is a qualitative Seismic Fire                                      the Seismic-Fire Interactions evaluation, there is no 13      Interactions                                      Assessment task does not quantitative impact with respect Assessment                                        introduce any epistemic to the uncertainty of this task.
uncertainties that affect the ANO-2 RICT Program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
The selected truncation was confirmed to be consistent with the requirements of the PRA Standard (Reference 10).
Based on a review of the assumptions and potential sources As the culmination of other of uncertainty related to this tasks, most of the uncertainty element and the discussion above, associated with quantification Fire Risk                                        it is concluded that the methodology 14                    has already been addressed.
Quantification                                    for the Fire Risk Quantification task The other source of uncertainty does not introduce any epistemic is the selection of the truncation uncertainties that would affect the limit.
ANO-2 RICT program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 32 of 50 Topic (To Item                        FPRA Key Assumptions                  Disposition For RICT Meet QU-E1)
This task does not introduce any new uncertainties. This task is intended to address how the fire risk assessment could be impacted by the various sources of uncertainty.
This task does not introduce any  Based on the discussion above, it is new uncertainties. This task is  concluded that the methodology for Uncertainty intended to address how the fire  the Uncertainty and Sensitivity 15    and Sensitivity risk assessment could be          Analyses task does not introduce Analyses impacted by the various sources  any epistemic uncertainties that of uncertainty.                  would affect the ANO-2 RICT program.
Therefore, this does not represent a key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
This task does not introduce any new uncertainties to the fire risk as it outlines documentation The FPRA Documentation task      requirements.
Fire PRA 16                    does not introduce any new        Therefore, this does not represent a Documentation uncertainties to the fire risk. key source of uncertainty for the ANO-2 TSTF-505 application and no RMAs are required to address this item.
Credit in the FPRA was removed during the NFPA-805 approval Very Early                                                    process given that NUREG-2180 Warning                    Installed in Unit 2 (only) in key (Reference 18) was not published.
Fire                    electrical cabinets. Procedures Detection                  are established to address        Therefore, this does not represent a System                    system operation and response. key source of uncertainty for the (VEWFDS)                                                      ANO-2 TSTF-505 application and no RMAs are required to address this item.
2CAN042301 Page 33 of 50
: 4. Assessment of Level 2 Epistemic Uncertainty Impacts In order to evaluate key sources of uncertainty for RICT Program application, an evaluation of Level 2 internal events PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and EPRI TR-1026511 (Reference 15). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.
In addition to the Level 2 topics (#17-23) in EPRI TR-1016737, the potential sources of model uncertainty in the ANO-2 PRA models were evaluated for all 32 Level 2 PRA topics outlined in EPRI TR-1026511 (Reference 15) and plant specific sources of uncertainty associated with the LERF model. Most of the generic topics are not sensitive to the LERF calculations and will not impact the RICT program calculations. However, sensitivity analyses were developed, in response to conservatisms in the SGTR sequences as documented in PSA-ANO2-06-4B-SOU (Reference 7), Section 8.4, and was determined not to be a key source of uncertainty for the RICT Program. Note that RMAs will be developed when appropriate using insights from the Level 2 PRA model results specific to the configuration.
All generic and plant specific sources of uncertainty in the Level 2 FPIE/IF and FPRA PRAs have been reviewed and assessed for the RICT program and are documented in PSA-ANO2-06-4B-SOU (Reference 7).
: 5. Assessment of Translation Real Time Risk (RTR Model) Uncertainty Impacts Incorporation of the baseline PRA models into the RTR model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-3 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to  for additional discussion on the RTR model.
Table E9-3: Assessment of Translation Uncertainty Impacts CRMP Model Change            Part of Model Impact on Model              Disposition and Assumptions                Affected The model, if Since the restructured restructured, will be PRA model logic                                                              model will produce Fault tree logic model    logically equivalent and structure may be                                                            comparable numerical structure, affecting both produce results optimized to increase                                                        results, this is not a IE PRA and FPRA.          comparable to the solution speed.                                                              source of uncertainty baseline PRA logic for the RICT Program.
model.
2CAN042301 Page 34 of 50 CRMP Model Change            Part of Model Impact on Model              Disposition and Assumptions              Affected Since this is a bounding approach for Incorporation of seismic                        The addition of addressing seismic risk risk bias to support                            bounding impacts for in the RICT Program, it RICT Program risk        Calculation of RICT    seismic events has no is not a source of calculations.            and Risk Management    impact on baseline translation uncertainty, Action Threshold      PRA or RTR model.
A conservative value                                                    and RICT Program (RMAT) within RTR. Impact is reflected in for the seismic delta                                                    calculations are not calculation of all RICTs CDF is applicable.                                                      impacted, so no and RMATs.
mandatory RMAs are required.
Since the RTR model evaluates specific This change is configurations during consistent with RTR at-power conditions, tool practice; therefore, the use of a plant Set plant availability                                                  this change does not availability factor less (Reactor Critical                                                        represent a source of Typecode @AVAIL        than 1.0 is not Years Factor) basic                                                      uncertainty, and RICT appropriate. This event to 1.0.                                                            Program calculations change allows the RTR are not impacted, so no model to produce mandatory RMAs are appropriate results for required.
specific at-power configurations.
: 6. Diverse and Flexible Coping Strategies (FLEX) in the PRA Models Based on a review of prior TSTF-505 NRC requests for additional information (RAIs), this section provides a description of FLEX equipment and strategies applicable to the ANO-2 PRA models in support of risk-informed decision-making for this TSTF-505 application. The specific uncertainty impacts are discussed for the various models in subsequent sections of this enclosure.
Overview Description FLEX portable equipment is credited in the ANO-2 FPIE PRA (which includes IF) and FPRA.
The FLEX equipment, component failure rates, operator actions, and differences between the models are discussed in the following sections.
2CAN042301 Page 35 of 50 a)  IE PRA I. A description of all FLEX equipment credited in the ANO-2 IE PRA.
All components relevant to the current PRA modeling for FLEX equipment are provided in Table E9-4. For portable equipment (pumps and diesel generators),
only one component is modeled in the ANO-2 PRA model. Components from permanently installed systems are not included unless they are FLEX portable equipment connection points.
Table E9-4: FLEX Component Table Component          Component            Performance          FLEX      Modeled IDs            Description              Criteria        Strategy  Failure State 300 gpm @ 700 ft P-254/P-255/  Portable SG Feed            Total Dynamic          Not    Fail to Start /
P-260/P-261  Pumps (4)                  Head (TDH) or      Connected  Fail to Run
                                                      ~300 psi Portable Inventory        750 gpm @ 230 ft        Not    Fails to Start /
P-258/P-259 Transfer Pumps (2)        TDH or ~100 psi    Connected  Fails to Run 480 VAC, 800 kW (200% capacity, Portable Diesel              capable of          Not    Fails to Start /
K-11/K-12 Generators (2)            supplying flow to  Connected  Fails to Run both units at the same time)
Sufficient to supply ANO-1 Engine-Driven                          Standby/Not Fails to Start /
P-6B                                  turbine-driven EFW Firewater Pump                                  Running    Fails to Run pump suction FS-1B        Fire Water Check Valve          N/A            Closed  Fails to Open Fire Water Manual FS-12                                          N/A            Open    Fails to Close Valve Fire Water Manual FS-14                                          N/A            Open    Fails to Close Valve Fire Water - Service FS-5700      Water Crosstie Manual            N/A            Closed  Fails to Open Valve Fire Water - Service SW-6047      Water Crosstie Manual            N/A            Closed  Fails to Open Valve 2CAN042301 Page 36 of 50 Component      Component          Performance    FLEX      Modeled IDs          Description        Criteria    Strategy  Failure State ANO-1 Supply to ANO-2 SW-632    Emergency Condenser          N/A        Closed  Fails to Open Supply Manual Valve ANO-1 Supply to ANO-2 2SW-69B  Emergency Condenser          N/A        Closed  Fails to Open Supply Manual Valve Pump P-4B to P-4C CV-3640  Crosstie Motor Operated      N/A        Open    Fails to Close Valve Pump P-4B to P-4C CV-3642  Crosstie Motor Operated      N/A        Open    Fails to Close Valve Qualified Condensate 2CS-818  Storage Tank (QCST)          N/A        Closed  Fails to Open FLEX Supply CS-287    QCST FLEX Supply            N/A        Closed  Fails to Open CS-283    QCST Makeup Valve            N/A        Closed  Fails to Open CS-284    QCST Makeup Valve            N/A        Closed  Fails to Open CS-5856  QCST Check Valve            N/A        Closed  Fails to Open CS-5859  QCST Check Valve            N/A        Closed  Fails to Open FLEX EFW Primary 2EFW-36  Discharge Isolation          N/A        Closed  Fails to Open Valve FLEX EFW Primary 2EFW-1087 Discharge Vent Isolation    N/A    Closed/Open Fail to Close Valve FLEX EFW Primary 2EFW-35  Discharge Isolation          N/A        Closed  Fails to Open Valve FLEX EFW Alternate 2EFW-38  Discharge Isolation          N/A        Closed  Fails to Open Valve 2CAN042301 Page 37 of 50 Component            Component                Performance            FLEX        Modeled IDs              Description                  Criteria          Strategy    Failure State FLEX EFW Alternate 2EFW-1091      Discharge Vent Isolation            N/A          Closed/Open    Fail to Close Valve FLEX EFW Alternate 2EFW-37        Discharge Isolation                  N/A              Closed    Fails to Open Valve FLEX Supply Breaker 2B524                                                N/A              Open      Fails to Close to 2B5 FLEX Supply Breaker 2B624                                                N/A              Open      Fails to Close to 2B6 II. A description of all FLEX operator actions credited in the ANO-2 IE PRA.
The post-initiator operator actions identified for the FLEX system are listed in Table E9-5. These HFEs were identified through procedure and FLEX strategy reviews and refined during the system modeling process.
Table E9-5: FLEX System Post-Initiator Human Failure Events Post-Initiator Event ID                            Event Description Operator Fails to Manually Open Steam Supply and Control Pump FLX2XHE-FO-2P7AMC 2P-7A [EFW Pump] without DC Power FLX2XHE-FO-800KDG          Operator Fails to Align 800 kW FLEX DG to Vital Busses Operator Fails to Initiate Alternate Low-Pressure Feedwater if FLX2XHE-FO-ALTFWI Demanded Operator Fails to Declare ELAP [Extended Loss of AC Power]
FLX2XHE-FO-ELAPXX Event FLX2XHE-FO-LOADSD          Operator Fails to Deep Load Shed DC Busses during ELAP Event Operator Fails to Manually Isolate Instrument Air to MSIVs for FLX2XHE-FO-MSIV FLEX Phase 1/2 Operator Fails to Refill QCST using ECP [Emergency FLX2XHE-FO-QCSTRF Cooling Pond] and FLEX Transfer Pump Operators Fail to Manually Cooldown and Depressurize using FLX2XHE-FO-SGDEP the SGs (FLEX)
Operator Fails to Install Manual SG Level Monitoring per FLX2XHE-FO-SGLVLM 2FSG-007 Attachment 1/2 2CAN042301 Page 38 of 50 Post-Initiator Event ID                              Event Description Operator Fails to Manually Open SG Supply Valve from EFW FLX2XHE-FO-SGMVLV for Phase 1/2 FLEX Operator Fails to Align Service Water to Steam Driven Pump FLX2XHE-FO-SWFPSS 2P-7A FLX2XHE-FO-REFUEL            Operator Fails to Refuel FLEX Equipment III. The methodology used to assess the failure probabilities of any modeled equipment credited in the mitigating strategies for FLEX.
The component boundaries and failure rates for all portable equipment in the FLEX model are being defined using the industry data source, PWROG 18042-P, Revision 1 (Reference 19). To simplify the modeling and bound common cause failure rate data uncertainties, only one component is modeled for each portable equipment function in the model. This is recognized as potentially conservative but bounds the risk estimates that would otherwise require additional model complexity and uncertainties.
Supporting requirements for HLR-DA-D (ASME Standard, RA-Sa-2009 (Reference 10) are addressed in Table E9-6 for the modeling of the Flex Portable Equipment.
Table E9-6: Supporting Requirements for HLR-DA-D Supporting Req.                                                              Discussion for (SR) No. /                    Supporting Requirement                    Section of Report Capability                      Capability Category II                Meeting Supporting Category                                                                    Requirement CALCULATE realistic parameter estimates for significant basic events based on relevant generic and plant-specific evidence unless it is      The component justified that there are adequate plant-specific      boundaries and data to characterize the parameter value and its      failure rates for all uncertainty. When it is necessary to combine          portable equipment in evidence from generic and plant-specific data,        the FLEX model are USE a Bayes update process or equivalent              being defined using DA-D1 / II      statistical process that assigns appropriate          the industry data weight to the statistical significance of the        source, PWROG-generic and plant-specific evidence and provides      18042-NP an appropriate characterization of uncertainty.      (Reference 19).
CHOOSE prior distributions as either non-            Generic data is used informative, or representative of variability in      without plant-specific industry data. CALCULATE parameter estimates          update at this time.
for the remaining events by using generic industry data.
2CAN042301 Page 39 of 50 Supporting Req.                                                          Discussion for (SR) No. /                Supporting Requirement                    Section of Report Capability                  Capability Category II                Meeting Supporting Category                                                              Requirement If neither plant-specific data nor generic parameter estimates are available for the Not applicable; parameter associated with a specific basic event, component data is USE data or estimates for the most similar DA-D2 / All                                                      available in equipment available, adjusting if necessary to PWROG-18042-NP account for differences. Alternatively, USE (Reference 19).
expert judgment and document the rationale behind the choice of parameter values.
The industry source data PWROG-18042-NP (Reference 19),
PROVIDE a mean value of, and a statistical provides the mean representation of the uncertainty intervals for, the value and uncertainty parameter estimates of significant basic events.
DA-D3 / II                                                        intervals being used Acceptable systematic methods include in the analysis. No Bayesian updating, frequentist method, or expert Bayesian update was judgment.
performed in this iteration as the source data includes the data from ANO-2.
2CAN042301 Page 40 of 50 Supporting Req.                                                        Discussion for (SR) No. /                Supporting Requirement                  Section of Report Capability                  Capability Category II              Meeting Supporting Category                                                            Requirement When the Bayesian approach is used to derive a distribution and mean value of a parameter, CHECK that the posterior distribution is reasonable given the relative weight of evidence provided by the prior and the plant-specific data.
Examples of tests to ensure that the updating is accomplished correctly and that the generic parameter estimates are consistent with the plant-specific application include the following:
(a) confirmation that the Bayesian updating does not produce a posterior distribution    Bayesian approach with a single bin histogram                  not used for data DA-D4 / II/III (b) examination of the cause of any unusual        values of the FLEX (e.g., multimodal) posterior distribution    components.
shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate (d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean value USE one of the following models for estimating CCF parameters for significant CCF basic events:                                            No new CCF events created in the FLEX (a) Alpha Factor Model                            model for portable (b) Basic Parameter Model                          equipment.
DA-D5 / II                                                      Currently, the ANO-2 (c) Multiple Greek Letter Model                    FLEX PRA models (d) Binomial Failure Rate Model                    only one piece of portable equipment JUSTIFY the use of alternative methods (i.e.,      per function.
provide evidence of peer review or verification of the method that demonstrates its acceptability).
USE generic common cause failure probabilities consistent with available plant experience.
See response to DA-D6 / II    EVALUATE the common cause failure DA-D5 probabilities in a manner consistent with the component boundaries.
2CAN042301 Page 41 of 50 Supporting Req.                                                          Discussion for (SR) No. /                  Supporting Requirement                  Section of Report Capability                  Capability Category II                Meeting Supporting Category                                                                Requirement If screening of generic event data is performed for plant-specific estimation, ENSURE that No screening DA-D7 / All    screening is performed on both the CCF events performed.
and the independent failure events in the data-base used to generate the CCF parameters.
If modifications to plant design or operating practice lead to a condition where past data are no longer representative of current performance, LIMIT the use of old data:
(a) If the modification involves new equipment or a practice where generic parameter estimates are available, USE the generic parameter estimates updated with plant-specific data as it becomes available for DA-D8 / II                                                          Not applicable significant basic events; or (b) If the modification is unique to the extent that generic parameter estimates are not available and only limited experience is available following the change, then ANALYZE the impact of the change and assess the hypothetical effect on the historical data to determine to what extent the data can be used.
IV. Methodology used to assess operator actions related to FLEX equipment The methodology of the plant-specific HEPs and associated scenario-specific performance shaping factors listed in (a) - (j) of supporting requirement HR-G3 of ASME/ANS RA-Sa-2009 (Reference 10), as endorsed by RG 1.200 (Reference 27) for the FLEX operator actions are discussed in the following section.
Operator actions related to FLEX equipment and strategies may be performed under unique operating circumstances and conditions. As such, the performance shaping factors (PSFs) were evaluated specifically for FLEX-related actions. Each of these PSFs is addressed in the development of the specific actions and is documented using the HRA calculator (Reference 20). Information was obtained via procedure review, operator interview, and FLEX specific sources such as the FLEX Validation Plan (Reference 21) and/or the FLEX Integrated Plan (Reference 22). The PSFs listed in HR-G3 of ASME/ANS RA-Sa-2009 are addressed as follows:
2CAN042301 Page 42 of 50 a) quality [type (classroom or simulator) and frequency] of the operator training or experience Training has been performed to ensure operator familiarity with FLEX equipment and FLEX strategies. Training included walk-throughs, job aids, equipment deployment, placement strategies, and use of different FLEX strategies.
b) quality of the written procedures and administrative controls FLEX strategy support guidelines have been developed in accordance with PWROG guidelines (Reference 19). FLEX support guidelines provide available, pre-planned FLEX strategies for accomplishing specific tasks in the EOPs or Abnormal Operating Procedures (AOPs). FLEX Support Guidelines (FSGs) would be used to supplement (not replace) the existing procedure structure that establishes command and control for the event. Procedural Interfaces have been incorporated into OP-2202.008, (Station Blackout procedure), to the extent necessary to include appropriate reference to FLEX Developed Strategies (FDSs) and provide command and control for the ELAP.
This is also assessed in the CBDTM, branches Pc-e through Pc-g of the HRA Calculator.
c) availability of instrumentation needed to take corrective actions The instrumentation required for each action is specific to the action itself.
Specifically, CBDTM branch Pc-a evaluates the availability of required instrumentation.
d) degree of clarity of cues/indications The clarity of the cues/indications is considered in the CBDTM branches Pc-b and Pc-d.
e) human-machine interface The human-machine interface (HMI) is evaluated in the Pc-c branch of the CBDTM as well as in the execution steps for each action.
f) time available and time required to complete the response Where applicable, site-specific thermal hydraulic (TH) analysis was used to determine the time window for FLEX actions. In other cases, the time window was based on other pertinent information which does not require TH data (e.g., time to refuel equipment). Operators talk-through and/or the FLEX validation plan (Reference 21) provided the basis for the time to complete the response.
2CAN042301 Page 43 of 50 g)  complexity of the required response The complexity of the response is assessed in the Execution PSFs window of the HRA calculator for each action. An assignment of complex or simple is selected, which in turn has an impact on the HEP.
h)  environment (e.g., lighting, heat, radiation) under which the operator is working The environment of the response is assessed in the Execution PSFs window of the HRA calculator for each action. This considers the lighting, heat/humidity, radiation level, and atmosphere where the action is performed.
i)  accessibility of the equipment requiring manipulation The accessibility of the equipment (accessible, with difficulty, or inaccessible) is assessed in the Execution PSFs window of the HRA calculator for each action.
j)  necessity, adequacy, and availability of special tools, parts, clothing, etc.
The adequacy and availability of tools required for the FLEX actions was reviewed. The key equipment necessary for the implementation of the FLEX strategies is stored and maintained at the ANO FLEX storage building. There is sufficient time available to access and obtain the necessary equipment, parts, and tools to perform the FLEX actions. This is also assessed in the Execution PSFs window of the HRA calculator for each action.
V. Potential for pre-initiator human failures events Maintenance procedures for portable equipment were reviewed for possible pre-initiator human failures that could render the equipment unavailable. The assessment of the pre-initiator human failure as described in HLR-HR-D of ASME/ANS RA-Sa-2009 as endorsed by RG 1.200 is described in the following section.
Consistent with the latest EPRI Knowledge Base Article on treatment of FLEX pre-initiator actions (Reference 23), the FLEX procedures were reviewed for potential pre-initiator human actions for the FPIE PRA. Permanently installed equipment that are used as part of FLEX strategies (e.g., the turbine driven EFW pump) already have established pre-initiator events that are included in the system modeling and described within the respective system notebook. An exception is the engine-driven fire pump (P-6B), a permanently installed pump that was not previously credited; therefore, the associated test and maintenance procedure was reviewed for potential pre-initiator HFEs. Operators check the successful restoration of the pump to service. This includes acceptable operational tests and vibration readings to restore pump to online condition. Since an operational test is performed, pre-initiator HFEs can be screened.
2CAN042301 Page 44 of 50 There were no pre-initiator HFEs associated with FLEX portable equipment that were identified as a result of this review. Operator interviews confirmed that even when explicit verification is not noted in procedures, operators perform self-check and peer check of alignments at every available opportunity. These checks ensure that any pre-initiating errors (misalignments or mis-calibrations) are corrected prior to placing the FLEX equipment into service.
VI. Review of the conclusions provided in Memorandum dated May 6th, 2022 (ADAMS Accession No. ML22014A084) "Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments."
E9-7: Assessment of FLEX Uncertainties Status of the ANO-2 Conclusions from 2017 Memo                          Incorporation of the 2021 Updates SCOPE - CONCLUSION 1: NEI 16-06 has not provided accepted HRA methods for inclusion of offsite portable equipment to take quantitative risk credits in risk- informed No offsite portable applications that should meet the guidance of RG 1.200; equipment is credited in therefore, claiming quantitative credits for offsite equipment the ANO-2 PRA models.
is not appropriate until evaluations consistent with the guidance of RG 1.200 or improvements in the NEI guidance or state-of-art methods address the technical gaps.
A focus scope peer UPGRADE - CONCLUSION 2: For any new risk-informed review was performed on application that has incorporated mitigating strategies and the ANO-2 PRA models should meet the guidance of RG 1.200, the licensee should as a result of an upgrade either perform a focused- scope peer review of the PRA identified with the model or demonstrate that none of the following criteria is accident sequences to the satisfied: (1) use of new methodology, (2) change in scope SBO event trees. This that impacts the significant accident sequences or the review included the FLEX significant accident progression sequences, (3) change in modeling. All open capability that impacts the significant accident sequences Findings were addressed or the significant accident progression sequences.
(see Enclosure 2).
2CAN042301 Page 45 of 50 Status of the ANO-2 Conclusions from 2017 Memo                      Incorporation of the 2021 Updates UPGRADE - CONCLUSION 3: Licensees may incorporate mitigating strategies in PRA models after the issuance of amendments for applications that use PRA models to exercise self-approval for a plant change. For such applications, the licensee should, in addition to conforming with specific license condition(s) associated with those applications, either perform a focused-scope peer review See response to and resolve the focused-scope peer review findings before conclusion item #2.
using the new models to support any risk- informed decision-making or document an evaluation demonstrating that none of the upgrade criteria is satisfied. NRC will monitor those evaluations and their documentation, along with evaluations and documents related to other items identified in this assessment, through appropriate regulatory processes (e.g., inspections).
For the IE and IF models, PWROG-18042-NP is the source data for the FLEX portable equipment.
PWROG-14003 is not used.
For the FPRA, DATA - CONCLUSION 4: The use of expert judgment PWROG-18042-NP is not consistent with the ASME/ANS PRA Standard as endorsed the source data for the by RG 1.200 is acceptable for estimating parameter values FLEX portable equipment.
under certain conditions and the rationale for estimated PWROG-14003 is not values should be documented. In reviewing future risk-used. All FLEX informed applications, the staff may request additional equipment will use failure information to understand the rationale for parameter data from the values. Using the appropriate regulatory processes, the PWROG-18042-NP NRC will review the rationale for parameter values added to (Reference 19) in the PRA models after issuance of applications that use PRA 2023 update.
models to exercise self-approval for a plant change.
Sensitivity analysis have been performed by setting the failure rates to the PWROG-18042-NP and the 95th percentile in Section 8.2 of PSA-ANO-2-4B-SOU (Reference 7).
2CAN042301 Page 46 of 50 Status of the ANO-2 Conclusions from 2017 Memo                    Incorporation of the 2021 Updates DATA - CONLCUSION 5: The NRC staff does not agree with crediting spare portable equipment not modeled in the PRA in lieu of using appropriate failure rates because this approach is not consistent with the ASME/ANS PRA See response to item 4.
Standard and RG 1.200. Furthermore, the potential impact of underestimating failure rates could be larger than the unquantified risk benefits of spare equipment not modeled in PRAs.
DATA - CONLCUSION 6: The failure rates of permanently installed equipment cannot be used for portable equipment even if sensitivity analyses are performed. Licensees See response to item 4.
should use plant-specific of generic data collected and analyzed using acceptable approaches to estimate the failure rates for portable equipment.
DATA - CONCLUSION 7: NEI 1606 and risk-informed applications should address whether and how the analysis    See response to item 4.
described in SR DAD8 is performed.
DATA - CONCLUSION 8: The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA See response to item 4.
Standard, as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.
DATA - CONCLUSION 9: The NRC staff does not have access to and has not reviewed PWROG14003. At this See response to item 4.
time, the NRC staff treats approaches proposed by that PWROG document as unreviewed methods.
DATA - CONLCUSION 10: Without any additional data or        Only a single FLEX evaluations, the currently available common-cause failure  portable component is (CCF) parameter values should be used, which should        modeled, no credit for appropriately reflect the higher CCF failure rates of the  redundant equipment is portable equipment when applied to the higher independent  currently in the PRA failure rates.                                              model.
2CAN042301 Page 47 of 50 Status of the ANO-2 Conclusions from 2017 Memo                      Incorporation of the 2021 Updates
* Human error probabilities are calculated for mitigation strategies for the internal events PRA which does not include extreme external hazards.
* No additional surrogates are included in the FLEX modeling.
* There have not been changes to the FLEX strategies since the HRA - CONCLUSION 11: The staff finds that using performance of the surrogates for specific actions or engineering judgement to feasibility study that estimate the failure probability does not adequately address would impact the elements needed for a technically acceptable HRA as loading/unloading described in the ASME/ANS PRA Standard (e.g., the equipment.
impact of the environment under which the operators work).
Until gaps in the human reliability analysis methodologies
* Plant-specific are addressed by improved industry guidance, HEPs              procedures for associated with actions for which the existing approaches      refueling portable are not explicitly applicable, such as actions described in    equipment were used Sections 7.5.4 and 7.5.5 of NEI 1606, along with              in the development of assumptions and assessments, should be submitted to            the refueling HFE.
NRC for review.
* Operator actions to perform DC load shed applied execution recoveries to reflect self-checking. A sensitivity for this source of uncertainty (FLEX HFEs) is provided in Section 8.3 of PSA-ANO2-06-4B-SOU (Reference 7) and determined not to be a key source of uncertainty for the RICT application.
2CAN042301 Page 48 of 50 Status of the ANO-2 Conclusions from 2017 Memo                        Incorporation of the 2021 Updates HRA - CONCLUSION 12: If procedures for initiating mitigating strategies are not explicit and the associated The decision to declare failure probabilities are not directly analyzed by accepted ELAP is modeled as a approaches, technical bases for probability of failure to cognitive-only HFE.
initiate mitigating strategies should be submitted to NRC for review.
HRA - CONCLUSION 13: Until acceptable guidance is                The guidance in EPRI provided for identifying and assessing unique aspects of        Knowledge Base Article pre-initiator human failure events for mitigating strategies,    2021-001 (Reference 23) the staff may request additional information regarding          was used for identifying assessment of those human failure events.                        pre-initiator HFEs.
a)    FLEX Portable Equipment in the FPRA The FPRA model of record credits the FLEX portable diesel generator. The FPRA currently does not use the data failure rates in PWROG-18042-NP.
The FPRA is planned to be updated to the current FPIE model of record logic structure in 2023 using the information associated with FLEX described above.
b)    Evaluation of FLEX as a Source of Uncertainty for the RICT Program Two sensitivities have been performed regarding the sources of uncertainty associated with the FLEX modeling in the RICT program.
Sensitivity #1 adjusts the FLEX portable equipment failure rates to their 95th percentile probabilities using the data from PWROG-18042-NP (Reference 19). Sensitivity #2 adjusts the FLEX operator actions associated with operating and aligning portable equipment to the 95th percentile. See Sections 8.2 and 8.3 of PSA-ANO2-06-4B-SOU (Reference 7).
: 7. References
: 1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
: 2. NRC NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making," (ADAMS Accession No. ML17062A466), Revision 1, March 2017 2CAN042301 Page 49 of 50
: 3. Electric Power Research Institute (EPRI) TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Final Report, December 2008
: 4. PSA-ANO2-01-QU-01, "ANO-2 PSA Uncertainty and Sensitivity Analysis," Revision 1
: 5. PSA-ANO2-01-SOU, "ANO-2 PRA - Internal Events Sources of Uncertainty," Revision 3
: 6. PSA-ANO2-01-IF-SOU, "Arkansas Nuclear One Unit 2 Internal Flooding Sources of Uncertainty," Revision 3
: 7. PSA-ANO2-06-4B-SOU, "ANO-2 PRA - Assessment of Key Assumptions and Sources of Uncertainty for TSTF-505 (RICT) Submittal," Revision 0
: 8. NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities,"
Volumes 1 and 2, (ADAMS Assession Nos. ML15167A401 and ML15167A411),
September 2005
: 9. NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants," (ADAMS Accession No. ML070650650),
February 2007
: 10. ASME/ANS RA-Sa-2009, Addenda to RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plants"
: 11. WCAP-16175-P-A, "Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants," Revision 0, March 2007
: 12. WCAP-16883-P, "Common Cause Failure Parameter Estimates for Babcock & Wilcox Plants," Revision 0, March 2008
: 13. Nuclear Science Advisory Committee (NSAC) 154, "ISLOCA Evaluation Guidelines," Final Report, September 1991
: 14. PSA-ANO2-03-FQ-01, "ANO-2 Fire PRA Uncertainty/Sensitivity Analysis," Revision 1
: 15. Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012
: 16. Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 2: "Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure," Final Report, NUREG/CR-7150, Vol. 1, EPRI 3002001989, U.S.
NRC and Electric Power Research Institute, May 2014
: 17. U.S. NRC and Electric Power Research Institute, NUREG-2169/EPRI 3002002936, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, United States Fire Event Experience Through 2009," (ADAMS Assession No. ML15016A069), January 2015 2CAN042301 Page 50 of 50
: 18. NUREG-2180, "Determining the Effectiveness, Limitations, and Operator Response for Very Early Warning Fire Detection Systems in Nuclear Facilities (DELORES-VEWFIRE),"
(ADAMS Assession No. ML16343A058), December 2016
: 19. PWROG-18042-NP, Revision 1, "Flex Equipment Data Collection and Analysis"
: 20. EPRI, "The EPRI HRA Calculator Software Users Manual," Version 5.1, EPRI, Palo Alto, CA, and Scientech, a Curtiss-Wright Flow Control company, Tukwila, WA: 2013. Software Product ID #: 300200314
: 21. ANO 2015-0078, "Entergy ANO Nuclear Plant, ANO FLEX Validation," Revision 0
: 22.  "FLEX Final Integrated Plan, ANO Units 1 and 2," Revision 1
: 23. EPRI, HRA Users Group Knowledge Base Article 2021-001, "Guidance for Pre-Initiator HRA for FLEX and Portable Equipment," Revision 1
: 24. NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants,"
(ADAMS Assession No. ML070650650), December 2005
: 25. PWR Owners Group Project PA-RMSC-0463, "White Paper on Consideration of Reactor Vessel Failure in Plant-Specific PRA Models for PWRs," January 2009
: 26. NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants," (ADAMS Accession No. ML070650650),
February 2007
: 27. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, (ADAMS Accession No. ML090410014), March 2009
: 28. Generic Safety Issue (GSI) 191, "The Impact of Debris Induced Loss of ECCS Recirculation on PWR Core Damage Frequency (NUREG/CR-6771)," (ADAMS Assession No. ML022410135), August 2002
 
Enclosure 10 2CAN042301 Program Implementation 0
2CAN042301 Page 1 of 3 Program Implementation
: 1. Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (Reference 2), requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk Managed Technical Specifications (RMTS) implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT).
This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including training of plant personnel, and specifically discusses the decision process for RMA implementation during extended Completion Times (CT).
: 2. RICT Program and Procedures Entergy Operations, Inc. (Entergy) will develop a program description and implementing procedures for the RICT Program. The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT Program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT Program. The program description and implementing procedures will incorporate the programmatic requirements for RMTS included in NEI 06-09-A. The program will be integrated with the online work control process. The work control process currently identifies the need to enter a Limiting Condition for Operation (LCO)
Action statement as part of the planning process and will additionally identify whether the provisions of the RICT Program are required for the planned work. The risk thresholds associated with 10 CFR 50.65(a)(4) will be coordinated with the RICT limits. The maintenance rule performance monitoring provisions and Mitigating System Performance Index (MSPI) thresholds will assist in controlling the amount of risk expended in use of the RICT Program. It should be noted that Entergy's Waterford 3 Steam Electric Station (WF3) recently implemented Risk Informed Completion Times; therefore, to the extent possible, the operating experience (OE) learned by WF3 during their development and implementation of RICT, fleet procedures, and other RICT-related processes and programs will be used by ANO-2 to streamline development and implementation of the RICT Program.
The Operations Department (senior licensed operators) is responsible for compliance with the LCO and will be responsible for implementation of RICTs and RMAs. Entry into the RICT Program will require management approval prior to pre-planned activities and within the time limits of the Required Action CT (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less for emergent conditions.
The procedures for the RICT Program will address the following attributes consistent with NEI 06-09-A:
* Plant management positions with authority to approve entry into the RICT Program.
0 2CAN042301 Page 2 of 3
* Important definitions related to the RICT Program.
* Departmental and position responsibilities for activities in the RICT Program.
* Plant conditions for which the RICT Program is applicable.
* Limitations on implementing RICTs under voluntary and emergent conditions.
* Implementation of the RICT Program 30-day back stop limit.
* Use of the Configuration Risk Management Program (CRMP) tool.
* Guidance on recalculating RICT and risk management action time (RMAT) within 12 hours or within the most limiting front-stop CT after a plant configuration change.
* Requirements to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded.
* Guidance on the use of RMAs including the conditions under which the RMAs may be credited in RICT calculations.
* Guidance on crediting probabilistic risk assessment (PRA) functionality.
* Conditions for exiting a RICT.
* Requirements for training on the RICT Program.
* Documentation requirements related to individual RICT evaluations, implementation of extended CTs, and accumulated annual risk.
: 3. RICT Program Training Training will be carried out in accordance with Entergy training procedures and processes that utilize the Systematic Approach to Training. These procedures were written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training.
Participation Departments that will receive training appropriate to their level of program responsibilities include:
* Operations
* Operations Training
* Work Management
* Outage Management
* Planning and Scheduling Personnel
* Work Week Managers
* Regulatory Assurance
* Maintenance
* Engineering
* Risk Management
* Other Selected Management Scope of Training 0
2CAN042301 Page 3 of 3 For those individuals directly involved in the implementation of the RICT Program the training topics will be developed with consideration of:
* Specific training on the revised Technical Specifications
* Record keeping requirements
* Case studies
* Hands-on experience with the CRMP tool for calculating RMAT and RICT
* Identifying appropriate RMAs
* Determining PRA functionality
* Common cause failure considerations
* Other detailed aspects of the RICT Program For management positions with authority to approve entry into the RICT Program, as well as supervisors, managers, and other personnel closely supporting RICT implementation, the training will provide a broad understanding of the purpose, concepts, and limitations of the RICT Program.
: 4. References
: 1. Letter from Jennifer M. Golder (NRC) to Buff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"
(ADAMS Accession No. ML071200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
 
Enclosure 11 2CAN042301 Monitoring Program 1
2CAN042301 Page 1 of 2 Monitoring Program
: 1. Introduction Section 4.0, Item 12, of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09, Revision 0-A (Reference 2), requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (Reference 3) and NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (note that RG 1.174, Revision 2 (Reference 4), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation (SE) for Section 4.0, Item 12.)
This enclosure provides a description of the process applied to monitor the cumulative risk impact of implementation of the Risk-Informed Completion Time (RICT) Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.
: 2. Description of Monitoring Program The RICT Program will require calculation of cumulative risk impact at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09-A. For the assessment period under evaluation, data will be collected for the risk increase associated with each application of an extended CT for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk will be calculated by summing all risk associated with each RICT application. This summation is the change in CDF or LERF above the zero maintenance baseline levels during the period of operation in the extended CT (i.e., beyond the front-stop CT). The change in risk will be converted to average annual values.
The total average annual change in risk for extended CTs will be compared to the guidance of RG 1.174, Revision 2, Figures 4 and 5, acceptance guidelines for CDF and LERF, respectively.
If the actual annual risk increase is acceptable (i.e., not in Region I of Figures 4 and 5 of RG 1.174, Revision 2), then the RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the acceptance guidelines of RG 1.174 and implementation of any necessary corrective actions to ensure future plant operation is within the guidelines will be conducted under the Corrective Action Program.
The evaluation of cumulative risk will also identify areas for consideration, such as:
* RICT applications that dominated the risk increase
* Risk contributions from planned vs. emergent RICT applications
* Risk Management Actions (RMAs) implemented but not credited in the risk calculations
* Risk impact from applying RICT to avoid multiple shorter duration outages
* Any specific RICT application that incurred a large proportion of the risk 1
2CAN042301 Page 2 of 2 Based on a review of the considerations above, corrective actions will be developed and implemented as appropriate. These actions may include:
* Administrative restrictions on the use of RICTs for specific high-risk configurations
* Additional RMAs for specific configurations
* Rescheduling planned maintenance activities
* Deferring planned maintenance to shutdown conditions
* Use of temporary equipment to replace out-of-service systems, structures, or components (SSCs)
* Plant modifications to reduce risk impact of future planned maintenance configurations In addition to impacting cumulative risk, implementation of the RICT Program may potentially impact the unavailability of SSCs. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts which may be incurred from implementation of the RICT Program. The SSCs in the scope of the RICT Program are also in the scope of the MR, which allows the use of the MR Program. RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications" (Reference 5), Section 3.2, Maintenance Rule Control, discusses that the scope of evaluations required under the Maintenance Rule should include prior related Technical Specification changes, such as extension of CTs.
The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as described in Element 3 of RG 1.174 and NEI 06-09-A.
: 3. References
: 1. Letter from Jennifer M. Golder (NRC) to Buff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"
(ADAMS Accession No. ML07I1200238), dated May 17, 2007
: 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
: 3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, (ADAMS Accession No. ML023240437), November 2002
: 4. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, (ADAMS Accession No. ML10091006), May 2011
: 5. Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making:
Technical Specifications," Revision 1, (ADAMS Accession No. ML100910008), May 2011
 
Enclosure 12 2CAN042301 Risk Management Action Examples 2
2CAN042301 Page 1 of 6 Risk Management Action Examples
: 1. Introduction This enclosure describes the process for identification and implementation of Risk Management Actions (RMAs) applicable during extended Completion Times (CTs) and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program consistent with the guidance provided in NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (Reference 1).
: 2. Responsibilities For planned entries into the RICT Program, Work Management is responsible for developing the RMAs with assistance from Operations and Probabilistic Risk Assessment (PRA). Operations is responsible for approval and implementation of RMAs. For emergent entry into extended CTs, Operations is also responsible for developing the RMAs.
: 3. Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the Risk Management Action Time (RMAT) will be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs requiring recalculation of a RMAT already in place, the procedure will require a reevaluation of the existing RMAs for the new plant configuration to determine if new RMAs are appropriate.
These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A.
For emergent entry into a RICT, if the extent of condition is not known, RMAs related to the success of redundant and diverse structures, systems, or components (SSCs) and reducing the likelihood of initiating events relying on the affected function will be developed to address the increased likelihood of a common cause event.
RMAs will be implemented in accordance with program procedures no later than the time at which an Incremental Core Damage Probability (ICDP) of 1E-6 is reached, or no later than the time when an Incremental Large Early Release Probability (ILERP) of 1E-7 is reached. If, as the result of an emergent condition, the Instantaneous Core Damage Frequency (ICDF) or the Instantaneous Large Early Release Frequency (ILERF) exceeds 1E-3 per year or 1E-4 per year, respectively, RMAs are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A.
By determining which SSCs are most important from a core damage frequency (CDF) or large early release frequency (LERF) perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. The guidance in NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making,"
(Reference 2) and Electric Power Research Institute (EPRI) TR-1026511, "Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the 2
2CAN042301 Page 2 of 6 Treatment of Uncertainty," (Reference 3) will be used in examining probabilistic risk assessment (PRA) results for significant contributors for the configuration, to aid in identifying appropriate compensatory measures (e.g., related to risk-significant systems that may provide diverse protection, or important support systems or human actions).
If the planned activity or emergent condition includes an SSC that is identified to impact the Fire PRA, as identified in the current Configuration Risk Management Program (CRMP), Fire PRA specific RMAs associated with that SSC will be implemented per the current plant procedure.
It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and Operator actions are modeled in the PRA; however, such quantification of RMAs is neither required nor expected by NEI 06-09-A. Nonetheless, if RMAs will be credited to determine RICTs, the procedure instructions will be consistent with the guidance in NEI 06-09-A.
NEI 06-09-A classifies RMAs into the three categories described below:
: 1)  Actions to increase risk awareness and control.
Shift brief Pre-job brief Training Presence of system engineer or other expertise related to the activity Special purpose procedure to identify risk sources and contingency plans
: 2)  Actions to reduce the duration of maintenance activities.
Pre-staging materials Conducting training on mock-ups Performing the activity around the clock Performing walk-downs on the actual system(s) to be worked on prior to beginning work
: 3)  Actions to minimize the magnitude of the risk increase.
Suspend or minimize activities on redundant systems Suspend or minimize activities on other systems that adversely affect the CDF or LERF Suspend or minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate Use temporary equipment to provide backup power, ventilation, etc.
Reschedule other risk-significant activities Determination of RMAs involves the use of both qualitative and quantitative considerations for the specific plant configuration and the practical means available to manage risk. The scope and number of RMAs are developed and implemented using a graded approach.
2 2CAN042301 Page 3 of 6 Procedural guidance for development of RMAs in support of the RICT program builds off the RMAs developed for other processes, such as the RMAs developed under the 10 CFR 50.65(a)(4) program and the protected equipment program. Additionally, common cause RMAs are developed to address the potential impact of common cause failures.
General RMAs will be developed and documented in plant procedures as candidates for initial selection for a RICT. These general candidate RMAs will be developed for the in-scope Technical Specification (TS) Required Actions, and will utilize risk insights, such as the identification of risk-significant SSCs, functions, operator responses, and/or initiating events.
General RMAs are developed to serve as the preliminary scope of candidate RMAs, which are then supplemented with configuration-specific candidate RMAs. General RMAs may leverage existing plant programs and processes. These RMAs may include:
Consideration of rescheduling maintenance to reduce risk Discussion of RICT in pre-job briefs Consideration of proactive return-to-service of other equipment Efficient execution of maintenance In addition to the general RMAs, configuration-specific RMAs are developed based on the CRMP tool to identify configuration-specific RMA candidates. These actions may include:
Identification of important equipment or trains for protection Identification of important Operator Actions for briefings Identification of key fire initiators and fire zones for RMAs in accordance with the station Fire RMA process Identification of dominant initiating events and actions to minimize potential for initiators Consideration of insights from PRA model cutsets, through comparison of importances Common cause RMAs are also developed to ensure availability of redundant SSCs, to ensure availability of diverse or alternate systems, to reduce the likelihood of initiating events that require operation of the out-of-service components, and to prepare plant personnel to respond to additional failures. Common cause RMAs are developed by considering the impact of loss of function for the affected SSCs.
Examples of common cause RMAs include:
Performance of non-intrusive inspections on alternate trains Confidence runs performed for standby SSCs Increased monitoring for running components Expansion of monitoring for running components Deferring maintenance and testing activities that could generate an initiating event which would require operation of potentially affected SSCs Readiness of operators and maintenance to respond to additional failures Shift briefs or standing orders which focus on initiating event response or loss of potentially affected SSCs 2
2CAN042301 Page 4 of 6 Per Entergy Operations, Inc. (Entergy) standards, for emergent conditions where the extent of condition is not performed prior to entering into the Risk Management Action Times (RMAT) or the extent of condition evaluation cannot rule out the potential for common cause failure, common cause RMAs are expected to be implemented to mitigate common cause failure potential and impact. These can include the pre-identified RMAs developed as discussed above, as well as alternative common cause RMAs for the specific configuration. RMAs, including both regular and common cause considerations, are developed for the specific configuration following the steps outlined above.
: 4. Examples Example RMAs that may be considered during a RICT Program entry for an Diesel Generator (DG), a Low Pressure Safety Injection (LPSI) Pump, and an Emergency Feedwater (EFW) Train (turbine-driven) to reduce the risk impact and ensure adequate defense-in-depth are:
4.1    Emergency Diesel Generator For TS 3.8.1.1, "A.C. Sources," Action b, one DG inoperable, additional RMAs would include:
: 1)  Brief the on-shift Operations crew concerning the unit activities, including any compensatory measures established, and review the appropriate emergency operating procedures for a Loss of Offsite Power.
: 2)  Contact the Transmission System Operator (TSO) to determine the reliability of offsite power supplies prior to entering a RICT and implement RMAs during times of high grid stress conditions, such as during high demand conditions.
: 3)  Verify remaining DG and Alternate AC Diesel Generator (AACDG) are available and aligned for standby service.
: 4)  Evaluate weather conditions for threats to the reliability of offsite power supplies.
: 5)  Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.
: 6)  Defer planned maintenance or testing that affects the reliability of the operable DG and associated support equipment. Defer planned maintenance activities on station blackout mitigating systems (such as the AACDG). Treat these as protected equipment.
: 7)  Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
: 8)  Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DG.
2 2CAN042301 Page 5 of 6 4.2  Low Pressure Injection Pump For TS 3.5.2, "Emergency Core Cooling Systems (ECCS) Subsystems - Tavg  300," Action a, one ECCS subsystem inoperable due to an inoperable LPSI train, additional RMAs would include:
: 1)  Verify remaining LPSI subsystem is available and aligned for standby service.
: 2)  Defer planned maintenance or testing that affects the reliability of the safety systems that provide a defense-in-depth. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
: 3)  Defer planned maintenance or testing on redundant ECCS LPSI subsystem and associated support equipment. Treat these SSCs as protected equipment.
: 4)  Minimize activities that could trip the unit.
: 5)  Evaluate weather conditions for threats to the reliability of offsite power supplies.
: 6)  Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected LPSI subsystem.
4.3  Emergency Feedwater Train (Turbine Driven)
For TS 3.7.1.2, "Emergency Feedwater (EFW) System," Action a, turbine-driven EFW train inoperable due to one inoperable steam supply, additional RMAs include:
: 1)  Verify remaining EFW train, including operability of motor-driven EFW and Common Feedwater (CFW) pumps, or Auxiliary Feedwater (AFW) train are available and aligned for standby service.
: 2)  Defer planned maintenance or testing that affects the reliability of the safety systems that provide a defense-in-depth. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.
: 3)  Defer planned maintenance or testing on motor driven EFW/CFW and AFW trains and associated support equipment. Treat these SSCs as protected equipment.
: 4)  Minimize activities that could trip the unit.
: 5)  Evaluate weather conditions for threats to the reliability of offsite power supplies.
: 6)  Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected turbine driven EFW train.
2 2CAN042301 Page 6 of 6
: 5. References
: 1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, (ADAMS Accession No. ML12286A322), November 2006
: 2. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," (ADAMS Accession No. ML090970525), March 2009
: 3. Electric Power Research Institute, EPRI TR-1026511, "Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," Technical Update, December 2012}}

Latest revision as of 21:22, 14 November 2024

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4
ML23095A281
Person / Time
Site: Arkansas Nuclear Entergy icon.png
Issue date: 04/05/2023
From: Couture P
Entergy Operations
To:
Office of Nuclear Reactor Regulation, Document Control Desk
References
2CAN042301
Download: ML23095A281 (1)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=2CAN042301,_License_Amendment_Request_to_Revise_Technical_Specifications_to_Adopt_Risk-Informed_Completion_Times_TSTF-505,_Revision_2,_Provide_Risk-Informed_Extended_Completion_Times_-_RITSTF_Initiative_4&oldid=3707205"