Text

Staff Assessment of Flood Hazard Focused Evaluation and Integrated Assessment
	ML20171A534
Person / Time
Site:	Millstone
Issue date:	08/13/2020
From:	David Wrona; NRC/NRR/DORL/LPMB
To:	Stoddard D; Dominion Nuclear Connecticut
	Uribe J
References
	EPID L-2020-JLD-0000
	Download: ML20171A534 (53)
	v • d • e

August 13, 2020 Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Dominion Nuclear Connecticut, Inc.

Millstone Power Station Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-6711

SUBJECT:

MILLSTONE POWER STATION, UNITS 2 AND 3 - STAFF ASSESSMENT OF FLOOD HAZARD FOCUSED EVALUATION AND INTEGRATED ASSESSMENT (EPID NO. L-2020-JLD-0000)

Dear Mr. Stoddard:

The purpose of this letter is to document the staffs evaluation of the Millstone Power Station, Units 2 and 3 (Millstone) flooding integrated assessment (IA) which was submitted in response to the Near-Term Task Force (NTTF) Recommendation 2.1, Flooding. The U.S. Nuclear Regulatory Commission (NRC) has concluded that the results and risk insights described in the Millstone flooding IA and the staffs independent assessment support the NRCs determination that no further response or regulatory actions are required.

By letter dated March 12, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12053A340), the NRC issued a request for information to all power reactor licensees and holders of construction permits in active or deferred status, under Title 10 of the Code of Federal Regulations (10 CFR), Section 50.54(f), hereafter referred to as the 50.54(f) letter. The request was issued in connection with implementing lessons learned from the 2011 accident at the Fukushima Dai-ichi nuclear power plant, as documented in the NRCs NTTF report (ADAMS Accession No. ML111861807). Enclosure 2 to the 50.54(f) letter requested that licensees reevaluate flood hazards for their sites using present-day methods and regulatory guidance used by the NRC staff when reviewing applications for early site permits and combined licenses (ADAMS Accession No. ML12056A046). By letters dated March 12, 2015, and January 4, 2019 (ADAMS Accession Nos. ML15078A203 and ML19011A109, respectively), Dominion Energy Nuclear Connecticut, Inc (Dominion, the licensee) submitted its flood hazard reevaluation report (FHRR) and supplemental information for Millstone.

After reviewing the licensees FHRR, by letters dated December 21, 2016 and April 3, 2019 (ADAMS Accession Nos. ML16308A226 and ML19070A217, respectively), the NRC staff issued a summary of its review of the Millstone reevaluated flood-causing mechanisms. The NRC staff also issued a staff assessment and supplement by letters dated October 3, 2018, and October 7, 2019 (ADAMS Accession Nos. ML18256A200 and ML19246A116, respectively),

which provided the documentation supporting the NRC staff's conclusions described in the summary letters.

D. Stoddard These letters affirmed that the local intense precipitation (LIP), streams and rivers, tsunami, and storm surge flood-causing mechanisms at Millstone are not bounded by the plants current design basis, therefore, additional assessments of the flood hazard mechanisms are necessary.

By letter dated February 10, 2020 (ADAMS Accession No. ML20042D996), the licensee submitted its IA for Millstone. The IAs are intended for the NRC to assess the sites capability to cope with the reevaluated hazard, and to determine if additional regulatory actions are necessary under the backfit regulation. The purpose of this staff assessment is to provide the results of the NRCs evaluation of the Millstone IA.

As set forth in the enclosed staff assessment, the NRC staff has concluded that the Millstone IA was performed consistent with the guidance described in Nuclear Energy Institute (NEI) 16-05, Revision 1, External Flooding Assessment Guidelines (ADAMS Accession No. ML16165A178), as endorsed by Japan Lessons-Learned Division (JLD) interim staff guidance (ISG) JLD-ISG-2016-01, Guidance for Activities Related to Near-Term Task Force Recommendation 2.1, Flood Hazard Reevaluation (ADAMS Accession No. ML16162A301).

The NRC staff has also concluded that the licensee has demonstrated that effective flood protection, if appropriately implemented, exists for the LIP, streams and rivers, and tsunami flood-causing mechanisms, and that the site is reasonably protected against these flood hazards. In addition, the staff has determined that the licensee has adequately evaluated the storm surge flood hazard and that scenarios with consequential flooding and higher frequencies of occurrence have an effective flood protection strategy, and those scenarios with lower frequencies of occurrence have a feasible response strategy to mitigate the effects of the flooding conditions. This determination is primarily based on the following considerations:

1. The inherent conservatisms, and the risk-informed insights determined by the low probability of the event,

2. The anticipatory actions that provide effective flood protection, and the reactive actions that provide reliable flood mitigation.

The staff has inspected, audited, and reviewed, as appropriate, pertinent provisions of the licensees strategy and found it acceptable. The NRC staff expects that the licensee will address the regulatory commitments described in the February 10, 2020, submittal consistent with NEI 99-04, "Guidelines for Managing NRC Commitment Changes," Revision 0, dated July 1999 (ADAMS Accession No. ML003680088). Based on the above, the NRC staff concludes that no additional regulatory actions are necessary at Millstone.

D. Stoddard If you have any questions, please contact Juan Uribe at 301-415-3809, or by e-mail at Juan.Uribe@nrc.gov.

Sincerely,

/RA/

David Wrona, Deputy Director (Acting)

Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos: 50-336 and 50-423

Enclosure:

Staff Assessment Related to the Flooding Evaluations for Millstone cc w/encl: Distribution via Listserv

STAFF ASSESSMENT BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO THE FOCUSED EVALUATION AND INTEGRATED ASSESSMENT FOR MILLSTONE POWER STATION, UNITS 2 AND 3 AS A RESULT OF THE REEVALUATED FLOODING HAZARD NEAR-TERM TASK FORCE RECOMMENDATION 2.1 - FLOODING EPID NO. L-2020-JLD-0000

1.0 INTRODUCTION

By letter dated March 12, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12053A340), the U.S. Nuclear Regulatory Commission (NRC) issued a request for information to all power reactor licensees and holders of construction permits in active or deferred status, under Title 10 of the Code of Federal Regulations (10 CFR),

Section 50.54(f), hereafter referred to as the 50.54(f) letter. The request was issued in connection with implementing lessons learned from the 2011 accident at the Fukushima Dai-ichi nuclear power plant, as documented in the NRCs Near-Term Task Force (NTTF) report (ADAMS Accession No. ML111861807). of the 50.54(f) letter requested that licensees reevaluate flood hazards for their respective sites using present-day methods and regulatory guidance used by the NRC staff when reviewing applications for early site permits and combined licenses (ADAMS Accession No. ML12056A046). If the reevaluated hazard for any flood-causing mechanism is not bounded by the plants current design basis (CDB) flood hazard, an additional assessment of plant response would be necessary. Specifically, the 50.54(f) letter states that an integrated assessment (IA) should be submitted, and described the information that the IA should contain.

By letter dated November 30, 2012 (ADAMS Accession No. ML12311A214), the NRC staff issued Japan Lessons-Learned Project Directorate (JLD) interim staff guidance (ISG) JLD-ISG-2012-05, Guidance for Performing the Integrated Assessment for External Flooding.

On June 30, 2015 (ADAMS Accession No. ML15153A104), the NRC staff issued COMSECY-15-0019, describing the closure plan for the reevaluation of flooding hazards for operating nuclear power plants. The Commission approved the closure plan on July 28, 2015 (ADAMS Accession No. ML15209A682). COMSECY-15-0019 outlines a revised process for addressing cases in which the reevaluated flood hazard is not bounded by the plants CDB. The revised process describes a graded approach in which licensees with hazards exceeding their CDB flood may not be required to complete an IA, but instead may perform a focused evaluation (FE). By letter dated September 1, 2015 (ADAMS Accession No. ML15174A257), the NRC informed all affected licensees of the plan to use a graded approach in addressing the reevaluated flood hazard.

Nuclear Energy Institute (NEI) 16-05, Revision 1, External Flooding Assessment Guidelines (ADAMS Accession No. ML16165A178), was issued by NEI to describe a method of applying a graded approach to address the reevaluated flood hazards. It has been endorsed by the NRC as an appropriate methodology for licensees to use in response to the 50.54(f) letter.

Enclosure

The NRCs endorsement of NEI 16-05, including exceptions, clarifications, and additions, is described in NRC JLD-ISG-2016-01, Guidance for Activities Related to Near-Term Task Force Recommendation 2.1, Flood Hazard Reevaluation (ADAMS Accession No. ML16162A301).

Therefore, NEI 16-05, Revision 1, as endorsed, describes acceptable methods for Millstone Power Station, Units 2 and 3 (Millstone) to address their response to the reevaluated flood hazard mechanisms.

The NRC staff described how the licensees assessment of the reevaluated hazard would be reviewed to determine if further regulatory action should be taken, such as backfitting additional safety enhancements, in an internal memorandum dated September 21, 2016 (ADAMS Accession No. ML16237A103), which was subsequently revised by memorandum dated March 2, 2020 (ADAMS Accession No. ML20043D958). This memorandum describes the formation of a Senior Management Review Panel (SMRP) from the Office of Nuclear Reactor Regulation (NRR) that are expected to reach a decision for each plant submitting an IA. Flood hazards evaluated as FEs are not subject to the SMRP. The SMRP is supported by NRC technical staff who are responsible for consolidating relevant information and developing recommendations for the consideration of the panel. In presenting recommendations to the SMRP, the supporting technical staff is expected to recommend placement of each flooding IA plant into one of three groups:

1) Group 1 will include plants for which available information indicates that further regulatory action is not warranted. For flooding hazards, Group 1 will include plants that have demonstrated (1) effective protection for severe flood hazards, and (2) that consequential flooding is expected to occur only for hazards with a sufficiently small mean annual frequency of exceedance.

2) Group 2 will include plants for which further regulatory action should be considered under the NRCs backfit provisions. This group may include plants that are unable to protect against relatively frequent flood hazards such that the event frequency in combination with other factors result in a risk to public health and safety for which a regulatory action is expected to provide a substantial safety enhancement.

3) Group 3 will include plants for which further regulatory action may be needed, but for which more thorough consideration of both qualitative and quantitative risk insights is needed before determining whether a formal backfit analysis is warranted.

The evaluation process that was performed to provide the basis for the staffs grouping recommendation to the SMRP for Millstone is described below. Based on its evaluation, the staff recommended to the SMRP that Millstone be classified as a Group 1 plant and therefore, no further regulatory action was warranted.

2.0 BACKGROUND

This document provides the final NRC staff assessment associated with the information that the licensee provided in response to the reevaluated flooding hazard portion of the 50.54(f) letter.

Therefore, this background section includes a summary description of the reevaluated flood information provided by the licensee and the associated assessments performed by the NRC staff. The reevaluated flood information includes: 1) the flood hazard reevaluation report (FHRR); 2) the mitigation strategies assessment (MSA); and 3) the IA.

Flood Hazard Reevaluation Report (FHRR)

By letters dated March 12, 2015, and January 4, 2019 (ADAMS Accession Nos. ML15078A203 and ML19011A109, respectively), Dominion Energy Nuclear Connecticut, Inc. (Dominion, the licensee) submitted its FHRR and supplemental information for Millstone. For Millstone, the mechanisms listed as not bounded by the CDB in the ISR letter are local intense precipitation (LIP), streams and rivers, tsunami, and storm surge flood causing mechanisms.

After reviewing the licensees FHRR, the NRC staff issued by letters dated December 21, 2016 and April 3, 2019 (ADAMS Accession Nos. ML16308A226 and ML19070A217, respectively), a summary of its review of the Millstone reevaluated flood-causing mechanisms. The NRC staff also issued an FHRR staff assessment and supplement by letters dated October 3, 2018, and October 7, 2019 (ADAMS Accession Nos. ML18256A200 and ML19246A116, respectively), which provided the documentation supporting the NRC staff's conclusions summarized in the ISR letter.

Mitigation Strategies Assessment (MSA)

By letter dated June 28, 2017 (ADAMS Accession No. ML17187A169), the licensee submitted the flooding MSA for Millstone for review by the NRC staff. The MSAs were intended to confirm that licensees had adequately addressed the reevaluated flooding hazards within their mitigating strategies for beyond-design-basis external events that were put in place to meet NRC Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (ADAMS Accession No. ML12054A735). In its MSA submittal, Dominion concluded that the current FLEX mitigating strategies can be deployed as designed during the reevaluated flood hazard events that exceed the current design basis (i.e., unbounded flood hazards) without any modification, and are therefore acceptable.

With regard to Order EA-12-049, Dominion submitted a compliance letter and Final Integrated Plan (FIP) by letters dated December 29, 2015, for Unit 2, and June 23, 2015, for Unit 3 (ADAMS Accession Nos. ML16005A184 and ML15182A012, respectively). The NRC staffs safety evaluation for the licensees compliance plans for Order EA-12-049 was issued on July 1, 2016 (ADAMS Accession No. ML16099A171).

In SECY-16-0142, Draft Final Rule - Mitigation of Beyond-Design-Basis Events (RIN 3150-AJ49), (ADAMS Accession No. ML16291A186) provisions were proposed that would have required mitigation strategies to address the reevaluated flood hazard information on a generic basis. As reflected in the Affirmation Notice and Staff Requirements Memorandum (SRM) dated January 24, 2019, the Commission determined that sites addressing the reevaluated hazards on a generic basis was not needed for adequate protection of public health and safety, but should instead be assessed on a plant-specific, case-by-case basis under the requirements of 10 CFR Section 50.109, Backfitting, and Section 52.98, Finality of combined licenses; information requests.

The Commission directed in the Affirmation Notice and SRM dated January 24, 2019 (ADAMS Accession No. ML19023A038), that the staff use the 50.54(f) process to ensure that the NRC and its licensees will take the needed actions, if any, to ensure there is no undue risk to public health and safety due to the potential effects of the reevaluated flood hazards. The SRM further directs that the staff should continue these efforts, utilizing existing agency processes to determine whether an operating power reactor license should be modified, suspended, or revoked in light of the reevaluated hazard.

By letter dated August 20, 2019 (ADAMS Accession No. ML19067A247), the NRC staff provided a path forward to treat the reevaluation of flood hazards in light of the Commission's direction in the January 24, 2019, Affirmation Notice and SRM. The August 20, 2019, letter categorized Millstone as a Category 3 plant, which corresponds to sites where an FE or IA flooding submittal is under review or is expected to be submitted. As a result of the Commission direction, the NRC staff suspended its review of flooding MSAs and did not complete a staff assessment response to the licensees MSA.

The staff assessment documented in this letter was performed in accordance with the information described in the August 20, 2019, staff letter including a plant-specific determination on whether additional regulatory actions are warranted to address the reevaluated hazard. The staffs evaluation of the IA considers, as appropriate, the licensees intention to use FLEX equipment to address the reevaluated hazards in accordance with the Commissions direction.

Integrated Assessment By letter dated February 10, 2020 (ADAMS Accession No. ML20042D996), the licensee submitted its IA for Millstone. The IAs are intended for the NRC to assess the sites capability to cope with the reevaluated flood hazard and to determine if additional regulatory actions are necessary. These regulatory actions would be taken in accordance with 10 CFR 50.109, Backfitting. To facilitate its review of the IA, the NRC staff issued a generic audit plan by letter dated July 18, 2017 (ADAMS Accession No. ML17192A452), stating its intention to review additional relevant information and supporting documentation, as needed. A summary of the audit performed is described in Section 5 of this staff assessment. The purpose of this letter is to document the staffs evaluation of the Millstone flooding IA.

3.0 TECHNICAL EVALUATION

Millstone is a two unit site located in Waterford, Connecticut, on the north shore of the Long Island sound. To the west of the site is Niantic Bay and to the east is Jordan Cove. Millstone, Unit 3 is on the north side of the main complex building, and Unit 2 is adjacent to Unit 3 on the south side.

The general site layout is presented in Figure 3-1 of this staff assessment. The nominal site grade at the power block of Unit 2 is 14 feet (ft.) mean sea level (MSL), and the structures are protected by flood walls and gates up to elevation 22 ft. MSL. The nominal site grade at the power block of Unit 3 is 24 ft. MSL. The mechanisms listed as not bounded by the CDB in the ISR letter are LIP, streams and rivers, tsunami, and storm surge. Table 3-1 of this staff assessment provides a summary of the ISR letter and compares each unbounded hazard analyzed in this assessment against the CDB values for each Unit.

For Millstone, Unit 2, the licensee evaluated LIP under Path 3 of NEI 16-05, which intends to demonstrate a feasible response against the hazard exceedance, and leverage the use of mitigating strategies as part of the site response. Upon review of the information, the NRC staff notes that the licensees evaluation more closely resembles a Path 2 evaluation, given that the licensee intends to implement additional flood protection barriers at the site which provide an effective flood protection, without relying on mitigation strategies as part of the overall site response. The licensees evaluation for a LIP hazard for Millstone Unit 2 followed the FE process, and is therefore not subject to further evaluation from the SMRP. The LIP event is bounded at Millstone Unit 3, as described in the FHRR staff assessment, and is therefore not evaluated in this assessment.

For Millstone, Units 2 and 3, the licensee evaluated the tsunami hazard under Path 2 of NEI 16-05, which intends to demonstrate effective flood protection against the hazard exceedance(s). The licensees evaluation for this hazard followed the FE process, and is therefore not subject to further evaluation from the SMRP. In its February 10, 2020, submittal, the licensee concluded that the strategies for maintaining the key safety functions (KSFs) of core cooling, spent fuel cooling, and containment integrity are maintained against the potential impacts of these flood hazards.

For Millstone, Units 2 and 3, the licensee evaluated the storm surge flood mechanism under Path 5 of NEI 16-05, whose purpose is to demonstrate an effective response to consequential flooding that has a relatively high likelihood of occurrence, and a feasible response to mitigate the effects of an extreme flood with a low likelihood of occurrence. In its February 10, 2020, submittal, the licensee concluded that effective flood protection is available for the reevaluated probabilistic storm surge flood hazard scenario with 10-4 annual exceedance probability (AEP) or higher; and that effective mitigation / feasible response strategies are available for the reevaluated combined effects with 10-5 AEP. The licensees evaluation for this hazard followed the IA process, and is therefore subject to further evaluation from the SMRP.

The NRC staff notes that both interim hazard letters issued on December 21, 2016 and April 3, 2019, listed the streams and rivers event as an unbounded hazard. For the streams and rivers event, the total water surface elevation is 11.2 ft. which is lower than the nominal site grade of 14 ft. and significantly lower than the CDB flood protection up to 22 ft. MSL for Unit 2; and significantly lower than the nominal site grade of 24 ft. MSL for Unit 3. This difference results in significant elevation margin at the site, and provides reasonable assurance that systems, structures, and components (SSCs) that provide the key safety functions (KSFs) of core cooling, spent fuel pool cooling, and containment integrity will be protected and maintained against a postulated streams and rivers event.

Furthermore, the NRC staff had previously reviewed the information provided by the licensee in the FHRR and concluded in the October 3, 2018, staff assessment that the reevaluated hazard for flooding from rivers and streams is bounded by the CDB. Therefore, flooding from rivers and streams does not need to be analyzed in a focused evaluation or a revised integrated assessment. As a result, no additional evaluations were performed for the streams and rivers hazard in this staff assessment. Additional technical details, as well as the NRC staffs review and conclusions for each unbounded flood hazard are provided in the following sections.

Table 3-1 Comparison of Unbounded Reevaluated Hazards Against the CDB Hazards for Millstone (source: ISR letter supplement).

Reevaluated Hazard Elevation Current Design Basis Elevation (MSL)

(MSL)1 Mechanism Total Total Stillwater Waves/Runup Stillwater Waves/Runup Elev. Elev.

Unit 2 LIP 14.5 ft. Minimal 14.5 ft. 17.5 ft. Minimal 17.5 ft.

No Streams No impact No impact Not impact 11.2 ft 11.2 ft.

and Rivers identified identified Applicable identified Not Not Not included Not Tsunami included in included 14.7 ft 14.7 ft.

in CDB applicable CDB in CDB 26.5 ft.2 Not Applicable 26.5 ft. 16.9 ft. Not 27.6 ft.4 (standing (standing Applicable3 water within water within Intake Intake structure) structure)

Storm Surge 18.2 ft. 6.9 ft. 25.1 ft. Negligible at 17.5 ft (at 17.5 ft. East side.

Powerblock) (at Powerblock) 2.3 ft at West 19.8 ft.

side.

Unit 3 No impact No impact No 11.2 ft Not 11.2 ft.

Streams identified identified impact Applicable and Rivers identified Not Not included Not 14.7 ft. Not 14.7 ft.

Tsunami included in in CDB included Applicable CDB in CDB 19.7 ft. 21.5 ft. 41.2 ft. 17.1 ft. 25.5 ft. 42.6 ft.

(at Intake (at Intake structure) structure)

Storm Surge 19.7 ft. 4.1 ft. 23.8 ft. 17.7 ft 4.5 ft. 22.2 ft (at (at Powerblock) Powerblock) 1 The storm surge values reflected in this Table are representative of an annual exceedance probability that supports decision-making, which is typically 10-3 (with margin) to 10-4.

2 The CDB is for the service water pumps within the Unit 2 intake structure.

3 Additional information regarding the development of the wave/runup analysis for Units 2 and 3 is described in the supplement to the ISR letter.

4 As stated in note 3 in Table 2 of the ISR supplement (ML19070A217), this reported value is the maximum water level from 4 cases evaluated for Unit 2 internal water levels using the GOTHIC code as presented in calculation package NAl-1996-001. Additional details are fully described in the ISR letter supplement.

3.1 Local Intense Precipitation At Millstone, Unit 2, the licensee stated that the reevaluated LIP event (17.5 ft.) exceeds the site grade (14 ft.). As a result, floodwaters can potentially reach susceptible SSCs that provide KSFs and are located in lower elevations at certain locations. The overall strategy at the site relies on advanced weather forecasting and monitoring that upon meeting certain threshold conditions, will trigger the installation of flood protection that will protect the site up to elevation 22 ft. MSL. The installed flood protection will then allow the potentially impacted SSCs to continue to perform their intended KSF for the duration of the event. The licensee also identified vulnerabilities at several locations as part of its analysis (including the roofs of certain buildings where key SSCs are located) where additional flood protection will be implemented in order to reduce/avoid water entry into these susceptible locations. In addition, several enhancements were also identified in the IA as changes that would provide additional functional and operability margin, but whose final implementation does not impact the conclusions made by Dominion.

At Millstone, Unit 3, the nominal site grade at the power block is 24 ft. When compared against the reevaluated LIP event (17.5 ft.), the NRC staff agrees that there is significant margin such that this flood hazard mechanism is not expected to impact key SSCs that provide KSFs at Unit 3. In the FHRR staff assessment, the NRC staff had previously reviewed this flood hazard and confirmed the licensee's conclusion that the reevaluated flood hazard for LIP is bounded by the CDB flood hazard protection. As a result, no further analysis is warranted for Unit 3 in this staff assessment.

The NRC staff confirmed that no changes and/or hazard refinements had been made in the FE to the reevaluated LIP hazard floodwater elevations previously reviewed by the NRC staff for Unit 2.

This includes no changes to the assumptions, inputs, and methods used to develop the hazard; and the evaluation of associated effects and the flood event duration that was documented in the October 3, 2018, staff assessment.

In summary, the licensees overall site response in the FE for LIP relies on two parallel paths: 1) weather monitoring and action-trigger conditions and 2) the installation of flood barriers part of the CDB. The licensee has also provided a regulatory commitment for the proposed installation of additional temporary flood protection capabilities at several buildings where vulnerabilities were identified. The licensee also identified several enhancements at the site that would provide additional functional and operability margin, but whose final implementation does not impact the conclusions made by Dominion and are therefore not part of the regulatory commitment.

Based on the summary above, the NRC staffs review focused on the available information that demonstrates the available physical margin (APM) at the site, the reliability of protection features and equipment, and the feasibility of any manual actions involved in the overall site response.

This approach is consistent with guidance documents NEI 16-05, and NEI 12-06, Revision 4 Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, (ADAMS Accession No. ML16354B421).

3.1.1 Flooding Impact on Plant Conditions The CDB flood protection strategy for LIP at Unit 2 provides flood protection up to 22 ft. by means of concrete flood walls, procedurally closed flood gates, and procedurally installed stop logs and flood barriers. To evaluate the impacts of LIP, the licensee first identified and documented all the flooding features available at the site, including locations with susceptible seals, in Dominion Engineering Technical Evaluation (ETE), ETE-MP-2014-1027, Revision 1, MPS2 Conduit/Piping

Penetrations & Flood Protection Features Identification. Then, the licensee compared the existing flood protection at the site against the reevaluated LIP flood hazard, in order to identify what changes, if any, needed to be made to existing SSCs that provide KSFs. The licensee documented the results of its evaluation in a) ETE-CPR-2017-1005, Revision 0, Millstone Unit 2 Beyond Design Basis Flooding Focused Evaluation and Integrated Assessment, b) ETE-CPR-2017-1002, Rev. 0, Millstone Unit 2 Beyond Design Basis Flooding Assessment, and c) ETE-MP-2018-1006. Rev. 0, Millstone Power Station Unit 2 Local Probable Maximum Precipitation Trigger Recommendations. Of relevance to this section, the NRC staff notes that the LIP maximum water surface elevations in the immediate vicinity of Unit 2 range from 14.3 ft. at flood gate 20 to 17.5 ft. at flood gate 13.

As part of its review (and consistent with the July 18, 2017, audit plan described in Section 5 of this staff assessment) the NRC staff sampled several licensee calculations and evaluations in order to further clarify the information in the FE submittal, and complete its assessment.

Specifically, the NRC staff sought to understand why additional protection was needed at the site, if the CDB flood protection up to 22 ft. already exceeded the maximum expected LIP stillwater range between 14.3 ft. and 17.5 ft.

In its audit response, the licensee noted that the flood protection assessment performed in ETE-CPR-2017-1002 documented potential vulnerabilities on building roofs at other various locations where door sills, siding, equipment, and penetrations become points of potential flood water in-leakage due to excessive ponding during a precipitation event. With regard to the type of modifications, the licensee noted that in general, duct banks, conduits, and piping penetration seals will be sealed and/or protected per ETE-MP-2014-1027. The licensee also described that while final flooding protection modifications have not yet been finalized, the completion of these actions are being tracked as a regulatory commitment, consistent with Table 3-1 and 3-2 of the IA.

In addition to the flooding modifications, the licensee stated that three LIP enhancements identified in ETE-CPR-2017-1005, Section 7.1.3.5 (and further described in Section 3.1.3 of this report) would also improve the conditions at the site, but would not result in the loss of a KSF at the site if not implemented.

Finally, the licensee confirmed that the safety-related SSCs in the main site/power block are flood protected to elevation 22 ft. MSL by concrete flood walls, procedurally closed flood gates, and procedurally-installed stop logs and flood barriers, and that no impact is expected from the reevaluated LIP event. The licensees complete analysis is described in ETE-CPR-2017-1005.

The NRC staff reviewed the supporting documentation and noted that in Table 6-1 of ETE-CPR-2017-1005, Rev. 0, the licensee preliminarily identified 32 locations with vulnerabilities. Examples of buildings with potentially vulnerable locations include the Enclosure Building, Auxiliary Building, emergency diesel generators (EDGs) Buildings, Turbine Building, and Fire Pump House. Some of the proposed modifications described by the licensee include adding seals, metal flashings, extending vent pipes and existing berms, constructing new flood berms, adding scuppers, and pre-staging temporary removable flood barriers. Final modifications have not yet been determined by the licensee, and were therefore not reviewed by the NRC staff.

In summary, the staff found that approximately 32 modifications have been proposed at several locations including the roofs of certain buildings where additional flood protection and/or penetrations seals will be installed in order to further enhance the existing CDB flood barriers that provide protection up to 22 ft. MSL.

With regard to the existing mitigating strategies at the site, the licensee stated in the June 28, 2017, MSA submittal, that the Unit 2 and Unit 3 EDGs, and the Unit 3 station blackout diesel generator are flood protected from the reevaluated LIP flood hazard. As a result, Dominion concluded in the MSA that an extended loss of alternating current (ac) power (ELAP) occurring in association with a LIP event is not plausible, and therefore an assessment of impact of the reevaluated flood hazards on the FLEX mitigating strategies is not required. However, as described in Section 2 of this staff assessment, the NRC staff suspended its review of flooding MSAs and did not complete a staff assessment response to the Millstone MSA. In its FE, the licensee stated that as a result of the analysis in the MSA, FLEX mitigating strategies are available as a defense-in-depth flood response to the reevaluated LIP flood hazard.

As part of its review, the NRC staff asked the licensee to clarify if mitigating strategies are still available (and planned to be maintained) at the site in light of the Commission direction described in Section 2 of this staff assessment, such that they provide a defense-in-depth feature against the reevaluated LIP event. In its response, the licensee stated that FLEX strategies are available at the site and not impacted as a result of a reevaluated LIP event, and will be maintained at the site. Technical evaluation ETE-CPR-2017-1004, Revision 0, Impact of Reevaluated Flood Hazards on FLEX Mitigating Strategy describes additional details of the FLEX strategies evaluated at Millstone in accordance with the NEI 12-06 guidance.

Because the licensee is primarily relying on flood protection and not FLEX strategies to address the LIP event, the NRC staff notes that this approach more closely resembles a Path 2 of NEI 16-05, as opposed to the Path 3 described in the FE submittal by Dominion. As a result, the NRC staff did not perform an in-depth review of the FLEX strategies against the reevaluated LIP event, as described in ETE-CPR-2017-1004. However, the NRC staff agrees that it is reasonable to assume (should the need arise) that FLEX strategies are available at Millstone for the LIP event, and provide a defense-in-depth feature for maintaining core cooling, containment integrity, and spent fuel pool cooling, as documented in the Mitigating Strategies safety evaluation. This determination is made upon consideration of:

FLEX equipment for Units 2 and 3 is stored in a single 10,000 square ft. concrete building located on the northeast side of the northern most overflow parking lot along the plant access road, and has a finished floor elevation that ranges between 37.45 - 37.7 ft. MSL.

This elevation is significantly above the expected reevaluated LIP floodwater of 17.5 ft.

The licensees analysis of potential sources of internal flooding against the CDB flood hazards, which determined that no potential sources prevented the implementation of FLEX strategies (see ADAMS Accession No. ML15246A123).

The LIP CDB elevation (14.5 ft. MSL) for which FLEX strategies have been designed against, compared against the lower range of the reevaluated LIP floodwaters expected at the site (14.3 ft. at flood gate 20).

In its FIP, Dominion described that the CDB limiting flooding scenario was a hurricane event at Unit 3. The expected maximum still water level for this event 19.7 ft. MSL (23.8 ft.

MSL including wave runup) for which FLEX strategies have been designed against, compared against the higher range of reevaluated LIP floodwaters expected at the site (17.5 ft. at flood gate 13).

3.1.2 Enhancement of Flood Protection Features The permanently installed barriers at Millstone that are relied upon for flood protection are mainly passive components, such as water-tight seals in penetrations, conduits, and duct lines between structures (e.g., manholes, drains, electrical penetrations, etc.). In addition, physical flood barriers (e.g., watertight doors, metal gates, concrete curbs, etc.) also provide flood protection. The NRC staff notes that the licensee had previously evaluated the flooding CDB in order to identify and address degraded, nonconforming, or unanalyzed conditions, and verified the adequacy of the associated monitoring and maintenance procedures at the site. These activities were performed and documented as part of the NTTF Recommendation 2.3 Walkdowns, report for Millstone (ADAMS Accession No. ML12334A445), and were requested by the NRC as part of the 50.54(f) letter activities. The results of the staffs evaluation of the walkdown report can be found by letter dated March 20, 2014 (ADAMS Accession No. ML14057A716), where the NRC staff described several vulnerabilities at the site, but concluded that no immediate safety concerns were identified at Millstone.

With regard to the proposed additional flood protection modifications at the site, the NRC staff reviewed ETE-CPR-2017-1005, Rev. 0, where the licensee identified 32 locations with potential vulnerabilities. However, because the licensee has not yet made a final determination on the additional flood protection to be installed at Millstone, the NRC staff did not perform a detailed review of the modifications. To the extent possible, the staff evaluated the adequacy of these flood protection barriers consistent with Section B.2.3, Appendix B of NEI 16-05 in the following sections. In general, proposed modifications at the site consist of adding/replacing duct banks, conduits, and piping penetration seals per ETE-MP-2014-1027.

Available Physical Margin The licensee stated in its FE that the CDB flood protection is 22 ft. for safety-related SSCs. As a result, there is a range of APM between 4.5 ft. and 7.7 ft. for the KSFs at the site depending on its location and the range of LIP floodwaters. The NRC staff agrees that there is considerable APM between the expected LIP floodwaters, and the existing flood protection. With regard to the APM for the proposed flood protection features, the licensee stated that it will be evaluated for adequacy once a final determination has been made regarding the location/type of flood barrier to be installed.

The NRC staff notes that the guidance described in NEI 16-05, Revision 1, Appendix B, as endorsed, states that Negligible or zero APM can be justified as acceptable if the use of conservative inputs, assumptions, and/or methods in the flood hazard reevaluation can be established. In the ISR letter and staff assessment, the NRC staff had previously concluded that the licensee's reevaluated flood hazard information was determined using conservative inputs, assumptions, and/or methods, and is a suitable input for other assessments such as the FE submittal. As previously described, this flood hazard was not revised in the FE. Examples of conservative assumptions made in the LIP analysis to justify acceptable APM include:

Assuming that active and passive drainage structures at the site are considered non-operational, Assuming the flood contributory areas are impervious in order to maximize runoff, and Assuming roof flooding evaluations (which led to additional modifications at the site) take no credit for building roof drains but include existing scuppers.

In addition, the licensee stated in its FE that further measures will be in place at the site to ensure adequate APM for the flood protection features relied upon for a LIP event. These are:

Credited flood gates remain closed, and credited stop logs and flood barriers remain installed, Flood protection features (temporary and permanent) are controlled and maintained in accordance with station procedures, Qualified seals are in place for flood boundary penetrations, Walls credited for flood protection (e.g., reinforced concrete, block, and steel walls) are controlled and maintained in accordance with Common Engineering Procedure C-EN-104I, Revision 13, Condition Monitoring of Structures, Roofs and roofing systems credited for flood protection are controlled and maintained in accordance with appropriate station procedures, Roof penetrations are sealed and/or flashed to levels greater than one inch above the calculated roof flood elevations, and Analyzed yard flow paths are controlled (i.e., not blocked or modified without evaluation) in accordance with Dominion Nuclear Fleet Administrative Procedure, MA-AA-113, "Yard Control."

Given the infrequent nature of the LIP event analyzed by the licensee, the inherent conservatisms embedded in the LIP analysis, and the APM of the existing and the proposed flood protection barriers above the still water elevations, the NRC staff agrees that there is sufficient APM such that the flood protection barriers, if implemented as described, are expected to reasonably protect key SSCs against the LIP hazard event.

Reliability of Flood Protection Features In its FE submittal, the licensee stated that the Millstone station design process requires that any design changes to the plant consider impact(s) on the potential for flooding, and whether the activity affects any of the station's hazard evaluations (i.e.: seismic, flooding, storms, etc.), or any flooding protective features such as culverts, drains and dikes. Therefore, the licensee described in the IA that any design changes to (and as a result of) the proposed flood modifications/enhancements will be performed consistent with Dominion Nuclear Standard, DNES-AA-GN-1003, Rev. 20, Design Effects and Considerations.

The NRC staff notes that the flood protection modifications proposed at the site have not yet been installed, and as a result, were not reviewed in detail by the NRC staff. However, the NRC staff agrees that ensuring that any design modification and/or changes follows a systematic design and implementation approach at the site is consistent with the guidance described in NEI 16-05, Revision 1, Appendix B. Specifically, Section B.2.3 describes guidance associated with the implementation of additional temporary and/or permanent flood protection features in a FE submittal. In addition, the NRC staff agrees that this programmatic review ensures that the CDB configuration will continue to be reliable, and maintained with adequate APM for any future design changes.

In its FE, the licensee provided two regulatory commitments associated with the LIP event. The regulatory commitments are to 1) design, store, stage, and install flood protection barriers at key locations throughout the plant, and 2) define plant protective measures, validate time sensitive actions (TSAs), provide installation and response timelines (including warning time and period of site preparation), and confirm the site strategy in accordance with NEI 12-06, NEI 16-05, and the NEI document "Warning Time for LIP Events." The licensee also stated that these modifications are expected to be completed by the end of the second refueling outage for Unit 2 after NRC approval of the FE submittal. As part of the audit discussions, Dominion clarified that the second refueling outage for Unit 2 is expected to occur spring 2023.

The NRC staff agrees that the approach to provide regulatory commitments as part of the FE evaluation is consistent with the guidance described in several NRC documents. For example:

COMSECY-15-0019 describes that licensees will submit letters providing a summary of the evaluation and, if needed, regulatory commitments to implement and maintain appropriate programmatic, procedural or plant modifications to protect against the LIP hazard. The Commission approved the closure plan on July 28, 2015 (ADAMS Accession No. ML15209A682).

By letter dated September 1, 2015, the NRC staff issued a letter titled Coordination of Requests for Information Regarding Flooding Hazard Reevaluations and Mitigating Strategies for Beyond-Design-Basis External Events. This letter describes a graded approach to complete the actions associated with the 50.54(f) letter. Specifically, this letter stated that for plants screening out of an integrated assessment, Where additional measures are necessary to protect against a flooding mechanism, licensees may include in their submittals regulatory commitments to implement procedural or hardware changes.

By letter dated September 21, 2016 (ADAMS Accession No. ML16237A103), the NRC staff issued the Phase 2 decision-making guidance document Regulatory Decision-making for Reevaluated Flooding and Seismic Hazards for Operating nuclear Power Plants,. The guidance described that the integrated assessment submittals will include evaluations related to various flooding mechanisms, an estimated timeline and associated time sensitive actions, descriptions of existing capabilities to deal with the scenarios, and possible regulatory commitments for new or enhanced capabilities.

As a result of the licensee having identified the proposed actions and modifications as regulatory commitments, the NRC staff appropriately credited the proposed changes that Dominion has planned at the site as part of its review. The NRC staff expects that the licensee will address the regulatory commitments consistent with NEI 99-04, "Guidelines for Managing NRC Commitment Changes," Revision 0, dated July 1999 (ADAMS Accession No. ML003680088).

With regard to the development of warning time, the NRC staff notes that NEI 15-05 was originally a white paper titled "Warning Time for Maximum Precipitation Events," (ADAMS Accession No. ML15104A159) which was subsequently endorsed by the NRC by letter dated April 23, 2015 (ADAMS Accession No. ML15110A080). This white paper was subsequently titled NEI 15-05.

In the FE, the licensee also stated that the reliability of the credited flood gates (installed and proposed) is further assured given that these features are inspected at least once every quarter to ensure they are available to provide flood protection when needed. Specifically, Millstone procedure SP 2665, Rev. 10, Building Flood Gate Inspections will be used. The NRC staff

reviewed the information provided by the licensee and agrees that incorporation of the flood protection equipment (flood gates) in plant programs (surveillance, inspection, and monitoring) will ensure the reliability of the flood barriers. In addition, the periodic inspections will address any storage, functionality, and standby conditions as well as in-service conditions (if applicable).

Furthermore, periodic inspections will further ensure that any equipment issues will be promptly identified and corrected via site processes, such as the corrective action program.

Based on the above information, the NRC staff agrees that adequate design and programmatic controls are in place at Millstone that ensure the existing plant protection will be maintained and appropriately enhanced with the additional proposed flood protection features, once implemented.

With regard to any future changes to implement the flood protection modifications, the licensees design change process will direct plant personnel to review operational data, control any modifications within the configuration document control system, and will reasonably result in the licensee conforming the changes to accepted engineering practices. As a result, the NRC staff concludes that, if implemented as described, the proposed additional temporary flood protection features are effective and reliable, and are expected to maintain or restore KSFs, consistent with NEI 16-05, Appendix B.

3.1.3 Weather Monitoring and Trigger Actions The general site response against the reevaluated LIP event at Millstone relies on the advanced monitoring of forecasted weather conditions, that direct plant personnel to install additional food protection barriers at SSCs that provide KSFs. Additional details for each area are described below.

Monitoring Weather Conditions In its FE, the licensee stated that the weather alerts/warnings that may impact the site originate from several reliable sources that are continually monitored, such as the Connecticut Valley Electric Exchange (CONVEX) which operates the electric transmission system in Connecticut and western Massachusetts, Connecticut Alert Emergency Notification System (CAENS), the local weather forecast, and/or the National Oceanic and Atmospheric Administration (NOAA) website.

At Millstone, the Shift Technical Advisor (STA) has the responsibility of monitoring the weather at all times consistent with surveillance procedure 2654R, Revision 3, Intake Structure Condition Determination. This procedure is performed a minimum of once per shift by the STA, and any decisions for declaration of the monitoring and action triggers will be based on the information received from monitoring the weather forecasts described above. This procedure also requires the STA to notify the Shift Manager (SM) or Unit Supervisor (US) of degraded environmental conditions. The NRC staff notes that full details of the STAs roles and responsibilities are described in Dominion Nuclear Fleet Administrative Procedure, OP-AA-500, "Conduct of Shift Technical Advisor."

Upon declaration of adverse weather conditions, Abnormal Operating Procedure (AOP) 2560, Revision 19, "Storms, High Winds and Tides" is entered. Specifically, the entry condition will be made upon "notification of a potential to exceed 3 inches, or more, of rain in any 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months period within the next 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period, for any weather condition as determined by the SM or US. The AOP 2560 also directs the site personnel to enter procedure C-OP-200.6, Revision 8, "Storms and Other Hazardous Phenomena," which establishes command and control of the site response.

The licensee also stated that other actions directed by AOP 2560 (made prior to installing the flood gates) are not considered TSAs, such as performing station management notifications of storm conditions, and initiating site inspection and cleanup of loose material and debris.

Consistent with the guidance described in NEI 16-05, Revision 1, Appendix C, Section C.5.1, the NRC staff finds the monitoring approach acceptable because it is an institutionalized and objective-based procedure that responds to actual or predicted flood conditions or effects.

Furthermore, the weather warning and/or alert monitoring established at Millstone is expected to be reliable because the information will likely originate from a verified source and/or trusted government agencys forecast.

Available Warning Time and Time Sensitive Actions Guidance document NEI 12-06, Revision 4 Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, (ADAMS Accession No. ML16354B421) defines TSAs as: Tasks, manual actions or decisions that are identified as having Time Constraints. In its FE, the licensee stated that the TSAs at Millstone are the procedural steps for installation of the flood barriers. The TSA actions, which are expected to require no more than 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to be performed, are to be initiated per AOP 2560 at least 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months prior to a forecasted LIP event. As a result, the licensee performed an evaluation that sought to validate the time sensitive actions to install the additional flood protection measures against the available warning time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (the LIP action trigger).

In general, the NRC staff notes that the validation of TSAs is achieved in a two-step process:

verification and validation of activities. Verification occurs prior to validation, and refers to the systematic verification of equipment capability and performance, equipment connections, tooling, plant modifications, and procedures/guidelines. Those activities are expected to be accomplished as part of the existing licensee processes such as the design change process, procurement process or procedure/guideline development process. Validation activities refers to validation of the feasibility of individual strategies identified as part of the flooding response. The purpose of the validation is to ensure that adequate resources (personnel, equipment, materials) are available to implement the individual strategies to achieve the intended results.

Following the guidance in NEI 12-06, and NEI 16-05, the licensee noted that hurricane Sandy impacted Millstone on October 29, 2012. In response to hurricane Sandy, the licensee documented the flood gate closure time for that event in ETE-MP-2018-1006. Rev. 0, Millstone Power Station Unit 2 Local Probable Maximum Precipitation Trigger Recommendations. This evaluation determined that closing of the flood gates took approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and 34 minutes.

For conservatism, in its FE analysis the licensee assumed 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of installation time (up from 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ). Furthermore, the licensee stated that the closure time documented in ETE-MP-2018-1006. Rev. 0 is considered to be a Level B Record for timed validation of Level B TSAs under the guidance of NEI 12-06, Appendix E, Section E.6.3.2.

The licensee also stated in its FE that under a worst-case operations/maintenance minimum staffing scenario, AOP 2560 could be entered, if needed, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to notification of the consequential LIP storm predicted to arrive at the site. In this scenario, the SM or the US in charge would immediately perform the requested actions and notifications described in attachment 6 of AOP 2560 for additional personnel to support the preparation efforts.

Approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months would be available for the additional personnel to arrive on site within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of the LIP event reaching the site. This would allow the site to have an adequately staffed operations and/or maintenance crew capable of performing the LIP flood barrier installation in 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Finally, the licensee stated that since Unit 3 is not impacted in the same manner as Unit 2,

additional operations and/or maintenance personnel could further supplement the Unit 2 staff for the LIP response, if needed.

As part of its review, the NRC staff sought to verify that the proposed strategy at Millstone could be implemented successfully in an organized pre-planned manner, that workers have been properly trained (or will be, as applicable), and that site personnel have demonstrated the ability to complete the requested tasks within the designated timeframe and within the expected environmental conditions. The NRC staff also sought to identify what redundant, compensatory, or confirmatory measures are in place that would address the potential for incorrect execution of the proposed actions.

The NRC staff reviewed the information in the FE and agrees that the anticipatory warning time at Millstone is a level B TSA, which is consistent with NEI 12-06 and corresponds to events where warning time is greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The NRC staff also agrees that the documentation of flood gate closure time (timed validation) for the LIP event is a Level B Record, given that the TSAs have been validated using validation results for similar activities, such as the hurricane Sandy event. Furthermore, additional confidence in the validation of the Level B TSAs is provided by Dominion given that there is significant margin available (approximately 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ) for the tasks to be performed at Millstone (difference between the time required to perform the task and the time available).

The NRC staff agrees that Dominion has demonstrated that redundant and compensatory measures are in place at Millstone by providing a clear organizational response to plant personnel, such that it is reasonable to expect that the LIP response strategies can still be implemented at the site under a postulated worst case minimum staffing scenario. The NRC staff also agrees that Dominion has developed anticipatory activities that incorporate triggers for when the plant is cued to respond to the flood event, and inspection activities before and after the event.

The licensee has also considered the TSAs at the site and has validated the existing flood protection strategies described in AOP 2560. For the additional proposed flood protection modifications, the licensee has committed to validation of the proposed actions by using the guidance described in NEI 12-06. Finally, the NRC staff also agrees that the actions proposed by the licensee would result in at least 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months of additional margin to implement the anticipatory flood protection actions under the worst staffing conditions, therefore demonstrating that the proposed actions are feasible and are reasonably expected to be accomplished prior to the LIP conditions arriving on-site.

With regard to the proposed modifications (which would include adding either scuppers, seals, berms, curbs or evaluated alternatives, etc.) described in Sections 3.1.1 and 3.1.2 of this staff assessment, the licensee clarified as part of the audit discussions that any resulting procedural change(s) developed as a result of the modification(s) will be addressed via the station modification process or a similar process. This will ensure that there is no impact to the current conclusions made by Dominion regarding the demonstration of effective flood protection at the site.

As part of the audit activities, the licensee described the three enhancements to the LIP event:

1. Revise the appropriate site procedures/processes to note that the Unit 2 flood gate / stop log installation requires approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , and by include step(s) confirming the time for completion of the installation,

2. Revise the appropriate site procedures/processes to make the installation of the flood gates / stops logs optional at the locations not required for the LIP flood responses, e.g. at the intake structure. Decreasing the number of required operations / maintenance activities during the LIP flood response, and

3. Pre-stage the tools and materials needed for installation of the flood gates / stop logs in a central location, and including this information in appropriate site procedures.

The licensee also indicated that the enhancements to the procedures described in the IA will be completed at the site by the end of calendar year 2020. The licensee clarified during the audit discussions that the enhancements described above are not part of the regulatory commitment for LIP at Unit 2.

3.1.4 Local Intense Precipitation Conclusion The NRC staff has evaluated the information provided in the FE submittal related to the overall site response and FLEX strategies, as evaluated against the reevaluated LIP hazard described in Section 3.1 of this staff assessment. The NRC staff has determined that the strategies to maintain core cooling, containment integrity, and spent fuel pool cooling can be appropriately implemented upon installation of additional flood protection at the site (existing and planned). The NRC staff made its determination based upon:

The inclusion of action triggers based upon the 24-hour and 12-hour weather forecast which provides adequate anticipatory time to install additional flood protection barriers at the site, The regulatory commitment to install additional flood protection features, and establish plant conditions that protect SSCs that provide KSFs, such that they can be relied upon, if needed, The identification, and completion of, additional enhancements that provide additional operational and functional capabilities, and The effectiveness of the licensees planned actions and overall strategy for coping with a LIP event.

The NRC staff notes that the licensee has made several commitments described in the IA and section 3.1.2 of this report that reference the completion of actions by the end of the second refueling outage for each unit. As part of the audit discussions, the licensee stated that the second refueling outage for Unit 2 is expected to occur spring 2023, and the second refueling outage for Unit 3 is expected to occur spring 2022. Therefore, the NRC staff concludes that the licensee has demonstrated the capability, if implemented as described, to deploy strategies against postulated beyond-design-basis events for the LIP event, including associated effects and flood event duration. Furthermore, the licensee has provided regulatory commitments to complete and maintain the strategies that would address a reevaluated LIP hazard at the site.

3.2 Tsunami In its FE, the licensee stated that the tsunami hazard was not considered as part of the CDB, and results in a reevaluated flood hazard elevation of 14.7 ft. MSL at the Intake Structures for both units, and at the Unit 2 general site area. No impact is expected around the Unit 3 powerblock due to the nominal site grade elevation of 24 ft. MSL. The licensee also stated that the reevaluated maximum tsunami flood level is bounded by the CLB probable maximum hurricane storm surge flood level, however the warning time for the tsunami is less than that for the probable maximum hurricane.

In the October 3, 2018, FHRR staff assessment, the NRC staff determined that the methodologies used by the licensee to determine the reevaluated tsunami hazard are consistent with present day methodologies and guidance, and the use of these methodologies is acceptable. The NRC staff also confirmed the licensees conclusion that the tsunami-generated flood height would inundate the Millstone, Unit 2, site to depths of one foot or less, and would not inundate the Unit 3 site.

This flood hazard was not revised as part of the FE evaluation.

3.2.1 Flooding Impact on Plant Conditions In its FE, the licensee stated that shallow flooding (up to 0.7 ft.) above the Unit 2 nominal site grade of 14 ft. MSL is possible. Because the Unit 3 nominal site grade is 24 ft., the reevaluated tsunami hazard elevation of 14.7 ft. is not expected to impact any key SSCs in the powerblock that provide KSFs. Additional details regarding the licensees tsunami analysis are described in site calculation 14-027, Rev. 0, Detailed Tsunami Modeling for Millstone Power Station.

For the tsunami event, the licensee stated in its FE that the protection actions for Unit 2 are essentially the same as a LIP or probable maximum hurricane event, and addressed by site procedures AOP 3569, Revision 22, Severe Weather Conditions, and AOP 2560, Revision 19, Storms, High Winds and High Tides. The licensee stated in the IA that the significant difference is that tsunami flood protection implementation is required to be initiated upon receipt of a tsunami warning (approximately 8.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months prior to the tsunami arriving on site), whereas the LIP flood protection implementation is required within 24 to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of the consequential LIP arriving on site. Upon installation of the flood protection, the Unit 2 powerblock SSCs that provide KSFs are flood protected to elevation 22 ft. MSL, and are therefore not impacted by the tsunami reevaluated hazard. The NRC staff notes that the expected tsunami flood arrival time was included as part of the FHRR, where additional details are described.

With regard to the Intake Structure for Unit 2, the licensee stated that the safety-related service water pumps, motors and associated electrical equipment (which are the only SSCs in the intake structure that provide a KSF) are protected from tsunami flooding by their elevation above the pump room floor. The service water pump motors have overhead electrical feeds and are mounted on pedestals at elevation 21.7 ft. MSL. Therefore, tsunami flood waters will enter the Intake Structure Pump Room through the floor grating (14 ft. MSL elevation), but will not reach the service water pump motors. When the tsunami surge recedes, it will drain through the floor grating. As a result, the licensee concluded that the Intake Structure is reasonably protected against a reevaluated tsunami hazard.

For the Unit 3 Intake Structure, the critical elevation is the floor elevation of the service water pump cubicles at 14.5 ft. MSL. If additional flood protection is not implemented prior to the tsunami arriving on site, the service water pump cubicles may experience approximately 0.2 ft. of

flooding on their floor elevation of 14.5 ft. MSL during the tsunami surge, and potentially prevent their ability to perform their intended function.

In summary, the potential impacts identified by the licensee related to the tsunami hazard for Unit 2 is the reduction in warning time available to implement the flood barriers at the powerblock SSCs, and for Unit 3 is the potential flooding of the service water pumps located in the Intake Structure.

3.2.2 Analysis of Permanently Installed Flood Protection Features With regard to Unit 2, the licensee stated in the FE that the CDB flood protection features relied upon for a tsunami event are the same as those relied upon for a LIP event, which have been described in Section 3.1.2 of this staff assessment. Because the existing flood features provide flood protection up to elevation 22 ft. MSL, no additional modifications are needed to the existing CDB flood barriers in order to ensure that SSCs that provide KSFs are protected in the Unit 2 powerblock, or the Intake Structure.

Similar to LIP, the licensee also identified vulnerabilities at several locations as part of its analysis (including the roofs of certain buildings where key SSCs are located) where additional flood protection will be implemented in order to reduce/avoid water entry into these susceptible locations. As part of the audit discussions, the NRC staff asked (and Dominion clarified) that the flood protection assessment performed in ETE-CPR-2017-1002 documented potential vulnerabilities on building roofs where door sills, siding, equipment, and penetrations become points of potential flood water in-leakage due to excessive ponding during a precipitation event.

The additional flood protection proposed for the tsunami event is the same as for the LIP event, which has been described in Section 3.1.1 of this staff assessment, and is being tracked via a regulatory commitment.

In addition, several enhancements were also identified in the IA as changes that would provide additional functional and operability margin, but whose final implementation does not impact the conclusions made by Dominion. As a result, the licensee stated that the tsunami enhancements identified in ETE-CPR-2017-1005, Section 7, would improve the conditions at the site, but would not result in the loss of a KSF at the site if not implemented. As part of the audit discussions, the licensee clarified that the enhancements to the procedure described in ETE-CPR-2017-1005, Section 7, will be completed at the site, and incorporated by the end of calendar year 2020.

With regard to Unit 3, the licensee stated in its FE that the service water pumps are housed in water-tight cubicles with hurricane storm surge flood protection which is proceduralized, and provides protection up to 25.5 ft. MSL, as described in 1) the Millstone, Unit 3 Final Safety Analysis Report (FSAR), Rev. 29.02, and 2) the Millstone Unit 3 Technical Requirements Manual (TRM), Rev. 193.00, 3/4.7.6. The flood protection measures described in the TRM would provide tsunami flood protection for the service water pumps. The licensee also stated that appropriate station procedures ensure that the service water cubicle water-tight doors, which are designed to conform to accepted engineering practices, are controlled and maintained. As part of the audit discussions, the NRC staff asked what specific procedure directed plant personnel to close the service water pump cubicle doors. In its response, the licensee clarified that the Unit 3 watertight doors are directed to be closed by AOP 3569, Severe Weather Conditions. Regarding maintenance, recurring preventative maintenance is performed per site document MP 3704A-722A, Watertight and Airtight Door Inspections. This preventative maintenance is scheduled every 18 months for the service water pump cubicle doors, and the doors are normally closed at all times except for passage.

The NRC staff agrees that having established proceduralized actions to ensure the service water cubicle water-tight doors are functional and maintained, provide additional assurance that the watertight doors are reliable and expected to perform their intended function at the site.

3.2.3 Analysis of Existing Weather Monitoring, Trigger Actions, and Procedural Response The site response against a tsunami event is described in site procedure AOP 2560, Rev. 19, Storms, High Winds and High Tides. This procedure directs the installation of flood protections barriers (i.e., closing flood gates, and installing stop logs and Fire Pump House flood protection devices) for both a tsunami and LIP flooding events. Similar to LIP, the tsunami warning will originate from several reliable sources that are continually monitored, such as the CONVEX, CAENS, the local weather forecast, and/or the NOAA website. Additional details regarding weather monitoring and notification are described in Section 3.1.3 of this staff assessment.

Time Sensitive Actions for Unit 2 Once Dominion determined that approximately 8.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months were available before the tsunami floodwaters arrived at Millstone, the licensee performed an evaluation that sought to validate the TSAs required to install the additional flood protection measures against the available warning time. The licensee noted that hurricane Sandy impacted Millstone on October 29, 2012. In response to hurricane Sandy, the licensee documented the flood gate closure time for that event in ETE-MP-2018-1006. Rev. 0, Millstone Power Station Unit 2 Local Probable Maximum Precipitation Trigger Recommendations. This evaluation determined that closing of the flood gates took approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and 34 minutes. For conservatism, in the FE analysis the licensee assumed 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months installation time (up from 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of available warning time (down from 8.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ), which results in a minimum of three additional hours of available margin to perform the TSAs. Furthermore, the licensee stated that the closure time documented in ETE-MP-2018-1006. Rev. 0 is considered to be a Level B Record for timed validation of Level B TSAs under the guidance of NEI 12-06, Appendix E, Section E.6.3.2.

As part of its review, the NRC staff sought to verify that the proposed strategy at Millstone could be implemented successfully in an organized pre-planned manner, that workers have been properly trained (or will be, as applicable), and that site personnel have demonstrated the ability to complete the requested tasks within the designated timeframe and within the expected environmental conditions. The staff also sought to identify what redundant, compensatory, or confirmatory measures are in place that would address the potential for incorrect execution of the proposed actions.

The NRC staff reviewed the information in the FE and agrees that the anticipatory warning time at Millstone is a level B TSA, which is consistent with NEI 12-06 and corresponds to events where warning time is greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The NRC staff also agrees that the documentation of flood gate closure time (timed validation) for the tsunami event is a Level B Record, given that the TSAs have been validated using validation results for similar activities, such as the hurricane Sandy event. Furthermore, additional confidence in the validation of the Level B TSAs is provided by Dominion given that there is significant margin available (approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months ) for the tasks to be performed at Millstone (difference between the time required to perform the task and the time available).

Time Sensitive Actions for Unit 3

In its FE, the licensee stated that the Unit 3 response described in the TRM is limited by the procedural implementation of the hurricane storm surge Intake Structure flood protection (i.e.,

monitoring sea water levels, shutting the watertight doors of both service water pump cubicles, and isolating the pump cubicle sump drain lines) within 15 minutes of the sea water level exceeding 13 ft. MSL at the intake structure. Because this timeline was determined to be not reasonable by Dominion, the licensee revised site procedure AOP 3569, Rev. 022-00, Severe Weather Conditions to include 1) a tsunami warning as a potential flooding condition, 2) an action trigger to initiate the Unit 3 service water pump cubicle flood protection actions described in the TRM immediately upon receipt of notification of an impending tsunami, and 3) directs personnel to complete the flood protection actions within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of the notification. The licensee stated in its FE that no tools or special qualifications are required to perform the tsunami flood protection TSAs.

Because the tsunami TSAs are expected to be completed in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the licensee determined that there is approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of margin for the TSAs to be completed, when compared to the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months warning time for a tsunami event. As a result, the licensee concluded that flood waters will be prevented from entering the safety-related service water pump cubicles with the tsunami flood protection implemented at the Intake Structure prior to the tsunami arriving on site, and the safety-related service water pumps will be protected from the tsunami event.

The NRC staff reviewed the information for Unit 3 provided in the FE, and supporting documentation as part of the audit activities. The NRC staff notes that there are three main procedures that govern the sites response against a tsunami event:

Surveillance procedure SP 3665.2, Rev. 11, Intake Structure Condition Determination with Vacuum in the Condenser which requires monitoring of the weather forecasts and conditions, evaluation of the environmental conditions, and notification of the SM or US of degraded environmental conditions. This procedure is applicable at all times and performed a minimum of once per shift, AOP 3569, Rev. 022-00, Severe Weather Conditions which is entered upon the Control Room being notified of a tsunami warning from CONVEX or CAENS, and C-OP-200.6, "Storms and Other Hazardous Phenomena" which establishes command and control of the site response, and is performed with the initiation of AOP 3569, or at the discretion of the SM or US.

The NRC staff agrees that the overall site response is started by receiving information from sources that have been determined to be reliable, and provide weather forecasting conditions at the site that are trustworthy. The information is then processed and compared to clear and unambiguous procedural triggers that have been revised, as appropriate, to account for the reevaluated tsunami flood hazard warning time. These action triggers are systematically proceduralized, and direct staff to install additional flood protection barriers with approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of margin to complete the activities before the tsunami floodwaters arrive onsite, and potentially impact the Unit 3 Intake Structure. The licensee also considered that these activities and notifications will be performed by trained staff, as applicable, in order to ensure consistency.

The NRC staff also agrees that the licensee adequately considered and established anticipatory actions to the tsunami event that are not expected to be impacted by adverse environmental conditions, given that they will be performed well in advance of the floodwaters arrival onsite. The

adequacy of the flood protection response for the tsunami event is also demonstrated by relying on flood protection barriers that are part of the CDB, and are therefore maintained and tracked in a controlled manner, and are determined to be available and reliable at all times.

The NRC staff reviewed the information presented in the submittal relative to the validation of the TSAs by the licensee. In its FE, the licensee stated that the 2-hour flood protection implementation time required at the site is considered to be a Level B Reasonable Validation of Level B TSAs under the guidance of NEI 12-06, Appendix E, Section E.6.3.2. The NRC staff notes that NEI 12-06, Appendix E defines Level B TSAs as those TSAs for events where warning time is greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . To validate a Level B TSA, the licensee has several alternatives, and one of those alternatives is the Level B Reasonable Judgment. The Level B Reasonable Judgment is defined as A validation method used to estimate the time required to accomplish tasks. The NRC staff notes that the Level B validation of the Level B TSAs at Millstone is further demonstrated by the margin available of at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to perform the task (difference between the time required to perform the task and the time available), the low complexity of the task (monitoring sea water levels, shutting the watertight doors of both service water pump cubicles, and isolating the pump cubicle sump drain lines), and the relatively low hazard exceedance of the tsunami floodwater 0.2 ft. when comparing the reevaluated flood hazard elevation (14.7 ft) against the service water pump elevation (14.5 ft.). In addition, another factor to consider are the inherent conservatisms and assumptions that were factored into the tsunami analysis. Once the flood protection is installed, the NRC staff agrees that the flood protection at the Unit 3 Intake Structure of 25.5 ft. MSL, (as described in TRM, Rev. 193.00, 3/4.7.6.) is reasonably expected to protect the service water pumps against tsunami floodwaters of 14.7 ft. MSL. As previously described, the Intake Structure service water pumps are the only SSC that provides a KSF at the Intake Structure.

Based on the above information for Units 2 and 3, the NRC staff agrees that the licensee has demonstrated that the TSAs required to implement the flood response strategy for Unit 2 and Unit 3 are feasible and the overall implementation of the strategy is adequate. This determination is made after reviewing the information in the FE, NEI 16-05, Appendix C, and NEI 12-06, Appendix E.

3.2.4 Tsunami Conclusion The NRC staff has evaluated the information provided in the FE submittal related to the protection strategies, as evaluated against the revised tsunami hazard described in Section 3.2 of this staff assessment. The NRC staff finds that the proposed flood protection and procedures at Millstone, if implemented as described, are expected to reasonably protect the site against the tsunami hazard event, and that the KSFs of core cooling, containment integrity, and spent fuel pool cooling are appropriately maintained. The NRC staff made its determination based upon:

The inclusion of a clear and unambiguous action triggers that are systematically proceduralized, and will be performed by trained staff; The action to establish plant conditions that protect the SSCs that provide KSFs by relying on existing CDB flood protection and procedures; and The validation of TSAs needed to implement the additional flood protection.

Therefore, the NRC staff concludes that the licensee has demonstrated the capability, if implemented as described, to have effective flood protection against postulated beyond-design-basis events for the tsunami event.

3.3 Storm Surge For the storm surge flood mechanism, the licensee is pursuing Path 5, whose purpose is to demonstrate an effective response to consequential flooding that has a relatively high likelihood of occurrence, and a feasible response to mitigate the effects of an extreme flood with a low likelihood of occurrence. Guidance document NEI 16-05, Revision 1, as endorsed, states that floods with an AEP of 1x10-4 (or 10-3 with margin) should be considered as the threshold for the high and low likelihood floods. The licensee stated that no changes to the flood mechanism evaluation have occurred since the submittal of the FHRR and FHRR supplement, which the NRC staff have reviewed.

As part of the IA review, the NRC staff evaluated the licensees determination of the consequential flooding elevation corresponding to an AEP of 10-3 with margin, or 10-4, and also reviewed the proposed site response to scenarios both above and below that elevation to determine if additional regulatory actions are necessary. Based on the substantial inherent differences between Millstone Units 2 and 3, the NRC staffs analysis of the IA is described by Unit, as appropriate. The results of the staffs evaluation are summarized below.

3.3.1 Current Licensing Basis Flooding Response for Units 2 and 3 At Millstone, the CDB controlling event for flooding at the site is a storm surge flood resulting from the occurrence of a probable maximum hurricane. For this postulated event, the maximum still water level is 19.7 ft. MSL, and the associated wave runup elevation is 23.8 ft. MSL. With regard to Millstone Unit 2 (site grade 14 ft. MSL), plant operators implement appropriate hurricane response procedures upon receiving hurricane warnings from weather service providers. General actions taken at Millstone Unit 2 are fully described in the Unit 2 FSAR, Section 2.5.4.2.1, and are summarized below:

1. Plant personnel ensure all plant flood gates are closed and that traveling screens are placed on continuous wash at high speed, and that all loose material around the site is removed or thoroughly tied down.

2. Higher plant supervision is notified of the storm warning. If a sustained wind speed of 50 miles per hour (mph) is measured at the meteorological tower, additional personnel will be called in to assist plant operators, as required.

3. Should sustained water level approach grade level due to extremely high tides (not wave action), plant management will assess the general plant condition. A decision will be made to continue operations or to initiate a normal plant shutdown.

4. One service water pump motor will be secured and protected against flooding to a minimum elevation of 28 ft. MSL in accordance with the TRM.

5. If the severity of the hurricane is such that the sustained water level is increasing above grade level:

a. Disable the diesel fuel oil transfer pumps to prevent water from shorting the pump motors.

b. Station an operator inside the Intake Structure to monitor the water level with respect to the service water and circulating water pump motors.

6. As long as the 345 transmission lines remain uninterrupted and plant equipment is not endangered, the plant can continue to be operated at power until the level of water in the Intake Structure reaches 16.5 ft. MSL which is just below the level of the circulating water pump motors. At this time, the plant would be tripped and placed in a hot standby condition in accordance with plant procedures. If outside power is lost, emergency loads would be supplied by the diesels, and additional operator response would be in accordance with plant procedures.

7. If, following the securing of the circulating water pumps, the level of water within the Intake Structure rises above 19.5 ft. MSL, one diesel would be immediately secured, and its cooling system realigned such that the diesel can be cooled by water supplied from the fire system in accordance with applicable operating procedures.

8. If the water level within the Intake Structure rises to 22 ft. MSL, thereby endangering the service water pump motors, the diesel operating on service water would be secured and the service water pumps would be tripped in accordance with plant procedures. Essential plant equipment would be powered by the diesel whose cooling system had previously been modified to use fire water. The plant would be maintained in a hot standby status.

Decay heat would be transferred from the core to the steam generators by natural circulation, and then removed from the steam generators by steaming through the atmospheric dump valves. The steam generators would be fed by either a steam-driven or electric auxiliary feedwater (AFW) pump taking a suction on the condensate storage tank (CST).

9. When the water level recedes below 22 ft. MSL, the motor which was protected would be recommissioned and started in accordance with plant procedures. It would then be used to cool the diesel which had not been lined up to the fire system. The time required for this step once the water level has receded is approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

10. The other service water pump motor(s) would then be removed, disassembled, steam cleaned, dried, reassembled and reinstalled, and then an additional pump would be started. This will then allow plant systems and equipment to be returned to a normal hot standby status.

11. When the water level recedes below grade elevation 14 ft. 6 inches, plant personnel will sample/remove/verify that no water is present in the diesel fuel oil storage tank or transfer piping, and disassemble, inspect and restore transfer pump motors.

With regard to Millstone Unit 3, the licensee stated in its IA that all safety-related SSCs are protected from flooding due to storm surge by the site grade elevation 24 ft. MSL with the exception of the circulating and service water pumphouse. As discussed in Section 3.2 of this staff assessment, the service water pumps and motors are located at elevation 14.5 ft. MSL inside the watertight cubicles of the pumphouse. The licensee also stated that upon installation of additional flood protection, the walls of the cubicles are watertight to elevation 25.5 ft. MSL, which protect the pump motor control centers and associated electrical equipment from flooding due to wave action and storm surge. The FSAR also describes that the front wall of the intake structure extends to elevation 43.0 ft. MSL, and is designed to withstand the forces of a standing wave with

a crest elevation of 41.2 ft. MSL. Additional information and flood considerations are described in the Millstone, Unit 3 FSAR, Section 3.4.

3.3.2 Reevaluated Storm Surge Hazard Characterization - Annual Exceedance Probability During the NRC's review of the reevaluated storm surge flood hazard information submitted in the FHRR, the NRC and Dominion concluded that in order to reduce the uncertainty around the FHRR's reevaluated 10-6 AEP probabilistic storm surge analysis, a more frequent AEP (10-3 with margin, or 10-4) probabilistic storm surge analysis that better supports regulatory decision-making would be performed. By letter dated January 4, 2019, the licensee submitted the supplement to the FHRR which described the more frequent AEP analysis.

As documented in the supplement to the FHRR staff assessment, both the licensee and the NRC staff performed the storm surge analysis and review in two parts: evaluating the stillwater storm surge, and then evaluating the combined effects. The stillwater storm surge flood level includes the effects of wind and wave setup, but not the effects of wave run-up. The combined effects analysis considers wave run-up combined with stillwater storm surge to obtain the total water level. For reference, the licensees storm surge analysis is further described in site calculations:

Dominion 18-075, Revision 0, Millstone Power Station Annual Exceedance Probability 1.0E-04 for Probabilistic Storm Surge Analysis, Dominion 18-110, Revision 0, Combined Effects Flood Analysis at Millstone Power Station Units 2 & 3, Dominion 19-005, Revision 0, Probabilistic Stillwater Flood Elevation Analysis for an AEP of 1E-5 at Millstone Power Station, and Dominion 19-007, Revision 0, Combined Effects Flood Analysis for Storm Surge Annual Exceedance Probability 1E-5 for Millstone Power Station.

Based on the guidance discussed in Section 1 of this staff assessment, the NRC staff performed a review of the licensees flood frequency analysis presented in the FHRR (including the supplement to the FHRR), and documented the results of its evaluation in the supplements to the ISR letter and FHRR staff assessment. Specifically, the NRC staff confirmed the licensees conclusion that the reevaluated flood hazard results for the storm surge at the 10-4 AEP were bounded by the current design basis at Millstone, Units 2 and 3, with the exception of the Unit 3 Intake Structure, where the CDB was exceeded only by the combined effects flood elevation (stillwater plus wind wave/runup). The NRC staff further determined that the licensee's results were reasonable for use in additional flooding evaluations such as the IA, and were consistent with the guidance described in NEI 16-05, Revision 1. The NRC staff reached this conclusion based on estimation of the 10-3 AEP stage plus a factor (or margin), or 10-4, consistent with the current state of practice, its own independent analysis, and limited insights from the licensees estimates of flood stage. The results associated with the high vs low likelihood threshold for storm surge events are summarized in Table 3-1 of this staff assessment.

In its IA, the licensee described two flooding scenarios at Millstone consistent with Path 5 of NEI 16-05. Scenario 1 corresponds to demonstrating effective flood protection against the high likelihood floods, and Scenario 2 corresponds to demonstrating a feasible response against the low likelihood floods. Given the inherently large uncertainty associated with the results at the

AEP of 10-6 (mainly as a result of the storm surge stillwater frequency curves being very sensitive to adjustments of various input parameters), the licensee performed the Scenario 2 in the IA analysis with a 10-5 AEP range and to the extent practical, provided quantitative and qualitative arguments associated with smaller frequencies. Table 3.3.2-1 below summarizes the flooding scenarios and the associated floodwater elevations from the IA submittal for Millstone.

Table 3.3.2-1 Path 5 Flooding Scenarios at Millstone Unit 2 Millstone Unit 2 Location Scenario 1 (10-4 AEP or greater) Scenario 2 (10-5 AEP)

Intake Structure 16.9 ft. MSL 19.8 ft. MSL (inside) (27.6 ft. MSL with wave/runup) (31.7 ft. MSL with wave/runup) 17.5 ft. MSL 20.9 ft. MSL Powerblock (17.5 ft. MSL with negligible (20.9 ft. MSL with negligible (East of Unit 2) wave/runup) wave/runup)

Powerblock 17.5 ft. MSL 20.9 ft MSL (West of Unit 2) (19.8 ft. MSL with wave/runup) (23.6 ft. MSL with wave/runup)

Millstone Unit 3 Location Scenario 1 (10-4 AEP or greater) Scenario 2 (10-5 AEP)

Intake Structure 17.1 ft MSL 19.6 ft. MSL (inside) (30.2 ft. MSL with wave/runup) (34.3 ft. MSL with wave/runup)

Powerblock 17.7 ft. MSL 20.2 ft. MSL (East of Unit 2) (22.2 ft. MSL with wave/runup) (24.1 ft. MSL with wave/runup)

Powerblock 17.7 ft. MSL 20.2 ft. MSL (West of Unit 2) (22.2 ft. MSL with wave/runup) (24.1 ft. MSL with wave/runup) 3.3.3 Unit 2 - Effective Flood Protection for High Likelihood Events With regard to the high likelihood effective protection for Unit 2, the licensee stated in the IA that all safety-related SSCs east of the powerblock are flood protected up to elevation 22 ft. MSL (as part of the CDB) by means of installing additional flood protection such as stop logs and flood gates. For additional information, the licensees procedures for the installation of the additional flood protection are fully described in site procedures AOP 2560, Revision 19, Storms, High Winds and High Tides and MP 2701E, Revision 1, Unit 2 Flood Gates Installation and Removal.

The licensee also stated in the IA that the storm surge floodwater levels are also bounded west of the Turbine Building wall (19.8 ft. vs. 25.1 ft. MSL), and at the intake structure exterior wall (37.2 ft. vs. 42.5 ft. MSL). However, the licensee concluded in the IA that the reevaluated storm surge levels at the Intake Structure (standing wave inside the building) exceed several trigger conditions associated with the protection of the Intake Structure SSCs, given that the reevaluated storm surge elevations were not bounded by the CLB (27.6 ft. vs. 26.5 ft. MSL). A general site layout of Millstone is provided in Figure 3-1 of this assessment for reference.

At Millstone, the safety-related service water pumps, motors, and associated equipment are the only SSCs located in the Intake Structure which provide the service water KSF, (i.e., the ultimate heat sink for reactor decay heat removal). The licensee described in the IA that one service water pump motor is protected against a storm surge event up to 28 ft. MSL by installing additional flood protection barriers directed by site procedures AOP 2560, MP 2701E, and MP 2721C, Revision 9, Protection and Restoration of Service Water Pump and Strainer Motor During a PMH.

Additional details regarding the CDB flood protection of the service water pumps are described in the Millstone Unit 2 TRM, Rev. 173, item 3/4.7.5. Additional details describing the licensees

storm surge analysis at the Intake Structure can be found in site calculation, NAl-1996-001, Revision 2, MP2 Intake Structure Refined Beyond Design Basis Inundation Analysis.

As part of the audit discussions, the licensee provided additional details that clarified the information already provided in the IA with regard to the response timeline at Millstone. Table 3.3.3-1 summarizes Dominions response to the storm surge event.

Table 3.3.3-1 Summary of Millstone Storm Surge Response Timeline Hour Action(s)

T= -24 Notification of a Hurricane Warning, AOP 2560 Storms, High Winds and High Tides is entered.

Increase monitoring of Intake Structure wave action, water level, operation of traveling screens at the intake structure, and operation of the circulating water pumps and condensers.

Monitor Wind Speed and direction refer to C OP 200.6 Storms and other Hazard Phenomena to evaluate status and determine course of action.

Perform site inspections and cleanup for loose material, debris or equipment.

Stage flood water removal pumps and hoses in the Turbine Building condenser pit area to remove potential flood water that might bypass the flood gates.

Install Fire Pump House flood protection devices.

Stage a BDB auxiliary feedwater (AFW) pump inside the Turbine Building Railway Access.

Close flood gates and install stop logs per MP 2701E.

Install a safety line between Turbine Building and Intake Structure.

Confirm or restore the Condensate Storage Tank (CST) level to 100%.

T= -12 Continue monitoring storm per C OP 200.6.

T= -4 If site wind speed is forecast to exceed 90 miles per hour within the next four hours, initiate plant shutdown per applicable procedure.

T ~ -3 Initiate plant shutdown due to intake structure water level being forecasted to exceed 16.5 ft. MSL within four hours, and maintain plant at Hot Standby conditions using the SG Atmospheric Steam Dump Valves and AFW.

T ~ -1 Install flood protection can on one operable service water pump motor, when water level (including wave crest height) reaches plant grade (14 ft. MSL) in accordance with TRM 3/4.7.5. Note, this action may be accomplished sooner based on Station Management continual review of storm condition per C OP 200.6.

T=0 Hurricane Winds arrive on site.

T~1 Align fire water pump/tank to an emergency diesel generator (EDG) not electrically aligned to the "canned" service water pump, if intake water level exceeds 19.5 ft.

MSL.

T~3 Start equipment powered from the EDG cooled by fire water, trip the EDG supplied by service water, stop all service water pumps and stop all reactor building component cooling water (RBCCW) pumps, if intake water level exceeds 22 ft. MSL.

T ~ 10 Remove flood protection can from service water pump motor and restore service water when intake water level recedes to less than 14 ft. MSL.

Specific to the Intake Structure and the service water pumps, the general trigger conditions and following actions described in the IA in response to a storm surge event at Millstone, Unit 2 are:

When water level including wave crest height reaches plant grade (14 ft. MSL), install flood protection can on one operable service water pump motor, If the Intake Structure water level is forecasted to exceed 16.5 ft. MSL within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , initiate plant shutdown to hot standby conditions, establish AFW to the steam generators (SG) and maintain at hot standby using the atmospheric dump valves (ADVs),

If the Intake Structure water level exceeds 19.5 ft., align fire water tank/pump to cool EDG not electrically aligned to the "canned" service water pump, If intake water level exceeds 22 ft. MSL, start equipment powered from the EDG cooled by fire water, trip the EDG supplied by service water, stop all service water pumps and stop all reactor building closed cooling water (RBCCW) pumps, When intake water level recedes to less than 14 ft., remove the flood protection can from service water pump motor, re-connect the motor electrically, and restore service water to the applicable EDG.

In summary, upon determination of a hurricane at the site (precursor to a storm surge event), the service water pumps are stopped if the Intake Structure water level exceeds 22 ft. MSL. One of the three service water pumps is flood protected up to 28 ft. MSL, and then restarted when the water level at the intake structure recedes to less than 14 ft. MSL. As a result of the above analysis, the licensee concluded in the IA that effective flood protection at Unit 2 is demonstrated by having one service water pump flood protected during the maximum 27.6 ft. MSL flood level inside the intake structure during the high likelihood (10-4 AEP) probabilistic storm surge flood hazard.

NRC Review of Effective Flood Protection for Unit 2 The NRC staff reviewed the Millstone, Unit 2 FSAR, Section 9.7.2 which fully describes the Service Water System. The Service Water System is described as having the main purpose of supplying a continuous flow of cooling water to the RBCCW heat exchangers, Turbine Building closed cooling water (TBCCW) heat exchangers, diesel engine heat exchangers, vital ac switchgear room cooling coils, chilled water heat exchangers, the circulating water pump bearings, and is the delivery system for the chlorination system of the circulating water system.

To perform its intended function, three half-capacity (12,000 gallons per minute (gpm) and 450 horsepower each) vertical wet pit, motor-driven pumps take suction downstream from the travelling screens in the Intake Structure. For additional reference, Figure 9.7-1 of the Millstone, Unit 2 FSAR provides additional details and an illustration of the Service Water System piping and instrumentation diagram.

The Millstone, Unit 2 FSAR, Section 9.7.2.3 also states that during normal operation, two service water pumps are operating and provide water to the RBCCW and the TBCCW heat exchangers and vital switchgear ventilation system cooling coils. Each pump is capable of supplying the required service water to one train for accident mitigation and safe shutdown. A third standby pump will be started remotely by manual means upon loss of an operating pump. During winter operation (ultimate heat sink temperature less than 60°F), the standby RBCCW and TBCCW heat

exchangers may be placed on-line (service water side only) in order to maintain service water pump minimum flow requirements. The Unit 2 FSAR Section 9.7.2.4 further describes that the Service Water System also provides cooling water to the EDGs when these are started such as in the case of a loss of offsite power.

If the Intake Structure becomes flooded and the service water to the diesels must be isolated, then cooling to one EDG is provided by a cross-connection to the Fire Water System (Fire Water System provides a diesel-driven pump, fuel, and cooling inventory). This FSAR section also describes that only two service water pumps are required for normal operation at Millstone while only one is needed for emergency operation.

Also, as part of the audit discussions the NRC staff asked what additional sources of water were available to replenish the depleted fire water tank, in the event that flood waters recede to 14 ft.

MSL, but offsite power has not yet been restored therefore rendering inoperable the canned service water pump that cools the EDG. In its response, the licensee clarified that once the water recedes, the can is removed from the service water pump and the service water pump is reconnected electrically and aligned to the system. The EDG being cooled by the service water pump is not the one being cooled by the Fire Water system. The 4160 Volt Bus will be recovered by AOP 2502C (A Train) or AOP 2502D (B Train), whichever one is not being supplied by the Fire System. The fire tanks are filled from the city water system automatically, if available. There is no backup method to fill the tanks. If the fire tanks are emptied, ETE-CPR-2012-0009 documents the requirements and strategies for maintaining the KSFs required for cooling the fuel in the reactor and the spent fuel pool, and to maintain the containment cooling function during an ELAP. The Fire Tanks hold 250,000 gallons each (total of 500,000 gallons). This will supply the diesel cooling for over 11.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months at a flow rate of 700 gpm required to cool the EDG.

As a result of the above information, the NRC staff confirmed that it is reasonable to assume protection of only one service water pump consistent with established CDB actions, and that availability of one protected pump will allow the plant to perform the KSF of decay heat removal upon restoration of the service water pumps (assuming offsite power is available and floodwaters recede to 14 ft. MSL or lower). If offsite power is assumed lost because of the hurricane conditions and the service water pump providing cooling to one of the two EDGs is removed from service, then a second EDG will be relied upon to provide power to one train of safety-related loads not requiring service water/RBCCW, (e.g. Charging pump, AFW pump, and 480 VAC air compressors for operating SG ADVs). This second EDG will operate until flood waters recede inside the Intake Structure, and the service water pumps can be restored 1) using offsite power, to perform their normal function or 2) restored using power from the other available EDG. In addition, the licensee stated that the containment conditions and SFP conditions are monitored while service water/RBCCW is not available, and containment cooling and SFP cooling are restored with the restoration of service water/RBCCW.

This second EDG described above is cross connected to the Fire Water System as a source for cooling the diesel heat exchangers (Fire Water System provides a diesel pump, fuel, and cooling inventory). This strategy will be maintained by Dominion until the storm surge waters recede, which is approximately 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after initiating the fire water pump operation due to the forecasted arrival of the storm surge conditions. For added conservatism, the licensee also analyzed in its IA the postulated scenario where offsite power is lost during a storm surge event, and the site also undergoes a temporary loss of ac power condition at the site. The loss of ac power condition occurs as a result of the depletion of the diesel-driven fire water pump fuel tank, which in turn is cooling the EDG cross-connected to the fire water tank/pump system.

Under this postulated event, the licensee stated that the key safety functions required to be maintained during the potential temporary loss of all ac power during the reevaluated 10-4 probabilistic storm surge flood hazard are the same as those required to be maintained during an ELAP condition. Under this scenario, the licensee included a summary in the IA for the actions to be performed at Millstone:

Reactor Core Cooling and Heat Removal - When Intake Structure water level is forecasted to exceed 16.5 ft. within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , plant shutdown to hot standby conditions is initiated.

AFW to the SGs is initiated and the plant is maintained at hot standby using the SG ADVs.

The licensee further stated that the analysis documented in calculation MISC-11787, Revision 0, Addendum D, Evaluation of Secondary Heat Removal Requirements Following an ELAP, Millstone Cases with Preemptive Shutdown concluded that if pre-emptive shutdown from full power is performed 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months prior to initiation of decay heat removal using the SG ADVs and AFW, the CST has 17.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of AFW supply prior to depletion, and the SG dryout would occur after 23.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months without replenishing the CST.

The SG ADVs have a manual operation capability if ac power is not available. Therefore, if emergency power is lost due to a temporary loss of EDG availability, CST volume and SG inventory are sufficient for reactor heat removal using the turbine-driven AFW pump and SG ADVs for about 23.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , which is more than an adequate amount of time for restoring cooling water (either fire water or service water) to the EDG for restoring emergency power and replenishing the CST.

Reactor Coolant System (RCS) inventory and reactivity control - Loss of the Charging pump/system occurs with a temporary loss of emergency power (i.e., loss of EDG cooling) at hour 55, if service water is not restored. The RCS inventory makeup to prevent loss of natural circulation and inventory control is not required for about 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months . Therefore, emergency power for operation of the Charging pumps/system, (i.e., RCS injection), would not be required for about 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months (i.e., until about hour 80). Additional details regarding the RCS inventory makeup are described in Attachment 1, Table 9.1-1, of ETE-CPR-2012-0009, Revision 7, Beyond Design Basis- FLEX Strategy Basis Document and Final Integrated Plan, Millstone Unit 2.

Spent Fuel Pool (SFP) Cooling - Procedure AOP 2560, Step 4.12 which is entered upon hurricane conditions at the site directs operators to enter AOP 2582, Revision 7, Loss of Spent Fuel Pool Cooling, Millstone Unit 2 for alternate SFP cooling, if required. More than sufficient time is available to initiate alternate SFP cooling, because after loss of SFP cooling (resulting from a temporary loss of emergency power due to loss of EDG cooling at hour 55) with the maximum expected SFP heat load, the SFP will begin to boil in approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and boil off to a level 10 ft. above top of fuel in 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

Therefore, SFP cooling would not be required during a temporary loss of emergency power due to EDG unavailability for between 6 and 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (i.e., between hour 61 and hour 85).

Indication of Key Parameters - Dc batteries provide power for key parameter indications for 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months after a loss of all ac power, if loss of all ac load stripping is performed within 75 minutes. Therefore, since the dc switchgear room would not be flooded, dc battery power would be available, and emergency ac power for key parameter indication would not be required during a short-term temporary loss of emergency ac power supplied

by the EDG (i.e., would not be required for 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months until about hour 84) if loss of all ac load stripping of the dc batteries is performed.

Containment Cooling - Reduction of containment temperature and pressure (containment cooling) is not required until 4 - 5 days after an ELAP. Therefore, containment cooling is not required until 4 - 5 days after the storm surge has passed through the site and would not be impacted by a temporary loss of emergency power due to temporary loss of EDG cooling as a result of a storm surge event.

Core Cooling in Shutdown Modes - If emergency power is lost temporarily due to temporary loss of EDG cooling, FLEX strategies are provided for reactor core cooling in shutdown modes during an ELAP condition. Reactor core cooling is accomplished in Mode 5 using the SG ADVs initially steaming off SG inventory and, if needed, with AFW delivered to the SGs using the beyond design basis (BDB) AFW pump pre-staged inside the Turbine Building railway access. In Mode 6, reactor core cooling during a loss of all ac power is accomplished by gravity feed from the Refueling Water Storage Tank (RWST) and by the BDB AFW pump if RWST driving head is not available.

As a result of the above, reactor core cooling in shutdown modes would not be significantly impacted by a temporary loss of emergency power due to the temporary loss of EDG cooling. In summary, the licensee concluded in its IA that the reevaluated storm surge hazard will have insignificant impact on the required operator actions in response to the storm surge flood levels.

This determination was made when considering a worst case scenario where a temporary loss of all ac power occurs as a result of depletion of the diesel-driven fire water pump fuel tank prior to storm waters receding, and Dominion being unable to refuel the fire water pump fuel tank for additional cooling capability.

For added operational flexibility, the licensee stated in its IA that it plans to enhance site procedure AOP 2560, Revision 19, Storms, High Winds and High Tides by adding steps to ensure that the fire water pump diesel fuel tank level is at maximum level when a hurricane warning is issued. In the event the operating service water pump is shut down due to water inside the Intake Structure exceeding 22 ft. MSL, this enhancement will provide approximately 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of diesel fuel for fire pump operation to provide fire water cooling capability for the EDG, before the diesel fuel tank would require refilling. This enhancement will provide the maximum time to 1) restore service water to the EDGs (removing the service water pump motor can, reconnecting the pump motor electrically, and restoring service water to the EDG) once the storm surge level recedes to 14 ft. MSL, or 2) refill the fire water pump diesel fuel tank.

The NRC staff reviewed the information above and requested additional clarification from the licensee as part of the audit discussions. Specifically, the NRC staff asked what other sources of fuel were available to replenish the diesel-driven fire water pump fuel tank, if needed. In its response, the licensee stated that a diesel fuel truck is available on site for replenishing the fire pump tank, if necessary. In addition, there is a 1,000 gallon fuel tank truck located in the BDB Dome (see ETE-CPR-2012-0009). The licensee stated that refilling the diesel tank during the storm was not considered, but it can be filled if desired and conditions allow. Technical evaluation ETE-CPR-2012-0009 documents the requirements and strategies for maintaining the KSFs required for cooling the fuel in the reactor and the SFP, and to maintain the containment cooling function during an ELAP. These KSFs are also required during the potential temporary (short-term) loss of all ac power and the loss of the service water and auxiliary feedwater KSFs due to flood inundation during the reevaluated combined effects with 10-5 probabilistic storm surge

flood hazard. The NRC staff notes that Section 3.7.6 of the FLEX mitigating strategies safety evaluation also describes available fuel sources for FLEX equipment relied upon as part of Order EA-12-049.

The NRC staff also requested clarification on how the service water would be restored to cool the EDG heat exchangers under a scenario where the storm surge flood waters had receded, but loss of offsite power had not yet been restored, given that the service water pumps are electrically motor-driven. In its response, the licensee stated that recovering an EDG to supply power for the motor-driven AFW Pumps is achieved with the steps described in EOP 2541. Specifically, the Standard Appendix 23C or 23F of this procedure would apply, depending on which train is used.

This procedure provides the necessary steps for starting the EDG and the service water pump.

Finally, the NRC staff asked about the proposed enhancement to the AOP 2560 procedure to ensure maximum availability of fuel within the fire water pump diesel fuel tank, and whether it was being tracked as a regulatory commitment. In its response, the licensee clarified that the enhancement is not being tracked as part of the regulatory commitments in the IA submittal, however, the action is being tracked in Dominions PAMS database as Millstone Licensing Action LA7812559. As part of the audit discussions, the licensee also stated that this enhancement is expected to be completed by the end of calendar year 2020.

Because the enhancement is not being tracked as a regulatory commitment, the NRC staff did not credit the 10-hour operational capability of the diesel fuel tank from the Fire Water System.

However, the NRC staff agrees that providing a 10-hour operational capability for cooling the EDG is adequate and consistent with the expected recession time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months for the high scenario event. Completion of the enhancement would provide further assurance that the temporary loss of ac power, if it occurs, will reasonably be expected to be remediated when considering the expected environmental conditions at the site. In addition, the NRC staff also agrees that several fuel sources are available to replenish the tank should the need arise. Additional discussion on the 10-hour operational capability and the licensees evaluation of a more conservative scenario (5-hour operational capability) is described below.

Testing, Maintenance, and Inspections With regard to testing and inspections of the Service Water System components, the FSAR states that major components of the system such as pumps and strainers are accessible for periodic inspection during normal operation. Specifically, FSAR Section 9.7.2.5 describes a list of actions performed by Dominion to ensure the capability of the system to provide the required safety-related cooling. Actions include inspecting and cleaning the intake bays to minimize fouling, monitoring of available heat exchanger parameters to detect gross debris loading, and cleaning the heat exchangers on the service water side to minimize fouling buildup.

As part of its audit review, the NRC staff asked about the frequency and periodicity of the surveillance inspections performed to the service water pumps. As part of its response, the licensee stated that site procedure SP 2612A, B, and C are the procedures used for surveillance of the service water pumps. Inservice testing of a service water pump is performed by operating the pump at a specified flow and measuring pump pressures and vibrations. The data obtained is then compared to previously established values to verify pump operational readiness (i.e., is operating properly and to detect undesirable trends). In these procedures, Section 4.1 tests the service water pump, service water pump discharge check valves, and service water pump discharge strainer flush valve for operational readiness on a quarterly frequency. Section 4.2

performs the biennial Comprehensive Pump Testing. Finally, the licensee stated that Section 4.3 performs the 5 point Preservice Pump Test.

The NRC staff agrees that a systematic and proceduralized periodic inspection program for the service water pumps and the associated flood protection components is a key component to ensure reliability of the equipment. This determination is made upon the increased likelihood to identify (and correct) any deficiencies, and provide adequate maintenance and oversight which in turn provide further assurance that the protected pump will perform its intended function.

Time Sensitive Actions The NRC staff reviewed the information above and agrees that the weather alerts/warnings that may impact the site originate from several reliable sources that are continually monitored, such as CONVEX, CAENS, the local weather forecast, and/or the NOAA website.

At Millstone, the STA has the responsibility of monitoring the weather at all times consistent with surveillance procedure 2654R, Rev. 3, Intake Structure Condition Determination. This procedure is performed a minimum of once per shift by the STA, and any decisions for declaration of the monitoring and action triggers will be based on the information received from monitoring the weather forecasts described above. This procedure also requires the STA to notify the SM or US of degraded environmental conditions. The NRC staff notes that full details of the STAs roles and responsibilities are described in Dominion Nuclear Fleet Administrative Procedure, OP-AA-500, "Conduct of Shift Technical Advisor." In addition, Dominion fleet procedure, CO-PROC-000-HRP-NUCLEAR, Revision 14, "Hurricane Response Plan - Nuclear" provides for a corporate level assessment of station operational status and for the delineation of corporate responsibilities and support staff requirements for a hurricane related storm surge event.

The adverse weather information is then processed and compared to clear and unambiguous procedural triggers that have been revised, as appropriate, to account for the reevaluated storm surge flood hazard warning time. The complete list of actions and triggers are fully described in:

AOP 2560, Revision 19, Storms, High Winds and High Tides, MP 2701E, Revision 0, Unit 2 Flood Gates Installation and Removal, MP 2721C, Revision 9, Protection and Restoration of Service Water Pump and Strainer Motor During a PMH, and Millstone Unit 2 Technical Requirements Manual, Rev. 173.

At Millstone, the storm surge procedural action trigger is notification of a hurricane warning (a hurricane warning is issued when hurricane conditions are expected in a specified coastal area in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or less, and include winds equal or greater than 74 mph and/or dangerously high tides and waves), and/or the forecast of a storm center with sustained wind speeds greater than 60 mph expected to strike the site within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . As a result, the initiating action trigger at Millstone requires the site storm surge response to be initiated between 24 and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months prior to a consequential storm surge reaching the site. For added conservatism, the NRC staff focused its review on site actions starting 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months prior to arrival of the hurricane conditions because it would provide the least amount of anticipatory time to complete the required flood protection activities.

The action triggers at Millstone are systematically proceduralized, and direct staff to install additional flood protection barriers with at least 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of margin to complete the activities before the storm surge floodwaters arrive onsite. Specifically, additional flood protection for the protected service water pump is achieved by MP 2701E, and MP 2721C will direct staff on how to restore service to the service water pumps. The NRC staff notes that the licensee also considered that these activities and notifications will be performed by trained staff, as applicable, in order to ensure consistency of the actions performed.

As part of the IA review, the NRC staff reviewed MP 2701E. This procedure clearly details the pre-briefing, tools, consumables, procedures and steps that must be followed by plant personnel to install, close, and open the additional flood protection at the site up to elevation 22 ft. MSL.

The procedure includes gate-specific instructions at several locations to ensure the unique location characteristics are being addressed (i.e.: Flood gate 15 consists of three planks with a jacking screw and post, and are stored up and under the stair platform just inside door. There are two sets, the preferred set has gaskets installed, the back-up set does not have gaskets installed.)

The NRC staff also notes that there are 22 total flood gates, and flood gates 16, 17, 18 and 20 are specific to the Intake Structure.

In its IA, the licensee stated that the closure time of the flood gates documented in ETE-MP-2018-1006. Rev. 0 is considered to be a Level B Record for timed validation of Level B TSAs under the guidance of NEI 12-06, Appendix E, Section E.6.3.2. This record documented that for Hurricane Sandy, plant personnel performed the closure of the flood gates in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and 34 minutes. Adding margin to the documented time, the licensee assumed 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months total time to perform the closure actions. Because these actions were performed with a fully staffed operations or maintenance crew, the licensee also evaluated a worst-case staffing scenario.

Under a worst-case staffing scenario, the licensee stated in the IA that AOP 2560 could be entered, if needed, 12-24 hours prior to notification of the consequential storm surge predicted to arrive at the site. In this scenario, the SM or the US in charge would immediately perform the requested actions and notifications described in AOP 2560 for additional personnel to support the preparation efforts.

The licensee further described that minimum staff would initiate closure of the flood gates, and approximately 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months would be available for the additional personnel to arrive on site within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months or more prior to the consequential storm surge arriving on site to ensure the flood gate closure could be completed. Finally, the licensee stated that since Unit 3 is not impacted in the same manner as Unit 2, additional operations and/or maintenance personnel could further supplement the Unit 2 staff for the storm surge response, if needed.

As part of its review, the NRC staff sought to verify that the proposed strategy at Millstone could be implemented successfully in an organized pre-planned manner, that workers have been properly trained (or will be, as applicable), and that site personnel have demonstrated the ability to complete the requested tasks within the designated timeframe and within the expected environmental conditions. The staff also sought to identify what redundant, compensatory, or confirmatory measures are in place that would address the potential for incorrect execution of the proposed actions.

The NRC staff reviewed the information in the IA and agrees that the anticipatory warning time at Millstone is a level B TSA, which is consistent with NEI 12-06 and corresponds to events where warning time is greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The NRC staff also agrees that the documentation of flood gate closure time (timed validation) for the storm surge event is a Level B Record, given that the TSAs have been validated using validation results for similar activities, such as the Hurricane

Sandy event. Furthermore, additional confidence in the validation of the Level B TSAs is provided by Dominion given that there is significant margin available (approximately 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ) for the tasks to be performed at Millstone (difference between the time required to perform the task and the time available under the most conservative timeline scenario).

The NRC staff also agrees that Dominion has demonstrated that redundant and compensatory measures are in place at Millstone by providing a clear organizational response to plant personnel, such that it is reasonable to expect that the storm surge response strategies can still be implemented at the site under a postulated worst case minimum staffing scenario. The NRC staff further agrees that Dominion has developed anticipatory activities that incorporate triggers for when the plant is cued to respond to the flood event, and inspection activities before and after the event to restore plant conditions. In addition, the NRC staff also agrees that the licensee has considered the TSAs at the site and has validated the existing flood protection strategies described in AOP 2560.

Available Physical Margin (APM)

The NRC staff considered the APM of approximately 4.5 ft. when comparing the 22 ft. MSL of available physical protection east of the powerblock against the anticipated 17.5 ft. of total water elevation for the storm surge event. With regard to the protection of the safety-related service water pump, the NRC staff also agrees that the licensee has demonstrated an effective flood protection that is systematically proceduralized, and has adequate APM of approximately 0.4 ft.

The NRC staff notes that the guidance described in NEI 16-05, Revision 1, Appendix B, as endorsed, states that Negligible or zero APM can be justified as acceptable if the use of conservative inputs, assumptions, and/or methods in the flood hazard reevaluation can be established. As described in Section 2 of this staff assessment, the NRC staff had concluded in the supplement to the ISR letter and staff assessment that the licensee's reevaluated flood hazard information was determined using conservative inputs, assumptions, and/or methods, and is a suitable input for other assessments such as the IA submittal.

In addition to the above information, the licensee also credited additional actions to ensure APM is adequate at Millstone, Unit 2. Specifically, the credited additional actions include:

Credited flood gates remain closed, and credited stop logs and flood barriers remain installed during and following the storm surge event, until flood waters subside, Credited flood gates, stop logs, and flood barriers are controlled and maintained in accordance with appropriate station procedures, Permanently installed flood barriers are controlled and maintained, Qualified seals are in place for flood boundary penetrations, and Reinforced concrete and block walls credited for flood protection are controlled and maintained (covered by Millstone Common Engineering Procedure C-EN-1041, Revision 13, Condition Monitoring of Structures.)

Conclusion of Demonstration of Effective Flood Protection for Unit 2

As a result of the above information, the NRC staff concludes that the licensee has demonstrated having effective flood protection for the high likelihood scenario at Millstone, Unit 2 that is reliable, maintained, and has APM such that the site is reasonably protected against the storm surge reevaluated flood hazard event.

3.3.4 Unit 2 - Feasible Mitigation for Low Likelihood Events At Millstone, the licensee stated in its IA that the reevaluated storm surge flood hazard total water levels for the low likelihood event are bounded by the respective CDB/CLB water levels for the east side of the power block (20.9 ft. vs. 21.3 ft. MSL). The key safety-related SSCs east of the Turbine Building west flood wall are protected from the 10-5 AEP probabilistic storm surge flood hazard by the flood wall and the CDB installed flood gates and stop logs up to elevation 22 ft.

MSL.

At the west wall of the Turbine Building, the reevaluated storm surge flood hazard total water levels are also bounded by the respective CDB/CLB (23.6 ft. vs. 25.1 ft. MSL). The CDB/CLB flood protection at the west wall of the Turbine Building credits metal siding for additional flood protection up to elevation 25.1 ft. MSL beyond the concrete walls (which protect up to elevation 22 ft. MSL). Similar to the effective protection analysis described in Section 3.3.3 of this assessment, the licensee evaluated the postulated event where the metal siding along the west wall of the Turbine Building is not present (as an added conservatism) to prevent flood water wave run up from overtopping the 22 ft. MSL west flood wall during the reevaluated flood hazard.

Under this postulated scenario, the floodwaters would exceed the 22 ft. MSL external concrete wall and the Turbine Building floor would be flooded at elevation 14.5 ft. MSL to a depth of approximately 1.9 ft. The licensee further described that the overtopping flood volume would fill the AFW pump room to a floor depth of 1.5 ft. MSL (located in the Turbine Building below the 14.5 ft. floor elevation) and inundate the two motor-driven auxiliary feedwater (MDAFW) and turbine-driven auxiliary (TDAFW) pumps, resulting in a loss of the AFW KSF.

The licensee also stated that the expected 1.9 ft. of flooding at the Turbine Building would not inundate the BDB AFW portable pump which is pre-staged in the Turbine Building railway access with a top of trailer frame height of about 2.3 ft. However, the flooding at the Turbine Building would partially submerge the BDB FLEX AFW and CST connections for the BDB AFW pump discharge and suction hoses. As a result of the above, the licensee concluded that margin is available when compared against the calculated 10-5 AEP storm surge flood hazard analysis.

With regard to the Intake Structure, the licensee stated in the IA that the storm surge level inside building (standing wave) for the low likelihood event is not bounded by the CDB/CLB (31.7 ft.

vs. 26.5 ft. MSL) and the south side of the Intake Structure (39.0 ft. MSL roof elevation) is also overtopped by the storm surge total water elevation of 43.0 ft. MSL. As a result of these hazard exceedances, the licensee assumed that the service water function is lost during the low likelihood scenario, resulting in the loss of the service water KSF, i.e., loss of ultimate heat sink.

Because the only SSC that provides a KSF at the Intake Structure is assumed lost, the licensee concluded in the IA analysis that the AFW system pumps and associated equipment located in the Turbine Building (AFW pump room) are the only safety-related SSCs located in the power block that are inundated by the reevaluated combined effects with 10-5 AEP probabilistic storm surge flood hazard.

In summary, for the low likelihood storm surge event Dominion assumed that the service water function at the Intake Structure is assumed lost, and also the AFW pumps are presumed to be flooded. The flooding of the AFW pump room does not credit the metal siding flood protection feature along the west wall of the Turbine Building. Specific details regarding the loss of AFW and service water are provided below.

Additional details regarding the licensees analyses are described in:

ETE-CPR-2017-1005, Rev. 0, Millstone Unit 2 Beyond Design Basis Flooding Focused Evaluation and Integrated Assessment, ETE-CPR-2017-1004, Rev. 0, Impact of Reevaluated Flood Hazards on FLEX Mitigating Strategies, Millstone Units 2 & 3, Dominion (Zachry) Calculation,19-007, Revision 0, Combined Effects Flood Analysis for Storm Surge Annual Exceedance Probability lE-5 for Millstone Power Station, and Dominion (Zachry) Calculation, NAl-1996-001, Revision 2, MP2 Intake Structure Refined Beyond Design Basis Inundation Analysis.

NRC Review of Feasible Flood Protection for Unit 2 Based on the information described in the IA, the NRC staff agrees that the key safety-related SSCs in the Unit 2 powerblock are protected against the low likelihood event by means of the flood protection barriers that protect up to elevation 22 ft. MSL. The NRC staff reached this determination by reviewing the Millstone FSAR, the IA, supporting information such as MP 2701E, and comparing 22 ft. MSL of flood protection against the expected low likelihood anticipated storm surge water elevation of 20.9 ft. MSL. This comparison results in an estimated APM of 1.1 ft. at the Unit 2 powerblock.

The licensee determined the 20.9 ft. water elevation assuming that the west side of the Unit 1 (located south of Unit 2) and Unit 2 combine to essentially form a continuous barrier, which effectively prevents wave runup along the west side wall of the barrier" from continuing on into the main site/power block area east of Turbine Building. In the supplements to the ISR letter and staff assessment, the NRC staff had previously concluded that the licensee's reevaluated storm surge flood hazard information was determined using conservative inputs, assumptions, and/or methods, and is a suitable input for other assessments such as the IA submittal. As previously described, this flood hazard was not revised in the IA and was therefore not re-reviewed in the IA by the NRC staff.

The NRC staffs review of a feasible response for the rest of Unit 2 focused on the sites ability to mitigate and restore core cooling via the AFW feeding the SGs before dryout conditions occur, and also on the sites ability to cope without the Service Water System. In general, the NRC staff notes that the requirements and mitigation strategies for maintaining the key safety functions required for cooling the fuel in the reactor and the SFP during an ELAP for Millstone, Unit 2 against CDB events are described in Dominion ETE-CPR-2012-0009, Revision 7, Beyond Design Basis - FLEX Strategy Basis Document and Final Integrated Plan, Millstone Unit 2. As described in Section 2 of this staff assessment, the NRC staff issued a safety evaluation documenting its evaluation of the FIP by letter dated July 1, 2016.

Loss of Auxiliary Feedwater (AFW)

In its IA, the licensee stated that the loss of AFW can be mitigated by enhancing an existing FLEX strategy where the BDB AFW pump is used to supply AFW to the SGs for reactor heat removal.

This BDB AFW pump is pre-staged in the Turbine Building as directed by site procedure AOP 2560, Revision 19, Storms, High Winds and High Tides. The two enhancements to the strategy proposed by Dominion are:

Procedurally direct connection of the pre-staged BDB AFW pump discharge and suction hoses to the BDB FLEX AFW and CST connections, respectively, when the unit is shutdown to hot standby conditions, and opening the FLEX connections' isolation valves if excessive flood water is filling the condenser pit; and Maintaining the SGs levels at the maximum value in their level range when the plant is in hot standby.

In its IA, the licensee concluded that these enhancements will ensure that the BDB AFW portable pump, with a 2.3 ft. top of trailer frame height, will be available for operation with approximately 1.9 ft. maximum flood depth present on the 14.5 ft. MSL elevation Turbine Building floor during the low likelihood reevaluated storm surge flood hazard.

The NRC staff notes that the timeline developed by Dominion in site calculation 19-007, Rev. 0, Combined Effects Flood Analysis for Storm Surge Annual Exceedance Probability lE-5 for Millstone Power Station was done over a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months time period. In contrast, the timeline summarized on Table 3.3.3-1 was normalized around hurricane winds on site being at T = 0 hour0 days 0 hours 0 weeks 0 months .

Therefore, the shutdown actions and conditions described below correspond to the hourly timeline described in site calculation 19-007. Dominion described in its IA that a total water level of about 16.5 ft. MSL occurs at the Intake Structure at about hour 48 of the event. Subsequently, AOP 2560, Revision 19, step 4.8 initiates a preemptive plant cooldown to hot standby conditions when the Intake Structure water level is forecasted to exceed 16.5 ft. within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This results in Dominion initiating normal shutdown to hot standby conditions at approximately hour 44 of the event over a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months time period. As a result of these preemptive actions, the licensee stated in the IA that the TDAFW pump would have been delivering AFW to the SGs for reactor heat removal for about 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months prior to loss of AFW function at about hour 51 of the event, when the AFW pump room is inundated. Dominion calculated the hour 51 inundation time in Attachment C, Figure 18 of site calculation,19-007.

As described above, the proposed enhancements to Step 4.8 of site procedure AOP 2560 would procedurally direct site personnel to establish the connections of the pre-staged BDB AFW pump discharge and suction hoses to the FLEX AFW and CST connections, respectively, before the flood waters reach the Turbine Building floor; and to AOP 2560, Step 4.17 to open the FLEX connections' isolation valves when excessive flood water level begins accumulating in the condenser pit.

In addition, with approximately 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of SG inventory available before depletion (with the SGs at normal level) for reactor decay heat removal following a preemptive reactor shutdown, Dominion concluded that there is reasonable assurance that the pre-staged/pre-connected BDB AFW pump would be started and delivering AFW to the SGs well before SG inventory is depleted in this scenario. Additional details of the licensees analysis are described in site calculation MISC-11787, Rev. 0, Addendum D, Evaluation of Secondary Heat Removal Requirements Following Extended Loss of AC Power (ELAP), Millstone Cases with Preemptive Shutdown.

NRC Staffs Review of Loss of Auxiliary Feedwater (AFW) Strategy The NRC staff notes that the sites decay heat removal strategy described above begins with the TDAFW pump providing the main AFW cooling function. Initially, the CST provides the water supply for the TDAFW pump. In the IA, the licensee described that the CST has approximately 17.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of AFW supply prior to depletion, and then SG dryout would occur approximately 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months later without replenishing the CST. Analyzing a conservative scenario, the licensee assumed that the TDAFW is lost due to flooding of the AFW pump room as a result of not crediting the metal siding along the west wall of the Turbine Building, which would otherwise prevent storm surge wave run up from overtopping the 22 ft. MSL west flood wall. As a result of the above, the licensees strategy relies on the use of the TDAFW for a period of time before transitioning over to the BDB FLEX AFW cooling.

As described in the July 1, 2016, safety evaluation, RCS cooldown at a rate of up to 100 degrees Fahrenheit (°F)/hour would commence within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of event initiation (an ELAP and loss of access to the ultimate heat sink) and would be continued for approximately 2 to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months until SG pressure reaches a target value of 120 per square inch absolute (psia). At 120 psia, the BDB AFW pump is capable of providing adequate feedwater flow to the SGs. The NRC staff notes that these activities would also apply and serve the same purpose during the reevaluated storm surge hazard scenario, and would not be challenged given their anticipatory nature and the expected environmental conditions in which they are performed. In addition, the NRC staff also agrees that assuming that the metal siding along the west wall of the Turbine Building is not present to prevent flood water wave run up from overtopping the 22 ft. MSL west flood wall during the reevaluated flood hazard is a conservative assumption, given that it is a flood protection feature credited in the CDB. Realistically, upon arrival of the storm surge flood waters the metal siding along the west wall of the Turbine Building may reduce, divert, or significantly prevent the amount of storm surge water entering the Turbine Building and the general powerblock.

After operation of the TDAFW pump and venting of the SGs via the ADVs, the reduced SG pressure will subsequently permit the BDB AFW pump to provide secondary makeup in advance of the TDAFW pump becoming unavailable due to the flooded AFW pump rooms. Also described in the July 1, 2016, safety evaluation, an AFW pump suction hose connection is installed between the CST and the TDAFW pump for use with the beyond-design-basis (BDB) FLEX strategies.

This connection provides a path to allow for an AFW supply to the TDAFW pump other than the CST. A second hose connection is installed between the motor-driven AFW pumps and the CST to provide a path for the CST to be refilled using a portable transfer pump, if required. A portable diesel transfer pump, hoses, fittings, and fuel oil has been pre-staged in the turbine building to facilitate the transfer of water to the CST. The CST may be refilled from a variety of sources, including the onsite fire system, city water system, the onsite freshwater pond, and various onsite water storage tanks, if available.

In the July 1, 2016, safety evaluation, the NRC staff performed independent confirmatory calculations to verify the licensees conclusions regarding CST depletion and SG dryout, including simulations using the TRACE thermal-hydraulic code. The NRC staff concluded that the licensees strategy for providing makeup to the CST (once the available inventory has depleted) within approximately 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months should be sufficient to prevent SG dryout. As a result of the above analysis in the safety evaluation, the NRC staff agrees that the estimated 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of available time before SG dryout is a reasonable assumption by the licensee in the IA analysis.

When comparing the 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months of available TDAFW flow (started at hour 44 of the event until hour 51 of the event) and the 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of available inventory inside the SG (with normal

operating volume), it is reasonable to assume Dominion has approximately 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months before SG inventory depletion after storm surge floodwaters exceed 16.5 ft. MSL at the Intake Structure, which is the trigger for plant shutdown to hot standby conditions. The NRC staff then evaluated the information related to the BDB FLEX pumps (prior to inundation of the AFW pump rooms) in order to avoid SG dryout.

With regard to the FLEX AFW pumps, the NRC staff requested clarification as part of the audit discussion on whether the comparison between the top of the trailer and approximate flood depth anticipated at the Turbine Building (2.3 ft - 1.9 ft. = 0.4 ft.) was being credited as APM by the licensee in the IA. In its response, the licensee stated that Dominion was crediting 0.4ft. of available APM. As a result of the licensees response, the NRC staff agrees that 0.4 ft. of APM provides additional assurance that the FLEX AFW pump is flood protected from the low likelihood storm surge flood, and is consistent with NEI 16-05, Revision 1, Appendix B which states that Negligible or zero APM can be justified as acceptable if the use of conservative inputs, assumptions, and/or methods in the flood hazard reevaluation can be established.

In its IA, the licensee is proposing a more realistic approach that includes enhancements to existing procedures. These enhancements to steps 4.8 and 4.17 of site procedure AOP 2560, proposed by the licensee in the IA, would procedurally direct site personnel to establish the connection of the pre-staged BDB AFW pump discharge and suction hoses to the FLEX AFW and CST connections, respectively, prior to flooding of the Turbine Building; and to open the FLEX connections' isolation valves when excessive flood water level begins accumulating in the condenser pit.

Because the changes to the existing procedures have not yet been made, the NRC staff did not perform a detailed review. However, the licensee included a regulatory commitment in the IA to Define plant protective measures, validate time sensitive actions (TSAs), provide installation and response timelines (including warning time and period of site preparation), and confirm the site strategy in accordance with NEI 12-06, NEI 16-05, and the NEI document "Warning Time for LIP Events." As part of the audit discussions, the licensee clarified that this regulatory commitment does not apply to the proposed enhancements to the site procedures for Unit 2 as a result of the reevaluated storm surge event. However, the licensee clarified that these enhancements are expected to be completed by the end of calendar year 2020. As a result, the NRC staff credited the proposed modifications in its IA review, but not the enhancements. The NRC staff expects that the licensee will address the regulatory commitments described in the IA consistent with NEI 99-04. The NRC staff agrees that completion of the enhancements will provide additional operational and functional capabilities at the site.

As a result of the above information, the NRC staff agrees that the licensee has demonstrated a feasible mitigation strategy for the low likelihood storm surge event for Unit 2 that has APM, has anticipatory measures that provide additional operational margin, and rely on FLEX equipment that is reliable, maintained, and protected from the anticipated storm surge floodwaters.

Loss of Service Water The licensee described that the loss of service water during the low likelihood event at Unit 2 is the same as described for the loss of service water during the high likelihood storm surge event documented in Section 3.3.3 of this staff assessment. In summary, upon determination of a hurricane at the site (precursor to a storm surge event), the service water pumps are progressively protected and removed from service based on weather forecasts, and stopped if the intake structure water level exceeds 22 ft. MSL. One of the three service water pumps is flood protected up to 28 ft. MSL, and then restarted when the water level at the intake structure recedes to less than 14 ft. MSL.

To mitigate the effects of the loss of the Service Water System, Dominion will use an EDG which is cross-connected to the Fire Water Service System as a source for cooling. This EDG cooled by fire water will power one train of safety-related loads not requiring service water/RBCCW, (e.g.

CH pump, AFW pump, 480 VAC air compressors for operating SG ADVs in MCR, HPSI and LPSI pumps) until the service water cooling can be restored to the other available EDG, or the service water pumps are available for operation with offsite power.

With regard to fuel, the licensee stated in its IA that the fire water pump's 275 gallon diesel fuel tank is verified to be filled between the low level capacity (50 percent) and full level capacity (100 percent) during daily operator rounds. As part of the audit discussions, the licensee clarified that site procedure SP 3670.1-008, Unit 3 Plant Equipment Rounds - Outside" is the procedure used to verify fuel level at Units 2 and 3. The licensee then stated that if the 275 gallon fuel tank is assumed to be half full, sufficient fuel would be available to operate the diesel driven fire pump (with a fuel consumption rate of 26 gallons/hour) for approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Similarly, the fire water pump diesel fuel tank would need to be verified to be at full level in order to provide 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of fire pump operation capability, and then refilled during the event after floodwaters recede to 14 ft. MSL (about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after initiating fire water pump operation) and the wind speed subsides to a reasonable level. Therefore, under the most conservative scenario where the fuel tank capacity is at 50 percent (5-hour operational time), the portable diesel pump providing cooling to the EDG may run out of fuel and the EDG may not have cooling water for a short time.

Losing the EDG would result in emergency power not being available (i.e., a temporary loss of all ac power). If a temporary loss of all ac power occurs, the IA described that Dominion will implement the FLEX strategies described in ETE-CPR-2012-0009, Rev. 7, Beyond Design Basis-FLEX Strategy Basis Document and Final Integrated Plan, Millstone Unit 2. These actions have been described in Section 3.3.3 of this staff assessment.

NRC Staffs Review of Loss of Service Water System Strategy As part of the IA review, the NRC staff sampled site procedure MP 2721C, Revision 9, Protection and Restoration of Service Water Pump and Strainer Motor During a PMH. This procedure states that protection of the service water pumps can be performed on any of the three pumps available, but is normally performed on the B service water pump. This procedure also details the pre-briefing meetings, tools, consumables, precautions, procedures and steps that must be followed by plant personnel to protect and restore the service water pumps. In general, the procedure directs plant personnel remove the service water pump motor leads and terminal box in order to be stored in a dry location. Operators are then instructed to lift the fiberglass can that weights approximately 250 pounds using a chain rig attached to the 3/4 inch eyebolt at the top of the can, and then place it atop the service water pump motor. Upon placement, the bottom flange of the can will then be secured to the service water pump pedestal bolts by using 4 hold-

down chains to prevent any potential uplift movements by floodwaters. Restoration of service includes the above steps in reverse order, plus additional electrical tests to ensure adequate electrical capability of the pump prior to being in-service.

Parallel to the protection of the service water pump, Dominion assumed the storm surge event results in a temporary loss of offsite power. Under this postulated scenario, Dominion will rely on an EDG cross connected to the Fire Water Service System. The Fire Water System provides temporary cooling to the EDG heat exchanger until at least one service water pump (which normally provides this function) is placed back in service. This EDG will provide the loads associated with motor-driven AFW pump relied upon for decay heat removal until:

The fire water diesel pump providing cooling runs out of fuel (between 5-10 hours of operational capability),

Storm surge flood waters recede to 14 ft. MSL or lower, and at least one service water pump is placed back in service (powered by an EDG if offsite power has not been restored). The other available EDG (not cross connected to the fire water service system) will continue to provide power to the AFW pump, and will be cooled by the service water system, or Offsite power is restored, and the service water pumps are in-service, and performing their normal function without the need for EDG power.

As part of the audit, the NRC staff sampled ETE-CPR-2017-1005, Millstone Unit 2 Beyond Design Basis Flooding Focused Evaluation and Integrated Assessment. In this technical evaluation, Dominion concluded that the Unit 2 and Unit 3 EDGs and the Unit 3 SBO diesel generator are protected from the FHRR reevaluated combined effects with probabilistic storm surge flood hazard. Thus, having both units EDGs available during the reevaluated flood hazard by definition makes the occurrence of an associated dual unit ELAP implausible.

The licensee also concluded in the technical evaluation that the service water pumps (at least one) will have power available from the EDGs, therefore this scenario by definition makes an associated occurrence of a loss of ultimate heat sink (LUHS) for either unit implausible.

The NRC staff reviewed the information above, and agrees that the licensees assumption that refueling of the 275-gallon fuel tank operating the diesel driven fire pump will be delayed is conservative assumption. This is the case if the 275-gallon fuel tank is maintained at the minimum allowed operational level (50%), which provides 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of fire pump operation, compared to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for flood waters to recede to site grade such that the pump can be refueled.

If the fuel tank is filled to 100%, 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of fire pump operation is available prior to the tank needing to be refueled, allowing 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to refuel the tank once the flood waters recede to site grade. Dominion is proposing a procedural change to fill/verify the 275-gallon fuel tank to 100%

prior to flooding above site grade. As part of the audit discussions, Dominion indicated that this enhancement is expected to be completed before the end of calendar year 2020.

Because the licensee is not including the proposed procedure enhancement as a regulatory commitment, the NRC staff did not credit these changes as part of Dominions response strategy.

Instead, the NRC staff focused its review on the most challenging and conservative scenario, which is the postulated event where the fire water diesel pump providing EDG cooling runs out of fuel (only 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of operational capability). Under this postulated scenario, the licensee will rely

on FLEX strategies developed under Order EA-12-049 to maintain the KSFs for approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months until the flood waters recede, and then the fuel tank of the Fire Water Service System can be replenished, or until the service water pump can then be restored to service via an EDG (to which it will also provide cooling to the heat exchangers), or electrically-operated if offsite power was not lost, or has been restored after the storm surge event. Therefore, there may not be a need to continue using the fuel tank of the Fire Water Service System.

Based on the above information, it can be reasonably concluded that if Dominion implements the procedural enhancements (to allow 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of operational capability), there will be no need to replenish the fuel tanks until after the floodwaters have receded from the site therefore preventing a temporary loss of all AC power occurring at the site. Under the most conservative scenario of 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of fuel operational capability (without implementation of the procedural enhancement), it can also be concluded that Dominion has FLEX strategies available such that SG dryout is avoided, and the cooling function can be maintained. Relying on FLEX strategies allows Dominion to have additional operational capability until the diesel fuel tank can be replenished after the floodwaters have receded from the site.

Conclusion of Demonstration of Feasible Flood Protection for Unit 2 The NRC staff reviewed the information for Unit 2 and agrees that the licensee has a feasible response to address the low likelihood storm surge flood scenario. Furthermore, three enhancements are proposed by Dominion to the Millstone procedures:

Procedurally directing connection of the pre-staged BDB AFW pump discharge and suction hoses to the BDB FLEX AFW and CST connections, respectively, when the unit is shutdown to hot standby conditions, and opening the FLEX connections' isolation valves if excessive flood water is filling the condenser pit, Maintaining the SGs levels at the maximum value in their level range when the plant is in hot standby, and Adding steps to MPS Procedure AOP 2560 in order to ensure that the fire water pump diesel fuel tank level is at maximum level when a hurricane warning is issued.

These enhancements to the procedures were not credited by the NRC staff given that they were not included as regulatory commitments. The NRC staff evaluated the sites capability to cope without these enhancements and concludes that the licensee has a feasible response to the low likelihood event. The procedure enhancements, if incorporated as described, are expected to provide further margin and operational flexibility at the site.

3.3.5 Unit 3 - Effective Flood Protection for High Likelihood Events In the IA, the licensee stated that the maximum CDB/CLB flood level at the power block (19.7 ft.

MSL stillwater + 4.1 ft. wave runup = 23.8 ft. MSL) bounds the high likelihood reevaluated storm surge flood level (17.7 ft. MSL stillwater + 4.5 ft. wave runup = 22.2 ft. MSL). In addition, the nominal site grade at the power block of Unit 3 is 24 ft. MSL and the elevation of the access openings in the safety-related structures at the powerblock are located at 24.5 ft. MSL or higher, therefore, the licensee concluded in the IA that the power block key SSCs are flood protected from the high likelihood reevaluated storm surge hazard event.

With regard to the Unit 3 Intake Structure, the storm surge water elevation inside the Intake Structure calculated in the IA is 17.1 ft MSL stillwater and 30.2 ft. MSL with wave/runup, as also described in Table 3.3.2-1 of this staff assessment. The licensee stated in the IA that the safety-related service water pumps and associated equipment are the only key SSCs located within the Intake Structure. The service water pumps are located in the watertight service water pump rooms that are flood protected to 25.5 ft. MSL by the elevation of the waterstop in the pump rooms' 2 ft. thick concrete walls. Other penetrations in the service water pump rooms are located at or above elevation 31 ft. MSL, (i.e., above the significant reflected wave crest elevation).

To address the potential impacts of the standing wave inside the Intake Structure (30.2 ft. MSL) against the maximum flood protection of the service water pump room (25.5 ft. MSL), the licensee performed an evaluation and documented the results in Dominion (Zachry) Calculation, NAl-1996-002, Revision 2, MP3 Intake Structure Service Water Pump Room Available Physical Margin During Beyond Design Basis Inundation. The licensee concluded in NAl-1996-002 that the standing wave would be present for a limited duration during the peak storm surge, and that there are no pathways that would allow water into the service water pump rooms during a combined effects storm surge flooding event, and any in-leakage above the waterstop would be negligible. Based on this determination, the licensee concluded that the service water pumps at Unit 3 are flood protected against the high likelihood flooding event.

As a result of the above, the licensee concluded that Millstone, Unit 3 has effective protection against the high likelihood events. Additional details regarding the licensees analysis and the NRCs staffs evaluation are presented below.

NRC Review of Effective Flood Protection for Unit 3 In general, the response at Millstone, Unit 3 against a hurricane event (precursor to the reevaluated storm surge) is primarily described in site procedures:

AOP 3569, Severe Weather Conditions, and C-OP-200.6 Revision 8, Storms and Other Hazardous Phenomena.

Based on the information reviewed in the FSAR, the IA, and supporting documentation, the NRC staff agrees that the site grade at Millstone ,Unit 3 (24 ft. MSL) provides effective flood protection against the high likelihood reevaluated storm surge hazard (22.2 ft. MSL) that is reliable and has available physical margin.

With regard to the Intake Structure, the NRC staff sampled site calculation NAl-1996-002 as part of the IA review. This calculation described the service water pump rooms, and notes that at Unit 3 they are located at elevation 14.5 ft. and each room is separated from the rest of the intake building by 2 ft. thick concrete walls that span floor to ceiling. The walls contain an internal waterstop up to elevation 25.5 ft. and are reinforced with rebar.

The licensee determined in NAl-1996-002, Revision 0, that the internal water level for the Intake Structure at Unit 3 is 28.1 ft. MSL. Assuming that the internal water level is equal to the stillwater level plus significant wave height gives a maximum internal water level of 30.2 ft. MSL for the Revision 1 combined effects data. Even though this level is 2.1 ft. higher than the Revision 0 water level, it does not invalidate the Revision 0 conclusions, as this water level is still below the elevations of penetrations identified in the Revision 0 analysis.

To evaluate the hydrostatic, hydrodynamic and debris loading on the intake structure, the licensee described in the IA that the supported internal water level at Unit 3 is a function of the wave height, period, and pressure differences inside and outside of the building. Due to pressure balancing between the external and internal parts of the building, the internal water level would typically balance out below the 28.1 ft significant wave height. The significant wave height was calculated to be 28.1 ft. MSL in Zachry Calculation 15-164, Rev. 1, Refined Hydrodynamic, Wave, and Debris Loading at Millstone Power Station.

The NRC staff notes that the significant wave height of 28.1 ft. MSL is approximately 2.1 ft. below the maximum total water level calculated for the high likelihood scenario inside the Intake Structure. In the supplements to the ISR letter and staff assessment, the NRC staff had previously concluded that the licensee's reevaluated storm surge flood hazard information was determined using conservative inputs, assumptions, and/or methods, and is a suitable input for other assessments such as the IA submittal. As previously described, this flood hazard was not revised in the IA and was therefore not re-reviewed in the IA by the NRC staff.

The licensee further described in the IA that the peak stillwater level and significant wave height analyzed of 28.1 ft. MSL are only maintained for under an hour before receding. If water rose internally to the 28.1 ft elevation and encompassed an unnoticed crack above the top of the waterstop, the combination of limited pressure head, limited submerged time, paint sealing the crack, roughness of concrete, thickness of the wall, and height of the crack would ensure that any amount of water that managed to pass through the wall would be negligible and in the form of weepage. Therefore, the licensee concluded in the IA that it is highly unlikely that there would be any accumulation of water capable of impacting safety-related equipment in the service water pump rooms due to water passing through cracks above the waterstop.

Under this postulated scenario, the NRC staff agrees that the inherent conservatisms included in the storm surge analysis, coupled with the short duration of the event and the robustness of the Unit 3 Intake Structure is reasonably expected to provide effective flood protection to the Unit 3 service water pumps. Furthermore, only a minimal amount of weepage is expected to be negligible and not significantly impact the service water pumps. This elevation would not exceed the minimum 31 ft. MSL elevation of some of the existing electrical penetrations in the north and south walls of the service water pump rooms which are unsealed. In the event of a loss of offsite power, the Unit 3 KSF of decay heat removal will be accomplished by the service water pumps (receiving power from an EDG). No other SSCs that provides KSFs are impacted at Millstone Unit 3.

Conclusion of Demonstration of Effective Flood Protection for Unit 3 As a result of the above information, the NRC staff concludes that the licensee has demonstrated having effective flood protection for the high likelihood scenario at Millstone, Unit 3 that is reliable, maintained, and has APM such that the site is reasonably protected against the storm surge reevaluated flood hazard event.

3.3.6 Unit 3 - Feasible Mitigation for Low Likelihood Events In its IA, the licensee stated that reevaluated total water level along the west wall of the Unit 3 Turbine Building was 24.1 ft. MSL, which exceeds the CDB/CLB total water level of 23.8 ft. MSL.

However, the Unit 3 nominal site grade elevation is 24 ft. MSL at the power block, and access openings to safety-related structures and facilities, except the service water pump rooms in the

intake structure, are at elevation 24.5 ft. MSL or greater. Therefore, the main site/power block area of MPS3 is protected by the existing site grade and safety-related structure access openings from stillwater and wave actions.

With regard to the Intake Structure, the licensee stated in the IA that the reevaluated stillwater level is bounded by the CDB/CLB (19.6 ft. MSL and 19.7 ft. MSL, respectively), but not the total water elevation. The total water elevation of 48 ft. MSL exceeds the CDB/CLB level of 41.2 ft.

MSL. Similar to Unit 2, the safety-related service water pumps are the only SSCs located in the Unit 3 Intake Structure that provide the KSF of decay heat removal. In site calculation NAl-1996-002, Revision 2, MP3 Intake Structure Intake, Dominion conservatively assumed a reevaluated storm surge significant reflected wave crest elevation of 31.7 ft. MSL within the Intake Structure. The significant wave inside the Intake Structure is a function of the wave height, period, and pressure differences inside and outside of the building. Due to pressure balancing between the external and internal parts of the building, the reflected wave crest elevation is 31.7 ft. MSL and this elevation could exist inside the Intake Structure and external to the service water pump rooms, for the limited duration of the peak storm surge. This elevation would exceed the minimum 31 ft. MSL elevation of some of the existing electrical penetrations in the north and south walls of the service water pump rooms which are unsealed.

In addition to the standing wave inside the Intake Structure, the wave runup elevation at the exterior of the intake structure (48 ft. MSL) exceeds the elevation of the seaward wall parapet (42.0 ft. MSL) and the lowest elevation (44.3 ft. MSL) of the openings for the ventilation intakes and exhausts on the roof (top of roof elevation is 39 ft. MSL). Therefore, the licensee concluded that some of the overtopping volume could enter the service water pump rooms through the ventilation intakes and exhausts via splashing and spray. As a result of the above information, the licensee concluded in its IA that the low likelihood reevaluated storm surge will inundate the service water pumps, motors and associated equipment, resulting in the loss of the service water KSF.

NRC Review of Feasible Flood Protection for Unit 3 At Millstone, Unit 3, the loss of the service water pumps results in the loss of decay heat removal capability given the intended function of the Service Water System, which has been described in Section 3.3.3 of this staff assessment. In its IA, the licensee addressed the sites capability to cope with the loss of service water against the different KSFs at the site. In summary:

Loss of emergency power provided by the EDGs - Alternate emergency power is available using the SBO diesel generator, which is located in the Unit 3 power block and flood protected by the nominal site grade elevation (24 ft. MSL) and by the floor elevations of the enclosures for the SBO diesel equipment (greater or equal than 26 ft. MSL). The SBO diesel generator is not safety-related but is designed for hurricane force winds. Therefore, since the SBO diesel generator has effective flood protection, it is assumed to be available to provide emergency power to the KSFs required in this scenario.

Loss of Spent Fuel Pool (SFP) Cooling - Alternate SFP cooling is available using SFP inventory makeup from the site Fire Water header in accordance with EOP 3505A. More than sufficient time is available to initiate alternate SFP cooling, because with the maximum expected SFP heat load, the SFP will begin to boil in approximately 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months and boil off to a level 10 ft. above top of fuel in 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months after loss of SFP cooling.

Adequate cooling of the spent fuel is assured with water level at or above 10 ft.

Loss of Charging Pump Cooling, which results in loss of charging (i.e. RCS injection) -

Alternate charging pump cooling is available using fire water aligned in accordance with AOP 3560, Attachment B. More than sufficient time is available after loss of normal charging to restore charging (initiate alternate charging pump cooling) because RCS inventory makeup to prevent loss of natural circulation is not required for 20.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Loss of Reactor Plant Component Cooling (RPCC), which results in loss of the following:

o Loss of MCC/Rod Control Air Conditioning Units (ACUs). With the unit shutdown the MCC/Rod Control ACUs are not required for at least 4 - 5 days at which time FLEX strategies are available for Containment cooling.

o Loss of Safety Injection Pump Cooling. Alternate safety injection pump cooling is available using fire water or domestic water aligned in accordance with AOP 3560, Attachment D. Alternate safety injection pump cooling is required only in Mode 6 for Shutdown Cooling.

o Loss of the Control Building Chiller Heat Exchanger, which results in loss of the Control Building Chiller. Compensatory measures are available for loss of the Control Building chiller.

o Loss of RHR / RCS Inventory (KSF for Shutdown Cooling). Alternate reactor decay heat removal is available using SG ADVs and AFW, if unit is in Mode 5; or a safety injection pump to make up RCS from the RWST, if unit is in Mode 6 in accordance with EOP 3505.

In its IA, the licensee also stated that the alternate means for accomplishing the required KSFs listed above are all performed inside structures located in the Unit 3 power block and thus not impacted by the 10-5 AEP storm surge flood levels or associated wind speeds.

The NRC staff reviewed the information above and agrees that the licensee adequately considered and established anticipatory and remedial actions to the low likelihood storm surge event that are not expected to be impacted by adverse environmental conditions, given that they will either be performed well in advance of the floodwaters arriving onsite; or inside structures within the Unit 3 powerblock that are not impacted by floodwaters. The adequacy of the flood protection response for the low likelihood storm surge event is also demonstrated by relying on flood protection barriers that are part of the CDB, and are therefore maintained and tracked in a controlled manner, and are determined to be available and reliable at all times. The NRC staff also agrees that the sites capability to cope with the loss of service water against the different KSFs at the site is further demonstrated by having established proceduralized actions that are controlled, and maintained in accordance with site procedures. This results in an overall coping strategy that is reliable and expected to result in key SSCs performing their intended function at the site.

In its IA, the licensee also described that site calculation 19-007, Rev. 0, Combined Effects Flood Analysis for Storm Surge Annual Exceedance Probability lE-5 for Millstone Power Station concluded that the duration of significant flooding (stillwater and wave runup) around the Intake Structure was approximately 8 to 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . Wind speeds associated with the combined effects with 10-5 AEP probabilistic storm surge flood hazard persist at greater or equal to 50 MPH for approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the peak storm surge stillwater level occurs. This results in the Millstone station personnel being able to perform outdoor activities around 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the peak stillwater level is reached, which is approximately when loss of service water would occur.

The NRC staff reviewed the information above and compared it against the available time for each KSF activity described in the licensees strategy to cope with the loss of service water. The alternate means for accomplishing the required loss of service water functions listed above are all performed inside structures located in the power block and thus not impacted by the low likelihood storm surge flood levels or associated wind speeds. Since the power block would not be inundated, the FLEX strategies are available as defense-in-depth to provide any or all of the FLEX safety functions within the time requirements of the FLEX strategy timeline. Given the relatively short duration of the peak water elevation and the 8-9 hours needed for the floodwaters to recede from around the Intake Structure, the staff finds it reasonable to assume that the licensee has sufficient margin to implement FLEX strategies at the site using installed (and portable) equipment.

The margin between the recession time and the FLEX strategies activities, in addition to the likelihood that the licensee can restore the service water pumps in around 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , provides reasonable assurance that the decay heat removal function can be restored, and maintained at Millstone, Unit 3. If the service water pumps cannot be restored, the licensee also discussed the additional capabilities provided by the FLEX Phase 3 strategy at Millstone. Specifically, the Phase 3 strategy to establish an alternate service water can be initiated shortly after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from the beginning of the event, when the Phase 3 equipment (including the low pressure/high capacity pump) are delivered to the site from the National Strategic Alliance for FLEX Emergency Response (SAFER) Center. Finally, the licensee stated in its IA that since the power block would not be inundated, the FLEX strategies are available as defense-in-depth to provide any or all of the FLEX KSFs within the time requirements of the FLEX strategy time line, if the emergency power distribution system is assumed to be unavailable due to a postulated failure of the SBO diesel generator (i.e., a postulated ELAP).

3.3.7 Conclusion on the Storm Surge Hazard Event The NRC staff has reviewed the Millstone IA, supporting electronic files, and supporting calculation packages. The staff has found that the licensee has adequately characterized the relevant flood parameters at the site, described the key SSCs impacted by the storm surge event, and has provided a proposed mitigation strategy that is reliable. The proposed mitigation strategy has effective flood protection with adequate APM, and considered the reliability of the mitigation equipment and the TSAs required to successfully implement the strategy. This determination is supported by:

The low probability of the event, as described in Section 3.3.2; The anticipatory actions that provide effective flood protection and the reactive actions that provide reliable flood mitigation, as described in Sections 3.3.3, 3.3.4, 3.3.5 and 3.3.6; and As a result, the NRC staff concludes that the flood response to the storm surge event is considered to be adequate, and provides reasonable assurance that key SSCs that provide KSFs will continue to perform their intended function for the duration of the event.

4.0 SENIOR MANAGEMENT REVIEW PANEL In accordance with the March 2, 2020, Phase 2 decisionmaking memo, the staff presented the results of the review with the recommendation that the storm surge flood mechanism at Millstone be treated as a Group 1 hazard to the SMRP. The staff notes that only the storm surge

flood-causing mechanism was in the scope of the SMRP and was evaluated as part of the IA. All other hazards were evaluated under the focused evaluation process described in NEI 16-05. The SMRP members provided input to the technical team related to the Path 5 storm surge flood hazard. The SMRP approved the staffs recommendation that the storm surge flood hazard should be classified as a Group 1 hazard, meaning that no further response or regulatory action is required.

5.0 AUDIT REPORT The NRC staff previously issued a generic audit plan dated July 18, 2017 (ADAMS Accession No. ML17192A452), that described the NRC staff's intention to conduct audits related to IAs and issue an audit report that summarizes and documents the NRC's regulatory audit of the licensee's IA. The NRC staff activities have been limited to performing the reviews described above including the audit of calculation packages and procedures that supported the licensees submittal. The staff determined that the information provided during the audit process served to verify statements that the licensee made in its FE/IA submittal. All references, drawings and/or calculation packages reviewed as part of the audit were found only to expand upon and clarify the information already provided on the docket, and so are not docketed or cited. Because this staff assessment appropriately summarizes the results of the documents that the staff audited, the NRC staff concludes that a separate audit report is not necessary, and that this document serves as the final audit report described in the July 18, 2017, letter.

6.0 CONCLUSION

The NRC staff has concluded that the licensee has adequately demonstrated that effective flood protection, if appropriately implemented, exists for the LIP and tsunami events. For the storm surge flood mechanism, the staff also agrees that the licensee has an effective protection strategy for the higher likelihood floods, and a reliable mitigation strategy for lower likelihood floods up at both units.

Based on the above, in accordance with Phase 2 of the process outlined in the 50.54(f) letter, the NRC staff concludes that additional regulatory actions associated with the reevaluated storm surge flood hazard, are not warranted at Millstone. Finally, the NRC staff notes that the licensee has satisfactorily completed providing responses to the 50.54(f) activities associated with the reevaluated flood hazards.

Figure 3-1 Millstone Units 2 and 3 General Site Layout

ML20171A534 *via email OFFICE NRR/DORL/LPMB/PM NRR/DANU/UARL/LA* NRR/DORL/LPMB/BC* OGC - NLO*

NAME JUribe SLent DWrona BHarris DATE 6/18/2020 6/18/2020 7/15/2020 7/24/2020 OFFICE NRR/DORL/DD* NRR/DRA/D* NRR/DEX/DD* NRR/DORL/DD(A)*

NAME MShams MFranovich JMarshall DWrona DATE 7/18/2020 8/7/2020 7/29/2020 8/13/2020

v t e Letter Sequence Other
EPID:L-2020-JLD-0000, Response to March 12, Request for Information Enclosure 2, Recommendation 2.1, Flooding Focused Evaluation/Integrated Assessment Submittal (Open)
Initiation Request Acceptance... Administration Questions Answers Results Approval... Other: ML20171A534
MONTHYEAR2020-02-10 [Table View]

ML20171A534