0CAN022001, Response to Request for Additional Information Related to License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

Response to Request for Additional Information Related to License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

ML20050E028
Person / Time
Site:	Arkansas Nuclear
Issue date:	02/19/2020
From:	Gaston R Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
0CAN022001
Download: ML20050E028 (20)

Text

10 CFR 50.90 0CAN022001 February 19, 2020 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

Subject:

Response to Request for Additional Information Related to License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis Arkansas Nuclear One, Units 1 and 2 NRC Docket Nos. 50-313 and 50-368 Renewed Facility Operating License Nos. DPR-51 and NPF-6 By letter dated April 29, 2019 (Reference 1), Entergy Operations, Inc. (Entergy), requested NRC approval of a proposed change to the license basis documents for Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) to use the Tornado Missile Risk Evaluator (TMRE) methodology as the licensing basis to qualify several components that have been identified as not conforming to the unit-specific current licensing basis. During the course of review, the NRC determined additional information was required to complete the review process.

The NRC notified Entergy of the request for additional information (RAI) on January 10, 2020 (Reference 2). A conference call had been previously held on January 7, 2020, in which the potential RAI was discussed. The RAI states a 45-day response period (i.e., response due February 24, 2020).

Entergy's RAI response is included in the attached enclosure. The responses do not impact the no significant hazards consideration provided in the original amendment request (Reference 1).

No new regulatory commitments are included in this submittal.

In accordance with 10 CFR 50.91, Entergy is notifying the State of Arkansas of Entergy's TMRE application RAI response by transmitting a copy of this letter and enclosure to the designated State Official.

Entergy Operations, Inc.

1340 Echelon Parkway Jackson, MS 39213 Tel 601-368-5138 Ron Gaston Director, Nuclear Licensing

0CAN022001 Page 2 of 2 If there are any questions or if additional information is needed, please contact Tim Arnold, Manager, Regulatory Assurance, Arkansas Nuclear One, at 479-858-7826.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on February 19, 2020.

Respectfully, ORIGINAL SIGNED BY RON GASTON Ron Gaston RWG/dbb

Enclosure:

Response to Request for Additional Information Related to Proposed Adoption of a Tornado Missile Risk Evaluator

References:

1.

Entergy Operations, Inc. (Entergy) letter to U. S. Nuclear Regulatory Commission (NRC), License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis, Arkansas Nuclear One, Units 1 and 2 (0CAN041904) (ML19119A090), dated April 29, 2019.

2.

NRC email to Entergy, ANO-1 and 2 -- Final RAI #2 RE: LAR to Incorporate Tornado Missile Risk Evaluator (TMRE) into Licensing Basis (EPID L-2019-LLA-0093), (0CNA012001) (ML20013C747), dated January 10, 2020.

cc:

NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Designated Arkansas State Official

Enclosure 0CAN022001 Response to Request for Additional Information Related to Proposed Adoption of a Tornado Missile Risk Evaluator

0CAN022001 Enclosure Page 1 of 17 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RELATED TO PROPOSED ADOPTION OF A TORNADO MISSILE RISK EVALUATOR By letter dated April 29, 2019 (Reference 1), Entergy Operations, Inc. (Entergy), requested NRC approval of a proposed change to the license basis documents for Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) to use the Tornado Missile Risk Evaluator (TMRE) methodology as the licensing basis to qualify several components that have been identified as not conforming to the unit specific current licensing basis. During the course of review, the NRC determined additional information was required to complete the review process.

The NRC notified Entergy of the request for additional information (RAI) on January 10, 2020 (Reference 2). A conference call had been previously held on January 7, 2020, in which the potential RAI was discussed. The RAI states a 45-day response period (i.e., response due February 24, 2020).

Each question associated with the subject RAI is repeated below followed immediately by Entergy's response to the specific question.

PRA RAI 02.01 - ANO-1 Nonconforming SSCs Not Included in the TMRE Analysis Section 6.5 of NEI 17-02, Revision 1 states that the probabilistic risk assessment (PRA) logic models need to be modified to include tornado-missile-induced failures for exposed structures, systems, and components (SSCs).

In the first part of the RAI response the licensee confirmed that the basis for excluding nonconforming SSCs was not based on the system-level screening criteria of supporting requirement SY-A15 but excluded for the following reasons:

With regards to the first nonconforming SSC excluded from the TMRE analysis, conduit EC1493, the RAI response states that the related impacted SSCs are the high point vent valves for the reactor coolant system (RCS). The response continues by stating that the venting of the RCS is currently not included in the internal events PRA (IEPRA) model.

Regarding the second nonconforming SSC exclusion (i.e., the small-bore service water pipes), the response states that the impacted SSCs are the emergency switchgear room chiller units. Furthermore, it states that analysis determined that these units are not needed to fulfill any PRA-related function. Additionally, the response states that flooding from the nonconformance would not impact any PRA-modeled SSCs that would initially survive a tornado event.

The NRC staff notes that supporting requirement AS-A3 self-assessment requires modification of the IEPRA success criteria and associated system models to account for the consequences of tornado events. Also, AS-A5 states that the TMRE PRA model is to be consistent with the system design, emergency operating procedures (EOPs), abnormal procedures, and plant transient response

0CAN022001 Enclosure Page 2 of 17 The NRC staff have noted, from previous experience, that not all of the mitigation strategies used in the EOPs or supporting procedures are included in the PRA models because they are higher-order strategies (3rd, 4th, etc.). They are not modeled because they do not significantly reduce overall risk values. In light of these observations:

a.

Provide an updated TMRE analysis using an updated TMRE PRA model that incorporates all of the nonconforming TMRE SSCs.

-OR-

b.

Provide a bounding risk value for the excluded nonconformances that is included in an updated TMRE analysis that incorporates all of the nonconforming SSCs (or surrogates modeled in the PRA).

-OR-

c.

Provide justification that the nonconforming SSCs and associated functions are not used in ANO EOPs, abnormal response procedures, or expected plant transient response to a tornado missile event.

Entergy Response (Part c)

High Point Vents Conduit EC1493 contains cables associated with the red train RCS high point vent (HPV) valves. All of these valves are normally closed. Failure of the cables in the conduit would prevent opening valves to vent the RCS. Following a tornadic event, a loss of offsite power (LOOP) and subsequent reactor trip would be expected. On a reactor trip, the operators enter procedure OP-1202.001, "Reactor Trip." This procedure contains no steps that direct use of the HPVs.

Note that with respect to PRA accident sequences, the need to open the HPVs cannot occur without the loss of Emergency Feedwater (EFW). Where EFW (and all other primary-to-secondary heat removal sources) is lost, a transfer to high pressure injection (HPI) cooling occurs. Implementation of HPI cooling does not direct use of the HPVs. Therefore, use of the HPVs is not included in the PRA models.

Proceeding normally through OP-1202.001, RCS pressure is controlled within specified limits.

Because the emergency diesel generators (EDGs) would be the source of power, the operators would transition to OP-1202.007, "Degraded Power." Progressing normally through OP-1202.007, proper operation of the EDGs and EFW is verified, and the plant placed in a stable condition. The Degraded Power procedure contains one contingency step to use the HPVs if subcooling margin (SCM) remains adequate and primary-to-secondary heat transfer is lost. With expected post-tornado plant response (i.e., with EFW operating), SCM would be adequate and Steam Generator (SG) tubes will remain intact. SCM would be lost only if all EFW is lost and, therefore, subsequent steps of OP-1202.002 would not apply. A tornado event is not assumed to result in the complete loss of primary-to-secondary heat transfer. Therefore, the Degraded Power procedure allowance to use the HPVs has no effect on the accident sequences modelled for the TMRE.

0CAN022001 Enclosure Page 3 of 17 At various points in OP-1202.001 and OP-1202.007, the operators are directed to take steps specified in OP-1202.012, "Repetitive Tasks," while continuing with the procedure in effect. The Repetitive Tasks procedure largely contains steps which verify that the HPVs are closed.

Failure of conduit EC1493 would preclude opening the HPVs and, if open, the vents would close. However, one repetitive task associated with RCS pressure control allows use of the Pressurizer HPVs as one of seven different options to lower RCS pressure. Entry into this task from the Degraded Power procedure may be necessary under the following conditions:

1.

RCS pressure control when SCM is met.

2.

An overcooling event is in progress (in this case, RCS pressure would not be high, precluding the need to open the HPVs).

3.

An overheating event is in progress (this results in a loss of adequate SCM).

With respect to SCM and the potential of an overheating event, sequences considered in the PRA models would only assume a loss of adequate SCM if all EFW is lost. As stated previously, a tornado event is not assumed to result in the loss of EFW or other loses that would lead to the opening of the HPVs and, therefore, the TMRE model does not rely on the HPVs to prevent core damage. Subsequently, the Repetitive Task procedure option of using the HPVs has no effect on the accident sequences modelled for the TMRE.

The Degraded Power EOP contains other steps that result in operators entering other procedures in conjunction with the Degraded Power EOP. These transitions either do not require the use of the HPVs or are associated with sequences that have success of EFW but loss of SCM. For sequences evaluated in the PRA, success of EFW ensures adequate SCM.

Failure of EFW results in a transfer to HPI cooling. As discussed previously, HPI cooling does not direct use of the HPVs.

Similar to the Degraded Power procedure, OP-1202.002, "Loss of Subcooling Margin," allows use of HPVs if SCM remains adequate and loss of primary-to-secondary heat transfer has been lost. This direction occurs well into the procedure following several steps that act to ensure primary-to-secondary heat transfer is established via other means. As stated previously, a tornado event is not assumed to result in the complete loss of primary-to-secondary heat transfer and, therefore, the TMRE model does not rely on the HPVs to prevent core damage.

Therefore, the SCM procedure allowance to use the HPVs has no effect on the accident sequences modelled for the TMRE.

In OP-1202.005, "Inadequate Core Cooling," HPVs are opened only if inadequate core cooling (ICC) is sustained such that Region 3 of the associated figure is entered (clad temperature

> 1400 °F, a condition that core damage has occurred or is imminent). On entering this region, the HPVs are opened after attempting to reduce SG pressures by steaming and feeding (using EFW). However, for PRA accident sequences, the conditions which would direct the transfer to OP-1202.005 would not occur if EFW was operating. Therefore, the ICC procedure use of the HPVs has no effect on the accident sequences modelled for the TMRE.

EOP OP-1202.006, "Tube Rupture," provides guidance for opening the HPVs as a contingency if 1) all primary-to-secondary heat removal is lost (i.e., SCM has been lost and adequate SCM is then restored, and Reactor Coolant Pumps (RCPs) cannot be restarted), 2) auxiliary spray is unavailable, or 3) normal spray is unavailable (i.e., RCPs cannot be restarted). Equipment

0CAN022001 Enclosure Page 4 of 17 supporting primary-to-secondary heat removal and auxiliary spray is not expected to be lost due to tornado missiles. In addition, a SG tube rupture (SGTR) does not occur due to the tornado event (see response to PRA RAI 08.01 for further information); therefore, it is not assumed OP-1202.006 would be entered as a result of the tornado event. Because this procedure is not expected to be in use and because all supporting equipment described above is not expected to be lost, the potential use of HPVs in the Tube Rupture procedure has no effect on the accident sequences modelled for the TMRE.

The HPVs are verified closed in OP-1202.008, "Blackout." Failure of conduit EC1493 would preclude opening the HPVs and, if open, the vents would close. In addition, this procedure is not expected to be in use as a result of tornado event (i.e., TMRE does not assume the loss of both EDGs). Therefore, the Blackout procedure use of the HPVs has no effect on the accident sequences modelled for the TMRE.

The discussion above concludes that potential use of the HPVs is not considered as higher-order mitigation strategies which are not included in the PRA models. Rather, the discussion shows that use of the HPVs is not directed by ANO EOPs, abnormal response procedures, or expected plant transient response to accident sequences modelled in the PRA in response to a tornado missile event.

Small Bore Piping The two small bore Service Water (SW) pipes (HCD-65-2 and HCD-66-2) provide flow to emergency switchgear room chillers VCH-4A and VCH-4B. In developing the PRA models for the electrical systems, the need for support systems was evaluated as required by supporting requirement (SR) SY-B6 of the ASME/ANS standard. That SR states, "Perform engineering analyses to determine the need for support systems that are plant-specific and reflect the variability in the conditions present during the postulated accidents for which the system is required to function."

The results of those analyses determined that the equipment in the electrical switchgear rooms that is modelled in the PRA would function under accident scenarios evaluated even without room cooling. Therefore, loss of VCH-4A and VCH-4B due to the potential loss of SW supply pipes HCD-65-2 and HCD-66-2 respectively, do not represent a failure mode that must be considered in the PRA. As a result, these cooling units were not included in the PRA models.

Furthermore, it would not be appropriate to add the cooling units to the TMRE model because the chillers provide no function credited in the PRA either directly or implicitly.

Based on the discussions above, it is concluded that neither conduit EC1493 or SW lines HCD-65-2" and HCD-66-2" perform any function that must be considered in the TMRE PRA models.

PRA RAI 05.01 - ANO TMRE Compliant-Case Conservatisms Sensitivity The RAI response states that with no change in the degraded case risk value and reducing the compliant case risk value this will only increase the delta core damage frequency (CDF) and delta large early release frequency (LERF) values. The NRC staff notes that the bounding sensitivity example provided in the guidance (example 1) does indeed intend to maximize the CDF and LERF values. Section 7.2.2 of NEI 17-02, Revision 1B, states that the compliant

0CAN022001 Enclosure Page 5 of 17 case conservatism sensitivity is to address TMRE PRA modeling conservatisms added to the TMRE PRA model, as described by self-assessments of supporting requirements AS-A10, LE-C3, and SY-B7 as stated in Appendix D of NEI 17-02, which could be masking changes in risk and therefore impacting the delta-risk values.

The guidance states that conservative assumptions associated with supporting requirements AS-A10, LE-C3, and SY-B7 (i.e., supporting requirements not related to exposed equipment failure probabilities) can be addressed by setting the failure probabilities of those non-Exposed Equipment Failure Probability (EEFP) probabilities to zero in the compliant case (example 2).

If the first two approaches exceed RG 1.174 thresholds, then the guidance provides example 3, which does not set EEFPs to zero in the compliant case. The apparent approach ANO utilized in the sensitivity study was to address EEFPs by removing valid failures from both compliant and degraded cases (example 4). The NRC staff also notes the guidance states that example 4 is used in conjunction with example 3.

From the RAI response, it appears that the analysis was identifying compliant case scenarios in the degraded case cutsets to determine the relative risk impact of the scenario based on the corresponding degraded cutset risk value. It is unclear to the NRC staff what TMRE PRA modeling assumptions are being addressed in the sensitivity study provided. In light of these observations:

a.

Identify the ANO TMRE PRA modeling conservatisms addressed by this sensitivity study associated with the self-assessment of supporting requirements AS-A10, LE-C3, and SY-B7 as described in Appendix D of NEI 17-02.

b.

Explain how the LAR compliant case conservatisms sensitivity addresses the conservatisms identified in Part a.

c.

As an alternative to Part b, provide updated sensitivity studies for both units that address the conservatisms identified in Part a.

Entergy Response ANO-1 CDF For ANO-1, the compliant base case CDF is 9.19E-06/year. Cutsets that contribute to 90% of this value total to 8.28E-06/year and include 295 cutsets in total comprised of 145 unique basic events (BEs). Of these 145 BEs, five represent the initiating events (IEs) for the tornado categories considered in the TMRE methodology. Since the IEs do not represent hardware failures, these IEs are not included in the compliant case sensitivity.

Four events are flag events that represent no physical condition but are used as part of the overall quantification process for the IEs PRA. As with the IEs, flag events do not represent hardware failures and are not included in the compliant case sensitivity. Two of the events represent operator actions and, per the guidance of NEI 17-02, Revision 1B, are not to be considered for the compliant case sensitivity.

0CAN022001 Enclosure Page 6 of 17 Twenty-six of the BEs represent EEFPs for vulnerabilities that are not non-conformances and result in direct core damage. Any changes to these direct-to-core-damage events would have an equal effect on both the compliant and degraded cases, so there would be no change in CDF.

Eighteen of the BEs are associated with hardware failures of the EDGs. These events contribute 48% to total CDF. Following the expected LOOP, both EDGs would be demanded to start and run for the required mission time. Failure data for the EDGs is based on plant-specific information with no significant conservatisms included in the EDG system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Five of the BEs are associated with hardware failures of components in the SW system. Failure data for these components uses best-estimate values with no significant conservatisms included in the SW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Two of the BEs are associated with hardware failures of the turbine-driven EFW pump. Failure data for this component uses best-estimate values with no significant conservatisms included in the EFW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

One BE represents the probability of a SG tube bursting given depressurization of the secondary side of the SG. This event contributes less than 0.3% to overall CDF. With such a small contribution, any uncertainties or conservatisms would not mask changes in risk.

The remaining 82 BEs represent tornado-induced failure of SSCs. The vulnerabilities of these SSCs are considered to meet licensing basis requirements for tornado missile protection but do not satisfy the more stringent requirements specified in NEI 17-02, Revision 1B. Of these 82 BEs, only 16 individual BEs have a Fussell-Vesely (FV) importance of greater than 0.5%.

The most significant of these BEs represent the vulnerability associated with Room 128, the controlled access area at the 386-foot elevation. The vulnerability associated with this area is protected to meet licensing basis requirements with the exception of three fire damper openings.

There are five BEs associated with the vulnerability of Room 128 and these represent the EFFP associated with each of the five tornado categories evaluated. The total FV importance for these events is 13.2%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible.

Using the FV importance value of 13.2%, this change would result in a reduction in the compliant case CDF of:

9.19E-06/year

• 0.132

• 0.25 = 3.0E-07/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in the degraded case CDF, the additional increase in CDF above would result in a total CDF as shown below, which remains below the CDF acceptance criteria of 1.0E-06/year.

5.9E-07/year + 3.0E-07/year = 8.9E-07/year

0CAN022001 Enclosure Page 7 of 17 Other SSCs represented by the 82 BEs associated with tornado missile vulnerabilities include the main steam isolation valves (MSIVs), main steam safety valves (MSSVs), borated water storage tank (BWST), conduits and cables located in Room 76, fuel oil storage tank vents, conduits and cables in manhole MH09, EDG stacks, and turbine building conduits evaluated in two different correlation groups. Because these are considered vulnerabilities and not non-conformances, any change in the respective EEFPs would affect both the degraded and compliant cases.

The FV importance measures for EEFPs representing all five tornado categories were summed for each of the SSCs above. The BWST has a FV importance of 3.6%. The cables and conduits have an FV importance of 2.3% and the MSIVs have a FV importance of 2.0%. All other SSCs above have a FV importance of less than 2%. Given these low FV importance values, none of these SSCs are considered to be masking changes in risk, especially considering that any reduction in the EEFPs would result in a reduction in both the compliant and degraded case CDFs.

Based on the discussion above it is concluded that equipment failures in the compliant case are not masking changes in risk or would result in a risk change for CDF that does not remain less than 1.0E-06/year.

ANO-1 LERF For ANO-1, the compliant base case LERF is 2.41E-06/year. Cutsets that contribute to 90% of this value total to 2.17E-06/year and include 575 cutsets in total comprised of 195 unique BEs.

Of these 195 BEs, five represent the IEs for the tornado categories considered in the TMRE methodology. Since the IEs do not represent hardware failures, these IEs are not included in the compliant case sensitivity.

Twenty-three events are flag events that represent no physical condition but are used as part of the overall quantification process for the IEs PRA. As with the IEs, flag events do not represent hardware failures and are not included in the compliant case sensitivity.

Ten of the events represent operator actions and, per the guidance of NEI 17-02, Revision 1B, are not to be considered for the compliant case sensitivity.

Twenty-seven of the BEs represent EEFPs for vulnerabilities that are not non-conformances and result in direct core damage. Any changes to these direct-to-core-damage events would have an equal effect on both the compliant and degraded cases, so there would be no change in LERF.

Fifteen of the BEs are associated with hardware failures of the EDGs. These events contribute 8% to total LERF. Following the expected LOOP, both EDGs would be demanded to start and run for the required mission time. Failure data for the EDGs is based on plant-specific information with no significant conservatisms included in the EDG system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

0CAN022001 Enclosure Page 8 of 17 Three of the BEs are associated with hardware failures of components in the SW system.

Failure data for these components uses best-estimate values with no significant conservatisms included in the SW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Four of the BEs are associated with hardware failures of turbine-driven EFW pump. Failure data for this component uses best-estimate values with no significant conservatisms included in the EFW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

One BE is associated with hardware failure of an instrument air system valve. This basic event has a FV importance of only 0.04%. This event would not mask changes in risk and, therefore, is not included in the compliant case sensitivity.

One BE is associated with hardware failure of the ERV to open. This basic event has a FV importance of only 0.02%. This event would not mask changes in risk and, therefore, is not included in the compliant case sensitivity.

Nineteen BEs represent phenomenology associated with containment performance as evaluated in the Level 2 PRA. These events do not represent any specific hardware failures and, per the guidance of NEI 17-02, Revision 1B, are not to be considered for the compliant case sensitivity.

The remaining 87 BEs represent tornado-induced failure of SSCs. The vulnerabilities of these SSCs are considered to meet licensing basis requirements for tornado missile protection but do not satisfy the more stringent requirements specified in NEI 17-02, Revision 1B. Of these 87 BEs, only eight individual BEs have a FV importance of greater than 0.5%. The most significant of these BEs represent the vulnerability associated with Room 128, the controlled access area at the 386-foot elevation. The vulnerability associated with this area is protected to meet licensing basis requirements with the exception of three fire damper openings.

There are five BEs associated with the vulnerability of Room 128 and these represent the EFFP associated with each of the five tornado categories evaluated. The total FV importance for these events is 7.8%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible.

Using the FV importance value of 7.8%, this change would result in a reduction in the compliant case LERF of:

2.41E-06/year

• 0.078

• 0.25 = 4.7E-08/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in degraded case LERF, the additional increase in LERF above would result in a total LERF as shown below, which remains below the LERF acceptance criteria of 1.0E-07/year.

5.1E-08/year + 4.7E-08/year = 9.8E-08/year

0CAN022001 Enclosure Page 9 of 17 Other SSCs represented by the 88 BEs representing tornado missile vulnerabilities include the MSIVs, MSSVs, BWST, conduits and cables located in Room 76, EDG stacks, and turbine building conduits evaluated in different correlation groups. Because these are considered vulnerabilities and not non-conformances, any change in the respective EEFPs would affect both the degraded and compliant cases.

The FV importance measures for EEFPs representing all five tornado categories were summed for each of the SSCs above. The BWST has a FV importance of 2.6%. The MSSVs have an FV importance of 1.8% and the MSIVs have a FV importance of 1.2%. All other SSCs above have a FV importance of less than 2%. Given these low FV importance values, none of these SSCs are considered to be masking changes in risk, especially considering that any reduction in the EEFPs would result in a reduction in both the compliant and degraded case LERFs.

Based on the discussion above it is concluded that equipment failures in the compliant case are not masking changes in risk or would result in the risk change for LERF that does not remain less than 1.0E-07/year.

ANO-2 CDF For ANO-2, the compliant base case CDF is 1.11E-05/year. Cutsets that contribute to 90% of this value total to 9.91E-06/year and include 124 cutsets in total comprised of 76 unique BEs.

Of these 76 BEs, five represent the IEs for the tornado categories considered in the TMRE methodology. Since the IEs do not represent hardware failures, these IEs are not included in the compliant case sensitivity.

Twenty of the BEs represent EEFPs for vulnerabilities that are not non-conformances and result in direct core damage. Any changes to these direct-to-core-damage events would have an equal effect on both the compliant and degraded cases so there would be no change in CDF.

Twenty-two of the BEs are associated with hardware failures of the EDGs. These events contribute 75% to total CDF. Following the expected LOOP, both EDGs would be demanded to start and run for the required mission time. Failure data for the EDGs is based on plant-specific information with no significant conservatisms included in the EDG system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Three of the BEs are associated with hardware failures of components in the SW system.

Failure data for these components uses best-estimate values with no significant conservatisms included in the SW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Two of the BEs are associated with hardware failures of turbine-driven EFW pump. Failure data for this component uses best-estimate values with no significant conservatisms included in the EFW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

The remaining 24 BEs represent tornado-induced failure of SSCs. The vulnerabilities of these SSCs are considered to meet licensing basis requirements for tornado missile protection but do not satisfy the more stringent requirements specified in NEI 17-02, Revision 1B. Of these 24 BEs, only seven individual BEs have a FV importance of greater than 0.5%. The most

0CAN022001 Enclosure Page 10 of 17 significant of these BEs represent the vulnerability associated with the refueling water tank (RWT), 2T-3. The vulnerability associated with the RWT is protected to meet licensing-basis requirements.

There are five BEs associated with the vulnerability of the RWT, two of which have a FV importance less than 0.5%. These five BEs represent the EFFP associated with each of the five tornado categories evaluated. The total FV importance for these events is 6.2%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible. Using the FV importance value of 6.2%, this change would result in a reduction in the compliant case CDF of:

1.11E-05/year

• 0.062

• 0.25 = 1.7E-07/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in the degraded case CDF, the additional increase in CDF above would result in a total CDF as shown below, which remains below the CDF acceptance criteria of 1.0E-06/year.

1.0E-07/year + 1.7E-07/year = 2.7E-07/year The vulnerability associated with Room 2076 is protected to meet licensing-basis requirements.

There are eight BEs associated with the vulnerability of this room, three of which have a FV importance greater than 0.5%. These represent the EFFPs for two correlation groups and are associated with the five tornado categories evaluated. The total FV importance for these events is 5.9%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible. Using the FV importance value of 5.8%, this change would result in a reduction in the compliant case CDF of:

1.11E-05/year

• 0.059

• 0.25 = 1.6E-07/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in the degraded case CDF, the additional increase in CDF above would result in a total CDF as shown below, which remains below the CDF acceptance criteria of 1.0E-06/year.

1.0E-07/year + 1.6E-07/year = 2.6E-07/year Even if the effect of reducing the EEFP of the RWT is included and neglecting any reduction in degraded case CDF, the additional increase in CDF above would result in a total CDF as shown below, which remains below the CDF acceptance criteria of 1.0E-06/year:

1.0E-07/year + 1.6E-07/year + 1.7E-07/year = 4.3E-07/year Other SSCs represented by the 24 BEs representing tornado missile vulnerabilities include fuel oil storage tank vents and MSIVs. Because these are considered vulnerabilities and not non-conformances, any change in their EEFPs would affect both the degraded and compliant cases.

0CAN022001 Enclosure Page 11 of 17 The FV importance measures for EEFPs for these SSCs were summed for each of the SSCs above. The fuel oil storage tank vents have a FV importance of 1.2%. The MSIVs and all other SSCs above have a FV importance of less than 1%. Given these low FV importance values, none of these SSCs are considered to be masking changes in risk, especially considering that any reduction in the EEFPs would result in a reduction in both the compliant and degraded case CDFs.

Based on the discussion above it is concluded that equipment failures in the compliant case are not masking changes in risk or would result in the risk change for CDF that does not remain less than 1.0E-06/year.

ANO-2 LERF For ANO-2, the compliant base case LERF is 6.18E-07/year. Cutsets that contribute to 90% of this value total to 5.56E-07/year and include 2280 cutsets in total comprised of 194 unique BEs.

Of these 194 BEs, five represent the IEs for the tornado categories considered in the TMRE methodology. Since the IEs do not represent hardware failures, they are not included in the compliant case sensitivity.

Nineteen events are flag events that represent no physical condition but are used as part of the overall quantification process for the IEs PRA. As with the IEs, flag events do not represent hardware failures and are not included in the compliant case sensitivity.

Four of the events represent operator actions and, per the guidance of NEI 17-02, Revision 1B, are not to be considered for the compliant case sensitivity.

Twenty-four of the BEs represent EEFPs for vulnerabilities that are not non-conformances and result in direct core damage. Any changes to these direct-to-core-damage events would have an equal effect on both the compliant and degraded cases so there would be no change in LERF.

Twenty-three of the BEs are associated with hardware failures of the EDGs. These events contribute 38% to total LERF. Following the expected LOOP, both EDGs would be demanded to start and run for the required mission time. Failure data for the EDGs is based on plant-specific information with no significant conservatisms included in the EDG system models.

These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Four of the BEs are associated with hardware failures of components in the SW system. Failure data for these components uses best-estimate values with no significant conservatisms included in the SW system models. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

Fourteen of the BEs are associated with hardware failures of EFW system components. Failure data for this component uses best-estimate values with no significant conservatisms included in the EFW system models. In addition, the total FV importance for these fourteen events is only 1.4%. These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

0CAN022001 Enclosure Page 12 of 17 Four BEs represent RCP seal failure probability. These events are developed using the consensus model in WCAP-16141. These BEs have a combined FV importance of only 0.07%.

These events would not mask changes in risk and, therefore, are not included in the compliant case sensitivity.

One BE is associated with hardware failure of a containment isolation check valve to close.

This basic event has a FV importance of only 0.2%. This event would not mask changes in risk and, therefore, is not included in the compliant case sensitivity.

Five BEs are associated with hardware failure of MSIVs to close. These BEs have a combined FV importance of only 0.03%. These events would not be masking changes in risk and, therefore, are not included in the compliant case sensitivity.

Forty-three BEs represent phenomenology associated with containment performance as evaluated in the Level 2 PRA. These events do not represent any specific hardware failures and, per the guidance of NEI 17-02, Revision 1B, are not to be considered for the compliant case sensitivity.

The remaining 48 BEs represent tornado-induced failure of SSCs. The vulnerabilities of these SSCs are considered to meet licensing basis requirements for tornado missile protection but do not satisfy the more stringent requirements specified in NEI 17-02, Revision 1B. Of these 48 BEs, only eight individual BEs have a FV importance of greater than 0.5%. The most significant of these BEs represent the vulnerability associated with the RWT. The vulnerability associated with the RWT is protected to meet licensing-basis requirements.

There are five BEs associated with the vulnerability of the RWT, two of which have a FV importance less than 0.5%. These five BEs represent the EFFP associated with each of the five tornado categories evaluated. The total FV importance for these events is 9.1%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible. Using the FV importance value of 9.1%, this change would result in a reduction in the compliant case CDF of:

6.18E-07/year

• 0.091

• 0.25 = 1.4E-08/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in degraded case LERF, the additional increase in LERF above would result in a total LERF as shown below, which remains below the LERF acceptance criteria of 1.0E-07/year.

6.0E-09/year + 1.4E-08/year = 2.0E-08/year The vulnerability associated with Room 2076 is protected to meet licensing-basis requirements.

There are ten BEs associated with the vulnerability of that room; three of these BEs have a FV importance greater than 0.5%. These represent the EFFPs for two correlation groups and are associated with the five tornado categories evaluated. The total FV importance for these events is 7.2%. The area of this vulnerability is considered to be well defined. As a result, any conservatism would not be expected to eliminate the vulnerability. As a conservative estimate, it is assumed that a maximum of a 25% reduction in the EEFP could be possible.

0CAN022001 Enclosure Page 13 of 17 Using the FV importance value of 7.2%, this change would result in a reduction in the compliant case LERF of:

6.18E-07/year

• 0.072

• 0.25 = 1.1E-08/year Any reduction in EEFP for the compliant case would also be applicable to the degraded case.

However, neglecting any reduction in degraded case LERF, the additional increase in LERF above would result in a total LERF as shown below, which remains below the LERF acceptance criteria of 1.0E-07/year.

6.0E-09/year + 1.1E-08/year = 1.7E-08/year Even if the effect of reducing the EEFP of the RWT is included and neglecting any reduction in degraded case LERF, the additional increase in LERF above would result in a total LERF as shown below, which remains below the LERF acceptance criteria of 1.0E-07/year.

6.0E-09/year + 1.4E-08/year + 1.1E-08/year = 3.1E-08/year Other SSCs represented by the 48 BEs representing tornado missile vulnerabilities include the MSIVs and MSSVs. Because these are considered vulnerabilities and not non-conformances, any change in their EEFPs would affect both the degraded and compliant cases.

The FV importance measures for EEFPs representing all five tornado categories were summed for each of the SSCs above. The MSIVs have a FV importance of 1.7%. The MSSVs have an FV importance of 1.2%. All other SSCs above have a FV importance of less than 1% or less.

Given these low FV importance values, none of these SSCs are considered to be masking changes in risk, especially considering that any reduction in the EEFPs would result in a reduction in both the compliant and degraded case LERFs.

Based on the discussion above it is concluded that equipment failures in the compliant case are not masking changes in risk or would result in the risk change for LERF that does not remain less than 1.0E-07/year.

PRA RAI 08.01 - Key Assumptions and Uncertainties that Could Affect the Application In response to the RAI, several assumptions and sources of uncertainty were provided for each unit. With regard to the uncertainty associated with thermally-induced steam generator tube ruptures (TI-SGTR), the response refers to the use of WCAP-16341 and ANO plant-specific data in analyzing TI-SGTR modeling. The NRC staff notes that WCAP-16341 states that the reports modeling is only applicable to pressurized water reactors (PWRs) with large, dry containments and designed by Combustion Engineering or Westinghouse. In contrast, ANO-1 is a Babcock & Wilcox reactor that uses once-through steam generators.

The TMRE Impact Assessment provided in the RAI response states that the change in LERF due to TI-SGTR would impact both the compliant and degraded cases. This would reduce the change in risk. The NRC staff concurs with this assessment but is uncertain what the resultant change in CDF and LERF risk values would be if this uncertainty was evaluated. ANO-1

0CAN022001 Enclosure Page 14 of 17 delta-risk values are relatively near the RG 1.174 threshold. The response did not provide an assessment of the potential change in delta risk. It is not clear to the NRC staff what the impact of this uncertainty is for this application. In light of these observations:

a.

Justify the use of WCAP-16341 methodology for ANO-1 for the TMRE PRA model.

b.

Alternatively, provide a basis, such as a sensitivity study, to conclude that the source of uncertainty related to TI-SGTR does not impact the ANO-1 TMRE results.

Entergy Response (Part b)

The PRA model revision used for the TMRE analysis was the model-of-record (Revision 5p00) at the time the TMRE analysis was initiated. That model used the TI-SGTR probability from WCAP-16341 because it was believed that the probability presented in the WCAP would provide a conservative estimate of risk with respect to a TI-SGTR event. Because it was recognized that the use of WCAP-16341 was not directly applicable, TI-SGTR was identified as a source of uncertainty for ANO-1.

NUREG-1570, "Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture,"

states:

"On the basis of expected loop flow patterns observed in scaled facility studies, severe accident thermal challenges to steam generator tubes are not a concern for the B&W design since the natural circulation of superheated steam is confined to the hot leg and never reaches the steam generator. The "candy-cane" configuration prevents the involvement of the tube bundle in convective flow processes that could exist in the hot leg."

For LERF, a sensitivity study was performed using the cutsets from the base case evaluations for the degraded and compliant cases. In this sensitivity study, the probability of TI-SGTR was set to zero (0.0) and the complement terms, i.e., the probability of not having a TI-SGTR, were set to TRUE. The cutsets were compressed and minimized. The results of this sensitivity analysis are shown below.

ANO-1 Quantification Results for TI-SGTR Sensitivity Study LERF / year Degraded 1.006E-06 Compliant 0.986E-06 Delta 2.0E-08 Based on the results of this sensitivity study, the change in risk, i.e. LERF remains in the "very small" category as defined in Regulatory Guide 1.174. The change in LERF for this sensitivity case is less than 40% of the value originally reported, 5.1E-08 per year.

0CAN022001 Enclosure Page 15 of 17 PRA RAI 09.01 - ANO-1 and ANO-2 Aggregate Results The following PRA RAIs may result in changes to the ANO TMRE PRA models:

PRA RAI 02.01 - ANO-1 Nonconforming SSCs Not Included in the TMRE Analysis PRA RAI 08.01 - Key Assumptions and Uncertainties that Could Affect the Application The following PRA RAIs address sensitivity studies and exceedance of RG 1.174 criteria:

PRA RAI 05.01 - ANO TMRE Compliant-Case Conservatisms Sensitivity In light of the above potential changes to the TMRE analysis:

a.

Provide updated ANO TMRE results and associated sensitivities that incorporate changes from the resolutions of these RAIs.

b.

If the guidelines from RG 1.174 applicable to TMRE PRA as discussed in NEI 17-02 are exceeded, provide justification using one of the three methods described in Section 7.3 of NEI 17-02.

Entergy Response As detailed in the response to PRA RAI 02.01, the non-conforming SSCs not included in the TMRE analysis do not need to be added to the model because these SSCs do not perform any PRA-related functions and no changes to the TMRE model were needed. Therefore, no updated results are needed in support of PRA RAI 02.01.

A revised compliant case conservatism study is detailed in the response to RAI PRA 05.01.

Results of the sensitivity analysis for the TI-SGTR concern are provided in the response to RAI PRA 08.01. However, no changes were needed to the PRA model because the analysis was performed using cutset manipulation.

The results provided in the subject responses conclude that all cases remain within the RG 1.174 acceptance criteria.

PRA RAI 09.b.01 - ANO-1 and ANO-2 Aggregate Results With regards to the ANO-1 TMRE missile distribution sensitivity, which exceeds the RG 1.174 threshold for both CDF and LERF, the RAI response referred to the RAI 07.e response as justification. However, the RAI 07.e response only addressed the reasons why the LERF results were more significantly impacted than the CDF results.

0CAN022001 Enclosure Page 16 of 17 Explain how the risk acceptance guidelines are met for this application. Justification may include but is not limited to the following:

describing and providing the results of a more detailed, realistic analysis to reduce conservatism and uncertainty describing compensatory measures and discussing their quantifiable impact on the risk results discussing the conservatisms in the analysis and their quantifiable impact on the risk results Entergy Response (3rd bullet)

For the missile distribution sensitivity of ANO-1, the EEFPs for all SSCs with a risk achievement worth (RAW) greater than 2 are increased by a factor of 2.75. In total, 39 EEFPs had a RAW greater than 2 and the associated values were subsequently increased for F4 through F6 tornados.

In addition, as described in Section 7.2.1 of NEI 17-02, Revision 1B, any highly-exposed target is evaluated to determine if more than 1100 potential missiles are located within 100 feet of the target. If so, the EEFP for that target may be increased by a factor greater than 2.75. Six of the 39 SSCs above met the criteria in NEI 17-02, Revision 1B, as being highly exposed. Of these six, one, the fuel oil storage tank vents, was determined to have more than 1100 potential missiles within 100 feet. As a result, the EEFP for the fuel oil storage tank vents was increased by a factor of 3.85. None of the highly-exposed SSCs were considered a non-conformance.

When applying the multiplier for the missile distribution sensitivity, the EEFPs from the base case were used. Calculation of these initial EEFPs for the base case contained conservatisms, but because the base case met the acceptance criteria for risk increase, the conservatisms were retained. For the missile distribution sensitivity, the results presented initially exceeded the acceptance criteria of RG 1.174. As a result, conservatisms from the base case were examined and those conservatisms which could impact the conclusions of the sensitivity study were removed.

The first conservatism examined was the impact of vulnerabilities of cables contained in conduits. The EEFPs for the vast majority of these vulnerabilities were calculated assuming that the target was non-robust. However, per Table B-18 of NEI 17-02, Revision 1B, a steel pipe less than 10-inches in diameter or less than 3/8-inches thick with a penetration failure mode can reduce the calculated EEFP by 50%. Because conduit is a steel pipe which meets these criteria, it is appropriate to reduce the EEFPs for conduits by 50%.

For the missile distribution sensitivity, those EEFPs that were increased in value for the sensitivity study were examined for conservatism. The EEFPs for the four correlation groups in the bowling alley, 73-A, 73B, 73-C, and 73-D, all represent conduits. Therefore, the EEFPs for these failures were reduced by 50% for the F4, F5, and F6 tornados. Also, the EEFPs for correlation groups 197-EC1504, 197-EC1056, 197-EC-01, and 197-EJ1004 also were reduced by 50% for the F4, F5, and F6 tornados.

0CAN022001 Enclosure Page 17 of 17 There are other vulnerabilities involving conduits that could have similar reductions performed.

These reductions would produce smaller effects than those previously described. The overall effect, however, is expected to reduce the change in risk shown below.

Additionally, the EEFP representing failure of the MSSVs was examined. Tornado missile impact to the MSSVs was assumed to cause all applicable failure modes of the valves. That is, an impact would cause both failure to open as well as failure to close. However, only one failure mode can be applicable for a given valve. Additionally, the valves for each SG were treated as a single correlation group. Reducing the correlation between the two SGs would reduce the failure probability for MSSVs. An estimate of the reduction of the EEFP for MSSVs is that half of the impacts would cause valve failure to open and half would cause failure to close.

Reducing the correlation of the two SG valve groups would further lower the EEFP. For this sensitivity, the EEFP for the MSSVs was reduced by 50% for the F4, F5, and F6 tornados.

Finally, the TI-SGTR was removed as a failure mode. The basis for this removal is discussed in the response to PRA RAI 08.01 above.

The combined effect of these changes is shown in the table below.

Zonal Missile Distribution Sensitivity Results CDF (/yr)

LERF (/yr)

Degraded 1.58E-05 1.72E-06 Compliant 1.50E-05 1.63E-06 Delta 8E-07 9E-08 These results show that removing conservatisms from the TMRE model causes the missile distribution sensitivity analysis to produce results that are within the acceptance criteria.

REFERENCES

1.

Entergy Operations, Inc. (Entergy) letter to U. S. Nuclear Regulatory Commission (NRC), License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis, Arkansas Nuclear One, Units 1 and 2 (0CAN041904)

(ML19119A090), dated April 29, 2019.

2.

NRC email to Entergy, ANO-1 and 2 -- Final RAI #2 RE: LAR to Incorporate Tornado Missile Risk Evaluator (TMRE) into Licensing Basis (EPID L-2019-LLA-0093),

(0CNA012001) (ML20013C747), dated January 10, 2020.

3.

Entergy letter to NRC, Response to Request for Additional Information Related to License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis, Arkansas Nuclear One, Units 1 and 2 (0CAN111901) (ML19322A767),

dated November 14, 2019.