Text

Issuance of Amendments 225 and 222 Implementation of NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specification (Rmts) Guidelines, Revision 0-A
	ML19175A243
Person / Time
Site:	Farley
Issue date:	08/23/2019
From:	Shawn Williams; Plant Licensing Branch II
To:	Hutto J; Southern Nuclear Operating Co
	Williams S
References
	EPID L-2018-LLA-0210
	Download: ML19175A243 (156)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 August 23, 2019 Ms. Cheryl A. Gayheart Regulatory Affairs Director Southern Nuclear Operating Company 3535 Colonnade Parkway Birmingham, AL 35243

SUBJECT:

JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2 - ISSUANCE OF AMENDMENT NOS. 225 AND 222 REGARDING IMPLEMENTATION OF NEI 06-09, "RISK-INFORMED TECHNICAL SPECIFICATIONS INITIATIVE 48, RISK-MANAGED TECHNICAL SPECIFICATIONS (RMTS) GUIDELINES,"

REVISION 0-A (EPID L-2018-LLA-0210)

Dear Ms. Gayheart:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment No. 225 to Renewed Facility Operating License No. NPF-2 and Amendment No.

222 to Renewed Facility Operating License No. NPF-8 for the Joseph M. Farley Nuclear Plant, Units 1 and 2, respectively. The amendments are in response to your application dated July 27, 2018, as supplemented by letters dated May 3, 2019, May 17, 2019, and June 27, 2019.

The amendments modify the Technical Specifications (TSs) to permit the use of Risk-Informed Completion Times (RICTs) in accordance with Topical Report Nuclear Energy Institute (NEI) 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A. The amendments also add a new program, the "Risk-Informed Completion Time Program," to TS Section 5.5, "Programs and Manuals."

C. Gayheart A copy of the related Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely, Shawn A. Williams, Senior Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-348 and 50-364

Enclosures:

1. Amendment No. 225 to NPF-2

2. Amendment No. 222 to NPF-8

3. Safety Evaluation cc: Listserv

UNITED ~TATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SOUTHERN NUCLEAR OPERATING COMPANY ALABAMA POWER COMPANY DOCKET NO. 50-348 JOSEPH M. FARLEY NUCLEAR PLANT, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 225 Renewed License No. NPF-2

1. The U.S. Nuclear Regulatory Commission {the Commission) has found that:

A The application for amendment to the Joseph M. Farley Nuclear Plant, Unit 1 (the facility), Renewed Facility Operating License No. NPF-2 (the license) filed by Southern Nuclear Operating Company (the licensee), dated July 27, 2018, as supplemented by letters dated May 3, 2019, May 17, 2019, and June 27, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes to the Technical Specifications and Appendix C, as indicated in the attachment to this license amendment. Paragraphs 2.C.(2) and 2.C.(3)h. of the license are hereby amended to read as follows:

2.C.(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 225, are hereby incorporated in the renewed license.

Southern Nuclear shall operate the facility in accordance with the Technical Specifications 2.C.(3) Additional Conditions

h. The Additional Conditions contained in Appendix C, as revised through Amendment No. 225, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the additional conditions.

3. This amendment is effective as of its date of issuance and shall be implemented within 180 days from the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION

~<h~

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to Renewed Facility Operating License, Technical Specifications, and Appendix C Date of Issuance: August 23, 201 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SOUTHERN NUCLEAR OPERATING COMPANY ALABAMA POWER COMPANY DOCKET NO. 50-364 JOSEPH M. FARLEY NUCLEAR PLANT, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 222 Renewed License No. NPF-8

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Joseph M. Farley Nuclear Plant, Unit 2 (the facility), Renewed Facility Operating License No. NPF-8 (the license) filed by Southern Nuclear Operating Company (the licensee), dated July 27, 2018, as supplemented by letters dated May 3, 2019, May 17, 2019, and June 27, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, the license is amended by changes to the Technical Specifications and Appendix C, as indicated in the attachment to this license amendment. Paragraphs 2.C.(2) and 2.C.(22)h. of the license are hereby amended to read as follows:

2.C.(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 222, are hereby incorporated in the renewed license. Southern Nuclear shall operate the facility in accordance with the Technical Specifications.

2.C.(22) Additional Conditions

h. The Additional Conditions contained in Appendix C, as revised through Amendment No. 222, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the additional conditions.

3. This amendment is effective as of its date of issuance and shall be implemented within 180 days of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION

~--z:~~

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to Renewed Facility Operating License, Technical Specifications, and Appendix C Date of Issuance: August 23, 201 9

ATIACHMENT TO JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2 LICENSE AMENDMENT NO. 225 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-2 DOCKET NO. 50-348 AND LICENSE AMENDMENT NO. 222 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-8 DOCKET NO. 50-364 Replace the following pages of the Renewed Facility Operating Licenses and Appendix "A" Technical Specifications (TSs) with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Remove License License NPF-2, page 4 NPF-2, page 4 NPF-2, page 5 NPF-2, page 5 NPF-2, Appendix C, page 3 NPF-8, page 3 NPF-8, page 3 NPF-8, page 7 NPF-8, page 7 NPF-8, Appendix C, page 3 TSs TSs 1.3-13 1.3-13 1.3-14 1.3-15 1.3-16 3.4.10-1 3.4.10-1 3.4.10-2 3.4.10-2 3.4.11-1 3.4.11-1 3.4.11-2 3.4.11-2 3.4.11-3 3.4.11-3 3.5.1-1 3.5.1-1 3.5.1-2 3.5.1-2 3.5.1-3 3.5.1-3 3.5.2-1 3.5.2-1 3.5.4-1 3.5.4-1 3.6.2-4 3.6.2-4 3.6.3-2 3.6.3-2 3.6.3-3 3.6.3-3 3.6.3-4 3.6.3-4 3.6.3-5 3.6.3-5 3.6.3-6 3.6.3-6 3.6.3-7

Remove Insert 3.6.6-1 3.6.6-1 3.6.6-2 3.6.6-2 3.6.6-3 3.6.6-3 3.6.6-4 3.7.2-1 3.7.2-1 3.7.2-2 3.7.2-2 3.7.4-1 3.7.4-1 3.7.5-1 3.7.5-1 3.7.7-1 3.7.7-1 3.7.7-2 3.7.7-2 3.7.8-1 3.7.8-1 3.7.8-2 3.7.8-2 3.7.8-3 3.7.19-1 3.7.19-1 3.7.19-2 3.7.19-2 3.8.1-2 3.8.1-2 3.8.1-3 3.8.1-3 3.8.1-4 3.8.1-4 3.8.1-5 3.8.1-5 3.8.1-6 3.8.1-6 3.8.1-7 3.8.1-7 3.8.1-8 3.8.1-8 3.8.1-9 3.8.1-9 3.8.1-10 3.8.1-10 3.8.1-11 3.8.1-11 3.8.1-12 3.8.1-12 3.8.1-13 3.8.1-13 3.8.1-14 3.8.1-14 3.8.1-15 3.8.4-1 3.8.4-1 3.8.4-2 3.8.4-2 3.8.4-3 3.8.4-3 3.8.4-4 3.8.4-4 3.8.4-5 3.8.4-6 3.8.7-1 3.8.7-1 3.8.7-2 3.8.7-2 3.8.9-2 3.8.9-2 3.8.9-3 3.8.9-3 3.8.9-4 5.5-16 5.5-16 5.5-17 5.5-18

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 225, are hereby incorporated in the renewed license. Southern Nuclear shall operate the facility in accordance with the Technical Specifications.

(3) Additional Conditions The matters specified in the following conditions shall be completed to the satisfaction of the Commission within the stated time periods following the issuance of the renewed license or within the operational restrictions indicated. The removal of these conditions shall be made by an

amendment to the renewed license supported by a favorable evaluation by the Commission.

a. Southern Nuclear shall not operate the reactor in Operational Modes 1 and 2 with less than three reactor coolant pumps in operation.

b. Deleted per Amendment 13

c. Deleted per Amendment 2

d. Deleted per Amendment 2

e. Deleted per Amendment 152 Deleted per Amendment 2

f. Deleted per Amendment 158

g. Southern Nuclear shall maintain a secondary water chemistry monitoring program to inhibit steam generator tube degradation.

This program shall include:

1) Identification of a sampling schedule for the critical parameters and control points for these parameters;

2) Identification of the procedures used to quantify parameters that are critical to control points;

3) Identification of process sampling points;

4) A procedure for the recording and management of data;

5) Procedures defining corrective actions for off control point chemistry conditions; and Farley - Unit 1 Renewed License No. NPF-2 Amendment No. 225

6) A procedure identifying the authority responsible for the interpretation of the data and the sequence and timing of administrative events required to initiate corrective action.

h. The Additional Conditions contained in Appendix C, as revised through Amendment No. 225, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the additional conditions.

i. Deleted per Amendment 152 (4) Fire Protection Southern Nuclear Operating Company shall implement and maintain in effect all provisions of the approved fire protection program that comply with 10 CFR 50.48(a) and 10 CFR 50.48(c), as specified in the licensee amendment requests dated September 25, 2012; April 25, 2016; December 14, 2018; and supplements dated December 20, 2012; September 16, 2013; October 30, 2013; November 12, 2013; April 23, 2014; May 23, 2014; July 3, 2014; August 11, 2014; August 29, 2014; October 13, 2014; January 16, 2015, and August 11, 2017, as approved in the safety evaluation reports dated March 10, 2015, October 17, 2016, November 1, 2017, and July 30, 2019. Except where NRC approval for changes or deviations is required by 10 CFR 50.48(c), and provided no other regulation, technical specification, license condition or requirement would require prior NRC approval, the licensee may make changes to the fire protection program without prior approval of the Commission if those changes satisfy the provisions set forth in 10 CFR 50.48(a) and 10 CFR 50.48(c), the change does not require a change to a technical specification or a license condition, and the criteria listed below are satisfied.

a. Risk-Informed Changes that May Be Made Without Prior NRC Approval A risk assessment of the change must demonstrate that the acceptance criteria below are met. The risk assessment approach, methods, and data shall be acceptable to the NRC and shall be appropriate for the nature and scope of the change being evaluated; be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at Farley. Acceptable methods to assess the risk of the change may include methods that have been used in the peer-reviewed fire PRA model, methods that have been approved by NRC through a plant-specific license amendment or NRC approval of generic methods specifically for use in NFPA 805 risk assessments, or methods that have been demonstrated to bound the risk impact.

Farley - Unit 1 Renewed License No. NPF-2 Amendment No. 225

APPENDIX C ADDITIONAL CONDITIONS RENEWED FACILITY OPERATING LICENSE NO. NPF-2 Amendment Condition Completion Number Additional Condition Date 225 Southern Nuclear Operating Company (SNC) is approved to Concurrent with implement the Risk Informed Completion Time (RICT) the implementation Program as specified in the license amendment request of the Risk Informed submittal dated July 27, 2018, as supplemented on the Completion Time following dates: May 3, 2019, May 17, 2019, and Program June 27, 2019.

Updates from the Findings and Observation resolutions of the Internal Events Internal Flooding Probabilistic Risk Assessment (PRA) model shall be incorporated into the Fire PRA per the internal SNC PRA configuration process, prior to implementation of the RICT program.

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC for generic use. If the licensee wishes to change its methods, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Farley - Unit 1 Renewed License No. NPF-2 Amendment No. 225

(2) Alabama Power Company, pursuant to Section 103 of the Act and 10 CFR Part 50, "Licensing of Production and Utilization Facilities," to possess but not operate the facility at the designated location in Houston County, Alabama in accordance with the procedures and limitations set forth in this renewed license.

(3) Southern Nuclear, pursuant to the Act and 10 CFR Part 70, to receive, possess and use at any time special nuclear material as reactor fuel, in accordance with the limitations for storage and amounts required for reactor operation, as described in the Final Safety Analysis Report, as supplemented and amended; (4) Southern Nuclear, pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess, and use at any time any byproduct, source and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; (5) Southern Nuclear, pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess, and use in amounts as required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (6) Southern Nuclear, pursuant to the Act and 10 CFR Parts 30, 40 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This renewed license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level Southern Nuclear is authorized to operate the facility at reactor core power levels not in excess of 2775 megawatts thermal.

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 222, are hereby incorporated in the renewed license.

Southern Nuclear shall operate the facility in accordance with the Technical Specifications.

(3) Deleted per Amendment 144 (4) Deleted per Amendment 149 (5) Deleted per Amendment 144 Farley - Unit 2 Renewed License No. NPF-8 Amendment No. 222

(b) The first performance of the periodic assessment of CRE habitability, Specification 5.5.18.c.(ii), shall be within 3 years, plus the 9-month allowance of SR 3.0.2, as measured from February 8, 2016, the date of the most recent successful tracer gas test, as stated in the August 25, 2004 letter response to Generic Letter 2003-01, or within the next 9 months if the time period since the most recent successful tracer gas test is greater than 3 years.

(c) The first performance of the periodic measurement of CRE pressure, Specification 5.5.18.d, shall be within 24 months, plus the 180 days allowed by SR 3.0.2, as measured from July 11, 2015, the date of the most recent successful pressure measurement test, or within 180 days if not performed previously.

(8) Deleted per Amendment 144 (9) Deleted per Amendment 144 (10) Deleted per Amendment 144

( 11 ) Deleted per Amendment 144 (12) Deleted per Amendment 144 (13) Deleted per Amendment 144

( 14) Deleted per Amendment 144 (15) Deleted per Amendment 144 (16) Deleted per Amendment 144

( 17) Deleted per Amendment 144 (18) Deleted per Amendment 144 (19) Deleted per Amendment 144 (20) Deleted per Amendment 144 (21) Deleted per Amendment 144 (22) Additional Conditions The Additional conditions contained in Appendix C, as revised through Amendment No. 222, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the additional conditions.

(23) Updated Final Safety Analysis Report The Updated Final Safety Analysis Report supplement shall be included in the next scheduled update to the Updated Final Safety Analysis Report required by 10 CFR 50.71(e)(4) following issuance of this renewed license.

Until that update is complete, Southern Nuclear may make changes to the programs and activities described in the supplement without prior Commission approval, provided that Southern Nuclear evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and

otherwise complies with the requirements of that section.

Farley - Unit 2 Renewed License No. NPF-8 Amendment No. 222

APPENDIX C ADDITIONAL CONDITIONS RENEWED FACILITY OPERATING LICENSE NO. NPF-8 Amendment Condition Completion Number Additional Condition Date 222 Southern Nuclear Operating Company (SNC) is approved to Concurrent with implement the Risk Informed Completion Time (RICT) the implementation Program as specified in the license amendment request of the Risk Informed submittal dated July 27, 2018, as supplemented on the Completion Time following dates: May 3, 2019, May 17, 2019, and Program June 27, 2019.

Updates from the Findings and Observation resolutions of the Internal Events Internal Flooding Probabilistic Risk Assessment (PRA) model shall be incorporated into the Fire PRA per the internal SNC PRA configuration process, prior to implementation of the RICT program.

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC for generic use. If the licensee wishes to change its methods, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Farley - Unit 2 Renewed License No. NPF-8 Amendment No. 222

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

(continued)

Farley Units 1 and 2 1.3-13 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore 7 days inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program B. ----------NOTE--------- B.1 Restore one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not subsystem to permitted for this OPERABLE loss of function status. OR Condition when the second subsystem is intentionally made In accordance with the inoperable. Risk Informed

Completion Time Two subsystems Program inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not AND met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (continued)

Farley Units 1 and 2 1.3-14 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B must also be entered.

The Condition is modified by a Note. The Note states that RICT entry is not permitted for this loss of function Condition when the second subsystem is intentionally made inoperable. RICT program entry is only allowed if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition Bis entered and RICT entry is not permitted, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . If one subsystem is not restored within one hour, Condition C must also be entered.

The Licensee may be able to apply a RICT to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and RICT entry is permitted, at least one subsystem must be restored within the calculated RICT. If one subsystem cannot be restored within the calculated RICT, Condition C must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant conditions result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.

(continued)

Farley Units 1 and 2 1.3-15 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and Care exited, and therefore, the Required Actions of Condition C may be terminated.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION Required Action should be pursued without delay and in a controlled TIME manner.

Farley Units 1 and 2 1.3-16 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Pressurizer Safety Valves 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.1 O Pressurizer Safety Valves LCO 3.4.1 O Three pressurizer safety valves shall be OPERABLE with lift settings

~ 2460 psig and::;; 2510 psig.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 with all RCS cold leg temperatures> the Low Temperature Overpressure Protection (LTOP) System applicability temperature specified in the PTLR.

NO TE---------------------------------------------

The lift settings are not required to be within the LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This exception is allowed for 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. -------------NOTE----------- A.1 Restore valve to 15 minutes RICT entry is not permitted OPERABLE status.

OR for this loss of function Condition when a In accordance with pressurizer safety valve is the Risk Informed intentionally made Completion Time inoperable. Program One pressurizer safety valve inoperable.

Farley Units 1 and 2 3.4.10-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Pressurizer Safety Valves 3.4.10 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

OR 8.2 Be in MODE 4 with any 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months RCS cold leg Two or more pressurizer temperatures :s: the safety valves inoperable. LTOP System applicability temperature specified in the PTLR.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is OPERABLE in In accordance with accordance with the INSERVICE TESTING the INSERVICE PROGRAM. Following testing, lift settings shall be TESTING within+/- 1%. PROGRAM Farley Units 1 and 2 3.4.10-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Pressurizer PORVs 3.4.11 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

LCO 3.4.11 Each PORV and associated block valve shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE-------------------------------------------------------

Separate Condition entry is allowed for each PORV and each block valve.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more PORVs A.1 Close and maintain 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable and capable of power to associated being manually cycled. block valve.

B. One PORV inoperable and B.1 Close associated block 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months not capable of being valve.

manually cycled.

AND B.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated block valve.

AND B.3 Restore PORV to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.4.11-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Pressurizer PORVs 3.4.11 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. One block valve inoperable. C.1 Place associated PORV 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in manual control.

AND C.2 Restore block valve to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B, or C not AND met.

D.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. Two PORVs inoperable and E.1 Close associated block 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months not capable of being valves.

manually cycled.

AND E.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated block valves.

AND E.3 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND E.4 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Farley Units 1 and 2 3.4.11-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Pressurizer PORVs 3.4.11 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME F. ---------------NO TE------------- F.1 Place associated 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not permitted PORVs in manual for this loss of function control.

Condition when a second AND block valve is intentionally made inoperable. F.2 Restore one block valve 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

to OPERABLE status.

Two block valves OR inoperable.

In accordance with the Risk Informed Completion Time Program G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition F not AND met.

G.2 Be in MODE4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.11.1 -------------------------------NOTES---------------------------

1. Not required to be performed with block valve closed in accordance with the Required Actions of this LCO.

2. Only required to be performed in MODES 1 and 2.

Perform a complete cycle of each block valve. In accordance with the Surveillance Frequency Control Program Farley Units 1 and 2 3.4.11-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Accumulators 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Accumulators LCO 3.5.1 Three ECCS accumulators shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with RCS pressure > 1000 psig.

NOTE----------------------------------------------

1n MODE 3, with RCS pressure> 1000 psig, the accumulators may be inoperable for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to perform pressure isolation valve testing per SR 3.4.14.1.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One accumulator A.1 Restore boron 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable due to boron concentration to within concentration not within limits.

limits.

B. One accumulator 8.1 Restore accumulator to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months inoperable for reasons OPERABLE status.

other than Condition A.

Farley Units 1 and 2 3.5.1-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Accumulators 3.5.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. ------------NOTE---------- C. 1 Restore accumulators to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry not permitted OPERABLE status.

for this loss of function Condition when two or OR more ECCS accumulators are In accordance with intentionally made the Risk Informed inoperable.

Completion Time

Program Two or more accumulators inoperable for reasons other than boron concentration not within limits.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B, or AND C not met.

D.2 Reduce RCS pressure to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 5 1000 psig.

Farley Units 1 and 2 3.5.1-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Accumulators 3.5.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each accumulator isolation valve is fully open. In accordance with the Surveillance Frequency Control Program SR 3.5.1.2 Verify borated water volume in each accumulator is In accordance with

~ 7555 gallons (31.4%) and:$ 7780 gallons (58.4%). the Surveillance Frequency Control Program SR 3.5.1.3 Verify nitrogen cover pressure in each accumulator is In accordance with

~ 601 psig and:$ 649 psig. the Surveillance Frequency Control Program SR 3.5.1.4 Verify boron concentration in each accumulator is In accordance with

~ 2200 ppm and :$ 2500 ppm. the Surveillance Frequency Control Program AND

NOTE-------

On ly required to be performed for affected accumulators Once within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after each solution volume increase of ~ 12%

level, indicated, that is not the result of addition from the refueling water storage tank SR 3.5.1.5 Verify power is removed from each accumulator In accordance with isolation valve operator when RCS pressure is the Surveillance

~ 2000 psig. Frequency Control Program Farley Units 1 and 2 3.5.1-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

ECCS- Operating 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS-Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE.

NOTES-------------------------------------------

1. In MODE 3, the Residual Heat Removal or the Centrifugal Charging Pump flow paths may be isolated by closing the isolation valves for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to perform pressure isolation valve testing per SR 3.4.14.1.

2. Upon entry into MODE 3 from MODE 4, the breaker or disconnect device to the valve operators for MOVs 8706A and 87068 may be locked open for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to allow for repositioning from MODE 4 requirements.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains A.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND

, 8.2 Be in MODE4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C. Less than 100% of the C.1 Enter LCO 3.0.3. Immediately ECCS flow equivalent to a single OPERABLE ECCS train available.

Farley Units 1 and 2 3.5.2-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

RWST 3.5.4 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.4 Refueling Water Storage Tank (RWST)

LCO 3.5.4 The RWST shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWST boron A.1 Restore RWST to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months concentration not within OPERABLE status.

limits.

OR RWST borated water temperature not within limits.

B. .------------NO TE----------- 8.1 Restore RWST to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry not permitted OPERABLE status.

OR for this loss of function Condition when the In accordance with RWST is intentionally the Risk Informed made inoperable. Completion Time Program RWST inoperable for reasons other than Condition A.

Farley Units 1 and 2 3.5.4-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Air Locks 3.6.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. One or more containment C.1 Initiate action to evaluate Immediately air locks inoperable for overall containment reasons other than leakage rate per Condition A or B. LCO 3.6.1.

AND C.2 Verify a door is closed in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months the affected air lock.

AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. Required Action and 0.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Farley Units 1 and 2 3.6.2-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. ------------NO TE------------- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months On ly applicable to penetration flow path by penetration flow paths use of at least one closed with two containment and de-activated isolation valves. automatic valve, closed In accordance with manual valve, blind the Risk Informed flange, or check valve Completion Time One or more penetration with flow through the Program flow paths with one valve secured.

containment isolation valve inoperable except AND for purge valve penetration leakage not A.2 ----------~-NOTE---------~--

within limit. lsolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days for penetration flow path is isolation devices isolated. outside containment Prior to entering MODE4from MODE 5 if not performed within the previous 92 days for isolation devices inside containment Farley Units 1 and 2 3.6.3-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. -----------NOTE---------- B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Only applicable to penetration flow path by penetration flow paths use of at least one closed with two containment and de-activated isolation valves. automatic valve, closed In accordance with

2. RICT entry is not manual valve, or blind the Risk Informed permitted for this loss flange. Completion Time of function Condition Program when the second containment isolation valve is intentionally made inoperable.

One or more penetration flow paths with two containment isolation valves inoperable except for purge valve penetration leakage not within limit.

Farley Units 1 and 2 3.6.3-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. ---------~-NOTE---------~- C. 1 Isolate the affected 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Only applicable to penetration flow path by penetration flow paths use of at least one closed with only one and de-activated containment isolation automatic valve, closed In accordance with valve and a closed manual valve, or blind the Risk Informed system. flange. Completion Time Program One or more penetration flow paths with one C.2 -------------NO TE------------

containment isolation 1solation devices in high valve inoperable. radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is isolated.

Farley Units 1 and 2 3.6.3-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. One or more penetration D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months flow paths containing penetration flow path by containment purge use of at least one valves, with penetration closed and de-activated leakage such that the automatic valve, closed sum of the leakage for all manual valve, or blind Type B and C tests is not flange.

within limits.

AND D.2 ---------NOTE-------------

lsolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days for penetration flow path is isolation devices isolated. outside containment Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment D.3 Perform SR 3.6.3.5 for Once per 92 days the penetrations containing resilient seal purge valves closed to comply with Required Action D.1.

Farley Units 1 and 2 3.6.3-5 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B, AND C, or D not met.

E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months F. One or more penetration F.1 Reduce leakage to within Prior to entering flow paths containing limit. MODE 4 from MODE containment purge 5 if the existing valves, with penetration leakage is determined leakage not within the during quarterly penetration limits. testing per SR 3.6.3.5 OR Prior to entering MODE 4 if excess leakage is determined during MODE 5 per SR 3.6.3.5 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.3.1 Verify each 48 inch purge valve is sealed closed, In accordance with except for one purge valve in a penetration flow path the Surveillance while in Condition D of this LCO. Frequency Control Program SR 3.6.3.2 ----------------------------NOTE----------------------------------

Va Ives and blind flanges in high radiation areas may be verified by use of administrative controls.

Verify each containment isolation manual valve and In accordance with blind flange that is located outside containment and the Surveillance not locked, sealed, or otherwise secured and Frequency Control required to be closed during accident conditions is Program closed, except for containment isolation valves that are open under administrative controls.

Farley Units 1 and 2 3.6.3-6 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.3.3 ----------------------------NO TES------------------------------

1. Valves and blind flanges in high radiation areas may be verified by use of administrative means.

2. The blind flange on the fuel transfer canal flange is only required to be verified closed after each draining of the canal.

Verify each containment isolation manual valve and Prior to entering blind flange that is located inside containment and MODE4from not locked, sealed, or otherwise secured and MODE 5 if not required to be closed during accident conditions is performed within closed, except for containment isolation valves that the previous are open under administrative controls. 92 days SR 3.6.3.4 Verify the isolation time of each automatic power In accordance with operated containment isolation valve in the the INSERVICE INSERVICE TESTING PROGRAM is within limits. TESTING PROGRAM SR 3.6.3.5 Perform leakage rate testing for containment In accordance with penetrations containing containment purge valves the Surveillance with resilient seals. Frequency Control Program AND Within 92 days after opening the valve SR 3.6.3.6 Verify each automatic containment isolation valve In accordance with that is not locked, sealed or otherwise secured in the Surveillance position, actuates to the isolation position on an Frequency Control actual or simulated actuation signal. Program Farley Units 1 and 2 3.6.3-7 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Spray and Cooling Systems 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray and Cooling Systems LCO 3.6.6 Two containment spray trains and two containment cooling trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray A.1 Restore containment spray 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable. train to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

8. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not AND met.

8.2 ------------NOTE----------

LCO 3.0.4.a is not applicable when entering MODE4.

Be in MODE 4. 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months Farley Units 1 and 2 3.6.6-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Spray and Cooling Systems 3.6.6 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. One containment cooling C.1 Restore containment 7 days train inoperable. cooling train to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program D. Two containment cooling D.1 Restore one containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months trains inoperable. cooling train to OPERABLE status.

E Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition C or D AND not met.

E.2 ---~-------NOTE-----------

LCO 3.0.4.a is not applicable when entering MODE4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months F. -------------NOTE------------ F.1 Restore one containment 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not spray train to OPERABLE OR permitted for this loss of status.

function Condition when In accordance with a second containment the Risk Informed spray train is intentionally Completion Time made inoperable. Program Two containment spray trains inoperable.

Farley Units 1 and 2 3.6.6-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Spray and Cooling Systems 3.6.6 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME G. -------------NOTE----------- G.1 Restore required trains to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not OPERABLE status.

permitted for this loss of function Condition when OR a third train is intentionally made In accordance with inoperable.

the Risk Informed

Completion Time Any combination of three Program or more trains inoperable.

H. Required Action and H.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition F or G not met. H.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.6.1 -----------------------------NO TE---------------------------------

Not required to be met for system vent flow paths opened under administrative control.

Verify each containment spray manual, power In accordance with operated, and automatic valve in the flow path that is the Surveillance not locked, sealed, or otherwise secured in position is Frequency Control in the correct position. Program Farley Units 1 and 2 3.6.6-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Containment Spray and Cooling Systems 3.6.6 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.6.2 Operate each required containment cooling train fan In accordance with unit for ~ 15 minutes. the Surveillance Frequency Control Program SR 3.6.6.3 Verify each containment cooling train cooling water In accordance with flow rate is ~ 1600 gpm. the Surveillance Frequency Control Program SR 3.6.6.4 Verify each containment spray pump's developed In accordance with head at the flow test point is greater than or equal to the INSERVICE the required developed head. TESTING PROGRAM SR 3.6.6.5 Verify each automatic containment spray valve in the In accordance with flow path that is not locked, sealed, or otherwise the Surveillance secured in position, actuates to the correct position Frequency Control on an actual or simulated actuation signal. Program SR 3.6.6.6 Verify each containment spray pump starts In accordance with automatically on an actual or simulated actuation the Surveillance signal. Frequency Control Program SR 3.6.6.7 Verify each containment cooling train starts In accordance with automatically on an actual or simulated actuation the Surveillance signal. Frequency Control Program SR 3.6.6.8 Verify each spray nozzle is unobstructed. In accordance with the Surveillance Frequency Control Program Farley Units 1 and 2 3.6.6-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

MSIVs 3.7.2

3. 7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs)

LCO 3.7.2 Two MSIVs per steam line shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 except when one MSIV in each steam line is closed.

ACTIONS

NOTE----------------------------------------------------------

Se pa rate Condition entry is allowed for each steam line.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more steam lines A.1 Restore MSIV to OPERABLE 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one MSIV inoperable status.

OR in MODE 1.

In accordance with the Risk Informed Completion Time Program

8. -----------NOTE------------ 8.1 Restore one MSIV to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months RICT entry is not OPERABLE status in permitted for this loss of affected steam line. OR function Condition when a second MSIV, in one or In accordance with more steam lines, is the Risk Informed intentionally made Completion Time inoperable. Program One or more steam lines with two MSIVs inoperable in MODE 1.

Farley Units 1 and 2 3.7.2-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

MSIVs 3.7.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B not met.

D. One or more steam lines D.1 Verify one MSIV closed in 7 days with one MSIV affected steam line.

inoperable in MODE 2 or AND 3.

Once per 7 days thereafter E. One or more steam lines E.1 Verify one MSIV closed in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months with two MSIVs affected steam line.

inoperable in MODE 2 AND or 3.

Once per 7 days thereafter F. Required Action and F.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D or E AND not met.

F.2 Be in MODE4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 -------------------------------NOTE------------------------------

Only required to be performed in MODES 1 and 2.

Verify closure time of each MSIV is ::; 7 seconds. In accordance with the INSERVICE TESTING PROGRAM Farley Units 1 and 2 3.7.2-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

ARVs 3.7.4

3. 7 PLANT SYSTEMS 3.7.4 Atmospheric Relief Valves (ARVs)

LCO 3.7.4 Three ARV lines shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required ARV line A.1 Restore required ARV line 7 days inoperable. to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Two required ARV lines 8.1 Restore one required ARV 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months inoperable. line to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program C. 1 Restore one required ARV 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C. Three required ARV lines line to OPERABLE status.

inoperable.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B, or C not met. AND D.2 Be in MODE4. 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Farley Units 1 and 2 3.7.4-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AFWSystem 3.7.5

3. 7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3. 7 .5 Three AFW trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE------------------------------------------------------

LCO 3.0.4b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. Turbine driven AFW train A.1 Restore affected equipment 7 days inoperable due to one to OPERABLE status.

inoperable steam supply. OR OR In accordance with

NOTE----------- the Risk Informed Only applicable if MODE Completion Time 2 has not been entered Program following refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A. OR In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.7.5-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

CCWSystem 3.7.7

3. 7 PLANT SYSTEMS 3.7.7 Component Cooling Water (CCW) System LCO 3.7.7 Two CCWtrains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One CCW train A.1 ------------NOTE----------~--

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4,"

for residual heat removal loops made inoperable by ccw.

Restore CCW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program.

B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not AND met.

8.2 ------------NO TE-----------

LCO 3.0.4.a is not applicable when entering MODE 4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Farley Units 1 and 2 3.7.7-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

CCWSystem 3.7.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. -----~----NOTE-~-------- C. 1 Restore one CCW train to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry not permitted OPERABLE status.

OR for this loss of function Condition when the In accordance with second CCW train is the Risk Informed intentionally made Completion Time inoperable. Program.

Two CCW trains inoperable.

D. Required Action and D. 1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition C not met. D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1 ------------------------------NO TE--------------------------------

1solation of CCW flow to individual components does not render the CCW System inoperable.

Verify each accessible CCW manual, power In accordance with operated, and automatic valve in the flow path the Surveillance servicing safety related equipment, that is not locked, Frequency Control sealed, or otherwise secured in position, is in the Program correct position.

SR 3.7.7.2 Verify each CCW automatic valve in the flow path In accordance with that is not locked, sealed, or otherwise secured in the Surveillance position, actuates to the correct position on an actual Frequency Control or simulated actuation signal. Program SR 3.7.7.3 Verify each CCW pump starts automatically on an In accordance with actual or simulated actuation signal. the Surveillance Frequency Control Program

Farley Units 1 and 2 3.7.7-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

sws 3.7.8

3. 7 PLANT SYSTEMS 3.7.8 Service Water System (SWS)

LCO 3.7.8 Two SWS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SWS train A.1 -----------NOTES-~-----~--

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," for emergency diesel generator made inoperable by SWS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops- MODE 4,"

for residual heat removal loops made inoperable by SWS.

Restore SWS train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.7.8-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

sws 3.7.8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. One SWS automatic 8.1 Restore both inoperable 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months turbine building isolation turbine building isolation OR valve inoperable in each valves to OPERABLE SWS train. status.

In accordance with the Risk Informed Completion Time Program C. Required Action and C. 1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B AND not met.

C.2 ------------NOTE-----------

LCO 3.0.4.a is not applicable when entering MODE4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months D. -----------NOTE----------- D.1 Restore one SWS train 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry not permitted to OPERABLE status.

for this loss of function OR Condition when the second SWS train is In accordance with intentionally made the Risk Informed inoperable. Completion Time

Program Two SWS trains inoperable for reasons other than Condition B.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Farley Units 1 and 2 3.7.8-2 Amendment No.225 (Unit 1)

Amendment No.222 (Unit 2)

sws 3.7.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1 -----------------------------NO TE------------------------------

1solation of SWS flow to individual components does not render the SWS inoperable.

Verify each accessible SWS manual, power In accordance with operated, and automatic valve in the flow path the Surveillance servicing safety related equipment, that is not locked, Frequency Control sealed, or otherwise secured in position, is in the Program correct position.

SR 3.7.8.2 Verify each SWS automatic valve in the flow path that In accordance with is not locked, sealed, or otherwise secured in the Surveillance position, actuates to the correct position on an actual Frequency Control or simulated actuation signal. Program SR 3.7.8.3 Verify each SWS pump starts automatically on an In accordance with actual or simulated actuation signal. the Surveillance Frequency Control Program SR 3.7.8.4 Verify the integrity of the SWS buried piping by visual In accordance with inspection of the ground area. the Surveillance Frequency Control Program Farley Units 1 and 2 3.7.8-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

ESF Room Coolers 3.7.19

3. 7 PLANT SYSTEMS 3.7.19 Engineered Safety Feature (ESF) Room Coolers LCO 3. 7.19 ESF Room Coolers shall be OPERABLE.

APPLICABILITY: When associated ESF equipment is required to be OPERABLE.

ACTIONS

NO TE -----------------------------------------------------------

Separate Condition entry is allowed for each ESF Room Cooler subsystem.

CONDITION REQUIRED ACTION COMPLETION TIME A. One required ESF Room A.1 Restore the affected ESF Room 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Cooler subsystem Train Cooler subsystem Train to inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. -----------NO TE---------- B.1 Restore one of the same ESF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not Room Cooler subsystems to permitted for this loss of OR OPERABLE status.

function Condition when In accordance with a second train of the the Risk Informed same ESF Room Cooler Completion Time subsystem is Program intentionally made inoperable.

Two trains of the same ESF Room Cooler subsystem inoperable.

Farley Units 1 and 2 3.7.19-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

ESF Room Coolers 3.7.19 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B not met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.19.1 Verify each ESF Room Cooler system manual valve In accordance with servicing safety-related equipment that is not locked, the Surveillance sealed, or otherwise secured in position, is in the Frequency Control correct position. Program SR 3.7.19.2 Verify each ESF Room Cooler fan starts In accordance with automatically on an actual or simulated actuation the Surveillance signal. Frequency Control Program Farley Units 1 and 2 3.7.19-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required offsite 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One DG set inoperable. ------------------NOTE------------------

LCO 3.0.4c is applicable when only one of the three DGs is inoperable.

8.1 Perform SR 3.8.1.1 for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months the required offsite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND 8.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported by discovery of the inoperable DG set Condition B inoperable when its concurrent with required redundant inoperability of feature(s) is inoperable. redundant required feature(s)

AND 8.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG set is not inoperable due to common cause failure.

OR (continued)

Farley Units 1 and 2 3.8.1-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources -Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.3.2 Perform SR 3.8.1.6 for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE DG set.

AND B.4 Restore DG set to 10 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program C. Two required offsite C. 1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when its redundant Condition C required feature(s) is concurrent with inoperable. inoperability of redundant required features AND C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.8.1-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite circuit ----------~~~-NOTE~-----~----------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, AND "Distribution Systems-Operating," when Condition Dis One DG set inoperable. entered with no AC power source to any train.

D.1 Restore required offsite 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months circuit to OPERABLE status. OR In accordance with the Risk Informed OR Completion Time Program D.2 Restore DG set to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program E. DG 1C is inoperable. E.1 Restore one DG set to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

AND DG Set B inoperable.

Farley Units 1 and 2 3.8.1-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources -Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME F. -----~-----NOTE------------ F.1 Restore one DG set to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months RICT entry is not permitted OPERABLE status.

for this loss of function OR Condition when a second DG set is intentionally In accordance with made inoperable. the Risk Informed

Completion Time Program DG 1-2A is inoperable.

AND DG Set B inoperable.

G. -------------NO TE------------- G.1 Restore one DG set to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months RICT entry is not permitted OPERABLE status.

for this loss of function OR Condition when a second DG set is intentionally In accordance with made inoperable. the Risk Informed

Completion Time Program DG 1C is inoperable.

AND DG 1-2A is inoperable .

AND DG Set B inoperable.

H. Required Action and H.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition C, E, F, or G not met.

Farley Units 1 and 2 3.8.1-5 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources- Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME I. One automatic load 1.1 Restore automatic load 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months sequencer inoperable. sequencer to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program J. Required Action and J.1 Be in MODE 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, 8, D, AND or I not met.

J.2 -----------NOTE----------

LCO 3.0.4.a is not applicable when entering MODE 4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months K. -------------NO TE----,--------- K.1 Restore required AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not permitted sources to OPERABLE for this loss of function status. OR Condition when a third AC source is intentionally In accordance with made inoperable the Risk Informed

Completion Time Program Three or more required AC sources inoperable.

L. Required Action and L.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition K not AND met.

L.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Farley Units 1 and 2 3.8.1-6 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and indicated power In accordance with availability for each required offsite circuit. the Surveillance Frequency Control Program SR 3.8.1.2 -----------~---------~-----NOTES~-----------------------~----

1. Performance of SR 3.8.1.6 satisfies this SR.

2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer. When modified start procedures are not used, the time, voltage, and frequency tolerances of SR 3.8.1.6 must be met.

Verify each DG starts from standby conditions and In accordance with achieves steady state voltage~ 3740 V and the Surveillance

~ 4580 V, and frequency~ 58.8 Hz and~ 61.2 Hz. Frequency Control Program Farley Units 1 and 2 3.8.1-7 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.3 --------~------~-------~----NOTES--~--------~---------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This Surveillance shall be conducted on only one DG at a time.

4. This SR shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.2 or SR 3.8.1.6.

Verify each DG is synchronized and loaded and In accordance with operates for 2 60 minutes at a load 2 2700 kW and the Surveillance

5: 2850 kW for the 2850 kW DG and 2 3875 kW and Frequency Control

,; 4075 kW for the 4075 kW DGs. Program SR 3.8.1.4 Verify each day tank contains 2 900 gal of fuel oil for In accordance with the 4075 kW DGs and 700 gal of fuel oil for the the Surveillance 2850 kWDG. Frequency Control Program SR 3.8.1.5 Verify the fuel oil transfer system operates to transfer In accordance with fuel oil from storage tank to the day tank. the Surveillance Frequency Control Program SR 3.8.1.6 ------------------------------NO TE--------------------------------

AII DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby condition and In accordance with achieves in :5: 12 seconds, voltage 2 3952 V and the Surveillance frequency 2 60 Hz. Frequency Control Program Farley Units 1 and 2 3.8.1-8 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.7 ----------------------------NOTE-------------------------------

Th is Surveillance shall not normally be performed in MODE 1 or 2. However, this surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify manual transfer of AC power sources from the In accordance with normal offsite circuit to the alternate required offsite the Surveillance circuit. Frequency Control Program SR 3.8.1.8 Verify each DG rejects a load greater than or equal to In accordance with its associated single largest post-accident load, and: the Surveillance Frequency Control

a. Following load rejection, the speed is :s; 75% of Program the difference between nominal speed and the overspeed trip setpoint; and

b. Following load rejection, the voltage is

~ 3740 V and :s; 4580 V.

Farley Units 1 and 2 3.8.1-9 Amendment No. 225 (Unit 1}

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.9 -------------~-~-~-~-~----NOTES-----------~--------~------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify on an actual or simulated loss of offsite power In accordance with signal: the Surveillance Frequency Control

a. De-energization of emergency buses; Program

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in :5 12 seconds,

2. energizes auto-connected shutdown loads through automatic load sequencer,

3. maintains steady state voltage 2 3740 V and :5 4580 V,

4. maintains steady state frequency 2 58.8 Hz and :5 61.2 Hz, and

5. supplies permanently connected and auto-connected shutdown loads for 2 5 minutes.

Farley Units 1 and 2 3.8.1-10 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.10 ------------------------------NO TE------------------------------

AII DG starts may be preceded by prelube period.

Verify on an actual or simulated Engineered Safety In accordance with the Surveillance Feature (ESF) actuation signal each DG auto-starts Frequency Control from standby condition and:

Program

a. In ~ 12 seconds after auto-start and during tests, achieves voltage ~ 3952 V;

b. In ~ 12 seconds after auto-start and during tests, achieves frequency ~ 60 Hz;

c. Operates for ~ 5 minutes and maintains a steady state generator voltage and frequency of ~ 37 40 V and ~ 4580 V and ~ 58.8 Hz and

~61.2Hz;

NO TE-------------------------------

S R 3.8.1.1 O.d and e shall not be performed in MODE 1 or 2.

d. Permanently connected loads remain energized from the offsite power system; and

e. Emergency loads are energized from the offsite power system.

Farley Units 1 and 2 3.8.1-11 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.11 Verify each DG's automatic trips are bypassed on In accordance with actual or simulated loss of voltage signal on the the Surveillance emergency bus and/or an actual or simulated ESF Frequency Control actuation signal except: Program

a. Engine overspeed;

b. Generator differential current; and

c. Low lube oil pressure.

SR 3.8.1.12 ----------------------------NO TE-----------------------------

Momenta ry transients below the minimum load specified do not invalidate this test.

Verify each DG operates for:::: 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: In accordance with the Surveillance

a. For :::: 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded :::: 4353 for the 4075 kW Frequency Control DGs and :::: 3100 kW for the 2850 kW DG; and Program

b. For the remaining hours of the test loaded

4075 kW for the 4075 kW DGs and :::: 2850 kW for the 2850 kW DG.

Farley Units 1 and 2 3.8.1-12 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.13 -----------------------------NO TES-----------------------------

1. This Surveillance shall be performed within 1O minutes of shutting down the DG after the DG has operated 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded 2 4075 kW for the 4075 kW DGs and 2 2850 kW for the 2850 kWDG.

Momentary transients below the minimum load specified do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

Verify each DG starts and achieves, in ::; 12 seconds, In accordance with voltage 2 3952 V and frequency 2 60 Hz. the Surveillance Frequency Control Program SR 3.8.1.14 -------------------------------NO TE------------------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG: In accordance with the Surveillance

a. Synchronizes with offsite power source while Frequency Control loaded with emergency loads upon a simulated Program restoration of offsite power;

b. Transfers loads to offsite power source; and

c. Returns to ready-to-load operation.

Farley Units 1 and 2 3.8.1-13 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources- Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.15 Verify, with a DG operating in test mode and In accordance with connected to its bus, an actual or simulated ESF the Surveillance actuation signal overrides the test mode by returning Frequency Control DG to ready-to-load operation. Program SR 3.8.1.16 Verify interval between each sequenced load block is In accordance with within +/- 10% of design interval or 0.5 seconds, the Surveillance whichever is greater, for each emergency load Frequency Control sequencer. Program SR 3.8.1.17 -------------------------------NOTES---------------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify on an actual or simulated loss of offsite power In accordance with signal in conjunction with an actual or simulated ESF the Surveillance actuation signal: Frequency Control Program

a. De-energization of emergency buses;

b. Load shedding from emergency buses; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in s; 12 seconds, (continued)

Farley Units 1 and 2 3.8.1-14 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.17 (continued)

2. energizes auto-connected emergency loads through load sequencer,

3. achieves steady state voltage

3740 V and s 4580 V,

4. achieves steady state frequency

58.8 Hz and s 61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for

5 minutes.

SR 3.8.1.18 ------------------------------NOTE-----------------------------

Testi ng of the shared Emergency Diesel Generator (EOG) set (EOG 1-2A or EOG 1C) on either unit may be used to satisfy this surveillance requirement for these EDGs for both units.

Verify each DG does not trip and voltage is In accordance with maintained s 4990 V and ;::: 3330 V during and the Surveillance following a load rejection of;::: 1200 kW and s 2400 Frequency Control kW. Program SR 3.8.1.19 -------------------------------NOTE-----------------------------

AII DG starts may be preceded by an engine prelube period.

Verify when started simultaneously from standby In accordance with condition, each DG achieves, ins 12 seconds, the Surveillance voltage ;::: 3952 V and frequency ;::: 60 Hz. Frequency Control Program Farley Units 1 and 2 3.8.1-15 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources-Operating LCO 3.8.4 The Train A and Train B Auxiliary Building and Service Water Intake Structure (SWIS) DC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Auxiliary Building DC A.1 Restore the Auxiliary 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months electrical power subsystem Building DC electrical inoperable. power subsystem to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program B. One Auxiliary Building DC B.1 Restore the battery 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months electrical power subsystem connection resistance to OR with battery connection within limit.

resistance not within limit.

In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.8.4-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources - Operating 3.8.4 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B AND not met.

C.2 ------------NO TE-----------

LCO 3.0.4.a is not applicable when entering MODE 4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months D. One required SWIS DC D.1 Restore the battery 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months electrical power connection resistance to OR subsystem battery within the limit.

connection resistance not within limit. In accordance with the Risk Informed Completion Time Program E. One required SWIS DC E.1 Declare the associated Immediately electrical power subsystem Service Water System inoperable. train inoperable.

OR Required Action and associated Completion Time of Condition D not met.

Farley Units 1 and 2 3.8.4-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources - Operating 3.8.4 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME F. ----------~NOTE------------ F.1 Restore required DC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry not permitted electrical subsystems to for this loss of function OPERABLE status. OR Condition when a second DC power electrical In accordance with subsystem is intentionally the Risk Informed removed from service. Completion Time

Program Two or more DC electrical subsystems inoperable that result in a loss of function.

G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition F not AND met.

G.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is~ 127.8 Von float In accordance charge. with the Surveillance Frequency Control Program SR 3.8.4.2 Verify no visible corrosion at battery terminals and In accordance connectors. with the Surveillance OR Frequency Control Program Verify post-to-post battery connection resistance of each cell-to-cell and terminal connection is :"S:: 150 microhms for the Auxiliary Building batteries and

"S:: 1500 microhms for the SWIS batteries.

Farley Units 1 and 2 3.8.4-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources -Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.3 Verify battery cells, cell plates, and racks show no In accordance visual indication of physical damage or abnormal with the deterioration. Surveillance Frequency Control Program SR 3.8.4.4 Remove visible terminal corrosion, verify battery cell- In accordance with to-cell and terminal connections are coated with the Surveillance anti-corrosion material. Frequency Control Program SR 3.8.4.5 Verify post-to-post battery connection resistance of In accordance with each cell-to-cell and terminal connection is ~ 150 the Surveillance microhms for the Auxiliary Building batteries and Frequency Control

5; 1500 microhms for the SWIS batteries Program SR 3.8.4.6 -----------------------------NO TE-----------------------------

Th is Surveillance may be performed in MODE 1, 2, 3, 4, 5, or 6 provided spare or redundant charger(s) placed in service are within surveillance frequency to maintain DC subsystem(s) OPERABLE.

Verify each required Auxiliary Building battery In accordance with charger supplies 2 536 amps at 2 125 V for ~ 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months the Surveillance and each required SWIS battery charger supplies Frequency Control 2 3 amps at 2 125 V for.~ 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Program Farley Units 1 and 2 3.8.4-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources- Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.7 ----~-----------------~--~NOTES----~-----------~---~----~- In accordance with

1. The performance discharge test in SR 3.8.4.8 the Surveillance may be performed in lieu of the service test in Frequency Control SR 3.8.4.7 once per 60 months. Program

2. The modified performance discharge test in SR 3.8.4.8 may be performed in lieu of the service test at any time.

3. This Surveillance shall not normally be performed for the Auxiliary Building batteries in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify battery capacity is adequate to supply, and maintain in OPERABLE status, the required emergency loads for the design load profile described in the Final safety Analysis Report, Section 8.3.2, by subjecting the battery to a service test.

Farley Units 1 and 2 3.8.4-5 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

DC Sources - Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.8 -----~----~-------~-~------NOTE------~-----~-~~-----------

This Surveillance shall not normally be performed for the Auxiliary Building batteries in MODE 1, 2, 3, or 4.

However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify battery capacity is ~ 80% of the manufacturer's In accordance with rating when subjected to a performance discharge the Surveillance test or a modified performance discharge test. Frequency Control Program AND 18 months when battery shows degradation or has reached 85% of expected life or 17 years, whichever comes first Farley Units 1 and 2 3.8.4-6 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Inverters-Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters-Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.

NOTE--------------------------------------

Two inverters may be disconnected from their associated DC bus for s 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on their associated common battery, provided:

a. The associated AC vital buses are energized from their Class 1 E constant voltage source transformers; and

b. All other AC vital buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter A.1 ------------NO TE------------

inoperable. E nter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems - Operating" with any vital bus de-energized.

Restore inverter to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.8.7-1 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Inverters-Operating 3.8.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition A not met. B.2 ----------NO TE-----------

LCO 3.0.4.a is not applicable when entering MODE 4.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C. -----------NO TE----------- C. 1 Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not permitted inverters to OPERABLE for this loss of function status. OR Condition when the second required inverter is In accordance with intentionally made the Risk Informed inoperable.

Completion Time

Program Two or more required inverters inoperable.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition C not AND met.

D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, and In accordance with alignment to required AC vital buses. the Surveillance Frequency Control Program Farley Units 1 and 2 3.8.7-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Distribution Systems- Operating 3.8.9 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. One or more AC electrical D.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution subsystems inoperable for subsystem(s) to OR reasons other than OPERABLE status.

Condition A, B, or C. In accordance with the Risk Informed Completion Time Program E. One or more AC vital E.1 Restore AC vital bus 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months buses inoperable. subsystem(s) to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program F. One Auxiliary Building DC F.1 Restore Auxiliary 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months electrical power distribution Building DC electrical subsystem inoperable. power distribution subsystem to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program Farley Units 1 and 2 3.8.9-2 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Distribution Systems - Operating 3.8.9 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D, E, or AND F not met.

G.2 -----------NOTE-----------

LCO 3.0.4.a is not applicable when entering MODE 4.

Be in MODE4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months H. One Service Water Intake H.1 Declare the associated Immediately Structure (SWIS) DC Service Water train electrical power distribution inoperable.

subsystem inoperable.

I. ------------NO TE-------------- 1.1 Restore one train to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not permitted OPERABLE status.

for this loss of function OR Condition when two or In accordance with more electrical power the Risk Informed distribution trains are Completion Time intentionally made Program inoperable.

Two trains with inoperable electrical distribution subsystems that result in a loss of function.

J. Required Action and J.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition I not AND met.

J.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Farley Units 1 and 2 3.8.9-3 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Distribution Systems- Operating 3.8.9 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and voltage to In accordance with required AC, DC, and AC vital bus electrical power the Surveillance distribution subsystems. Frequency Control Program Farley Units 1 and 2 3.8.9-4 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.18 Control Room Integrity Program (GRIP) (continued)

c. Maintain a CRE configuration control and a design and licensing bases control program and a preventative maintenance program. As a minimum, the CRE configuration control program will determine whether the i) CRE differential pressure relative to adjacent areas and ii) the control room ventilation system flow rates, as determined in accordance with ASME N510-1989 or ASTM E2029-99, are consistent with the values measured at the time the ASTM E741 test was performed. If item i or ii has changed, determine how this change has affected the inleakage characteristics of the CRE. If there has been degradation in the inleakage characteristics of the CRE since the E741 test, then a determination should be made whether the licensing basis analyses remain valid. If the licensing basis analyses remain valid, the CRE remains OPERABLE.

d. Test the CRE in accordance with the testing methods and at the frequencies specified in RG 1.197, Revision 0, May 2003.

The provisions of SR 3.0.2 are applicable to the control room inleakage testing frequencies.

5.5.19 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

(continued)

Farley Units 1 and 2 5.5-16 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEl-06-09, Revision 0-A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function, or inoperability of all required trains of a system required to be OPERABLE, if one or more of the trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09. However, the following additional constraints shall be applied to the criteria for "PRA Functional".

1. Any structures, systems, and components (SSC) credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

(continued)

Farley Units 1 and 2 5.5-17 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.20 Risk Informed Completion Time Program (continued)

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure mechanism that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications Front Stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse SSC of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSCs. Documentation of RMAs shall be available for NRC review.

h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

Farley Units 1 and 2 5.5-18 Amendment No. 225 (Unit 1)

Amendment No. 222 (Unit 2)

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 225 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-2 AND AMENDMENT NO. 222 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-8 SOUTHERN NUCLEAR OPERATING COMPANY JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2 DOCKET NOS. 50-348 AND 50-364

1.0 INTRODUCTION

By letter dated July 27, 2018 (Reference 1), as supplemented by letters dated May 3, 2019 (Reference 2), May 17, 2019 (Reference 3), and June 27, 2019 (Reference 4), Southern Nuclear Operating Company (SNC, the licensee) submitted a license amendment request (LAR) that proposed changes to the Technical Specifications (TSs) for the Joseph M. Farley Nuclear Plant, Units 1 and 2 (FNP or Farley).

Specifically, the licensee requested changes to the TSs to implement a risk-informed approach for voluntary extension of completion times (CTs) for Limiting Conditions for Operation (LCOs).

The proposed amendments would add a new program, the "Risk Informed Completion Time Program," to TS Chapter 5, "Administrative Controls." The methodology for using this program is described in the Nuclear Energy Institute (NEI) topical report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A (Reference 5). NEI 06-09, Revision 0-A, provides a methodology for extending CTs and thereby delaying exiting the operational mode of applicability or taking remedial actions if risk is assessed and managed within the limits and programmatic requirements established by a risk-informed completion time (RICT} program or a configuration risk management program (CRMP). The U.S. Nuclear Regulatory Commission (NRC) staff found NEI 06-09, Revision 0-A, to be acceptable for referencing by licensees proposing to amend their TSs to implement risk-managed TSs as documented in the NRC staff's final safety evaluation (SE) for NEI 06-09, enclosed with the staff's letter dated May 17, 2007 (Reference 6).

On February 5-7, 2019, the NRC staff participated in a regulatory audit at the SNC offices in Birmingham, Alabama. The NRC staff performed the audit to ascertain the information needed to support its review of the application and develop requests for additional information (RAls), as needed. On February 26, 2019 (Reference 7), the NRC staff issued an audit summary. By letter dated March 12, 2019 (Reference 8), the NRC staff sent the licensee RAls.

Enclosure 3

On September 25, 2018, the NRC staff published a proposed no significant hazards consideration (NSHC) determination in the Federal Register (83 FR 48466) for the proposed amendments. Subsequently, by letters dated May 3, 2019, and May 17, 2019, the licensee provided additional information that expanded the scope of the amendment request as originally noticed in the Federal Register. Accordingly, the NRC staff published a second proposed NSHC determination in the Federal Register on June 4, 2019, (84 FR 25840), which superseded the original determination in its entirety.

The supplemental letter dated June 27, 2019, provided additional information that clarified the application, did not expand the scope of the application as noticed, and did not change the NRC staff's proposed NSHC determination as published in the Federal Register on June 4, 2019 (84 FR 25840).

2.0 REGULATORY EVALUATION

2.1 Description of Risk-Informed Completion Times (RICTs)

The TS LCOs are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO is not met, the licensee must shut down the reactor or follow any remedial action (e.g., testing, maintenance, or repair activity) permitted by the TSs until the LCO can be met. The remedial actions (i.e., ACTIONS) associated with an LCO contain Conditions that typically describe the ways in which the requirements of the LCO can fail to be met. Specified with each stated Condition are Required Action(s) and CTs. The CTs are referred to as the "front stops" in the context of this SE. For certain Conditions, the TSs require exiting the Mode of Applicability of an LCO.

NEI 06-09, Revision 0-A, provides a risk-informed methodology for extending CTs and thereby delay exiting the operational mode of applicability or taking Required Actions if risk is assessed and managed within the limits and programmatic requirements established by a RICT program or a CRMP. The licensee's use of the new CT requires risk to be assessed, monitored, and managed as measured by the configuration-specific core damage frequency (CDF) and large early release frequency (LERF) using processes and limits specified in NEI 06-09, Revision 0-A.

Use of the new CT also requires compensatory measures, or risk management actions (RMAs),

and quantitative evaluation of risk sources if probabilistic risk assessment (PRA) models are not available.

2.2 Description of Proposed Changes The licensee's submittal requested approval to add a "Risk Informed Completion Time Program," to Chapter 5, "Administrative Controls," of the TSs and to modify selected CTs to permit extending the CTs, provided that risk is assessed and managed as described in NEI 06-09, Revision 0-A. The licensee's application proposed to use NEI 06-09, Revision 0-A, and included documentation regarding the technical adequacy of the probabilistic risk assessment (PRA) models for the RICT Program, consistent with the guidance of Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated March 2009 (Reference 9).

The typical CT would be modified by the application of the RICT Program as shown in the following example. The changed portion is indicated in italics.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A One subsystem A.1 Restore subsystem 7 days inoperable. to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program Where necessary, conforming changes are proposed to CTs to make them accurate following the use of a RICT. For example, most TS have requirements to close/isolate containment isolation devices if one or more containment penetrations have inoperable devices. This is followed by a requirement to periodically verify that the penetration is isolated. By adding the flexibility to use a RICT to determine a time to isolate the penetration, the periodic verifications must then be based on the time "following isolation."

There are three major categories of proposed changes to the LCOs:

1) For the listed required actions, the option of calculating a RICT would be added.

2) For conditions involving loss of function, the condition would be modified by Notes prohibiting voluntary entry.

3) In some cases, additional changes would be made to accommodate the incorporation of the RICT Program. For example, the required actions would be modified to require restoration of equipment to operable status, where noted.

2.2.1 Technical Specification 1.0 Use and Application Example 1.3-8 would be added to TS 1.3, Completion Times, and would read as follows:

EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable. to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. ----------NOTE--------- B.1 Restore one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT entry is not subsystem to permitted for this OPERABLE OR loss of function status.

Condition when the In accordance with the second subsystem Risk Informed is intentionally made Completion Time inoperable. Program Two subsystems inoperable.

C. Required Action C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time AND not met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months EXAMPLE 1.3-8 (continued)

When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B must also be entered. The Condition is modified by a Note. The Note states that RICT entry is not permitted for this loss of function Condition when the second subsystem is intentionally made inoperable.

RICT program entry is only allowed if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition Bis entered and RICT entry is not permitted,

at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . If one subsystem is not restored within one hour, Condition C must also be entered.

The Licensee may be able to apply a RICT to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and RICT entry is permitted, at least one subsystem must be restored within the calculated RICT. If one subsystem cannot be restored within the calculated RICT, Condition C must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant conditions result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, 8, and Care exited, and therefore, the Required Actions of Condition C may be terminated.

2.2.2 Technical Specification 5.5.20, Risk-Informed Completion Time Program Technical Specification 5.5.20, which describes the RICT Program, would be added to the TS and would read as follows:

5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEl-06-09, Revision 0-A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e.,

not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function, or inoperability of all required trains of a system required to be OPERABLE, if one or more of the trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09.

The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f. Use of a RlCT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09. However, the following additional constraints shall be applied to the criteria for "PRA Functional".

1. Any structures, systems, and components (SSC) credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure mechanism that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications Front Stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining components shall be increased to represent the conditional failure probability due to CC failure of

these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be.implemented. These RMAs shall target the success of the redundant and/or diverse SSC of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSCs. Documentation of RMAs shall be available for NRC review.

h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

Conditions f.1 and f.2 add constraints to the PRA Functional definition in Section 2.3.1 of NEI 06-09, Revision 0-A. The constraints bring in design basis considerations from the NRC staff SE Condition 2 to ensure that the design basis success criteria continue to be met. Where there are differences between the PRA and the design basis success criteria for the values of, for example, flow rates and timing, the RICT will be calculated based on the PRA success criteria but the capability of the remaining SSC to meet the design basis success criteria will continue to be met per TS 5.5.20.f.

2.2.3 Application of the RICT Program to Existing LCOs and Conditions; and Other Proposed Changes LCO 3.4.10, Pressurizer Safety Valves

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore valve to OPERABLE status."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a pressurizer safety valve is intentionally made inoperable."

LCO 3.4.11, Pressurizer Power Operated Relief Valves (PORVs)

Required Action B.3 o The option of calculating a RICT is applied to the action, "Restore PORV to OPERABLE status."

Required Action C.2 o The option of calculating a RICT is applied to the action, "Restore block valve to OPERABLE status."

Required Action F.2 o The option of calculating a RICT is applied to the action, "Restore one block valve to OPERABLE status."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a second block valve is intentionally made inoperable."

LCO 3.5.1, Accumulators

Required Action C.1 o The option of calculating a RICT is applied to the action, "Restore accumulators to OPERABLE status" for proposed new Condition C, "Two or more accumulators inoperable for reasons other than boron concentration not within limits."

o The condition is modified by a note stating, "RICT entry not permitted for this loss of function Condition when two or more ECCS accumulators are intentionally made inoperable."

Required Actions D.1 and D.2 o Existing Condition C is revised to Condition D and states, "Required Action and associated Completion Time of Condition A, B, or C not met." Associated Required Actions C.1 and C.2 are relabeled D.1 and D.2, respectively.

o Existing Condition D and associated required action to enter LCO 3.0.3 is deleted.

LCO 3.5.2, ECCS-Operating

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore train(s) to OPERABLE status."

LCO 3.5.4, Refueling Water Storage Tank (RWST)

Required Action B.1 o The option of calculating a RICT is applied to the action, "Restore RWST to OPERABLE status."

o The condition is modified by a note stating, "RICT entry not permitted for this loss of function Condition when the RWST is intentionally made inoperable."

Existing Actions Notes allowing RWST piping to be unisolated from non-safety piping are deleted. These Notes are no longer applicable; they were only applicable to refueling outages 1R25 (spring 2015) and 2R24 (spring 2016).

LCO 3.6.2, Containment Air Locks

Required Action C.3 o The option of calculating a RICT is applied to the action, "Restore air lock to OPERABLE status."

LCO 3.6.3, Containment Isolation Valves

Required Action A.1

o The option of calculating a RICT is applied to the action, "Isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured."

Required Action B.1 o The option of calculating a RICT is applied to the action, "Isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when the second containment isolation valve is intentionally made inoperable," in addition to the existing note stating that the Condition is "Only applicable to penetration flow paths with two containment isolation valves."

Required Action C.1 o The option of calculating a RICT is applied to the action, "Isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange."

LCO 3.6.6, Containment Spray and Cooling Systems

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore containment spray train to OPERABLE status."

Required Action C.1 o The option of calculating a RICT is applied to the action, "Restore containment cooling train to OPERABLE status."

Required Action F.1 o The option of calculating a RICT is applied to the action, "Restore one containment spray train to OPERABLE status" for proposed new Condition F, "Two containment spray trains inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss offunction Condition when a second containment spray train is intentionally made inoperable."

Required Action G.1 o The option of calculating a RICT is applied to the action, "Restore required trains to OPERABLE status" for proposed new Condition G, "Any combination of three or more trains inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a third train is intentionally made inoperable."

Proposed new Condition His added, "Required Action and associated Completion Time of Condition For G not met," with associated Required Actions H.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , AND H.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3.7.2, Main Steam Isolation Valves (MSIVs)

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore MSIV to OPERABLE status."

Required Action 8.1 o The option of calculating a RICT is applied to the action, "Restore one MSIV to OPERABLE status in affected steam line."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a second MSIV, in one or more steam lines, is intentionally made inoperable."

LCO 3. 7.4, Atmospheric Relief Valves (ARVs)

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore required ARV line to OPERABLE status."

Required Action 8.1 o The option of calculating a RICT is applied to the action, "Restore one required ARV line to OPERABLE status" for proposed new Condition B, "Two required ARV lines inoperable."

Proposed new Condition C is added, "Three required ARV lines inoperable," with associated Required Action C.1, "Restore one required ARV line to OPERABLE status."

Proposed new Condition Dis added, "Required Action and associated Completion Time of Condition A, B, or C not met," with associated Required Actions 0.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and 0.2, "Be in MODE 4" in 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

LCO 3. 7.5, Auxiliary Feedwater {AFW) System

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore affected equipment to OPERABLE status."

Required Action 8.1 o The option of calculating a RICT is applied to the action, "Restore AFW train to OPERABLE status."

LCO 3.7.7, Component Cooling Water {CCW) System

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore CCW train to OPERABLE status."

Required Action C.1 o The option of calculating a RICT is applied to the action, "Restore one CCW train to OPERABLE status" for proposed new Condition* C, "Two CCW trains inoperable."

o The condition is modified by a note stating, "RICT entry not permitted for this loss of function Condition when the second CCW train is intentionally made inoperable."

Proposed new Condition Dis added, "Required Action and associated Completion Time of Condition C not met," with associated Required Actions D.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and D.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3.7.8, Service Water System (SWS)

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore SWS train to OPERABLE status."

Required Action B.1 o The option of calculating a RICT is applied to the action, "Restore both inoperable turbine building isolation valves to OPERABLE status."

Required Action D.1 o The option of calculating a RICT is applied to the action, "Restore one SWS train to OPERABLE status," for proposed new Condition D, "Two SWS trains inoperable for reasons other than Condition B."

o The condition is modified by a note stating, "RICT entry not permitted for this loss of function Condition when the second SWS train is intentionally made inoperable."

Proposed new Condition Eis added, "Required Action and associated Completion Time of Condition D not met," with associated Required Actions E.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and E.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3. 7.19, Engineered Safety Feature (ESF) Room Coolers

Required Action A. 1 o The option of calculating a RICT is applied to the action, "Restore the affected ESF Room Cooler subsystem Train to OPERABLE status."

Required Action B.1 o The option of calculating a RICT is applied to the action, "Restore one of the same ESF Room Cooler subsystem to OPERABLE status," for proposed new Condition B, "Two trains of the same ESF Room Cooler subsystem inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a second train of the same ESF Room Cooler subsystem is intentionally made inoperable."

Proposed new Condition C is added, "Required Action and associated Completion Time of Condition A or B not met," with associated Required Actions C.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and C.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3.8.1, AC Sources-Operating

Required Action A.3 o The option of calculating a RICT is applied to the action, "Restore required offsite circuit to OPERABLE status."

Required Action 8.4 o The option of calculating a RICT is applied to the action, "Restore DG [diesel generator) set to OPERABLE status."

Required Action C.2 o The option of calculating a RICT is applied to the action, "Restore one required offsite circuit to OPERABLE status."

Required Action D.1 o The option of calculating a RICT is applied to the action, "Restore required offsite circuit to OPERABLE status."

Required Action D.2 o The option of calculating a RICT is applied to the action, "Restore DG set to OPERABLE status."

Required Action E.1 o Proposed new action, "Restore one DG set to OPERABLE status," is added for proposed new Condition E, "DG 1C is inoperable AND DG set B inoperable."

Required Action F.1 o The option of calculating a RICT is applied to the action, "Restore one DG set to OPERABLE status," for proposed new Condition F, "DG 1-2A is inoperable AND DG set B inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a second DG set is intentionally made inoperable."

Required Action G.1 o The option of calculating a RICT is applied to the action, "Restore one DG set to OPERABLE status," for proposed new Condition G, "DG 1C is inoperable AND DG 1-2A is inoperable AND DG Set B inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a second DG set is intentionally made inoperable."

Existing Condition F is revised to Condition H and states, "Required Action and associated Completion Time of Condition C, E, F, or G not met." Associated Required Action F.1 is relabeled H.1.

Required Action 1.1 .

o The option of calculating a RICT is applied to the action, "Restore automatic load sequencer to OPERABLE status," for proposed re-lettered Condition I, "One automatic load sequencer inoperable."

Existing Condition His revised to Condition J and states, "Required Action and associated Completion Time of Condition A, B, D, or I not met." Associated Required Actions H.1 and H.2 are relabeled J.1 and J.2, respectively.

Required Action K.1 o The option of calculating a RICT is applied to the action, "Restore required AC sources to OPERABLE status," for proposed new Condition K, "Three or more required AC sources inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when a third AC source is intentionally made inoperable."

Proposed new Condition L is added, "Required Action and associated Completion Time of Condition Knot met," with associated Required Actions L.1, "Be in Mode 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and L.2, "Be in Mode 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3.8.4, DC [Direct Current) Sources-Operating

Required Action A 1 o The option of calculating a RICT is applied to the action, "Restore the Auxiliary Building DC electrical power subsystem to OPERABLE status."

Required Action 8.1 o The option of calculating a RICT is applied to the action, "Restore the battery connection resistance to within limit."

Required Action D.1 o The option of calculating a RICT is applied to the action, "Restore the battery connection resistance to within the limit."

Required Action F.1 o The option of calculating a RICT is applied to the action, "Restore required DC electrical subsystems to OPERABLE status," for proposed new Condition F, "Two or more DC electrical subsystems inoperable that result in a loss of function."

o The condition is modified by a note stating that "RICT entry not permitted for this loss of function Condition when a second DC power electrical subsystem is intentionally removed from service."

Proposed new Condition G is added, "Required Action and associated Completion Time of Condition F not met," with associated Required Actions G.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and G.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO 3.8.7, Inverters-Operating

Required Action A.1 o The option of calculating a RICT is applied to the action, "Restore inverter to OPERABLE status."

Condition B is modified to state, "Required Action and associated Completion Time of Condition A not met."

Required Action C.1 o The option of calculating a RICT is applied to the action, "Restore required inverters to OPERABLE status," for proposed new Condition C, "Two or more required inverters inoperable."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when the second required inverter is intentionally made inoperable."

Proposed new Condition D is added, "Required Action and associated Completion Time of Condition C not met," with associated Required Action 0.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and 0.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

TS 3.8.9, Distribution Systems-Operating

Required Action 0.1 o The option of calculating a RICT is applied to the action, "Restore AC electrical power distribution subsystem(s) to OPERABLE status."

Required Action E.1 o The option of calculating a RICT is applied to the action, "Restore AC vital bus subsystem(s) to OPERABLE status."

Required Action F.1 o The option of calculating a RICT is applied to the action, "Restore Auxiliary Building DC electrical power distribution subsystem to OPERABLE status."

Required Action 1.1 o The option of calculating a RICT is applied to the action, "Restore one train to OPERABLE status" for proposed modified Condition I, "Two trains with inoperable electrical distribution subsystems that result in a loss of function."

o The condition is modified by a note stating, "RICT entry is not permitted for this loss of function Condition when two or more electrical power distribution trains are intentionally made inoperable."

Proposed new Condition J is added, "Required Action and associated Completion Time of Condition I not met," with associated Required Actions J.1, "Be in MODE 3" in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and J.2, "Be in MODE 5" in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

2.3 Regulatory Review The NRC staff considered the following policy statements, regulatory requirements, and guidance during its review of the proposed changes.

2.3.1 Applicable Regulations The regulatory requirements related to the content of the TSs are contained in Section 50.36, "Technical specifications," of Title 10 of the Code of Federal Regulations (10 CFR).

Section 50.36 of 10 CFR requires TSs to include items in the following categories: ( 1) safety limits, limiting safety system settings, and limiting control settings; (2) LCOs; (3) surveillance requirements; (4) design features; (5) administrative controls; (6) decommissioning; (7) initial notification; and (8) written reports. Section 50.36(c)(2) states, in part, "Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met." Section 50.36(c)(5) states, in part, that administrative controls are "the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner."

In determining whether the proposed TS remedial actions should be granted, the Commission applies the "reasonable assurance" standard of 10 CFR 50.40(a) and 50.57(a)(3). The regulation at 10 CFR 50.40(a) states that in determining whether to grant the licensing request, the Commission will be guided by, among other things, consideration about whether "the processes to be performed, the operating procedures, the facility and equipment, the use of the facility, and other [TSs], or the proposals, in regard to any of the foregoing collectively provide reasonable assurance that the applicant will comply with the regulations in this chapter, including the regulations in Part 20 of this chapter, and that the health and safety of the public will not be endangered."

The regulation at 10 CFR 50.55a{h}, "Protection and safety systems," states that "Protection systems of nuclear power reactors of all types must meet the requirements specified in this paragraph. Each combined license for a utilization facility is subject to the following conditions."

Section 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants" (i.e., the Maintenance Rule), requires licensees to monitor the performance or condition of SSCs against licensee established goals in a manner sufficient to provide reasonable assurance that these SSCs are capable of fulfilling their intended functions.

Paragraph 50.65(a)(4) requires the assessment and management of the increase in risk that may result from a proposed maintenance activity.

The regulation at 10 CFR 50.57( a)(2) requires that the facility will operate in conformity with the application as amended, the provisions of the Atomic Energy Act, and the rules and regulations of the Commission.

The regulation at 10 CFR 50.57(a)(6) requires that the issuance of the license will not be inimical to the common defense and security or to the health and safety of the public.

As part of evaluating defense-in-depth, the NRC staff utilized 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 17, "Electric power systems." This GDC provides, in part, that

an onsite electric power system and an offsite electric power system shall be provided to permit functioning of SSCs important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that ( 1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

Although GDC 18, "Inspection and testing of electric power systems," is generally applicable to electrical power systems, the design and maintenance of the electrical power system equipment are not being changed by the proposed extension of the CTs and only the CTs in the TSs are being changed; therefore, the proposed changes do not affect compliance with GDC 18, as incorporated into the plant licensing basis through the updated final safety analysis report (UFSAR), Revision 28 (Reference 10). The review summarized by this SE is only within the requirements of GDC 17 with respect to defense-in-depth (e.g., availability/capacity/capability of the electrical power systems).

Some of the GDCs for protection systems also stipulate certain aspects of diversity and defense-in-depth, as described below. The NRC staff also utilized 10 CFR Part 50, Appendix A, GDCs 21, 22, 23, and 29 to evaluate the compliance with defense-in-depth design criteria for the proposed changes.

2.3.2 Commission Policy Statements The NRC provided details concerning the use of PRA in the "Final Policy Statement: Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities," published in the Federal Register (60 FR 42622; August 16, 1995). In this publication, the Commission wrote, in part:

The Commission believes that an overall policy on the use of PRA methods in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that would promote regulatory stability and efficiency. In addition, the Commission believes that the use of PRA technology in NRC regulatory activities should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach ....

PRA addresses a broad spectrum of initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for multiple and common cause failures. The treatment therefore goes beyond the single failure requirements in the deterministic approach. The probabilistic approach to regulation is, therefore, considered an extension and enhancement of traditional regulation by considering risk in a more coherent and complete manner ....

Therefore, the Commission believes that an overall policy on the use of PRA in nuclear regulatory activities should be established so that the many potential applications of PRA can be

implemented in a consistent and predictable manner that promotes regulatory stability and efficiency. This policy statement sets forth the Commission's intention to encourage the use of PRA and to expand the scope of PRA applications in all nuclear regulatory matters to the extent supported by the state-of-the-art in terms of methods and data ....

Therefore, the Commission adopts the following policy statement regarding the expanded NRC use of PRA:

( 1) The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

(2) PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed. It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

(3) PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

(4) The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

2.3.3 Regulatory Guidance RG 1.174, Revision 3 (Reference 11 ), "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," describes an acceptable risk-informed approach for assessing the nature and impact of proposed permanent licensing basis changes by considering engineering issues and applying risk insights. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, Revision 1 (Reference 12), "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," describes an acceptable risk-informed approach specifically for assessing proposed TS changes. This regulatory guide identifies a three-tiered approach for a licensee's evaluation of the risk associated with a proposed TS completion time change, as follows.

Tier 1 assesses the risk impact of the proposed change in accordance with acceptance guidelines consistent with the Commission's Safety Goal Policy Statement, as documented in RG 1. 174 and RG 1. 177. Tier 1 assesses the impact on plant risk as expressed by the change in CDF (.1CDF), and the change in large early release frequency (.1LERF). It also evaluates plant risk while equipment covered by the proposed CT is out-of-service, as represented by incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP).

The limits for ICCDP and ICLERP are consistent with the criteria for incremental core damage probability (ICDP) and incremental ICLERP from Nuclear Management and Resources Council (NUMARC) 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," April 2011 (Reference 13),

guidance for managing the risk of on-line maintenance activities. ICDP and ILERP

[incremental large early release probability] are the limits on which the licensee will base the RICT. In RG 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May 2012 (Reference 14), the NRC endorsed NUMARC 93-01 which provides methods acceptable to the NRC for complying with the Maintenance Rule, 10 CFR 50.65(a)(4). Tier 1 also addresses PRA quality, including the technical adequacy of the licensee's plant-specific PRA for the subject application.

Tier 2 identifies and evaluates any potential risk-significant plant equipment outage configurations that could result if equipment, in addition to that associated with the proposed license amendment, is removed from service simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The purpose of this evaluation is to ensure that there are appropriate restrictions in place such that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed CT is implemented.

Tier 3 addresses the licensee's CRMP to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and appropriate compensatory measures are taken to avoid risk-significant configurations that may not have been considered when the Tier 2 evaluation was performed. Compared with Tier 2, Tier 3 provides additional coverage to ensure that risk-significant plant equipment outage configurations are identified in a timely manner and that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule, which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, subject to the guidance provided in RG 1.177, Section 2.3. 7.1 and the adequacy of the licensee's program and PRA model for this application. The CRMP ensures that equipment removed from service prior to or during the proposed extended CT will be appropriately assessed from a risk perspective.

RG 1.200 describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the

results, such that the PRA can be used in regulatory decision making for light-water reactors.

This regulatory guide provides guidance for assessing the technical adequacy of a PRA.

RG 1.200 endorses, with clarifications, the NRC staff position on the use of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) Standard, RA-Sa-2009, "Addenda to ASME RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (the PRA Standard) (Reference 15).

As discussed in RG 1.177 and RG 1.174, a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption;

2. The proposed change is consistent with the defense-in-depth philosophy;

3. The proposed change maintains sufficient safety margins;

4. When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement; and

5. The impact of the proposed change should be monitored using performance measurement strategies.

RG 1.93, Revision 1, "Availability of Electric Power Sources" (Reference 16), provides guidelines that the NRC staff considers acceptable when the number of available electric power sources are less than the number of sources required by the LCOs for a facility.

3.0 TECHNICAL EVALUATION

The licensee proposed to add a RICT program to the Administrative Controls section of the TS, add new conditions and associated required actions in specific TSs, and modify selected actions to permit extending CTs, provided that risk is assessed and managed as described in NEI 06-09, Revision 0-A. In accordance with NEI 06-09, Revision 0-A, PRA methods are used to justify each extension to a Required Action CT based on the specific-plant configuration that exists at the time of the applicability of the Required Action and are updated when plant conditions change. The licensee's application for the changes proposed in the LAR ihcluded documentation regarding the technical adequacy of the PRA models used in the CRMP, consistent with the requirements of RG 1.200.

Most TSs identify one or more Conditions for which the LCO may not be met, to permit a licensee to perform required testing, maintenance, or repair activities. Each Condition has an associated Required Action for restoration of the LCO or for other actions, each with some fixed time interval, referred to as the CT, which identifies the time interval permitted to complete the Required Action. Upon expiration of the CT, the licensee is required to shut down the reactor or follow the Required Action(s) stated in the ACTIONS requirements. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or Required Actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance level of TS required equipment is unchanged and the Required Action(s), including the requirement to shut

down the reactor, are also unchanged, only the CTs for the Required Actions are extended by the RICT Program.

The NRC staff reviewed the licensee's PRA methods and models to determine whether they are technically acceptable for use in the proposed risk-informed CT extensions. The NRC staff also reviewed the licensee's proposed RICT program to determine whether it provides the necessary administrative controls to permit CT extensions.

3.1 Review of Key Principles RG 1.177 and RG 1.174 identify five key safety principles to be applied to risk-informed changes to the TSs. Each of these principles is addressed in NEI 06-09, Revision 0-A. The NRC staff's evaluation of the licensee's proposed use of RICTs against these key safety principles is discussed below.

3.1.1 Key Principle 1: Compliance with Current Regulations As stated in 10 CFR 50.36(c)(2), LCOs are "the lowest functional capability or performance levels of equipment required for safe operation of the facility. When [an LCO] of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the [TSs] until the condition can be met."

Generally, LCOs are established to preserve the single failure criterion for systems relied upon in the safety analysis report. The single failure criterion is a general design objective that is used to evaluate system designs to ensure that a single failure does not result in a TS loss of the capability of the system to perform its safety function or functions. Generic Letter 80-30, "Clarification of the Term 'Operable' as It Applies to Single Failure Criterion for Safety Systems Required by TS," dated April 10, 1980 (Reference 17), states, in part, that:

By and large, the single failure criterion is preserved by specifying Limiting Conditions for Operation (LCOs) that require all redundant components of safety related systems to be OPERABLE. When the required redundancy is not maintained, either due to equipment failure or maintenance outage, action is required, within a specific time, to change the operating mode of the plant to place it in a safe condition. The specified time to take action, usually called the equipment out-of-service time [termed Completion Time in the Standard Technical Specifications], is a temporary relaxation of the single failure criterion, which, consistent with overall system reliability considerations, provides a limited time to fix equipment or otherwise make it OPERABLE.

When the necessary redundancy is not maintained (e.g., one train of a two-train system is inoperable), the TSs permit a limited period of time to restore the inoperable train to OPERABLE status and/or take other remedial measures. If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two-train system inoperable, the TS safety function is accomplished by the remaining OPERABLE train. In the current TSs, the CT is specified as a fixed time period (termed the "front stop"). The addition of the option to determine the CT in accordance with the RICT Program would allow an evaluation to determine a configuration-specific CT.

The evaluation would be done in accordance with the methodology prescribed in NEI 06-09, Revision 0-A. The RICT is limited to a maximum of 30 days (termed the "back stop") and can

only be used when there is no TS or PRA loss of specified safety function (LOF). The CTs in the current TSs were established using experiential data, risk insights, and engineering judgement. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or Required Actions, if risk is assessed and managed appropriately within specified limits and programmatic requirements.

When the necessary redundancy is not maintained and the system loses the capability to perform its safety function(s) without any further failures (e.g., two trains of a two-train system are inoperable), there is a TS LOF and the plant must exit the mode of applicability for the LCO, or take remedial actions, as specified in the TSs. Under certain circumstances, a configuration-specific RICT may be determined and used following a TS LOF. However, Part (d) of proposed TS 5.5.20 would not allow the use of a RICT for voluntary entry into a configuration which represents a loss of safety (i.e., inoperability of all required trains of a system required to be OPERABLE) and other restrictions apply.

For unplanned events (i.e., "emergent conditions"), Part (e) of proposed TS 5.5.20 would permit the use of a RICT when there is a loss of TS safety function (i.e., all required trains required to be OPERABALE are determined to be inoperable), if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09, Revision 0-A. However, Part (e) of proposed TS 5.5.20 would constrain this RICT to a maximum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Furthermore, Part (f) of proposed TS 5.5.20 would require that SSCs credited in the PRA Functionality determination be the same SSCs relied upon to perform the TS safety function and that the same parameters be used as used in the design basis success criteria. Moreover, Part (g) of proposed TS 5.5.20 would present requirements for addressing the possibility of CC failure upon entering a RICT for emergent conditions. In addition, Part (h) of proposed TS 5.5.20 would disallow using a RICT for a TS LOF condition, if the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of PRA Functionality. These constraints ensure that the design basis success parameter values will be met any time a RICT is exercised and minimize the impact on the safety basis.

10 CFR Part 50, Appendix A, GDC 17 requirements are reflected, in part, in the electrical power systems TS LCOs, which require redundant electrical power sources/equipment to be operable (in operating modes). When a TS LCO is not met because an electrical power source/equipment required by a TS LCO is inoperable, the TS require the licensee to follow the remedial actions permitted by the TS until the LCO can be met or shut down the reactor. The current Farley TSs permit entry in a TS condition to restore the inoperable power source/equipment to operable status within a limited time period (i.e., CT). During the CT, when the licensee is in a TS condition for TS 3.8.1, 3.8.4, 3.8. 7, and 3.8.9, the 10 CFR Part 50, Appendix A, GDC 17 redundancy requirements for the required power sources are not met.

The licensee proposed the option to use the RICT program to extend the time for restoring the inoperable electrical power source/equipment to operable status beyond the existing CTs up to a maximum of 30 days.

During the RICT program entry for the proposed electrical TS conditions, when the LCO is not met due to the inoperable electrical power source/equipment, the redundancy required by the TS LCO (in operating modes) as specified in GDC17 will not be maintained. The NRC staff notes that operating the plant while remedial actions are being taken during the period of time the redundancy required by the GDC and LCO is not maintained is allowed by the regulation at 10 CFR 50.36(c)(2).

The licensee also proposed to add restrictions to specific LCOs to preclude entry into LCOs that may result in TS LOF. However, the licensee has proposed the use of a RICT for cases where the equipment may be PRA functional. With the incorporation of the RICT Program, the required performance levels of equipment specified in LCOs are not changed. Only the required CT for the Required Actions are modified by the RICT Program.

3.1.1.1 Key Principle 1 Conclusions Section 3.1.2 and 3.3.3 of this SE provides an evaluation of the defense-in-depth and safety margin considerations associated with the proposed RICT Program. For the reasons described in those sections and for the reasons described above, the NRC staff concludes that the requirements of 10 CFR 50.36 are satisfied. This ensures that the plant will be operated in accordance with the design (i.e., the application as amended) and is safe. Therefore, the requirements of 10 CFR 50.57(a)(2) and 10 CFR 50.57(a)(6) are met.

Based on the above, the NRC staff finds that the proposed changes meet the first key safety principle of RG 1.174 and RG 1.177.

3.1.2 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon.

Defense-in-depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures.

As discussed throughout RG 1.174, consistency with the defense-in-depth philosophy is maintained by the following:

Preserve a reasonable balance among the layers of defense.

Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

Preserve adequate defense against potential common-cause failures (CCFs).

Maintain multiple fission product barriers.

Preserve sufficient defense against human errors.

Continue to meet the intent of the plant's design criteria.

The proposed change represents a robust technical approach that preserves a reasonable balance among redundant and diverse key safety functions that provide avoidance of core damage, avoidance of containment failure, and consequence mitigation. The three-tiered

approach to risk-informed TS CT changes provides additional assurance that defense-in-depth will not be significantly impacted by such changes to the licensing basis. The licensee is proposing no changes to the design of the plant or any operating parameter, no new operating configurations, and no new changes to the design-basis in the proposed changes to the TS.

The effect of the proposed change when implemented will be that the RICT Program will allow CTs to vary based on the risk significance of the given plant configuration (i.e., the equipment out-of-service at any given time) provided that the system(s) retain(s) the capability to perform the applicable safety function(s) without any further failures (e.g., one train of a two-train system is inoperable). Though a configuration-specific RICT may be determined and used following a TS LOF, there are a number of restrictions as described above that ensure that the design basis success parameter values will be met any time a RICT is exercised. Accordingly, when PRA Functional and a RICT are applied to a TS LCO with sufficient trains remaining operable to fulfill the TS safety function, the operability of these remaining train(s) limits the magnitude of any reduction in defense-in-depth to a reduction that has been previously evaluated when the prescribed CT was approved. When the RICT is applied to a TS condition with all trains of equipment being declared inoperable, application of PRA Functional instead of the design basis functional capabilities may reduce the capability to fulfill the TS safety function beyond that previously approved in the LCO. However, this impact is mitigated by a number of restrictions stipulated in proposed TS 5.5.20, discussed below.

Part (f) of proposed TS 5.5.20 requires that SSCs credited in the PRA Functionality determination be the same SSCs relied upon to perform the TS safety function and that the same parameters be used in the PRA Functionality success criteria as used in design basis success criteria. This requirement ensures that there is no unanalyzed reduction in system redundancy, independence, and diversity because the SSCs designed to fulfill all design basis functions should be available and capable of providing the design basis success criteria parameters.

Part (g) of proposed TS 5.5.20 provides requirements for addressing the possibility of CC failure upon entering a RICT for emergent conditions. An important element of defense-in-depth is that defenses against potential CC failures are maintained and the potential for the introduction of new CC failure mechanisms is assessed. The potential for redundant trains to be affected from a CC is included quantitatively in the RICT calculation, or qualitatively in RMAs targeted toward ensuring that any potential CC failure will not cause a failure of the remaining redundant and/or diverse SSC fulfilling the affected TS function.

Part (d) of proposed TS 5.5.20 does not allow use of RICT for voluntary entry into a TS LOF configuration (i.e., inoperability of all required trains of a system required to be OPERABLE) and Part (e) of proposed TS 5.5.20 constrains this kind of RICT to a maximum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Part (h) of proposed TS 5.5.20 disallows using a RICT for a TS LOF condition, if the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of PRA Functionality. Also, Part (f.2) of proposed TS 5.5.20 states that the same parameters shall be used in PRA Functionality success criteria as used in design basis success criteria. Thus, any exposure to reduced defense-in-depth that might exist due to reliance on PRA Functional instead of the design basis functional capabilities is mitigated by the stipulations in proposed TS 5.5.20.

The NRC staff finds that the licensee's proposal to use RICTs for specific TS LOFs when applied together with the restrictions described above from Parts (d), (e), (f), (g), and (h) of

proposed TS 5.5.20 are acceptable for meeting the Key Principle 2 because the proposed change is consistent with defense-in-depth philosophy.

The PRA Functionality determination is also applicable without the stipulations of proposed TS 5.5.20 for situations in which the TS function is met but a redundant SSC for that TS function is TS inoperable. In this case, sufficient trains remain operable to fulfill the TS safety function, and the operability of the train(s) determined to be PRA Functional ensures redundancy.

The proposed RICT Program uses plant-specific operating experience for component reliability and availability data. Thus, the allowances permitted by the RICT Program are directly reflective of actual component performance in conjunction with component risk significance. In some cases, the RICT Program may use compensatory actions to reduce calculated risk in some configurations. Where credited in the PRA, these actions are incorporated into station procedures or work instructions and have been modeled using appropriate human reliability considerations. Application of the RICT Program determines the risk significance of plant configurations. It also permits the operator to identify the equipment that has the greatest effect on the existing configuration risk. With this information, the operator can manage the out-of-service duration and determine the consequences of removing additional equipment from service.

The application of the RICT Program places high value on key safety functions and works to ensure that they remain a top priority over all plant conditions. The RICT would be applied to extend CTs on key electrical power distribution systems. Failures in electrical power distribution systems can simultaneously affect multiple safety functions; therefore, potential degradation to defense-in-depth during the extended CTs are discussed further below.

3.1.2.1 Use of Compensatory Measures to Retain Defense-in-Depth Application of the RICT Program provides a structure to assist the operator in identifying effective compensatory actions for various plant maintenance configurations to maintain and manage acceptable risk levels. NEI 06-09, Revision 0-A, addresses potential compensatory actions and RMA measures by stating, in generic terms, that compensatory measures may include but are not limited to the following:

Reduce the duration of risk-sensitive activities.

Remove risk-sensitive activities from the planned work scope.

Reschedule work activities to avoid high risk-sensitive equipment outages or maintenance states that result in high-risk plant configurations.

Accelerate the restoration of out-of-service equipment.

Determine and establish the safest plant configuration.

The NEI 06-09, Revision 0-A, requires that compensatory measures be initiated when the PRA calculated RMA time (RMAT) is exceeded or, for preplanned maintenance for which the RMA T is expected to be exceeded, RMAs shall be implemented at the earliest appropriate time.

Therefore, quantitative risk analysis, the qualitative considerations, and the prohibition on loss of all trains of a required system ensure that a reasonable balance of defense-in-depth is

maintained to ensure the protection of public health and safety. The NRC staff finds that this proposed change meets the second key safety principle of RG 1. 177 and is, therefore, acceptable.

3.1.2.2 Evaluation of Electrical Power Systems This section is related to changes proposed for TS 3.8.1, TS 3.8.4, TS 3.8. 7, and TS 3.8.9, which have to do with electrical power systems.

3.1.2.2.1 System Description The Farley electric power design basis ca11 be found in Section 8.1.4 of the UFSAR.

Offsite Power Sources As stated in the UFSAR, the offsite and onsite power systems at the Farley Units 1 and 2 are designed to comply with the requirements of GDCs 17 and 18, respectively. The UFSAR states that the existing offsite power system consists of two physically independent sources of power for each unit. There are four startup auxiliary transformers, two for each unit, that are connected to the transmission system through four separate 230 kilo Volt (kV) oil-static cables.

These transformers provide a source of power for startup, shutdown, and operational requirements for both units. Under normal operating conditions, these startup transformers supply power to 4160 Volt (V) buses A, B, C, D, and E for Unit 1 and D and E only for Unit 2 along with 4160 V emergency buses F, G, H, J, K, and L. Susses Kand Lare considered extensions of busses F and G. The 4160V emergency buses F, H, and K of each unit and their associated emergency loads are designated as load group train A and the corresponding 4160V emergency buses G, J, and L of each unit and their associated emergency loads are designated as load group train B.

Onsite Alternating Current (AC) Power Sources The onsite AC power system consists of five diesel generators (DGs) with 1-2A and 1C assigned to the load group train A, while DGs 1B, 28, and 2C are assigned to the load group train B. DG 2C is dedicated to station blackout (SBO) events. The five DGs have two different ratings, DGs 1-2A, 1B, and 28 are rated at 4075 kilo Watt (kW) and DGs 1C and 2C are rated at 2850kW. Four of the DGs (i.e., DGs 1-2A, 1C, 1B, and 28) are dedicated for use during design basis events and DG 2C is dedicated as the alternate AC (MC) power source for use during a SBO event. DG 1C with a rating of 2850 kW does not have enough capacity to support accident loads required for safe shutdown of the units. This DG is selected to power the safety busses of the non-accident unit. DG configuration for mitigating consequences of accidents is described in the UFSAR as follows:

[DGs] 1Band 28 are uniquely dedicated to train B of Unit 1 and Unit 2, respectively. [DGs] 1-2A and 1C are shared between both units and are directly connectable to the units through dedicated breakers, not through bus interties.

[DGs] 1-2A and 1C are dedicated to train A, but there are no design basis events in which [DG] 1-2A or 1C supplies power to safety loads of both units simultaneously. In all events, [DGs] 1-2A and 1Care assigned to only one of the two units, depending on the event. The Unit 1 and Unit 2 breakers for each of these two [DGs] are interlocked so as to prevent the [DGs] from being connected to both units at the same time; therefore, [DGs] 1-2A and 1C are characterized

as "shared" only from the point of view of their capability to align to either Unit 1 or Unit 2.

Direct Current (DC) Power Systems The safety-related battery systems consist of two batteries for the auxiliary building and four batteries for the service water building (two batteries per train). The auxiliary building system for each unit consists of two 125 V-DC switchgear assemblies, three 125 V-DC battery chargers, two 125 V-DC batteries, and six DC distribution cabinets. Each 125 V-DC bus is supplied from one of the battery chargers with one battery floating on the bus. Each battery contains 60 lead calcium cells electrically connected in series to establish a nominal 125-V power supply. The auxiliary building station batteries have a rated capacity of 1300 ampere-hours based on a 2-h discharge rate at 77°F to 1. 75 V per cell average. The batteries provide the voltage required for operation of safety-related components for normal and accident conditions.

A separate 125 V-dc system for the service water area consists of two independent and redundant subsystems. Each subsystem consists of two battery/charger sets and two DC distribution panels. Either battery/charger set can provide 100-percent power to both DC distribution panels while recharging its batteries. The two DC distribution panels feed Unit 1, Unit 2, and shared loads. The majority of these loads are switchgear control supply. The batteries have a capacity of 75 ampere-hours based on an 8-hour discharge .rate to 1. 75 volts per cell. The battery load primarily includes switchgear controls and indication. Each battery has adequate storage capacity to carry its load without charger support for a period of at least two hours.

Inverters The 120V vital AC instrumentation distribution system of each unit consists of four redundant 120V vital AC instrumentation distribution panels A, B, C, and D. The inverters receive normal power from a vital 125V DC bus. These panels supply uninterruptible power for essential instrumentation and control loads under all operating conditions. Each panel receives 120V AC power from its own separate 7.5 kVA static inverter. The inverters receive normal power from a vital 125V DC bus. The normal supply to the static inverters is from 125V DC bus A for inverters A and B, and 125V DC bus B for inverters C and D. In the event of failure of the normal source, the vital AC instrumentation distribution panels from an alternate source. The alternate supply from 600V Motor Control Center (MCC) A is available via a regulating transformer and panel G for inverters A and B, and 600V MCC B supplies inverters C and D via a regulating transformer and AC distribution panel H.

Uninterruptible Power Supply for Auxiliary Feedwater Pump Each unit is equipped with a 3-kVA uninterruptible power system (UPS) assigned to provide a reliable source of control power, AC and DC, for the turbine-driven auxiliary feedwater pump and its associated steam admission and discharge valves. The UPS supplies control power to the following loads: 125 V-DC to the turbine-driven auxiliary feedwater pump control panel, 125 V-DC to the turbine-driven auxiliary feedwater steam admission valves, and 120 V-AC for the turbine-driven auxiliary feedwater pump speed control.

AC Power Distribution Systems The AC auxiliary system for each unit consists of the 4.16kV, 600V, 480V, 208V, and 120V subsystems, each designed to provide reliable electrical power during all modes of plant operation and shutdown conditions. Six 4.16-kVemergency buses, F, G, H, J, K, and L, supply equipment essential for the safe shutdown of the plant for each unit. These buses are supplied from two startup transformers connected to the offsite source during normal and emergency operating conditions. The safety-related safeguards distribution systems are arranged so that the loss of a single bus section results in only single losses of engineered safeguards. A redundant engineered safeguard circuit is available to perform the same function.

3.1.2.2.2 Key Principle 2: Evaluation of Defense-in-Depth (Electrical System)

The defense-in-depth philosophy is incorporated into the design of the electrical power systems by having multiple/redundant and independent layers of electrical power sources/subsystems to ensure power to equipment required to prevent and mitigate postulated design basis accidents (DBAs), events, transients, and abnormal occurrences assuming a single failure. The LCOs for the electrical power system TSs (in operating modes) require redundant electrical power sources/equipment that are/is capable of performing necessary safety functions assuming a single failure to be operable. If an electrical power source/equipment required by a TS LCO is inoperable, then the required redundancy (i.e., defense-in-depth) will be reduced or lost, the LCO will not be met, and an applicable TS condition will be entered for remedial actions.

The NRC staff reviewed the defense-in-depth of the electrical power systems for the TS conditions that would be impacted by the proposed RICT program. For this review, the staff evaluated the consequences of reduced defense-in-depth in plant systems in each proposed electrical power system TS condition to determine whether the change in the plant configuration, during the entry into the RICT program for the specific TS condition, is consistent with the defense-in-depth philosophy of having multiple layers of defense during plant operation to mitigate accidents. The staff reviewed information pertaining to the proposed electrical power system TS conditions in the application and the applicable TS LCOs to identify supplemental electrical power sources/equipment (not necessarily required by the LCOs) that are/is available at Farley and capable of performing the same safety function of the inoperable electrical power source/equipment.

The accident analyses for Farley classify plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public.

The four categories are:

A. Condition I - Normal operation and operational transients.

B. Condition II - Faults of moderate frequency.

C. Condition Ill - Infrequent faults.

D. Condition IV - Limiting faults.

Typically, Condition Ill and Condition IV faults involve release of radionuclides and loss of inventory which may result in fuel damage. These faults, coupled with postulated loss of offsite power (LOOP) event, are generally considered limiting or bounding conditions for safety systems required to mitigate the consequences of an accident. The staff evaluated the ability of available equipment to maintain safe shutdown following a Condition Ill or a Condition IV event coupled with reduced defense-in depth during entry into a RICT-related LCO.

For each electrical power system TS condition affected by the RICT program, the licensee provided the Farley design success criteria in Table E1 .1, "Revised TS LCO Conditions to Corresponding PRA Functions," of its letter dated July 27, 2018. Each TS condition design success criterion reflects the minimum electrical power source/subsystem required to be operable by the LCOs to support the minimum safety functions necessary to mitigate postulated DBAs, safely shut down the reactor, and maintain the reactor in a safe shutdown condition.

The NRC staff notes that since the use of the RICT program is based on the plant configurations provided in this application, this review of the defense-in-depth of the electrical power systems is limited to only this set of plant configurations.

3.1.2.2.3 NRC Staff Evaluation of Proposed Changes The NRC staff used information available in the Farley UFSAR, LAR, and supplements to the LAR, to evaluate the proposed changes.

Table E1 .1 of Enclosure 1 to the LAR provides a listing of each TS LCO Condition to which the RICT Program is proposed to be applied. This table documents the information regarding the TSs with the associated safety analyses including "Design Success Criteria" (the function success criteria as documented in the Technical Specifications bases and/or UFSAR) and "PRA Success Criteria" (the function success criteria modeled in the PRA).

The proposed RICT program can be used to extend the time for restoring the inoperable electrical power source/equipment to operable status beyond the existing CTs up to a maximum of 30 days. Table E1 .2 of Enclosure 1 provides typical calculated RICTs to demonstrate the effect on CDF and LERF for each individual condition to which the RICT Program applies. The LAR states:

These calculations were performed based on the use of separate zero-maintenance annual average PRA models which include the internal events PRA model, internal fire PRA model that reflects NFP-805 plant modifications, seismic bounding delta CDF/LERF values and main control room abandonment bounding delta CDF/LERF values ....

In addition, the RICT calculations in Table E1 .2 assume that a single SSC impacts the applicable TS LCO Condition for most cases; however, in some cases, more than one SSC was considered to impact the TS LCO Condition to ensure a more limiting case RICT can be generated for conditions that allow more than one train inoperable but do not meet the criteria for a loss of function.

In such cases there are two entries for that LCO. These estimates are based on a Unit 1 model calculation and are considered applicable to Unit 2 for the purpose of providing an estimate due to the close similarity between the Unit 1 and Unit 2 models.

The licensee also stated, "The actual RICT values during program implementation will be calculated based on the actual unit and plant configuration and the on-record version of the CRMP model available which represents the as-built and as-operated plant .... "

3.1.2.2.4 TS 3.8.1 - AC Sources-Operating During operation, the TS LCO 3.8.1 requires the following AC electrical sources to be operable:

a) Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System; and b) Two diesel generator (DG) sets capable of supplying the onsite Class 1E power distribution subsystem( s ); and c) Automatic load sequencers for Train A and Train B.

The Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate) and the onsite standby power sources (Train A and Train B DGs). The design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

Offsite power is supplied to the 230 kV switchyard from the transmission network by six transmission lines. From the 230 kV switchyard, two electrically and physically separated circuits provide AC power, through startup auxiliary transformers, to the 4.16 kV ESF Buses.

Each unit has two start up transformers, 1A and 1B for Unit 1 and 2A and 28 for Unit 2.

The onsite Class 1E AC Distribution System is divided into redundant load groups so that the loss of any one group does not prevent the minimum safety functions from being performed.

Each train has connections to two preferred offsite power sources and a single DG set. DG set A consists of the 1-2A and 1C DGs. DG set B consists of the 1B DG (Unit 1) and the 28 DG (Unit 2). DG 2C is dedicated as the alternate AC (AAC) power source for use during a SBO event.

3.1.2.2.4.1 TS 3.8.1 Condition A - One required offsite circuit inoperable The licensee proposed the option to use the RICT program to extend the existing 72-hour CT to restore the required offsite circuit to operable status for TS 3.8.1 Condition A. The example calculation in Table E1.2 indicates a RICT of 12.7 days related to CDF. According to Table E1 .1, the design success criteria for TS 3.8.1 Condition A is one qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System.

Therefore, during a RICT program entry for TS 3.8.1 Condition A, the remaining required offsite circuit and onsite DG sets will be capable of supplying power to the ESF systems required to mitigate DBAs with offsite power available. In case offsite power is lost concurrently with the DBAs, as assumed in the UFSAR Chapter 15 analysis, the two operable DG sets will have the capability to power the minimum ESF systems required to mitigate the DBAs.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition A, the defense-in-depth of the electrical power systems that ensure onsite AC power to key safety-related equipment required to operate during DBAs with or without offsite power is maintained with redundant DG sets.

3.1.2.2.4.2 TS 3.8.1 Condition B - One DG set inoperable The licensee proposed the option to use the RICT program to extend the existing 10-day CT to restore DG to operable status for TS 3.8.1 Condition 8. The example calculation in Table E1 .2 indicates a RICT of 30 days related to CDF.

As described above, Farley has 2 DG Sets, each set comprised of 2 DGs. Table E1 .1 and the UFSAR states that the design success criteria for TS 3.8.1 Condition B is one of two DG sets capable of supplying one train of the onsite Class 1E AC Electrical Power Distribution System.

Therefore, during a RICT program entry for TS 3.8.1 Condition 8, the remaining DG set, in addition to the two qualified offsite power circuits, will be capable of supplying power to ESF systems required to mitigate DBAs. In the event of loss of offsite power concurrent with the DBAs discussed in the UFSAR Chapter 15 analysis, the remaining DG set will be available to power the minimum ESF systems required to mitigate the consequences of postulated DBAs.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition 8, the defense-in-depth of the electrical power systems that ensure AC power to key safety-related equipment required to operate during DBAs is reduced to the available offsite power sources and one DG set or limited to one DG set in the event of complete loss of offsite power 3.1.2.2.4.3 TS 3.8.1 Condition C -Two required offsite circuits inoperable The licensee proposed the option to use the RICT program to extend the existing 24-hour CT to restore one offsite power source to operable status for TS 3.8.1 Condition C. The example calculation in Table E1 .2 indicates a RICT of 1.4 days related to CDF. At Farley, the offsite power system consists of two physically independent sources of power for each unit. There are four startup auxiliary transformers, two for each unit, that are connected to the transmission system through four separate 230 kV cables. Therefore, during a RICT program entry for TS 3.8.1 Condition C, the remaining onsite power system consisting of 2 DG sets will be capable of supplying power to ESF systems required to mitigate DBAs. This configuration is similar to the loss of offsite power concurrent with the DBAs discussed in the UFSAR Chapter 15 analysis.

The available DG sets can power the minimum ESF systems required to mitigate the consequences of postulated DBAs.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition C, the defense-in-depth of the electrical power systems that ensure AC power to key safety-related equipment required to operate during DBAs is reduced to the available onsite power sources only.

3.1.2.2.4.4 TS 3.8.1 Condition D - One required offsite circuit inoperable AND One DG set inoperable.

The licensee proposed the option to use the RICT program to extend the existing 24-hour CT to restore one offsite power source or one DG set to operable status for TS 3.8.1 Condition D.

The example calculation in Table E1 .2 indicates a RICT of 0.2 days related to CDF and 1.8 days for LERF.

According to Table E1 .1, the design success criteria for TS 3.8.1 Condition D is similar to the combined impact of LCO 3.8.1 Condition A and Condition 8, i.e., loss of one qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power

Distribution System coupled with loss of one DG set. Therefore, during a RICT program entry for TS 3.8.1 Condition D, the remaining required offsite circuit and one onsite DG set will be capable of supplying power to the ESF systems required to mitigate DBAs when offsite power is available.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition D, the defense-in-depth of the electrical power systems that ensure AC power to key safety-related equipment required to operate during DBAs is reduced to one DG set and one offsite power source or a single DG set when OBA concurrent with loss of offsite power is postulated in accordance with UFSAR Chapter 15 analysis.

3.1.2.2.4.5 TS 3.8.1 Condition E, F, G, and added Notes TS 3.8.1 Condition E: DG 1C is inoperable AND DG Set B inoperable TS 3.8.1 Condition F: DG 1-2A is inoperable AND DG Set B inoperable. Added Note:

"RICT entry is not permitted for this loss of function Condition when a second DG set is intentionally made inoperable."

TS 3.8.1 Condition G: DG 1C is inoperable AND DG 1-2A is inoperable AND DG Set B inoperable. Added Note: "RICT entry is not permitted for this loss of function Condition when a second DG set is intentionally made inoperable."

The current version of Farley LCO 3.8.1 Condition E (two DG sets inoperable) includes 3 CTs (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if all three DGs are inoperable OR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months if DG 1-2A and DG 1(2)8 are inoperable OR 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if DG 1C and DG 1(2)8 are inoperable) which correspond to different combinations of DG failures. The 2-hour CT is associated with all 3 DGs, capable of being aligned to a particular unit, declared inoperable. This failure combination includes DG 1-2A, DG 1C, and either DG 18 or DG 28. The 8-hour Completion Time is applicable when DG1-2A and either DG 1B or DG 28 are inoperable. The 24-hour Completion Time is applicable when DG 1C and either DG 1B or DG 28 are inoperable.

By email dated March 12, 2019, the NRC staff notified the licensee that it required additional information to complete its review. Specifically, in the request for additional information (RAI)

15, the NRC staff indicated that, for conditions that represent a LOF, or inoperability of all required trains of a system required to be OPERABLE, additional clarifying notes were needed.

The clarifying notes should provide restrictions applicable to the TS LOF Conditions, including a backstop of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , restricting voluntary entry into the TS LOF condition, and additional criteria for declaring SSCs PRA Functional. In response to this request by letter dated May 3, 2019, the licensee provided additional information. The response states:

For the combination of DG failures which currently has a 24-hour Completion Time, SNC will retain the current licensing basis and will not apply the RICT program to this combination of DG failures. SNC considers the combinations of DG failures with 2- and 8-hour Completion Times as useful candidates to apply the RICT program and agrees these combinations are a loss of function, which is consistent with the Vogtle safety evaluation. SNC will apply the appropriate LOF RICT program constraints to these conditions. Consequently, Condition E will need to be divided into three Conditions to incorporate this change, one Condition will be added for each of the Completion Times. The new TS markups

and clean type pages for LCO 3.8.1 are contained in Enclosures 2 (pages 3.8.1-4 and 3.8.1-5) and Enclosure 3 (3.8.1-5 through 3.8.1-15 or 16) to this letter.

The proposed new TS 3.8.1 Conditions E, F, and G reflect different combinations of inoperable DG sets. As discussed above, DG set A consists of the 1-2A and 1C DGs. DG set B consists of the 1B DG (Unit 1) and the 28 DG (Unit 2). With all or part of Train A DG set and Train B DG set inoperable, the capacity of the remaining standby AC sources is reduced depending on which combination of individual DGs is affected. The design success criteria for TS 3.8.1 proposed new Conditions E, F, and G rely on the qualified offsite power circuits and the onsite Class 1E AC Electrical Power Distribution System. In the event of loss of offsite electrical power, the remaining onsite (single) DG system may not have adequate power to mitigate the consequences of DBAs postulated in the UFSAR. The licensee considers operation of the unit for a short duration as a lower risk compared to an immediate shutdown as the loss of power to the transmission network may result in a grid perturbation. The length of time allowed to remain operable is relatively short. Since the DGs have different ratings, the licensee has proposed CTs that are commensurate with available capacity of the operable portion of the DG set.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 proposed new Condition E, F, and G, the defense-in-depth of the electrical power systems that ensure AC power to key safety-related equipment required to operate during DBAs is significantly reduced. For the new Condition E, the licensee has stated that the 24-hour CT will be maintained and RICT will not be considered. For Conditions F and G, the licensee has added a restriction to state that RICT entry is not permitted for this loss of function Condition when a second DG set is intentionally made inoperable. Therefore, the RICT entry will be considered only when DGs associated with Conditions F and G are considered inoperable.

Based on the low risk of a DBA during the short RICTs considered for these cases, the NRC staff finds the proposed rationale and changes to be acceptable 3.1.2.2.4.6 TS 3.8.1 Condition H - Required Action and associated Completion Time of Condition C, E, F, or G not met.

The proposed change does not require RICT evaluation. The licensee has proposed expanding existing Condition F (Required Action and associated Completion Time of existing Condition C or E not met) to include the proposed expansion of existing Condition E into proposed new Conditions E, F, and G. The renumbered TS 3.8.1 Condition H now incorporates all the elements of existing Condition E. The NRC staff finds this change to be acceptable.

3.1.2.2.4. 7 TS 3.8.1 Condition I - One automatic load sequencer inoperable Existing Condition G is proposed to be renumbered as Condition I. The licensee proposed the option to use the RICT program to extend the existing 12-hour CT to restore the sequencer to operable status for TS 3.8.1 renumbered Condition I. The example calculation in Table E1 .2 indicates a RICT of 17.1 days related to CDF.

At Farley, the sequencer enables a predetermined sequence of loading the DGs or actuates the ESF loads on the offsite circuits when offsite power is available. Thus, when the sequencer is inoperable, the associated DG set AND associated offsite power source are unavailable.

TS 3.8.1 Condition I is similar to TS Condition D though in this case the associated DG sets and offsite power source are available from a defense-in-depth perspective. Therefore, during a RICT program entry for TS 3.8.1 renumbered Condition I, the remaining required offsite circuit

and one onsite DG set will be capable of supplying power to the ESF systems required to mitigate DBAs when offsite power is available.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.1 renumbered Condition I, the defense-in-depth of the electrical power systems that ensure immediate AC power to key safety-related equipment required to operate during DBAs is reduced to one DG set and one offsite power source or a single DG set when OBA concurrent with loss of offsite power is postulated in conformance with UFSAR Chapter 15 analysis.

3.1.2.2.4.8 TS 3.8.1 Condition J - Required Action and associated Completion Time of Condition A, B, D, or I not met.

The proposed change does not require RICT evaluation. The licensee proposes to revise existing Condition H (Required Action and associated Completion Time of Condition A, B, D, or G not met) to include the proposed renumbered Condition I instead of existing Condition G. The renumbered TS 3.8.1 Condition I incorporates all the elements of existing Condition G. The NRC staff finds this change to be acceptable.

3.1.2.2.4.9 TS 3.8.1 Condition K - Three or more required AC sources inoperable Existing TS 3.8.1 Condition I (three or more required AC sources inoperable) is proposed to be renumbered as proposed new Condition K. Loss of three or more required AC sources results in a TS related LOF. The existing Required Action 1.1 requires immediate plant shutdown (LCO 3.0.3). This action was based on the severity of the degradation related to available power sources as any further losses in the AC electrical power system will cause a total LOF. The licensee is proposing a new Action K.1, "Restore required AC sources to OPERABLE status,"

with a proposed new CT of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR in accordance with the Risk Informed Completion Time Program. The licensee has also proposed adding a note stating that RICT entry is not permitted for this LOF Condition when a third AC source is intentionally made inoperable. As discussed above, the RICT program cannot be used for the voluntary removal of systems or components which would result in a loss of safety function. The licensee may use the RICT program when a third required AC source is found inoperable or when three or more required AC sources are simultaneously found inoperable. As discussed in the licensee response to RAI #15, when applicable, the RICT for this Condition cannot exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The licensee considers the operation of the unit for a short duration as a lower risk compared to an immediate shutdown, as the loss of AC power to the transmission network due to a unit shutdown may result in a grid perturbation. The length of time allowed to remain operable is relatively short. Since the loss of AC power sources results in significant degradation of available power sources, the licensee has proposed a CT that is commensurate with available resources and is, therefore, acceptable.

Based on the low risk of a OBA during the short RICTs considered for this case, the NRC staff finds the proposed rationale and changes to be acceptable.

3.1.2.2.4.10 TS 3.8.1 Condition L - Required Action and associated Completion Time of Condition K not met.

The licensee has proposed a new Condition L for when the Required Action and associated Completion Time of renumbered Condition K is not met. Condition L is not RICT-related but provides predetermined Required Action L.1 for the unit to be in MODE 3 within a CT of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND proposed new Required Action, L.2 for the unit to be in MODE 5 with a proposed CT of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

3.1.2.2.5 3.8.4 DC Sources-Operating During normal operation, LCO 3.8.4 requires the following DC systems:

The Train A and Train B Auxiliary Building and Service Water Intake Structure (SWIS)

DC electrical power subsystems shall be OPERABLE.

As discussed in the UFSAR, the 125 VDC electrical power system consists of two main systems. The Auxiliary Building System and the SWIS System. The Auxiliary Building 125 VDC system consists of two redundant subsystems (Train A and Train 8) which supply DC power to various ESF systems throughout the plant. Each Auxiliary Building subsystem (train) consists of a 125 VDC battery, an associated full capacity battery charger, and all associated control equipment and interconnecting cabling.

The SWIS 125 VDC system provides power for controls, power loads, and annunciation and alarms for the safety-related Service Water System. The SWIS 125 VDC system consists of four battery/battery charger subsystems. Each subsystem consists of a 125 VDC battery and full capacity battery charger. The subsystems are divided into Train A and Train B which are shared between the two units. Each of the 4 subsystems can supply 100 percent of the required capacity for the associated train. During normal operation, subsystem 1 is in service for Train A with subsystem 2 in standby mode. Similarly, for Train 8, subsystem 3 is in service with subsystem 4 in standby mode.

3.1.2.2.5.1 TS 3.8.4 Condition A - One Auxiliary Building DC electrical power subsystem inoperable.

The DC system powers various ESF systems throughout the plant. Loss of one DC train results in complete loss of AC and DC power sources associated with that train. The licensee proposed the option to use the RICT program to extend the existing 2-hour CT to restore the Auxiliary Building DC electrical power subsystem to operable status. The example calculation in Table E1 .2 indicates a RICT of 1.4 days related to CDF.

As stated in Table E1 .1, the design success criteria for TS 3.8.4 Condition A is one out of the two DC Systems. During a RICT program entry for TS 3.8.4 Condition A, the remaining DC system will be capable of supplying power to the DC loads required to mitigate DBAs with or without offsite power.

Based on the above, the NRC staff finds that during a RICT program entry for TS 3.8.4 Condition A, the defense-in-depth of the electrical power systems that ensure DC power to key safety-related equipment required to operate during DBAs with or without offsite power is reduced to one train of DC system (battery and charger). If one of the required DC electrical power subsystems is inoperable and a postulated single failure would result in the complete loss of the remaining 125 VDC electrical power subsystems resulting in complete loss of ESF functions, the RICT and front stop CT are relatively short for TS 3.8.4 Condition A. The NRC staff finds the proposed change to be acceptable.

3.1.2.2.5.2 TS 3.8.4 Condition B - One Auxiliary Building DC electrical power subsystem with battery connection resistance not within limit.

TS 3.8.4 Condition D - One required SWIS DC electrical power subsystem battery connection resistance not within limit.

The licensee proposed the option to use the RICT program to extend the existing 24-hour CTs to restore the battery connection resistance to within the limit for TS 3.8.4 Conditions B and D.

The example calculation in Table E1 .2 indicates a RICT of 30 days related to CDF and 30 days for LERF.

Conditions B and D represent one Auxiliary Building or one SWIS DC power subsystem with connection resistance not within the specified limit. This condition indicates that there is a potential increase in the resistance in the circuits associated with the battery system and the terminal voltage at the specific loads may not be adequate. Typically, the condition does not require the battery to be declared inoperable as it can, in most cases, perform the required safety function. The change in resistance is an early indication that the battery requires maintenance.

In the extreme case that the battery connection resistance has degraded to a condition whereby one battery (Auxiliary Building or SWIS) is not capable of performing its required safety function, then during a RICT program entry for TS 3.8.4 Condition B or D, the remaining DC system will be capable of supplying power to the DC loads required to mitigate DBAs with or without offsite power.

. Based on the above, the NRC staff finds that during a RICT program entry for TS 3.8.4 Condition B or D, the defense-in-depth of the electrical power systems that ensure DC power to key safety-related equipment required to operate during DBAs with or without offsite power will be maintained for a majority of instances when entry into this LCO is required. For the extreme case of significant degradation of connection resistance, the DC system (Auxiliary Building or SWIS) will be reduced to one train of DC system (battery and charger) and safe shutdown capability following a postulated OBA can be maintained. The NRC staff finds the proposed change to be acceptable.

3.1.2.2.5.3 TS 3.8.4 Condition F - Two or more DC electrical subsystems inoperable that result in a loss of function The licensee has proposed a new TS 3.8.4 Condition F to use the RICT program when two or more DC electrical subsystems are inoperable resulting in a LOF. The associated CT to restore one of the DC electrical subsystems to an operable status is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program. The example calculation in Table E1 .2 indicates a RICT of 1.4 days related to CDF. The licensee has also proposed a new Note to state that RICT entry is not permitted for this loss of function Condition when a second DC power electrical subsystem is intentionally removed from service.

As discussed in the licensee response to RAI #15, when applicable, the RICT for this Condition cannot exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The licensee considers operation of the unit for a short duration as a lower risk compared to an immediate shutdown, as the loss of AC power to the transmission network due to a unit shutdown may result in a grid perturbation. The length of time allowed to remain operable is relatively short. Since the loss of DC power sources results in significant degradation of available power sources, the licensee has proposed a CT that is commensurate with available resources.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.4 Condition F, the defense-in-depth of the electrical power systems that ensure DC power to key safety-related equipment required to operate during DBAs is significantly reduced. The licensee has added a restriction to state that RICT entry is not permitted for this loss of function Condition when a second DC electrical subsystem is intentionally made inoperable. Therefore, the RICT entry will be considered only when DC systems associated with the proposed new Condition F are inadvertently inoperable. Based on the low risk of a OBA during the short RICTs considered for these cases, the NRC staff finds the proposed rationale and changes to be acceptable.

3.1.2.2.5.4 TS 3.8.4 Condition G - Required Action and associated Completion Time of Condition F not met.

The licensee has proposed a new Condition G when the Required Action and associated Completion Time of proposed new TS 3.8.4 Condition Fis not met. Condition G is not RICT-related but provides predetermined Required Action G.1 for the unit to be in MODE 3 within a CT of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Required Action G.2 for the unit to be in MODE 5 with a CT of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Based on the significance of DC power sources and the risk of plant operation with inoperable but potentially available AC and DC power sources, the NRC staff finds the proposed short-duration CTs for Required Actions G.1 and G.2 to be reasonable to allow adequate time for orderly shutdown and acceptable based on the low risk of a OBA during the short period considered for this case.

3.1.2.2.6 3.8. 7 Inverters-Operating During normal operation, LCO 3.8. 7 requires the following inverter systems:

The required Train A and Train B inverters shall be OPERABLE.

There are four Class 1E inverters that supply the four vital AC distribution panels. The power for the inverters is from the Class 1E 125 VDC Trains A and B Auxiliary Building station batteries or their associated chargers. The four Class 1E inverters provide uninterruptible 120V, 60 Hz power for the systems such as reactor protection, engineered safety features actuation, nuclear steam supply control and monitoring instrumentation required for plant safety. UFSAR Chapter 15 analysis assumes that critical safety systems, such as reactor protection and engineered safety features systems, function in a timely manner to protect safety limits. Hence, the functionality of inverters is critical for response times of systems important to plant safety.

Each distribution panel can be connected to an alternate source of Class 1E 120 VAC power through a 120 V regulated constant voltage transformer. This alternate source does not have a battery back-up system and will, therefore, result in loss of power to the associated panel when the input AC power source is interrupted. Hence, this alternate AC source has a limited CT to prevent undue system actuations in case of loss of input AC power or voltage transients in the input AC power.

During normal operation, LCO 3.8.7 requires four inverters (Two Train A and Two Train B) to be operable.

3.1.2.2.6.1 TS 3.8. 7 Condition A - One required inverter inoperable The licensee proposed the option to use the RICT program to extend the existing 24-hour CT for restoring an inverter to operable status in TS 3.8. 7 Condition A The example calculation in Table E1 .2 indicates a RICT of 1.4 days related to CDF and 1.2 days for LERF (the staff notes that the DC bus failure was assumed in the RICT calculation).

As required by the current Note, the AC vital bus associated with the inoperable inverter will be manually re-energized from its alternate 120 VAC source through a regulating transformer.

Therefore, the AC vital bus associated with the inoperable inverter would be re-energized within*

the current 24-hour CT for TS 3.8. 7 Condition A prior to entering the RICT for TS 3.8. 7 Condition A Table E1 .1 identified the design success criteria for TS 3.8.7 Condition A as one train with 2 of 2 inverters (each train redundant). The NRC staff notes that 3 inverters will provide a single layer of defense since they are the minimum inverters required to support the minimum safety functions necessary to mitigate postulated DBAs.

During a RICT program entry for TS 3.8. 7 Condition A, the remaining 3 inverters will be capable of providing uninterruptible AC power to the AC vital buses required during Anticipated Operational Occurrences (AOOs) or DBAs with or without offsite power. In addition, the alternate 120 VAC bus fed from an ESF MCC through a regulating transformer will provide power to the AC vital bus associated with the inoperable inverter when offsite power or onsite AC power is available.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8. 7 Condition A, one complete train of equipment required to be actuated in time commensurate with assumptions in the accident analysis will be available to mitigate the consequences of postulated DBAs and AOOs. The NRC staff find the proposed change to be acceptable.

3.1.2.2.6.2 TS 3.8. 7 Condition C - Two or more required inverters inoperable.

The licensee has proposed a new TS 3.8. 7 Condition C to use the RICT program when two or more required inverters are inoperable resulting in a loss of function. The associated CT to restore one of the inverter to an operable status is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program. The example calculation in Table E1 .2 indicates a RICT of 30 days related to CDF. The licensee has also proposed a new Note to state that RICT entry is not permitted for this loss of function Condition when the second required inverter is intentionally made inoperable.

As discussed in the licensee response to RAI #15, when applicable, the RICT for this Condition cannot exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The licensee considers operation of the unit for a short duration as a lower risk compared to an immediate shutdown, as the loss of AC power to the transmission network due to a unit shutdown may result in a grid perturbation. The length of time allowed to remain operable is relatively short.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8. 7 Condition C, the capability to actuate the safety-related equipment required to operate during DBAs and AOOs is significantly reduced. The licensee has added a restriction to state that RICT entry is not permitted for this loss of function Condition when the second inverter is intentionally made inoperable. Therefore, the RICT entry will be considered only when inverters

associated with the new TS 3.8. 7 Condition C are inadvertently inoperable. The NRC staff finds the proposed rationale and changes to be reasonable and acceptable based on the low risk of a OBA during the short RICTs considered for these cases.

3.1.2.2.6.3 TS 3.8. 7 Condition D - Required Action and associated Completion Time of Condition C not met.

The licensee has proposed a new TS 3.8. 7 Condition D when the Required Action and associated Completion Time of Condition C is not met. The proposed new Condition Dis not RICT-related but provides predetermined Required Action D.1 for the unit to be in MODE 3 within a CT of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Required Action D.2 for the unit to be in MODE 5 within a proposed CT of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Based on the significance of uninterruptible AC power provided by the inverters, and the risk of plant operation with potential delay in actuation of safety systems, the NRC staff finds the proposed short-duration CTs for Required Actions D.1 and D.2 to be reasonable to allow adequate time for orderly shutdown and acceptable based on the low risk of a OBA during the short period considered for this case.

3.1.2.2.7 3.8.9 Distribution Systems-Operating During normal operation, LCO 3.8.9 has the following requirements:

Train A and Train B AC, DC, and AC vital bus electrical power distribution subsystems shall be OPERABLE.

The onsite Class 1E AC, DC, and AC vital bus electrical power distribution systems are divided into two redundant and independent AC, DC, and AC vital bus electrical power distribution trains. The AC electrical power subsystem for each train consists of a primary ESF 4.16 kV bus and secondary 600 and 208/120 V buses, distribution panels, motor control centers, and load centers. Each train of 4.16 kV ESF buses has at least one offsite source of power and an onsite DG source.

The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters. DC and AC vital bus electrical power distribution systems are designed to ensure the availability of necessary power to ESF systems to ensure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.

3.1.2.2. 7.1 TS 3.8.9 Condition D - One or more AC electrical distribution subsystems inoperable for reasons other than Condition A, 8, or C The licensee proposed the option to use the RICT program to extend the existing 8-hour CT for restoring one or more AC power distribution subsystems to operable status in TS 3.8.9 Condition D. Per TS 3.8.9, Condition A represents Load Center 1-2R inoperable due to power supply being unavailable from Unit 1 or Unit 2, Condition B represents Required Action and associated Completion Time of Condition A not met, and Condition C represents Load Center 1-2R inoperable for reasons other than Condition A or B.

According to the LAR, the loss of one or more AC electrical distribution subsystems is confined to either one of the two trains of safety-related systems. As described above, Farley has 2

Trains of AC distribution system and each train can supply adequate power for safe shutdown of the unit following a postulated OBA. Table E1 .1 and the UFSAR state that the design success criterion for TS 3.8.9 Condition D is one train of the onsite Class 1E AC Electrical Power Distribution System. Therefore, during a RICT program entry for TS 3.8.9 Condition D, the remaining AC system train with available onsite and offsite power systems will be capable of supplying power to ESF systems required to mitigate DBAs. In the event of loss of offsite power*

concurrent with the DBAs discussed in the UFSAR Chapter 15 analysis, the remaining DG set will be available to power the minimum ESF systems required to mitigate the consequences of postulated DBAs.

The NRC staff finds that with one or more required AC buses, load centers, motor control centers, or distribution panels inoperable in one train (A or B), for reasons other than Condition A, B, or C, and a loss of safety function has not yet occurred, the,remaining AC electrical power distribution subsystems are capable of supporting the minimum safety function necessary to shut down the reactor and maintain it in a safe shutdown condition.

Since the loss of one complete train of AC system significantly reduces the overall defense-in depth of the AC system, and a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported, the proposed RICT and CT are relatively short for this LCO. The NRC staff finds the proposed change to be acceptable.

3.1.2.2. 7.2 TS 3.8.9 Condition E- One or more AC Vital buses inoperable The licensee proposed the option to use the RICT program to extend the existing 8-hour CT for restoring one or more AC vital buses to operable status in TS 3.8.9 Condition E. According to the LAR, the loss of one or more AC Vital buses (powered from an inverter) is confined to either one of the two trains of safety-related systems and there is no loss of safety function.

Table E1 .1 identified the design success criteria for TS 3.8.9 Condition E as one Train with 2 of 2 distribution panels (each train redundant). During a RICT program entry for TS 3.8.9 Condition E, the remaining 2 inverters and the associated distribution panels in the redundant train will be capable of providing uninterruptible AC power to the AC vital buses required during AOOs or DBAs with or without offsite power. The alternate 120 VAC bus( es) fed from a regulating transformer( s) may not be available as the associated Vital bus( es) may be inoperable.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition E, one complete train of equipment required to be actuated in time commensurate with assumptions in the accident analysis will be available to mitigate the consequences of postulated DBAs and AOOs. The NRC staff finds the proposed change to be acceptable.

3.1.2.2.7.3 TS 3.8.9 Condition F - One Auxiliary Building DC electrical power distribution subsystem inoperable.

The licensee proposed the option to use the RICT program to extend the existing 2-hour CT for restoring the Auxiliary Building DC electrical power distribution subsystem to operable status in TS 3.8.9 Condition F. The LAR does not identify this Condition resulting in LOF, hence the loss of one or more DC system components (battery, battery charger, DC busses, etc.) is confined to either one of the two DC trains of safety-related systems and there is no loss of safety function.

Table E1 .1 identified the design success criteria for TS 3.8.9 Condition Fas one Train with 2 of 2 distribution panels (each train redundant). During a RICT program entry for TS 3.8.9 Condition F, the remaining Auxiliary Building Battery and associated DC distribution panels in the redundant train will be capable of providing DC to the loads required during AOOs or DBAs with or without offsite power. The DC system is critical for response time and functioning of ESF equipment. When the plant is in the LCO related to Condition F, the unit is significantly more vulnerable to a complete loss of all DC power. Hence, the CTs (and RICTs) are relatively short to restore the DC system.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition F, one complete train of equipment required to be actuated in time commensurate with assumptions in the accident analysis will be available to mitigate the consequences of postulated DBAs and AOOs. The NRC staff finds the proposed change acceptable.

3.1.2.2.7.4 TS 3.8.9 Condition I - Two trains with inoperable electrical distribution subsystems that result in a loss of safety function.

The licensee has proposed a revised TS 3.8.9 Condition I to use the RICT program when two trains with inoperable electrical distribution subsystems result in a loss of function. The associated CT to restore one of the trains to an operable status is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program. The example calculation in Table E1 .2 indicates a RICT of 0.2 days related to CDF. The licensee has also proposed a new Note to state that RICT entry is not permitted for this loss of function condition when two or more electrical power distribution trains are intentionally made inoperable.

As discussed in the licensee response to RAI #15, when applicable, the RICT for this Condition cannot exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The licensee considers operation of the unit for a short duration as a lower risk compared to an immediate shutdown, as the loss of AC power to the transmission network due to a unit shutdown may result in a grid perturbation. The length of time allowed to remain operable is relatively short.

Based on the above, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition I, the capability to actuate the safety-related equipment required to operate during DBAs and AOOs is significantly reduced. The licensee has added a restriction to state that RICT entry is not permitted for this loss of function Condition when two electrical power distribution trains are intentionally made inoperable. Therefore, the RICT entry will be considered only when electrical power distribution trains associated with TS 3.8.9 Condition I are inadvertently inoperable. Based on the low risk of a OBA during the short RICTs considered for these cases, the NRC staff finds the proposed rationale and changes to be acceptable.

3.1.2.2.7.5 TS 3.8.9 Condition J - Required Action and associated Completion Time of Condition I not met.

The licensee has proposed a new TS 3.8.9 Condition J when the Required Action and associated Completion Time of proposed revised TS 3.8.4 Condition I is not met. TS 3.8.9 Condition J is not RICT-related but provides predetermined Required Action J.1 for the unit to be in MODE 3 within a CT of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Required Action J.2 for the unit to be in MODE 5 within a CT of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Based on the significance of distribution subsystems that are inoperable resulting in a loss of function, and the risk of plant operation with potential delay in actuation and operation of safety

systems, the NRC staff finds the proposed short-duration CTs for Actions J.1 and J.2 to be reasonable to allow adequate time for orderly shutdown and acceptable based on the low risk of a OBA during the short period considered for this case.

3.1.2.2.8 Risk Management Actions By determining which SSCs are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. Oto the LAR, "Risk Management Action Examples," describes the process for identification of RMAs applicable during extended Completion Times and provides several examples of RMAs for Farley. The NRC staff reviewed some of the examples of RMAs that are considered during a RICT so that the increased risk is reduced and to ensure that adequate defense-in-depth is maintained. Examples include:

A) TS LCO 3.8.1, Condition B (One DG set inoperable):

1) The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions;

2) Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit;

3) Deferral of maintenance that affects the reliability of the trains associated with the operable DGs;

4) Deferral of planned maintenance activities on station blackout mitigating systems, and treating those systems as protected equipment; and

5) Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.

B) TS LCO 3.8.4, Condition B (One Auxiliary Building DC electrical power subsystem with battery connection resistance not within limit):

1) Limit the immediate discharge of the affected battery, if possible;

2) Recharge the affected battery to float voltage conditions using a spare battery charger, if possible;

3) Evaluate the remaining battery capacity and protect its ability to perform its safety function; and

4) Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries.

The NRC staff review of RMAs concluded that the proposed actions are reasonable for reducing the risk of cascading events that may result in further degrading safe shutdown capabilities or adversely impacting the consequences of postulated AOOs and DBAs, and are, therefore, acceptable.

3.1.2.2.9 NRC Staff Electrical Evaluation Conclusion The NRC staff reviewed the proposed changes to Farley electrical power systems TS 3.8 that would add and/or change CTs evaluated in accordance with the RICT Program for certain required actions of the proposed TS.

Based on the above, the NRC staff determined that the proposed changes: (1) meet the intent of the design criteria described in GDC 17 concerning availability, capacity, and capability of the electrical power systems since the proposed changes do not make any design bases changes to the plant and are consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance levels of equipment required for safety is maintained; (2) allow operation of the plant to continue with adequate defense-in-depth; and (3) ensure safety margins are maintained during the implementation of the RICT Program. The NRC staff also concludes that the proposed changes are consistent with RG 1.174 and RG 1. 77, and are, therefore, acceptable.

3.1.2.3 Evaluation. of Instrumentation and Control Systems The licensee has not included instrumentation and control TS in the RICT Program. Therefore, no review of Instrumentation and Control Systems was necessary for this LAR.

3.1.2.4 Key Principle 2 Conclusions The LAR proposes to modify the TS requirements to permit extending selected CTs using the RICT Program in accordance with NEI 06-09, Revision 0-A. The NRC staff reviewed the licensee's proposed TS changes and supporting documentation. The NRC staff finds that extending the selected CTs with the RICT Program following loss of redundancy, but maintaining the capability of the system to perform its safety function, is an acceptable reduction in defense-in-depth provided that the licensee identifies and implements compensatory measures, as appropriate, during the extended CT.

The NRC staff further evaluated key safety functions in the proposed CT extensions and concluded that (1) the changes maintain the intent of the design criteria; (2) the specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences preserving system redundancy, independence, and diversity commensurate with the expected frequency, consequences of challenges to the system, and uncertainties; and (3) sufficient capacity and capability is maintained to ensure that containment integrity and other vital functions are maintained in the event of postulated accidents preserving the independence of barriers.

The NRC staff concludes that the proposed changes are consistent with the defense-in-depth philosophy with respect to the requirements in GDC 17 concerning availability, capacity, and capability of the electrical power systems. The proposed changes are also consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance levels of equipment required for safety is maintained. Therefore, the NRC staff concludes that the proposed changes are consistent with the principle of defense-in-depth, and are, therefore, acceptable.

3.1.3 Key Principle 3: Evaluation of Safety Margins The safety margin is the distance between the bounding prediction of the load and the point at which failure becomes non-negligible on the capacity probability density function. In nuclear power plant design, safety margins are ensured by setting conservative safety limits and

keeping operating conditions below the safety limits by an amount that is at least commensurate with the uncertainty of the load. For this review, the NRC staff considered the consequences of equipment that was not available due to entry into RICT and the available safe shutdown equipment to ensure that design margins are not adversely impacted.

Section 2.2.2 of RG 1.177 states, in part, that sufficient safety margins are maintained when:

Codes and standards ... or alternatives approved for use by the NRC are met. ...

Safety analysis acceptance criteria in the final safety analysis report (FSAR) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainties ....

The licensee is not proposing to change any quality standard, material, or operating specification. In the LAR, the licensee proposed to add a new program, "Risk Informed Completion Time Program," in Section 5.0, "Administrative Controls," of the TSs, which would require adherence to NEI 06-09, Revision 0-A.

The NRC staff evaluated the effect on safety margins when the RICT is applied to extend the CT up to a backstop of 30 days in a TS condition with sufficient trains remaining operable to fulfill the TS safety function. Although SNC will be able to have design basis equipment out of service longer than the current TS allow, any increase in unavailability is expected to be insignificant and is addressed by the consideration of the single failure criterion in the design-basis analyses. Acceptance criteria for operability of equipment are not changed and, if sufficient trains remain operable to fulfill the TS safety function, the operability of the remaining train(s) ensures that the current safety margins are maintained. The NRC staff finds that if the specified TS safety function remains operable, sufficient safety margins would be maintained during the extended CT of the RICT program. The NRC staff has evaluated specific proposed changes to the TS as described in Section 2.2 of this SE.

After entry into a TS condition, an emergent failure may occur that results in insufficient trains of equipment remaining operable to perform the specified TS safety function. NEI 06-09, Revision 0-A, states and the licensee's proposed TS change allows that for emergent conditions, a RICT may be applied for a TS LOF conditions given that one or more of the trains are PRA Functional. Unlike the situation when a RICT is applied to a TS condition with sufficient trains remaining operable to fulfill the TS safety function, the application of PRA Functionality could reduce the remaining capability of the mitigative functions beyond that previously approved. This is especially true if alternative SSCs other than those relied upon to perform the TS safety function are credited in the PRA Functionality determination. However, the limitation stipulated in Part (f.1) of proposed TS 5.5.20 states that PRA Functionality shall credit the same SSCs relied on in the TS safety function. Also, Part (f.2) of proposed TS 5.5.20 states that the same parameters shall be used in PRA Functionality success criteria as used in design basis success criteria. Thus, any reduction in the safety margin is minimal and therefore acceptable.

Safety margins are also maintained if PRA Functionality is determined for the inoperable train which would result in an increased CT. Credit for PRA Functionality, as described in NEI 06-09, Revision 0-A, is limited to the inoperable train, loop, or component. The reduced but available functionality may support further increase in the CT consistent with the risk of the configuration.

During this increased CT, the specified safety function is still being met by the operable train

and therefore requires no evaluation of PRA Functionality to meet the design basis success criteria.

3.1.3.1 Key Principle 3 Conclusions Based on the above, the NRC staff finds that the proposed changes do not invalidate the Farley design-basis analyses. Although the licensee will be able to have design-basis equipment out of service longer than the current TSs allow and the likelihood of successful fulfillment of the safety functions will be decreased when redundant train(s) are not be available, the capability to fulfill the function will be retained. Any increase in unavailability is included in the RICT evaluation. Therefore, safety margin reductions are minimized by the constraints in the RICT Program discussed in this SE. Based on the above, the NRC staff concludes that the proposed changes meet the third key safety principle of RG 1.177 and are, therefore, acceptable.

3.1.4 Key Principle 4: Change in Risk is Small and Consistent with the Safety Goal Policy Statement The proposed RICT states that it "must be implemented in accordance with NEl-06-09, Revision 0-A, 'Risk-Managed Technical Specifications (RMTS) Guidelines."'

NEI 06-09, Revision 0-A, provides a methodology for a licensee to evaluate and manage the risk impact of extensions to TS CTs. Permanent changes to the fixed TS CTs are typically evaluated by using the three-tiered approach described in RG 1.177 and RG 1.174. This approach addresses the calculated change in risk as measured by the change in CDF and LERF, as well as the ICCDP and ICLERP; the use of compensatory measures to reduce risk; and the implementation of a CRMP to identify risk-significant plant configurations.

The NRC staff evaluated the licensee's proposed changes against the three-tiered approach in RG 1.177 for a licensee's evaluation of the risk associated with a proposed TS CT change.

3.1.4.1 Tier 1: PRA Capability and Insights Tier 1 evaluates the impact of the proposed changes on plant operational risk. The Tier 1 review involves two aspects: ( 1) the technical acceptability of the PRA models and their application to the proposed changes, and (2) a review of the PRA results and insights described in the licensee's application.

Farley does not have diverse and flexible coping strategies {FLEX) and associated equipment incorporated into its PRA models; therefore, no review of FLEX modeling strategies were considered in the evaluation of this LAR.

3.1.4.1.1 PRA Technical Acceptability The RG 1.174 states that the scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process. The NRC's SE as described in NEI 06-09, Revision 0-A, states that the PRA models should conform to the guidance in RG 1.200, Revision 1. The current version of RG 1.200 is Revision 2, which clarifies that the currently applicable ASME/ANS PRA standard is ASME/ANS RA-Sa-2009, "Addenda to ASME RA-S-2008, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications." The Farley PRA model used the current ASME/ANS PRA standard and RG 1.200 as noted below. The

Farley PRA model is composed of an Internal Events PRA (IEPRA) (including internal flooding) and a Fire PRA. The licensee screened out all external hazard events, as described in Section 3.1.4.1.2 of this SE, as insignificant contributors to RICT calculations. The Farley PRA model with modifications is used as the CRMP model as described in Section 3.1.4.1.3 of this SE.

Internal Events PRA (including Internal Flooding)

The licensee's evaluation of the technical adequacy of its IEPRA model included a full-scope peer review and a Facts and Observations (F&O) closure review. A full-scope peer review of the Farley IEPRA was performed in March 2010 using the process defined in NEI 05-04 (Reference 18) in accordance with the ASME/ANS RA-Sa-2009 PRA standard and RG 1.200, Revision 2. In response to RAI 01 and RAI 02, the licensee stated that in October 2018, an independent assessment (IA) team conducted an on-site F&O closure review performed in conformance with the F&O closure process guidance in NEI letter dated February 21, 2017, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)" (Reference 19) as accepted in NRC letter dated May 3, 2017 (Reference 20). The licensee stated that all Finding-level F&Os, including findings against PRA supporting requirements that were met at CC-II were provided to the IA team for the F&O closure review.

The licensee further stated that the IA team concluded that (1) all F&Os were closed and (2)° none of the model changes constituted a PRA upgrade. The licensee confirmed that closure of all finding-level F&Os was assessed to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements, associated with the closed F&Os now meet CC-II of the ASME/ANS PRA standard. During an onsite audit from February 5-9, 2019 (Reference 7),

the NRC staff reviewed the licensee's internal events PRA F&O closure. The NRC staff noted that the closure of all finding-level F&Os now meets CC-II of the ASME/ANS PRA standard.

In LAR Enclosure 7, the licensee states that "[t]he plant has been modified to install the RCP

[Reactor Coolant Pump] shutdown seals developed by Westinghouse" which were "modeled consistent with WCAP-17100" (Reference 21). The guidance in WCAP-17100 applies to Westinghouse Generation I and II shutdown seals (SOS). However, in the licensee's October 12, 2017, response to NRC RAls for its Containment Integrated Leakage Rate Testing Program (Reference 22), the licensee stated that the PRA includes credit for Westinghouse Generation Ill RCP Shutdown seals (Gen Ill SOS). Therefore, in RAI 05, the NRC staff requested clarification of the kind of RCP seals that are installed at Farley, how those seals are credited in the IEPRA and Fire Probabilistic Risk Assessment (FPRA) models, and whether the modeling is in conformance with the limitations and conditions prescribed in the NRC's SE (Reference 23) of Topical Report (TR} Pressurized-Water Reactor Owners Group (PWROG)-14001-P, Revision 1 (Reference 24) for modeling the Westinghouse Gen Ill SOS.

The NRC staff also requested clarification of whether the RCP seal modeling has been subject to a peer review. In response to RAI 05, the licensee explained that the Westinghouse Gen Ill SOS are installed in all RCPs at Farley and that the IEPRA and FPRA models credit these seals. The licensee explained that the guidance in PWROG-14001-P, Revision 1, was used to model the SOS and that no exceptions were taken to the limitations and conditions prescribed in the NRC SE for the Westinghouse Gen Ill SOS. The licensee stated that the RCP seal modeling has not been subject to a peer review. The licensee asserted that the seal modeling is not an upgrade but rather an expansion of RCP seal modeling based on the guidance in WCAP-15603, Revision 1-A, "WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs," (Reference 25) that was peer reviewed. The licensee stated that the differences between the PWROG-14001-P and WOG 2000 seal models concern the failure probabilities applied, the expected seal leakages, and the modeling of operator actions. Given that the licensee followed the guidance in PWROG-14001-P and took no exceptions to the

limitations and conditions laid out in the NRC SE of PWROG-14001-P, the NRC staff finds it unlikely that a focused-scope peer review would identify oversights in the modeling that could impact the application. The NRC staff also notes that a PWROG-14001-P, Revision 1, RCP seal model can be developed with additions and adjustments of a WOG 2000 RCP seal model.

Accordingly, the NRC staff finds the licensee's modeling to the RCP SOS acceptable.

Based on its review, the NRC staff finds that the IEPRA, including internal flooding, had been adequately peer reviewed against the current versions of the PRA standard and RG 1.200 and that the licensee has adequately closed the F&Os; therefore, the IEPRA, including internal flooding, is technically acceptable to support the RICT Program, including RICT calculations.

Fire PRA The licensee's evaluation of the technical adequacy of its Fire PRA (FPRA) model included a full-scope peer review, two focused-scope peer reviews, and an F&O closure review. A full-scope peer review of the Farley FPRA was performed in March 2012 using the process defined in NEI 07-12 (Reference 26) in accordance with the ASME/ANS RA-Sa-2009 PRA standard and RG 1.200, Revision 2. In response to RAI 01, the licensee explained that in January 2018, a focused-scope peer review was performed to review updates to the FPRA made as part of Farley's National Fire Protection Association (NFPA) 805 implementation, which constituted a change in methodology, that incorporated guidance on incipient fire detection, spurious operation treatment, guidance for cable tray fires, and guidance for junction box fires. In response to RAI 01 and RAI 02, the licensee explained that in April 2018, an IA team conducted an on-site F&O closure review in conformance with the F&O closure process guidance in NEI letter dated February 21, 2017, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-out of Facts and Observations (F&Os)" as accepted in NRC letter dated May 3, 2017. Finally, a second focused-scope peer review was performed in July 2018 to address upgrades identified by the IA team, which concerned fire ignition sources characterized using one fire intensity and the treatment of secondary combustibles.

The licensee stated that as part of the F&O closure process, additional review and consensus sessions were conducted remotely after the April 2018 on-site IA review, between April and September 2018. The licensee stated that all Finding-level F&Os, including findings against PRA supporting requirements that were met at CC-II and the one finding-level F&O issued during the January 2018 focused-scope peer review, were provided to the IA team for the F&O Closure review. The licensee stated that the IA team concluded that all F&Os were closed and that no model changes constituted a PRA upgrade, except for the resolutions of two F&Os which were determined to constitute a PRA upgrade and were subject to the July 2018 focused-scope peer review. Finally, the licensee stated that closure of all finding-level F&Os was assessed to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements, associated with the closed F&Os now meet CC-II of the ASME/ANS PRA standard.

In RAI 02.e, the NRC staff noted that the F&O closure process is intended to address resolution of findings presented to the IA team prior to the onsite review. Therefore, the NRC staff requested the licensee to provide any F&Os resulting from any focused-scope peer reviews that were performed concurrently with or after the April 2018 on-site F&O closure review. In response to RAI 02.e, the licensee provided two F&Os that resulted from the July 2018 focused-scope peer review, along with their associated dispositions. The NRC staff reviewed these two F&Os and the licensee's description of their resolution. The NRC staff found that the two F&Os are related to PRA documentation and, therefore, concluded that they have no impact on the application.

Because the FPRA F&O closure review process occurred prior to the IEPRA F&O Closure process, in RAI 03, the NRC staff requested confirmation that the modeling updates performed for the internal events PRA to resolve Finding-level internal events F&Os were also incorporated into the FPRA or justification for why these updates do not apply to the fire PRA or do not have a consequential impact on this application. In response to RAI 03, the licensee stated that the IEPRA updates included incorporation of periodic data update, dual unit loss of service water via loss of the service water dam and river water initiator model, new pre-initiator human failure events (HFEs) for the Diesel Fuel Oil system, detailed human reliability analysis (HRA) on post-initiator HFEs used as screening values, and an updated HRA dependency analysis. The licensee proposed a license condition to incorporate the updates from the F&O resolutions of the internal flooding PRA model into the FPRA prior to implementation of the RICT program (discussed in Section 4.0 of this SE). Therefore, the NRC staff finds that this has no impact on the application.

In response to RAI 05, the licensee explained, as described previously in this SE, that it credited its Westinghouse Gen Ill SOS in the FPRA. Therefore, as similarly described above for the IEPRA review, the NRC staff finds that the licensee's modeling of the RCP SOS in the FPRA is acceptable because (1) it is in conformance with guidance in PWROG-14001-P, (2) no exceptions were taken to the limitations and conditions prescribed in the NRC SE for the Westinghouse Gen Ill SOS, and (3) the modeling of the Westinghouse Gen Ill SOS is an expansion of the older WOG 2000 RCP seal modeling.

In RAI 06, the NRC staff observed that after the issuance of the SE to Farley for implementation of its NFPA 805 program, NRC has issued updated guidance for aspects of the fire PRA that supplants earlier guidance. Accordingly, the NRC staff requested clarification of whether guidance from the following NRC guidance documents has been incorporated into the Farley FPRA that will be used in the RICT program:

NUREG-2180, "Determining the Effectiveness, Limitations, and Operator Response for Very Early Warning Fire Detection Systems in Nuclear Facilities (DELORES-VEWFIRE)," regarding the updated approach to credit incipient fire detections systems (Reference 27);

NUREG-2169, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database," regarding changes in fire ignition frequencies and non-suppression probabilities (Reference 28);

NUREG/CR-7150, "Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE)," Volume 2, "Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure," regarding possible increases in spurious operation probabilities (Reference 29).

In response to RAI 06, the licensee stated that guidance from the cited guidance documents has been incorporated into the Farley FPRA that will be used in the RICT program.

As a result of the review of the LAR and its supplements, the NRC staff concludes that the licensee has demonstrated that the FPRA adequately meets the SRs in ASME/ANS-RA-Sa-2009, as clarified by RG 1.200, Revision 2, and after completion of the implementation item listed in the license condition, the FPRA will be technically adequate to support the RICT Program, including RICT calculations.

PRA Technical Acceptability Conclusions Based on its review of the licensee's submittal and assessments, the NRC staff concludes that the Farley PRA models for internal events (including internal flooding) and fire events used to implement the RICT Program satisfy the guidance of RG 1.200. The PRA models conform sufficiently to the applicable industry PRA standards for internal events (including internal flooding) and fires at an appropriate capability category. The NRC staff also concludes that the licensee has established sufficient basis for the acceptable disposition of the peer review findings.

The NRC staff finds that the IEPRA and FPRA models are technically adequate to support the RICT program because the licensee (1) reviewed the PRA using endorsed guidance and adequately resolved identified issues, (2) will address remaining issues through the implementation item listed in the license condition, and (3) established a periodic update and review process to update the PRA and associated CRMP model to incorporate changes made to the plant and PRA methods and data.

3.1.4.1.2 Scope of the PRA NEI 06-09, Revision 0-A, requires a quantitative assessment of the potential impact on risk due to impacts from internal and external events, including internal fires. As clarified in the SE on NEI 06-09, Revision 0-A, other sources of risk (i.e., seismic and other external events) must be quantitatively assessed if they contribute significantly to the incremental risk of any RMTS configuration. Sources of risk shown to be insignificant contributors to configuration risk may be excluded for the RICT calculations. Additionally, shutdown risk assessment is not applicable to this LAR since the LAR only applies to Modes 1 and 2.

The licensee provided its assessment of external hazard risk for the RICT Program in LAR , "Information Supporting Justification of Bounding Analysis or Excluding Sources of Risk Not Addressed by the PRA Models." In Enclosure 3, Attachment 2, the licensee states that this assessment is based on an update of the Farley Individual Plant Examination of External Events (IPEEE) external hazard screening evaluation, but also states in LAR Enclosure 3 that the list of hazards is the same as presented in Appendix 6-A of the ASME/ANS PRA Standard.

Furthermore, the NRC staff notes that this list is essentially the same list of hazards as presented in Table 4-1 of NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking" (Reference 30).

According to the LAR, the licensee evaluated the following external hazards:

Seismic Events (treated by adding the bounding seismic risk to the RICT calculations)

Accidental Aircraft Impacts

Avalanche

Biological Event

Coastal Erosion

Drought

External Flooding

Extreme Winds and Tornados (including generated missiles)

Fog

Hail

High Summer Temperatures

High Tide, Lake Level or River Stage

Hurricane

Ice Cover

Turbine-Generated Missiles

Landslide

Lightning

Low Lake Level or River stage

Low Winter Temperature

Meteorite or Satellite Impact

Forest or Range Fires

Industrial or Military Facility Accident

Release of Chemicals in Onsite Storage

River Diversion

Sand or Dust storm

Seiche

Snow

Soil Shrink-Swell Consolidation

Storm Surge

Toxic Gas

Transportation Accidents

Pipeline Accidents (e.g., natural gas)

Tsunami

Volcanic Activity

Waves Enclosure 4 to the LAR states:

[The review of external hazards] process considers two aspects of the external hazard contribution to risk. The first is the contribution from the occurrence of beyond design basis conditions, e.g., winds greater than design, seismic events greater than design-basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant. The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power, etc. While the plant design basis assures that the safety related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless cause a demand on these systems that in and of itself presents a risk.

In LAR Table E3.A2.1, the license provides a disposition for each hazard and concludes

. that no unique PRA model for these hazards is required in order to assess configuration risk for the RICT program (with the exception of internal flooding and internal fire, which are addressed by a PRA). In LAR Enclosure 3, Attachment 1, the licensee explains that as a precondition to entering a RICT, if design assumptions are degraded such that the plant faces an.increased challenge from an external hazard that is screened because of an SSC taken out of service as part of the RICT program, then one of two actions will be taken, either (1) compensatory actions are implemented or (2) an incremental increase to CDF and LERF equal to the applicable hazard frequency for impacted equipment is added to the change-in-risk as part of the RICT calculation.

External Hazards The NRC staff's SE in NEI 06-09, Revision 0-A, states that sources of risk besides internal events and internal fires (i.e., seismic and other external events) must be quantitatively assessed if they contribute significantly to configuration-specific risk. The SE further states that bounding analyses or other conservative quantitative evaluations are permitted where realistic PRA models are unavailable. In addition, the SE concludes that if sources of risk can be shown to be insignificant contributors to configuration risk, then they may be excluded from the RMTS.

The licensee addressed the risk from seismic events and other external hazards in the context of this application in Enclosure 3 to the LAR. This enclosure provided bounding estimate for the risk from seismic events for use in determining the configuration risk for the RICTs identified in the LAR. The basis for exclusion of certain hazards from consideration in the determination of RICTs due to their insignificance to the calculation of configuration risk was also provided in the same enclosure. The licensee stated that its IPEEE external screening evaluation was updated to support this LAR. External hazards considered by the licensee were listed in Table E3.A2.1 of Enclosure 3 to the LAR. The NRC staff finds that the list of external hazards considered by the licensee is consistent with the hazards listed in Appendix 6-A of the ASME/ANS RA-Sa-2009 PRA Standard which is endorsed in RG 1.200, Revision 2.

The NRC staff reviewed Enclosure 3 to the LAR and the information in the supplemental letter dated May 3, 2019, to determine the acceptability of the consideration of risk from seismic events and other external hazards for this application.

Seismic The licensee explained in the LAR that RICT calculations will include a risk contribution from seismic events. The licensee's approach for including the seismic risk contribution in the RICT calculation is to add a constant seismic CDF and LERF to each calculation. To estimate a RICT, the licensee proposed to add a baseline seismic CDF contribution of 4.51 x 1o-6 per year and a seismic LERF contribution of 2.07x1Q-6 per year to the configuration-specific delta CDF and delta LERF from the internal events, including internal flooding, and internal fire initiating events for every RICT occurrence.

The baseline seismic CDF and LERF estimates were derived using a bounding analysis discussed by the licensee in Attachment 1 of Enclosure 3 to the LAR. The approach used the plant-specific seismic hazard curves developed in response to the Near-Term Task Force (NTTF) recommendation 2.1 (Reference 31) and a plant-level high confidence of low probability of failure (HCLPF) capacity of 0.1 g referenced to peak ground acceleration (PGA). HCLPF is the capacity representing 95 percent confidence that the conditional probability of failure of an SSC is 5 percent or less. The uncertainty parameter for seismic capacity was represented by a combined beta factor of 0.4. The analysis used the hazard curves for four frequencies (PGA 100 Hz, 10 Hz, 5 Hz, and 2.5 Hz) and used the average of these four results to determine the seismic CDF estimate of 4.51x10-6 per year. The seismic LERF estimate was determined by the convolution of the seismic CDF determined above with the containment isolation failure represented using the same HCLPF value of 0.1g PGA. Similar to the seismic CDF calculation, the average of the four frequencies was used to determine the seismic LERF estimate of 2.0?x 10-6 per year. The licensee proposed to use the seismic CDF and LERF as a "penalty" for the RICT calculations, that is, the seismic CDF and LERF estimate would be added to internal events, including internal flooding, and internal fire delta CDF and delta LERF contribution for every RICT proposed in the LAR.

The NRC staff's evaluation of the licensee's approach and estimate determined that the HCLPF value of 0.1 g PGA, as well as the composite beta factor of 0.4, is consistent with the corresponding values used for Farley in the Generic Issue (Gl)-199 (Reference 32) evaluation, which represent the most recent information on those parameters for Farley. The staff notes that 0.1g PGA is the lowest plant level HCLPF in the Gl-199 evaluation. The NRC's staff previous assessment of the licensee's re-evaluated seismic hazard states (Reference 31) that the licensee's methodology was acceptable and that the re-evaluated hazard adequately characterized the site. The previous NRC staff conclusion on the re-evaluated hazard is applicable here because the same seismic hazard was used for this application. Furthermore, the NRC staff's review determined that the use of the fragility of components leading to containment isolation failure, such as the estimates in Appendix B of NUREG/CR-4334, "An Approach to the Quantification of Seismic Margins in Nuclear Power Plants" (Reference 33), is much higher than the value of 0.1 g used by the licensee for the seismic LERF estimate. The staffs review finds that the use of the average of the estimates from the four frequencies to determine the baseline seismic CDF and LERF is consistent with the approach used in Gl-199.

The NRC staff verified the bounding seismic CDF and LERF estimates provided by the licensee in the LAR.

The NRC staff finds that during RICTs for SSCs credited in the design basis to mitigate seismic events, the licensee's proposed methodology captures the risk associated with seismically induced failures of redundant SSCs because such SSCs are assumed to be fully correlated. By assuming full correlation, the seismic risk for those RICTs will not increase if one of the redundant SSCs is unavailable because simultaneous failure of all redundant trains would be assumed. During RICTs for SSCs not credited in the design-basis seismic event, but which could be used when credited SSCs fail, the proposed methodology for considering seismic risk contributions may be non-conservative because the seismically induced failure of such SSCs during the RICT may not be included in the risk increase. However, the occurrence and degree of non-conservatism depends on the plant HCLPF value used for the RICT calculations, as compared to the HCLPF values for such SSCs. The degree of non-conservatism will be low or nonexistent if the plant HCLPF value is lower than most or all SSCs impacted by a seismic event. During RICTs for SSCs that are not used to mitigate a seismic event, the proposed methodology for considering seismic risk contributions is conservative because the seismically induced failure of such SSCs would not result in a risk increase associated with the plant configuration during the RICT, but the baseline seismic risk is still included in the calculation.

In the LAR, Attachment 2, Enclosure 3, the licensee also calculated the seismically induced loss of offsite power {LOOP) frequency of 5x 10-6 per year, which is less than 1 percent of the total unrecovered LOOP frequency in the internal events PRA. The NRC staff evaluated the analysis and finds that the analysis adequately addresses the impact of seismically induced LOOP and has an insignificant impact on the RICT program calculations.

In summary, the NRC staff's review finds the licensee's proposal to use the baseline seismic CDF and LERF contributions of 4.51 x10-6 /yr and 2.07x1Q-6 /yr, respectively, as an addition to the configuration-specific delta CDF and delta LERF from the internal events, including internal flooding, and internal fire initiating events, acceptable for the licensee's RICT program because (1) the licensee used the most current plant-specific seismic hazard information, (2) the licensee used an acceptably low plant HCLPF value of 0.1 g consistent with the information for the licensee in the Gl-199 evaluation, and (3) adding baseline seismic risk to RICT calculations, which assumes the fully correlated failures, is conservative for SSCs credited in seismic events, while any potential non-conservative results for SSCs that are not credited in seismic events is small or nonexistent, as discussed above.

Extreme Winds and Tornado Hazards of Enclosure 3 to the LAR discusses the licensee's evaluation of the extreme winds and tornadoes impact on this application. Table E3.A2.1 of the same enclosure discusses the basis for the insignificant impact of extreme winds and tornados (including tornado-generated missiles) for this application and relies on the design of SSCs and a tornado missile analysis.

The staff notes that the licensee's site is located in the NRC's tornado region I, as shown in RG 1.76, Revision 1 (Reference 34). In response to RAls 11.d and 11.e, the licensee explained that its design tornado wind speed is greater than the wind speed with an occurrence frequency of 1x10-7 per year from NUREG/CR-4461, Revision 2, "Tornado Climatology of the Contiguous United States" (Reference 35), for the Farley site. The licensee further explained that straight winds and hurricane winds hazard was bounded by tornado winds for Farley. The NRC staff's review of the information in the submittal and the supplement finds that the licensee's design basis can be considered as a bounding or demonstrably conservative analysis. The NRC staff's review also notes that the internal events PRA already includes weather related LOOP events as initiators which capture the impact of high straight winds and tornados. Further, the plant's abnormal operating procedures for severe weather includes actions in the event of a tornado sighting, tornado warning, or severe thunderstorm. Therefore, the NRC staff finds that the extreme winds hazard, excluding the tornado-generated missile hazard, has an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed RICTs.

Concerning the tornado missile hazard, in response to RAls 11.f and 11.g, the licensee explained that the tornado missile damage frequency referred to in the LAR was based on a plant-specific TORM IS analysis, which is documented in Section 3.5.1.2 of the UFSAR and was approved in Amendment No. 150 for Unit 1 and No. 142 for Unit 2. The license provided the basis for the insignificant impact of the tornado-generated missile hazard using the TORM IS results in combination with the results of recent walkdowns performed for the tornado missile protection review. The licensee stated that there were conservative assumptions with respect to specific targets in the TORM IS analysis and that the results of the TORM IS analysis, which showed a total damage frequency of about ?x 10-7 per year, were based on the total arithmetic sum of the damage frequency for the identified unprotected SSCs from tornado-generated missiles. The staff's review of the information in the supplement notes that TORM IS provides the total damage frequency from missiles and multiple targets, some of which may be protected from tornado-generated missiles, need to fail in order to cause core damage. Therefore, the NRC staff concludes that the impact of tornado-generated missiles on the SSCs included in the TORMIS analysis is insignificant for this application.

In response to RAls 11.f and 11.g, the licensee stated that recent tornado missile protection walkdowns identified diesel fuel oil storage tank vents and several ventilation hoods on the SWIS roof that were not protected against tornado-generated missiles. The licensee provided additional qualitative considerations for the impact of these additional tornado missile targets.

The licensee stated that the diesel fuel oil storage tank vents were small targets located on the ground level and spaced such that it was unlikely that a single tornado-generated missile would cause the failure of multiple vents. The licensee further stated that its abnormal operating procedure for severe weather included actions to minimize potential tornado missiles on-site in the event of a tornado sighting, tornado warning, or severe thunderstorm. The licensee explained that the procedure provided specific direction for inspecting and taking necessary actions for any crimped or blocked fuel oil tank vents, which was a priority mitigating action and

the first one to be taken following a tornado strike. The licensee further explained that the procedure referred to planned, packaged, and staged work orders to immediately repair tornado missile damage to the diesel fuel oil storage tank vents. The staff's review finds that it is unlikely that tornado-generated missile would damage the diesel fuel oil storage tank vents such that the functionality is lost and that procedures exist to inspect and correct any damage.

Therefore, the staff finds that the tornado-generated missile impact on diesel fuel oil storage tank vents is insignificant for this application.

In response to RAls 11.f and 11.g, with regard to the SWIS ventilation hoods, the licensee stated that the large majority of the area within 2500 feet of the SWIS is grass or water, which would not produce any damaging missiles. Therefore, the frequency of missile strikes on SWIS targets, based on missile inventory, was expected to be lower than the other TORMIS targets evaluated. The licensee also evaluated the impact of two failure modes, crushing and removal, of the SWIS ventilation hoods on the functionality of the SWIS components and concluded that a majority of the failures do not have a significant impact. The licensee also explained that proceduralized actions provided direction to minimizing potential tornado missiles and directed the operators to inspect the plant for damage, including to the SWIS ventilation hoods. In the event that in-leakage was identified from the ventilation hoods, operators were directed to take immediate measures to temporarily protect electrical equipment by containing or deflecting leakage. The NRC staff's review finds that it is unlikely that tornado-generated missile would damage the SWIS ventilation hoods such that the functionality is lost due to the limited missile inventory and that procedures exist to inspect and correct any damage. Therefore, the NRC staff finds that the tornado-generated missile impact on SWIS ventilation hoods is insignificant for this application.

The staff's review also notes that there are no tornado missile targets associated with containment integrity and, therefore, the tornado-generated missile impact on LERF is insignificant for this application.

In summary, the NRC staff's evaluation of the licensee's consideration of extreme wind and tomados, including tornado-generated missiles, hazard finds that (1) the hazard has an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed RICTs and (2) the existing procedures will result in the inspection and correction of any damage to SSCs due to tornado-generated missiles.

External Flooding of Enclosure 3 to the LAR discusses the licensee's evaluation of the risk from external flooding hazard. Table E3.A2.1 of the same enclosure discusses the basis for the insignificant impact of the external flooding hazard on this application and includes the results documented in the licensee's flood hazard reevaluation report (FHRR) (Reference 36).

In response to RAls 11 a, b, and c, the licensee provided additional details of the external flood causing mechanisms as well as the basis for the insignificant impact for each of these mechanisms.

As discussed in the response to RAI 11.a, three mechanisms were not bounded by the current licensing basis (CLB) in the FHRR: failure of dams and onsite water control/storage structure, Local Intense Precipitation (LIP), and combined effects flooding. As the failure of dams and onsite water control/storage structure was bounded by the combined effects flooding, the LIP and combined effects flooding mechanisms were considered in additional detail by the licensee

for this application. Based on its review of the May 3, 2019, supplement, the FHRR in the context of this application, and its assessment of the licensee's focused evaluation for external flooding (Reference 37), the NRC staff finds that external flooding mechanisms besides LIP and combined effects flooding either do not challenge the plant or do not apply to the plant and, therefore, do not need to be considered for this application.

The licensee stated that the FHRR calculated standing water against external doors around the plant during a LIP event and evaluated ingress from exterior doors. The licensee explained that the depth of water was calculated to be insufficient to impact SSCs. The licensee provided the available physical margin for various buildings based on the FHRR calculations for LIP. The NRC staff's review of the licensee's FHRR in the context of this application noted that the licensee's FHRR states that all active and passive system components (e.g., pumps, gravity storm drain systems, inlets, etc.) were assumed to be non-functional or clogged during the calculation for LIP. Further, the licensee's abnormal operating procedures for severe weather provided procedures to prepare for a LIP event which included sandbagging. The NRC staff's assessment of the licensee's focused evaluation for external flooding concluded that available physical margin existed based on the staff's verification of the height and location of curbs and pedestals credited for flood protection in the auxiliary buildings for Units 1 and 2 as well as confirmation that the maximum estimated LIP flood depths inside safety-related buildings were lower than the height of the flood protection curbs. That conclusion is applicable to this review because the licensee relied on the same calculations of the impact of LIP for this application.

Based on its review to the submittal, the supplement, and relevant information from the FHRR, the NRC staff finds that LIP has an insignificant contribution to configuration risk with doors in Table A-1 of response RAI 11.a in their normally closed position and, therefore, can be excluded from the calculation of the proposed RICTs.

The licensee's calculation for the combined effects flooding mechanism in the FHRR followed the guidance in NUREG/CR-7046 (Reference 38) and applied a 2-year wind speed in the critical direction on top of the highest stillwater elevation produced by the governing flooding scenario.

In the May 3, 2019, supplement, the licensee stated that the combined effects flooding mechanism caused a maximum still flood elevation that was below the Finished Floor Elevation (FFE) of the plant. The licensee stated that credit was taken for the Kontek Vehicle Barrier System (VBS) to prevent wave action from propagation to the plant's safety-related buildings, because the maximum flooding against the VBS is lower than the height of the VBS. The licensee stated that the VBS had sufficient load carrying capacity to demonstrate available physical margin to withstand wave action due to winds. The NRC staff's assessment of the licensee's focused evaluation for external flooding concluded that the VBS load capacity is considerably greater than the resultant loads from the wave action. That conclusion is applicable to this review because the licensee relied on the same calculations of the impact of combined effects flooding for this application. Based on its review to the submittal, the supplement, and relevant information from the FHRR, the NRC staff finds that combined effects flooding has an insignificant contribution to configuration risk with credit for the VBS and, therefore, can be excluded from the calculation of the proposed RICTs.

The staff's review notes that the approach used in the FHRR is based on theoretical maximum values for the external flooding hazards which provides confidence that the damage potential from higher frequency, lower magnitude values is captured.

In response to RAI 11.c, the licensee stated that the VBS and doors in Table A-1 of response to RAI 11.a were credited for screening the external flooding hazard. The licensee stated that the configuration of these SSCs will be considered during the process of Risk Management Action

(RMA) development for a RICT. The licensee explained that the VBS is a system with a tightly-controlled configuration and evolutions where the configuration is changed from its normal configuration are infrequent and brief in nature. The licensee further stated that the RMA process would address the configuration of the VBS to ensure awareness of its role in preventing external flooding damage and to minimize the unavailability. Similarly, the licensee explained that the doors listed in Table A-1 of response to RAI 11.a were normally closed doors and their importance in preventing external flooding damage would be addressed in the RMA process. The RMA process would ensure that the unavailability of the door to prevent damage from the external flooding hazard is minimized. The staff's review of the licensee's proposed inclusion of the credited flood protection features finds that the RMAs will ensure that assumptions related to the availability and the functionality of those features remain valid during RICTs such that the external flooding hazard continues to have an insignificant impact on the configuration-specific risk.

In summary, the NRC staff's evaluation of the licensee's consideration of external flooding hazard finds that (1) the external flooding hazard has an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed RICTs and (2) the licensee, via RMAs, will ensure that assumptions related to the availability and the functionality of credited flood protection features remain valid during RICTs.

Other External Hazards Besides the external flooding and high winds and tornados discussed above, the licensee provided rationale for the insignificant impact of other external hazards in Table E3.A2.1 of of Enclosure 3 to the LAR. The NRC staff's review of the information in the submittal finds that the contributions from the other external hazards have an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed RICTs because they either do not challenge the plant or they are bounded by the external hazards analyzed.

External Hazards Conclusion The NRC staff concludes that the licensee's approach for considering the impact of seismic events and other external hazards in the RICT calculations is acceptable because the licensee included a technically acceptable quantitative assessment of the seismic risk consistent with the guidance in the NEI 06-09, Revision 0-A, demonstrated the insignificant contribution to configuration risk from other external hazards on the proposed RICTs, and included RMAs to ensure that assumptions related to the availability and the functionality of credited flood protection features remain valid during RICTs.

Shutdown Risk Shutdown risk is not applicable to this LAR since the LAR only applies to Modes 1 and 2.

3.1.4.1.3 PRA Modeling As summarized in NEI 06-09, Revision 0-A, and the associated SE, a RICT for a given Required Action can be calculated when the specific systems or components involved are modeled directly or indirectly in the PRA. For each TS LCO for which the RICT Program is proposed to apply, for any of its Required Actions, the licensee identified that: (1) the success criteria parameters used to determine PRA Functionality determination are the same as the design

basis success criteria parameters; (2) the system is included in the PRA models or the licensee has addressed systems not in the PRA either in the LAR or in response to an RAI; (3) common-cause failures and surrogate identification are appropriately addressed; and (4) the CRMP provides the capability to select the system as out of service in order to calculate a RICT and the CRMP is maintained consistent with the baseline PRA model.

Success Criteria Table E1 .1 in Enclosure 1 to the LAR, as supplemented, identifies each TS within the scope of the proposed RICT program and, as applicable, summarizes how the PRA success criteria differ from the design basis success criteria. In some cases, all the design basis success criteria are not modelled in the PRA (e.g., Control Room Air Conditioning System) or are more restrictive than the PRA success criteria (e.g., the PORV success criteria are more restrictive than the design basis success criteria when the PORVs are used to mitigate certain beyond design basis scenarios). CTs calculated from the PRA will be based on the PRA success criteria which have been reviewed consistent with the PRA technical adequacy review process described in RG 1.200. Use of less restrictive PRA success criteria solely to extend CTs when the design basis criteria can still be satisfied is consistent with NEI 06-09, Revision 0-A, and the associated SE and, therefore, acceptable.

LAR Table E1 .1 states regarding LCO 3.6.6, Containment Spray and Cooling Systems, Conditions D and E, that the design success criteria for the Containment Cooling system is one of two Containment Cooling trains. In RAI 15.a, the NRC staff noted that this design success criteria cannot be met in Condition E when two Containment Cooling trains are inoperable.

Therefore, the NRC staff requested justification that this condition was not a TS LOF and that the licensee provide updated TS markups for this condition. In response to RAI 15.a, the licensee removed this condition from the scope of the RICT program.

In RAI 15.b, the NRC staff noted that for LCO 3.7.4, Atmospheric Relief Valves (ARVs), LAR Table E1 .1 indicates that there are three ARVs but that the success criteria is four-of-four ARVs for anticipated transients without trip (ATWT) conditions. Therefore, the NRC staff requested an explanation for this apparent discrepancy. In response to RAI 15.b, the licensee stated that the actual success criteria used in the PRAs for an anticipated transients without scram (ATWS) event is four-of-five Main Steam Safety Valves (MSSVs), not four ARVs. The licensee justified that the condition with one or two ARVs lines inoperable is not a TS LOF because design criteria require one ARV available to conduct a unit cooldown following a steam generator tube rupture (SGTR). The licensee concluded that three ARVs inoperable is a LOF condition and because the existing CT is already approved for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , removed it from the scope of the RICT program.

In RAI 15.c, the NRC staff noted that LAR Table E1 .1 does not indicate LCO 3.8.1, Condition E, Two DG sets inoperable, as a TS LOF condition even though the design success criteria is one of two DG sets operable. Therefore, the NRC staff requested confirmation that the licensee intended to treat this condition as a TS LOF. In response to RAI 15.c, the licensee updated the TS to treat conditions with two DG sets inoperable as TS LOF and provided updated TS markups.

The NRC staff noted that the RICT program administrative control proposed in TS 5.5.20, item f.1 states that any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified TS safety function. In RAI 16, the NRC staff requested clarification regarding LCO 3. 7.6, Condensate Storage Tank (CST), Condition A, CST

Inoperable, of whether credit for an alternate SSC other than the SSC covered by the TS was being proposed for use in a PRA Functionality determination for this LOF condition. The NRC staff stated that if credit for an alternate SSCs is being proposed for LCO 3.7.6, Condition A, then justification is needed for how sufficient redundancy and diversity is maintained in this condition. In response to RAI 16, the licensee withdrew LCO 3.7.6, Condition A from the scope of the RICT program.

System, Surrogate, and Common-Cause Modeling Table E1 .1 in Enclosure 1 to the LAR, as supplemented, identifies each TS within the CRMP program and, as applicable, identifies how the systems and components are implicitly or explicitly modelled in the PRA. Regulatory Position 2.3.3 of RG 1.174 states that the level of detail in the PRAs should be sufficient to model the impact of the proposed licensing basis change. The NRC SE for NEI 06-09, Revision 0-A, states that a RICT can be applied to SSCs that are either modeled in the PRA, or whose impact can be quantified using conservative or bounding approaches. The LAR did not provide sufficient description of the PRA modeling for some systems for the staff to understand how a RICT could be applied and, therefore, the staff requested further information in RAI 13.

In response to RAI 13, the licensee provided clarification of how the Containment Air Locks (LCO 3.6.3) are modeled in the CRMP model supporting the RICT program. The licensee stated that containment airlocks are not explicitly modeled in the PRA and that the impact of an open or not fully closed airlock will be considered through surrogate events (e.g.,

Administratively Controlled Penetrations Not Isolated). The licensee explained that the radioactive material release from these surrogate events is assumed to result directly in large early release. This approach is conservative for a single inoperable air lock given that the remaining air lock door provides an operable barrier to release. The licensee acknowledges that the removal of any Containment Air Lock from service conservatively results in a relatively short RICT limited by LERF. The NRC staff concludes that this approach is acceptable because it produces a conservative calculated RICT.

In LAR Table E1 .1 regarding LCO 3.7.11, Control Room Air Conditioning System (CRACS),

Condition E, two CRACS trains Inoperable, the licensee indicates that the CRACS is not modelled in the PRA. Therefore, in RAI 14.c, the NRC staff requested an explanation of how this condition will be treated in the CRMP model to reflect the LCO condition. In response to RAI 14.c, the licensee stated that it had removed LCO 3. 7 .11, Condition E from the RICT program.

In RAI 14.d, the NRC staff noted that based on a public meeting held October 16, 2018 (Reference 39), there are swing EDGs shared between Unit 1 and Unit 2. As described in the public meeting, swing EDGs 1-2A and 1C are shared between Unit 1 and Unit 2. EOG 1-2A is large, rated at 4075 kW, and can support full safety injection (SI) loading. EOG 1C is smaller, rated at 2850 kW, and cannot support full SI loading. Both swing EDGs can be aligned to the

'A' train buses of the AC electrical distribution system of each unit. If an SI signal is received, the larger EOG 1-2A aligns to the A train of the unit that received the first SI signal, and the smaller EOG 1C aligns to the A train of the opposite unit. During a simultaneous dual unit Loss of Offsite Power (LOSP) without SI, EOG 1-2A is assigned to Unit 1 and EOG 1C is assigned to Unit 2. Given this design, the NRC staff noted that the RICT estimates for one unit could be impacted by the real-time configuration of the opposite unit. Therefore, in RAI 14.d, the NRC staff requested a description of how the shared EDGs are modeled in CRMP PRA models. In response to RAI 14.d, the licensee explained that for a simultaneous dual unit LOSP event

without SI, EDG 1-2A is credited only in the Unit 1 model and EDG 1C is credited only in the Unit 2 model. For a dual unit LOSP event with SI, the licensee explained that in both the Unit 1 and Unit 2 models, the availability of EDG 1-2A is modeled using a basic event that represents the average probability that EDG 1-2A was already demanded by the opposite unit. The licensee stated that using the average probability value could underestimate the CDF and LERF for specific configurations of the opposite unit. However, the licensee performed a sensitivity study in which it increased the probability of this basic event by two orders of magnitude to 5.79E-01 for Unit 1 and to 5.70E-02 for Unit 2. The licensee indicated that the sensitivity study results showed a minimal impact on the CDF and LERF values. The NRC staff notes that raising the unavailability of this basic event produces bounding estimates of the probability that EDG 1-2A is unavailable because it is already in use by the opposite unit. The NRC staff finds the licensee's treatment of shared EDGs acceptable because (1) for LOSP without SI signal, the site-specific alignment of EDGs is reflected in the CRMP model and (2) for LOSP with SI signal, the risk associated with the site-specific alignment of EDGs is shown to be adequately captured based on the results of the sensitivity study described above.

In LAR, Enclosure 6, Section 3.0, "Administrative Controls," the licensee states that for planned configurations, the RICT calculations will be performed consistent with guidance in Section 3.3.6 of NEI 06-09, Revision 0-A, which states "[f]or all RICT assessments of planned configurations, the treatment of common cause failures in the quantitative CRM [Configuration Risk Management] Tools may be performed by considering only the removal of the planned equipment and not adjusting common cause failure terms." The NRC staff notes that this simplification produces both conservative and non-conservative effects .. The NRC staff also notes that CCF probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because the calculations reasonably include CCFs after removing one train for maintenance consistent with the accuracy of the estimates.

In LAR, Enclosure 6, Section 3.0, "Administrative Controls," the licensee states that for unplanned or emergent conditions, the potential for CC failure is considered during the operability determination process referred to as an "extent of condition" assessment. Part (g) of proposed TS 5.5.20 provides requirements for addressing the possibility of CC failure upon entering a RICT for emergent conditions. In response to RAI 17 .a, the licensee clarified that the wording of proposed TS 5.5.20 presented in Attachment 1 is not the wording that it intends to adopt but rather the wording in Attachments 2 and 3. If a high degree of confidence cannot be established that there is no CC failure mechanism that could affect the redundant components, then the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods: (1) The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG or (2)

RMAs not already credited in the RICT calculation shall be implemented that target the success of the redundant and/or diverse SSCs of the failed SSC and, if possible, reduce the frequency of initiating events. The NRC staff finds that the first option is acceptable because it quantitatively incorporates the potential CCF into the estimated RICT consistent with RG 1.177 guidance on including CCFs. The NRC staff finds that the second option is acceptable because identifying the redundant and/or diverse SSCs and developing RMAs targeting the function(s) provides adequate additional confidence that the function(s) will be available while investigation into the potential for CCF is completed.

CRMP Model The Farley PRA model serves as the model used by the CRMP tool, which is used to perform the RICT calculations. The CRMP tool models the change in CDF/LERF above the zero-maintenance baseline plant configuration and converts to average annual values. In order to translate the baseline Farley PRA model for use in the CRMP model, adjustments must be made to the baseline PRA model. These adjustments are described in the LAR Enclosure 6.

The CRMP tool used to perform the RICT calculations provides a user interface which supports the RICT program by providing a method to evaluate the plant configuration.

In LAR Enclosure 6, the licensee specifically describes the steps associated with creating a one-top model for the internal events, internal flooding, and fire PRAs after resolving peer review findings and describes the changes needed to facilitate configuration-specific risk calculations. These changes made to the PRA modeling during the translation to the CRMP model consist of: ( 1) Adding the seismic bounding CDF and LERF to the Farley baseline risk of the CRMP model so that its contribution can be added to the risk increase in RICT calculation; (2) Setting the Plant Availability (PAV) event factor to 1.0 in the CRMP model because PAV is not applicable to configuration-specific risk calculations; (3) Setting the maintenance event probabilities to O and when components are in maintenance setting them to 1.0 to reflect the actual plant configuration; (4) Setting the PRA model for anticipated transient without scram (ATWS) events using interval values to reflect the impact of core life; and (5) Setting the PORV block valve to O or 1.0 to reflect the actual configuration.

The licensee also discusses administrative controls for the CRMP such as when and how to treat CC failures, modeling requirements for emergent conditions, modeling requirements for TS LOF, and quality and updates requirements.

The NRC staff reviewed the licensee's information and concluded that the scope of SSCs to which the RICT Program would be applied is appropriately included in the PRA models and in the CRMP. Therefore, the NRC staff finds that the licensee's PRA modeling is consistent with NEI 06-09, Revision 0-A, guidance subject to the conditions in Section 4.0 of the SE on NEI 06-09, Revision 0-A.

3.1.4.1.4 PRA Modeling Conclusions The NRC staff reviewed the licensee's information and concluded that the PRA modeling used to support the proposed RICT Program can appropriately model alignments of components during periods when the RICT would be calculated. Therefore, the NRC staff finds that the licensee has satisfied the intent of RG 1.177 (Section 2.3.3) and RG 1.174 (Section 2.3) and that the PRA modeling is appropriate for this application.

3.1.4.1.5 Sensitivity and Uncertainty Analyses Risk-informed analyses of TS changes can be affected by uncertainties regarding the assumptions made during the PRA model's development and application. Typically, the risk resulting from TS CT changes is relatively insensitive to most uncertainties because the uncertainties tend to affect similarly both the base case and the changed case. The licensee considered PRA modeling uncertainties and their potential impact on the proposed RICT Program and identified, as necessary, the applicable RMAs to limit the impact of these uncertainties. In Enclosure 7 to the LAR, the licensee discussed key assumptions and sources of uncertainty.

In LAR Tables E7.1 and E7.3, the licensee identifies sources of Internal Events Probabilistic Risk Assessment (IEPRA) and Fire Probabilistic Risk Assessment (FPRA) uncertainty and dispositions their impact on the application. The licensee states that no internal events or fire PRA modeling uncertainties were identified that would require a sensitivity study as part of the RICT program calculations. The licensee states that the IEPRA and FPRA uncertainty analyses were performed based on guidance from NUREG-1855 and cites Revision O (Reference 40).

Revision O of NUREG-1855 primarily addresses sources of model uncertainty for internal events (including internal flooding) and did not address the possible need to propagate parametric data uncertainty to account for the impact of state of knowledge correlation (SOKC). Revision 1 of NUREG-1855, issued in March 2017, explicitly discusses the need to consider SOKC and addresses uncertainties associated with fire and other hazards, through the associated guidance in EPRI TR 1026511 that provides generic key assumptions and sources of uncertainty for other hazards such as internal fire.

In RAI 9, the NRC staff requested a description of the process used to identify generic and plant-specific key assumptions and sources of uncertainty for the IEPRA and the FPRA that were then evaluated for their impact on the application. Because the total CDF and LERF estimates presented for Farley in LAR Enclosure 4 are close to the RG 1.174 total risk acceptance guidelines, the NRC staff also requested confirmation that the parametric uncertainty evaluations that consider SOKC were performed for the IEPRA (including internal flooding) and FPRA models and that the propagated mean total CDF and LERF values were confirmed to meet the RG 1.174 guidelines. In response to RAI 9, the licensee stated that it followed the evaluation process described in NUREG-1855, Revision 1. The licensee stated that generic sources of IEPRA uncertainty from EPRI TR 1016737 were considered along with uncertainties discussed in the PRA documentation. The licensee explained that sources of FPRA uncertainty were identified from the FPRA documentation and were considered by the licensee to be consistent with the generic sources of FPRA uncertainty identified in EPRI TR 1026511, Appendix B. The licensee provided an additional list of IEPRA key assumptions and sources of uncertainty in the RAI response, along with their dispositions for this application. The NRC staff reviewed the dispositions to these additional uncertainty issues and considered them to fall into one of three acceptable categories (i.e., the modeling is based on industry consensus modeling, the modeling represents a slight conservativism, and the modeling represents the as-built as-operated plant). The licensee also explained that the propagated mean total CDF and LERF values that reflect SOKC were confirmed to meet RG 1.174 risk acceptance guidelines.

In LAR Enclosure 7, Table E7.1, the licensee states that the baseline PRA does not account for seasonal variations caused by external hazards even though certain initiating events can be affected by them. However, the licensee also states in LAR Table E7.1 that the proposed RICT Program would include a qualitative consideration of weather events as part of the RMA decision process when LCO 3.8.1 CTs are extended to address this source of uncertainty. NEI 06-09, Revision 0-A, guidance states in Section 2.3.4:

If the PRA model is constructed using data points or basic events that change as a result of time of year or time of cycle (examples include moderator temperature coefficient, summer versus winter alignments for HVAC, seasonal alignments for service water), then the RICT calculation shall either 1) use the more conservative assumption at all time, or 2) be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration for the feature as modeled in the PRA. Otherwise, time-averaged data may be used in establishing the RICT.

In RAI 7, the NRC staff requested a description of how the uncertainty associated with weather events is considered in the RMA decision process. The NRC staff also requested explanation of whether initiating events other than loss of offsite power (e.g., loss of Plant Service Water) can be impacted by seasonal variations in external hazards and how those impacts are considered in a RICT application. In response to RAI 7, the licensee stated that, based on information about the likelihood of adverse weather affecting the site, such as a National Weather Service tornado warning, the reactor trip and LOOP frequencies will be adjusted in the configuration risk tool, as defined by the Maintenance Rule program procedures. The licensee further stated that RMAs will also be considered, such as actions to restore systems to service as soon as possible; securing all items which may become missiles during high winds; suspending switchyard activities; ensuring diesel generators are aligned for auto-start; and maintaining plant storage tank levels as high as possible. The licensee also explained that no other initiators are subject to seasonal variations in frequency and that the success criteria used for modeling plant response to adverse weather are based on "limiting success criteria." The NRC staff finds that the licensee adequately considers the seasonal variations in the risk estimates consistent with the guidance in NEI 06-09, Revision 0-A.

In LAR Enclosure 7, Tables E7.1 and E7.2, the NRC staff also noted dispositions of key assumptions and sources of uncertainty based on conservative modeling that seemed to have the potential to impact the application. Therefore, the NRC staff requested further information about these two uncertainty issues as discussed below.

In LAR Table E7.3, under the FPRA Cable Selection task, the licensee states that some systems are not credited in the FPRA by treating those systems as always failed. In RAI 8.a, the NRC staff noted that this conservatism in the FPRA modeling could have a non-conservative impact on the RICT calculations. Accordingly, the NRC staff requested the identification of the systems assumed failed in fire scenarios and justification that this conservative assumption does not result in the determination of a non-conservative RICT. In response to RAI 8.a, the licensee stated that the components not credited in the FPRA were of low risk significance and, therefore, the cables for these components were not identified. The list of these unidentified components is referred to as the unknown locations (UNL) list. The licensee explained that the UNL list contains components in the licensee's proposed RICT program (or that support components in the licensee's proposed RICT program), such as containment isolation valves and Containment Vent Valve 3446, and components associated with cues for operator actions credited in the FPRA for mitigation following equipment failure (e.g., Train A and B Annunciator for Containment Sump Pump Room Cooling). In the RAI response, the licensee provides the results of a sensitivity study which compares the CDF and LERF values based on failing the UNL components versus the CDF and LERF values based on crediting the UNL components. The comparison between baseline case in which UNL components are assumed failed and the variant case in which the UNL components are assumed always to succeed yield a delta CDF and LERF that represents the maximum extent to which the modelling conservatism could mask risk in the change-in-risk calculation performed for a RICT determination. However, the delta CDF and LERF are 6E-07 per year and 2E-07 per year, respectively. Accordingly, even if these entire delta CDF and LERF values were conservatively converted to a 30-day ICDP and 30-day ICLERP and added to the ICDP and ILERP calculated for the CT extension, their impact on the calculated RICT would be inconsequential. The NRC staff finds that the licensee's treatment in the FPRA models of certain components (with untraced cables) is acceptable because a sensitivity study demonstrates that the impact of modeling these components compared to assuming that they always fail has an inconsequential impact on the RICT calculations.

In RAI 8.b, the NRC staff noted that credit for battery life was limited to two hours based on conservative FSAR analysis which excludes credit for proceduralized actions that would extend battery life. Therefore, the NRC staff requested justification that the exclusion of credit for actions that would extend battery life has an inconsequential impact on the application including RICTs calculated for LCOs that involve the operability of DC electrical power SSCs. In response to RAI 8.b, the licensee explained that for scenarios other than station blackout, the battery charger is required in the FPRA for DC power demands beyond the assumed two-hour battery life and, therefore, the battery charger would have a shorter estimated RICT. The licensee further explained that the successful operation of the turbine driven AFW pump relies on steam admission valves that are operated by instrument air and not DC power. Additionally, the site emergency operating procedures direct the operators to take manual control of the turbine driven AFW pump in these scenarios and these actions are time validated and are a part of the licensee's operator training program. The NRC staff understands that AFW is an important mitigation system in preventing core damage during station blackout scenarios and notes that the AFW system's reliance on DC power is reduced due to the steam admission valves for the turbine driven AFW pump being operated by instrument air. The NRC staff finds that the credit for two hours battery life will not have an impact on the AFW system to perform its design mitigating function and, therefore, has an inconsequential impact on the application.

The NRC staff finds that the licensee performed an adequate assessment to identify the potential sources of uncertainty and that the identification of the key assumptions and sources of uncertainty was appropriate and consistent with the guidance in NUREG-1855 and associated EPRI TR-1016737. Therefore, the NRC staff finds that the licensee has satisfied the guidance in RG 1.177 (Section 2.3.5) and RG 1.174 (Section 2.2.2) and that the treatment of model uncertainties for risk evaluation of extended CTs is appropriate for this application and consistent with the guidance identified in NEI 06-09, Revision 0-A.

3.1.4.1.6 PRA Results and Insights The proposed changes would implement a process to determine TS RICTs rather than specific changes to individual TS CTs. NEI 06-09, Revision 0-A, requires periodic assessment of the risk incurred due to operation beyond the front-stop CTs due to the implementation of a RICT program and comparison to the guidance of RG 1.174 for small increases in risk. As with other unique risk-informed applications, supplemental risk acceptance guidelines that complement the RG 1.174 guidance are appropriate. NEI 06-09, Revision 0-A, requires that configuration risk be assessed to determine the RICT and establishes the criteria for ICDP and ILERP on which to base the RICT. An ICDP of 1E-5 and an ILERP of 1E-6 are used as the risk measures for calculating individual RICTs. These limits are consistent with NU MARC 93-01, Revision 4A (Reference 13). The use of these limits in NEI 06-09, Revision 0-A, aligns the TS CTs with the risk management guidance used to support plant programs for the Maintenance Rule and the NRC staff accepted these supplemental risk acceptance guidelines for RMTS programs in its approval of NEI 06-09, Revision 0-A.

The TR NEI 06-09, Revision 0-A, as modified by the limitations and conditions in the NRC SE, requires that the cumulative impact of implementation of an RMTS be periodically assessed and shown to result in (1) a total risk impact below 1E-5/year for changes to CDF, (2) a total risk impact below 1E-6/year for changes to LERF, and (3) the total CDF and total LERF must be reasonably shown to be less than 1E-4/year and 1E-5/year, respectively. The licensee indicated in Enclosure 4 to the LAR that the estimated total CDF and LERF meet the 1E-4/year and 1E-5/year criteria of RG 1.174, respectively, consistent with the guidance in NEI 06-09, Revision 0-A, and that these guidelines must be satisfied whenever a RICT is implemented.

In RAI 10, the NRC staff noted that the F&O closure or the response to NRC RAls could involve updates to the IEPRA, internal Flooding PRA, or FPRA models. Therefore, the NRC staff requested an update of the CDF and LERF estimates, a summary of any updates performed after the LAR submittal, and a demonstration that the total CDF and LERF values still meet the risk acceptance criteria in RG 1.174. In the response to RAI 10, the licensee provided updated total CDF and LERF values. The licensee provided that the estimated total CDF is 9.51 E-05 per year for Unit 1 and 9.37E-05 per year for Unit 2 and that the estimated total LERF is 5.98E-06 per year for Unit 1 and 6.66E-06 per year for Unit 2. The licensee also stated that updates to the IEPRA and FPRA models due to responses to RAls was unnecessary, but that updates to the IEPRA and FPRA were required to resolve F&Os during the F&O closure process. The licensee stated that updates to the IEPRA to resolve F&Os will be incorporated into the FPRA as part of the normal PRA configuration control process prior to implementation of the proposed RICT program, as described in the license condition discussed in Section 4.0 of this SE.

The NRC staff reviewed the licensee's information, including RAI responses, and concluded that the PRA modeling used to support the proposed RICT Program is sufficient to treat alignments of components during periods when the RICT would be calculated. Therefore, the NRC staff finds that the licensee has satisfied the guidance of RG 1.177 (Section 2.3.3) and RG 1.174 (Section 2.2.3) and that the PRA modeling at Farley is appropriate for the calculation of RICTs.

The NRC staff also finds that changes to the PRA will only implement PRA methods approved by the staff and that the license condition provides reasonable assurance that the CDF and LERF guidelines will be met before the licensee implements the proposed RICT program.

The licensee has incorporated NEI 06-09, Revision 0-A, in the proposed RICT program of TS 5.5.20, and, therefore, can calculate the RICT consistently with its criteria and assesses the RICT program to ensure that any risk increases are small per the guidance of RG 1.174.

Therefore, the NRC staff finds that the licensee's proposed RICT program is consistent with NEI 06-09, Revision 0-A, and acceptable.

3.1.4.1.7 Implementation of the RICT Program The NRC staff reviewed the licensee's description of programs and procedures associated with implementation of the proposed RICT program in Attachment 1 (and its enclosures) of the LAR because NEI 06-09, Revision 0-A, involves the real-time application of PRA results and insights by the licensee. The administrative controls on the PRA and on changes to the PRA should provide confidence that the PRA results are reasonable and the administrative controls on the plant personnel using the RICT should provide confidence that the RICT program will be appropriately applied.

The quality assurance practices for the PRA models include meeting the ASME/ANS PRA standards and RG 1.200, which includes guidance for performing peer reviews and focused-scope peer reviews. The quality assurance practices for the PRA models are discussed by the licensee in Enclosure 2, "Information Supporting Consistency with Regulatory Guide 1.200, Revision 2," and Enclosure 5, "PRA Model Update Process," of the submittal. According to , "Attributes of the CRMP Model," future changes made to the baseline PRA model, changes made to the baseline PRA model for translation to the online model, and changes made to the online model configuration files are controlled and documented by plant procedures.

Changes to the PRA are expected to occur over time to reflect changes in PRA methods and changes to the as-built, as-operated, and maintained plant to reflect the operating experience at

the plant as specified in RG 1.200, Revision 2. Changes in PRA methods are addressed by the following License Condition in updated Enclosures 2 and 3, Appendix C for the Unit 1 and Unit 2 Operating Licenses, provided in response to RAI 12 in a letter dated May 3, 2019:

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC for generic use. If the licensee wishes to change its methods, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

The NRC staff finds that this license condition is acceptable because it adequately implements the proposed RICT program using models, methods, and approaches consistent with applicable guidance that is acceptable to the NRC.

Changes to the as-built, as-operated, and maintained plant to reflect the operating experience at the plant are discussed in LAR Enclosure 5. Enclosure 5 summarizes the PRA configuration control process, delineates the responsibilities and guidelines for updating the full power internal event, internal flood, fire, and seismic PRA models, and includes both periodic and interim PRA model updates. The licensee stated that the process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, procedural changes, planVindustry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the CRMP model.

In Enclosure 5 to the LAR, the licensee described the administrative controls process applicable to the PRA models used to support the proposed RICT program to ensure that these models reflect the as-built and as-operated plant. The licensee stated that the process provides for controlling the model and the associated electronic files and it includes both regularly scheduled and interim PRA model updates. Plant changes, including physical modifications and procedure or operating practice changes, are reviewed prior to implementation to determine if they could impact the PRA models. Routine updates are performed, at a minimum, every two fuel cycles.

The licensee further stated that if a quantitatively significant change cannot be implemented in the PRA model such that it could adversely affect RICT calculations, alternatives including bounding analyses or restrictions on the use of the RICT program are put in place. Further, the licensee stated that the reviews and updates will be performed by qualified personnel with independent reviews and approvals.

The licensee stated in Enclosure 6 to the LAR that the plant procedures specify that an acceptance test is performed after every CRMP model update. This test verifies proper translation of the baseline PRA models and acceptance of all changes made to the baseline PRA models into the CRMP model. This test also verifies correct mapping of plant components to the basic events in the CRMP model. The NRC staff concludes that the CRMP model used to calculate the RICTs is acceptable because the underlying PRA models will remain acceptable, the transition between the baseline and the CRMP models is reasonable, and the acceptance test should verify that the CRMP model is consistent with the underlying baseline PRA.

As described in Enclosure 8, "Program Implementation," to the LAR, the licensee has qualification and training programs for development, maintenance, and use of the CRMP model.

The licensee identifies the attributes that the RICT program procedures will address consistent with NEI 06-09, Revision 0-A. The licensee also identified the plant personnel that will be trained and the different types of training that the different plant personnel will receive. This includes training for individuals who will be directly involved in the implementation of the RICT program, as well as other individuals who may have some involvement with the RICT program.

The NRC staff finds that the implementation described in Enclosure 8 should establish appropriate programmatic and procedural controls for the proposed RICT program, consistent with the guidance of NEI 06-09, Revision 0-A. Training of plant personnel will be provided throughout all levels of the organization, commensurate with each position's responsibilities within the RICT program, as described in NEI 06-09, Revision 0-A. The NRC staff notes that the licensed bperators in the control room have responsibility for ensuring compliance with the TS and that the RICT program training to be provided will ensure that the licensee's staff understands risk concepts and will provide it with the necessary skills to determine the appropriate RICT when operating under an extended CT within the RICT program. The NRC staff notes that procedural guidance is provided for (1) the overall CRMP, (2) development and implementation of RMAs, (3) detailed requirements and limitations of the RICT program, (4)

PRA Functionality determination, and (5) recording LCOs.

LAR Enclosure 8, Section 2.4, discusses Farley's procedure for determining whether SSCs that are declared TS inoperable can be considered PRA Functional. The procedure identifies three specific conditions in which a TS inoperable SSC can be PRA Functional. The procedural instruction is based on guidance in NEI 06-09, Revision 0-A, that defines conditions for which PRA Functional can be used and provides examples of conditions for which PRA Functional cannot be used. Section 2.4 of Enclosure 8 to the LAR states that if the condition causing TS inoperability only impacts functions not modeled in the CRMP and has no risk impact, then the SSC may be considered PRA Functional. In RAI 18, the NRC staff noted that SSCs may be excluded from the PRA models based on explicitly stated or implicit assumptions made in the modeling. Therefore, the NRC staff requested confirmation that such PRA assumptions and modeling decisions are assessed during the PRA Functionality determination to conclude that an inoperable SSC not explicitly modeled in the PRA can be considered PRA Functional. In response to RAI 18, the licensee confirmed that PRA assumptions and modeling decisions must be assessed during the PRA Functionality determination to conclude that an inoperable SSC not explicitly modeled in the PRA can be considered PRA Functional and provided examples illustrating how such assumptions and modeling decisions would be considered.

Based on the proposed RICT program that would be included in Section 5.5.20 of the TSs and the licensee's description of the PRA model update process, the NRC staff finds that the licensee's PRA maintenance and change process provides confidence that the CRMP models used in the RICT calculations will continue to use PRA methods that are acceptable to the NRC and that the PRA model used for the RICT calculations will be updated as necessary to reflect the as-built and as-operated plant. Therefore, the NRC staff finds that the licensee has appropriate administrative controls in place to ensure proper implementation of the proposed RICT program, consistent with the guidance of NEI 06-09, Revision 0-A.

3.1.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations Tier 2 provides that a licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is taken out-of-service in accordance with the proposed TS change.

The TR NEI 06-09, Revision 0-A, does not permit voluntary entry into high risk configurations, which would exceed instantaneous CDF and LERF limits of 1E-3/year and 1E-4/year, respectively. It further requires implementation of RMAs when the actual or anticipated risk accumulation during a RICT will exceed one tenth of the incremental core damage probability or incremental ICLERP limit. Such RMAs may include rescheduling planned activities to lower risk periods or implementing risk reduction measures. The limits established for entry into a RICT and for RMA implementation are consistent with the guidance of NUMARC 93-01, Revision 4A, endorsed by RG 1.160, Revision 3, as applicable to plant maintenance activities. The RICT program requirements and criteria are consistent with the principle of Tier 2 to avoid risk significant configurations.

In RAI 19, the NRC staff requested a description of the criteria and insights that will be used to determine what compensatory measures and RMAs to apply for specific plant configurations. In response to RAI 19, the licensee described the procedural guidance for development and implementation of RMAs to meet the requirements of 10 CFR 50.65(a)(4) regarding requirements for monitoring the effectiveness of maintenance and for the RICT program. The licensee presented a table that describes the RMA requirements for various potential conditions based on (1) whether the time interval from discovery of a condition requiring entry into a TS action exceeds the front stop, (2) whether the time interval from discovery of a condition requiring entry into a TS action exceeds the RMAT, and (3) the risk profile (i.e., green, yellow, orange, or red). Based on the condition, the following types of RMAs are applied:

Non-fire Level 1 RMA (Actions that increase awareness of the risk, control of the activity, and rigor associated with planning activities).

Non-fire Level 2 RMA (Actions that minimize activity durations and the magnitude of risk increase).

Non-fire Level 3 RMA (Actions that escalate risk awareness and instill an acute urgency to lower risk).

Fire RMAs (Actions that reduce the likelihood of a fire causing an initiating event or damaging accident mitigation equipment).

Common Cause RMAs (RMAs that target the success of the redundant and/or diverse SSCs of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC).

The licensee stated that plant procedures contain immediate actions for emergent non-green risk profiles including stopping work that would generate a plant transient or initiating event; taking action to restore to functional status any out of service components that provide redundancy to the failed SSC(s); deferring any activities that might impact availability of functional components, including fire detection and suppression equipment; and initiating response teams and augmented staffing. In addition, the licensee stated that plant procedures

also direct development of RMAs based on use of the CRMP model to identify risk significant events such as important out-of-service components, in-service components, initiators, and fire zones. The NRC staff finds that the licensee's criteria and insights that will determine RMAs will meet the requirements of 10 CFR 50.65(a)(4) and are, therefore, acceptable.

Based on the licensee's incorporation of NEI 06-09, Revision 0-A, in the TS, and because the proposed risk acceptance guidelines are consistent with the guidance of RG 1.174 and RG 1.177, the NRC staff finds that the licensee's Tier 2 program is acceptable and supports the implementation of the proposed RICT Program.

3.1.4.3 Tier 3: Risk-Informed Configuration Risk Management Tier 3 provides that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity.

The licensee addresses Tier 3 guidance by requiring the assessment of the RICT to be based on the plant configuration of all SSCs that might impact the RICT, including safety-related and non-safety-related SSCs. If a risk-significant plant configuration exists, based on the expectation of exceeding a threshold of one-tenth of the risk on which the RICT is based, then compensatory measures and RMAs are required to be implemented. Thus, the proposed RICT program provides a methodology to assess and address risk-significant configurations. Further, reassessments of any plant configuration changes are also required to be completed in a timely manner, based on the more restrictive limit of any applicable TS action requirement or a maximum of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the configuration change occurs.

Based on the licensee's incorporation of NEI 06-09, Revision 0-A, in the TS, and because the proposed changes are consistent with the Tier 3 guidance of RG 1.177, the NRC staff finds that the proposed changes are acceptable.

3.1.4.4 Key Principle 4 Conclusions The licensee has demonstrated the technical acceptability and scope of its PRA models and that the models can support the implementation of the proposed RICT program for determining CTs. The licensee has made proper consideration of key assumptions and sources of uncertainty. The risk metrics are consistent with the approved methodology of NEI 06-09, Revision 0-A, and the acceptance guidance in RG 1.177 and RG 1.174. The proposed RICT program is controlled administratively through plant procedures and training. The proposed RICT program follows the NRG-approved methodology in NEI 06-09, Revision 0-A. The NRC staff concludes that the proposed RICT program satisfies the fourth key safety principle of RG 1.177 and is, therefore, acceptable.

3.1.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program Regulatory Guides 1.174, Revision 3, and 1.177, Revision 1, establish the need for an implementation and monitoring program to ensure that extensions to TS CTs do not degrade operational safety over time and that no adverse degradation occurs due to unanticipated degradation or CC mechanisms. Two performance monitoring strategies are identified in the licensee's LAR. Monitoring of the total cumulative impact of extending the CTs and monitoring the reliability and availability of SSCs impacted by the proposed RICT program.

Section 3.3.3 of NEI 06-09, Revision 0-A, requires that the licensee track the risk associated with all entries beyond the front stop CT and Section 2.3.1 provides a requirement for assessing cumulative risk, including a periodic evaluation of any increase in risk, due to the use of the RMTS program to extend the CTs. According to Enclosure 9 to the submittal, the licensee calculates cumulative risk at least every refueling cycle, not to exceed 24 months, consistent with NEI 06-09, Revision 0-A, guidance. The licensee converts the cumulative ICDP and the ILERP into average annual values which are then compared to the acceptable risk increase guidelines of RG 1.174. If any limits are exceeded, corrective actions are taken to ensure that future plant operational risk is within the acceptance guidance. This evaluation ensures that RMTS program implementation meets RG 1.174 guidance for small risk increases. The licensee will implement NEI 06-09, Revision 0-A, via the proposed RICT program and, therefore, complies with this RMTS program.

An implementation and monitoring program is also intended to ensure that any changes to the reliability and availability of SSCs within the scope of the RICT program be identified and incorporated into the RICT models. Regulatory Guide 1.174 states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed. is sufficient for the SSCs affected by the risk-informed application. The LAR states that the SSCs in the scope of the proposed RICT program are also in the scope of the Maintenance Rule and, therefore, the Maintenance Rule monitoring can be used.

3.1.5.1 Key Principle 5 Conclusions The NRC staff concludes that the proposed RICT program satisfies the fifth key safety principle of RG 1.177 and RG 1.174 by, in part, monitoring the average annual cumulative risk increase as described in NEI 06-09, Revision 0-A, and using this average annual increase to ensure that the program, as implemented, meets RG 1.174 guidance for small risk increases and, therefore, is acceptable. Additionally, the NRC staff concludes that the proposed RICT program satisfies the fifth key safety principle of RG 1.177 and RG 1.174 because, in part, all the affected SSCs are within the Maintenance Rule program which can be used to monitor changes to the reliability and availability of these SSCs.

3.2 Technical Specification Administrative Controls Section The NRC staff reviewed the licensee's proposed addition of a new program, the RICT Program, to the Administrative Controls section of the TS. The NRG staff evaluated the elements of the new program to ensure its alignment with the requirements in 10 CFR 50.36(c)(5) and to ensure that the programmatic controls are consistent with the RICT program described in NEI 06-09, Revision 0-A.

Proposed TS 5.5.20 would require that the RICT Program be implemented in accordance with NEI 06-09, Revision 0-A. This is acceptable because NEI 06-09, Revision 0-A, establishes an appropriate framework for an acceptable RICT program.

The TS would state that a RICT may not exceed 30 days. The NRC staff determined that a 30-day limit is appropriate because it allows sufficient time to restore SSCs to operable status while avoiding excessive out-of-service times for TS SSCs.

The TS would state that the RICT may only be used in Modes 1 and 2. This provision ensures that the RICT is only used for determination of CDF and LERF for modes of operation modelled in the PRA.

The TS would require that while in a RICT, any change in plant configuration as defined in NEI 06-09, Revision 0-A, must be considered for the effect on the RICT. The TS would also specify time limits for determining the effect on the RICT. These time limitations are consistent with those specified in NEI 06-09, Revision 0-A.

The TS would contain requirements for the treatment of CCFs for emergent conditions in which the common cause evaluation is not complete. The requirements are to either (a) numerically account for the increased probability of CCF or (b) implement RMAs that support redundant or diverse SSCs that perform the functions of the inoperable SSCs and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Key Principle 2 of risk-informed decision making is to ensure that the change is consistent with defense-in-depth philosophy. The seven considerations supporting the evaluation of the impact of the proposed changes on defense-in-depth are discussed in RG 1.174, including one to preserve adequate defense against potential CCF. The NRC staff finds that numerically accounting for an increased probability of failure will shorten the estimated RICT based on the particular SSCs involved thereby limiting the time when a CCF could affect risk. Alternatively, implementing actions that can increase the availability of other mitigating SSCs or decrease the frequency of demand on the affected SSCs will decrease the likelihood that a CCF could affect risk. The NRC staff concludes that both the quantitative and the qualitative actions minimize the impact of CCF and, therefore, support meeting Key Principle 2 as described in RG 1.174.

These methods either limit the exposure time, help ensure the availability of alternate SSCs, or decrease the probability of plant conditions requiring the safety function to be performed. The NRC staff finds that these methods contribute to maintaining defense-in-depth because the methods limit the exposure time or ensure the availability of alternate SSCs.

The TS would contain a provision that risk assessment approaches and methods used shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant and reflect the operating experience at the plant, as specified in RG 1.200, Revision 2. Methods to assess the risk from extending the CTs must be PRA methods used to support this LAR or other methods approved by the NRC for generic use. As stated in the NRC staff's SE of NEI 06-09, Revision 0-A:

TR NEI 06-09, Revision 0, requires an evaluation of the PRA model used to support the RMTS against the requirements of RG 1.200, Revision 1, and ASME RA-S-2002, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications" ... for capability Category II. This assures that the PRA model is technically adequate for use in the assessment of configuration risk. This capability category of PRA is sufficient to support the evaluation of risk associated with out-of-service SSCs and establishing risk-informed CTs.

Proposed TS 5.5.20 was updated to reflect the current revision of RG 1.200. RG 1.200 incorporates ASME RA-S-2002 by reference.

The NRC staff's SE of NEI 06-09, Revision 0-A, also states:

As part of its review and approval of a licensee's application requesting to implement the RMTS, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods approved by the NRC staff for use in the plant-specific RMTS program. If a licensee wishes to change its methods, and the change is outside the bounds of the license condition, the licensee will need NRC approval, via a license amendment, of the

implementation of the new method in its RMTS program. The focus of the NRC staff's review and approval will be on the technical adequacy of the methodology and analyses relied upon for the RMTS application.

The licensee proposes to relocate this limitation and condition from a license condition to the Administrative Controls section of the TS. Specifically, proposed TS 5.5.20 restates this limitation and condition from the NRC staff's SE in language that is appropriate for the Administrative Controls section of the Farley TS. This constraint appropriately requires the licensee to utilize the risk assessment approaches and methods previously approved by the NRC and/or incorporated in the RICT Program and requires prior NRC approval for any change in PRA methods to assess risk that are outside those approval boundaries. The NRC staff finds that this requirement is appropriately reflected in the Administrative Controls section of the Farley TS.

The regulations at 10 CFR 50.36(c)(5) require the TS to contain administrative controls providing "provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner."

The NRC staff has determined that the Administrative Controls section of the Farley TS, as amended, will ensure operation of the facility in a safe manner when the facility uses the RICT Program. Therefore, the NRC staff has determined that the requirements of 10 CFR 50.36(c)(5) are satisfied.

4.0 PROPOSED LICENSE CONDITION In its letter dated May 3, 2019, the licensee proposed the following license condition to be added to Appendix C of the Farley Units 1 and 2 renewed facility operating licenses:

Southern Nuclear Operating Company (SNC) is approved to implement the Risk Informed Completion Time (RICT) Program as specified in the license amendment request submittal dated July 27, 2018, as supplemented on ...

[May 3, 2019.]

Updates from the Findings and Observation resolutions of the Internal Events Internal Flooding Probabilistic Risk Assessment (PRA) model shall be incorporated into the Fire PRA per the internal SNC PRA configuration process, prior to implementation of the RICT program.

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC for generic use. If the licensee wishes to change its methods, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

The NRC staff notes that prior approval would be required for a change to the proposed RICT Program or the implementation of the proposed RICT Program as described in the TS Administrative Controls Section 5.5.20. Prior NRC approval would also be required for changes to the PRA methods that have not been previously approved by the NRC in this SE or for generic use. The NRC staff finds that the license condition is acceptable because, with it, the

licensee would adequately implement the proposed RICT Program using models, methods, and approaches consistent with applicable guidance that are acceptable to the NRC.

5.0

SUMMARY

5.1 NRC Staff Findings and Conclusions The NRC staff finds that the licensee's proposed implementation of the RICT Program for the identified scope of RMAs is consistent with the guidance of NEI 06-09, Revision 0-A, subject to the limitations and conditions evaluated in Section 4.0 of this SE. The licensee's methodology for assessing the risk impact of extended CTs, including the individual CT extension impacts in terms of ICDP and ILERP, and the overall program impact in terms of ~CDF and ~LERF, is accomplished using PRA models of sufficient scope and technical adequacy based on consistency with the guidance of RG 1.200, Revision 2, with completion of the implementation items. The RICT calculation uses the PRA model as translated into the CRMP tool and the licensee has an acceptable process in place to ensure that the PRA model continues to use NRC accepted methods and is appropriately updated to reflect changes to the plant or operating experience. In addition, the NRC staff finds that the proposed implementation of the RICT Program addresses the RG 1.177 defense-in-depth philosophy and safety margins to ensure that they are adequately maintained and includes adequate administrative controls as well as performance monitoring programs.

The regulation at 10 CFR 50.36(a)(1) states, in part, "A summary statement of the bases or reasons for such specifications, other than those covering administrative controls, shall also be included in the application, but shall not become part of the technical specifications."

Accordingly, along with the proposed TS changes, the licensee also submitted TS Bases changes that corresponded to the proposed TS changes to provide the reasons for the TSs.

The NRC staff finds that the TS bases changes were consistent with the bases changes in the model application.

5.2 Technical Evaluation Conclusions The NRC staff has evaluated the proposed changes against each of the five key principles in RG 1.177 and RG 1.174.

The proposed changes to the LCO conditions and the CTs for remedial actions are acceptable and will continue to meet 10 CFR 50.36(c)(2), 50.40(a), 50.57(a)(2), and 50.57(a)(6).

Therefore, the NRC staff concludes that the proposed change meets Key Principle 1: change meets current regulations.

For LCO conditions in the existing TS, some reduction in defense-in-depth has already been evaluated and accepted for a limited period of time during the current CT, and the RICT provides solely a risk-informed extension for operating in that plant condition. Therefore, the NRC staff concludes that the proposed change meets Key Principle 2: change is consistent with defense-in-depth philosophy.

Implementation of the methodology as described in the licensee's proposed TS 5.5.20 provides confidence that the licensee can extend the CTs without any unanalyzed reductions in safety margins because the design-basis success criteria parameters will be at the same level and provided by the same equipment as has been currently accepted. Therefore, the NRC staff concludes that the proposed change meets Key Principle 3: maintains sufficient safety margins.

The licensee has demonstrated the technical acceptability and scope of its PRA models, after completion of the limitations in the license condition, and that the models can support implementation of the RICT Program for determining the identified CTs. The risk metrics will be consistent with the NRG-approved methodology of NEI 06-09, Revision 0-A, RG 1.174, and RG 1.177 and the RICT Program is controlled administratively through plant procedures and training. Therefore, the NRC staff concludes that the proposed change meets Key Principle 4:

proposed increases in CDF or risk are small and are consistent with the Commission's Safety Goal Policy Statement.

The licensee takes the sum of the contributors to risk associated with each application of the RICT program and that change in CDF or LERF above the zero maintenance baseline levels is converted into average annual values which are then compared to the limits of RG 1.174. If any limits are exceeded, corrective actions are taken to ensure that future plant operational risk is within the acceptance guidance. The SSCs in the scope of the RICT Program that have their CTs extended by entry into the RICT Program are monitored to ensure that their safety performance is not degraded because the SSCs in the scope of the RICT Program are also in the scope of the Maintenance Rule. RG 1.174 states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application. The NRC staff, therefore, concludes that the proposed change meets Key Principle 5: use performance measurement strategies to monitor the change.

Based on the above, the NRC staff concludes that the proposed changes satisfy the key principles of risk-informed decision-making identified in RG 1.174 and RG 1.177 and, therefore, the requested adoption of the proposed changes to the TSs, implementation items, and associated guidance is acceptable.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Alabama State official was notified of the proposed issuance of the amendments on July 16, 2019. On July 23, 2019, the State official confirmed that the State of Alabama had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (84 FR 25840; June 4, 2019). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

9.0 REFERENCES

1. Gayheart, Cheryl A., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant -

Units 1 & 2, License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, 'Risk-Informed Technical Specifications Initiative 4b, Risk Managed Technical Specifications (RMTS) Guidelines,"' dated July 27, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18208A619).

2. Gayheart, Cheryl A., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications, SNC Response to U.S. Nuclear Regulatory Commission Request for additional Information (RAI}," dated May 3, 2019 (ADAMS Accession No.ML19123A253).

3. Gayheart, Cheryl A., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant Units 1 & 2, Significant Hazards Evaluation and Environmental Considerations for Farley Risk Informed Technical Specifications Response to Request for Additional Information,"

dated May 17, 2019 (ADAMS Accession No. ML19137A343).

4. Gayheart, Cheryl A., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant-Units 1 & 2, Risk Informed Technical Specification Information Only Bases Changes,"

dated June 27, 2019 (ADAMS Accession No. ML19178A390).

5. Nuclear Energy Institute (NEI) Topical Report NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, November 2006 (ADAMS Accession No. ML12286A322).

6. Golder, Jennifer, U.S. Nuclear Regulatory Commission, letter and Final Safety Evaluation to Biff Bradley, Nuclear Energy Institute, "Final Safety Evaluation For Nuclear Energy Institute (NEI) Topical Report (TR} NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"'

dated May 17, 2007 (ADAMS Accession No. ML071200238).

7. Williams, Shawn, U.S. Nuclear Regulatory Commission, letter to Cheryl Gayheart, Southern Nuclear Operating Company, "Joseph M. Farley Nuclear Plant, Units 1 and 2 -

Audit Summary in Support of the License Amendment Request to Implement Risk-Informed Technical Specifications Initiative 48," dated February 26, 2019 (ADAMS Accession No. ML19042A108).

8. Williams, Shawn, U.S. Nuclear Regulatory Commission, E-mail to Jamie Marquess Coleman, SNC, "RE: Joseph M. Farley Nuclear Plant, Units 1 and 2 - Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, 'Risk-Informed Technical Specifications Initiative 4B' (EPID L-2018-LLA-0210)," dated March 12, 2019 (ADAMS Accession No. ML19072A027).

9. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated March 2009 (ADAMS Accession No. ML090410014).

10. Gayheart, Cheryl A., Southern Nuclear Operating Company, letter and supplements to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant, Units 1 & 2, Revision 28 to the Updated Final Safety Analysis Report, Updated NFPA 805 Fire Protection Program Design Basis Document, Technical Specification Bases Changes, Technical Requirements Manual Changes, 10 CFR 50.59 Summary Report, and Revised U.S. Nuclear Regulatory Commission Commitments Report," dated October 30, 2018 (ADAMS Package Accession No. ML18312A093).

11. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," January 2018 (ADAMS Accession No. ML17317A256).

12. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications,"

May 2011 (ADAMS Accession No. ML100910008).

13. Nuclear Energy Institute (NEI) and Nuclear Management and Resources Council (NUMARC) 93-01, Revision 4A, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," April 2011 (ADAMS Accession No. ML11116A198).

14. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, Revision 3, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May 2012 (ADAMS Accession No. ML113610098).

15. American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS)

RA-Sa-2009, Addenda to ASME RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications."

16. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.93, Revision 1, "Availability of Electric Power Sources," March 2012 (ADAMS Accession No. ML090550661).

17. Generic Letter (GL) 80-30, "Clarification of the Term "Operable" as it Applies to Single Failure Criterion for Safety Systems Required by TS," April 10, 1980 (publicly available in the U.S. Nuclear Regulatory Commission Library at http://www.nrc.gov/reading-rm/doc-collections/gen-comm/gen-letters/1980/gl80030. htm I).

18. Nuclear Energy Institute (NEI) NEI 05-04, Revision 2, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," November 2008 (ADAMS Accession No. ML083430462).

19. Andersen, Victoria, Nuclear Energy Institute (NEI), letter to Stacey Rosenberg, U.S.

Nuclear Regulatory Commission, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," dated February 21, 2017 (ADAMS Accession No. ML17086A431 ).

20. Giitter, Joseph and Ross-Lee, Mary Jane, U.S. Nuclear Regulatory Commission, letter to Greg Krueger, Nuclear Energy Institute, "U.S Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os)," dated May 3, 2017 (ADAMS Accession No. ML17079A427).

21. Westinghouse Electric Company, LLC, WCAP-17100-NP, Revision 1, "PRA Model for the Westinghouse Shut Down Seal," February 2010 (ADAMS Accession No. ML101020568).

22. Wheat, Justin T., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant, License Amendment Request to Revise Technical Specification Section 5.5.17

'Containment Leakage Rate Testing Program,' Final Response to NRC Requests for Additional Information," dated October 12, 2017 (ADAMS Accession No. ML172858308).

23. Morey, Dennis C., U.S. Nuclear Regulatory Commission, letter to W. Anthony Nowinowski, Pressurized Water Reactor (PWR) Owners Group, "Final Safety Evaluation for Pressurized Water Reactor Owners Group Topical Report PWROG-14001-P, Revision 1 'PRA Model for the Generation Ill Westinghouse Shutdown Seal' (CAC No.

MF4397)," dated August 23, 2017 (ADAMS Accession Nos. ML17200C875 and ML17200C876).

24. Stringfellow, Jack, Pressurized Water Reactor (PWR) Owners Group, letter to U.S.

Nuclear Regulatory Commission Document Control Desk, "Submittal of PWROG-14001-P/NP Revision 1, 'PRA Model for the Generation Ill Westinghouse Shutdown Seal,' PA-RMSC-0499R2," dated July 3, 2014 (ADAMS Accession No. ML14190A331).

25. Westinghouse Electric Company, LLC, WCAP-15603, Revision 1 (Non-Proprietary),

"WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs," May 2002 (ADAMS Accession No. ML021500485).

26. Nuclear Energy Institute (NEI) NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA)

Peer Review Process Guidelines," Draft Version H, Revision 0, Nuclear Energy Institute, Washington, DC, November 2008.

27. U.S. Nuclear Regulatory Commission, NUREG-2180, "Determining the Effectiveness, Limitations, and Operator Response for Very Early Warning Fire Detection Systems in Nuclear Facilities (DELORES-VEWFIRE), Final Report," dated December 2016 (ADAMS Accession No. ML16343A058).

28. U.S. Nuclear Regulatory Commission and Electric Power Research Institute (EPRI),

NUREG-2169, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database," January 2015 (ADAMS Accession No. ML15016A069).

29. U.S. Nuclear Regulatory Commission and Electric Power Research Institute (EPRI),

NUREG/CR-7150, "Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE)," Volume 2 (ADAMS Accession No. ML14141A129).

30. U.S. Nuclear Regulatory Commission, NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking,"

March 2017 (ADAMS Accession No. ML17062A466).

31. Vega, Frankie, U.S. Nuclear Regulatory Commission, letter to C.R. Pierce, "Joseph M.

Farley Nuclear Plant, Units 1 and 2 - Staff Assessment of Information Provided Pursuant to Title 1O of the Code of Federal Regulations Part 50, Section 50.54(f),

Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-lchi Accident (TAC Nos. MF3832 and MF3833)," dated October 16, 2015 (ADAMS Accession No. ML15287A092).

32. U.S. Nuclear Regulatory Commission, Generic Issue 199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," August 2010 (ADAMS Package Accession No. ML100270582).

33. Lawrence Livermore National Laboratory, prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-4334, "An Approach to the Quantification of Seismic Margins in Nuclear Power Plants," August 1985 (ADAMS Accession No. ML090500182).

34. U.S. Nuclear Regulatory Commission, Regulatory Guide 1. 76, Revision 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," March 2007 (ADAMS Accession No. ML070360253).

35. Pacific Northwest National Laboratory, prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Revision 2, "Tornado Climatology of the Contiguous United States," February 2007 (ADAMS Accession No. ML070810400).

36. Pierce, C.R., Southern Nuclear Operating Company, letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Joseph M. Farley Nuclear Plant- Units 1 and 2, Recommendation 2.1 Flood Hazard Reevaluation Report," dated October 21, 2015 (ADAMS Accession No. ML15294A530 (Non-Public)).

37. Vega, Frankie, U.S. Nuclear Regulatory Commission, letter to J.J. Hutto, "Joseph M.

Farley Nuclear Plant, Units 1 and 2 - Staff Assessment of Flooding Focused Evaluation (CAC Nos. MF9863 and MF9864; EPIDs 000495/05000348/L-2017-JLD-0043 and 000495/05000364/L-2017-JLD-0043)," dated January 24, 2018 (ADAMS Accession No. ML17331A410).

38. U.S. Nuclear Regulatory Commission, NUREG/CR-7046 (PNNL-20091 ), "Design-Basis Flood Estimation for Site Characterization at Nuclear Power Plants in the United States of America," November 2011 (ADAMS Accession No. ML11321A195).

39. Williams, Shawn, U.S. Nuclear Regulatory Commission, Memo to Southern Nuclear Operating Company, "Summary of October 16, 2018, Meeting with Southern Nuclear Operating Company, Inc. to Discuss the Joseph M. Farley Nuclear Plant, Units 1 and 2, Electrcial Distribution System as it Relates to the Risk-Informed Completion Times Amendment (EPID L-2018-LLA-0210)," dated Novemver 7, 2018 (ADAMS Acession No.

ML18306A313).

40. U.S. Nuclear Regulatory Commission, NUREG-1855, Volume 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making,"

March 2009 (ADAMS Accession No. ML090970525).

Principal Contributors:

M. Biro B. Hartle T. Tjader G. Matharu D.Wu Date of Issuance: August 23, 2019

ML19175A243 *Via Memo OFFICE DORL/LPL2-1/PM DORL/LPL2-1/LA DRA/APLA/BC DSS/STSB/ABC DE/EEOB/ABC NAME SWilliams KGoldstein SRosenberg* PSnyder DWilliams DATE 7/24/19 7/19/19 7/2/19 7/2/19 7/11/19 OFFICE DSS/SRXB/ABC OGC/NLO DORL/LPL2-1 /BC DORL/LPL2-1/PM NAME RAnzalone JWachutka MMarkley $Williams DATE 7/24/19 8/6/19 8/23/19 8/23/19

v t e Letter Sequence Approval
EPID:L-2018-LLA-0210, TSTF-500, TSTF-505, TSTF-412 (Approved, Closed)
Initiation Request, Request, Request Acceptance, Acceptance, Acceptance Administration Meeting, Meeting Questions Answers 3 May 2019 17 May 2019 Results Approval, Approval Other: ML19042A108
MONTHYEAR2019-03-12 [Table View]

ML19175A243

Text

SUBJECT:

Dear Ms. Gayheart:

Enclosures:

Attachment:

Attachment:

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

SUMMARY

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

9.0 REFERENCES

Navigation menu

Search