Text

Supplemental Information Letter to Adopt TSTF-505, Provide Risk- Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2 and 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems .
	ML23216A110
Person / Time
Site:	Nine Mile Point
Issue date:	08/04/2023
From:	David Gudger; Constellation Energy Generation
To:	; Office of Nuclear Reactor Regulation, Document Control Desk
References
	NMP1L3545
	Download: ML23216A110 (1)
	v • d • e

200 Exelon Way Kennett Square, PA 19348 www.constellation.com 10 CFR 50.90 10 CFR 50.69 10 CFR 50.36 NMP1L3545 August 4, 2023 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License No. DPR-63 NRC Docket No. 50-220

Subject:

Supplemental Information Letter for Nine Mile Point Nuclear Station, Unit 1, to Adopt TSTF-505, "Provide Risk- Informed Extended Completion Times - RITSTF Initiative 4b," Revision 2 and 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors."

References:

1. Letter from D. Gudger (Constellation Energy Generation, LLC) to U.S.

Nuclear Regulatory Commission, "License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, 'Provide Risk- Informed Extended Completion Times -

RITSTF Initiative 4b,' " dated December 15, 2022 (ML22349A108)

2. Letter from D. Gudger (Constellation Energy Generation, LLC) to U.S.

Nuclear Regulatory Commission, "Application to Adopt 10 CFR 50.69, 'Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors,' " dated December 15, 2022 (ML22349A521)

3. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Constellation Energy Generation, LLC), "NMP1 TSTF-505 and 50.69 Audit Plan," dated January 31, 2023 (ML23025A386)

4. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Constellation Energy Generation, LLC), "Nine Mile Point Unit 1 - TSTF-505 and 10 CFR 50.69 Audit Questions (EPIDs L-2022-LLA-0185 and L-2022-LLA-186)," dated April 28, 2023 (ML23118A388)

5. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Constellation Energy Generation, LLC), "Nine Mile Point Nuclear Station, Unit 1 - TSTF-505 and 10 CFR 50.69 Audit Questions (EPIDs L-2022-LLA-0185 and L-2022-LLA-186)," dated May 21, 2023 (ML23142A022)

U.S. Nuclear Regulatory Commission Supplemental Information Letter TSTF-505 and 10 CFR 50.69 Docket No. 50-220 August 4, 2023 Page 2

6. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Constellation Energy Generation, LLC), "Share file Observations on Response to Question 06 and 22," dated June 13, 2023 (ML23209A767)

7. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Constellation Energy Generation, LLC), "Draft Audit Results File," dated June 14, 2023 (ML23209A769)

8. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to M. Rossi (Constellation Energy Generation, LLC), "RE:

NMP1 Revised Responses for Audit Questions 17 and 19," dated July 11, 2023 (ML23205A241) [Follow-up NRC observations for Audit Questions 6.a, 6.b, and 6.c]

9. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to M. Rossi (Constellation Energy Generation, LLC), "RE:

NMP1 Revised Responses for Audit Questions 17 and 19," dated July 11, 2023 (ML23205A242) [Follow-up NRC observations for Audit Question 19]

10. Letter from R. Guzman (Senior Project Manager, U.S Nuclear Regulatory Commission) to M. Rossi (Constellation Energy Generation, LLC), "RE:

NMP1 Revised Responses for Audit Questions 17 and 19," dated July 19, 2023 (ML23205A243) [Follow-up NRC observations for Audit Question 18]

By letters dated December 15, 2022 (References 1 and 2), Constellation Energy Generation, LLC, (CEG) requested to change the Nine Mile Point Nuclear Station, Unit 1 (NMP1) Technical Specifications (TS). The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML17290B229) and adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors."

In a letter dated January 31, 2023 (Reference 3), the NRC requested a combined regulatory audit for the applications in References 1 and 2 to be held the week of June 12, 2023. The dates of the audit were June 13th and 14th. This letter included an audit plan and a list of documents to be made available to the NRC review staff via an online portal.

In letters dated April 28, 2023 (Reference 4) and May 22, 2023 (Reference 5), the NRC provided audit questions and requested responses to the questions to be uploaded to the online portal prior to the start of the regulatory audit. A total of 28 audit questions were provided.

References 6 through 10 document the NRC followup questions provided to CEG during the regulatory audit period.

As a result of the regulatory audit, this Supplemental Information Letter provides the responses to specific audit questions requested by the NRC to be placed on the NMP1 docket.

Attachments to this letter provide the NRC audit questions followed by the CEG responses.

U.S. Nuclear Regulatory Commission Supplemental Information Letter TSTF-505 and 10 CFR 50.69 Docket No. 50-220 August 4, 2023 Page 3 CEG has reviewed the information supporting a finding of no significant hazards consideration and the environmental consideration provided to the NRC in References 1 and 2. The supplemental information provided in this letter does not affect the bases for concluding that the proposed license amendments do not involve a significant hazards consideration. Furthermore, the supplemental information provided in this letter does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with this supplement.

There are no commitments contained in this response.

If you should have any questions regarding this submittal, please contact Ronnie.Reynolds@constellation.com.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 4th day of August 2023.

Respectfully, David T. Gudger Senior Manager, Licensing & Regulatory Affairs Constellation Energy Generation, LLC Attachments:

1. Supplemental Information: Responses to NRC Audit Questions

2. Supplemental Information: Revised Technical Specifications and Bases Markups

3. Supplemental Information: Revised Enclosure 1, "List of Revised Required Actions to Corresponding PRA Functions"

4. Supplemental Information: Revised Attachment 4, "Cross-Reference of TSTF-505 and Nine Mile Point, Unit 1, Technical Specifications"

5. Supplemental Information: Revised Attachment 5, "Information Supporting Instrumentation Redundancy and Diversity"

6. Supplemental Information: Revised Enclosure 4, Section 4, "Extreme Winds Analysis" cc: USNRC Region I Regional Administrator w/attachments USNRC Senior Resident Inspector - NMP "

USNRC Project Manager, NRR - NMP "

A. L. Peterson, NYSERDA "

B. Frymire, NYSPSC "

ATTACHMENT 1 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information: Responses to NRC Audit Questions Supplemental Information Letter Page 1 of 82 Responses to NRC Audit Questions Audit Question-01 (EEEB - RICT) - TS LCOs 3.6.3.b and 3.6.3.e.2 According to Table E1-1 of LAR Enclosure 1, corresponding to Technical Specification (TS) limiting condition for operation (LCO) 3.6.3.b (One required offsite circuit inoperable), structures, systems and components (SSCs) covered by the TS LCO condition are listed as "Lines 1/4." Elaborate on the meaning of "Lines 1/4."

Also, in Table E1-1, provide complete information for all columns corresponding to TS LCO 3.6.3.e.2 (Two required offsite circuits inoperable).

Constellation Response:

The description of Lines 1/4 from NMP1 UFSAR,Section IX, is as follows:

Power for Station startup, the reserve supply to the auxiliaries, and the normal supply to selected auxiliaries is obtained from the 115-kV bus. This bus is fed by two 115-kV transmission lines from remote generating stations. One line is from the South Oswego Steam Station (Line #1), approximately 12 miles away. The other line is from the Lighthouse Hill Station, approximately 26 mi away, through the J. A. FitzPatrick switchyard (Line #4). Both stations have other tie line connections into the Company statewide transmission system. Lighthouse Hill includes hydroelectric generators which have the capability of startup without power input from outside sources fed from Bennetts Bridge. Technical Specification 3.6.3.b for Emergency Power Sources allows either Line 1 OR Line 4 to be de-energized provided two diesel-generator power systems are operable. If either of these 115 kv external lines are de-energized, that line (Either Line 1 or Line 4) shall be returned to service within 7 days.

The following illustration is an excerpt from the Plant AC Station Power Distribution Drawing ID C-19409-C, Sheet 1B:

Attachment 1 Supplemental Information Letter Page 2 of 82 Responses to NRC Audit Questions Table E1-1 is revised to include the complete information for all columns corresponding to LCO 3.6.3.e.2. The revised portion of Table E1-1 is provided below. See Attachment 3 of this supplemental information letter for revised Table E-1.

Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.6.3.e.2 Two required offsite Line 1/4 Yes Supply AC loads One offsite Same SSCs are modeled circuits inoperable. during operation source consistent with the TS scope and so can be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

Supplemental Information Letter Page 3 of 82 Responses to NRC Audit Questions Audit Question-02 (EEEB/STSB - RICT) - TS LCO 3.6.2i According to page 8 of LAR Attachment 4 (Cross-Reference of TSTF-505 and NMP1 TS) corresponding to the TSTF-505 TS "Loss of Power (LOP) Instrumentation - one or more channels inoperable," the equivalent statement is in the NMP1 TS Table 3.6.2i, Note (1). According to the comments column for TS 3.6.2.i, Note (1), "No change" to incorporate RICT program is proposed because TS 3.6.2i, Note (1) does not have an associated Completion Time, and is excluded. However, the change to TS 3.6.2i is discussed further in other parts of the LAR (e.g., page 21 of Attachment 5; page E1-15, page E1-19, page E1-21 of Enclosure 1).

Explain or resolve the above apparent discrepancy regarding TS 3.6.2i, Note (1).

Constellation Response:

NMP1 TS Table 3.6.2i, Note (1), is not within the scope of TSTF-505, Revision 2, as described in Attachment 4 (Cross-Reference). The remaining discussions on TS 3.6.2i, Note (1), are removed as shown in Attachment 3 (Revised Enclosure 1) and Attachment 5 (Revised Redundancy and Diversity).

Audit Question-03 (STSB - RICT) - TS Markups a) Editorial: On TS page 54 of LAR Attachment 2 (Proposed Technical Specification Changes (Mark-Ups)), TS 3.1.4.c has the phrase insertion pointer in the wrong place.

b) On TS page 155 of LAR Attachment 2, the completion time for TS 3.3.6.c appears inconsistent with TSTF-505, Revision 2. The proposed change states, in part, "

the apparently malfunctioning vacuum breaker valve shall be exercised and pressure tested as specified in 3.3.6.b immediately and every 15 days thereafter or in accordance with the Risk Informed Completion Time Program until appropriate repairs have been completed." TSTF-505, Revision 2, Section 2.3, "Scope," details the RICT program exclusion criteria for required actions and completion times.

Exclusions 7 and 16, do not allow periodically performed or "immediate" completions times. Please provide justification for this variation or revise all mentions of TS 3.3.6.c in the LAR.

c) On TS page 213 of LAR Attachment 2, TS Table 3.6.2.b Note (g) is included in the RICT program. However, it is not discussed in the LAR Attachment 4 cross reference table or the LAR Enclosure 1, Table E1-1 list of required actions to corresponding PRA functions. Please provide justification for this change or resolve the inconsistency where TS Table 3.6.2.b Note (g) is mentioned in the LAR.

Constellation Response:

a) The text box arrow will be revised to point after the phrase "within 7 days." A revised markup is provided in Attachment 2 to this Supplemental Information Letter.

b) To maintain consistency with TSTF-505, Revision 2, the following sections will be revised:

Attachment 2, TS page 155 is removed from the scope.

Attachment 2, Bases page 157 is removed from the scope.

Supplemental Information Letter Page 4 of 82 Responses to NRC Audit Questions

Attachment 4, Revised Attachment 4, page 12 of 17 is revised to identify that RICT is not applicable for TS 3.3.6.c and that TSTF-505 changes are not incorporated.

Attachment 3, Revised Enclosure 1, Table E1-1, page E1-8 is revised to remove TS 3.3.6.c from the scope.

Attachment 3, Revised Enclosure 1, Table E1-2, is revised to remove TS 3.3.6.c from the example RICT calculations.

The above sections are revised to reflect this change and are provided in Attachments 2 through 4 of this Supplemental Information Letter.

c) The Markup of TS page 213, TS Table 3.6.2.b, Note (g), is not within the scope of the LAR and is therefore removed. The list of affected TS pages is revised to reflect this change and is provided in Attachment 2 to this Supplemental Information Letter.

Audit Question-04 (STSB - RICT) - License Condition What is the purpose of the proposed license condition in LAR Attachment 6? Is there an expectation that there will be probabilistic risk assessment related implementation items? The proposed license condition is as follows:

Adoption of Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extension Completion Times - RITSTF Initiative 4b."

CEG is approved to implement TSTF-505, Revision 2, modifying the Technical Specification requirements related to Completion Times (CT) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). The methodology for using the new Risk-Informed Completion Time Program is described in NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, which was approved by the NRC on May 17, 2007.

Constellation Response:

A License Condition is not required for the TSTF-505 application; therefore, Attachment 6 as shown in Reference 1 is no longer required.

Audit Question-05 was resolved during the regulatory audit.

Audit Question-06 (APLA - RICT) - Credit for FLEX Equipment and Actions NRC memorandum dated May 6, 20221 provides the NRCs staff updated assessment of identified challenges and strategies for incorporating Diverse and Flexible Mitigation Capability (FLEX) equipment into a probabilistic risk assessment (PRA) model in support of risk-informed decision-making in accordance with the guidance of RG 1.2002.

1 U.S. NRC memorandum, "Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments," dated May 6, 2022 (ADAMS Accession No. ML22014A084).

2 U.S. Nuclear Regulatory Commission, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," RG 1.200, Revision 3, December 2020 (ML20238B871).

Supplemental Information Letter Page 5 of 82 Responses to NRC Audit Questions With regards to equipment failure probability, in the memorandum dated May 6, 2022, the NRC staff states in Conclusion 4:

Licensees that choose not to use the generic failure probabilities in PWROG-18042 to develop plant-specific failure probabilities for portable FLEX equipment modeled in PRAs used for risk-informed applications should submit a justification for the methods and probabilities used to the NRC for review and approval.

It appears that NUREG-6928 fixed equipment failure rates (with a 2x increase) were used as probabilities for FLEX portable equipment. It is unclear to the NRC staff how the NMP1 approach satisfies the concerns of Conclusion 4.

With regards to the uncertainty related to equipment failure probabilities, in the updated NRC memorandum, the NRC staff states in Conclusion 8:

PWROG-18043, Revision 1, notes that there was insufficient data to quantify the failure to load probabilities for portable diesel generators due to lack of detailed data. To account for the uncertainty in the testing activities. licensees should ensure their preventive maintenance strategies include such testing and that the data reported provides this information. licensees should continue to assess the uncertainty in equipment failure rates and address or disposition it.

The NRC staff notes the results of a FLEX sensitivity study was provided by the licensee; however, it is unclear to the NRC staff if this sensitivity addresses the concerns of Conclusion 8.

For example, the licensees FLEX sensitivity study increased the FLEX maintenance unavailability factors by a factor of 10 (i.e., from 0.01 to 0.1). However, failure probability uncertainties associated with other FLEX failure modes may have a greater impact on risk (e.g.,

FLEX generator fails to run after first hour has a failure probability of 6.16E-2 in the licensees analysis and the uncertainty associated with this failure probability is likely to significantly increase the risk impact). The FLEX failure probabilities assumed in the licensees sensitivity study appears to be noticeably lower than that in PWROG-18042, which was approved by NRC (e.g., fail-to-start probability of the portable diesel-driven pump in PWROG-18042 is a factor of 17 higher than that assumed in the licensees sensitivity study). The results from the FLEX sensitivity study demonstrate a change of 28.8% in core damage frequency (CDF) value, which seems to indicate that FLEX failure probabilities are a key source of uncertainty. Also, the sensitivity study does not appear to address the impact of this uncertainty on the risk-informed completion time (RICT) calculations.

With regards to human reliability analysis (HRA), in the memorandum dated May 6, 2022, the NRC staff states, in part, in Conclusion 11:

EPRI [Electric Power Research Institute] 3002013018 provides updated detailed industry guidance for estimating the human error probabilities (HEPs) of the actions needed to implement mitigating strategies using portable equipment. EPRI 3002013018 provides guidance that is acceptable to the NRC, with the clarifications below...

FLEX actions were developed by the licensee using the methodologies provided in EPRI 3002013018. However, it is unclear to the NRC staff how NMP1 analysis addressed the staff clarifications on the use of the EPRI guidance.

With regards to PRA upgrade, the NRC staff states in the updated NRC memorandum in Conclusion 2:

Therefore, Conclusion 2 remains unchanged [that] for any new risk-informed application that has incorporated mitigating strategiesthe licensee should either perform a Supplemental Information Letter Page 6 of 82 Responses to NRC Audit Questions focused-scope peer review of the PRA model or demonstrate [that it does not meet the three criteria of an PRA upgrade].

The NRC staff notes that the NMP1 PRA models appear to utilize updated industry guidance, and therefore, it is unclear whether the FLEX analysis is an PRA upgrade for NMP1.

Given these observations, address the following:

a) Describe the methodology used to assess the failure probabilities of any modeled equipment credited in the licensee's mitigating strategies (i.e., FLEX). The discussion should include a justification of the rationale for parameter values, and how the uncertainties associated with the parameter values are considered in the RICT calculations in accordance with ASME/ANS RA-Sa-20093, as endorsed by RG 1.200 (e.g., supporting requirements for HLR-DA-D). This justification should also disposition any significant differences between these FLEX parameter values and those generic failure probabilities in PWROG-18042.

-OR-Alternatively, propose a mechanism to incorporate into the NMP1 PRA models used for RICT calculations updated FLEX parameter values prior to implementing the RICT program.

b) Provide a discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include:

i. A summary of how the licensee evaluated the impact of the NRC clarifications in memorandum dated May 6, 2022, with regards to using the EPRI 3002013018 FLEX HRA methodology.

ii. Provide updated FLEX HRA results, if required, to address the NRC clarifications.

iii. Provide justification that the use of the EPRI FLEX HRA methodology does not meet the definition of an PRA upgrade as defined by RG 1.200.

Alternatively, if a justification is not provided, propose a mechanism to conduct a focused-scope peer review (FSPR) regarding incorporation of the EPRI FLEX HRA method for the NMP1 PRA models. Include in the mechanism to close out all F&Os that result from the FSPR prior to implementing the RMTS program.

c) Provide an updated assessment of the impact on risk values and uncertainty analysis provided in the LAR by FLEX equipment credited in NMP1's PRA models. This assessment should include, if required, any modifications to FLEX modeling based on the issues raised in this question. Include in this discussion:

(i) The impact of FLEX on any of the RICT values provided in Table E1-2 of the LAR and on the total baseline risk values provided in LAR Enclosure 5.

(ii) Discuss whether the uncertainty associated with FLEX modeling is a key source of uncertainty for the RMTS program.

3 American Society of Mechanical Engineers (ASME) and American Nuclear Society (ANS) PRA standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009, New York, NY (Copyright).

Supplemental Information Letter Page 7 of 82 Responses to NRC Audit Questions If this uncertainty is "key," then describe and provide a basis for how this uncertainty will be addressed in the RMTS program (e.g., programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty). If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09-A; and (2) provide RMA examples that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

Constellation Response:

a) A robust data set did not exist for FLEX equipment as of the freeze date for the most recent NMP1 periodic PRA update (12/31/2021). Therefore, for FLEX equipment failure rates, the NMP1 chose to assign double the failure rates of similar installed equipment.

In the case of portable generators, installed EDGs were chosen as the similar equipment. For portable pumps, installed diesel fire pumps were chosen as the similar equipment.

While somewhat arbitrary, this approach is judged reasonable because of the mechanical similarity of FLEX equipment to permanently installed equipment and the multiplication factor addresses potential failure modes related to transport that exist for portable equipment versus permanently installed equipment. That said, in the case of the installed EDGs, their rapid start requirements (i.e., 10 seconds to rated speed) may bias overall unreliability more than that of the portable generators which do not have such a harsh initiation regime.

Following the completion of the latest NMP1 PRA update, the NRC issued a memorandum regarding FLEX equipment4 which endorses PWROG FLEX equipment reliability data (PWROG-18042-NP). The PWROG dataset was reviewed, and Table 6a-1 provides a comparison for the NMP1 PRA.

4 U.S. NRC memorandum, Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments, dated May 6, 2022 (ADAMS Accession No. ML22014A084).

Supplemental Information Letter Page 8 of 82 Responses to NRC Audit Questions Table 6a Comparison of FLEX Equipment Failure Rate Estimates Equipment Failure Mode NMP1 PWROG- PWROG-18042-(Base Model) 18043-P NP (Rev. 1)

Failure to Start 5.41E-03 3.13E-02 4.35E-02 Failure to Run 7.44E-03 (1st hour) 3.51E-03/hr

1-EXP(-1.03E-2 Failure to Run after 2.68E-03/hr* 24 hr =

24) = 2.19E-01 Portable 1st hour 23 hr= 8.42E-2 Generator (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months ) 6.16E-02 Maintenance 1.00E-02 N/A N/A Unavailability Total Failure 8.45E-02 1.15E-01 2.63E-01 Probability Failure to Start 6.19E-03 1.65E-02 3.38E-02 Failure to Run 4.02E-03 (1st hour) 6.15E-03/hr

1.55E-02/hr*

Failure to Run after 5.95E-05/hr* 24 hr = 24 hr =

Portable 1st hour 23 hr= 1.48E-01 3.72E-01 Pump (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months ) 1.37E-03 Maintenance 1.0E-02 N/A N/A Unavailability Total Failure 2.16E-02 1.65E-01 4.06E-01 Probability NMP1 values are lower than both PWROG datasets and the applicability of these datasets has been considered. It was determined that there are significant downsides to direct adoption of the PWROG dataset.

The main downside is in the treatment of the failure to run for multiple hours. The PWROG dataset is informed by tests wherein the equipment is run for brief periods of time. When this data is reduced to a per hour basis and then multiplied by the mission time, overly conservative failure probabilities occur due to the compounded bias of failures which occur shortly after equipment start. Mechanically, a piece of equipment which starts and runs to the point of reaching stable operating conditions (generally in the first hour of operation) should continue to run with a higher reliability than that of the startup/warmup period. While noted in the PWROG document (Section 5.1 "Considering the short operating periods the FLEX equipment is typically run") the failure to explore and treat longer-term operational reliability is viewed as overly conservative. From Table 6a-1, a total failure probability of nearly 30% for portable generators and over 40% for portable pumps, driven largely by mission time multiplication effects, are difficult to imagine for professionally procured and commissioned industrial equipment in the United States.

In summary, while the NMP1 data treatment is not ideal, it has a rational basis involving similarity of equipment, and PWROG dataset issues, generally involving excessive conservatism, suggest that the PWROG dataset is not an obviously better choice.

The significance of these considerations on the NMP1 RICT program is addressed in more detail in the response to question 6c, below.

Supplemental Information Letter Page 9 of 82 Responses to NRC Audit Questions b)i As part of the 2021 PRA update, the FLEX HRA modeling techniques documented in EPRI 30020130185 were employed in the update of the NMP1 FLEX HRA human failure event (HFE) evaluations. The FLEX update work was performed before the release of the May 6, 2022 NRC Memo "Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments", hence, the NMP1 FLEX evaluations were not developed to address the NRC clarifications on the use of EPRI 3002013018 in FLEX HRA.

In order identify and evaluate the impacts of the NRC clarifications on the NMP1 FLEX action evaluations, specifically conclusions 11, 12, and 13, each of the HRA-specific clarifications has been listed in Table 6b-1 along with a disposition of the comment relative to the NMP1 FLEX HRA evaluations.

5 Human Reliability Analysis (HRA) for Diverse and Flexible Mitigation Strategies (FLEX) and Use of Portable Equipment: Examples and Guidance. EPRI, Palo Alto, CA: 2018. 3002013018.

Supplemental Information Letter Page 10 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo HRA - CONCLUSION 11: The Issue 1: Until additional industry Issue 1: Section 2.3.3.2.3 of EPRI 3002013018, which provides staff finds that using surrogates guidance (on assessing the impact of example techniques for performing detailed HRA on FLEX for specific actions or extreme external events on FLEX actions, states:

engineering judgement to actions) is provided that is consistent with estimate the failure probability the guidance in RG 1.200, a justification The general guidance for modeling human actions in external do not adequately address the for quantitative credit for the use of hazards using the EPRI HRA methodology is described in elements needed for a portable equipment in an extreme NUREG-19216 for fire and EPRI 3002008093 (Reference 3) for technically acceptable HRA as external event in PRAs used for risk- seismic. EPRI 3002008093 can be used generally for other described in the ASME/ANS informed applications should be external hazards, however, future work will be done on hazard-PRA Standard (e.g., the impact submitted to the NRC for review and specific guidance for hazards which involve environmental of the environment under which approval. exposure issues (e.g., external flood, high winds, etc.).

the operators work). Until gaps in the human reliability analysis The implication is that the NUREG-1921 guidance for modeling methodologies are addressed FLEX actions in internal fire events is adequate, and these by improved industry guidance, techniques were used in adaptation of the NMP1 FLEX actions HEPs associated with actions for the Fire PRA. The other external hazards are not quantified for which the existing with detailed models; therefore, this question is not applicable to approaches are not explicitly the evaluations for those hazards.

applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

Issue 2: Surrogate HEPs A, B, and C A summary of the use of surrogate failure data used in the developed in EPRI 3002013018 for NMP1 FLEX action evaluations has been provided below in human tasks not included in NUREG/CR- addition to a self- assessment of whether additional NRC review 12787 may be used without additional is expected to be required:

NRC review IF they are applicable to the analyzed plant; however, any other ZFX02_FXOPERATOR: Operator Fails to Deploy and Start proposed surrogates necessary to credit FLEX Generator (ELAP) (Execution Only) 6 EPRI/NRC-RES Fire Human Reliability Analysis Guidelines - Final Report, U.S. Nuclear Regulatory Commission, Rockville, MD and the Electric Power Research Institute (EPRI),

Palo Alto, CA: July 2012. NUREG-1921, EPRI 1023001.

7 Swain, A.D., Guttmann, H.E., Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, August 1983.

Supplemental Information Letter Page 11 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo mitigating strategies in a licensees PRA

Uses Surrogate A (transportation of portable equipment) for use in risk-informed applications modified to address the milage in NMP1s deployment should be submitted for NRA review and route and number of trips required for the trailer. No approval. significant change to the Surrogate A development and additional review is not expected to be required.

ZFX03_FXOPERATOR: Operator Fails to Deploy and Start FLEX Generator (ELAP) (OLS=F)

This action is the same as ZFX02_FXOPERATOR except that the DC load shed action has failed. The same surrogate HEP is used and the same conclusion is applicable.

ZFX04_FXOPERATOR: Operator Fails to Deploy FLEX Pump (ELAP)

Uses Surrogate A (transportation of portable equipment) modified to address the milage in NMP1s deployment route and number of trips required for the trailer. No significant change to the Surrogate A development and additional review is not expected to be required.

Uses Surrogate B (connecting temporary hoses). No significant change to the Surrogate B development for making Storz hose connections was made and additional review is not expected to be required.

Uses Surrogate C (validation of portable pump operability). For NMP1, the characteristics of pump use are essentially the same as for the EPRI 30020080938 example and no additional review is expected to be required.

Uses a new surrogate value for making threaded hose connections (rather then the Storz connections from Surrogate B). While highly similar to Surrogate B, the surrogate basis is new and has been provided as part of 8

An Approach to Human Reliability Analysis for External Events with a Focus on Seismic. EPRI, Palo Alto, CA: 2016. 3002008093.

Supplemental Information Letter Page 12 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo this response (See Note 1, included following this table) for NRC review.

ZFX05_FXOPERATOR: Operators Fail to Initiate Injection with the FLEX Pump

Uses a new surrogate value for making threaded hose connections (same as ZFX04_FXOPERATOR).

ZFX06_FXOPERATOR: Op Fails to Connect and Start FLEX Pump for EC Makeup (ELAP, EXE-ONLY)

Uses Surrogate B (connecting temporary hoses). No significant change to the Surrogate B development for making Storz hose connections was made and additional review is not expected to be required.

Uses a new surrogate value for making threaded hose connections (same as ZFX04_FXOPERATOR).

Issue 3: EPRI 3002013018 does not No significant changes between the transportation tasks provide guidance on calculating HEPs for described in the NMP1 FLEX Strategy Validation document 9 and connecting/disconnecting trailers or the procedures used1011 in the evaluations for loading/unloading equipment based on ZFX02_FXOPERATOR, ZFX03_FXOPERATOR, or characteristics that are specific to the ZFX04_FXOPERATOR were identified.

sample plants tasks. Licensees should confirm there have not been changes to Further, for the NMP1 FLEX actions, the pump and generator the mitigating strategies since the are integral to the trailers, as in the EPRI 3002013018 example, feasibility analysis was performed and, if and no loading or unloading errors are applicable. Similarly, applicable, document the basis for drops of other supporting components, such as electrical cable excluding such tasks. and temporary hoses, were considered to be possible, but that critical damage to such components in the event of a drop would be negligible and damage due to equipment drops when loading a trailer were excluded from quantitative evaluation. Regarding failures to connect the trailers properly, transportation of the 9

Nine Mile Point Unit 1, "FLEX Strategy Validation".

10 N1-DRP-FLEX-ELEC, "Emergency Damage Repair - BDB/FLEX Generator Deployment Strategy, " Revision 00400.

11 N1-DRP-FLEX-MECH, "EMERGENCY DAMAGE REPAIR - BDB/FLEX PUMP DEPLOYMENT STRATEGY", Revision. 00900.

Supplemental Information Letter Page 13 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo trailers occurs at low speed such that detachment of the trailer is not expected to cause significant damage to the equipment.

Hence, this failure mode was considered to be non-critical and it was excluded, as it was in the EPRI 3002013018 example.

No additional review by the NRC is expected to be required.

Issue 4: For portable equipment refueling, For NMP1, there is a person assigned to monitor the FLEX if f there are no personnel available to diesel driven equipment, there are clear procedures governing monitor the fuel level or there are no clear the refueling action, and the action meets the refueling pre-defined procedures or plans directing screening guidance in EPRI 3002013018 and EPRI Knowledge refueling, the licensee should submit a Base Article 2021-007. The refueling action screening justification for the modeling approach evaluation is documented in the HRA Notebook.

used to the NRC for review and approval.

If there are personnel available to monitor No additional review by the NRC is expected to be required.

fuel level and there are clear refueling procedures, the EPRI 3002013018 guidance may be used in conjunction with EPRI Knowledge Base Article 2021-007 to evaluate/screen the refueling actions.

Issue 5: If the DC Load Shed action uses The NMP1 DC Load Shed action (ZOLS1_OLS_OPERAT) does the 0.5 self-check recovery, the not include credit for the self-check recovery.

evaluation should be submitted to the NRC for review and approval. No additional review by the NRC is expected to be required.

HRA - CONCLUSION 12: If Issue 1: For ELAP events, a plant- For NMP1, the declaration of ELAP action is evaluated using the procedures for initiating specific evaluation should be performed EPRI 3002013018 techniques and an evaluation was performed mitigating strategies are not to determine whether the cognitive to determine whether or not any significant cognitive work was explicit and the associated element should be included in the human required to initiate the deployment of the portable equipment.

failure probabilities are not reliability evaluation of the operator directly analyzed by accepted actions to deploy portable FLEX For NMP1, the portable generator deployment action does not approaches, technical bases for equipment. require significant cognitive work when the SBO procedure has probability of failure to initiate been entered and load shed has been performed successfully and HFE ZFX02_FXOPERATOR Operator Fails to Deploy and Supplemental Information Letter Page 14 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo mitigating strategies should be If the decision to initiate mitigating Start FLEX Generator (ELAP) (Execution Only) does not submitted to NRC for review. strategies (declare ELAP) is not modeled include a cognitive failure element.

in the PRA, the technical basis for the rationale used to exclude the decision For cases when load shed is not initiated in a timely manner should be submitted to the NRC for (i.e., it fails), the sequence definition does not include a review and approval. successful diagnosis of SBO conditions requiring FLEX equipment deployment and HFE ZFX03_FXOPERATOR Operator Fails to Deploy and Start FLEX Generator (ELAP)

(OLS=F) does include an evaluation of the cognitive element related to the initiation of generator deployment.

FLEX pump deployment, which is modeled in HFE ZFX04_FXOPERATOR Operator Fails to Deploy FLEX Pump (ELAP), does require the diagnosis of Fire Water System failure to initiate timely deployment and it does include a cognitive element related to the initiation of pump deployment.

No additional review by the NRC is expected to be required.

Issue 2: If FLEX mitigating strategies are The NMP1 PRA does credit FLEX strategies for non-ELAP credited in the PRA for events other than scenarios, including use of the portable pump for RPV makeup ELAP (such as for maintenance or other in long term (post containment challenge) scenarios and use of equipment failures), procedures must the FLEX pump to provide long term makeup to the shell side of explicitly indicate when and how to the emergency condensers.

implement mitigating strategies for the additional events. If no explicit For RPV makeup, the EOPs (e.g., N1-EOP-RPV (1-2), Detail procedures exist to initiate the mitigating E2) list the FLEX pumps as a potentially available alternate RPV strategies, the technical basis for the injection source in the same way that other systems are listed, probability of failure should be submitted such as Fire Water. As identified above, the sequences that to the NRC for review and approval. include use of the FLEX pump are scenarios in which many hours are available to identify the conditions that would require deployment of the FLEX pump and while the EOPs do not include explicit guidance dictating when pump deployment must begin, the supporting procedures provide information about the time requirements for FLEX pump deployment and direct the Supplemental Information Letter Page 15 of 82 Responses to NRC Audit Questions Table 6b-1 Status of NRC Clarifications Conclusion from 2017 2021 Updates (summary) Disposition for NMP1 HRA Memo Units supervisors at each Nine Mile Point unit to confer with each other to determine the priorities for implementation.

For use of the FLEX pump for emergency condenser shell side makeup for non-ELAP transients and very small LOCAs as well as for post core damage sequences the operators must enter the FLEX procedures based on plant functional cues. Procedure N1-DRP-FLEX-MECH has explicit guidance for implementing this strategy.

HRA - CONCLUSION 13: Until Issue 1: The licensee should ensure that The NMP1 URE (PRA Model Change) database has been acceptable guidance is provided any changes made to the FLEX reviewed and no changes to the FLEX strategies have been for identifying and assessing implementation plans, since original identified.

unique aspects of pre-initiator implementation, are thoroughly reviewed human failure events for for their impacts on HRA, including pre-mitigating strategies, the staff initiators.

may request additional information regarding assessment of those human failure events.

Issue 2: The licensee should ensure The NMP1 FLEX model does not include pre-initiators for FLEX.

battery failures are appropriately The PRA also does not credit proceduralized use of jump-considered in the pre-initiator assessment starting from other FLEX equipment. This capability is judged to if not included in equipment failure rates. offset potential battery charging pre-initiators. Finally, the preventative maintenance and corrective action programs should minimize such failure modes.

Issue 3: Regarding PRA upgrade - If the The FLEX pre-initiator review was performed in the same pre-initiator assessment is performed in manner as the other credited HFEs.

the same way as for the peer reviewed PRA, the assessment for mitigating The inclusion of the FLEX equipment in the pre-initiator analysis strategies would not be considered a does not represent a PRA upgrade.

PRA upgrade.

Supplemental Information Letter Page 16 of 82 Responses to NRC Audit Questions Table 6b-1 Note 1: Regarding treatment for Connecting Threaded Fluid Lines:

Making connections to plant piping (e.g., installing a threaded connector on a pipe flange) and connecting hoses using threaded connections is required as part of the implementation of the FLEX strategies. In general, this requires the operator to identify the connection points and to make a water-tight connection by ensuring the connections are properly tightened. Potential failure modes include:

-Selection of incorrect connection point

-Under or over tightening the connections (leading to leakage or disassembly)

For the incorrect selection of a connection point, the characteristics of the selection task are very similar to identifying a local valve: 1) the connection points are labeled in the same way as local valves, 2) the connection points are located on local plant piping outside of the MCR, 3) the connection points may be grouped in banks with other connection points similar to a valve gallery, 4) the connections vary in size. In addition, the connection point is often located with a nearby isolation valve, which may also be used to identify the connection point. For these reasons, the use of the THERP Table 20-13 data for local valve selection is considered to be a reasonable substitute for selection of a temporary hose connection point. For connecting threaded connection onto temporary hoses, the selection error is considered to be negligible given that the hoses are put into place for the specific purpose of the task and the task could not proceed if the connection was not in place (self-recovering error).

For improper tightening, Reference 5 indicates that the basic error rate for this task is 1.04E-4 per opportunity (item "T", "Torque "uid lines - incorrectly torqued" in Table 1 of Reference 5), which has been rounded to 1.0E-4 for this evaluation and is assumed to be a mean value given that the values are multiplied in the Adjusted Error Rate calculations in Reference 5 (as only mean values can be).

Because the HRAC does not provide a means of providing user defined values for basic human error rates, the THERP entries in the HRAC were reviewed to identify a value that is close to the 1.0E-4 HEP that could be used as a substitute for this task. Table 20-12 item 8a12 shows that for the manipulation of a 2-position switch, there is an HEP of 2.7E-4, which is similar in magnitudes to the "over-torquing" basic error rate from Reference 5. This is suggested as a substitute value for this task in order to facilitate use of the HRAC for modeling these tasks (e.g., it allows for the HRAC to automatically adjust for stress changes).

b)ii Based on Table 6b-1, it is judged that FLEX HEPs are reasonable and any further refinement in the analysis would be mainly justification and documentation in nature and quantitative results would not be significantly impacted.

12 Swain, A.D, Guttman, H.E., Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, August 1983.

Supplemental Information Letter Page 17 of 82 Responses to NRC Audit Questions b)iii No new methodologies were implemented for the FLEX equipment and mitigating strategies that were added to the PRA model. As documented in Reference 9, the use of the "Delay Implementation" decision tree from the IDHEAS at-Power HRA method to augment the Cause-Based Decision Tree methodology that was already used throughout the NMP1 HRA is not considered a PRA Upgrade. Similarly, surrogate data was used to augment the THERP methodology for quantifying alignment tasks related to portable equipment, but the use of additional failure probabilities within the existing methodology does not constitute the use of a new methodology. The impacts of the modeling changes on the results were as expected (i.e., reductions in the SBO and total loss of AC accident sequences when FLEX generators and portable pumps are credited, and reductions in the loss of containment heat removal scenarios when the HCVS system is credited). These changes do not represent a change in capability that impacts the significant accident sequences, but merely represent model updates to ensure that the models reflect the as-built, as-operated plant.

Additional Information for Part (b):

It is not expected that the operators will tow the FLEX equipment at speeds which would threaten trailer decoupling. A 15-mph speed limit is posted for site access although it is not re-posted for inside the protected area. In terms of logistics, Figure 6b-1 shows the deployment routes which involve numerous turns such that acceleration with equipment to high speeds is unlikely. In terms of distances, the following estimates provide the route distances.

NMP1 FLEX Generator Location - 2,600 ft

NMP1 FLEX Pump Location - 1,000 ft

NMP2 FLEX Generator Location - 3,500 ft

NMP2 FLEX Pump Location -1,600 ft Given the following, 15 mph = 1,320 FT/min, 20 mph = 1,760 FT/min, 25 mph = 2,200 FT/min, total travel time is less than ~3 minutes. Given this short amount of time, and the turning requirements noted above, any incentive for excessive speed is considered negligible risk within the overall unreliability of FLEX alignment actions.

Note that 25 mph is not a procedurally or otherwise enforced limit but rather a reasonable judgement given the limited travel length required and the slow acceleration associated with the industrial-class equipment used for towing. Further, the ~3-minute travel time is a small fraction of the ELAP window such that travel time is not a critical performance shaping factor.

Supplemental Information Letter Page 18 of 82 Responses to NRC Audit Questions Figure 6b-1 FLEX Equipment Haul Route For the battery pre-initiator it is noted that some events in the PWROG dataset include Failure to Start cases caused by a battery failure so pre-initiator failures are included in the sensitivity dataset at least to some degree. Further, the NMP1 FLEX alignment procedure (S-DRP-HC) includes a simple step to jump-start the battery as needed, see Figure 6b-2. While not explicitly included in the current PRA HEP, this action is straight forward and would only add a minor extra execution error to the HEP. Taking a screening misalignment failure probability of 1E-1 and a screening jumpstart step failure probability of 1E-2 yields a 1E-3 failure probability related to battery misalignment.

Considering this failure mode is at least partially addressed in the PWROG dataset and 1E-3 represents a small contributor to the total FLEX unreliability (i.e., note the base value of 8.45E-02 and sensitivity value of 2.63E-01 in Table 6c-1), the base and sensitivity cases are judged to reasonably bound this additional failure mode.

Finally, with regard to the jump-start capability, it is noted that the tow vehicles have standard voltage (12v) batteries which is consistent with the FLEX generators ("3 450Kw Gen 12-volt battery, one per Gen." per S-PM-FLEX, Page 22-23, Step 6.6.3).

Supplemental Information Letter Page 19 of 82 Responses to NRC Audit Questions Figure 6b Excerpt from NMP1 FLEX Initiation Procedure In terms of the modeling of cognitive errors and the ELAP declaration, the HFE ZFX01 "Operator Fails to Declare ELAP (COG-ONLY)" is used to represent the failure to declare ELAP in time to support the connection of the FLEX equipment to plant safety systems and initiate it to support its associated function(s). The use of some FLEX equipment, such as the deployment and initiation of the FLEX generator when load shed has been performed successfully (ZFX02), requires no additional cognitive work for completion of the action, while other actions, such as initiation of injection with the FLEX pump (ZFX05), do require additional cognitive work and the action evaluations address the additional cognitive work relevant to those actions.

Supplemental Information Letter Page 20 of 82 Responses to NRC Audit Questions The logic for FLEX Generator deployment utilizes two different HFEs:

ZFX02 "Operator Fails to Deploy and Start FLEX Generator (ELAP) (Execution Only)" and

ZFX03 "Operator Fails to Deploy and Start FLEX Generator (ELAP) (OLS=F)."

The main difference between these events is that the system window is shorter (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) if DC Load Shedding is failed (i.e., OLS=F) than if load shedding is successful (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ),

and the cognitive work to deploy the generator within the required time frame given that load shed has failed is included in the ZFX03 evaluation. In the model, both of these events are ORed with a cognitive HEP, ZFX01"Operator Fails to Declare ELAP (Cognitive Only)". Thus, failure to declare an ELAP prohibits success of generator deployment in both cases.

In terms of the FLEX pump providing RPV makeup, the following deployment and injection actions are logically ORed with the ZFX01 cognitive HEP (above), even though the FLEX pump is listed in EOPs as a source of RPV makeup and ELAP declaration isnt expressly required:

ZFX04 "Operator Fails to Deploy FLEX Pump (ELAP)"

ZFX05 "Operators Fail to Initiate Injection with the FLEX Pump" This conservatism is viewed as bounded within the overall set of actions for FLEX pump deployment.

Finally, in terms of the FLEX pump providing EC makeup, the following deployment and alignment actions are logically ORed with the ZFX01 cognitive HEP (above):

ZFX04 "Operator Fails to Deploy FLEX Pump (ELAP)"

ZFX06 "Operators Fail to Connect and Initiate FLEX Pump for EC makeup" For alignment of the pumps in non-ELAP, procedures are available separate from ELAP (i.e.,

EOP-RPV, DRP-FLEX-MECH) such that ELAP declaration is not required. However, the model treats the ZFX01 action as always required, even in non-ELAP, as a surrogate for overall operator diagnosis and cognition. This is viewed as reasonable, it a bit conservative as noted above.

c.)i A set of sensitivity cases were performed to determine the potential impacts on the RICT values provided in Table E1-2 of the LAR. Table 6c-1 provides a comparison of the FLEX equipment reliability values for the base model and the sensitivity model (PWROG dataset).

Supplemental Information Letter Page 21 of 82 Responses to NRC Audit Questions Table 6c Comparison of FLEX Equipment Failure Rate Estimates Equipment Failure Mode NMP1 PWROG-18042-(Base Model) NP Failure to Start 5.41E-03 4.35E-02 Failure to Run 7.44E-03 (1st hour) 1-EXP(-1.03E-2 Failure to Run after *24) = 2.19E-01 2.68E-03/hr*23 hr=

Portable 1st hour 6.16E-02 Generator (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months )

Maintenance 1.00E-02 N/A Unavailability Total Failure 8.45E-02 2.63E-01 Probability Failure to Start 6.19E-03 3.38E-02 Failure to Run 4.02E-03 (1st hour) 1-EXP(-1.55E-2 Failure to Run after *24) = 3.11E-01 5.95E-05/hr*23 hr=

Portable 1st hour 1.37E-03 Pump (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months )

Maintenance 1.0E-02 N/A Unavailability Total Failure 2.16E-02 3.44E-01 Probability Regarding double-entry of LCOs, NMP1 Technical Specification cases were considered.

Relative to FLEX, Emergency Diesel Generators overlap functionally and were selected as the primary equipment for the double-tech spec review. Thus, every combination tech spec entry case involves an Emergency Diesel Generator unavailable. In addition to the EDG unavailable, the following additional equipment was considered:

Emergency Condensers (EC) - at NMP1 Emergency Condensers support RPV level during station blackout scenarios. EDGs and FLEX are noteworthy in SBO scenarios, so an EDG-EC combination was developed.

Core Spray - Core Spray is unavailable in an SBO so overlapping unavailability is a lesser concern. However, EDGs support Core Spray so an EDG-Core Spray combination was developed. It is noted that this combination does not have significant functional overlap.

HPCI - HPCI at NMP1 is not like other BWRs in that NMP1 HPCI is a mode of feedwater. Feedwater requires offsite power and has limited functional overlap with EDGs and FLEX but an EDG-HPCI combination was developed; mainly to highlight the difference between NMP1 HPCI and typical BWR HPCI.

Supplemental Information Letter Page 22 of 82 Responses to NRC Audit Questions

RPV Isolation - the mapping for RPV isolation included the unlikely situation where an isolation valve was failed open. With a fire-induced spurious operation of the redundant IV causing ISLOCA and Core Spray, the main mitigation for ISLOCA, impacted by fire and the EDG assumed unavailable, otherwise unlikely scenarios become less unlikely and are captured by the RICT model. FLEX equipment plays essentially no role in such scenarios and a short RICT time is driven by the impact of equipment related to the dual tech spec entries.

Table 6c-2 provides a summary of the combination cases along with the previously quantified sampling of single-entry cases.

TABLE 6c FLEX SENSITIVITY - RICT ESTIMATE RESULTS Tech TS/LCO Condition Base Model Sensitivity Spec RICT Estimate (PWROG) RICT (days) Estimate (days) 3.1.3.B One Emergency Cooling subsystem 30 30 inoperable.

3.1.4.B One redundant core spray subsystem 30 30 inoperable.

3.1.6.B One control rod drive pump coolant injection 30 30 subsystem inoperable.

3.1.8.B One High Pressure Coolant Injection (HPCI) 30 30 subsystem inoperable.

3.2.7.B One or more reactor coolant system 21.3 21.3 isolation valves inoperable except due to leakage not within limit.

3.3.7.C One containment spray subsystem in each 30 30 system or its associated raw water systems inoperable.

3.6.3.C One required Emergency Diesel Generator 30 30 (EDG) inoperable or one required EDG inoperable and one required offsite circuit inoperable.

Supplemental Information Letter Page 23 of 82 Responses to NRC Audit Questions TABLE 6c FLEX SENSITIVITY - RICT ESTIMATE RESULTS Tech TS/LCO Condition Base Model Sensitivity Spec RICT Estimate (PWROG) RICT (days) Estimate (days) 3.6.3.H One DC electrical power subsystem 14.4 12.9 inoperable.

3.6.3.C, One required Emergency Diesel Generator 20 16 3.1.3.B (EDG) inoperable or one required EDG inoperable and one required offsite circuit inoperable.

AND One Emergency Cooling subsystem inoperable.

3.6.3.C, One required Emergency Diesel Generator 30 30 3.1.4.B (EDG) inoperable or one required EDG inoperable and one required offsite circuit inoperable.

AND One redundant core spray subsystem inoperable.

3.6.3.C, One required Emergency Diesel Generator 30 30 (EDG) inoperable or one required EDG 3.1.8.B inoperable and one required offsite circuit inoperable.

AND One High Pressure Coolant Injection (HPCI) subsystem inoperable.

Supplemental Information Letter Page 24 of 82 Responses to NRC Audit Questions TABLE 6c FLEX SENSITIVITY - RICT ESTIMATE RESULTS Tech TS/LCO Condition Base Model Sensitivity Spec RICT Estimate (PWROG) RICT (days) Estimate (days) 3.6.3.C, One required Emergency Diesel Generator 4 4 (EDG) inoperable or one required EDG 3.2.7.B inoperable and one required offsite circuit inoperable.

AND One or more reactor coolant system isolation valves inoperable except due to leakage not within limit.

3.6.3.C, One required Emergency Diesel Generator 6 2 (EDG) inoperable or one required EDG 3.6.3.H inoperable and one required offsite circuit inoperable.

AND One DC electrical power subsystem inoperable.

c)ii As noted above, a set of RICT calculations were re-performed as a sensitivity using the PWROG data. Table 6c-2 shows the results of these cases which include single LCO entry cases as well as multiple LCO entry cases. As can be seen, the allowed outage time for a one specification case involving DC equipment was reduced given the PWROG data. The simultaneous LCO cases showed that the EDG-DC LCO combinations and the EDG-Emergency Condenser LCOs combination both show a potential for a reduced LCO, while the other combination LCOs were not significantly impacted.

It should be re-iterated that the PWROG data sensitivity cases reflect an extreme condition with below-expected reliability for FLEX equipment. Further, NMP1 has implemented a FLEX jump-start capability for FLEX battery issues which is not reflected in the PWROG FLEX dataset. However, due to the impact on calculated RICTs for LCO 3.6.3.H and LCOs 3.6.3.C/3.1.3.B simultaneous entry, RMAs will be considered when these conditions are entered to account for this source of uncertainty in the RICT Program.

The RMAs considered in the RICT Program will help to improve the likelihood significant equipment is available if needed and thereby reduce the potential need to deploy the FLEX Supplemental Information Letter Page 25 of 82 Responses to NRC Audit Questions equipment. RMAs are outlined by Constellation procedure OP-AA-108-118 Risk Informed Completion Time and include:

Actions to raise risk awareness and control, such as briefing of crews on risk important operator actions and procedures.

Actions to reduce the duration of maintenance activities, such as performing activities around the clock.

Actions to minimize the magnitude of the risk increase, such as protecting risk important equipment or minimizing fire risk in risk important rooms or areas.

Additional guidance in included in ER-AA-600-1052 "Risk Management Support of RICT."

General Risk Management Action should be taken using a graded approach, based upon PRA and RICT risk:

o Consider postponing other site maintenance to reduce risk levels.

o Consider re-scheduling the activity to reduce risk levels.

o Use Paragon (i.e., PRA Model) to identify the optimal site configuration to minimize risk.

o Include a discussion of RICT during pre-job briefs.

o If other equipment is concurrently out-of-service, consider developing return-to service priorities.

o Consider actions to reduce duration of the maintenance activity:

Pre-stage parts and materials and prepare for likely contingencies.

Walkdown anticipated tagouts before performing actual tagouts.

Training on mockups.

Around-the-clock maintenance.

Establish contingency plans to restore other key out-of-service equipment.

For RICT cases, configuration-specific RMAs are also assessed with the specific plant configuration in mind. As such, for cases involving the LCOs highlighted by the FLEX data sensitivity (i.e., LCO 3.6.3.H and LCOs 3.6.3.C/3.1.3.B simultaneous entry) as well as other RICT conditions, configuration-specific RMAs include:

Additional equipment for protection.

Additional briefings for important operator actions.

Additional rooms/areas for Fire RMAs. If a suppression system is out-of-service in a room identified as being important to fire risk in a RICT configuration, then a continuous fire watch with an extinguisher shall be established in those rooms as a RMA.

The protected equipment program procedure (OP-AA-108-117) lists additional guidance which supports the effectiveness of RMAs:

Walkdown protected equipment postings and equipment during rounds and verify the following:

Supplemental Information Letter Page 26 of 82 Responses to NRC Audit Questions o The postings remain properly established.

o No unauthorized access or work is being performed on or within 2 feet of the protected equipment.

o There is nothing in the area (e.g., scaffolding) that could interfere with the functioning of the protected equipment.

o If radiological or inaccessibility conditions prevent performance of the walkdown.

o then obtain Operation Shift Management approval to waive the walkdown, if necessary.

Ensure frequent communications to station and supplemental workers identify the status of protected equipment and any planned protected equipment changes by performing the following steps.

o Review the current protected equipment and planned changes.

o Communicate changes to protected equipment.

o Communicate switchyard protected equipment to the Transmission Operator and inform them that the protected equipment is considered vital and no actions should be performed that could jeopardize power availability.

Finally, procedure WC-AA-101 "On-Line Work Control Process" provides a number of additional administrative controls including some guidance explicitly involving portable equipment. A partial list of FLEX-relevant examples from this procedure includes:

If severe weather or conditions that are potential HREs for loss of offsite power are expected, then planned unavailability of AC power sources shall be deferred.

If an offsite power source becomes unavailable or degraded, or the risk of losing offsite power significantly increases due to severe weather, then systems required to mitigate the loss of offsite power shall be made available as soon as possible.

Maximizing the Benefit of Portable Equipment - Examples of Potential Strategies o Stage portable diesel generators during safety-related plant diesel generator outages to provide defense-in-depth.

o Use a portable diesel generator during security diesel generator outage.

o Stage a portable pump to provide defense-in-depth for spent fuel pool inventory control or use it to provide temperature control.

o Stage a portable pump to provide defense-in-depth for a degraded safety related pump .

o Use a portable pump to augment a degraded non-safety related pump.

o Stage a portable pump to provide defense-in-depth for Reactor Coolant System (RCS) reactivity and RCS inventory safety functions.

Supplemental Information Letter Page 27 of 82 Responses to NRC Audit Questions o Use a portable battery bank to support replacement of installed battery banks.

o Use a temporary power supply to power instrumentation and control (I&C) or plant loads during power supply outages.

o Use of portable fans for room cooling on loss of normal Heating, Ventilation, and Air Conditioning (HVAC).

As summarized above, the RMA process outlined by Constellation RICT program procedures will reduce the risk associated with the uncertainty of the FLEX reliability data by:

Heightened awareness of important operator actions will help minimize human error probability. In particular, the alignment of the FLEX jumpstart capability is judged to reduce uncertainty related to FLEX equipment reliability data.

Identification of high-risk fire areas will help to reduce the risk of initiating events and loss of risk significant components caused by fires in those areas.

Protection of key equipment will help to ensure that the equipment is in its expected configuration and thereby reduce the unreliability important equipment.

Minimization of time spent in maintenance-related alignments.

NRC Follow-up Question to Audit Question 06.a and 06.c Responses [Reference 6]

06.a: Response did not justify NMP1's approach for FLEX failure rates (i.e., 2x permanently installed failure rates):

Response did not provide a basis for the 2x factor (value seems arbitrary)

PWROG-18042 (where FLEX failure rates are based on industry experience and vetted by industry and approved by NRC) suggests the 2x factor is too low.

Response primarily focused on questioning PWROG-18042 (i.e., "its too conservative"), which doesnt validate NMP1's approach.

Response seems ok with FTS failure rates in PWROG-18042, and these FTS failure rates are 10-16x larger than the permanently installed SSCs. This suggests the 2x factor used by licensee is too low.

NMP1s approach (or justification of approach) does not consider available generic or plant-specific FLEX data.

Doesn't meet Conclusion 6 of NRC Memo dated May 6, 2022 (ML22014A084) which states, "should not use failure rates for permanently install equipment."

Response states that DG FTR probability in PWROG-18042 is biased to failing within the first hour (i.e., short FLEX run times). However, from PWROG-18042, early DG FTR events (before reaching stable conditions) are counted as FTS.

06.c: Provide Updated uncertainty analysis.

Supplemental Information Letter Page 28 of 82 Responses to NRC Audit Questions

Response states FLEX failure probability uncertainty has a minor impact on RICT results (i.e., not a key source of uncertainty).

However, for LCOs 3.6.3.C and 3.6.3.H in Table 6c-3, the impact of FLEX failure probability uncertainty is significant (i.e., impacts RICT by 50% or more).

-FLEX failure probability is a key source of uncertainty.

Response mentions one RMA to address FLEX uncertainty (i.e., dedicating the N+1 FLEX generator during AC or DC RICT). It is unclear what this RMA represents:

-Describe RMA in more detail?

-How does this RMA reduce risk (i.e., how credited in PRA sensitivity study)?

-Is there sufficient time to credit a spare FLEX DG?

-Since FLEX uncertainties primarily impact fire CDF sequences, what fire-specific RMAs can be implemented?

Constellation Response to NRC Follow-up Question for Audit Question 06.a and 06.c Responses 06.a: The dataset from PWROG-18042-NP have been applied to the NMP1 Average Maintenance model to develop a set of importance measures which reflect unadjusted use of the PWROG FLEX data.

As part of the 2021 PRA update, the FLEX HRA modeling techniques documented in EPRI 30020130185 were employed in the update of the NMP1 FLEX HRA human failure event (HFE) evaluations. In order identify and evaluate the impacts of the NRC clarifications on the NMP1 FLEX action evaluations, specifically conclusions 11, 12, and 13, each of the HRA-specific clarifications has been listed in Table 6b-1 along with a disposition of the comment relative to the NMP1 FLEX HRA evaluations.

Failure rates for permanently installed equipment were replaced in the sensitivity with PWROG FLEX data (applies to Conclusion 6).

From PWROG-18042, early DG FTR events (before reaching stable conditions) are counted as FTS.

06.c: Updated uncertainty analysis is provided.

NRC Follow-up Questions to Audit Question 06.b and 06.c Responses [Reference 7]

6.b: Regarding operating trailers at low speeds, provide further justification that ensure low speed operations during an event (heighten stress levels).

Regarding the screening of battery depletion pre-initiator, provide further screening justification, such as currently FLEX PRA modeling.

Regarding the modeling of declaring an ELAP, provide clarification on the modeling of the cognitive operator action and its impact on crediting FLEX strategies in the PRA model.

6.c: Add to response a discussion on whether the RICTs for plant configurations involving more than one LCO entry are significantly impacted by FLEX uncertainties (e.g., expand the sensitivity study to include multiple LCO entries whose RICT is sensitive to FLEX Supplemental Information Letter Page 29 of 82 Responses to NRC Audit Questions uncertainties and less than the 30 day backstop). Also, discuss the basis for the chosen plant configurations involving more than one LCO entry.

Constellation Responses to NRC Follow-up Question for Audit Question 06.b and 06.c Responses 6.b: Response to 06.b above is revised to address Reference 7 follow-up questions.

6.c: Table 6c-1 provides a comparison of the FLEX equipment reliability values for the base model and the sensitivity model (PWROG dataset).

Table 6c-2 and response to 6.cii above is revised to address the impact on RICT for plant configurations involving more than one LCO entry.

Table 6c-2 provides an update of the sensitivity case using PWROG data for LCO combination 3.6.3.H (one DC electrical power subsystem inoperable) and 3.6.3.C. Risk Management Actions as provided in station procedures were included to reflect the uncertainty.

NRC Follow-up Questions to Audit Question 06 Responses [Reference 8]

6.a: In Table 6a-1 for portable generator failure to run after 1st hour, the base case was shown in the table as 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months instead of 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months . The product of 6.16E-2 is correct for 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months .

6.b: Information from both the original response to 6.b and the revised response to 6.b are needed on the docket.

Revised response to audit question 6.b states, "15 mph = 2,200 FT/min." Should that be 25 mph? Please correct this in revised response.

The revised response states, "any incentive for excessive speed is considered negligible risk". Given the response lists 25 mph, is this the highest speed that can be expected? Please clarify in revised response.

Regarding the HEP for jump starting a depleted FLEX DG battery using the tow vehicle. Are the battery voltages compatible, i.e., 12V vs. 24V (please explain)? If not, explain how the tow vehicle battery would be utilized to start the FLEX DG.

6.c: In Table 6c-1 for portable generator failure to run after 1st hour, the base case was shown in the table as 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months instead of 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months . The product of 6.16E-2 is correct for 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months .

For the sensitivity study in Table 6c-2, what is the RICT sensitivity results for LCO combination 3.6.3.H (one DC electrical power subsystem inoperable) and 3.6.3.C, and discuss the results?

The revised response concluded that the RICT is not sensitive to the uncertainties associated with FLEX equipment failure probabilities, and based on the results of the sensitivity study, no specific global risk management actions (RMAs) were identified related to these uncertainties.

However, the NRC staff notes that the sensitivity study results in Table 6c-2 show significant decreases in RICT (20 percent) for LCO combination 3.6.3.C and 3.1.3.B (one EDG /offsite & one EC train). Also, for single LCO 3.6.3.H (one DC train), the Supplemental Information Letter Page 30 of 82 Responses to NRC Audit Questions decrease in RICT (10.4 percent) can be considered significant. Therefore, the basis for the licensees conclusion regarding this sensitivity study (i.e., "the impact is still assessed to be minor") is unclear. The impact of FLEX failure probability uncertainties appears to significantly impact RICT calculations for certain LCOs and that this is a key source of uncertainty.

Considering these observations, (a) Describe and provide a basis for how the uncertainty of FLEX equipment failure probabilities will be addressed in the RMTS program (e.g.,

programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty). If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09-A; and (2) provide RMA examples that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

-OR-(b) Provide a mechanism (e.g., a license condition/implementation item) to incorporate NRC-accepted FLEX parameter data in the NMP1 PRA models used for RICT calculations prior to implementing the RICT program.

Constellation Responses to NRC Follow-up Questions for Audit Question 06 Responses:

6.a: The base case in Table 6a-1 above for portable generator failure to run after 1st hour is revised to show 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months .

6.b: "15 mph = 2,200 FT/min." is revised to 25 mph.

Part 6.b is revised to note that 25 mph is not a procedurally or otherwise enforced limit but rather a reasonable judgement given the limited travel length required and the slow acceleration associated with the industrial-class equipment used for towing.

With regard to the jump-start capability, it is noted that the tow vehicles have standard voltage (12v) batteries which is consistent with the FLEX generators ("3 450Kw Gen 12-volt battery, one per Gen." per S-PM-FLEX, Page 22-23, Step 6.6.3).

6.c: The base case in Table 6c-1 above for portable generator failure to run after 1st hour is revised to show 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months .

Table 6c-2 is updated to provide the sensitivity case using PWROG data for LCO combination 3.6.3.H (one DC electrical power subsystem inoperable) and 3.6.3.C.

The response to question 6.C.ii was augmented to summarize Risk Management Actions as provided in station procedures to reflect the FLEX equipment reliability uncertainty.

Supplemental Information Letter Page 31 of 82 Responses to NRC Audit Questions Audit Question-07 was resolved during the regulatory audit Audit Question-08 was resolved during the regulatory audit Audit Question-09 (APLA - RICT) - In-Scope LCOs and Corresponding PRA Modeling The NRCs safety evaluation for NEI 06-09-A specifies that the LAR should provide a comparison of the TS functions to the PRA modeled functions to show that the PRA modeling is consistent with the licensing basis assumptions or to provide a basis for when there is a difference. Table E1-1 of LAR Enclosure 1 identifies each Limiting Condition for Operation (LCO) in the TSs proposed for inclusion in the RICT program. The table also describes whether the systems and components covered by the LCO are modeled in the PRA and, if so, presents both the design success criteria and PRA success criteria. For certain LCOs, the table explains that the associated structures, systems, and components (SSCs) are not modeled in the PRAs but will be represented using a surrogate event that fails the function performed by the SSC. For some LCOs, the LAR did not provide an adequate description for the NRC staff to conclude that the PRA modeling will be sufficient.

Regarding TS LCO 3.3.4.B, Table E1-1 states that, for any primary containment isolation valves (PCIVs) not modeled, a pre-existing small leak event that is modeled will be used as a surrogate. It is unclear to the NRC staff which pathways will be used for each affected function.

a) Clarify which pre-existing small leak event will be used as a surrogate for each of the system isolation functions affected.

b) Provide justification that the surrogate bounds each of the isolation functions.

Constellation Response:

a) Basic Event ZZZ01CISOISSLEAK, Small Pre-existing Leak, will be used as a surrogate for any PCIV not modeled. The NMP1 containment isolation logic includes two phenomenological events for pre-existing containment failure events:

ZZZ01CISOISSLEAK "Small Pre-existing Leak"

ZZZ02CISOISLLEAK "Large Pre-existing Leak" In terms of the logic, failure of either of these conditions will satisfy containment isolation failure and meet criteria for Large Early Release (LERF). The primary phenomenological difference is that Primary Containment pressure remains elevated given the ZZZ01CISOISSLEAK failure mode and is depressurized given the ZZZ01CISOISLLEAK failure mode.

Figure 9-1 shows both of these basic events within the overall containment isolation failure fault tree logic. Failure of either of these events satisfies failure for the containment isolation function. The small leak was chosen as the surrogate because:

The small leak is viewed as a more challenging plant condition (i.e., failure Large enough for LERF but containment pressure remains elevated).

Supplemental Information Letter Page 32 of 82 Responses to NRC Audit Questions

In terms of unmodeled pathways, smaller containment penetrations are more likely to be the subject of RICT initiatives because small penetrations are more numerous and explicitly modeled penetrations are larger pathways.

b) The pre-existing small leak event contained within the PRA model is directly under the IS gate, "Containment isolation failure." Setting this event to True for any unmodeled component would act as a conservative surrogate given there would be no credit for any redundant equipment that would potentially mitigate PCIV failure (i.e. concurrent inboard and outboard isolation valve failure in order to fail to isolate for a single line). See Figure 9-1 which demonstrates how the ZZZ01CISOISSLEAK basic event satisfies (i.e., fails) the containment isolation failure fault tree logic.

Figure 9 NMP1 Containment Isolation Logic Audit Question-10 (APLA - RICT) - Performance Monitoring The NRC SE for NEI 06-09-A, states, "[t]he impact of the proposed change should be monitored using performance measurement strategies." NEI 06-09-A considers the use of NUMARC 93-01, Revision 4F, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants" (ML18120A069), as endorsed by RG 1.160, Revision 4 (ML18220B281), for the implementation of the Maintenance Rule. NUMARC 93-01, Section 9.0, contains guidance for the establishment of performance criteria.

In addition, the NEI 06-09-A methodology satisfies the five key safety principles specified in RG 1.177, Revision 2 (ML20164A034) relative to the risk impact due to the application of a RICT.

Moreover, NRC staff position C.3.2 provided in RG 1.177 for meeting the fifth key safety principle acknowledges the use of performance criteria to assess degradation of operational Supplemental Information Letter Page 33 of 82 Responses to NRC Audit Questions safety over a period. It is unclear how the licensees RICT program captures performance monitoring for the SSCs within-scope of the RMTS program. Therefore:

a) Confirm that the NMP1 Maintenance Rule program incorporates the use of performance criteria to evaluate SSC performance as described in NUMARC 93-01, as endorsed by RG 1.160.

b) Alternatively, describe the approach or method used by NMP1 for SSC performance monitoring, as described in NRC staff position C.3.2 of RG 1.177, Revision 2, for meeting the fifth key safety principle. In the description, include criteria (e.g., qualitative or quantitative), along with the appropriate risk metrics, and explain how the approach and criteria demonstrate the intent to monitor the potential degradation of SSCs in accordance with the NRC SE for NEI 06-09-A.

Constellation Response:

Nine Mile Point Unit 1 (NMP1), like all operating Constellation sites, follows NEI 18-10, "Monitoring the Effectiveness of Nuclear Power Plant Maintenance," guidance for meeting the requirements of 10 CFR 50.65 (Maintenance Rule). This is an alternative to the NRC-endorsed guidance in NUMARC 93-01. Therefore, the response will address option (b) above. NEI 18-10 differs from NUMARC 93-01 guidance primarily regarding how (a)(2) SSC functions are managed.

Regarding the Risk Informed Completion Time (RICT) program, NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b: Risk-Managed Technical Specifications (RMTS)

Guidelines Industry Guidance Document," outlines the requirements that must be followed to allow extension of allowable completion times. This includes evaluating the acceptability of a single completion time extension and the cumulative risk contribution based on the extension of all RICT windows throughout a 24-month period. The RICT program manages risk through use of several risk metrics and also through the use of Risk Management Actions (RMAs). The risk metrics are described in NEI 06-09 and include limits while in a RICT, limits to prevent entry into potential high risk configurations, and cumulative tracking limits imposed to assure that the guidance of RG 1.174, Revision 1, is met. These limits aid in minimizing the impact on plant safety.

In the NRC Final Safety Evaluation (SE) for NEI Topical Report (TR) 06-09 (ADAMS Accession No. ML071200238, dated May 17, 2007), the five key safety principles of risk-informed decision making presented in RG 1.174, Revision 1, for risk-informed applications are addressed including the fifth key safety principle:

"The impact of the proposed change should be monitored using performance measurement strategies."

As stated in the SE, the cumulative impact of implementation of a RMTS is periodically assessed and must be shown to result in a total risk impact below certain values (on an annual basis). The SE concludes that these criteria are consistent with the guidance of RG 1.174, Revision 1, for acceptable small changes in risk. The SE also acknowledges that "the NRC staff anticipates that the use of extended CTs [Completion Times] within an RMTS program is unlikely to be a routine practice, since licensees already accomplish planned maintenance activities within the existing TS CTs." Furthermore, the SE states:

Supplemental Information Letter Page 34 of 82 Responses to NRC Audit Questions Although the RMTS are permitted to be applied to planned maintenance activities, other requirements, such as 10 CFR 50.65 performance monitoring, and regulatory oversight of equipment performance, are disincentives to a licensee for incurring significant additional unavailability of plant equipment, even when allowed by an RMTS program.

This provides a further control on the use of the RMTS which could result in a significant increase in equipment unavailability and the commensurate risk.

The SE then considers a single CT extension which could (alone) approach the risk limits of NEI 06-09, but acknowledges that while allowable, such configurations are not routinely encountered during plant maintenance activities and are not the anticipated application of the RMTS. The SE concludes that:

"...the performance monitoring and feedback specified in the TR, is sufficient to reasonably assure changes in risk due to the implementation of the RMTS are small and are consistent with Section 3.2 of RG 1.177. Thus, the fifth key safety principle of RG 1.177 is satisfied."

Demonstration that the SSCs within-scope of the RICT application remain capable of performing their intended functions is addressed by NEI 18-10 guidance, which includes measures to prevent incurring significant additional unavailability of plant equipment and analyzes equipment failures in the context of maintenance program effectiveness. The approach/method used by NMP1 (and all operating Constellation plants) for demonstrating that SSCs remain capable of performing their intended functions includes an examination of Core Damage Frequency (CDF) trends. NEI 18-10, Section 9.1.3, and Constellation procedure, "Maintenance Rule 18 Periodic (a)(3) Assessment," require review of CDF trends over the assessment period for the purpose of ensuring a proper balance of SSC availability and reliability, as required by 10 CFR 50.65 paragraph (a)(3). While cumulative risk tracking (specifically intended for RICT) examines the incremental risk (above the front stop) for RICT entries on a 24-month basis, CDF trending (performed for broader Maintenance Rule purposes) examines the aggregate risk of all online work - not just RICT window entries and is performed as a 12-month rolling average for Maintenance Rule purposes.

The results of CDF trending are addressed in the periodic (a)(3) assessment of the effectiveness of maintenance actions, performed once per fuel cycle. This assessment is required by 10CFR 50.65, paragraph (a)(3) which states (in part):

"...ensure that the objective of preventing failures of structures, systems, and components through maintenance is appropriately balanced against the objective of minimizing unavailability of structures, systems, and components due to monitoring or preventive maintenance."

CDF trending (for Maintenance Rule purposes) examines the risk impact associated with both planned and unplanned maintenance and considers the impact of failures through the associated unplanned maintenance. CDF trending also provides an aggregate assessment of maintenance planning and execution. The Internal Events PRA model (including internal flooding) is used for CDF trending. External events such as fire, seismic and external flooding are excluded because they are not explicitly quantified in the (a)(4) process. The calculated aggregate risk is compared to the annual average base CDF. The CDF trend evaluation is then used to perform the required periodic assessment in accordance with Engineering procedure, "Maintenance Rule 18 Periodic (a)(3) Assessment." The process requires:

Supplemental Information Letter Page 35 of 82 Responses to NRC Audit Questions

obtaining the CDF trends for the assessment period from the PARAGON configuration risk management tool, and then

evaluating fluctuations in the trend.

CDF trends are reviewed during the periodic (a)(3) assessment for a minimum of:

long unavailability durations,

peak periods of risk increase,

need to update PRA, and

multiple occurrences of the same configuration due to ineffective maintenance.

Any such fluctuations found are then examined for purposes of identifying multiple occurrences of the same unplanned configuration due to ineffective maintenance, or an imbalance in planned maintenance activities per the maintenance strategy to unplanned events requiring corrective maintenance activities. Excessive instances of long unavailability windows and/or frequent extension of completion times are indicative of an ineffective maintenance strategy. If any concerns are identified, an Issue Report (IR) is generated in the Corrective Action Program (CAP) to evaluate cause and an (a)(1) determination is performed. This will lead to SSC functions moving to (a)(1) monitoring requirements and goal setting.

NEI 18-10 guidance handles reliability as follows. If an event or failure occurs and an IR is generated in CAP associated with a scoped in SSC with High Safety Significant (HSS) function(s), the IR will be reviewed for HSS Maintenance Rule Functional Failures (MRFF). Any HSS MRFF will result in an immediate (a)(1) determination (i.e., every HSS function has an equivalent of a reliability performance criterion value of 0). All IRs that represent a Plant Level Event (PLE) will result in an immediate (a)(1) determination. For Low Safety Significant (LSS) functions the reliability is monitored by evaluation of system performance trends. When a trend in system/function performance is observed, this would drive an immediate (a)(1) determination.

Trends are identified on an ongoing/continuous basis by identification through engineer review, through operating experience review, or during the (a)(3) assessment. LSS trending is taking system health inputs (e.g., IRs, degraded conditions, preventive and predictive maintenance results, etc.) and determining if issues are occurring repeatedly such that the maintenance program is ineffective. There is no set limit or number to constitute a trend. While trend reviews are performed by engineers real-time, an additional review is performed by the Maintenance Rule Coordinator as part of the (a)(3) assessment.

In this fashion, 10 CFR 50.65 performance monitoring complements the RICT program, and ensures that significant additional unavailability of plant equipment leading to a degradation of plant safety will not be incurred and, therefore, meeting the fifth key safety principle of RG 1.177.

Audit Question-11 (APLA - RICT) - Consideration of Shared Systems in Calculation of a RICT RG 1.200, Revision 2, states, "[t]he base PRA serves as the foundational representation of the as-built and as-operated plant necessary to support an application."

Supplemental Information Letter Page 36 of 82 Responses to NRC Audit Questions The LAR does not appear to address the existence of crossties between units. However, the NRC staff has reviewed system documents in the portal that have shared systems. The NRC staff notes that for some of these systems, it appears the sharing of a system is not consistent among units. It appears that some operational aspects, such as alternate alignments, were excluded from the PRA models. For multiunit events (e.g., loss of offsite power and seismic events), credit for a shared system may be limited to one unit.

Clarify what systems are shared, how they are shared, whether they can support the other unit in an accident. Explain how the shared systems are credited for each unit in the PRA models.

This discussion should also address the following:

a) Identify systems that can be cross-tied to another unit. Discuss any differences among the units sharing these systems.

b) Explain how shared systems credited in the real-time risk model that support the RICT calculations are modeled for each unit in a multiunit event. Include in this discussion what aspects of these systems were excluded from the PRA model(s) and why these exclusions do not impact the application.

c) If the impact of events that can create a concurrent demand for a system shared by multiple units and credited in the real-time risk model is not addressed, explain why this modeling exclusion does not have a significant impact on the RICT calculations.

Constellation Response:

a) Nine Mile Point Unit 1 (NMP1) is fully independent from Nine Mile Point Unit 2 (NMP2).

All mitigating systems (including support systems) are separate and are not shared. A cross-tie between Unit 1 and Unit 2 firewater can be used (modeled in the PRA).

Additionally, there is shared portable equipment (generators and chargers) that is modeled in the PRA.

NMP1s Fire Protection System is fully independent and there are no shared components with NMP2 that are needed for that system to function. However, two cross-tie pathways are available between NMP1 and NMP2 via BV-100-54 and VLV-100-971. That being said, flow calculations are only available for the BV-100-54 supply line so that is the only cross-tie currently credited.

In terms of the FLEX equipment, the model credits equipment that is shared with Unit 2.

There are 5 Diesel Driven pumps and 3 Portable Generators available for NMP1 and NMP2. The PRA requires only 1 portable Generator and 1 Pump for each unit to successfully perform the FLEX function.

b) There are no multi-unit events postulated to simultaneously result in a loss of offsite power and loss of the emergency power systems for the NMP1 and NMP2 PRA models.

The switchyards are separate for Unit 1 and Unit 2 and each unit has its own dedicated emergency diesels.

There are five diesel driven pumps (BDB-P2A B, C, D, E), two for NMP1, two for NMP2, and one N + 1 pump. There are 3 portable diesel generators (BDB-GENA, B, C), one for NMP1, one for NMP2, and one N + 1 Generator. NMP2 equipment could be used for FLEX strategies at NMP1 but is not explicitly credited in the PRA model. RMAs could potentially involve NMP2 FLEX equipment. The NMP1 PRA credits the use of two FLEX Generators and two FLEX pumps.

Supplemental Information Letter Page 37 of 82 Responses to NRC Audit Questions c) The shared systems are addressed by the real-time risk model as discussed above Audit Question-12 (APLA - RICT) - Digital Instrumentation and Control Modeling Concerning the quality of the PRA model, NEI 06-09-A states that RG 1.174 and RG 1.200 define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

Regarding digital instrumentation and control (I&C), the NRC staff notes the lack of consensus industry guidance for modeling these systems in plant PRAs to be used to support risk-informed regulatory applications. In addition, known modeling challenges exist, such as the lack of industry data for digital I&C components, the difference between digital and analog system failure modes, and the complexities associated with modeling software failures including common-cause software failures. Also, though reliability data from vendor tests may be available, this source of data is not a substitute for in-the-field operational data. Given these challenges, the uncertainty associated with modeling a digital I&C system could impact the RICT program. Therefore, address the following:

a) Clarify whether digital I&C systems are credited in the PRA models that will be used in the RICT program.

b) If digital I&C systems are credited in the PRA models that will be used in the RICT program, provide justification (e.g., describe and provide the results of a sensitivity study) that demonstrates the modeling uncertainty associated with crediting digital I&C systems has an inconsequential impact on the RICT calculations.

Alternatively, if a justification is not provided, identify which LCOs are determined to be impacted by digital I&C systems modeling for which risk management actions (RMAs) will be applied during a RICT. Explain and justify the criteria used to determine what level of impact to the RICT calculation require additional RMAs.

Constellation Response:

a) Digital Feedwater Level Control was installed at NMP1 and this modification has been incorporated in the PRA. It can be found under gate OVRFL-13-L8, called ZZDFW_DIGITALFW Digital FW fails and pushes level high. It is set to a value of 1E-

4. In addition, the digital feedwater system is an implicit input to the Loss of Feedwater Initiating Event (%LOF) with is equal to 6.64E-2/yr. in the base model. There are no other digital systems credited in the NMP1 PRA.

For the digital feedwater level control sensitivity, the NMP1 model was edited for the following:

Set ZZDFW_DIGITALFW increased from 1E-4 to 1E-2

%LOF increased from 6.64E-2/yr. to 1.2E-1/yr.

In addition, a number of additional specification cases have been added at the bottom of Table Q12-1 for completeness. The results of this sensitivity are provided in Table Q12-1 and show a negligible impact on RICT results.

Supplemental Information Letter Page 38 of 82 Responses to NRC Audit Questions Table Q12-1 Digital Feedwater Level Control Sensitivity LAR Sensitivity ID TS Condition Results (Days)

(days)

One High Pressure Coolant Injection 3-1-8-B_1 30 30 (HPCI) subsystem inoperable.

One High Pressure Coolant Injection 3-1-8-B_2 30 30 (HPCI) subsystem inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_1 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_10 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_11 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_12 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_2 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_3 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_4 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_5 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_6 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_7 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_8 30 30 required channels inoperable.

Core Spray Initiation - One or more 3-6-2-A-Table-3-6-2-D-Note-F-1_9 30 30 required channels inoperable.

Automatic Depressurization System 3-6-2-A-Table-3-6-2-F-Note-D-1_1 (ADS) Initiation - One or more required 0.9 0.9 channels inoperable.

High Pressure Coolant Injection (HPCI) 3-6-2-A-Table-3-6-2-K-Note-C-1_1 Initiation - One or more required 30 30 channels inoperable.

Supplemental Information Letter Page 39 of 82 Responses to NRC Audit Questions Table Q12-1 Digital Feedwater Level Control Sensitivity LAR Sensitivity ID TS Condition Results (Days)

(days) 3.1.3.B One Emergency Cooling subsystem 30 30 inoperable.

3.1.4.B One redundant core spray subsystem 30 30 inoperable.

3.1.6.B One control rod drive pump coolant 30 30 injection subsystem inoperable.

3.1.8.B One High Pressure Coolant Injection 30 30 (HPCI) subsystem inoperable.

3.2.7.B One or more reactor coolant system 21.3 21 isolation valves inoperable except due to leakage not within limit.

3.3.7.C One containment spray subsystem in 30 30 each system or its associated raw water systems inoperable.

3.6.3.C One required Emergency Diesel 30 30 Generator (EDG) inoperable or one required EDG inoperable and one required offsite circuit inoperable.

3.6.3.H One DC electrical power subsystem 14.4 14 inoperable.

b) Refer to response 12.a above.

Audit Question-13 (APLA - RICT) - Impact of Seasonal Variations The Tier 3 assessment in RG 1.177 stipulates that a licensee should develop a program that ensures the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. NEI 06-09-A and its associated NRC safety evaluation state that, for the impact of seasonal changes, either conservative assumptions should be made, or the PRA should be "adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration." of the LAR states that outside temperatures' impact on service water pumps were evaluated and addressed. However, it does not appear to specify the modeling adjustments needed to account for seasonal and time of cycle dependencies and what kind of adjustments will be made. Therefore, address the following to clarify the treatment of seasonal and time of cycle variations:

a) Explain how the RICT calculations address changes in PRA data points, basic events, and SSC operability constraints as a result of extreme weather conditions, seasonal variations, other environmental factors, or time of cycle. Also, explain how these adjustments are made in the configuration risk management program (CRMP) model and how this approach is consistent with the guidance in NEI 06-09-A and its associated NRC final SE.

Supplemental Information Letter Page 40 of 82 Responses to NRC Audit Questions b) Describe the criteria used to determine when PRA adjustments due to extreme weather conditions, seasonal variations, other environmental factors, or time of cycle variations need to be made in the CRMP model and what mechanism initiates these changes.

Constellation Response:

a) See response b) below for how extreme weather conditions are addressed procedurally.

For the NMP1 model, the impact of outside temperatures on system requirements like seasonal service water pumps were evaluated and found no dependent flags were needed to be addressed in the CRMP model. Additionally, there are no time-of-cycle impacts on the NMP1 model. Therefore, there are no adjustments made to the CRMP model to account for the extreme weather conditions, seasonal variations, other environmental factors, or time of cycle.

b) Extreme temperature condition modeling is consistent with the plant design basis. There are no circumstances in which extreme weather conditions are addressed differently than the plant technical specifications would allow.

Conditions requiring the LOOP HRE (such as Severe Thunderstorm Warning, Tornado Warning or Solar Magnetic grid disturbances) are proceduralized in the Constellation Work Control procedures and appropriate risk management actions such as deferring any AC power maintenance may be taken as a result of the HRE. In addition, a separate Operations procedure provides guidance for severe weather mitigation such as restoring ECCS or other system equipment to cope with severe weather, holding shift briefings for potential weather impacts and reviewing LOOP procedures as well as guidance for specific threats such as removing potential on site missiles for high wind conditions or additional intake monitoring for blizzard conditions.

Audit Question-14 (APLA - RICT) - PRA Update Process Section 2.3.4 of NEI 06-09-A specifies, "criteria shall exist in PRA configuration risk management to require PRA model updates concurrent with implementation of facility changes that significantly impact RICT calculations."

LAR Enclosure 7 states that if a plant change or a discovered condition is identified and can have significant impact on the RICT calculations, then an unscheduled update of the PRA models will be implemented. More specifically, the LAR states that if the plant changes meet specific criteria defined in the plant PRA and update procedures, including criteria associated with consideration of the cumulative risk impact, then the change will be incorporated into applicable PRA models without waiting for the next periodic PRA update. The LAR does not explain under what conditions an unscheduled update of the PRA model will be performed or the criteria defined in the plant procedures that will be used to initiate the update.

Considering these observations, describe the conditions under which an unscheduled PRA update (i.e., more than once every two refueling cycles) would be performed and the criteria that would be used to require a PRA update. In the response, define what is meant by "significant impact to the RICT Program calculations."

Constellation Response:

The Constellation Risk Management FPIE & FPRA Model Update procedures [1][2] require an evaluation of plant changes or discovered conditions (tracked as Updating Requirement Evaluations or UREs) against an extensive list of criteria including change in CDF/LERF. A Risk Management Engineer will evaluate each URE to determine whether the MOR should be Supplemental Information Letter Page 41 of 82 Responses to NRC Audit Questions updated expeditiously, or the update can be delayed to the next periodic update. This determination will be made based on whether the PRA model fidelity (representation of the as-built, as operated plant) without the update is adequate to support PRA applications that are currently in effect. This is determined either by qualitative screening or Working model updates for potentially significant changes.

Some of the PRA Unscheduled Update Criteria are listed below:

CDF or LERF change >25%

CDF>1E-5

LERF>1E-6

Significant change in accident class or sequence (greater than factor of 2 increase in an accident class that contributes >5% risk)

Configuration risk increase factors that could breach the color thresholds used in Maintenance Rule a(4).

These evaluations, particularly the check on significant sequences and configuration risk, ensure changes that could significantly impact RICT calculations initiate an unscheduled PRA model update or result in administrative limits on the RICT program per Constellation procedures (for example, limiting the use of RICT to LCOs where the impact of the condition is not significant).

References

1. ER-AA-600-1015 FPIE Model Update Rev. 20

2. ER-AA-600-1061 FPRA Model Update Rev. 7 Audit Question-15 was resolved during the regulatory audit Audit Question-16 (APLA - RICT) - Exclusion of High Winds Penalty in RICT Estimates Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by "performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT."

Table E1-2 of Enclosure 1 of the LAR provides RICT estimates for TS actions proposed to be in the scope of the RICT program. Note 1 of the table states that the calculations are based on internal events, internal flood, and internal fire PRA model calculations with seismic penalties.

The NRC staff notes that Section 4 of Enclosure 4 identifies the high wind hazard risk is significant to overall plant risk and calculates two different penalties that are listed in Table E5-1.

It is unclear to the NRC staff whether the RICT values of Table E1-2 include the high winds penalties in the calculation.

a) Confirm that the RICT values provided in Table E1-2 of Enclosure 1 of the LAR were calculated considering the high wind penalties.

b) Clarify how the different values of high wind penalties developed in Enclosure 4 to the LAR are applicable to each RICT.

Supplemental Information Letter Page 42 of 82 Responses to NRC Audit Questions c) If high wind penalties were not provided in Table E1-2, include the high winds penalties, and update the table.

Constellation Response:

a) RICT values provided in Table E1-2 of Enclosure 1 of the LAR were calculated considering the high wind penalties. Note 1 of Table E1-2 is revised in Attachment 3 to this supplemental information letter to include the high wind penalties.

b) For all RICTs that do not involve a diesel generator (DG) or DG board, the penalty factors for CDF and LERF are 5E-6/yr. and 5E-7/yr., respectively. If a RICT configuration includes the unavailability of a DG or DG board, the penalty factors are 1E-5/yr. for CDF and 1E-6/yr. for LERF.13 c) High wind penalties are included in Table E1-2 of Revised Enclosure 1 in Attachment 3 of this supplemental information letter.

Audit Question-17 (APLC - RICT) - SSC Design Wind Capacity Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by "performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT."

The high winds penalty approach is used to quantify the risk impact and to support the RICT evaluation. Table E4-6 of Enclosure 4 to the LAR provides the design wind speed capacities for several structures, including the emergency diesel generator (EDG) Building and Board Rooms.

The table states a design wind speed capacity of 175 mph for the EDG Building. The NRC staff noted that Table E4-4 states that the DG board room wall capacity could not be confirmed, and the limiting DG building roof capacity value of 175 mph was used in the calculation. It is unclear to the NRC staff the criteria used to determine that the DG board room wall wind capacity is not the limiting part of the EDG Building and Board Rooms and if the decision is conservative for the high winds penalty calculation.

a) Discuss how it was determined that the DG board room wall wind capacity is not the limiting component for the EDG building. Include in this discussion justification that the selection of the DG building roof as the limiting component is a conservative assumption for the high winds penalty calculation.

b) Demonstrate, using an approach such as a sensitivity study, that the use of the EDG building roof capacity as the limiting component does not significantly impact any RICT calculation.

Constellation Response:

a) Based on a review of DG Building and DG Board Room drawings and a walkdown of the DG Building and DG Board Rooms, the DG Board Rooms were determined to be of similar construction to the DG Building ("Diesel Gen. Area" in Table XVI-31).

13 These values were presented and "accepted" by the NRC during the audit. However, the penalties have since been updated as shown in the Question 18.g. response.

Supplemental Information Letter Page 43 of 82 Responses to NRC Audit Questions

i. Structural System - Although the structural columns are not designed to take any side wind pressure (no physical connection to side panels), even if the columns were designed to do so, the structural columns are oriented on their weak axis for bending in the DG Board Room as opposed to the strong axis in the DG Building. Given their shorter height (by at least a factor of 2) the moment demand is expected to be reduced by a factor of at least 4. Given that for column sections the strong/weak axis section modulus ratio typically ranges from 2.5 to 3.5, it can be concluded that the structural system of the DG Board Room is of at least equivalent strength to the DG Building.

ii. Wall Panels - The wall panels utilized in the DG Building and DG Board Room are identical. As a result, due to their reduced vertical spans, the capacity for the DG Board Room is expected to be substantially higher than the DG Building.

iii. Roof Panels - The roof panels utilized in the DG Building and DG Board Room are identical. As a result, due to the reduced spans, the capacity for the DG Board Room is expected to be higher than the DG Building.

Therefore, it is concluded that the DG Board Rooms wind capacity is higher (due to shorter horizontal and vertical spans) than the DG Building, which is reflected in Table XVI-31 of the UFSAR and, as a result, the 175-mph roof capacity can be conservatively used as the limiting capacity for the DG and DG Board Room structures.

b) By assuming a lower design capacity for the DG Board Room, the wind pressure CDF and LERF would be higher, since the penalty factor calculation conservatively assumes that failure of the DG Building or DG Board Room results directly in core damage (i.e.,

CCDP = 1).

However, the response to part a) provides adequate assurance that the assumed 175-mph capacity for the DG Board Room is conservative. Therefore, no quantitative sensitivity calculation is judged necessary or performed in response to this question.

Audit Question-18 (APLC - RICT) - Design Wind Speed Capacity Parameter and Fragility Calculations Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT."

Table E4-6 of Enclosure 4 to the LAR provides the design wind speed capacities for several key structures. The table includes two columns for the same parameter, Vd. The first column in Table E4-6 defines Vd as the design wind speed capacity and the second column defines it as the 3-second gust wind speed. The licensee used a formula in the EPRI report 3002003107 to calculate the median velocity Vm. Section 4.5.1 of EPRI report 3002003107 defines Vd as the design wind speed capacity and it is used as the variable in the calculation of median velocity.

The EPRI report provides no mention of the 3-second gust wind speed. Enclosure 4 of the LAR states "The hazard curves from data in NUREG/CR-4461 and the ASCE Hazard Tool are based Supplemental Information Letter Page 44 of 82 Responses to NRC Audit Questions on the 3-second gust wind speeds. To reconcile the difference in time domains, the fastest mile wind speeds were converted to 3-second gust wind speeds."

a) Justify defining Vd as both the design wind speed capacity and the 3-second gust wind speed in Table E4-6.

b) Explain why the 3-second gust wind speed was chosen as the parameter for the licensees wind capacity and fragility calculations, when the 3-second gust wind speed was not defined in EPRI report 3002003107 for use in the calculation of Vm.

Note (1) of Table E4-6 states, "A more detailed fragility analysis was performed to develop the screenhouse parameters," and shows Screenhouse Vm = 239 mph with r = 0.08 and u = 0.11.

The NRC staff noted that a licensees calculation in N1-MISC-021 shows missile impact effects on the screenhouse. The median wind capacity Vm was estimated as Vm = (1.1

1.2

Vd)0.5, which is different from the formula in EPRI report 3002003107 used for other SSCs, but it is listed in Table 4-1 of the EPRI report. However, N1-MISC-021 changed Vd to Vd,hc in the formula, and let Vd,hc = 1.780.5 Vd, and used Vd = 150 mph, which is not consistent with 144 mph in Table E4-6 for Screenhouse.

c) Explain what is the Vd,hc and why it replaces Vd in the formula used for calculation of the median velocity Vm. Why Vd = 150 mph is used, instead of 144 mph in Table E4-6 for Screenhouse?

d) Discuss, with justification, the use of a different Vm calculation formula for the screenhouse compared to the other SSCs.

Note (2) of Table E4-6 shows a generic c = 0.2 was selected for all SSCs, except for the Screenhouse. Table 4-2 of ERPI report 3003003107 shows ranges of s, d, and p, and by using Eq. 4-10 of the EPRI report, r or u = (s2 + d2 + p2)0.5, can be obtained in a range of 0.2 to 0.5. Then, c should be calculated from c = (r2 + u2)0.5, which should be higher than r or u in a range of 0.2 to 0.5.

e) Discuss how the c value of 0.2 was selected for the NMP1 high winds structure fragility analysis. Include in this discussion justification that the value of 0.2 results in a conservative high winds penalty.

f) Demonstrate, using an approach such as a sensitivity study, that the value of 0.2 for the c parameter does not significantly impact any RICT calculation.

g) If any values were changed due to questions (a) to (f), provide the updated high wind penalty factors to be used in the RICT program.

Constellation Response:

a) Use of fastest-mile or 3-sec gust windspeeds is simply the use of a different metric for a given variable. To determine the failure frequency of a structure due to wind pressure, the hazard curve and the structure capacity curves must use the same windspeed metric (averaging time for Vd variable in this case). Since the high wind hazard curves available from industry sources use the current 3-sec gust windspeed, the 3-sec gust equivalents of the NMP1 fastest-mile design capacity windspeeds were calculated in order to make the high wind convolution calculation coherent. The method to convert between windspeed averaging times is commonly accepted practice and an overview of this conversion method can be found in a Wind Engineering Bulletin [The Wind Engineer, Newsletter for the Supplemental Information Letter Page 45 of 82 Responses to NRC Audit Questions Association of Wind Engineering, March 2007] Technical Note: Windspeed Averaging Times (refer to https://aawe.org/wp-content/uploads/2016/05/Newsletter-2007-03.pdf)14:

The basic wind speeds in ASCE7-05 correspond to 3-second gust speed measured at 10m above ground in open country. Historically, however, averaging times in which the mean wind speed is most often reported has been fastest mile, 1-minute and hourly. For consistency in the code a criterion to convert mean wind speeds from one averaging time to another was needed. The IBC (2003) provided Table 1609.3.1 which can be used to convert the 3-second gust wind velocities into fastest mile wind velocities and vice-versa. On the other hand to convert the 1-minute or the hourly mean wind speeds to the 3-second gust wind velocity, the ASCE7-05 provides the Durst Curve (ASCE 7-05 commentary Figure C6-2).

The results of the calculations used to convert NM1 fastest-mile windspeeds to 3-sec gust windspeeds are provided in Table 1. As an example, 175 mph fastest-mile wind speed is converted to ~197 mph 3-sec gust wind speed:

1. Determine the time required for 1 mile of wind to pass the hypothetical measuring point.

3600 sec/hr/175 mph = 20.6 sec/mile

2. Determine the hourly mean wind speed (V3600) corresponding to the fastest mile wind speed.

From the Durst Curve: V20.6/V3600 = 1.36 V20.6/V3600 = 175/V3600 = 1.36 V3600 = 175/1.36 = 128.7 mph

3. Determine the 3-sec gust wind speed.

From the Durst Curve: V3/V3600 = 1.53 V3 = 1.53*V3600 = 1.53*128.7 mph = 196.9 mph ~ 197 mph TABLE 18-1 DESIGN WIND SPEED CONVERSIONS TO 3-SECOND GUST Vt -

Fastest Time for 1-Mile mile of Wind V3 - 3-sec Wind to Pass a Vt/V3600 V3/V3600 3-second Gust/

Speed Point [Durst [Durst Gust Speed Fastest (mph) (sec/mile) Curve] V3600 Curve] (mph) Mile Ratio 145 24.8 1.34 108.2 1.53 165.6 1.14 150 24.0 1.35 111.1 1.53 170.0 1.13 175 20.6 1.36 128.7 1.53 196.9 1.13 190 18.9 1.37 138.7 1.53 212.2 1.12 285 12.6 1.42 200.7 1.53 307.1 1.08 300 12.0 1.42 211.3 1.53 323.2 1.08 14 A similar discussion can be found on slides 8 and 9 of the presentation "Wind Loads: The Nature of Wind" by T. Bart Quimby, PE, PhD. https://www.slideserve.com/JasminFlorian/wind-loads-the-nature-of-wind Supplemental Information Letter Page 46 of 82 Responses to NRC Audit Questions b) The 3-second gust windspeed is commonly used for windspeed averaging time. The calculation of Vm in ERPI report 3002003107 does not specify any averaging time for windspeed, it is applicable regardless of the averaging time. Since the NM1 hazard curves are developed using the 3-sec gust windspeed data, that was chosen as the averaging time for the fragility calculations in the LAR.

To minimize confusion with the fastest-mile windspeeds, the nomenclature for the 3-sec gust design windspeed is changed to:

Vd-3s is defined as the 3-second gust equivalent of the fastest-mile design windspeed.

Table E4-6 in the LAR will be updated such that third column heading "3-sec Gust Design Wind Speed Capacity (Vd)" will be changed to "3-sec Gust Design Wind Speed Capacity (Vd-3s)" as well as any other reference to the 3-sec gust design winds speed in the text of Enclosure 4. Table 2 below is an updated version of Table E4-6.

c) Vd,hc corresponds to the high-confidence wind speed value that would yield an interaction ratio of 1.0 for the given load combination. It was calculated through a detailed evaluation of the Extreme Environmental and Abnormal Load Combinations of ANSI N690, taking into account the factored dead and live loads. It was considered a design value since the associated fraction of the live load considered in the load combination is statistically unlikely.

Due to the screenhouse dominating the estimated wind pressure CDF15 during the initial assessment of structural fragilities, a more detailed analysis was performed to support removing conservatism from the screenhouse fragility parameters.

From the more detailed analysis of the screenhouse, it was observed that the 150-mph design wind speed was not controlling the structural design (i.e., the load combination yielding a demand-to-capacity ratio of 1.0). As a result, in order to determine what would be the equivalent design wind speed corresponding to a demand-to-capacity ratio of 1.0, Vd,hc was calculated. It is acceptable to use Vd,hc in the calculations herein since this is the wind speed that would be used as the design wind speed if the wind load combination were to control the structural design.

As a result, it can be concluded that Vd,hc is the high-confidence design wind speed that corresponds to the capacity of the screenhouse roof. Vd,hc is conservatively taken as the 3-sec gust design wind speed for the screenhouse.

While doing the more detailed structural assessment of the Screenhouse for fragility purposes, it was confirmed that 150 mph (as stated in Table XVI-31 of the UFSAR) is the design speed. The potential discrepancy in design speed for the Screenhouse is based on information from ECP 15-000703, as noted in Table E4-4. This was driven by the fact that the 8" precast concrete panels were evaluated for 40psf load bearing capacity. However, upon more detailed review, it was determined that the panels 40psf loading reflected the windward side (controlling) loading corresponding to a 150mph wind (37.5psf is the actual value per page 9 of S2.1-SH-SF01).

15 Using Vd=150 mph for the screenhouse would result in more than a 50% increase in wind pressure CDF with 60% contribution to total wind pressure CDF from the screenhouse. Since the assumption of core damage with no mitigation for the failure of the screenhouse is conservative (see Assumption 1 in response to part e) of this question), the calculation of the penalty factors remains demonstrably conservative after removing conservatism from the fragility calculations of a single structure.

Supplemental Information Letter Page 47 of 82 Responses to NRC Audit Questions Table E4-4 will be updated to show 150 mph as the design capacity for the screenhouse, with the justification provided above. An updated version of Table E4-6, reflecting the changes to the screenhouse wind velocities is provided in the response to part e) below, as other values (e.g., c) have also changed.

d) The formula used to calculate Vm for the screenhouse has been updated to be consistent with the other NM1 structures in the evaluation. The formula used is:

Vm = Vd-3s * (Fs

Fd

Fp)

The factors in the median value calculation for the various structures are:

Fs: A conservative value of 1.1 is used for the strength factor of the screenhouse to account for material overstrength and modeling uncertainty for the screenhouse building due to the modeling simplicity of the structural system. The value used for the remaining buildings is the recommended 1.2 value (i.e., no change from the original submittal).

Fd: For the screenhouse, the ductility factor (Fd) was not considered (i.e., taken as 1.0), since compressive buckling was deemed to be the controlling failure mode, due to it's non-ductile nature. Also, a Fd value of 1.0 is used for the TB above 261 case since the non-Class I building has unknown failure modes (no change from the original submittal).

The ductility factor for all other Class I structures and adequately detailed non-safety-related structures was taken as 1.25 (no change from the original submittal). This value is conservative since the typical ultimate-to-yield-stress ratio for steel (typically controlling ductile failure modes) is closer to 1.5.

Fp: The pressure factor (Fp) value for all structures was taken as 1.3 (no change from original submittal), reflecting the upper bound of the recommended values due to the large area of the structures under consideration and inherent wind pressure variability on large surfaces, especially on roofs.

An updated version of Table E4-6, reflecting the changes to the screenhouse velocities, is provided in the response to part e) below, as the values for c have also changed.

e) The selection of values for all evaluated structures was reviewed; changes were made to the values, as discussed below. Eq. 4-10 of EPRI report 3003003107 is:

r or u = (s2 + d2 + p2)

A s value of 0.15 was conservatively used to reflect the strength variability. This is in line with values proposed in the literature16 for overstrength. A value closer to the lower bound of the proposed s value range was deemed more reasonable to be used due to the overstrength typically observed in dynamic-dominated loading, such as wind.

A d value of 0.08 was used to reflect the ductility variability. The lower bound value was deemed reasonable to be used in tandem with the conservative value for the median 16 M.K. Ravindra, State-of-the-Art and Current Research Activities in Extreme Winds Relating to Design and Evaluation of Nuclear Power Plants, The Tornado: Its Structure, Dynamics, Prediction, and Hazards, Geophysical Monograph 79, American Geophysical Union, 1993. [Note: this is Reference [95] in EPRI 3002003107]

Supplemental Information Letter Page 48 of 82 Responses to NRC Audit Questions capacity calculation (typical values of ultimate-to-yield-stress ratios). For structures where the controlling failure mode was brittle or unknown (i.e., the screenhouse and TB above 261) no variability was considered since Fd is equal to 1.0.

A p value of 0.15 was used to reflect the pressure variability. The lower bound value was deemed appropriate to be used for this calculation due to the well-studied aerodynamics of the building shapes that have been evaluated. Additionally, the majority of the controlling structural elements were found to be the roof (panels or structure). Since wind pressure variability is more prominent on flat roofs (variability depending also on wind direction for rectangular roofs), the Fp value of 1.3 is considered conservative, thus a lower bound value for p is deemed appropriate.

In the majority of the cases, variabilities are considered nested into a composite variability (c) based on guidance provided by Park and Reich (BNL-61588)17 and the definition of epistemic and aleatoric variability. Thus, s and d can be associated with u, and p can be associated with r. This is because of the inherent statistical variability of strength and inelastic properties of materials, whereas for pressure it expresses the inherently random effects that are associated with wind loading.

Thus, the composite c is calculated as the square root of the sum of the squares of s, d, and p; it reflects both uncertainty and randomness:

c = (s2 + d2 + p2)

Using this equation and the values provided, c = 0.212 for the screenhouse and TB above 261' and c = 0.227 for all other structures. These are both higher than the c values used in the original LAR. Table 18-2 below is an updated version of Table E4-6, reflecting the changes to Vd and Vm for the screenhouse and c for all structures.

17 Park and Reich, BNL-61588, , "Probabilistic Wind/Tornado/Missile Analyses for Hazard and Fragility Evaluations, 1995 [Note:

this is Reference [98] in EPRI 3002003107]

Supplemental Information Letter Page 49 of 82 Responses to NRC Audit Questions TABLE 18-2 Updated Table E4-6: Wind Pressure Fragility Parameters for NMP1 Key Structures 3-sec Gust 3-sec Gust Design Wind Design Wind Median Speed Speed Capacity Capacity Capacity (Vd- Wind Speed (Vd) 3s) (Vm)

Description (mph) (mph) (mph) c Screenhouse (above Elev. 150(1) 200(2) 239.2 0.212 261')

Main Stack 145 165.6 231.2 0.227 EDG Building and Board 175 196.9 274.9 0.227 Rooms Reactor Building (El. 340' 190 212.2 296.3 0.227 Refuel Floor)

Reactor Building (Below 340') 300 323.2 451.4 0.227 Turbine Building (Battery 285 307.1 428.8 0.227 Rooms)

Turbine Building (Control 235 258.7 361.2 0.227 Room)

Turbine Building (Above Elev. 190 212.2 265.0 0.212 261')

Notes:

(1) The design wind speed for the screenhouse is 150 mph; see the response to part c).

(2) The design 3-sec gust wind speed (Vd-3s) is 200 mph, which is Vd-hc, as discussed in the response to part c).

As discussed here and in the response to part d), some conservatism was considered in the selection of the factors used to determine Am and c. It is acknowledged that each factor by itself is not always conservative (or could be more conservative). However, each aspect and variable of a demonstrably conservative analysis should not have to be conservative or bounding for the application of the analysis to result in conservative penalty factors. In addition to the conservative variable selections and other conservative assumptions (no offsite power recovery, no FLEX credit), there are several significantly conservative assumptions in how the penalty factors are calculated that must be considered:

1. The failure of each structure is assumed to result in core damage. There are two conservative aspects to this assumption.

a. The failure mode of the structure and the impact to the risk significant SSCs in the structure are assumed to be the worst case - all SSCs in the structure are considered to be failed due to catastrophic failure of the structure. This is very conservative, as the structure may fail such that only certain SSCs are affected while others may still be functional. For example, the DG building failure may only result in one DG failing.

Supplemental Information Letter Page 50 of 82 Responses to NRC Audit Questions

b. Even if all SSCs in certain structures are failed, core damage is guaranteed. For example, core damage mitigation is feasible following the failure of both DGs, using a combination of the Emergency Condenser system and FLEX. However, some structural failures (e.g., the Reactor Building), if catastrophic, would not be mitigated and core damage would be assured.

2. The CDF and LERF estimated, due to the failure of any of the structures, is applied as the increase in CDF and LERF (i.e, CDF and LERF). The penalty factor is used in RICT calculations to account for the increase in CDF and LERF as a result of the plant configuration. The penalty factor, as calculated for NM1, represents the base CDF and LERF associated with the wind-induced structural failures. Most configurations allowed by the RICT program would result in little or no increase in CDF and LERF due to structural failures. Even for risk significant SSCs, the CDF associated with failure of the DG building would not increase if a DG were unavailable, since the failure of the DG building is assumed to result in core damage, regardless of whether one or both DGs are available.

3. The failure probabilities (and hence CDF and LERF) of structures due to straight winds includes wind speeds above procedurally required shutdown conditions. N1-SOP-64, High Winds, directs the plant to be shut down when local wind speeds exceed 125 mph. Once the plant is shutdown, the RICT is exited and no longer applies. Eliminating the contribution of straight wind induced structural failures for wind speeds above 125 mph would result in at least a 50% reduction in wind pressure CDF. Even if delays result in not shutting down until winds are at 150 mph, there could be a substantial reduction in wind pressure CDF (e.g., ~20 - 25%).

f) The increased c values provided in the response to part e) of this question and shown in Table 18-2 are used to update the wind pressure CDF values. Table 18-3 below is an updated version of Table E4-7. It also includes the change to the main stack percentage contribution from 31% to 33% (for straight winds only), as described in the response to Audit Question 19. These changes resulted in an increase in the total CDF associated with wind pressure failures from 1.3E-6/yr. to 5.0E-6/yr. This is nearly a factor of 4 increase in CDF, primarily driven by straight wind failures.

The impact of the changes shown in Table 18-3 on the High Wind Penalty Factors are provided in response to part g), below. Since the updated c values are higher than in the original LAR and given the conservative nature of the penalty factor calculations, as described in the response to part e) above, no sensitivity cases are performed using more conservative values for c.

Supplemental Information Letter Page 51 of 82 Responses to NRC Audit Questions TABLE 18-3 Updated Table E4-7: Wind Pressure CDF Due to Failure of Key NMP1 Structures Wind Pressure CDF (/yr.)

Straight Structure Tornado Wind Total Contribution Screenhouse (WSH) 2.4E-07 1.8E-06 2.0E-06 40%

Main Stack (WSTK) 1.3E-07 1.6E-06 1.8E-06 35%

EDG Bldg. (WDG) 8.4E-08 4.6E-07 5.4E-07 11%

Reactor Bldg. (WRB) 4.0E-08 1.5E-07 1.9E-07 4%

TB - Battery Rooms (WTB1) 5.8E-10 3.8E-10 9.7E-10 <0.1%

TB - Control Room (WTB2) 4.7E-09 6.8E-09 1.2E-08 0.2%

TB - Above El. 261' (WTB3) 8.9E-08 4.0E-07 4.9E-07 10%

TOTAL 5.9E-07 4.5E-06 5.0E-06 100%

g) As described in Section 4.1 of Enclosure 4, there are two sets of CDF and LERF penalty factors, one for LCO configurations without a DG or DG Board unavailable and another for LCO configurations with a DG or DG Board unavailable. Since the wind pressure CDF and LERF have increased (see part f) above), the penalty factors will increase. There is no change to the tornado missile CDF (1.6E-6/yr.) or LERF.

The penalty factor calculations follow the same form as the calculations shown in Section 4.0 of Enclosure 4 (under the heading High Wind Risk for Maintenance Conditions), with the difference being the total (base) HWCDF is 6.6E-6/yr.

HWCDF = CDFWP + CDFTM = 5.0E-6/yr. + 1.6E-6/yr. = 6.6E-6/yr.

Since there are no changes to tornado missile risk, the increase in CDF during maintenance is unchanged from the original LAR:

One DG, DG board, battery, or battery board18 unavailable: CDFTM = 6.0E-6/yr.

All other configurations: CDFTM = 1.9E-6/yr.

Therefore, the updated penalty factors for HWCDF are:

LCOs not involving a DG, DG board, battery, or battery board:

CDF = 6.6E-6/yr. + 1.9E-6/yr. = 8.5E-6/yr. [70% increase from the original LAR]

LCOs involving a DG, DG board, battery, or battery board:

CDF = 6.6E-6/yr. + 6.0E-6/yr. = 1.3E-5/yr. [30% increase from the original LAR]

HWLERF penalty factors are determined by multiplying the HWCDF by 0.1 (i.e., the HWCLERP)

LCOs not involving a DG, DG board, battery, or battery board:

LERF = 8.5E-6/yr.

0.1 = 8.5E-7/yr.

18 During the updates to the penalty factor calculations, it was determined that the DG/DG Board case should also be used for configurations with a battery or battery board unavailable.

Supplemental Information Letter Page 52 of 82 Responses to NRC Audit Questions

LCOs involving a DG, DG board, battery, or battery board:

LERF = 1.3E-5/yr.

0.1 = 1.3E-6/yr.

NRC Follow-up Question to Audit Question 18 Response [Reference 8]

The NRC staff has two follow-up questions on the response to audit question 18:

1. The response part c or d did not provide any discussion why the high-confidence wind speed is used for the screenhouse, while the 3-second gust wind speed is used for all other structures. Explain why the screenhouse uses a different method than all other structures.

2. In Response part e, the uncertainty c calculation is not consistent with Equation 4-10 of EPRI 3002003107, where it shows r or u = (s2 + d2 + p2)0.5, but not c. Provide justification for deviation from EPRI 3002003107.

Constellation Response to NRC Follow-up Question for Audit Question 18 Response:

1. The responses to parts c and d above are revised to explain the method used for the screenhouse.

2. The response to Part e above is revised to provide justification for the deviation from EPRI 3002003107.

Audit Question-19 (APLC - RICT) - Calculation of the Main Stack Contribution to High Wind CDF Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by "performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT."

According to Table E4-7 of Enclosure 4 to the LAR, the Main Stack contributes to 48% of the wind pressure CDF penalty due to failure of key structures at NMP1. The LAR states "the stack is the most significant contributor due to its relatively low fragility" The LAR also states "For the stack, only 31% of the stack failure frequency results in failure of a key structure (EDG building, screenhouse, or reactor building.)" The calculation of the 31% stack failure frequency is provided in N1-MISC-021, "NMP1 High Winds and Tornado Risk Assessment." The calculation assumes that the stack can fall in any direction with equal probability and only a certain fraction of the stack failure directions will result in the failure of a key structure. From the spatial diagram in N1-MISC-021, it appears that the key structures all lay within approximately a 190-degree arc of the main stack.

Justify that the omission of site wind direction data for determining the stack failure direction probability for this important contributor to high wind CDF penalty is conservative or include wind direction data for the site into the calculations.

Constellation Response:

Upon further review of the stack structure, a calculation was performed that determined the height of maximum stress (and point of stack failure) to be at approximately elevation 315' (~74' above the base of the stack). As a result, it can be considered that the ~296' of stack above the Supplemental Information Letter Page 53 of 82 Responses to NRC Audit Questions height of maximum stress would topple as a single body upon failure. This is in close agreement with Section III-3.2 of the UFSAR, which states that approximately 280' of stack would topple intact. The direction of the topple would be predominantly dictated by the wind direction at the time of failure. A smaller amount of debris is expected to be present closer to the stack base, with insignificant consequences to risk significant structures.

Average local wind directions were used to determine the percentage of stack failures which are assumed to result directly in core damage. Conservatively, the percentage of winds assumed to cause failure of the stack in the directions shown in Figure III-23 of the UFSAR were increased by only ~2% (from 31% to 33%). This is only applicable to failures from straight winds since tornado wind directionality at the location of the stack can be considered uniformly random due to its stochastic nature; 31% of stack failures due to tornadic winds are considered to result in core damage.

Using the updated value of 33%, the CDF contribution of stack failures (in Table E4-7 of the LAR) increases the total wind pressure risk by ~4E-8/yr. from 6.3E-7/yr. to 6.7E-7/yr. Any potential impact of this change on the penalty factor(s) is included in the updated response to Audit Question 21.

NRC Follow-up Question to Audit Question 19 Response In the draft response to AQ-19, the licensee stated that average local wind directions were used to determine the percentage of stack failures which are assumed to result directly in core damage. They also stated that the percentage of winds assumed to cause failure of the stack were conservatively increased by 2% (from 31% to 33%) for straight winds. The staff requests review of a summary of the wind direction data the licensee used as well as the calculations and assumptions made to derive the 33% value for percentage of stack failures that would result in core damage.

Constellation Response to NRC Follow-up Question for Audit Question 19 Response:

To determine the likelihood of winds that can cause the stack to fall on one of the critical SSCs (DGs, Screenhouse (SH), and Reactor Building (RB)) shown in the shaded areas of UFSAR Figure III-23, wind roses were obtained from the Northeast Regional Climate Center (NRCC).

Wind rose data from the NRCC is based on hourly observations from select weather stations.

https://www.nrcc.cornell.edu/wxstation/windroses/windroses.html The Oswego-Fulton-County Airport (KFZY) wind rose data was used to represent the wind at the site. This is the closest weather station (approximately 12 miles south of the site) with wind rose data in the NRCC database. Data was collected for the time period 1/1/00 to 6/22/23

(~22.5 years).

The 36-point wind rose was chosen; it provides the percentage of winds greater than 3 knots (3 kts

1.151 ~3.5 mph) that come from every 10 degrees of the compass rose (e.g., 170°,

180°, 190°).

Supplemental Information Letter Page 54 of 82 Responses to NRC Audit Questions The sum of percentages from the 36 compass points does not add up to 100%, since some of the time winds are either calm or variable (Vrb).

Calm Per the AMS (American Meteorological Society) Glossary of Meteorology:

The National Weather Service reports a wind as calm when it is determined to have a speed of less than three knots.19

Variable (Vrb)

The NRCC provided a definition for variable winds [Ref Email from NRCC on 6/22/23 Re: ACIS Wind Rose Data]: "variable wind is reported when the wind direction varies by 60 degrees or more during the 2-minute observation period."

The purpose of this effort is to determine the likelihood of high winds (of sufficient speed to affect the stack) originating from certain directions. Therefore, the percentage of calm winds is not relevant (and no directional data is provided for calm winds). For variable winds, the wind is coming from significantly different directions in a short period of time. Although variable winds may come from directions affecting the stack, there is no directional data provided for variable winds.

Since wind direction data for ~27% of the time is not provided (i.e., either calm or variable), the wind direction data is normalized to ~73% of the time with data. The percentages provided for each direction are divided by ~73% to determine the normalized wind direction percentages.

This can be seen in the % w/o Vrb/Calm column in Table 19-2.

Using the shaded areas from UFSAR Figure III-23 as the directions in which stack failure is assumed to result in core damage, normalized data is selected from wind directions 180° opposite the shaded directions (the direction the winds are coming from) to determine the total percentage of winds which are assumed to result in core damage due to stack failure. Figure 19-1 shows the 36-point wind rose overlaid with UFSAR Figure III-23. The data obtained from NRCC is shown in Table 19-2.

The wind directions chosen for each structure are noted in the column 'Affected Structure' in Table 19-2. The percentage of winds affecting each structure is summed in Table 19-1. The total (32.5%) is rounded to 33%.

Note that data from each direction includes winds from within 5° of that direction. For example, winds from 0° includes all winds from 355° to 005°. Therefore, the totals in Table 19-1 include winds from 10° more than the width of the shaded areas in Figure III-23. For example, winds from 350° and 000° were selected for the DG. This represents winds from 345° to 005°, or 20°.

However, the shaded area for the DG in Figure III-23 is a little less than 10° wide.

19 This is confirmed by setting the low end of the windspeed ranges for the ACIS wind roses to <=3 mph (had 0% occurrence) and

<=4 mph (which had data). Therefore, the <=5 mph default bin is actually 3-5 mph, and calm is everything <3 mph.

Supplemental Information Letter Page 55 of 82 Responses to NRC Audit Questions Figure 19-1 Wind Rose Superimposed with UFSAR Figure III-23 Table 19-1 Total Percentage of Winds Affecting Each Structure Normalized Structure Percentage Degrees DG 4.4% 20 SH 24.4% 80 RB 3.7% 60 Total 32.5% 160 Supplemental Information Letter Page 56 of 82 Responses to NRC Audit Questions Table 19-2: Percent of Winds from Each Direction (by Wind Speed in mph) 5 to 10 to 15 to 20 to 25 to 30 to 35 to 40 to All % w/o Affected 5 >45 10 15 20 25 30 35 40 45 Winds Vrb/Calm Structure 0 0.3 0.8 0.5 0.1 0.0 0.0 0.0 0.0 0.0 0.0 1.7% 2.3% DG 10 0.2 0.7 0.5 0.1 0.0 0.0 0.0 0.0 0.0 0.0 1.5% 2.1%

20 0.3 0.6 0.3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.2% 1.7%

30 0.4 0.4 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.9% 1.2%

40 0.3 0.2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5% 0.7% RB 50 0.2 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.3% 0.4% RB 60 0.2 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.3% 0.4% RB 70 0.3 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.4% 0.6% RB 80 0.3 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.4% 0.6% RB 90 0.5 0.3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.8% 1.1% RB 100 0.8 0.8 0.2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.8% 2.5%

110 1.1 1.4 0.4 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.9% 4.0% SH 120 1.5 1.7 0.5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 3.7% 5.1% SH 130 1.4 1.4 0.3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 3.1% 4.3% SH 140 0.8 0.6 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.5% 2.1% SH Supplemental Information Letter Page 57 of 82 Responses to NRC Audit Questions Table 19-2: Percent of Winds from Each Direction (by Wind Speed in mph) 5 to 10 to 15 to 20 to 25 to 30 to 35 to 40 to All % w/o Affected 5 >45 10 15 20 25 30 35 40 45 Winds Vrb/Calm Structure 150 0.4 0.3 0.1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.8% 1.1% SH 160 0.4 0.5 0.2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.1% 1.5% SH 170 0.5 1.0 0.5 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.1% 2.9% SH 180 0.5 1.2 0.7 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.5% 3.4% SH 190 0.5 1.3 0.6 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.5% 3.4%

200 0.5 1.2 0.4 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.1% 2.9%

210 0.5 1.0 0.4 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.9% 2.6%

220 0.6 1.1 0.4 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.2% 3.0%

230 0.6 1.1 0.6 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.4% 3.3%

240 0.5 1.0 0.8 0.2 0.1 0.0 0.0 0.0 0.0 0.0 2.6% 3.6%

250 0.4 0.9 0.8 0.3 0.1 0.0 0.0 0.0 0.0 0.0 2.5% 3.4%

260 0.3 0.8 0.8 0.4 0.1 0.1 0.0 0.0 0.0 0.0 2.5% 3.4%

270 0.3 1.0 1.1 0.5 0.2 0.1 0.0 0.0 0.0 0.0 3.2% 4.4%

280 0.3 1.2 1.5 0.7 0.2 0.1 0.0 0.0 0.0 0.0 4.0% 5.5%

290 0.4 1.3 1.5 0.6 0.2 0.1 0.0 0.0 0.0 0.0 4.1% 5.6%

Supplemental Information Letter Page 58 of 82 Responses to NRC Audit Questions Table 19-2: Percent of Winds from Each Direction (by Wind Speed in mph) 5 to 10 to 15 to 20 to 25 to 30 to 35 to 40 to All % w/o Affected 5 >45 10 15 20 25 30 35 40 45 Winds Vrb/Calm Structure 300 0.4 1.3 1.3 0.5 0.2 0.0 0.0 0.0 0.0 0.0 3.7% 5.1%

310 0.5 1.3 1.1 0.3 0.1 0.0 0.0 0.0 0.0 0.0 3.3% 4.5%

320 0.4 1.2 0.9 0.2 0.0 0.0 0.0 0.0 0.0 0.0 2.7% 3.7%

330 0.4 1.0 0.7 0.1 0.0 0.0 0.0 0.0 0.0 0.0 2.2% 3.0%

340 0.3 0.8 0.5 0.1 0.0 0.0 0.0 0.0 0.0 0.0 1.7% 2.3%

350 0.3 0.7 0.4 0.1 0.0 0.0 0.0 0.0 0.0 0.0 1.5% 2.1% DG Subtotal 72.6%

Vrb 7.1%

Calm 20.0%

TOTAL 99.7%(1) 100.0%

Supplemental Information Letter Page 59 of 82 Responses to NRC Audit Questions Audit Question-20 (APLC - RICT) - NMP1 Tornado Missile Vulnerability Analysis Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by "performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT." of the LAR provides CDF and large early release frequency (LERF) risk values for NMP1s tornado missile assessment. However, it does not provide details on the methodology used for this analysis. The NRC staff noted that the NMP1 high winds assessment states that the risk is evaluated using a simple tornado missile target model, based on the methods in NEI 17-0220. It is unclear to the NRC staff if the NMP1 tornado risk analysis consisted of any deviations from the NEI 17-02 methodology and data.

a) Describe the "simple tornado missile target model, based on the methods in NEI 17-02" used for the licensees tornado missile risk analysis.

b) Clarify if the NMP1 tornado missile risk analysis deviated from the NEI 17-02 methods and data. Provide details, if any, for each deviation.

c) Provide justification for the use of all deviations, if any, in calculating NMP1s tornado missile risk. Include in this discussion how the deviations do not significantly impact RICT calculations.

Constellation Response:

a) A general description of the method used to develop the tornado missile CDF and LERF values for NMP1 is described in Enclosure 4 in Reference 1 starting on page E4-25.

Additional clarification is provided below. See Attachment 6 for the Revised Enclosure 4.

The 'simple tornado missile target model' would be better described as a tornado missile target 'risk analysis,' in that a model consisting of event trees and fault trees was not created. Rather, frequencies and probabilities of tornado missile failure were calculated for combinations of significant tornado missile targets (e.g., both ECs, both DGs). The targets are listed and described on page E4-26 (Reference 1) and the combinations of targets that are assumed to lead directly to core damage are listed on pages E4-28 to E4-30 in Reference 1.

The failure frequency for each target in Table E4-8 in Reference 1 is the sum of the products of tornado hazard frequency and target failure probability over the five F'2 - F'6 tornado hazard intervals. It is only the target failure probability calculations that are based on NEI 17-02, specifically methods for calculating 'Exposed Equipment Failure Probabilities' (EEFPs) described in Section 5 of NEI 17-02.

The EEFP for a given target is calculated for five intervals, F'2 - F'6. These same intervals are used in the NMP1 calculations.

The Missile Impact Parameters (MIP) from Table 5-1 of NEI 17-02, Rev 1b, are used in the NMP1 calculations.

20 NEI 17-02, "Tornado missile Risk Evaluator (TMRE) Industry Guidance Document, Revision 1B, dated September 2018 (ML18262A328).

Supplemental Information Letter Page 60 of 82 Responses to NRC Audit Questions

The missile inventories in Table 5-1 of NEI 17-02 is used, based on estimates of NMP1 missile inventory being less than the maximum missile inventory of 240,000 missiles in NEI 17-02.

Robust Categories, described in Table 5-2 of NEI 17-02, were used where appropriate to reduce the missile inventory for certain targets.

Target areas were estimated from plant drawings and walkdown information. In general, target areas were conservatively estimated to be the entire area of the exposed walls or roofs of the areas around the targets.

The resultant tornado missile induced SSC failure probabilities were convolved with the applicable hazard frequencies to determine target failure frequencies. Also shown in Table E4-8 is the target failure probability. This is calculated by dividing the total failure frequency by the tornado hazard frequency for F'2 and greater tornados. The failure frequency of two targets combined (in the same event but by different tornado missiles) is the product of the failure frequency for one and the failure probability for the other.

b) As discussed in the response to 20.a), the NEI 17-02 method is used to calculate the tornado missile failure probabilities. The only deviation (other than conservative deviations allowed by NEI 17-02) is for the battery or battery board room calculations.

The battery and battery board rooms are protected with exterior walls made from 8" concrete panels. Although 8" concrete panels are not considered in a robust category in NEI 17-02, they do provide considerable protection against tornado missiles. [Note:

Robust Category H in Table 5-2 of NEI 17-02 is for 8" reinforced concrete roofs; however, lower (vertical) missile speeds were used to develop that robust category].

Using a similar method as described in Sections C.3 and B.6 of NEI 17-02, it was determined that only 40% of missiles could penetrate the 8" concrete panels. This value (40%) was used to reduce the EEFP calculations for the battery and battery board room walls.

c) The deviation made to consider the battery and battery board room exterior walls as robust is consistent with the methodology in NEI 17-02. The analysis of the panel capacities to prevent perforation or global failure was done in the same manner as performed for part of Section C.3 of the NEI 17-02. Therefore, it was considered appropriate from a technical perspective.

A sensitivity was performed as part of this question response to determine the impact on the HW/TM penalty values of considering the 8" concrete panels as not robust (i.e.,

100% of missiles will penetrate the panels at all tornado intervals). The results are:

DC Battery and Battery Board CDF (Table E4-9) increased from 3.2E-9/yr. to 1.8E-8/yr.

DC and EDG SSCs CDF (Table E4-9) increased from 5.7E-8/yr. to 1.4E-7/yr.

Total Tornado Missile CDF increased from 1.6E-6/yr. to 1.65E-6/yr.

DG Maintenance CDF increased from 6.0E-6/yr. to 6.4E-6/yr.; however, the HWCDF penalty value for DG maintenance is unaffected since there is adequate margin between the total configuration CDF and the penalty factor value.

Supplemental Information Letter Page 61 of 82 Responses to NRC Audit Questions Therefore, this deviation has minimal impact on the total estimated tornado missile CDF and no impact on the HW/TM CDF and LERF penalty values and RICT Calculations.

Audit Question-21 (APLC - RICT) - High Wind Risk for Maintenance Configurations Section 2.3.1, Item 7 of NEI 06-09-A, states that the "impact of other external events risk shall be addressed in the RMTS program" and explains that one method to do this is by "performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT." The NRC staffs SE for NEI 06-09 states that "[w]here PRA models are not available, conservative, or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT."

Under the subsection of "High Wind Risk for Maintenance Configurations," the licensee provided one DG or respective DG board unavailable delta CDFTM = 6.0E-6 /yr, and one train of EC or associated equipment unavailable delta CDFTM =1.9E-6 /yr. It is not clear to the NRC staff how these values were calculated.

Explain how these delta CDF values are calculated and the calculation method used.

Constellation Response:

As NMP1 does not have a high winds PRA, these risk estimation calculations are performed as convolution calculations (of high wind hazard curve and high-wind induced failures) in a computer spreadsheet (typical of such calculations). As discussed in the "High Wind Risk for Maintenance Configurations" in Section 4 of Enclosure 4 in Reference 1, since the HWCDF contribution from wind pressure failures is based on assuming that any structural failure has a CCDP = 1, maintenance configurations do not affect the estimated CDF from wind pressure failures (also see response to Question 18.f). It is the HWCDF tornado missile induced failure frequencies that are used to estimate HWCDF for maintenance configurations.

Note: The base HWCDF was changed in response to Audit Question 18, due to increases in the wind pressure CDF. The updated HWCDF from the response to Question 18.g is used here.

However, there was no change to the tornado missile CDF values, in either the base or maintenance cases.

One DG, DG Board, Battery, or Battery Board OOS21 To calculate the HWCDF associated with one DG (or one DG Board) out of service (OOS), it is appropriately assumed that tornado-missile induced failure of one or more of the following SSCs results in a CCDP of 1.022:

Opposite train DG

Opposite train DG Board

Opposite train Battery

Opposite train Battery Board 21 The original LAR considered a separate penalty factor for configurations involving DG or DG board unavailability. During the re-evaluation of the penalty factor in response to Audit Question 18, it was determined that this higher penalty factor should also apply to configurations involving battery or battery board unavailability. See the response to Question 18.g.

22 Failure of the DG Cooling Water (DGCW) pumps would also result in a loss of the available DG, but the DGCW pumps are correlated (a single missile is postulated to fail both pumps) and they are a separate target whose failure is assumed to lead directly to core damage.

Supplemental Information Letter Page 62 of 82 Responses to NRC Audit Questions Assuming no recovery of offsite power in the short term (reasonable for a tornado induced loss of power), any of the above tornado-induced failures in combination with the opposite DG, DG board, battery, or battery board OOS will lead to a loss of all AC power and eventual core damage. This risk estimation does not credit the potential recovery options using FLEX equipment. Therefore, the frequencies of the tornado missile induced failure of one train of DG, DG board, battery, and battery board are summed to obtain an estimate of the HWCDF for this OOS configuration.

The tornado missile induced failure frequencies used to determine the risk increase can be found in Table E4-8 of the submittal. In the case of DGs, the tornado missile induced failure probability of DG2 is higher than for DG1 (DG2 exposed wall area is larger than that of DG1), so the unavailability of DG1 is the case conservatively used in the LAR to determine the risk increase (i.e., if DG1 is unavailable, the probability that the opposite train DG fails due to tornado missiles is higher than if DG2 were unavailable).

Supplemental Information Letter Page 63 of 82 Responses to NRC Audit Questions The values used in the estimate are:

SSC TM Failure Frequency DG2 4.3E-6/yr.

DGB102 1.5E-6/yr.

Batt Rm 12 1.8E-7/yr.

Batt Bd Rm 12 6.8E-8/yr.

TOTAL 6.0E-6/yr.

Therefore, the increase in TM CDF with one DG, DG board, battery, or battery board unavailable is 6E-6/yr.

Note: 6.0E-6/yr. is the CDF increase; the base HWCDF from tornado missiles and wind pressure is 6.6E-6/yr., which is conservatively added to the risk increase to determine the penalty factor.

6.0E-6 + 6.6E-6 = 1.3E-5/yr.23 One Train of EC OOS If one train of EC or its support equipment is unavailable, the simplified risk assessment assumes that the failure of the opposite train EC (or its support equipment) will result in core damage. As discussed above, this risk estimation does not credit offsite AC recovery or use of FLEX strategies. In addition, use of the diesel fire pump for direct re-filling of the ECs is not credited in this risk estimation. Both EC trains have the same tornado missile induced failure frequencies. From Table E4-8 of the LAR submittal:

SSC TM Failure Frequency EC Condenser 6.8E-7/yr.

EC Makeup Tank/Piping 1.2E-6/yr.

TOTAL 1.9E-6/yr.

Therefore, the increase in TM CDF with one EC or its support equipment unavailable is 1.9E-6/yr.

Note: The above CDF increase is added to the base HWCDF of 6.6E-6/yr. (see discussion on DG above); the total HWCDF for this OOS case is 8.5E-6/yr.

Audit Question-22 (APLA - 50.69) - Credit for FLEX Equipment and Actions NRC memorandum dated May 6, 202224 provides the NRCs staff updated assessment of identified challenges and strategies for incorporating Diverse and Flexible Mitigation Capability (FLEX) equipment into a probabilistic risk assessment (PRA) model in support of risk-informed decisionmaking in accordance with the guidance of RG 1.20025.

23 In the original LAR, penalty factor calculation results were rounded up to obtain the final CDF and LERF penalty factors. This conservatism is no longer applied to any of the penalty factors.

24 U.S. NRC memorandum, "Updated Assessment of Industry Guidance for Crediting Mitigating Strategies in Probabilistic Risk Assessments," dated May 6, 2022 (ML22014A084).

25 U.S. Nuclear Regulatory Commission, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities, "RG 1.200, Revision 3, December 2020 (ML20238B871).

Supplemental Information Letter Page 64 of 82 Responses to NRC Audit Questions With regards to equipment failure probability, in the memorandum dated May 6, 2022, the NRC staff states in Conclusion 4:

Licensees that choose not to use the generic failure probabilities in PWROG-18042 to develop plant-specific failure probabilities for portable FLEX equipment modeled in PRAs used for risk-informed applications should submit a justification for the methods and probabilities used to the NRC for review and approval.

It appears that NUREG-6928 fixed equipment failure rates (with a 2x increase) were used as probabilities for FLEX portable equipment. It is unclear to the NRC staff how the NMP1 approach satisfies the concerns of Conclusion 4.

With regards to the uncertainty related to equipment failure probabilities, in the updated NRC memorandum, the NRC staff states in Conclusion 8:

PWROG-18043, Revision 1, notes that there was insufficient data to quantify the failure to load probabilities for portable diesel generators due to lack of detailed data. To account for the uncertainty in the testing activitieslicensees should ensure their preventive maintenance strategies include such testing and that the data reported provides this information. licensees should continue to assess the uncertainty in equipment failure rates and address or disposition it.

The NRC staff notes the results of a FLEX sensitivity study was provided by the licensee; however, it is unclear to the NRC staff if this sensitivity addresses the concerns of Conclusion 8.

For example, the licensees FLEX sensitivity study increased the FLEX maintenance unavailability factors by a factor of 10 (i.e., from 0.01 to 0.1). However, failure probability uncertainties associated with other FLEX failure modes may have a greater impact on risk (e.g.,

FLEX generator fails to run after first hour has a failure probability of 6.16E-2 in the licensees analysis and the uncertainty associated with this failure probability is likely to significantly increase the risk impact). The FLEX failure probabilities assumed in the licensees sensitivity study appears to be noticeably lower than that in PWROG-18042, which was approved by NRC (e.g., fail-to-start probability of the portable diesel-driven pump in PWROG-18042 is a factor of 17 higher than that assumed in the licensees sensitivity study). The results from the FLEX sensitivity study demonstrate a change of 28.8% in CDF value, which seems to indicate that FLEX failure probabilities are a key source of uncertainty.

With regards to human reliability analysis (HRA), in the memorandum dated May 6, 2022, the NRC staff states, in part, in Conclusion 11:

EPRI 3002013018 provides updated detailed industry guidance for estimating the human error probabilities (HEPs) of the actions needed to implement mitigating strategies using portable equipment. EPRI 3002013018 provides guidance that is acceptable to the NRC, with the clarifications below...

FLEX actions were developed by the licensee using the methodologies provided in EPRI 3002013018. However, it is unclear to the NRC staff how NMP1 analysis addressed the staff clarifications on the use of the EPRI guidance.

With regards to PRA upgrade, the NRC staff states in the updated NRC memorandum in Conclusion 2:

Therefore, Conclusion 2 remains unchanged [that] for any new risk-informed application that has incorporated mitigating strategiesthe licensee should either perform a Supplemental Information Letter Page 65 of 82 Responses to NRC Audit Questions focused-scope peer review of the PRA model or demonstrate [that it does not meet the three criteria of an PRA upgrade].

The NRC staff notes that the NMP1 PRA models appear to utilize updated industry guidance, and therefore, it is unclear whether the FLEX analysis is an PRA upgrade for NMP1.

Given these observations, address the following:

a) Describe the methodology used to assess the failure probabilities of any modeled equipment credited in the licensee's mitigating strategies (i.e., FLEX). The discussion should include a justification of the rationale for parameter values, and how the uncertainties associated with the parameter values are considered in 50.69 categorization in accordance with ASME/ANS RA-Sa-200926, as endorsed by RG 1.200 (e.g., supporting requirements for HLR-DA-D). This justification should also disposition any significant differences between these FLEX parameter values and those generic failure probabilities in PWROG-18042.

-OR-Alternatively, propose a mechanism to incorporate into the NMP1 PRA models updated FLEX parameter values prior to implementing 50.69.

b) Provide a discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include:

i. A summary of how the licensee evaluated the impact of the NRC clarifications in memorandum dated May 6, 2022, with regards to using the EPRI 3002013018 FLEX HRA methodology.

ii. Provide updated FLEX HRA results, if required, to address the NRC clarifications.

iii. Provide justification that the use of the EPRI FLEX HRA methodology does not meet the definition of an PRA upgrade as defined by RG 1.200.

Alternatively, if a justification is not provided, propose a mechanism to conduct a focused-scope peer review (FSPR) regarding incorporation of the EPRI FLEX HRA method for the NMP1 PRA models. Include in the mechanism to close out all F&Os that result from the FSPR prior to implementing 50.69.

c) [Note: Question 22.c is revised in accordance with Reference 7]. Provide an updated assessment of the impact on 50.69 SSC categorization by FLEX equipment credited in NMP1's PRA models. This assessment should include, if required, any modifications to FLEX modeling based on the issues raised in this question. Include in this discussion, the impact of FLEX on exceeding importance rankings for affected SSCs and whether the uncertainty associated with FLEX modeling is a key source of uncertainty for 50.69. If this uncertainty is "key," then describe and provide a basis for how this uncertainty will be addressed for 50.69 categorization.

Two examples of sensitivity studies:

-ML20303A307 (APLA RAI 05, Tables APLA-05-A.2 and APLA-05-A.3) 26 American Society of Mechanical Engineers (ASME)and American Nuclear Society (ANS) PRA standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009, New York, NY (Copyright).

Supplemental Information Letter Page 66 of 82 Responses to NRC Audit Questions

-ML20177A535 (APLA RAI 03: Tables B-1 and B-2)

Constellation Response:

a) See the response to Question APLA-06a.

b)i See the response to Question APLA-06bi.

b)ii See the response to Question APLA-06bii.

b)iii` See the response to Question APLA-06biii.

c) A revised sensitivity assessment has been performed. For this sensitivity, the PWROG values developed for Question 6, and repeated in Table 22c-1, have been applied to the NMP1 Average Maintenance model to develop a set of importance measures which reflect unadjusted use of the PWROG FLEX data.

Table 22c Comparison of FLEX Equipment Failure Rate Estimates Equipment Failure Mode NMP1 PWROG-18042-(Base Model) NP Failure to Start 5.41E-03 4.35E-02 Failure to Run 7.44E-03 (1st hour) 1-EXP(-1.03E-2 Failure to Run after 2.68E-03/hr*24 hr= *24) = 2.19E-01 Portable 1st hour 6.16E-02 Generator (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months )

Maintenance 1.00E-02 N/A Unavailability Total Failure 8.45E-02 2.63E-01 Probability Failure to Start 6.19E-03 3.38E-02 Failure to Run 4.02E-03 (1st hour) 1-EXP(-1.55E-2 Failure to Run after 5.95E-05/hr*23 hr= *24) = 3.11E-01 Portable 1st hour 1.37E-03 Pump (23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months )

Maintenance 1.0E-02 N/A Unavailability Total Failure 2.16E-02 3.44E-01 Probability The vast majority of components retained their base significance (HSS or LSS) in the sensitivity assessment. However, 21 basic events representing a handful of components have different significance in the PWROG sensitivity versus the base model results.

Table 22c-2 provides a listing of these basic events. Conclusion from review of Table 22-2:

The first 8 rows of Table 22c-1 shows that the FLEX equipment is LSS in the Base model and HSS in the sensitivity model. This is expected due to the higher failure rates Supplemental Information Letter Page 67 of 82 Responses to NRC Audit Questions employed in the sensitivity case. However, it is highly unlikely that the FLEX system would part of 50.69 categorization.

Another 8 basic events reflect EDG failure modes which are individually LSS in the Base Model and HSS in the sensitivity model. However, the sum of the F-V basic events for the EDG system components are already HSS hence there will be no change in categorization results for the EDGs. Note that RLY_74A10__RAZMD "RLY-(CO2)74A10 Relay Spuriously Actuates" is associated with EDG room cooling.

The Check Valve associated with the Diesel Fire Pump (DFP) makeup pathway is LSS in the Base Model and HSS in the sensitivity model. The DFP is assigned HSS in the base model based on other Basic Events which are HSS in the base model results.

Note that spurious operation of two circuit breakers, BKR-(17/007B)R1052/612 and BKR-(16/008B)R1042/602, drop from HSS to LSS in the sensitivity assessment. This occurs because their RAW values drop slightly due to being a smaller contributor to a higher sensitivity CDF.

In summary, the results of the sensitivity case show that there would be no change to the categorization of any systems that would be likely candidates for categorization.

Supplemental Information Letter Page 68 of 82 Responses to NRC Audit Questions Table 22-2 Importance Value Comparison Core Damage LERF Significance Basic Event Description FV RAW FV RAW Base PWROG Base PWROG Base PWROG Base PWROG Base PWROG 600V FLEX Portable Diesel Generator EG_FLEXA___GAFR1 2.80E-03 1.90E-01 1.37 1.67 0.00E+00 1.01E-03 1.00 1.00 LSS HSS BDB-GENA FTR 1st Hour 600V FLEX Portable Diesel Generator EG_FLEXB___GAFR1 2.80E-03 1.90E-01 1.37 1.67 0.00E+00 1.01E-03 1.00 1.00 LSS HSS BDB-GENB FTR 1st Hour Diesel Driven FLEX PMP_FLEX_A_PFFR1 Pump A FTR 1st 6.00E-05 7.22E-02 1.01 1.15 0.00E+00 1.87E-02 1.00 1.04 LSS HSS Hour Diesel Driven FLEX PMP_FLEX_B_PFFR1 Pump B FTR 1st 6.00E-05 7.22E-02 1.01 1.15 0.00E+00 1.87E-02 1.00 1.04 LSS HSS Hour 600V FLEX Portable EG_FLEXA___GAFS1 Diesel Generator 2.01E-03 3.72E-02 1.37 1.80 0.00E+00 3.00E-05 1.00 1.00 LSS HSS BDB-GENA FTS 600V FLEX Portable EG_FLEXB___GAFS1 Diesel Generator 2.01E-03 3.72E-02 1.37 1.80 0.00E+00 3.00E-05 1.00 1.00 LSS HSS BDB-GENB FTS Diesel Driven FLEX PMP_FLEX_A_PFFS1 2.00E-05 7.53E-03 1.01 1.20 0.00E+00 1.75E-03 1.00 1.05 LSS HSS Pump A FTS Diesel Driven FLEX PMP_FLEX_B_PFFS1 2.00E-05 7.53E-03 1.01 1.20 0.00E+00 1.75E-03 1.00 1.05 LSS HSS Pump B FTS EG-EDG102 Fails to EG_EDG102__GAZR1 3.29E-03 5.26E-03 1.87 2.39 9.90E-04 9.70E-04 1.27 1.26 LSS HSS Run for First Hour EG-EDG102 Fails to EG_EDG102__GAZS1 2.36E-03 3.79E-03 1.86 2.38 6.80E-04 6.70E-04 1.25 1.24 LSS HSS Start BKR-(101/2B-BKR_R1012__CAZO1 1)R1012/151 Fails to 1.77E-03 2.85E-03 1.85 2.36 4.70E-04 4.60E-04 1.22 1.22 LSS HSS Open Supplemental Information Letter Page 69 of 82 Responses to NRC Audit Questions Table 22-2 Importance Value Comparison Core Damage LERF Significance Basic Event Description FV RAW FV RAW Base PWROG Base PWROG Base PWROG Base PWROG Base PWROG BKR-(102/2-BKR_R1022__CAZP1 1)R1022/571 Fails to 1.77E-03 2.85E-03 1.85 2.36 4.70E-04 4.60E-04 1.22 1.22 LSS HSS Close PMP-82-40 Fails to PMP_82_40__PCZS1 Start, DG102 Fuel Oil 1.34E-03 2.16E-03 1.84 2.34 3.40E-04 3.40E-04 1.22 1.21 LSS HSS Transfer PMP-82-40 Fails to Run after 1st hour, PMP_82_40__PCZR2 4.70E-04 7.70E-04 1.76 2.25 1.00E-04 1.00E-04 1.16 1.16 LSS HSS DG102 Fuel Oil Transfer PMP-79-54 Fails to Run after 1st hour, PMP_79_54__PCZR2 5.90E-04 7.40E-04 1.95 2.20 3.50E-04 3.40E-04 1.57 1.56 LSS HSS DG103 Cooling Water PMP-82-40 Fails to Run in 1st hour, PMP_82_40__PCZR1 8.00E-05 1.30E-04 1.63 2.05 1.00E-05 1.00E-05 1.10 1.10 LSS HSS DG102 Fuel Oil Transfer CKV-100-14 Fails to CKV_100_14_VCZO1 1.00E-05 1.00E-05 1.87 2.23 0.00E+00 0.00E+00 1.00 1.00 LSS HSS Open RLY-(CO2)74A10 RLY_74A10__RAZMD Relay Spuriously 1.00E-05 1.00E-05 1.55 2.08 0.00E+00 0.00E+00 1.00 1.00 LSS HSS Actuates CKV-82-87 DG 103 CKV_82_87__VCZO1 Fuel Oil Check Valve 1.00E-05 1.00E-05 1.98 2.31 0.00E+00 0.00E+00 1.29 1.28 LSS HSS Fails to Open BKR-BKR_R1052__CAZM1 (17/007B)R1052/612 0.00E+00 0.00E+00 2.05 1.74 0.00E+00 0.00E+00 1.00 1.00 HSS LSS Spuriously Closes Supplemental Information Letter Page 70 of 82 Responses to NRC Audit Questions Table 22-2 Importance Value Comparison Core Damage LERF Significance Basic Event Description FV RAW FV RAW Base PWROG Base PWROG Base PWROG Base PWROG Base PWROG BKR-BKR_R1042__CAZM1 (16/008B)R1042/602 1.00E-05 0.00E+00 2.27 1.89 0.00E+00 0.00E+00 1.41 1.40 HSS LSS Spuriously Closes Supplemental Information Letter Page 71 of 82 Responses to NRC Audit Questions Audit Question-23 was resolved during the regulatory audit Audit Question-24 was resolved during the regulatory audit Audit Question-25 (APLC - 50.69) - Overall Use of NEI 00-04 Figure 5-6 NEI 00-0427 Figure 5-6 provides guidance to be used to determine SSC safety significance. The same document states, in part, that if it can be shown that the component either did not participate in any screened scenarios or, even if credit for the component was removed, the screened scenario would not become unscreened, then it is considered a candidate for the LSS category.

In Section 3.2.4 of the LAR the licensee stated that "[a]ll other external hazards, except for seismic, were screened for applicability to NMP1 per a plant-specific evaluation..." However, the licensee discussed the extreme high winds and tornados, which is not screened, in the same section. lists all hazards as screened except for internal events, internal flooding, internal fire with PRA models, seismic hazard with an alternate approach, and the extreme winds and tornados with high wind safe shutdown equipment list (HWSSEL). The guidance in NEI 00-04, Figure 5-6 regarding SSCs that play a role in screening a hazard is not discussed in the of the LAR. Therefore, it appears to the NRC staff based on this description that at the time an SSC is categorized it will not be evaluated using the guidance in NEI 00-04, Figure 5-6 to confirm that the SSC is not credited in screening an external hazard because that evaluation has already been made. The NRC staff notes that plant changes, plant or industry operational experience, updates to hazard frequency information, and identified errors or limitations in the PRA models could potentially impact the conclusion that an SSC is not needed to screen an external hazard.

a) Clarify whether or not an SSC will be evaluated during categorization of the SSC using the guidance in NEI 00-04, Figure 5-6 to confirm that the SSC is not credited in screening an external hazard.

b) If an SSC will not be evaluated using the guidance in NEI 00-04, Figure 5-6 to confirm that the SSC is not credited in screening an external hazard at the time of categorization because that evaluation has already been made, then explain how plant changes, plant or industry operational experience, updated information in hazard frequencies and identified errors or limitations that could change that decision are addressed.

Constellation Response:

a) During categorization of SSCs, consistent with the guidance in NEI 00-04, Figure 5-6 will be followed.

b) See response to Question APLC 25a above.

27 NEI 00-04, Revision 0, "10 CFR 50.69 SSC Categorization Guideline," July 2005 (ML052910035).

Supplemental Information Letter Page 72 of 82 Responses to NRC Audit Questions Audit Question-26 (APLC - 50.69) - Development of the High Winds Safe Shutdown Equipment List (HWSSEL)

Paragraph 50.69(b)(2)(ii) of 10 CFR requires that the quality and level of detail of the systematic processes that evaluate the plant for external events during operation is adequate for the categorization of SSCs.

Section 3.2.4 of the LAR states, the wind pressure / missile hazard safety significance process uses a High Winds Safe Shutdown Equipment List (HWSSEL)." It further states that this list will be developed. The LAR continues by stating that the proposed approach will identify SSCs associated with this hazards safe shutdown function and barriers to be high safe significant (HSS).

It is not clear when the list will be developed, as it was not listed as one of the categorization prerequires in Attachment 1. In addition, the licensee discussed the equipment that fulfills a HWSSEL function, which is not shown in Table 3-1 "Categorization Evaluation Summary", that is, the high winds and tornado hazards are not mentioned. If the high winds and tornados are considered as a part of other external hazards, its evaluation level is for component only, not including its function from the HWSSEL, as discussed in Section 3.2.4.

Section 3.3 of NEI 00-04, Revision 0 provides limited guidance for determining the technical adequacy attributes required for these types of analyses for this specific application. RG 1.201, Revision 1 states that "as part of the plant-specific application requesting to implement §50.69, the licensee or applicant will provide the bases supporting the technical adequacy of itsnon-PRA-type analyses for this application."

Address the following regarding the proposed HWSSEL approach:

a) Explain when the HWSSEL will be developed. Justify why it is not included as one of the categorizations prerequires in Attachment 1. If it cannot be justified, provide a mechanism, such as inclusion in Attachment 1, to ensure that the HWSSEL will be developed prior to initiation of the 10 CFR 50.69 program at NMP1.

b) Table 3-1, "Categorization Evaluation Summary" lists the different methods for categorization and the rules under which the IDP can or cannot change HSS to LSS.

The high winds initiator is not listed separately in this Table. Because high winds are evaluated differently than all other external hazards at NMP1, explain why this hazard is not specifically provided in the table or revise the table to provide "high winds" separately to show that candidate HWSSEL SSCs cannot be changed by the IDP, and that the evaluation level can be at the function level as well.

c) Provide justification that the HWSSEL method meets the expectations in the Statements of Consideration for 10 CFR 50.69 that non-PRA methods used in the categorization process are conservative. In the justification, identify the industry assessments referenced in the LAR and summarize the industry evaluations and results that support the conclusion that the NMP1 proposed approach to use the HWSSEL is conservative.

d) Provide details on the methodology to be used to develop the HWSSEL. Include in the response how the high wind related SSCs would be processed using this methodology.

e) High wind / tornado / tornado missile protection actions can be credited if they are "feasible", but PRA actions generally are not credited unless they are proceduralized and have a failure probability assigned. Some feasible actions have a high failure probability. Further, certain actions need to be taken outside of Seismic Category-I Supplemental Information Letter Page 73 of 82 Responses to NRC Audit Questions structures and need expanded time for feasibility due to high wind/tornado/tornado missile conditions.

i. Justify the consideration of operator actions in the HWSSEL without a detailed evaluation and explain how the feasibility and failure probability of operator actions (which could be high) is incorporated in the analysis for determining SSCs in the HWSSEL?

ii. Explain the mapping that will be performed to assign any operator actions deemed feasible to SSCs for exclusion from the HWSSEL?

f) The terminator oval in Figure 3.2 of the LAR for the 'No' decisions states, "[c]andidate Low Safety Significant." Provide a description to clarify what SSCs would be categorized as LSS using the flow chart in Figure 3.2 that are not considered in the high winds / tornado / tornado missile safe shutdown analysis. In the description, provide examples of SSCs that would be categorized as LSS for this terminator oval.

Constellation Response:

a) The HWSSEL will be developed prior to categorizing any system at NMP1. Attachment 1, "List of Categorization Prerequisites" of the 50.69 LAR will be revised, as shown below, thusly (to add the HWSSEL) and included in a supplemental letter following the NRC staff's audit.

Supplemental Information Letter Page 74 of 82 Responses to NRC Audit Questions Attachment 1: List of Categorization Prerequisites Constellation will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision-Making Panel (IDP) member qualification requirements.

Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary High Safety Significant (HSS) or Low Safety Significant (LSS) based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2). Any component supporting an HSS function is categorized as preliminary HSS.

Components supporting, an LSS function are categorized as preliminary LSS.

Component safety significance assessment. Safety significance of active components is assessed through a combination of Probabilistic Risk Assessment (PRA) and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

Assessment of defense-in-depth (DID) and safety margin. Safety-related components that are categorized as preliminary LSS are evaluated for their role in providing DID and safety margin and, if appropriate, upgraded to HSS.

Review by the IDP. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of Regulatory Guide 1.174.

Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

Documentation requirements per Section 3.1.1 of the enclosure.

High Winds Safe Shutdown Equipment List (HWSSEL) of SSCs needed to achieve and maintain safe shutdown of the reactor assuming unavailability of offsite power as described in Section 3.2.4 of the enclosure.

b) Table 3-1 has been revised as shown below. The table will be included in a supplemental letter following the NRC staff's audit.

Supplemental Information Letter Page 75 of 82 Responses to NRC Audit Questions Table 3-1: Categorization Evaluation Summary IDP Categorization Drives Change Element Step - NEI 00-04 Evaluation Level Associated HSS to Section Functions LSS Internal Events Not Base Case - Yes Allowed Section 5.1 Fire, Seismic and Other External Allowable No Risk (PRA Events Base Component Modeled) Case PRA Sensitivity Allowable No Studies Integral PRA Not Assessment - Yes Allowed Section 5.6 Fire and Other Not External Hazards Component No Allowed Extreme Wind or Not Function/Component Yes Risk Tornado Allowed (Non-modeled)

Seismic - Function/Component Allowed 2 No Shutdown - Not Function/Component No Section 5.5 Allowed Core Damage - Not Function/Component Yes Section 6.1 Allowed Defense-in-Depth Containment - Not Component Yes Section 6.2 Allowed Qualitative Considerations -

Function Allowable1 N/A Criteria Section 9.2 Passive - Section Not Passive Segment/Component No 4 Allowed Notes:

1 The assessments of the qualitative considerations are agreed upon by the IDP in accordance with Section 9.2. In some cases, a 10 CFR 50.69 categorization team may Supplemental Information Letter Page 76 of 82 Responses to NRC Audit Questions provide preliminary assessments of the seven considerations for the IDPs consideration, however the final assessments of the seven considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 10 CFR 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 10 CFR 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 10 CFR 50.69 team (i.e.,

all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

2 IDP consideration of seismic insights can also result in an LSS to HSS determination.

c) Part II.1.2 (PRA Requirements) in the Statement of Considerations states in part:

"The supporting guidance for the rule has been structured such that licensees will gain more benefit when PRA methods are used (beyond the minimum PRA requirements in § 50.69(c)), and where non-PRA methods are used, the requirements and associated implementation guidance account for this situation by requiring a process that tends to conservatively categorize SSCs into RISC-1 and RISC-2 (i.e., no special treatment requirements are removed)." [emphasis added]

In NEI 00-04, Section 5.4 allows the safety significance of SSCs be determined using either an external hazards (e.g., high winds (HW)) PRA or the process shown in NEI 00-04 Figure 5-6. Since NMP1 does not have a HW PRA, and the HW hazard was not screened, use of the Figure 5-6 safety significance process for plants with screened external hazards does not apply. Instead, NMP1 proposes to use an alternative approach to identify high safety significant (HSS) SSCs for high wind scenarios. The proposed approach is conservative since all SSCs and their associated functions that are needed to achieve and maintain safe shutdown of the reactor given high wind events that are assumed to result in unavailability of offsite power are considered to be high safety significant (HSS) and cannot be downgraded to low safety significant (LSS) by the IDP.

A similar approach using a Tornado Safe Shutdown Equipment List (TSSEL) for tornado missiles was approved by the NRC staff for use at the Arkansas Nuclear One (ANO) sites. The ANO TSSELs are based on the High Winds Equipment Lists (HWELs), which Supplemental Information Letter Page 77 of 82 Responses to NRC Audit Questions were developed to support the ANO Units 1 and 2 Tornado Missile Risk Evaluator (TMRE) LARs (see ML20135H141 for NRC approval.) The method for developing a TMRE HWEL is described in NEI 17-02, Revision 1B, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document."

d) Plant SSCs on the HWSSEL will be chosen based on NMP1 site design engineering input for the high winds safe shutdown strategy and will use a screening process with criteria to identify SSCs whose failure would have no significant risk impact given a high winds event or are not otherwise credited for mitigating the effects of a high winds event.

The criteria list below will be used:

1. SSCs not powered by emergency onsite AC sources. This screening is also done for sites that implement industry's Tornado Missile Risk Evaluator (TMRE) so it would apply to the HWSSEL as well. The rationale for this step is that the high wind event is assumed to cause a LOOP without credit for offsite power recovery.

Therefore, if SSCs do not have emergency power sources, they are screened.

2. SSCs not required to function during or after a loss of offsite AC power event.

Examples for this screening criterion include SSCs needed to generate a reactor trip signal, since loss of power will cause a reactor scram.

3. SSCs in systems that are assumed unavailable following a high wind event.

4. SSCs outside a Category I structure not protected against tornado missiles and/or not credited for mitigation. This is also similar to the TMRE screening. Unless designed for high winds and missiles, SSCs outside Category I structures (either unprotected or in a non-Category I structure) will be assumed to fail during a high wind event and are not credited in mitigation.

5. SSCs that only perform a passive safety function during a high wind event and are protected inside Category I structures (e.g., normally closed valves whose high wind/tornado mitigation function is to remain closed).

6. SSCs determined by NMP1 operations to be part of the high winds mitigation strategy for safe shutdown.

The remaining SSCs not screened out will be identified as the risk significant (RISC 1 or 2 SSCs) SSCs on the HWSSEL.

Next, a function-level evaluation for SSCs on the HWSSEL will be performed using the flowchart in Figure 3-2 from the LAR (replicated below in response to 26f).

NEI 00-04 requires that all functions for the system being categorized be identified.

SSCs required to perform the HWSSEL functions will be risk significant SSCs per the guidance in NEI 00-04. During categorization of systems, NEI 00-04 component to function mapping process will be applied to the safe shutdown function of (1) Decay Heat Removal; (2) Reactivity Control; (3) Inventory Control; (4) Power Availability, and (5) Reactor Pressure Control. The SSCs that fulfill the wind pressure / missile hazard safe shutdown functions, as well as any high winds or missile barriers that are credited with protecting equipment that fulfills a HWSSEL function, will be identified as candidate Supplemental Information Letter Page 78 of 82 Responses to NRC Audit Questions high safety significant (HSS) for the system being categorized regardless of their tornado damage susceptibility or frequency of challenge. This approach ensures the SSCs that are credited to achieve and maintain the capability for safe shutdown are retained as safety-significant.

e)i Equipment on the HWSSEL are those SSCs needed for safe shutdown of the reactor given a high wind event as described in part d. There is no reliance on operator actions in the determination of whether or not an SSC should be assigned to the HWSSEL.

e)ii See the answer to part i of this question.

f) Figure 3-2 from the LAR is provided below.

Figure 3-2: Safety Significance Process for SSCs for the Extreme Winds or Tornados Hazard Select SSC Is the SSC on the Does the SSC support Candidate Low No No HWSSEL? a HWSSEL Function? Safety Significant Yes Candidate High Yes Safety Significant Identify Safety Significant Attributes of SSC SSCs that would be categorized as LSS using the flow chart above are those that are not credited for safe shutdown and/or preventing core damage or large early release given the occurrence of a high wind or tornado induced loss of offsite power. Examples of SSCs that would be categorized as LSS for this hazard would be SSCs not powered by emergency onsite AC sources. Other examples would be SSCs not required to function after a loss of offsite power event.

Audit Question-27 (APLC - 50.69) - External Flooding (Local Intense Precipitation)

Paragraph 50.69(b)(2)(ii) of 10 CFR requires that the quality and level of detail of the systematic processes that evaluate the plant for external events during operation is adequate for the categorization of SSCs.

In Attachment 4 of the LAR "External Hazards Screening," the licensee stated that an analysis (S0FLOODF002) was performed to calculate the volume of water that will leak into the buildings Supplemental Information Letter Page 79 of 82 Responses to NRC Audit Questions during the Local Intense Precipitation (LIP) without any temporary flood barriers installed. It appears this statement may not be consistent with the assumption 5.1 and 5.4 of the analysis, S0FLOODF002, where a temporary flood barrier either may need to be or must be installed.

The licensee concluded that water intrusion through normally closed exterior doors that would ultimately accumulate on the 250 ft elevation to a maximum depth of 31 inches; as a result, no safety related equipment will be impacted. Therefore, the licensee determined that temporary flood barriers were not required to screen this hazard, only closing of exterior doors were required.

The S0FLOODF002 analysis appears to address the 72-hour Probable Maximum Precipitation (PMP) event. It is unclear to the NRC staff the applicability of the 72-hour PMP analysis for the 24-LIP event given the NMP1 FE analysis. The NRC staff notes that in Section 3.2.1 of its September 20, 2017, flooding focused evaluation28, the following flood protection barriers will be installed for the following areas to address LIP:

Battery Board Room

Foam Room

Emergency Diesel Generator Room

Auxiliary Control Room

Reactor Building It appears that the temporary flood barriers are required to address LIP events, which is not consistent with the S0FLOODF002 analysis. Therefore, address the following:

a) Justify the applicability of the S0FLOODF002 analysis to the LIP event. Include in this discussion any plant or procedure modifications since the NMP1 FE submittal that impacted the use of flood barriers to address the LIP event.

b) Clarify that during a LIP event no flood barriers are necessary to address the areas identified in the NRC staffs 2017 flooding focused evaluation. If barriers are necessary, identify the corresponding areas and explain how the barriers will be treated under the proposed categorization program.

c) Attachment 4 to the LAR provides the Table of External Hazard Screening. In the External Flooding section of the table, it states "the LIP mechanism requires several normally closed exterior doors to slow water intrusion for screening. These doors will be considered high safety significant (HSS) since they are credited for screening the external flood hazard." Provide a list of the specific exterior doors that will be assigned HSS since they are credited for screening the external flood hazard (in accordance with Figure 5-6 in NEI 00-04).

Constellation Response:

a) The purpose of the calculation S0FLOODF002 was to demonstrate that the installation of the flood barriers at NMP Unit 1 are only required for defense-in-depth and/or asset protection from the storm waters. The calculation shows that even without installation of the temporary barriers, the water would accumulate to 31 in. on the 250 ft elevation, which is highly conservative given there are elevations lower than 250 ft at the station, and not impact safety related SSCs that are all present on Elevation 261 ft. The margin 28 Gibson, L.K., U.S. Nuclear Regulatory Commission to Hanson, B.C., Exelon Generation Company, LLC, "Nine Mile Point Nuclear Station, Units 1 and 2-Staff Assessment of Flooding Focused Evaluation (CAC NOS. MG0087 and MG0088), dated September 20, 2017 (ML17251A045).

Supplemental Information Letter Page 80 of 82 Responses to NRC Audit Questions from accumulated water above 250 ft to 261 ft is approximately 8.4 ft which provides substantial buffer.

The hazard selected for evaluation in S0FLOODF002 is the same as was used in the FHRR and the COLA for NMP Unit 3 (Ref. 1, pg. 10). According to the Staff Assessment of the Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation, "HMR 51 (NOAA, 1978) and HMR 52 (NOAA, 1982)" were applied and three PMP durations were evaluated. Total rainfall depths for the 1 mi2 (2.59 km2) area are 16.0 in. (40.6 km) for the 1-hour PMP, 22.4 in. (56.9 km) for the 6-hour PMP, and 33.0 in. (83.8 km) for the 72-hour PMP."

The SA of the FE goes on further to state "In the FHRR, Section 2.1.2.3 describes that the 72-hour PMP yields flood elevations up to approximately 0.6 ft higher than the results from the 6-hour PMP simulation. The 72-hour PMP provides a maximum calculated flood elevation of 260.6 to 262.4 ft, with a maximum water depth of 0.3 ft to 2.8 ft in the immediate vicinity of NMP Unit 1 and 2."

The staff then states agreement in using the 72-hour PMP for the analysis given, "These flood event duration parameters were identified using an overlay of Figures 2.1-3 and 2.1-23 of the FHRR, which was contained in the RAI response. A similar comparison using FHRR Figures 2.1-3 and 2.1-15 for the 6-hour PMP results in: (1) flood warning time of less than one hour (see FHRR Figure 2.1-15) and (2) a flood inundation duration of 14.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months above elevation 261 ft (79.55 m). Therefore, the NRC staff agreed with the licensee's conclusion that the 72-hour PMP event results in the highest water surface elevation and longest period of inundation. However, the staff noted that PMP events shorter than 72-hour PMP (e.g., the 6-hour PMP event identified above) result in potentially significantly shorter warning time and likewise results in a flood above the elevation of openings to plant structures (261 ft; 79.55 m)."

Given that S0FLOODF002 does not rely on operator actions to install temporary barriers, the reduced warning time of the 1-hour 1 sq mi LIP event is not relevant to the calculation and the critical parameters are the maximum flood depth and longest duration time which both come from the 72-hour PMP. If that event does not produce enough volume of water to inundate the rooms on elevation 250 ft, then volume from the 1-hour LIP is subsumed in the 72-hour PMP.

b) After the completion of the Focused Evaluation, NMP1 completed the calculation for S0FLOODF002 documenting that the temporary barriers are not necessary for a successful mitigation of flood waters from the PMP event. The calculation was designed to demonstrate that the exterior doors and assumed gaps would not allow enough water to enter the key structures and accumulate on the lowest elevations to flood up and affect safety related SSCs on the 261 ft elevation. Therefore, the conclusion for this LAR was that the barriers are not required but will still be installed by the station as a defense-in-depth measure. The only required credited barriers are the normally closed and permanently installed exterior doors.

c) The doors will be considered high safety significant (HSS) since they are credited for screening the external flood hazard are provided in Table 27-1.

Table 27-1: Doors Required for Screening External Flood Scenarios Supplemental Information Letter Page 81 of 82 Responses to NRC Audit Questions Area Door No. Normal Position Diesel Generator Area D-034 Closed D-035 Closed D-085 Closed Radwaste D-201 Closed D-202 Closed D-207 Closed D-219 Closed D-221 Closed D-223 Closed Waste Disposal Building D-036 Closed Main Turbine Building D-040 Closed D-041 Closed D-042 Closed D-043 Closed D-044 Closed D-254 Closed Admin Building D-001 Closed D-030 Closed D-100-5 Closed D-111-5 Closed D-117-1 Closed D-117-2 Closed D-117-3 Closed D-308 Closed S1-3 Closed S3-4 Closed

References:

1. US NRC, Nine Mile Point Nuclear Station Units 1 and 2 - Staff Assessment of Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation.

July 24, 2014, ML14153A410.

Audit Question-28 (APLC - 50.69) - Screening of Snowfall Risk Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the "impact of other external events risk shall be addressed in the RMTS program," and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that

"[o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk."

Supplemental Information Letter Page 82 of 82 Responses to NRC Audit Questions LAR Attachment 4, External Hazard Screening, indicates that criterion "C5" was used to screen the snow hazard. Criterion C5 states the event develops slowly, allowing adequate time to eliminate or mitigate the threat.

The NMP1 IPEEE states "NMP1 drawings indicate that NMP1 has capabilities beyond the 40 PSF design specification. These drawings indicate that the roofs are capable of supporting 100 PSF. Subtracting 25 PSF to account for roof building materials the 75 PSF margin would support approximately 14.4 inches of water" The IPEEE goes on to state "the 96 PSF value corresponds to approximately 12 feet of fresh snow" "Given the approximate 3-foot roof wall height and normal winds off Lake Ontario it is judged unlikely that this level of snow could accumulate on roofs."

It is unclear to the staff whether the risk of this hazard is adequately considered for this application since snow loading for the 75 PSF value was not provided, and no discussion of how the threat is monitored or mitigated via internal guidelines or procedures is provided.

a) Given that heavy snowfalls can lead to loss of power events, provide procedures used to monitor and mitigate the winter snow load on critical buildings including the EDG buildings.

b) Justify the screening of risk associated with snowfall from the application by demonstrating that the past major snowfall events result in sufficient margin to withstand such events.

Constellation Response:

a) Severe Weather And Natural Disaster Guidelines Procedure OP-AA-108-111-1001 Rev. 25 provides requirements and recommendations for actions to be taken in the event the site is going to be impacted by high winds, tornados, hurricane, excessive rain, flooding, snow, tsunami, Geomagnetic Disturbances (GMD), or ice accumulation. Step 4.6 includes pre-storm roof snow loading considerations. Attachment 1 provides operational considerations for snow removal ("Verify snow removal plan in place including equipment and consumables. Make provisions to clear paths to vital equipment that must be monitored by Operations or Security.")

b) According to the National Weather Service, a conservative "rule-of-thumb" for snow ratio states that for every 10-inches of snow there would be an inch of water (10:1), 14.4-inches of water (or 75 PSF margin per the IPEEE) is equivalent to about 144-inches of snow. (Source: https://www.weather.gov/arx/why_snowratios).

The largest snowfall total ever recorded on a single day during the period 1926-2023 in Oswego, NY was 40 inches which occurred on December 8, 1958. The most snow over a two-day period was 50 inches during February 4-5, 1972. (Source:

https://www.extremeweatherwatch.com/cities/oswego/most-daily-snow).

Based on implementation of the severe weather procedure cited in part a), and the approximate 100-inch margin available (10 inches of rain) to 144-inches heavy snow loads, it is extremely unlikely that 144-inches of snow would be allowed to accumulate on roofs of critical buildings prior to removal. Therefore, sufficient margin exists for expected snow loads on roofs at NMP1 such that Criterion C5 is an appropriate justification to screen the snow hazard at NMP1.

ATTACHMENT 2 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information: Revised Technical Specifications and Bases Markups Supplemental Information Letter Page 1 of 1 Revised Technical Specifications Markup As stated in the response to Audit Question 03b, TS page 155 is removed from the scope of the LAR. Below is the revised list of TS pages:

Proposed Technical Specification Changes (Mark-Ups)

TS Pages 44 216 50 219 54 222 63 225 76 237 143 245 156 255 159 256 160 257 204 355b 212 As stated in the response to Audit Question 03b, TS Bases page 157 is removed from the scope of the LAR. Below is the revised list of TS Bases pages:

Proposed Technical Specification Bases Changes (Mark-Ups)

(for Information Only)

TS Bases Pages 48 52 57 64 78 150 158 162 248 258

LIMITING CONDITION FOR OPERATION SURVEILLANCE REQUIREMENT 3.1.4 CORE SPRAY SYSTEM 4 .1.4 CORE SPRAY SYSTEM Applicability: Applicability:

Applies to the operating status of the core spray Applies to the periodic testing requirements for the systems when in the Power Operating Condition or core spray systems.

Shutdown Condition - Hot.

Objective:

To verify the operability of the core spray systems.

To assure the capability of the core spray systems to cool reactor fuel in the event of a loss-of-coolant accident.

Specification:

The core spray system surveillance shall be

a. Whenever irradiated fuel is in the reactor vessel performed as indicated below.

and the reactor coolant temperature is greater than 212°F, each of the two core spray systems a. In accordance with the Surveillance Frequency shall be operable except as specified in Control Program automatic actuation of each Specifications band c below. subsystem in each core spray system shall be demonstrated.

b. If a redundant component of a core spray system becomes inoperable, that system shall be b. In accordance with the Surveillance Frequency considered operable provided that the component Control Program pump operability shall be is returned to an operable condition within 7 days checked .

and the additional surveillance required is performed. c. In accordance with the Surveillance Frequency Control Program the operability of power-

c. If a redundant component in each of the core operated valves required for proper system spray systems becomes inoperable, both systems operation shall be checked.

shall be considered operable provided that the or in accordance with the component is returned to an operable condition Risk Informed Completion within 7 days and the additional surveillance required is performed. Time Program or in accordance with the Risk Informed Completion AMENDMENT NO. 142, 222, 236 54 Time Program

ATTACHMENT 3 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information:

Revised Enclosure 1 (This replaces Enclosure 1 in Reference 1 in its entirety)

Supplemental Information - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions

1. Introduction Section 4.0, Item 2 of the NRC Final Safety Evaluation (Reference 1 of this Enclosure) for NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 2) identifies the following needed content:

The license amendment request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 50.46 ECCS flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure provides confirmation that the Nine Mile Point Nuclear Station Unit 1 (NMP1)

PRA models include the necessary scope of SSCs and their functions to address each proposed application of the Risk-Informed Completion Time (RICT) Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation. The comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The NMP1 PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.

Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:

- Column "Proposed TS LCO Condition": Lists all of the LCOs and condition statements within the scope of the RICT Program.

- Column "SSCs Covered by TS LCO Condition": The SSCs addressed by each action requirement.

- Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.

- Column "Function Covered by TS LCO Condition": A summary of the required functions from the design basis analyses.

- Column "Design Success Criteria": A summary of the success criteria from the design basis analyses.

- Column "PRA Success Criteria": The function success criteria modeled in the PRA.

- Column " Other Comments": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions E1-1

Supplemental Information - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09, Revision 0-A.

The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Real-Time Risk (RTR) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to capability Category II of the PRA standard as required by NEI 06-09, Revision 0-A.

Examples of calculated RICT are provided in Table E1-2 for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). Following 4b implementation, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09, Revision 0-A and the NRC safety evaluation, and may differ from the RICTs presented.

E1-2

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.1.2.b One Liquid Poison Two Liquid Poison Yes Provide a One of two Same SSCs are modeled subsystem trains backup trains consistent with the inoperable. capability for TS scope and so can bringing the be directly included reactor from full in the RTR tool for power to a cold, the RICT program.

Xenon-free The success criteria shutdown are consistent with the design basis.

3.1.3.b One Emergency Two Emergency Yes Provide a One of two Same SSCs are modeled Cooling subsystem Cooling loops/trains, redundant trains consistent with the inoperable. two condensers per backup for core TS scope and so can loop decay heat be directly included removal in the RTR tool for following reactor the RICT program.

isolation and The success criteria scram are consistent with the design basis.

E1-3

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.1.4.b One redundant core Two core spray Yes Low pressure Two of four One of four PRA success criteria spray subsystem systems, two injection into the subsystems, subsystems is based on Safety inoperable. subsystems/trains per RPV one in each Evaluation 93-02, system system Pipe Whip Analysis Design Basis, requiring only one of four trains of core spray (core spray pump and its topping pump). SSCs system modeling is consistent with the TS scope and so can be directly included in the RTR tool for the RICT program.

The PRA success criteria are less conservative but more realistic than the design basis for each train.

E1-4

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.1.4.c One redundant core Two core spray Yes Low pressure Two of four One of four PRA success criteria spray subsystem systems, two injection into the subsystems, subsystems is based on Safety inoperable in each subsystems/trains per RPV one in each Evaluation 93-02, core spray system. system system Pipe Whip Analysis Design Basis, requiring only one of four trains of core spray (core spray pump and its topping pump). SSCs system modeling is consistent with the TS scope and so can be directly included in the RTR tool for the RICT program.

The PRA success criteria are less conservative but more realistic than the design basis for each train.

E1-5

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.1.6.b One control rod drive Two control rod pump Yes Provide high One of two Same SSCs are modeled pump coolant coolant injection pressure trains consistent with the injection subsystem subsystems makeup and TS scope and so can inoperable. core cooling in be directly included the case of a in the RTR tool for small line break the RICT program.

The success criteria are consistent with the design basis.

3.1.8.b One High Pressure Two trains of HPCI Yes High pressure One of two Two of two SSCs are modeled Coolant Injection injection into the trains trains in consistent with the (HPCI) subsystem RPV Medium TS scope and so can inoperable. LOCA be directly included scenarios, in the RTR tool for else one of the RICT program.

two trains The PRA success criteria are more conservative than the design basis in Medium LOCA scenarios as the PRA requires both trains.

E1-6

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.3.4.b One or more Primary Containment Yes Limit fission One of two Same SSCs are modeled penetration flow paths Isolation Valves product release isolation valves consistent with the with one PCIV (PCIVs) during and per penetration TS scope and so can inoperable except due following be directly included to leakage not within postulated in the RTR tool for limit. accidents the RICT program.

Any PCIV not explicitly modeled will use a pre-existing small leak event for the RICT calculation.

The success criteria are consistent with the design basis.

3.3.6.f.2 One or more Three parallel sets of Yes Equalize One of three Two of SSCs are modeled suppression two suppression pressure lines opens three lines consistent with the chamber-to-reactor chamber-to-reactor between the open TS scope and so can building vacuum building vacuum suppression be directly included breakers not fully breakers in series chamber and in the RTR tool for closed. reactor building the RICT program.

to maintain The PRA success containment criteria are more structural conservative than the integrity. design basis.

E1-7

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.3.7.b One containment Two containment spray Yes Removal of heat One of four Same SSCs are modeled spray subsystem systems with two pump from the drywell trains consistent with the inoperable. trains each and pressure See footnote 1 TS scope and so can suppression be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

3.3.7.c One containment Two containment spray Yes Removal of heat One of four Same SSCs are modeled spray subsystem in systems with two pump from the drywell trains consistent with the each system or its trains each and pressure TS scope and so can associated raw water suppression See footnote 1 be directly included systems inoperable. Four containment in the RTR tool for spray raw water trains, the RICT program.

one per containment The success criteria spray pump train are consistent with the design basis.

E1-8

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.3.7.d One containment Two containment spray Yes Removal of heat One of four Same SSCs are modeled spray system or its systems with two pump from the drywell trains consistent with the associated raw water trains each and pressure TS scope and so can systems inoperable. suppression See footnote 1 be directly included Four containment in the RTR tool for spray raw water trains, the RICT program.

one per containment The success criteria spray pump train are consistent with the design basis.

3.6.2 RPS Instrumentation - Instrumentation Not Provide reactor One of two Same Electrical failure of Table 3.6.2.a One or more required outlined in table 3.6.2.a explicitly trip signal based channels, the SCRAM system Note (o) channels inoperable. (see footnotes 2 and 3) on plant taken twice will be used as a parameters conservative surrogate for failure of any channel of RPS.

3.6.2 RPS Instrumentation - See 3.6.2 Table 3.6.2.a Note (o)

Table 3.6.2.a Two or more required Note (o) channels inoperable.

E1-9

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions 3.6.2 Reactor Coolant or Instrumentation Yes Automatic One of two Same Main Steam and Table 3.6.2.b Containment Isolation initiating isolation of isolation of channels, RWCU Isolation Note (f) - One or more interfacing lines with Reactor Coolant taken twice. signals are not required channels the reactor coolant or Primary explicitly modeled in inoperable. system or penetrations Containment RWCU area the PRA. Failure of in primary containment Isolation valves temperature is corresponding (see footnotes 3 and 4) one of three isolation valves to channels, close will be used as taken once. a conservative surrogate.

SDC area temperature is Area temperature one of one instrumentation is not channel, taken explicitly included in once. the PRA model.

Isolation signal output relays for SDC and failure of RWCU isolation valves to close will be used as conservative surrogates.

Remaining SSCs are modeled consistent with the TS scope and so can be directly included in the RTR tool for the RICT program. The success criteria are consistent with the design basis.

E1-10

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.6.2 Emergency Cooling Instrumentation Yes Automatic One of two Same SSCs are modeled Table 3.6.2.c Initiation - One or initiating operation of initiation of channels, consistent with the Note (e) more required the emergency Emergency taken twice TS scope and so can channels inoperable. condensers Cooling system be directly included (see footnotes 3 and 5) in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

3.6.2 Emergency Cooling Instrumentation Yes Automatic One of two Same SSCs are modeled Table 3.6.2.c Isolation - One or initiating isolation of the isolation of channels, consistent with the Note (f) more required emergency condensers Emergency taken twice TS scope and so can channels inoperable. from the reactor Cooling systems be directly included coolant system (see in the RTR tool for footnotes 3 and 4) the RICT program.

The success criteria are consistent with the design basis.

3.6.2 Core Spray Initiation - ECCS actuation Yes Automatic One of two Same SSCs are modeled Table 3.6.2.d One or more required instrumentation for initiation of Core channels, consistent with the Note (f) channels inoperable. Core Spray Spray system taken twice TS scope and so can (see footnotes 3 and 6) be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

E1-11

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.6.2 Containment Spray ECCS actuation Yes Automatic One of two Same SSCs are modeled Table 3.6.2.e Initiation - One or instrumentation for initiation of channels, consistent with the Note (c) more required Containment Spray Containment taken twice TS scope and so can channels inoperable. (see footnotes 3 and 7) Spray system be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

3.6.2 Automatic ECCS actuation Not Automatic One of two Manual Failure of all ADS Table 3.6.2.f Depressurization instrumentation for explicitly initiation of ADS channels, initiation valves to open will be Note (d) System (ADS) ADS taken twice only used as a Initiation - One or (see footnotes 3 and 8) conservative more required surrogate for the channels inoperable. RICT calculation.

3.6.2 High Pressure ECCS actuation Not Automatic One of two Same Failure of all Table 3.6.2.k Coolant Injection instrumentation for explicitly initiation of HPCI channels, HPCI/FW pumps to Note (c) (HPCI) Initiation - One HPCI taken twice start will be used as or more required (See footnotes 3 and a conservative channels inoperable. 10) surrogate for the RICT calculation.

E1-12

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.6.3.b One required offsite Lines 1/4 Yes Supply AC loads One offsite Same SSCs are modeled circuit inoperable. during operation source consistent with the TS scope and so can be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

3.6.3.c One required 2 EDGs Yes Supply AC loads One of two Same SSCs are modeled Emergency Diesel when offsite EDGs consistent with the Generator (EDG) power is lost TS scope and so can inoperable or one be directly included required EDG in the RTR tool for inoperable and one the RICT program.

required offsite circuit The success criteria inoperable. are consistent with the design basis.

3.6.3.d One required reserve Reserve Transformers Yes Supply AC loads One offsite Same SSCs are modeled power transformer 101N and 101S during operation source consistent with the inoperable. TS scope and so can be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

E1-13

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical SSCs Function Design PRA TS Condition SSCs Covered by TS Specification Modeled Required by TS Success Success Other Comments Description LCO Condition (TS) in PRA? LCO Condition Criteria Criteria 3.6.3.e.2 Two required offsite Line 1/4 Yes Supply AC loads One offsite Same SSCs are modeled circuits inoperable. during operation source consistent with the TS scope and so can be directly included in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

3.6.3.h One DC electrical Two Battery chargers, Yes Supply DC loads One of two Same SSCs are modeled power subsystem one battery, and during operation subsystems consistent with the inoperable. associated DC power TS scope and so can distribution (battery) be directly included board per subsystem in the RTR tool for the RICT program.

The success criteria are consistent with the design basis.

E1-14

Supplemental Information - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions

1. With two of the containment spray intertie valves open, operation of two containment spray pumps is required to assure the proper flow distribution to the containment spray headers to reduce containment pressure during the first fifteen minutes of the LOCA.

Requiring two containment spray pumps to operate reduces the 400 percent redundance of the containment spray system, but there are still six combinations (two out of four pumps) that will assure two pump operation. The intertie valves are normally closed, and they are not included in the PRA.

2. The reactor protection system is made up of two independent trip systems (11 and 12).

Each trip system contains 2 logic channels (11/1, 11/2 and 12/1, 12/2). The outputs of the channels in a trip system are combined in a logic so that either channel will trip that trip system. The tripping of both trip systems will produce a reactor scram. The tripping logic of the total system is referred to as one-out-of-two taken twice. Each channel contains the various functional inputs to RPS such as Reactor level, MSIV closure, etc.

Loss of any functional input does not prevent the channel from responding to other inputs. Use of an electrical SCRAM failure as a surrogate for a non-modeled functional input is conservative as it encompasses loss of all the inputs to all channels rather than any single input to a channel.

3. Individual pieces of instrumentation such as a pressure transmitter may be shared by multiple design basis functions.

4. The control logic for primary coolant isolation in the Main Steam, Reactor Water Cleanup, and Shutdown Cooling systems occurs for Low Low reactor water level or manual initiation. Main Steam also isolates on Low reactor pressure, Low Low Low condenser vacuum, and high temperature in the main steam line tunnel. Primary containment isolation signals initiate on Low Low reactor water level, high drywell pressure, or manual initiation. Like RPS, each input is sensed by two trip units consisting of two channels each with one-out-of-two taken twice logic. Emergency Condenser isolation automatically initiates on only high steam flow measured in the steam line of each emergency cooling loop in a one-out-of-two taken once logic. Either input signal can automatically initiate the system. Additionally, Reactor Water Cleanup and Shutdown Cooling each have a single channel for high area temperature isolation signals.

5. The control logic for emergency condenser automatic initiation occurs for Low Low reactor water level or high reactor pressure. Like RPS, each input is sensed by two trip units consisting of two channels each with one-out-of-two taken twice logic. Either input signal can automatically initiate the system.

6. The control logic for core spray automatic initiation occurs for Low Low reactor water level or high drywell pressure. Core spray injection valves automatically open when reactor vessel pressure is below 365 psig. Like RPS, each input is sensed by two trip units consisting of two channels each with one-out-of-two taken twice logic. Either input signal can automatically initiate the system.

E1-15

Supplemental Information - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions

7. The control logic for containment spray automatic initiation occurs only if both Low Low reactor water level and high drywell pressure signals trip. Like RPS, each input is sensed by two trip units consisting of two channels each with one-out-of-two taken twice logic. Both input signals are required to automatically initiate the system.

8. The control logic for ADS automatic initiation occurs only if both Low Low Low reactor water level and high drywell pressure signals trip. Each input is sensed by two trip units consisting of two channels each with two-out-of-two taken once logic. Both channels of a trip unit must activate to trip the trip unit, and only one trip unit is required per input.

Unlike other initiation signals, ADS trip units are energize-to-trip instead of de-energize-to-trip. This is due to the requirement that automatic depressurization be prevented unless AC power is available to the emergency core cooling systems. Both input signals are required to automatically initiate the system.

9. The emergency bus undervoltage instrumentation consists of two different undervoltage functions: loss of voltage and degraded voltage. Each function is monitored by three separate undervoltage relays, one relay per phase. The relay outputs are arranged in a two-out-of-three logic configuration for each bus. The relay outputs supply input to the time delay functions for each undervoltage function. Each bus has one time delay relay for loss of voltage and two time delay relays for degraded voltage. When a loss of voltage or degraded voltage setpoint has been exceeded and the respective time delay completed, the time delay relay actuates and sends a Loss of Power (LOP) signal to the respective bus load shedding control scheme, which starts the associated diesel generator (DG), provides a closure signal for the DG output breaker, opens both offsite circuit supply breakers, and sheds all loads on the 4.16kV emergency bus.

10. The control logic for HPCI automatic initiation occurs for Low reactor water level or an automatic turbine trip. Level is sensed by two trip units consisting of two channels each with one-out-of-two taken twice logic. Turbine trip is a single channel to a single trip unit.

Either input signal can automatically initiate the system.

E1-16

Supplemental Information Revised Attachment 5 Page 17 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity RICT Tech Spec TS Condition Estimate1,2 3.1.2.b One Liquid Poison subsystem inoperable. 30.0 3.1.3.b One Emergency Cooling subsystem inoperable. 30.0 3.1.4.b One redundant core spray subsystem inoperable. 30.0 One redundant core spray subsystem inoperable in each core 3.1.4.c spray system. 30.0 One control rod drive pump coolant injection subsystem 3.1.6.b inoperable. 30.0 One High Pressure Coolant Injection (HPCI) subsystem 3.1.8.b inoperable. 30.0 One or more penetration flow paths with one PCIV inoperable 3.3.4.b except due to leakage not within limit. 21.0 One or more suppression chamber-to-reactor building vacuum 3.3.6.f.2 breakers not fully closed. 30.0 3.3.7.b One containment spray subsystem inoperable. 30.0 One containment spray subsystem in each system or its 3.3.7.c associated raw water systems inoperable. 30.0 One containment spray system or its associated raw water 3.3.7.d systems inoperable. 30.0 3.6.2 Table 3.6.2.a Note (o) RPS Instrumentation - One or more required channels inoperable. 30.0 3.6.2 Table 3.6.2.a Note (o) RPS Instrumentation - Two or more required channels inoperable. 30.0 3.6.2 Table Reactor Coolant or Containment Isolation - One or more required 3.6.2.b Note (f) channels inoperable. 30.0 3.6.2 Table.3.6.2.c Emergency Cooling Initiation - One or more required channels Note (e) inoperable. 30.0 3.6.2 Table.3.6.2.c Emergency Cooling Isolation - One or more required channels Note (f) inoperable. 30.0 3.6.2 Table 3.6.2.d Note (f) Core Spray Initiation - One or more required channels inoperable. 30.0 3.6.2 Table Containment Spray Initiation - One or more required channels 3.6.2.e Note (c) inoperable. 30.0 3.6.2 Table Automatic Depressurization System (ADS) Initiation - One or more 3.6.2.f Note (d) required channels inoperable. 0.9 3.6.2 Table High Pressure Coolant Injection (HPCI) Initiation - One or more 3.6.2.k Note (c) required channels inoperable. 30.0 3.6.3.b One required offsite circuit inoperable. 30.0 One required Emergency Diesel Generator (EDG) inoperable or one required EDG inoperable and one required offsite circuit 3.6.3.c inoperable. 30.0 3.6.3.d One required reserve power transformer inoperable. 30.0 3.6.3.e.2 Two required offsite circuits inoperable. 24.9 E1-17

Supplemental Information Attachment 3 - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions RICT Tech Spec TS Condition Estimate1,2 3.6.3.h One DC electrical power subsystem inoperable. 13.9

1. RICTs are based on the internal events, internal flood, and internal fire PRA model calculations with high wind and seismic penalties. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09, Revision 0-A. RICTs are rounded to the nearest number of hours for illustrative purposes.

2. Per NEI 06-09, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.

Table E1-3 lists the TSTF-505 Rev 2 Table 1 Tech Specs that require additional justification along with a description of how the additional justification is provided in the LAR.

Table E1-3: TSTF-505 Rev 2 Table 1 Tech Specs that Require Additional Justification Tech Spec Description TSTF-505 NMP1 Additional Justification Tech Spec Tech Spec Source Range Monitor 3.3.1.2.A 3.5.1 N/A - TSTF-505 changes are Instrumentation - One or more excluded.

required SRMs inoperable in MODE 2 with intermediate range monitors (IRMs) on Range 2 or below.

Feedwater and Main Turbine High 3.3.2.B ---- N/A - The NMP1 TS do not contain Water Level Trip Instrumentation - this TS. Therefore, a change is not Two or more feedwater and main proposed to the NMP1 TS.

turbine high water level trip channels inoperable.

End of Cycle Recirculation Pump 3.3.4.1.A.1 ---- N/A - The NMP1 TS do not contain Trip (EOC-RPT) Instrumentation - 3.3.4.1.A.2 this TS. Therefore, a change is not One or more required channels proposed to the NMP1 TS.

inoperable.

Low-Low-Set (LLS) Instrumentation 3.3.6.3 ---- N/A - The NMP1 TS do not contain this TS. Therefore, a change is not proposed to the NMP1 TS.

Primary Containment Air Lock - 3.6.1.2.C.3 3.3.5.A N/A - TSTF-505 changes are Primary containment air lock excluded.

inoperable for reasons other than Condition A or B.

E1-18

Supplemental Information - Revised Enclosure 1 Docket No. 50-220 List of Revised Required Actions to Corresponding PRA Functions Table E1-3: TSTF-505 Rev 2 Table 1 Tech Specs that Require Additional Justification Tech Spec Description TSTF-505 NMP1 Additional Justification Tech Spec Tech Spec Primary Containment Isolation 3.6.1.3.E.1 3.3.4.B TSTF-505 changes are incorporated.

Valves (PCIVs) - One or more However, under certain penetration flow paths with one or circumstances, with more than one more containment purge valves containment isolation valve not not within purge valve leakage within leakage limits, a loss of limits. function may occur. Therefore, a Note is added to the Completion Time which prohibits applying a RICT when there is a loss of function.

Reactor Building-to-Suppression 3.6.1.7 3.3.6.F.2 TSTF-505 changes are incorporated.

Chamber Vacuum Breakers SSCs are modeled consistent with the TS scope and so can be directly included in the RTR tool for the RICT program. The PRA success criteria are more conservative than the design basis.

Main Turbine Bypass System - 3.7.7.A ---- N/A - The NMP1 TS do not contain Requirements of the LCO not met this TS. Therefore, a change is not or Main Turbine Bypass System proposed to the NMP1 TS.

inoperable.

2. References

1. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'"

dated May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, dated October 12, 2012 (ADAMS Accession No. ML12286A322).

E1-19

ATTACHMENT 4 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information:

Revised Attachment 4 Cross-Reference of TSTF-505 and Nine Mile Point, Unit 1, Technical Specifications (This replaces Attachment 4 in Reference 1 in its entirety)

Supplemental Information Revised Attachment 4 Page 1 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

Completion Times 1.3 Example 1.3-8 1.3-8 --------- No NMP1 TS do not contain Examples. Although this change is a variation to TSTF-505, it is considered administrative and is acceptable. See Variation 2.3.7.

Standby Liquid Control (SLC) 3.1.7 3.1.2 Liquid Poison System System One SLC subsystem inoperable [for 3.1.7.B 3.1.2.b Yes TSTF-505 changes are incorporated. The NMP1 Liquid reasons other than Condition A]. Poison System provides the same function as the SLC System. This is considered an acceptable administrative variation in title and numbering. See Variation 2.3.1.

Supplemental Information Revised Attachment 4 Page 2 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

Reactor Protection System (RPS) 3.3.1.1 3.6.2 Instrumentation One or more required channels 3.3.1.1.A.1 Table 3.6.2.a, Note Yes TSTF-505 changes are incorporated into Note (o).

inoperable. (o) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

3.3.1.1.A.2 Table 3.6.2.a, Note Yes (o) TSTF-505 changes are incorporated into Note (o).

However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Supplemental Information Revised Attachment 4 Page 3 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

One or more Functions with one or 3.3.1.1.B.1 Table 3.6.2.a, Note Yes TSTF-505 changes are incorporated into Note (o).

more required channels inoperable (o) However, under certain circumstances, with more than in both trip systems. one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

3.3.1.1.B.2 Table 3.6.2.a, Note Yes (o) TSTF-505 changes are incorporated into Note (o).

However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Source Range Monitor (SRM) 3.3.1.2 3.5.1 Instrumentation One or more required SRMs 3.3.1.2.A.1 3.5.1 No TSTF-505 changes are not incorporated.

inoperable in MODE 2 with intermediate range monitors (IRMs) on Range 2 or below.

Supplemental Information Revised Attachment 4 Page 4 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

Feedwater and Main Turbine High 3.3.2.2 3.6.2 Water Level Trip Instrumentation One feedwater and main turbine 3.3.2.2.A Table 3.6.2.k, Note Yes TSTF-505 changes are incorporated into Note (c).

high water level trip channel c.1 However, under certain circumstances, with more than inoperable. one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Two or more feedwater and main 3.3.2.2.B ----------- No This Condition is not applicable to NMP TS. See turbine high water level trip Variation 2.3.7.

channels inoperable.

End of Cycle Recirculation Pump 3.3.4.1 -----------

Trip (EOC-RPT) Instrumentation One or more required channels 3.3.4.1.A.1 ----------- No This Condition is not applicable to NMP TS. See inoperable. Variation 2.3.7.

3.3.4.1.A.2 ----------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

Anticipated Transient Without 3.3.4.2 -----------

Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation

Supplemental Information Revised Attachment 4 Page 5 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

One or more channels inoperable. 3.3.4.2.A.1 ----------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

3.3.4.2.A.2 ----------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

Emergency Core Cooling System 3.3.5.1 3.6.2 (ECCS) Instrumentation As required by Required Action A.1 3.3.5.1.B.3 Table 3.6.2.d, Note Yes TSTF-505 changes are incorporated. However, under and referenced in Table 3.3.5.1-1. (f) certain circumstances, with more than one channel inoperable, a loss of function may occur. Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained.

For variation to Note see Variation 2.3.14.

As required by Required Action A.1 3.3.5.1.C.2 Table 3.6.2.e, Note Yes TSTF-505 changes are incorporated into Note (c).

and referenced in Table 3.3.5.1-1. (c) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Supplemental Information Revised Attachment 4 Page 6 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

As required by Required Action A.1 3.3.5.1.D.2.1 Table 3.6.2.k, Note Yes TSTF-505 changes are incorporated into Note (c).

and referenced in Table 3.3.5.1-1. (c) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

As required by Required Action A.1 3.3.5.1.E.2 -----------. No This Condition is not applicable to NMP TS. See and referenced in Table 3.3.5.1-1. Variation 2.3.7.

As required by Required Action A.1 3.3.5.1.F.2 Table 3.6.2.f, Note Yes TSTF-505 changes are incorporated into Note (d).

and referenced in Table 3.3.5.1-1. (d) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

As required by Required Action A.1 3.3.5.1.G.2 Table 3.6.2.f, Note Yes TSTF-505 changes are incorporated into Note (d).

and referenced in Table 3.3.5.1-1. (d) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Reactor Core Isolation Cooling 3.3.5.2 3.6.2 (RCIC) System Instrumentation

Supplemental Information Revised Attachment 4 Page 7 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

As required by Required Action A.1 3.3.5.2.B.2 Table 3.6.2.c, Note Yes TSTF-505 changes are incorporated. NMP1 does not and referenced in Table 3.3.5.2-1 (e) for Parameter 2. have a RCIC system. The NMP1 design uses Emergency (Function 1). Condensers as part of the Emergency Cooling System.

The equivalent Function is performed by Parameter 2, Low-Low Reactor Water Level, for Emergency Cooling Initiation. This is a variation to TSTF-505. See Variation 2.3.8. However, under certain circumstances, with more than one channel inoperable, a loss of function may occur. Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

As required by Required Action A.1 3.3.5.2.D.2.1 ------- No This Condition is not applicable to NMP TS. See and referenced in Table 3.3.5.2-1 Variation 2.3.7.

(Functions 3 and 4).

Primary Containment Isolation 3.3.6.1 3.6.2 Instrumentation One or more required channels 3.3.6.1.A.1 Table 3.6.2.b, Note Yes TSTF-505 changes are incorporated into Note (f).

inoperable (f) However, under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Supplemental Information Revised Attachment 4 Page 8 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

-------- Table 3.6.2.c, Note Yes TSTF-505 changes are incorporated. The NMP1 design (f) for Parameter 3 uses Emergency Condensers as part of the Emergency Cooling System. Parameter 3, High Steam Flow Emergency Cooling System, for Emergency Cooling Isolation is a variation to TSTF-505. See Variation 2.3.16. Under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained. For variation to Note see Variation 2.3.14.

Low-Low-Set (LLS) 3.3.6.3 Instrumentation One LLS valve inoperable due to 3.3.6.3.A ------- No This Condition is not applicable to NMP TS. See inoperable channel(s). Variation 2.3.7.

Loss of Power (LOP) 3.3.8.1 3.6.2 Instrumentation One or more channels inoperable. 3.3.8.1.A Table 3.6.2i, Note (1) No TSTF-505 changes are not incorporated.

3.6.2.1, Note (1) does not have an associated Completion Time and is excluded.

Supplemental Information Revised Attachment 4 Page 9 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

Safety/Relief Valves (S/RVs) 3.4.3 One [or two] required S/RV[s] 3.4.3.A 3.2.8.b No TSTF-505 changes are not incorporated.

inoperable. Condition 3.2.8b is a default condition and is excluded.

ECCS - Operating 3.5.1 3.1.4 NMP1 has two methods of coolant injection: Core Spray System and High Pressure Coolant Injection (HPCI). HPCI is a high pressure injection source from an alternate mode of feedwater and is covered in NMP1 TS 3.1.8. Core Spray is a low pressure injection source

(<365 psig ) and is part of TS 3.1.4.

One low pressure ECCS 3.5.1.A 3.1.4.b Yes TSTF-505 changes are incorporated.

injection/spray subsystem This applies to the NMP1 Core Spray System. This inoperable or applies to the NMP1 (low pressure) Core Spray System.

One LPCI pump in both LPCI subsystems inoperable. 3.1.4.c Yes High Pressure Coolant Injection 3.5.1.C 3.1.8.b Yes TSTF-505 changes are incorporated.

(HPCI) System Inoperable. This applies to the NMP1 HPCI System. HPCI is not an Engineered Safeguards system and is not considered in any Loss of Coolant Accident Analyses.

Supplemental Information Revised Attachment 4 Page 10 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

HPCI System inoperable and 3.5.1.D.1 -------- No This Condition is not applicable to NMP TS. See Condition A entered. Variation 2.3.7.

3.5.1.D.2 -------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

One ADS valve inoperable. 3.5.1.E 3.1.5.b No TSTF-505 changes are not incorporated.

NMP1 requires all six of the solenoid-actuated pressure relief valves (Automatic Depressurization System) to be operable. If this specification cannot be met, then reactor coolant temperature shall be reduced to 110 psig or less and saturation temperature or less, respectively, within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Therefore, NMP1 TS 3.1.5.b is not included in the scope of this LAR.

One ADS valve inoperable and 3.5.1.F.1 -------- No This Condition is not applicable to NMP TS. See Condition A entered. Variation 2.3.7.

3.5.1.F.2 -------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

RCIC [Reactor Core Isolation 3.5.3 ---------

Cooling] System RCIC system inoperable. 3.5.3.A -------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

-------- 3.1.3 Emergency Cooling System

Supplemental Information Revised Attachment 4 Page 11 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

-------- 3.1.3.b Yes One emergency cooling system inoperable. See Variation 2.3.9.

-------- 3.1.6 Control Rod Drive Pump Coolant Injection

-------- 3.1.6.b Yes When one redundant train becomes inoperable. See Variation 2.3.10.

Primary Containment Air Lock 3.6.1.2 Primary containment air lock 3.6.1.2.C.3 -------- No This Condition is not applicable to NMP TS. See inoperable for reasons other than Variation 2.3.7.

Condition A or B.

Primary Containment Isolation 3.6.1.3 3.3.4 Valves (PCIVs)

One or more penetration flow 3.6.1.3.A.1 3.3.4.b Yes TSTF-505 changes are incorporated.

paths with one PCIV inoperable [for reasons other than Condition[s] D

[and E)).

[One or more penetration flow 3.6.1.3.E -------- No This Condition is not applicable to NMP TS. See paths with one or more Variation 2.3.7.

containment purge valves not within purge valve leakage limits].

Reactor Building-to-Suppression 3.6.1.7 3.3.6 Chamber Vacuum Breakers

Supplemental Information Revised Attachment 4 Page 12 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

One line with one or more reactor 3.6.1.7.C 3.3.6.f(2) Yes TSTF-505 changes are incorporated.

building-to-suppression chamber vacuum breakers inoperable for opening.

Two [or more] lines with one or 3.6.1.7.D -------- No This Condition is not applicable to NMP TS. See more reactor building-to- Variation 2.3.7.

suppression chamber vacuum breakers inoperable for opening.

Suppression Chamber-to-Drywell 3.6.1.8 3.3.6 Vacuum Breakers One required suppression 3.6.1.8.A 3.3.6.c No TSTF-505 changes are not incorporated.

chamber-to-drywell vacuum breaker inoperable for opening.

Residual Heat Removal (RHR) 3.6.2.3 Suppression Pool Cooling One RHR suppression pool cooling 3.6.2.3.A -------- No This Condition is not applicable to NMP TS. See subsystem inoperable. Variation 2.3.7.

--------- 3.3.7 NMP1 Containment Spray System

-------- 3.3.7.b Yes TSTF-505 changes are incorporated. See Variation 2.3.11.

-------- 3.3.7.c Yes TSTF-505 changes are incorporated. See Variation 2.3.12.

Supplemental Information Revised Attachment 4 Page 13 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

-------- 3.3.7.d Yes TSTF-505 changes are incorporated. See Variation 2.3.13.

Residual Heat Removal (RHR) 3.6.2.4 Suppression Pool Spray One RHR suppression pool spray 3.6.2.4.A -------- No This Condition is not applicable to NMP TS. See subsystem inoperable. Variation 2.3.7.

--------- 3.3.7 NMP1 Containment Spray System

-------- 3.3.7.b Yes See TSTF 3.6.2.3. See Variation 2.3.9.

-------- 3.3.7.c Yes See TSTF 3.6.2.3. See Variation 2.3.10.

-------- 3.3.7.d Yes See TSTF 3.6.2.3. See Variation 2.3.11.

Drywell Cooling System Fans 3.6.3.1 ---------

Two [required] [drywell cooling 3.6.3.1.B.2 -------- No This Condition is not applicable to NMP TS. See system fans] inoperable. Variation 2.3.7.

Residual Heat Removal Service 3.7.1 Water (RHRSW) System One RHRSW pump in each 3.7.1.B -------- No This Condition is not applicable to NMP TS. See subsystem inoperable. Variation 2.3.7.

One RHRSW subsystem inoperable 3.7.1.C -------- No This Condition is not applicable to NMP TS. See for reasons other than Condition A. Variation 2.3.7.

Supplemental Information Revised Attachment 4 Page 14 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

--------- 3.3.7 NMP1 Containment Spray System

3.3.7.b Yes See TSTF 3.6.2.3. See Variation 2.3.11.

3.3.7.c Yes See TSTF 3.6.2.3. See Variation 2.3.12

3.3.7.d Yes See TSTF 3.6.2.3. See Variation 2.3.13

[Plant Service Water (PSW)] 3.7.2 System and [Ultimate Heat Sink (UHS)]

One [PSW] pump in each 3.7.2.B --------- No This Condition is not applicable to NMP TS. See subsystem inoperable. Variation 2.3.7.

One or more cooling towers with 3.7.2.C --------- No This Condition is not applicable to NMP TS. See one cooling tower fan inoperable. Variation 2.3.7.

One [PSW] subsystem inoperable 3.7.2.E --------- No This Condition is not applicable to NMP TS. See for reasons other than Condition[s] Variation 2.3.7.

A [and C].

Main Turbine Bypass System 3.7.7

[Requirements of the LCO not met 3.7.7.A --------- No This Condition is not applicable to NMP TS. See or Main Turbine Bypass System Variation 2.3.7.

inoperable].

AC Sources - Operating 3.8.1 3.6.3

Supplemental Information Revised Attachment 4 Page 15 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

One [required] offsite circuit 3.8.1.A.3 3.6.3.b Yes TSTF-505 changes are incorporated.

inoperable.

One [required] DG inoperable. 3.8.1.B.4 3.6.3.c Yes TSTF-505 changes are incorporated.

--------- 3.6.3.d Yes TSTF-505 changes are incorporated.

NMP1 TS 3.6.3.d states, If a reserve power transformer becomes inoperable it shall be returned to service within seven days. NMP1 intends to apply RICT to the seven-day completion time. This is a variation as reserve power transformers are not included in the TSTF. See Variation 2.3.15 Two [required] offsite circuits 3.8.1.C.2 3.6.3.e(2) Yes TSTF-505 changes are incorporated.

inoperable.

One [required] offsite circuit 3.8.1.D.1 3.6.3.c Yes TSTF-505 changes are incorporated.

inoperable.

AND One [required] DG inoperable. 3.8.1.D.2

[One [required] [automatic load 3.8.1.F --------- No This Condition is not applicable to NMP TS. See sequencer] inoperable. Variation 2.3.7.

DC Sources - Operating 3.8.4 3.6.3

Supplemental Information Revised Attachment 4 Page 16 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

One [or two] battery charger[s on 3.8.4.A.3 3.6.3.h Yes TSTF-505 changes are incorporated.

one division] inoperable. NMP1 TS 3.6.3.h states, If a battery system becomes inoperable that system shall be returned to service within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . A battery system consists of one battery, at least one battery charger, and the associated dc power distribution (battery) board.

One [or two] batter[y][ies on one 3.8.4.B 3.6.3.h Yes TSTF-505 changes are incorporated.

division] inoperable. NMP1 TS 3.6.3.h states, If a battery system becomes inoperable that system shall be returned to service within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . A battery system consists of one battery, at least one battery charger, and the associated dc power distribution (battery) board.

One DC electrical power subsystem 3.8.4.C 3.6.3.h Yes TSTF-505 changes are incorporated.

inoperable for reasons other than NMP1 TS 3.6.3.h states, If a battery system becomes Condition A [or B]. inoperable that system shall be returned to service within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . A battery system consists of one battery, at least one battery charger, and the associated dc power distribution (battery) board.

Inverters - Operating 3.8.7 One [required] inverter inoperable. 3.8.7.A --------- No This Condition is not applicable to NMP TS. See Variation 2.3.7.

Supplemental Information Revised Attachment 4 Page 17 of 17 Docket No. 50-220 Cross-Reference of TSTF-505 and Nine Mile Point Nuclear Station, Unit 1 Technical Specifications TSTF-505 Tech Spec Description TSTF-505 NMP1 Tech Spec Apply Comments Tech Spec RICT?

Distribution Systems - Operating 3.8.9 ---------

One or more AC electrical power 3.8.9.A --------- No This Condition is not applicable to NMP TS. See distribution subsystems Variation 2.3.7.

inoperable.

[One or more AC vital buses 3.8.9.B --------- No This Condition is not applicable to NMP TS. See inoperable]. Variation 2.3.7.

One or more [station service] DC 3.8.9.C --------- No This Condition is not applicable to NMP TS. See electrical power distribution Variation 2.3.7.

subsystems inoperable.

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.15 [NEW TS] 6.5.10 The NMP1 TS do not currently contain this program.

The new RICT Program will be added to the NMP1 TS 6.5.10 consistent with TSTF-505. The difference in TS section numbering is an administrative variation as described in Section 2.3 of Attachment 1.

ATTACHMENT 5 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information:

Revised Attachment 5 Information Supporting Instrumentation Redundancy and Diversity (This replaces Attachment 5 in Reference 1 in its entirety)

Supplemental Information Revised Attachment 5 Page 1 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity The following Instrumentation Technical Specifications (TS) Sections are included in this TSTF-505 License Amendment Request (LAR) for Nine Mile Point Nuclear Station, Unit 1 (NMP1).

1. RPS Instrumentation (Scram Function) - TS Section 3.6.2

2. Vessel/Containment Isolation (Including Shutdown Cooling and Reactor Water Cleanup Isolation)

3. Emergency Condenser Initiation

4. Core Spray Initiation (Including Inside Containment Isolation Valve Opening)

5. Containment Spray Initiation

6. Automatic Depressurization System (ADS) Initiation

7. Emergency Bus Undervoltage Protection Logic

8. High Pressure Coolant Injection (HPCI) Initiation Included below is a description of the redundant and diverse means available to mitigate accidents that each identified instrumentation and control function defined in TS Section 3 is designed to prevent.

The following abbreviations are used within the Event column of the included tables:

DBA - Design Bases Accident ATWS - Anticipated Transient Without Scram OT -Operational Transient Definition:

Transient -Analyzed conditions which are anticipated or abnormal but reasonably expected during the life of the plant (moderate frequency and infrequent events).

Supplemental Information Revised Attachment 5 Page 2 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

1. RPS Instrumentation (Scram Function)

Reference:

TS 3.6.2 Protective Instrumentation The RPS design creates defense-in-depth from the redundancy of the channels for each Function Unit.

Each Functional Unit has multiple channels.

Each Functional Unit will cause a reactor trip with 2/2, 2/4, 3/4, or 2/8 tripped channels.

See the detailed list provided below for more information.

A failed channel does not cause or prevent a trip.

2/2 is defined as two channels two trip systems, one channel per trip system and is used for manual initiation (de-energize to trip) logic, e.g., (Channel A1) and (Channel B1).

2/4 is defined as four channels, two trip systems, two channels per trip system arranged in one-out-of-two twice (de-energize to trip) logic, e.g., (Channel A1 or A2) and (Channel B1 or B2).

3/4 is defined as four non-independent channels, two trip systems, two channels per trip system arranged in one-out-of-two twice (de-energize to trip) logic such that any one instrument will not trip any channel, any two instruments will trip up to one channel in one trip system, and any three instruments will trip at least one channel in each trip system.

2/8 is defined as eight channels, two trip systems, four channels per trip system arranged in one-out-of-four twice (de-energize to trip) logic, e.g., (Channel A1 or A2 or A3 or A4) and (Channel B1 or B2 or B3 or B4).

Manual Scram - 2/2

High Reactor Pressure - 2/4

High Drywell Pressure - 2/4

Low Reactor Water Level - 2/4

High Water Level Scram Discharge Volume - 2/4

Main-Steam-Line Isolation Valve Position (Closure) - 2/8 Each channel can trip from either its inboard or outboard valve closing.

Reactor Mode Switch (Shutdown Position) - 2/2 Single Mode Switch inputs to both channels.

Intermediate Range Monitors - 2/8 Each trip system may have one channel inoperative

Average Power Range Monitors - 2/8 Each trip system may have one channel inoperative

Turbine Stop Valve (Closure) - 3/4

Generator Load Rejection (Turbine Trip/ Turbine Stop Valve Rapid Closure) - 2/4 In addition, NMP1 has an Anticipated Transient Without Scram (ATWS) Mitigation System designed to mitigate the effects of an ATWS event. It uses Alternate Rod Injection (ARI) and reactor Recirc Pump Trip (RPT), which increases the diversity and reliability of the reactivity control system, thereby decreasing the probability and potential consequences of an ATWS event. The ATWS mitigation system is initiated automatically by either Low-Low Reactor Water Level or High Reactor Pressure in a two-out-of-two-taken-once energize to actuate logic system.

Supplemental Information Revised Attachment 5 Page 3 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity The NMP1 design also includes a Standby Liquid Control (Liquid Poison) system as an independent backup. Liquid poison is manually initiated to inject boron into the Reactor Vessel while an interlock operates to shut down and isolate the Reactor Water Clean-Up system to prevent removal of the injected boron.

Notes:

In TS Table 3.6.2a, Instrumentation that Initiates Scram, parameter number (7) has been deleted.

Several items listed in TS Table 3.6.2a are not specifically credited in any transients or accidents in UFSAR chapter XV. These functions are still considered safeguards but are not analyzed since they are relied upon during the most limiting case of any transient or accident. For example, the High Pressure setpoint will be reached during the Inadvertent Startup of a Cold Recirc Loop transient, however the system will have already tripped on Neutron Flux, APRM Upscale.

Supplemental Information Revised Attachment 5 Page 4 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Reactor Protection System (RPS)

Credited Safety Analysis Event TS RPS Instrument USAR Diverse Instrumentation Event Table Function Transient / Accident Section 3.6.2a 1. Manual Scram None Manual Scram Manual Trip N/A

- Mode Switch to Shutdown

- De-energize Trip System Power

- Manually Initiate ARI 3.6.2a 2. High Reactor None Anticipated Transient 1. Automatic Initiation ATWS Pressure Without Scram -High Reactor Pressure or Low-Low Water Level

2. Manual Initiation 3.6.2a 3. High Drywell XV.C.2 Loss-of-Coolant 1. Automatic Initiation DBA Pressure Accident -Low Reactor Water Level or High Drywell Pressure

2. Manual Initiation XV.C.5 Containment Design 1. Automatic Initiation DBA Basis Accident -Low Reactor Water Level or High Drywell Pressure

2. Manual Initiation 3.6.2a 4. Low Reactor XV.C.2 Loss-of-Coolant 1. Automatic Initiation DBA Water Level Accident -Low Reactor Water Level or High Drywell Pressure

2. Manual Initiation XV.C.5 Containment Design 1. Automatic Initiation DBA Basis Accident -Low Reactor Water Level or High Drywell Pressure

2. Manual Initiation XV.B.3.13 Feedwater Controller 1. Automatic Initiation OT Malfunction (Zero -Low Reactor Water Level Demand) - Main-Steam-Line Isolation Valve Position

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 5 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Reactor Protection System (RPS)

Credited Safety Analysis Event TS RPS Instrument USAR Diverse Instrumentation Event Table Function Transient / Accident Section 3.6.2a 5. High Water Level None None 1. Automatic Initiation N/A Scram Discharge -High Water Level Scram Volume Discharge Volume

2. Manual Initiation 3.6.2a 6. Main-Steam-Line XV.B.3.5 Main Steam Line 1. Automatic Initiation OT Isolation Valve Isolation Vale Closure -Main-Steam-Line Isolation Valve Position (With Scram) Position

-Neutron Flux, APRM, Upscale

-High Reactor Pressure

2. Manual Initiation XV.C.1 Main Steam Line Break 1. Automatic Initiation DBA Outside the Drywell -Main-Steam-Line Isolation Valve Position

-Low Reactor Water Level

2. Manual Initiation 3.6.2a 7. Deleted N/A N/A N/A N/A 3.6.2a 8. Shutdown None Manual Scram Manual Trip N/A Position of Reactor - Manual Scram Buttons Mode Switch - De-energize Trip System Power

- Manually Initiate ARI 3.6.2a 9.a.i Neutron Flux, None None 1. Automatic Initiation N/A IRM, Upscale - Neutron Flux, IRM, Upscale

2. Manual Initiation 3.6.2a 9.a.ii Neutron Flux, None None 1. Automatic Initiation N/A IRM, Inoperative - Neutron Flux, IRM, Inoperative

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 6 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Reactor Protection System (RPS)

Credited Safety Analysis Event TS RPS Instrument USAR Diverse Instrumentation Event Table Function Transient / Accident Section 3.6.2a 9.b.i Neutron Flux, XV.B.3.6 Inadvertent Startup of 1. Automatic Initiation OT APRM, Upscale Cold Recirculation Loop - Neutron Flux, APRM, Upscale

2. Manual Initiation XV.B.3.12 Safety Valve Actuation 1. Automatic Initiation OT (Overpressurization - Neutron Flux, APRM, Upscale Analysis) 2. Manual Initiation 3.6.2a 9.b.ii Neutron Flux, None None 1. Automatic Initiation N/A APRM, Inoperative - Neutron Flux, APRM, Inoperative

2. Manual Initiation 3.6.2a 10. Turbine Stop XV.B.3.1 Turbine Trip Without 1. Automatic Initiation OT Valve Closure Bypass - Turbine Stop Valve Closure

- Neutron Flux, APRM, Upscale

- High Reactor Pressure

2. Manual Initiation XV.B.3.3 Feedwater Controller 1. Automatic Initiation OT Failure (Maximum - Turbine Stop Valve Closure Demand) - Neutron Flux, APRM, Upscale

- High Reactor Pressure

2. Manual Initiation XV.B.3.14 Turbine Trip with Partial 1. Automatic Initiation OT Bypass (Low Power) - Turbine Stop Valve Closure

- High Reactor Pressure

2. Manual Initiation XV.B.3.15 Turbine Trip with Partial 1. Automatic Initiation OT Bypass (High Power) - Turbine Stop Valve Closure

- Neutron Flux, APRM, Upscale

- High Reactor Pressure

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 7 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Reactor Protection System (RPS)

Credited Safety Analysis Event TS RPS Instrument USAR Diverse Instrumentation Event Table Function Transient / Accident Section XV.B.3.18 Loss of Condenser 1. Automatic Initiation OT Vacuum - Turbine Stop Valve Closure

- High Reactor Pressure

2. Manual Initiation XV.B.3.20 Loss of Auxiliary Power 1. Automatic Initiation OT

- Turbine Stop Valve Closure

- High Reactor Pressure

2. Manual Initiation 3.6.2a 11. Generator Load XV.B.3.19 Loss of Electrical Load 1. Automatic Initiation OT Rejection - Turbine Stop Valve Rapid Closure

- Turbine Stop Valve Closure

- Neutron Flux, APRM, Upscale

- High Reactor Pressure

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 8 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

2. Vessel/Containment Isolation (Including Shutdown Cooling and Reactor Water Cleanup Isolation)

Reference:

TS 3.2.7 Reactor Coolant System Isolation Valves TS 3.3.4 Primary Containment Isolation Valves The Primary Containment at Nine Mile Point Unit 1 is required to contain the mass and energy released during a design basis LOCA, which is defined as an instantaneous double-ended rupture of a reactor coolant system recirculation line. During this event, water and steam from the reactor vessel flash into the drywell forcing the drywell atmosphere into the suppression chamber airspace through the vent pipes, vent header, and downcomers.

The Primary Containment Isolation design creates defense-in-depth from the redundancy of the channels for each Functional Unit.

Each Functional Unit has multiple channels.

Each Functional Unit will cause an isolation with 2/2, 2/4, 2/8, 2/16, 1/4, or 1/12 tripped channels.

A failed channel does not cause or prevent a trip.

2/2 is defined as two channels two trip systems, one channel per trip system and is used for manual initiation (de-energize to trip) logic, e.g., (Channel A1) and (Channel B1).

2/4 is defined as four channels, two trip systems, two channels per trip system arranged in one-out-of-two twice (de-energize to trip) logic, e.g., (Channel A1 or A2) and (Channel B1 or B2).

2/8 is defined as eight channels, two trip systems, four channels per trip system arranged in one-out-of-four twice (de-energize to trip) logic, e.g., (Channel A1 or A2 or A3 or A4) and (Channel B1 or B2 or B3 or B4).

2/16 is defined as 16 channels, two trip systems, eight channels per trip system arranged in a one-out-of-eight twice (de-energize to trip) logic.

1/4 is defined as 4 channels, one trip systems arranged in a one-out-of-four (de-energize to trip) logic.

1/12 is defined as 12 channels, one trip system arranged in a one-out-of-twelve (de-energize to trip) logic.

Table 3.6.2b & 4.6.2b Instrumentation that initiates primary coolant system or containment Isolation

Primary coolant isolation (Main steam, cleanup, & Shutdown cooling) o Low-Low Reactor Water Level - 2/4 o Manual - 2/2

Main Steam Line Isolation o High steam flow main-steam line - 2/8 o Low reactor pressure - 2/4 o Low-low-low condenser vacuum - 2/4 o High temperature main steam line tunnel - 2/16

Cleanup system isolation

Supplemental Information Revised Attachment 5 Page 9 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity o High area temperature - 1/12 o Liquid Poison Initiation - 1/2

Shutdown Cooling System Isolation o High area temperature - 1/4

Containment Isolation o Low-Low reactor water level - 2/4 o High drywell pressure - 2/4 o Manual - 2/2

Supplemental Information Revised Attachment 5 Page 10 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Primary Containment Isolation TS Table Instrument Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Transient/Design Basis Section Accident Primary Coolant Isolation (Main Steam, Cleanup, & Shutdown Cooling) 3.6.2b Low low reactor XV.C.5 Containment Design Basis 1. Automatic Initiation DBA water level Accident - Low-Low Reactor Water Level

2. Manual Initiation Main Steam Line Isolation 3.6.2b High steam flow XV.C.1 Main Steam Line Break 1. Automatic Initiation DBA Main-Steam Line Outside the Drywell - High steam flow main-steam line

- Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation 3.6.2b Low Reactor Pressure XV.C.2 Loss-of-Coolant Accident 1. Automatic Initiation DBA

- High steam flow main-steam line

- Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation XV.B.3.13 Feedwater Controller 1. Automatic Initiation OT Malfunction (Zero - High steam flow main-steam line Demand) - Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 11 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Primary Containment Isolation TS Table Instrument Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Transient/Design Basis Section Accident XV.B.3.21 Pressure Regulator 1. Automatic Initiation OT Malfunction - High steam flow main-steam line

- Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation 3.6.2b Low-Low-Low XV.B.3.18 Loss of Main Condenser 1. Automatic Initiation OT Condenser Vacuum Vacuum - High steam flow main-steam line

- Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation 3.6.2b High Temperature XV.C.1 Main Steam Line Break 1. Automatic Initiation DBA Main Steam Line - High steam flow main-steam line Tunnel - Low Reactor Pressure

- Low-Low-Low Condenser Vacuum

- High Temperature MSL Tunnel

2. Manual Initiation Cleanup System Isolation 3.6.2b High Area None None 1. Automatic Initiation N/A Temperature - High Area Temperature (Cleanup) - Liquid Poison Initiation

2. Manual Initiation 3.6.2b Liquid Poison None None 1. Automatic Initiation N/A Initiation - High Area Temperature

- Liquid Poison Initiation

2. Manual Initiation Shutdown Cooling System Isolation

Supplemental Information Revised Attachment 5 Page 12 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Primary Containment Isolation TS Table Instrument Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Transient/Design Basis Section Accident 3.6.2b High Area Temp. None None 1. Automatic Initiation N/A (Shutdown Cooling) - High Area Temp. (Shutdown Cooling)

2. Manual Initiation Containment Isolation 3.6.2b Low Low Reactor XV.C.5 Containment Design Basis 1. Automatic Initiation DBA Water Level Accident - Low Low Reactor Water Level

- High Drywell Pressure

2. Manual Initiation 3.6.2b High Drywell XV.C.2 Loss-of-Coolant Accident 1. Automatic Initiation DBA Pressure - High Drywell Pressure

- Low Low Reactor Water Level

2. Manual Initiation XV.C.5 Containment Design Basis 1. Automatic Initiation DBA Accident - High Drywell Pressure

- Low Low Reactor Water Level

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 13 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

3. Emergency Condenser Initiation

Reference:

TS 3.1.3 Emergency Condenser Initiation The emergency cooling initiation logic is separated into two trip systems which use a one-out-of-two taken twice logic configuration. The actuation of a single trip system will cause a half emergency cooling system initiation. A high reactor pressure or low-low reactor water level signal from an instrument channel will de-energize its corresponding time delay relay after 12 seconds.

Automatic isolation of the emergency cooling systems (loops) occurs on a high steam flow isolation signal from the four dP transmitters connected to the steam supply lines (two transmitters per steam line). Each dP transmitter provides the sensor inputs to its respective instrument channel.

The Emergency Condenser design creates defense-in-depth from the redundancy of the channels for the Trip Function

Trip Function (Emergency Condenser System Actuation) has multiple channels.

Trip Function (Emergency Condenser System Actuation) will cause a Trip Function with 2/4 tripped channels.

Emergency Condenser System has two automatically actuated independent full-capacity systems.

Emergency Cooling Isolation will cause a Trip Function in the given Emergency Condenser Sub-system with 1/2 tripped channels. Each Emergency Condenser subsystem has one trip system with 2 channels.

A failed channel does cause or prevent a trip.

Emergency Condenser Initiation

Low-Low Reactor Water Level OR High Reactor Pressure 2/4 is defined as two channels, one trip system arranged in a one-out-of-two once (de-energize to initiate) logic, e.g., (Channel A) or (Channel C).

o High Reactor Pressure o Low-low Reactor Water Level Emergency Cooling Isolation

High Emergency Cooling System Flow (for each of two systems) 1/2 is defined as four channels, one trip system arranged in a one-out-of-two (energize to initiate) logic, e.g., (Channel A or Channel C) or (Channel B or Channel D) to isolate the given Emergency Condenser subsystem (11 or 12, respectively).

o High Steam Flow

Supplemental Information Revised Attachment 5 Page 14 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Instrument Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Transient/Design Basis TS Table Section Accident 3.6.2c High-Reactor XV.B.3.5 Main Steam Line Isolation 1. Automatic Initiation OT Pressure Valve Close (W/Scram) - High Reactor Pressure Or XV.B.3.1 Turbine Trip Without OR OT Low-Low Reactor Bypass -Low-Low Reactor Level Level XV.B.3.15 Turbine Trip With Partial 2. Manual Initiation OT Bypass (Full Power)

XV.B.3.13 Feedwater Controller Malfunction (Zero OT Demand)

XV.B.3.19 Loss Of Electric Load (Generator Trip) OT XV.B.3.20 Loss Of Auxiliary Power OT XV.B.3.22 Instrument Air Failure OT

Supplemental Information Revised Attachment 5 Page 15 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

4. Core Spray Initiation (Including Inside Containment Isolation Valve Opening Initiation)

Reference:

TS 3.3.5.1 Core Spray Initiation with Inside Containment Isolation Valve Opening Initiation The Core Spray System in conjunction with the Automatic Depressurization System (ADS) is the standby emergency core cooling system for removal of decay heat from the reactor fuel assemblies in the event of a loss of coolant accident. In conjunction with the ADS, the Core Spray system provides the required core cooling for small breaks. Without assistance from the ADS, the CSS is capable of providing the required core cooling for large break sizes up to the largest possible break consisting of a double ended rupture of a reactor recirculation line. For small breaks depressurization via ADS is needed to bring reactor pressure below CSS pressure permissive. Core Spray System Initiation shall be automatic upon receipt of appropriate initiation signals from the RPS. Core Spray System has two automatically actuated independent full-capacity systems. Each set of pumps, consisting of one core spray pump and one topping pump delivers water directly above the core.

The Inside Containment Isolation valves (40-01, 40-09, 40-10, 40-11) are normally closed.

These valves function as core spray Inside Containment Isolation valves and automatically open during Core Spray System initiation when the reactor vessel drops to 365 psig. There are two core spray inlet valves for each loop, and they are installed in parallel to provide redundant flow paths into the vessel. These are normally closed AC MOV and open automatically during system initiation (LL H2O level or Hi DW Pres) when reactor pressure drops below 365 psig. The safety function is to open for core spray injection.

The Core Spray design creates defense-in-depth from the redundancy of the channels for the Trip Function (Core Spray System Actuation).

Trip Function (Core Spray System Actuation) has multiple channels.

Trip Function (Core Spray System Actuation) will cause a Trip Function with 2/4 tripped channels.

A failed channel does cause or prevent a trip (except Manual).

2/4 is defined as four channels, two trip systems, two channels per trip system arranged in one-out-of-two twice (de-energize to trip) logic, e.g., (Channel A1 or A2) and (Channel B1 or B2).

Core Spray Initiation

Low-Low Reactor Water Level OR High Drywell Pressure 2/4

Manual Inside Containment Isolation Valve Opening Initiation

Low-Low Reactor Water Level OR High Drywell Pressure AND

Reactor Vessel Pressure Lower than 365 psig.

Supplemental Information Revised Attachment 5 Page 16 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity Instrument Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Transient/Design Basis TS Table Section Accident 3.6.2d High Drywell Pressure XV.C.2.0 Loss of Coolant Accident 1)Automatic Initiation DBA

- Pump Start - High Drywell Pressure

- Low-Low Reactor Water Level

2) Manual Initiation XV.C.5.0 Containment Design Basis 1)Automatic Initiation DBA Accident - High Drywell Pressure

- Low-Low Reactor Water Level

2) Manual Initiation XV.C.2.0 Loss of Coolant Accident 1)Automatic Initiation DBA

- Low-Low Reactor Water Level

- High Drywell Pressure

2) Manual Initiation Low-Low Reactor Level - Pump Start XV.C.5.0 Containment Design Basis 1)Automatic Initiation DBA Accident - Low-Low Reactor Water Level

- High Drywell Pressure

2) Manual Initiation XV.C.2.0 Loss of Coolant Accident 1)Automatic Initiation DBA

- Low Reactor Pressure and either High Drywell Pressure or Low-Low Low Reactor Pressure Reactor Water Level

2) Manual Initiation Open Core Spray Discharge Valves XV.C.5.0 Containment Design Basis 1)Automatic Initiation DBA Accident

Supplemental Information Revised Attachment 5 Page 17 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

- Low Reactor Pressure and either High Drywell Pressure or Low-Low Reactor Water Level

2) Manual Initiation

Supplemental Information Revised Attachment 5 Page 18 of 25 Docket 50-220 Information Supporting Instrumentation Redundancy and Diversity

4. Containment Spray Initiation

Reference:

TS 3.3.7 AND 4.3.7 Containment Spray System (Containment Spray System Initiation)

The Containment Spray System is designed to provide a high degree of reliability in meeting the design functional requirements.

o Each loop is designed with heat removal capacity well in excess of the expected maximum.

o The two loops are sufficiently separated to minimize the possibility of coincident active failures.

o Automatic initiation of all four pumps of the Containment Spray System assures that the containment will not be over pressurized.

o The Containment Spray System is used in conjunction with the core spray system to condense the steam in the drywell that is released from core spray heat removal process.

o The Containment Spray System provides additional means of heat removal with Electromagnetic Relief Valves with Containment Spray in Torus Cooling Mode.

The Containment Spray System is normally in standby, lined up for automatic start. It is initiated by two, simultaneous signals: High Drywell pressure at 3.5 psig, AND a Low-Low Reactor level at 5 inches.

The Containment Spray System Initiation creates defense-in-depth from the redundancy of the channels for each loop.

o Initiation Function has multiple channels.

o Initiation Function will cause an Actuation with 2/4 tripped channels for that instrumentation function.

o High Drywell Pressure AND Low-Low Reactor Level Logic (Channel 11 and Channel 12) o A failed channel does not prevent a trip, but may cause a trip depending on the logic design 2/4 is defined as four sub-channels (11/1, 11/2, 12/1, 12/2), two trip systems, two channels per trip system arranged in a one-out-of-two twice (de-energize to trip) logic.

Once the 2/4 logic is satisfied for both High Drywell Pressure AND Low-Low Reactor Water Level, the Containment Spray System Initiation Logic will be satisfied and the system will initiate.

Supplemental Information Revised Attachment 5 Page 19 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity TS Table Containment Spray Credited Safety Analysis Event Diverse RPS Instrumentation for Event Function UFSAR Transient/Design Basis Containment Spray System Section Accident 3.6.2e High Drywell XV.C.2.0 Loss of Coolant Accident 1) Automatic Initiation DBA Pressure - High Drywell Pressure AND AND Low-Low Reactor Water Level Low-Low Reactor 2) Manual Initiation Water Level XV.C.5.0 Containment Design Basis 1) Automatic Initiation DBA Accident - High Drywell Pressure AND Low-Low Reactor Water Level

2) Manual Initiation

Supplemental Information Revised Attachment 5 Page 20 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity

5. Automatic Depressurization System (ADS) Initiation

Reference:

TS 3.1.5 Solenoid-Actuated Pressure Relief Valves (Automatic Depressurization System):

The ADS design creates defense-in-depth from the redundancy of the channels for the Trip Function.

Initiation Function has multiple channels.

Initiation Function will cause an Actuation with 2/4 tripped channels.

A failed channel does cause or prevent a trip.

Manual initiation Automatic Depressurization System (ADS) 2 Systems - A & B, either system A or B will cause all ADS valves to open.

o Reactor Vessel Water Level (Low Low Low - Level 1) - 2/4 o Drywell Pressure (High) - 2/4 o All contacts in one trip system must close to initiate ADS trip system 2/4 is defined as four channels, one trip system arranged in a one-out-of-two twice (energize to initiate) logic, e.g., (Channel A or Channel C) and (Channel B or Channel D).

Supplemental Information Revised Attachment 5 Page 21 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 Automatic Depressurization System (ADS)

Credited Safety Analysis Event TS Instrument USAR Diverse Instrumentation Event Table Function Transient / Accident Section 3.6.2f Low-Low-Low XV.C.1.0 Main Steam Line Break 1. Automatic Initiation DBA Reactor Water Level Outside the Drywell -Low-Low-Low Reactor Water Level

2. Manual Initiation XV.C.2.0 Loss-of-Coolant Accident 1. Automatic Initiation DBA

-Low-Low-Low Reactor Water Level AND High Drywell Pressure

2. Manual Initiation XV.C.5.0 Containment Design 1. Automatic Initiation DBA Basis Accident -Low-Low-Low Reactor Water Level AND High Drywell Pressure

2. Manual Initiation High Drywell XV.C.2.0 Loss-of-Coolant Accident 1. Automatic Initiation DBA Pressure -Low-Low-Low Reactor Water Level AND High Drywell Pressure

2. Manual Initiation XV.C.5.0 Containment Design 1. Automatic Initiation DBA Basis Accident -Low-Low-Low Reactor Water Level AND High Drywell Pressure

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 22 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity

6. High Pressure Coolant Injection (HPCI) Initiation

Reference:

TS 3.1.8 High Pressure Coolant Injection TS Table 3.6.2k High Pressure Coolant Injection HPCI initiation is prompted by the Reactor Protection System under the following conditions: 1)

A turbine trip or 2) Low reactor water level. If a reactor scram occurs prior to low reactor level being reached (e.g., as may be the case due to high drywell pressure under LOCA conditions),

the Turbine Control System contains a five second time delay before the turbine is tripped.

The High Pressure Coolant Injection (HPCI) System is a mode of operation of the Condensate and Feedwater Systems rather than an independent, stand alone system. The High Pressure Coolant Injection System (HPCI) is provided to ensure adequate core cooling in the unlikely event of small reactor coolant line break. The HPCI System is available for line breaks which exceed the capability of the Control Rod Drive pumps and which are not large enough to allow fast enough depressurization for core spray to be effective.

The HPCI initiation design creates defense-in-depth from the redundancy of the channels for the Trip Function.

Initiation Function has multiple channels.

Initiation Function will cause an Actuation with 2/4 tripped channels.

A failed channel does cause or prevent a trip.

HPCI Initiation:

- Low reactor level - 2/4

- Turbine Trip - 2/2 2/2 is defined as two channels two trip systems, one channel per trip system and is used for manual initiation (de-energize to trip) logic, e.g., (Channel A1) and (Channel B1).

2/4 is defined as four channels, one trip system arranged in a one-out-of-two twice (energize to initiate) logic, e.g., (Channel A or Channel C) and (Channel B or Channel D).

Supplemental Information Revised Attachment 5 Page 23 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity Unit 1 High Pressure Coolant Injection (HPCI) Initiation Credited Safety Analysis Event TS Instrument USAR Event Table Function Transient / Accident Section 3.1.8 Low Reactor Water None None 1. Automatic Initiation None Level - Low Reactor Water Level

2. Manual Initiation Turbine Trip None None 1. Automatic Initiation None

- Turbine Trip

2. Manual Initiation

Supplemental Information Revised Attachment 5 Page 24 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth Defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o Current Technical Specifications (TS) reflect this balance by allowing one sensor module or channel to be placed in trip, while preserving the fundamental safety function of the applicable system. Tripping an inoperable channel does not affect the number of channels required to provide the safety function. Even in the TS condition for two channels in a function inoperable, the fundamental safety function is preserved since sufficient operable channels remain in the function.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one or two channels of the applicable instrumentation are inoperable. The remaining operable channels for that function are fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable functions has not been decreased (diversity), the number of minimum operable channels to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one channel inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable instrumentation and its functions. It may allow the allowed outage time to be extended for one or two channels in a function to be inoperable prior to placing the channel in trip. Placing the channel in trip fulfils one of the two required channels in trip needed to perform the safety function.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Supplemental Information Revised Attachment 5 Page 25 of 25 Docket No. 50-220 Information Supporting Instrumentation Redundancy and Diversity

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the allowed outage time does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no change to the defenses against that potential human error have been altered.

The intent of the plants design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the Updated Safety Analysis Report (USAR). Redundancy, diversity of signal and independence of trip channel functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the Risk Informed Completion Time (RICT) Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

ATTACHMENT 6 Nine Mile Point Nuclear Station, Unit 1 Renewed Facility Operating License DPR-63 Docket No. 50-220 Supplemental Information:

Revised Enclosure 4, Section 4 (This replaces Enclosure 4 Section 4 in Reference 1 in its entirety)

Supplemental Information Page 1 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 4 EXTREME WINDS ANALYSIS (Revised)

A review was performed of the NMP1 UFSAR (Reference [1]), the NMP1 Individual Plant Examination for External Events (IPEEE) (References [2] and [3]) and ECP-15-000703, "High Wind Vulnerability Evaluation for Nine Mile Point Unit 1" (Reference [4]). NMP1 is a pre-GDC plant; as such, it was not designed or licensed to modern standards. ECP-15-000703 includes a consolidated discussion of the historical design information and acknowledges the lack of a tornado missile design basis at NMP1. Based on the design information in the UFSAR and ECP-15-0008703 and the risk assessment performed for the IPEEE, the high winds hazard does not screen out for this TSTF-505 application.

For the TSTF-505 application, a simplified risk analysis is used to estimate the CDF and LERF associated with high winds, including tornado missiles at NMP1. Conservative penalty factors are developed to account for the risk associated with high winds, including tornado missiles during RICT configurations. The detailed analysis of high wind risk for this application is discussed in Section 2.1 of N1-MISC-015 external hazard assessment (Reference [5]). The key points and results of the analysis are summarized below.

Section 3 of DCD-120 (Reference [6]) provides the original NMP1 design bases. The design high wind velocity is 125 mph (30 feet above ground), which is equivalent to severe environmental loading and the severe tornado load is the same as the high wind severe load.

The extreme tornado load (i.e., the wind speed capacity of structures required for safe shutdown) is 175 mph. Section 1.2 of ECP-15-000703 notes that NMP1 is not licensed to tornado wind loading and is instead licensed to high wind loading.

Table XVI-31 from the UFSAR provides the wind speeds and wind pressure capabilities of key NMP1 structures. ECP-15-000703 reviewed this table with other legacy design documents and structural calculations for wind pressure capacities and compared them with those given in the UFSAR (i.e., Table XVI-31). As a result of the ECP-15-000703 conclusions, some wind capacities (e.g., the EDG building and Screenhouse) were updated for this risk application. The key NMP1 structures considered for risk impact from wind pressure failures are listed in Table E4-1.

The IPEEE (Reference [2]) estimated the NMP1 CDF for tornado and wind loadings to be approximately 1.6E-6/yr, assuming credit for operators to utilize the east and west instrument rooms to control the plant during a station blackout. Without credit for the procedure, CDF was estimated to be 2.1E-6/yr. This is above the quantitative CDF screening criterion of 1E-6/yr.

The basic approach to estimation of the high wind risk for the TSTF-505 application is to perform a numerical convolution calculation of the NMP1 high wind hazard curves with NMP1 SSC wind fragilities.

Supplemental Information Page 2 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Table E4-1: Key Structures and Design Capacities for Wind Pressure Failures29 Design Capacity Structure (mph)(1) Affected SSCs Comments Screenhouse (above 150 EDG CW pumps, Diesel and Electric 150 mph per Table XVI-31, but ECP-15-000703 indicates that Elev. 261') Fire pumps, Containment Spray the precast wall panels and supporting structure may only be pumps, ESW pumps, SW pumps rated for ~125 mph. However, upon more detailed review, it was determined that the panels 40psf loading reflected the windward side (controlling) loading corresponding to a 150mph wind (37.5psf is the actual value). Therefore, 150 mph from Table XVI-31 was confirmed as the design wind speed.

Main Stack 145 Main stack failure can affect the Per Note (4) of Table XVI-31, 177 mph at the top of the stack Screenhouse, EDG building, and corresponds to yield stress levels and is equivalent to 145 mph Reactor Building, per UFSAR Figure at 30 ft above grade. Hazard curve wind speeds are at 33 ft (10 III-23. m) above grade, so 145 mph is slightly conservative (wind speeds increase with increasing elevation above grade).

EDG Building and 175 EDGs and associated switchgear. Although the DG Area and DG Board Room have higher Board Rooms capacities in Table XVI-31, ECP-15-000703 indicates that the DG roof limits the capacity to 175 mph. ECP-15-00703 could not confirm the DG board room wall and roof capacity. Based on a walkdown and review of DG Building and DG Board Room drawings, the DG Board Rooms were determined to be of similar construction to the DG Building (Diesel Gen. Area in Table XVI-31). It was concluded that the DG Board Rooms wind capacity is higher (due to shorter horizontal and vertical spans) than the DG Building, which is reflected in Table XVI-31 of the UFSAR and, as a result, the 175-mph roof capacity can be conservatively used as the limiting capacity for the DG and DG Board Room structures.

29 Replaces Table E4-4 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 3 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Design Capacity Structure (mph)(1) Affected SSCs Comments Reactor Building (El. 190 ECs on refuel floor ECP-15-000703 confirms the wind loads in Table XVI-31for the 340' Refuel Floor) RB steel superstructure.

Reactor Building 300 ECCS and electrical systems. A simple calculation in ECP-15-00703 indicates that the RB (Below 340) concrete superstructure can withstand the 300-mph wind load in Table XVI-31. Failure of the reactor building superstructure above elevation 340 (at 190 mph) is bounding for the purposes of the risk assessment.

Turbine Building - 285 125VDC Batteries and Buses 285 mph per Table XVI-31.

Battery and Battery Board Rooms Turbine Building 235 Control Room Per Note (2) of Table XVI-31, modification of the structural (Control Room) support steel should result in a capacity of 300 mph wind pressure. However, no evidence of such modifications could be located. Therefore, 235 mph (steel framing capacity) is used.

Turbine Building 190 Cables, BOP, EC make-up TB superstructure capacity is 190 mph per Table XVI-31. ECP-(above Elev. 261') 15-000703 concluded that a majority of the loading criteria for the TB superstructure is valid. The main discrepancy is that several structural members were identified in previous analyses as needing reinforcement or replacement, but upgrades or modifications could not be confirmed. Since ECP-15-000703 does not provide an alternative (lower) capacity, it is assumed that the TB superstructure can withstand 190 mph winds. The uncertainty associated with the TB capacity is addressed in the fragility parameters for the TB.

Notes: (1) NMP1 design capacity windspeeds are in units of "fastest-mile" mph.

Supplemental Information Page 4 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Wind Hazards A tornado hazard curve for NMP1 was developed using Enhanced Fujita (EF) scale tornado wind speed estimates from Table 6-1 of NUREG/CR-4461 Revision 2 (Reference [7]). The EF-Scale is the more current tornado wind speed estimation method and was also used for the Ginna TSTF-505 tornado missile analysis and penalty factor in Enclosure 4 (Reference [8]);

Ginna and NMP1 are relatively close geographically and have the same tornado hazard data in Table 6-1 of NUREG/CR-4461, Rev 2. The exponential curve-fit equation (y = 0.0378e-0.063x) was used to calculate the tornado wind hazard interval frequencies used in the risk assessment of NMP1 wind pressure risk.

Due to the relatively low design wind speeds for some of the important NMP1 structures (e.g.,

DG Building), the straight wind hazard must also be determined for NMP1. Although the risk from straight winds was not evaluated in the IPEEE, the vulnerability of low-capacity structures to relatively low-speed winds with a relatively high frequency cannot be dismissed. Although these NMP1 structures meet the NMP1 high wind design bases, the straight wind induced structural failures are significant contributors to the overall wind pressure risk at NMP1.

The current release of ASCE 7-22 includes new long-return-period hazard maps for wind and tornados, which are available via the online ASCE Hazard Tool (Reference [9]). These hazard maps are the product of research work performed by NIST with the support of NRC. The ASCE Hazard Tool provides Mean Recurrence Interval (MRI) wind speeds based on map location and/or latitude/longitude. Data points for the 100-year through 1,000,000-year MRI wind speeds were obtained and an exponential curve equation (y = 239.05e-0.111x) was used to calculate the straight wind hazard interval frequencies used in the risk assessment of NMP1 wind pressure risk.

The tornado and straight wind hazard intervals used in the risk assessment are provided in Table E4-2 below.

Table E4-2: NMP1 Tornado and Straight Wind Hazard Intervals30 STRAIGHT Hazard TORNADO STRAIGHT WIND Lower Interval TORNADO Hazard WIND Lower Hazard Bound Represent. Lower Bound Interval Bound Interval Wind Wind Exceedance Occurrence Exceedance Occurrence Hazard Speed Speed(1) Frequency(2) Frequency(3) Frequency(2) Frequency(3)

Interval (mph) (mph) (/yr) (/yr) (/yr) (/yr) 0 73 86.7 3.80E-04 3.23E-04 7.23E-02 6.98E-02 1 103 111.2 5.75E-05 3.78E-05 2.59E-03 2.20E-03 30 Replaces Table E4-5 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 5 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 STRAIGHT Hazard TORNADO STRAIGHT WIND Lower Interval TORNADO Hazard WIND Lower Hazard Bound Represent. Lower Bound Interval Bound Interval Wind Wind Exceedance Occurrence Exceedance Occurrence Hazard Speed Speed(1) Frequency(2) Frequency(3) Frequency(2) Frequency(3)

Interval (mph) (mph) (/yr) (/yr) (/yr) (/yr) 2 120 122.5 1.97E-05 5.32E-06 3.92E-04 1.67E-04 3 125 129.9 1.44E-05 6.72E-06 2.25E-04 1.51E-04 4 135 142.3 7.65E-06 4.68E-06 7.42E-05 6.02E-05 5 150 158.7 2.97E-06 2.02E-06 1.40E-05 1.21E-05 6 168 178.7 9.57E-07 7.18E-07 1.90E-06 1.74E-06 7 190 199.3 2.39E-07 1.67E-07 1.66E-07 1.46E-07 8 209 240.6 7.23E-08 7.13E-08 2.01E-08 2.01E-08 9 277 288.3 9.97E-10 7.63E-10 1.06E-11 9.77E-12 10 300 360.0 2.34E-10 2.34E-10 8.25E-13 8.25E-13 Notes:

(1) Hazard interval representative magnitude used for fragility failure probability calculations. Geometric mean approach (i.e., the square root of the product of the mph at the beginning and end of a given interval).used, except for final interval where a nominal 360 mph is used.

(2) Obtained from exponential curve fit equation.

(3) Hazard interval annual initiating event frequency is calculated (except for the final interval) as exceedance frequency associated with the interval beginning point minus the exceedance frequency at the end of the interval. The frequency of the last hazard interval is the exceedance frequency at the beginning point of that interval.

The design basis wind speeds reported in the UFSAR and ECP-15-000703 are based on the fastest mile wind-speed measurement. The hazard curves from data in NUREG/CR-4461 and the ASCE Hazard Tool are based on 3-second gust wind speeds. To reconcile the difference in time domains, the fastest mile wind speeds were converted to 3-sec gust equivalent design wind speeds (Vd-3s)31. The 3-sec gust design wind speeds are included in Table E4-3.

31 The method to convert between windspeed averaging times is commonly accepted practice and an overview of this conversion method can be found in a Wind Engineering Bulletin [The Wind Engineer, Newsletter for the Association of Wind Engineering, March 2007] - Technical Note: Windspeed Averaging Times (refer to https://aawe.org/wp-content/uploads/2016/05/Newsletter-2007-03.pdf )

Supplemental Information Page 6 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Wind Pressure Fragilities The wind pressure structural fragilities calculated for the key NMP1 structures, which followed the process in Section 4.5.1 of EPRI 3002003107 (Reference [10]). The formula for calculating the median velocity, Vm, wind load capacity of a structure.

Vm = Vd-3s * (Fs

Fd

Fp) where:

Vd-3s is the 3-sec gust equivalent of the design wind speed (mph), determined by converting the fastest-mile design wind speed to 3-sec gust wind speed in Table E4-3.

Fs is the strength factor equal to 1.2 for all structures except the screenhouse, per Table 4-2 of EPRI 3002003107. A conservative value of 1.1 is used for the strength factor of the screenhouse to account for material overstrength and modeling uncertainty for the screenhouse building due to the modeling simplicity of the structural system.

Fd is the ductility factor:

For the screenhouse, the ductility factor (Fd) was not considered (i.e., taken as 1.0),

since compressive buckling was deemed to be the controlling failure mode, due to it\s non-ductile nature. Also, a Fd value of 1.0 is used for the TB above 261 case, since the non-Class I building has unknown failure modes (no change from the original submittal).

The ductility factor for all other Class I structures and adequately detailed non-safety-related structures was taken as 1.25 (no change from the original submittal). This value is conservative since the typical ultimate-to-yield-stress ratio for steel (typically controlling ductile failure modes) is closer to 1.5.

Fp is the pressure factor and is equal to 1.3 for all structures, per Table 4-2 of EPRI 3002003107. This is the upper bound of the recommended values; it was chosen because of the large area of the structures under consideration and inherent wind pressure variability on large surfaces, especially on roofs.

The selection of values for all evaluated structures was reviewed; changes were made to the values, as discussed below. Eq. 4-10 of EPRI report 3003003107 is:

r or u = (s2 + d2 + p2)

A s value of 0.15 was conservatively used to reflect the strength variability. This is in line with values proposed in the literature32 for overstrength. A value closer to the 32 M.K. Ravindra, State-of-the-Art and Current Research Activities in Extreme Winds Relating to Design and Evaluation of Nuclear Power Plants, The Tornado: Its Structure, Dynamics, Prediction, and Hazards, Geophysical Monograph 79, American Geophysical Union, 1993. [Note: this is Reference [95] in EPRI 3002003107]

Supplemental Information Page 7 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 lower bound of the proposed s value range was deemed more reasonable to be used due to the overstrength typically observed in dynamic-dominated loading, such as wind.

A d value of 0.08 was used to reflect the ductility variability. The lower bound value was deemed reasonable to be used in tandem with the conservative value for the median capacity calculation (typical values of ultimate-to-yield-stress ratios). For structures where the controlling failure mode was brittle or unknown (i.e., the screenhouse and TB above 261) no variability was considered since Fd is equal to 1.0.

A p value of 0.15 was used to reflect the pressure variability. The lower bound value was deemed appropriate to be used for this calculation due to the well-studied aerodynamics of the building shapes that have been evaluated. Additionally, the majority of the controlling structural elements were found to be the roof (panels or structure). Since wind pressure variability is more prominent on flat roofs (variability depending also on wind direction for rectangular roofs), the Fp value of 1.3 is considered conservative, thus a lower bound value for p is deemed appropriate.

In the majority of the cases, variabilities are considered nested into a composite variability (c) based on guidance provided by Park and Reich (BNL-61588)33 and the definition of epistemic and aleatoric variability. Thus, s and d can be associated with u, and p can be associated with r. This is because of the inherent statistical variability of strength and inelastic properties of materials, whereas for pressure it expresses the inherently random effects that are associated with wind loading.

Thus, the composite c is calculated as the square root of the sum of the squares of s, d, and p; it reflects both uncertainty and randomness:

c = (s2 + d2 + p2)

Using this equation and the values provided, c = 0.212 for the screenhouse and TB above 261 and c = 0.227 for all other structures.

33 Park and Reich, BNL-61588, , "Probabilistic Wind/Tornado/Missile Analyses for Hazard and Fragility Evaluations, 1995 [Note:

this is Reference [98] in EPRI 3002003107]

Supplemental Information Page 8 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Table E4-3: Wind Pressure Fragility Parameters for NMP1 Key Structures34 3-sec Gust 3-sec Gust Design Wind Design Wind Median Speed Speed Capacity Capacity Wind Capacity (Vd) (Vd-3s) Speed (Vm)

Description (mph) (mph) (mph) c Screenhouse (above Elev. 261) 150(1) 200(2) 239.2 0.212 Main Stack 145 165.6 231.2 0.227 EDG Building and Board Rooms 175 196.9 274.9 0.227 Reactor Building (El. 340 Refuel 190 212.2 296.3 0.227 Floor)

Reactor Building (Below 340) 300 323.2 451.4 0.227 Turbine Building (Battery Rooms) 285 307.1 428.8 0.227 Turbine Building (Control Room) 235 258.7 361.2 0.227 Turbine Building (Above Elev. 190 212.2 265.0 0.212 261')

Notes:

(1) The design wind speed for the screenhouse is 150 mph, per Table XVI-31 of the UFSAR.

(2) The design 3-sec gust wind speed (Vd-3s) is 200 mph for the screenhouse, which is based on the calculation of a high confidence design wind speed (V d,hc). Due to the screenhouse dominating the estimated wind pressure CDF during the initial assessment of structural fragilities, a more detailed analysis was performed to support removing conservatism from the screenhouse fragility parameters. This was done only for the screenhouse, and the remainder of the fragility variables follow the method used for all other structures. It is acceptable to use Vd,hc in the calculations herein since this is the wind speed that would be used as the design wind speed if the wind load combination were to control the structural design.

Structural failure probabilities are calculated separately for each structure, wind hazard (straight wind and tornado), and wind speed interval. The failure probabilities are calculated using the fragility equation:

f = (ln(V/Vm)/c) where:

is the standard Gaussian cumulative distribution function 34 Replaces Table E4-6 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 9 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 V is the representative (geometric mean) wind speed for the interval Vm and c are from Table E4-3.

Wind Pressure CDF The CDF from wind pressure failures at NMP1 is estimated assuming that failure of a structure due to wind pressure results directly in core damage (i.e., CCDP =1). This is conservative for some structures, since there are mitigation strategies for most structural failures identified in the IPEEE. Additionally, FLEX provides additional mitigation equipment and strategies. However, structural failures of buildings vary from partial failure of a portion of a building to total collapse of the structure, so it is difficult to determine with much certainty what equipment will be available, functional, and accessible after the failure.

Wind pressure CDF is estimated by summing the convolved failure frequencies for each key structure, except for the stack, for both tornado and straight winds. For the stack, only 33% of the stack failure frequency is assumed to result in failure of a key structure (EDG building, Screenhouse, or Reactor Building). Figure III-23 from the UFSAR (Reference [1]) shows the critical areas, which account for approximately 31% of the possible directions the stack could fail. The 33% applied to the stack failure frequency for core damage calculations is based on the assumption that the direction the stack would topple would be predominantly dictated by the wind direction at the time of failure. Average local wind directions were used to determine the percentage of stack failures (33%) which are assumed to fail one of the key structures in Figure III-23 of the UFSAR. This is only applicable to failures from straight winds since tornado wind directionality at the location of the stack can be considered uniformly random due to its stochastic nature; 31% of stack failures due to tornadic winds are considered to result in core damage.

Table E4-4 lists the convolved wind-pressure failure frequencies for each structure, for tornados and straight winds. Assuming that failure of each structure leads to core damage with a CCDP

= 1, the total CDF is equal to the total convolved failure frequency of 5.0E-6/yr. This is lower than the estimated CDF developed in the IPEEE, although the approach and methods used to estimate CDF in this analysis are not comparable to the IPEEE.

Table E4-4 also provides the contribution of each structure to the total CDF from wind pressure failures. The screenhouse is the most significant contributor due to its relatively low fragility.

Supplemental Information Page 10 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Table E4-4: Wind Pressure CDF Due to Failure of Key NMP1 Structures35 Wind Pressure CDF (/yr.)

Straight Structure Tornado Wind Total Contribution Screenhouse (WSH) 2.4E-07 1.8E-06 2.0E-06 40%

Main Stack (WSTK) 1.3E-07 1.6E-06 1.8E-06 35%

EDG Bldg (WDG) 8.4E-08 4.6E-07 5.4E-07 11%

Reactor Bldg (WRB) 3.9E-08 1.5E-07 1.9E-07 4%

TB - Battery Rooms (WTB1) 5.8E-10 3.8E-10 9.6E-10 <0.1%

TB - Control Room (WTB2) 4.7E-09 6.8E-09 1.2E-08 0.2%

TB - Above El. 261' (WTB3) 8.9E-08 4.0E-07 4.9E-07 10%

TOTAL 5.9E-07 4.4E-06 5.0E-06 100%

The LERF associated with wind pressure failures of structures is discussed in the Total High Winds CDF and LERF subsection below, which addresses total high winds (i.e., wind pressure and tornado missile) CDF and LERF.

Tornado Missiles Tornado missile risk is evaluated using a simplified and conservative tornado missile target model. There are several key SSCs that are vulnerable to tornado missiles. The key targets include:

Battery and Battery Board Rooms

Diesel Generators and DG Board Rooms

EC Make-up Tanks

Emergency Cooling Condensers

DG CW Pumps in Screenhouse

Control Building Opening Tornado missile failure probabilities are estimated for the targets over a range of tornado intensities based on the target size, location, missile barriers, and susceptibility to missile damage. Target failure frequencies are then obtained by convolving the failure probability for 35 Replaces Table E4-7 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 11 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 each tornado missile wind speed interval with the tornado frequency for the respective interval.

A total conditional failure probability for each target is calculated by dividing the total failure frequency by the total tornado hazard frequency over all tornado winds speeds considered in the tornado missile analysis. The convolved frequency and conditional failure probabilities are used for CDF estimates Missile Failure Fragilities This section provides a brief description of the missile target failure SSCs probability and frequency calculations.

Battery and Battery Board Rooms The Battery and Battery Board Rooms are on the south end of the Turbine Building. The outer walls are 8 precast concrete panels. These do not provide complete protection against tornado missiles. The exterior wall that potentially exposes Battery Board Room 12 to tornado missiles is smaller than Battery Board Room 11, so it has a smaller failure probability and frequency.

EC Make-up Tanks The two EC Make-up (MU) Tanks (11 and 12) are located on the TB 369 level. They are large aluminum tanks and the failure probabilities also include the piping from the tanks that run through the TB into the RB to supply the ECs. Although the tanks can withstand being hit by certain missiles without failing, no credit is taken for the tanks surviving a tornado missile strike. Also, most missiles that can damage the tanks are heavy and are unlikely to be elevated over 100 above grade.

Emergency Cooling Condensers Each pair of EC Condensers (111-112 and 121-122) and the local EC support equipment (e.g., instrumentation, piping) are modeled as targets. The condensers are located on the 340 level of the RB. The south side of the condensers is protected by a 12 concrete wall. Although the top of the condensers is protected by steel grating, no credit is taken for the grating stopping any missiles. Although some credit is taken for the ability of the EC condensers to withstand missile hits, many of the missiles that can cause failure of the tanks (i.e., large and heavier missiles) are not typically lifted to such high elevations except in higher intensity tornados (the ECs are approximately 80 above grade).

Diesel Generators and DG Board Rooms The DGs are housed in structures that are not designed for missile protection, per se.

The siding used at the site was tested and shown capable of protecting internal equipment against a 4 x 12 cross-sectional area test specimen weighting 105 lbs and traveling at 300 mph (Reference [3]). Some credit is taken for the DG Building and DG Board Room Walls stopping lighter non-penetrating missiles. There are two rollup-doors

Supplemental Information Page 12 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 (one for each DG building) that open when the DG runs. For the purposes of the missile failure calculations, no credit is taken for missiles being stopped by the rollup doors or the missile screen behind each door that provides partial protection up to the height of the door opening (the rollup doors open when the DG is running for ventilation). The exposed portion of the DG1 wall is smaller than for DG2, so it has a lower missile failure probability.

Missiles can also hit the ventilators, air intakes, or exhaust piping on the roof of the DG buildings. Missiles can penetrate the roof and damage the DGs or support equipment.

The roof is thin gauge steel, so no credit is taken for it stopping any missiles.

Note that the DG building and DG board rooms are relatively sheltered. There is not much area for tornado missiles to be generated and strike the walls or roofs of these structures. Thus, the missile flux in the area is expected to be less than the general area around the powerblock. No credit is taken for the potential reduction in missiles due to the location and arrangement of the diesel structures.

Screenhouse / DG CW Pumps The DG CW pumps are in the screenhouse and are only partially protected by a concrete wall to the north. The pumps are collocated and separated by a steel barrier, but because they are directly adjacent to each other, it is conservatively assumed that a single missile can cause the failure of both pumps (which provide cooling water the DGs).

Control Building Opening A ventilation opening above the control building was identified that could result in missile damage to the CR. All missiles striking the opening are considered to cause damage.

Table E4-5 provides the convolved failure frequencies and conditional failure probabilities for all the modeled tornado missile targets.

Table E4-5: Tornado Missile Failure Frequencies and Probabilities for Vulnerable SSCs36 Failure Frequency Failure Target (/yr) Probability Battery Board Room 11 1.9E-07 3.3E-03 Battery Board Room 12 6.8E-08 1.2E-03 Battery Room 11 1.8E-07 3.1E-03 Battery Room 12 1.8E-07 3.1E-03 EC MU Tank 11 (ECMUT11) 1.2E-06 2.1E-02 36 Replaces Table E4-8 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 13 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Failure Frequency Failure Target (/yr) Probability EC MU Tank 12 (ECMUT12) 1.2E-06 2.1E-02 EC Condensers 111/112 (EC11) 6.8E-07 1.2E-02 EC Condensers 121/122 (EC12) 6.8E-07 1.2E-02 DG1 3.1E-06 5.5E-02 DG2 4.3E-06 7.5E-02 DG Board 103 (DGB103) 1.5E-06 2.5E-02 DG Board 102 (DGB102) 1.5E-06 2.5E-02 DG CW Pumps (DGCW) 3.5E-07 6.2E-03 Control Room 9.5E-08 1.7E-03 Tornado Missile CDF Tornado missile CDF is estimated by considering the failure frequencies and conditional failure probabilities for the tornado missile targets SSCs. Combinations of missile failures that result in a loss of all onsite AC or DC power (assuming LOOP with no offsite power recovery) or a loss of all Emergency Cooling are assumed to result in core damage with a CCDP=1. Recovery or mitigation are not credited for these scenarios, although there are potential mitigation paths available, using either installed equipment and/or FLEX.

Since the modeling of the tornado missile probabilities is conservative and the assumption that CCDP = 1 in these scenarios is also conservative, combinations of tornado missile and random failures of SSCs are not evaluated. Most combinations of missile and non-missile failures (i.e.,

hardware or operator actions) would have additional mitigation options such that a single non-missile failure would not result in a CCDP = 1. This is especially true if the failures do not occur at the start of the event (when the tornado missile failures occur), allowing more time for additional strategies (including offsite power recovery) to be used to prevent core damage.

The following combination of missile failures are considered to result in core damage with a CCDP = 1.

DC Power: The failure of both trains of DC due to tornado missiles is assumed to have a CCDP = 1. Tornado missile failures are considered for:

o Both Battery Rooms 11 and 12 o Both Battery Board Rooms 11 and 12 o One battery room (11 or 12) and a battery board room on the opposite train.

Supplemental Information Page 14 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4

EDGs and EDG Boards: Failure of both EDG trains is assumed to have a CCDP = 1.

Tornado missile failures are considered for:

o Failure of both EDGs o Failure of both EDG boards o Failure of one EDG and one EDG board on opposite trains Simultaneous failure of a DC battery or battery board on the opposite train from s EDG that is failed will result in failure of both trains of AC power. Therefore, combinations with EDGs and DC are also considered:

o Failure of one EDG and one battery on opposite trains o Failure of one EDG and one DC battery board on opposite trains o Failure of one EDG board and one battery on opposite trains o Failure of one EDG board and one DC battery board on opposite trains

EC Condensers and EC Make-up Tanks: Failure of both EC trains is assumed to have a CCDP = 1. Tornado missile failures are considered for:

o Both pairs of EC condensers (111-112 and 121-122) o EC Make-up Tanks 11 and 12 o Failure of one pair of EC Make-up Tanks (11 or 12) and a pair of EC condensers on the opposite train

Screenhouse Pumps: The failure of both DG CW pumps is assumed to result in core damage, even though alternate methods (e.g., fire water) to provide DG cooling.

Control Building: If the Control Building ventilation opening is hit, it is assumed to result in core damage.

Supplemental Information Page 15 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Table E4-6: Estimated CDF Due to Missile Failures of SSCs37 SSCs CDF (/yr) Contribution DC Battery and Battery Board Rooms 3.2E-09 0.2%

EDGs and EDG Boards 9.2E-07 59%

DC and EDG SSCs(1) 5.7E-08 4%

ECs and EC MU Tanks 1.3E-07 8%

DG CW Pumps (Screenhouse) 3.5E-07 23%

Control Room 9.5E-08 6%

1.6E-06 100%

TOTAL Notes:

(1) The CDF for the combination of DC and EDG SSCs is due to failures of an EDG or EDG board on one train and failure of a battery or battery board on the other train.

Total High Wind CDF and LERF The total High Wind CDF from wind pressure failures and tornado missiles is provided in Table E4-7 below.

Table E4-7: Total High Wind CDF Wind Tornado Pressure Missile Total Structure/SSC CDF (/yr) CDF (/yr) CDF (/yr) Contribution Screenhouse (WSH) 2.0E-06 3.5E-07 2.4E-06 36%

Main Stack (WSTK) 1.8E-06 - 1.8E-06 27%

EDG Bldg (WDG) 5.4E-07 9.8E-07(1) 1.5E-06 23%

Reactor Bldg (WRB) 1.9E-07 - 1.9E-07 3%

TB - Battery Rooms (WTB1) 9.7E-10 3.2E-09 4.2E-09 0.1%

TB - Control Room (WTB2) 1.2E-08 9.5E-08 1.1E-07 2%

TB - Above El. 261' (WTB3) 4.9E-07 1.3E-07(2) 6.2E-07 9%

TOTAL 5.0E-06 1.6E-06 6.6E-06 100%

37 Replaces Table E4-9 in the December 15, 2022 submittal (ML22349A108).

Supplemental Information Page 16 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Notes:

(1) The CDF for the combination of DC and EDG SSCs is included in this value.

(2) The CDF for the combination of EC condensers and EC makeup tanks is included in this value.

The total estimated high wind CDF is the sum of the CDF contributions from wind pressure and tornado missiles.

HWCDF = CDFWP + CDFTM = 5.0E-6/yr + 1.6E-6/yr = 6.6E-6/yr LERF The NMP1 high wind LERF (HWLERF) is calculated by multiplying the total HWCDF by an averaged high winds biased conditional large early release probability (HWCLERP). The adjective averaged indicates the HWCLERP covers the spectrum of HWCDF accident sequence types (different accident sequence types exhibit different individual CLERP values).

An estimate of the averaged HWCLERP is calculated using the following input information:

Accident Types: HWCDF accident type information and risk.

Primary Containment: the primary containment is not failed due to any of the wind hazards

High Wind CLERP Information: High wind biased quantifications of the NMP1 full power internal events (FPIE) PRA are used to provide estimates of HWCLERPs.

Each of the above are discussed below.

Accident Types The total HWCDF is overwhelmingly dominated (approximately 86%) by three high wind scenarios (see Table in Section 2.1.3 of N1-MISC-015):

EDG building failures (~23%)

NMP1 main stack failure and collapse onto key structures (~27%)

Screenhouse and/or DG CW pump failure (~36%)

The second and third contributors above (i.e., NMP1 main stack and screenhouse) result in the same initial plant damage state. The EDG building scenario results in a less severe initial plant damage state because the screenhouse is not directly failed and the diesel-driven fire pump can be used for RPV core cooling or makeup to the EC makeup tanks. As such, this analysis proceeds with the averaged HWCLERP estimation based on the initial plant damage scenario created by the high wind induced NMP1 main stack collapse onto a key structure or screenhouse failure.

Supplemental Information Page 17 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 As discussed previously, high wind induced main stack failure is conservatively modeled by assuming a CCDP of 1.0 given collapse onto a key structure (the screenhouse structural failure scenario also assumes a CCDP of 1.0). This conservative modeling approach is not extended into the HWLERF analysis (i.e., a HWCLERP of 1.0 is not assumed) as the analysis would become overly conservative. For the HWCLERP analysis, failure of the screenhouse is assumed to directly the EDG CW pumps, Diesel and Electric fire pumps, Containment Spray pumps, ESW pumps, and SW pumps. Such high wind induced accident scenarios would progress as follows:

Loss of offsite power (initiated by high winds)

Emergency AC power unavailable due to loss of the EDG CW pumps in the screenhouse

Other than the Emergency Condensers (ECs) located in the Reactor Building, all other installed NMP1 reactor core cooling options are unavailable due to the loss of offsite power, failure of the Screenhouse sources and the associated failure of the EDGs.

A General Emergency will be declared in under 30 minutes from the start of the event given the SBO conditions and the indication from the severe plant damage that recovery of AC power in the short term is not likely.

Crossties from the other plant, Nine Mile Point 2, and/or alignment of FLEX are potential options

Makeup to the Emergency Condensers is gravity fed from dedicated tanks in the turbine building. Given the loss of AC power and loss of equipment in the screenhouse, no standard options for makeup to the shell side of the ECs is available (crossties to NMP2 and FLEX are potential options).

ECs will provide reactor core cooling for approximately 8 hrs (requiring an operator manual action in the turbine building to throttle the EC makeup supply) before the available secondary side water supply is exhausted.

Without makeup to the EC makeup tanks or recovery of another RPV coolant injection option, the RPV water level will begin to boil off at approximately t=8 hrs and the onset of core damage will begin in an additional 1-2 hrs.

Primary Containment High wind induced failure of the NMP1 primary containment is a very low likelihood failure (effectively non-credible). The primary containment is a very robust structure contained within the reactor building. The suppression chamber portion of the primary containment is located below grade and not subjected to direct wind loadings. The drywell portion of the primary containment is a steel structure surrounded by reinforced concrete. In addition, the portion of the reactor building surrounding the drywell is designed to a 3-sec gust equivalent design wind

Supplemental Information Page 18 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 speed (Vd-3s) of 323 mph ; refer to Table E4-3. As such, this analysis reasonably and appropriately assumes the primary containment is not failed due to any of the wind hazards.

High Wind CLERP Information High wind biased quantifications of the 2022 NMP1 full power internal events (FPIE) PRA (Reference [11]) are used to provide estimates of HWCLERPs. A quantification modeling the accident scenario characteristics was performed using the following high wind biased adjustments into the PRA:

Loss of offsite power initiated sequences quantified for both CDF and LERF

Equipment located in screenhouse directly failed

Offsite AC recovery directly failed

Credit for FLEX or equipment crosstie from NMP2 directly failed The above high wind biased adjustments to the PRA produce a conservative SBO accident scenario, with no AC recovery, no crossties to NMP2 or FLEX, and only ECs available for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months at the time they cease operation. The HWCLERP resulting from this conservative high wind biased quantification is 0.087. The dominant contributor to this HWCLERP accident progression is the probability of an SBO-induced seal LOCA size sufficient to defeat EC core cooling. A similar run was performed for assumed main stack collapse onto the EDG building, which has the additional mitigation capability of potential alignment of the U1 (or U2) diesel-driven fire pump for makeup to the EC makeup tanks. The HWCLERP resulting from this high wind biased quantification is 0.033.

Given the HWCLERP information above, an averaged HWCLERP of 0.1 is used in this analysis to quantify HWLERF.

NMP1 HWLERF Using the averaged HWCLERP of 0.1 discussed above and the total HWCDF, the NMP1 HWLERF is calculated as follows:

NMP1 HWLERF = 6.6E-6/yr x 0.1 (HWCLERP) = 6.6E-7/yr

Supplemental Information Page 19 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 High Wind Risk for Maintenance Configurations The estimated CDF and LERF associated with the failure of any of the structures is applied as the increase in CDF and LERF (i.e, CDF and LERF). The penalty factor is used in RICT calculations to account for the increase in CDF and LERF as a result of the plant configuration.

The penalty factor, as calculated for NM1, represents the base CDF and LERF associated with the wind-induced structural failures. Most configurations allowed by the RICT program would result in little or no increase in CDF and LERF due to structural failures. For example, even for risk significant SSCs, the CDF associated with failure of the DG building would not increase if a DG were unavailable, since the failure of the DG building is assumed to result in core damage, regardless of whether one or both DGs are available. Using the total wind-pressure related risk to estimate the penalty value (e.g., the total CDF will be applied as the CDF) is conservative.

Therefore, the configuration risk due to wind pressure failures is:

CDFWP = CDFWP = 5.0E-6/yr LERFWP = LERFWP = 5.0E-7/yr Maintenance configurations (e.g., EC train unavailable, EDG in maintenance) will result in higher CDF and LERF due to tornado missile failures. The tornado missile convolved failure frequencies and probabilities are used to estimate tornado missile CDF in certain maintenance configurations. The two most risk significant RICT configurations with respect to tornado missiles are:

One DG, DG board, battery, or battery board unavailable (CDFTM = 6.6E-6/yr)

One train of EC or associated equipment unavailable (CDFTM = 1.9E-6/yr)

The increase in CDF associated with these configurations is added to the based tornado missile CDF calculated in the previous section. Due to the large increase in CDF with a DG unavailable, two tornado missile CDF values are calculated for RICT configurations:

LCOs not involving a DG, DG board, battery, or battery board HWCDF = 6.6E-6/yr + 1.9E-6/yr = 8.5E-6/yr

LCOs involving a DG or DG board HWCDF = 6.6E-6/yr + 6.0E-6/yr = 1.3E-5/yr HWLERF for these configurations is determined by multiplying the HWCDF by 0.1 (HWCLERP)

LCOs not involving a DG or DG board HWLERF = 8.5E-6/yr

0.1 = 8.5E-7/yr

LCOs involving a DG or DG board HWCDF = 1.3E-5/yr

0.1 = 1.3E-6/yr

Supplemental Information Page 20 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 Disposition for TSTF-505 Applications For the TSTF-505 application, penalty factors are used to account for the HWCDF and HWLERF during RICT configurations. The HWCDF and HWLERF values calculated above provide the basis for the penalty factors; the HWCDF and HWLERF for maintenance configurations are applied as CDF and LERF in the RICT calculations.

LCOs configurations not involving a DG, DG board, battery, or battery board. The HWCDF calculated for these configurations is 8.5E-6/yr. The HWLERF is calculated by multiplying the CDF by the HWCLERP of 0.1. Therefore, the penalty factors are:

CDF = 8.5E-6/yr LERF = 8.5E-7/yr

LCOs configurations involving a DG, DG board, battery, or battery board. The HWCDF calculated for these configurations is 1.3E-5/yr. The HWLERF is calculated by multiplying the CDF by the HWCLERP of 0.1. Therefore, the penalty factors are:

CDF = 1.3E-5/yr LERF = 1.3E-6/yr

Supplemental Information Page 21 of 21 Docket No. 50-220 Revised Enclosure 4 Section 4 References

[1] Nine Mile Point Nuclear Station, Unit 1 - UFSAR, Revision 27.

[2] Nine Mile Point Nuclear Power Station - Unit 1 Individual Plant Examination for External Events (IPEEE), August 1996.

[3] U.S. NRC, "Nine Mile Point Unit 1 - Individual Plant Examination of External Events (TAC NO. M83645), "Enclosure, Staff Evaluation Report by the Office of Research, Individual Plant Examination of External Events (IPEEE) Submittal, Nine Mile Point Nuclear Station, Unit No. 1, Docket No. 50-220," July 18, 2000.

[4] Engineering EC Evaluation No. ECP-15-000703, "High Wind Vulnerability Evaluation for Nine Mile Point 1, Revision 0," January 2014.

[5] N1-MISC-015, "External Hazards Assessment for Nine Mile Point Nuclear Station, Unit 1,"

Revision 1, July 2023.

[6] DCD-120, "Nine Mile Point Nuclear Station Unit 1 Design Criteria Document, External Events," Revision 0, January 1992.

[7] NUREG/CR-4461, Tornado Climatology of the Contiguous United States, Revision 2, February 2007.

[8] Exelon Letter to NRC, R.E. Ginna Nuclear Power Plant, License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML21140A324), dated May 20, 2021.

[9] ASCE 7 Hazard Tool, in https://asce7hazardtool.online/.

[10] High-Wind Risk Assessment Guidelines, Palo Alto, CA: 2015. 3002003107.

[11] N1-PRA-013, "Nine Mile Point Unit 1 PRA Summary Notebook (2021 PRA Update),"

Revision 1, May 2022.

v t e Letter Sequence Supplement
EPID:L-2022-LLA-0186, (Open)
Initiation Request, Request Acceptance Supplement Administration Questions Answers Results Approval, Approval Other: ML23025A386, ML23033A014, ML23118A388, ML23142A022, ML23149A001, ML23205A241, ML23205A242, ML23205A243, ML23209A767
MONTHYEAR2023-05-22 [Table View]

NMP1L3545, Supplemental Information Letter to Adopt TSTF-505, Provide Risk- Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2 and 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems .

Text

Subject:

References:

References:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Navigation menu

NMP1L3545, Supplemental Information Letter to Adopt TSTF-505, Provide Risk- Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2 and 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems .

Text

Subject:

References:

References:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Navigation menu

Search