0CAN041904, License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into the Licensing Basis

ML19119A090
Person / Time
Site:	Arkansas Nuclear
Issue date:	04/29/2019
From:	Gaston R Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
0CAN041904
Download: ML19119A090 (176)

Text

Entergy Operations, Inc.

1340 Echelon Parkway Jackson, MS 39213 Tel 601-368-5138 Ron Gaston Director, Nuclear Licensing 10 CFR 50.90 0CAN041904 April 29, 2019 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

SUBJECT:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis Arkansas Nuclear One, Units 1 and 2 NRC Docket Nos. 50-313 and 50-368 Renewed Facility Operating License Nos. DPR-51 and NPF-6 Pursuant to 10 CFR 50.90, Entergy Operations, Inc. (Entergy) hereby requests a change to the license basis documents for Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) to use the Tornado Missile Risk Evaluator (TMRE) methodology as the licensing basis to qualify several components that have been identified as not conforming to the unit specific current licensing basis. The enclosure concludes that the proposed amendment does not involve a significant hazards consideration.

The TMRE methodology was transmitted to the Nuclear Regulatory Commission (NRC) by the Nuclear Energy Institute (NEI) as NEI Technical Report 17-02, Revision 1, on September 21, 2017 (Reference 1). NEI established a Pilot Plant NRC review for the TMRE methodology through which Revisions 1A and 1B of NEI 17-02 (References 2 and 3) were submitted to the NRC in licensees responses to the NRCs request for additional information.

The NRC issued Regulatory Issue Summary (RIS) 2015-06, "Tornado Missile Protection" (Reference 4), to, in part, remind licensees of the need to conform to a plants current, site-specific licensing basis for tornado-generated missile protection. In response to RIS 2015-06, walkdowns were performed of ANO-1 and ANO-2 to identify potential vulnerabilities with the current licensing basis (CLB) for tornado missile protection. Plant configurations in both units for which structures, systems, and components (SSCs) should be protected from tornado-generated missiles based on the CLB were identified.

The NRC provided information in Enforcement Guidance Memorandum (EGM) 15-002 (Reference 5) with respect to exercising enforcement discretion when an operating power reactor licensee does not comply with a plants current site-specific licensing basis for tornado-generated missile protection. The NRC would exercise this enforcement discretion only when a licensee implements initial compensatory measures to provide additional protection,

0CAN041904 Page 2 of 3 followed by more comprehensive, long-term compensatory measures implemented within 60 days of discovery of a non-complying SSC. The NRC issued Revision 1 of EGM 15-002 (Reference 6) to provide guidance for a licensee to request an extension of the enforcement discretion expiration date, if appropriately justified. The nonconforming SSCs identified at ANO-1 and ANO-2 were entered into the sites corrective action program and the enforcement discretion allowed by EGM 15-002 was applied.

On March 19, 2018, ANO submitted a request to extend the enforcement discretion provided in EGM 15-002 for tornado-generated missile protection non-conformances identified in response to RIS 2015-06, "Tornado Missile Protection" (Reference 7). The NRC approved the requested extension on April 12, 2018 (Reference 8), which extended the expiration date for the period of enforcement for ANO-1 and ANO-2 to June 10, 2020.

Approval of the proposed amendment is requested by May 1, 2020. This date supports the expiration date for the period of enforcement. Once approved, the amendment shall be implemented within 30 days.

No new regulatory commitments are included in this amendment request.

In accordance with 10 CFR 50.91, Entergy is notifying the State of Arkansas of this amendment request by transmitting a copy of this letter and enclosure to the designated State Official.

If there are any questions or if additional information is needed, please contact Tim Arnold at 479-858-7826.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on April 29, 2019.

Sincerely, ORIGINAL SIGNED BY RON GASTON Ron Gaston RG/dbb

Enclosure:

Evaluation of the Proposed Change Attachments to

Enclosure:

1. Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

2. Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

3. ANOs Review of Pilot Plant RAIs

4. Safety Analysis Report Page Markups

5. Retyped Safety Analysis Report Pages

0CAN041904 Page 3 of 3

REFERENCES:

1. NEI Technical Report 17-02, [Rev. 1], dated September 2017 (ML17268A033 and ML17268A036)

2. NEI Technical Report 17-02 [Rev. 1A] included in Vogtle Electric Generating Plant - Unit 1 and 2 Tornado Missile Risk Evaluator SNC Response to NRC Request for Additional Information, dated July 26, 2018 (ML18207A876)

3. NEI Technical Report 17-02 [Rev. 1B] included in Shearon Harris Nuclear Power Plant, Unit 1 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis -

Supplement and Request for Additional Information Response, dated September 19, 2018 (ML18262A328)

4. NRC Regulatory Issue Summary 2015-06, "Tornado Missile Protection,"

dated June 10, 2015 (ML15020A419)

5. NRC memorandum, "Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," dated June 10, 2015 (ML15111A269)

6. NRC memorandum, "Enforcement Guidance Memorandum 15-002, Revision 1: Enforcement Discretion for Tornado-Generated Missile Protection Non-Compliance," dated February 7, 2017 (ML16355A286)

7. Entergy letter to the NRC dated March 19. 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generate Missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06,'Tornado Missile Protection'" (0CAN031802)

(ML18078B016)

8. NRC letter to Arkansas Nuclear One dated April 12, 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generated missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CNA041801)

(ML18094A739) cc: NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Mr. Bernard R. Bevill Arkansas Department of Health Radiation Control Section 4815 West Markham Street Slot #30 Little Rock, AR 72205

Enclosure to 0CAN041904 Evaluation of the Proposed Change

Enclosure to 0CAN041904 Page 1 of 47 EVALUATION OF THE PROPOSED CHANGE 1.0

SUMMARY

DESCRIPTION The proposed amendment would modify the Safety Analysis Reports (SARs) associated with Arkansas Nuclear One, Unit 1 (ANO-1) Renewed Facility Operating License DPR-51 and Arkansas Nuclear One, Unit 2 (ANO-2) Renewed Facility Operating License NPF-6 to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology. The TMRE methodology was transmitted to the Nuclear Regulatory Commission (NRC) by the Nuclear Energy Institute (NEI) as NEI Technical Report 17-02, Revision 1, on September 21, 2017 (Reference 1). NEI established a Pilot Plant NRC review for the TMRE methodology through which Revisions 1A and 1B of NEI 17-02 (References 2 and 3) were submitted to the NRC in licensees responses to the NRCs request for additional information. TMRE is a proposed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles and provides guidance for resolving discrepancies against the current licensing basis (CLB) requirements.

The methodology assists in determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where adequate tornado missile protection is not currently provided and cannot be used to avoid providing tornado missile protection in the plant modification process. The requested change does not involve a significant hazards consideration.

The proposed amendment would modify ANO-1 SAR Section 5.1.5, "Wind and Tornado Loads,"

and ANO-2 SAR Section 3.5.4, "Barrier Design Procedures."

ANO-1 SAR Section 5.1.5 currently states:

Design wind loads are based on ASCE Paper 3269, "Wind Forces on Structures."

A. "Design" Wind Load (except tornado) is in accordance with the following tabulated values determined from ASCE 3269 paper for a basic wind velocity of 67 mph, 1.1 gust factor, and 1.3 shape factor:

Height Above Design Pressure Ground (Feet) PSF 0-30 20 30-50 20 50-100 26 100-150 26 B. Tornado. Class 1 structures are analyzed for tornado loading (not coincident with accident or earthquake) on the following basis:

1. Differential bursting pressure between the inside and the outside of the structures - three psi positive pressure.

Enclosure to 0CAN041904 Page 2 of 47

2. Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors.

The provisions for gust factors and variations of wind velocity with height do not apply.

3. Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6. Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures.

Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings and it is highly improbable that they will be pierced by tornado missiles. Further analysis also indicates that, in the unlikely event these penetrations are impinged by tornado missiles, the incident will not cause a LOCA or prevent a safe shutdown of the plant. The spent fuel pool walls are inherently resistant to missiles. A discussion on the enclosure over the new and spent fuel pool storage facilities is included in Section 5.3.2. Investigations of previous tornadoes demonstrate that no funneling effect of the tornado winds is to be expected between the Unit 1 and Unit 2 containment structures.

The possibility of the generation of secondary missiles within the structure from tornado missiles was analyzed. The 3-inch diameter pipe, as described in Section 5.2.1.2.6 was considered as potentially damaging due to its high density. However, based on results of U. S. Army Corps of Engineers investigation (5), only 13 inches of concrete thickness is required to prevent spalling of 3,000 psi concrete from an impact by the 3-inch diameter pipe missile. Since 18 inches is the minimum exterior wall and slab thickness provided for Class 1 structures, the safety related equipment and systems will not be affected by secondary missiles.

Intervening SSCs, including large equipment and structural members, may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

Enclosure to 0CAN041904 Page 3 of 47 Entergy Operations, Inc. (Entergy) proposes to add the following to ANO-1 SAR Section 5.1.5:

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH- 4A and 4B chillers (reference CR-ANO-1-2017-3702).

ANO-2 SAR Section 3.5.4 currently states, in part:

The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

Entergy proposes to add the following to ANO-2 SAR Section 3.5.4:

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Enclosure to 0CAN041904 Page 4 of 47 Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

2.0 DETAILED DESCRIPTION 2.1 Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (Reference 4). The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed. The specific criteria for each nuclear power plant are contained in the individual plants specific licensing basis.

In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection.

Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles. Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS methodology. The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile, and was accepted for use by the NRC. In cases where some components were not in conformance with a plants licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required. Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis.

The Nuclear Energy Institute (NEI) developed the TMRE methodology, which is an alternative risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Enclosure to 0CAN041904 Page 5 of 47 2.2 Current Licensing Basis 2.2.1 ANO-1 Licensing Basis ANO-1 General Design Criteria The ANO-1 construction permit was issued in December 1968. ANO was aware of the proposed Atomic Energy Commission (AEC) General Design Criteria (GDC); however, ANO-1 received the construction permit prior to issuance of the GDC. Although ANO-1 was not governed by the GDC, ANO-1 SAR, Section 1.4.2, includes a discussion of how ANO-1 meets the intent of GDC 2.

The ANO-1 general design strategy for meeting the intent of the draft GDC 2, "Design Bases for Protection Against Natural Phenomena," was to provide protection of safety related equipment against natural phenomenon by housing safety-related equipment in seismically qualified Class I structures. These structures then provide protection against natural phenomenon such as rain, wind, differential pressure and tornado missiles (reference SAR Section 1.4.2). SAR Section 5.1.2.1.1 identifies the following structures as being Class 1:

Reactor building (including steel liner, prestressing system penetrations, air locks, interior structures, and shielding elements directly related to nuclear safety)

Auxiliary building housing the engineered safeguards systems, control room, spent fuel pool (excluding liner plate), diesel generators, and radioactive materials.

Portions of the intake structure housing service water pumps Supports for Seismic Class 1 system components Emergency reservoir and pipelines Emergency diesel fuel storage vault Post-Accident Sampling System Building ANO-1 meets the intent of draft GDC 4, Environmental and Missile Design Basis, for tornado-generated missiles through structural design and physical location of components, which includes redundant train separation (reference SAR Section 1.4.4).

ANO-1 Safety Evaluation Report The NRC staff issued the original Safety Evaluation Report (SER) to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from the original SER include:

Section 3.3, Wind and Tornado Design The sustained design wind speed used for the design of essential plant structures was 67 mph. Wind pressure, shape factors, gust factors, and variation of winds with height were determined in accordance with the American Society of Civil Engineers paper ASCE 3269, "Wind Forces on Structures."

Enclosure to 0CAN041904 Page 6 of 47 Tornado design loading consisted of a differential pressure equal to 3 psi occurring in three seconds, followed by a calm for two seconds and a repressurization, and a lateral force caused by a funnel of wind having a peripheral tangential velocity of 300 mph and forward progression of 60 mph.

We conclude that the design of the facility to the above wind and tornado loads is acceptable.

Section 3.5, Missile Protection The design of essential structures and vital components considered the effects of a spectrum of tornado-borne missiles and internally generated missiles associated with component overspeed failures and missiles that could originate from high energy system ruptures. There will be no loss of function of seismic Category I structures or components as a result of missile action.

All seismic Category I structures are designed to withstand the effects of the following spectrum of tornado-borne missiles: a 4-inch x 12-inch by 12-foot long wooden plank traveling end-on at 300 mph; an automobile weighing two tons traveling through the air 25 feet above the ground at 50 mph and striking the structure with a contact area of 20 square feet; and a missile equivalent to a 3-inch diameter schedule 40 pipe, 10 feet long, traveling end-on at 100 mph and striking the structure anywhere over its full height.

Essential components contained in seismic Category I structures are inherently protected from tornado-borne missiles by virtue of being in a tornado resistant structure. The main steam and reactor building purge line penetrations are not located within a tornado resistant structure or protected by missile shielding, but have been designed to withstand tornado winds and pressure drop loadings. We have reviewed the applicants missile impact analysis for these penetrations (main steam line and purge lines) and conclude that missile impacts on these penetrations would not cause a LOCA or prevent safe plant shutdown.

We conclude that the missile protection provided for ANO-1 is acceptable.

ANO-1 CLB for Tornado and Tornado Missile Protection Design Per the ANO-1 SAR, Section 5.1.2.1, Seismic Class 1 SSCs are defined as those SSCs which could cause uncontrolled release of radioactivity upon failure or those essential for safe shutdown reactor shutdown and the immediate and long-term operation following a loss of coolant accident (LOCA). These structures include the Reactor Building, the Auxiliary Building (housing engineered safeguards systems, Control Room, spent fuel pool (SFP), emergency diesel generators (EDGs), and radioactive materials), portions of the Intake Structure (housing Service Water pumps and support features), the emergency diesel fuel oil storage vault, and the post-accident sampling system building. As discussed in SAR Section 5.1.5, Class 1 structures were analyzed for tornado loading (not coincident with accident or earthquake) on the following basis:

Differential bursting pressure between the inside and the outside of the structures -

three psi positive pressure.

Enclosure to 0CAN041904 Page 7 of 47 Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph.

The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category 1 structures were designed considering a uniform pressure resulting from the 300 mph wind velocity. The applicable portions of wind design methods described in ASCE paper 3269, "Wind Forces on Structures," are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, SFP, EDG rooms, etc., are inherently tornado protected by virtue of being housed in tornado resistant structures. The SFP walls are inherently resistant to missiles. The main steam line and containment purge line reactor building penetrations are not located within a tornado resistant structure or protected by a missile shield. In accordance with the SAR, these penetrations will withstand tornado winds and pressure drop loadings, and it is considered highly improbable that these penetrations will be pierced by tornado missiles. Further analysis also indicates that, in the unlikely event these penetrations are impinged by tornado missiles, the incident will not cause a LOCA or prevent a safe shutdown of the plant.

Per Section 5.1.5 of the ANO-1 SAR, Class 1 structures were designed, except as noted below, for the following CLB tornado missiles:

A 4-inch thick by 12-inch wide by 12-foot long wood plank traveling end-on at a velocity of 300 mph.

An airborne 4,000-pound passenger automobile traveling at a velocity of 50 mph, not more than 25 feet above the ground.

A 3-inch diameter schedule 40 pipe, 10 feet long, traveling end-on at 100 mph, sticking anywhere over the full height of the structure was also considered.

The possibility of the generation of secondary missiles within structures from tornado missiles was analyzed. The 3-inch diameter pipe, as described above, was considered as potentially damaging due to its high density. However, based on results of U.S. Army Corps of Engineers investigation, only 13 inches of concrete thickness is required to prevent spalling of 3,000 psi concrete from an impact by the 3-inch diameter pipe missile. Since 18 inches is the minimum exterior wall and slab thickness provided for Class 1 structures, the safety related equipment and systems will not be affected by secondary missiles.

Vertical missiles are not considered in the CLB.

2.2.2 ANO-2 Licensing Basis ANO-2 General Design Criteria ANO-2 was originally designed to comply with the 70 "Proposed General Design Criteria for Nuclear Power Plant Construction Permits," published in July 1967. Nevertheless, Sections 3.1.1 through 3.1.6 of the ANO-2 SAR provide a comparison with the AEC GDC published as Appendix A to 10 CFR 50 in 1971, illustrating how the intent of each GDC (as published in 1971) is met.

Enclosure to 0CAN041904 Page 8 of 47 ANO-2 meets the intent GDC 2 by housing safety-related equipment in Seismic Category 1 structures, which are designed for the most severe local wind phenomena and tornado effects which can be expected to occur at the site (reference SAR Section 3.3). Seismic Category 1 structures, which are considered tornado resistant enclosures, and the associated protected equipment include:

ANO-2 SAR Table 3.3-1 Tornado Wind Protected Components and Tornado Resistant Enclosures Protected Components Tornado Resistant Enclosure Reactor Coolant System Containment Reactor Protective System and Engineered Containment Safety Features Inside Containment Control Room Auxiliary Building Various Electrical, Instrumentation and Control Containment and Auxiliary Building Equipment Required for Safe Shutdown Shutdown Cooling System Auxiliary Building Reactor Coolant Pressure Control Equipment Auxiliary Building Boron Addition Equipment Auxiliary Building Spent Fuel Pool Fuel Pool Wall Emergency Diesel Generators Diesel Generator Rooms in Auxiliary Building Diesel Fuel Oil System Underground Vault Service Water Pumps Intake Structure Emergency Feedwater Pumps Auxiliary Building Safety Injection System Auxiliary Building ANO-2 meets the intent of GDC 4 through conservative design methods, segregated routing of piping, missile shield walls, and engineered hangers and pipe restraints, all of which are used to accommodate dynamic effects of postulated accidents. These same features as well as the strength of the auxiliary building, containment and intake structure protect the safety-related equipment from missiles which might be generated either within or outside the plant (reference SAR Section 3.1.1).

ANO-2 Safety Evaluation Report The NRC staff issued the original ANO-2 SER to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from the original SER include:

Enclosure to 0CAN041904 Page 9 of 47 ANO-2 SER Section 3.3, Wind and Tornado Design Criteria All seismic Category I structures exposed to wind forces are being designed to withstand the effects of the design wind. The design wind specified has a velocity of 80 miles per hour based on a recurrence interval of 100 years.

The procedures used to transform the wind velocity into pressure loadings on structures and the associated vertical distribution of wind pressures and gust factors are in accordance with American Society of Civil Engineers Paper No. 3269, "Wind Forces on Structures."

All seismic Category I structures exposed to tornado forces and needed for the safe shutdown of the plant are designed to resist a tornado with a 300 mile per hour tangential wind velocity and a 60 miles per hour translational wind velocity. The atmospheric pressure drop associated with the design tornado is three pounds per square inch in three seconds. An appropriate spectrum of tornado-generated missiles is also postulated as will be discussed in Section 3.5 of this report.

The procedures used to transform tornado wind velocity into pressure loadings are similar to those used for the design wind loadings. The pressure drop associated with the design tornado is treated as a static uniform load applied on vertical and horizontal projected areas of the structures.

Tornado missile effects were determined using procedures to be discussed in Section 3.5 of this report. The total effect of the design tornado on seismic Category I structures was determined by the appropriate combination of the individual effects of the tornado wind pressure, pressure drop and tornado associated missiles. Tornado-generated loads were then combined with other applicable loads as will be discussed in Section 3.8 of this report. Structures are arranged on the plant site and protected in such manner that collapse of structures not designed for tornadoes will not affect safety-related structures and systems.

The criteria used and the procedures utilized to account for loading on seismic Category I structures and components induced by the design wind and tornado specified for the plant provide a conservative basis for engineering design and assure that such environmental forces are adequately represented.

The use of these procedures provides reasonable assurance that, in the event of wind or a tornado, the structural integrity of all seismic Category I structures will not be impaired and consequently, seismic Category I systems and components located within these structures will be adequately protected. Conformance with these criteria is an acceptable basis for satisfying the requirements of General Design Criteria 2.

ANO-2 SER Section 3.5, Missile Protection Criteria The plant seismic Category I structures, systems and components are shielded from, or are designed for, various postulated missiles. Missiles considered include tornado generated missiles and various postulated missiles generated within the plant.

Enclosure to 0CAN041904 Page 10 of 47 Adequate information has been provided indicating the structures, shields and barriers that are designed to resist the effects of missiles. The missiles applicable to each of these structures, shields and barriers are also adequately identified and their characteristics defined.

The analysis of structures, shields and barriers to determine the effects of missile impact was accomplished in two steps. In the first step, the potential damage that could be done by the missile in the immediate vicinity of impact was investigated. This was accomplished by estimating the depth of penetration of the missile into the impacted structures. Furthermore, secondary missiles are prevented by fixing the target thickness well above that determined for penetrations. In the second step of the analysis, the overall structural response of the target when impacted by a missile was determined using established methods of impactive analysis. The equivalent loads of missile impact, whether the missile is environmentally generated or accidently generated within the plant, were combined with other applicable loads as is discussed in Section 3.8 of this report.

The design procedures used to determine the effects and loading on seismic Category I structures by design basis missiles selected for the plant provide a conservative basis for engineering design to assure adequate protection from the effects of missile impacts.

The use of these criteria for protection from postulated missiles provides reasonable assurance that resulting loads and effects will not impair the structural integrity of seismic Category I structures, or result in any loss of function of safety-related systems and components contained in such structures. We have concluded that conformance with these criteria is an acceptable basis for satisfying the applicable requirements of General Design Criteria 2 and 4.

ANO-2 SER Section 3.5.1, Tornado Missile Protection Our review for tornado missile protection was based on General Design Criteria 2 and 4.

We found that all safety-related equipment necessary for a cold shutdown was adequately protected from tornado missiles with the exception of the underground diesel fuel lines leading from the emergency diesel fuel oil tank vault to the diesel generator room and the sluice gate within the emergency cooling pond intake structure.

The applicant subsequently provided additional protective covering over the diesel fuel lines in addition to the previous three-foot soil cover, and provided further protective features in the design of the emergency cooling pond intake structure.

We therefore conclude that the Arkansas Nuclear One - Unit 2 facility is adequately protected against tornado missiles and is acceptable.

ANO-2 SAR Per Section 3.3, "Wind and Tornado Loadings," of the ANO-2 SAR, Class 1 structures were designed for the most severe local wind phenomena and tornado effects which can be expected to occur at the site. These structures include: the Containment Building, the Auxiliary Building, the SFP wall, the EDG rooms within the Auxiliary Building, the diesel fuel oil underground vault, and the Intake Structure.

Enclosure to 0CAN041904 Page 11 of 47 As reflected in Section 3.3.2, "Tornado Loadings," of the ANO-2 SAR, tornado-protected Class 1 structures were analyzed for tornado loadings not coincident with any unrelated accident condition or earthquake. For Class 1 structures designed to withstand tornadoes and tornado generated missiles, the following parameters were applied in combinations to produce the most critical conditions.

The dynamic wind pressure is caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward procession of 60 mph. The tornado resistant design of the ANO units was completed prior to the issuance of Regulatory Guide (RG) 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants." As a result, the radius of maximum rotational speed is not significant to the ANO design, and Class 1 structures were designed considering a uniform pressure resulting from the 300 mph wind velocity. The applicable portions of wind design methods described in ASCE Paper No. 3269 were used, particularly for shape factors. The provisions for gust factors and variation of wind velocity with height were not applied.

The structure interior bursting pressure is taken as rising 1 psi/sec for three seconds followed by a 2-second calm, then decreasing at 1 psi/sec for three seconds. This cycle accounted for reduced pressure in the eye of a passing tornado. All fully enclosed Class 1 structures were designed to withstand the full 3 psi pressure differential.

Tornado-generated missiles will not cause loss of containment integrity, penetrate the Control Room boundary, or cause loss of integrity to the SFP. SSCs were designed such that tornado missiles will not cause loss of function to any system required for hot shutdown of the reactor from the Control Room even assuming the failure of a single active component, and will not cause loss of function of any system required for cold shutdown.

Section 3.3.2.1 of the ANO-2 SAR considers three types of tornado missiles. Each type was considered to act independently, with only one type occurring at any one time. The three types of missiles are as follows:

A wood plank, 4-inches x 12-inches in cross section, weighing 108 pounds, traveling end-on at a speed of 300 mph and striking the structures at any elevation.

A steel pipe, schedule 40, 3-inches in diameter x 10-feet long, weighing 75.8 pounds, traveling end-on at 100 mph and striking the structure at any elevation.

An automobile of 4,000-pound weight, striking the structure at 50 mph on a contact area of 20 square feet, any portion of the impact area being not more than 25 feet above grade.

Section 3.3.2.3 of the ANO-2 SAR states that failure of Class 2 structures is not expected to affect the ability of Class 1 structure to perform their functions based on the following:

Tornado missiles that may be formed by the failure of Class 2 structures will not exceed the force of those postulated and described above, against which Class 1 structures were designed.

Enclosure to 0CAN041904 Page 12 of 47 An investigation of the structural frame of the Class 2 Turbine Building in the vicinity of the Auxiliary Building revealed the Turbine Building will not collapse when subjected to tornado loadings, assuming that one-third of the exterior metal siding would be exposed to the full tornado load. The structural steel framing enclosing the Auxiliary Building SFP area has also been checked for the same conditions, with the same results. This condition is commonly observed in tornado damage. The fasteners are known to be much weaker in shear and in pull out than the continuous sheet acting as a catenary.

Therefore, in the event of a tornado, the fasteners on the two ends of the sheet can be expected to fail and the sheathing assumed to remain balanced and restrained by the central portion of the panel against the girts.

Missile barriers capable of withstanding tornado-generated missiles and designed to provide protection from identified missiles are outlined below (reference ANO-2 SAR, Table 3.5-1).

Protected Components Missile Barrier Reactor Coolant System and other protected Prestressed concrete containment, primary equipment and systems inside containment and secondary shields, reinforced concrete and refueling cavity wall, internal structures and beams, movable missile shield Control Room Components Enclosure by reinforced concrete auxiliary building walls and slabs Safety injection, spray, boron addition, cooling Reinforced concrete auxiliary building.

water, ventilation, electrical instrumentation Separation of safety-related trains and and control and other protected equipment in enclosure by auxiliary building internal auxiliary building structure, walls and slabs.

Spent Fuel Pool SFP wall. Heavy structural auxiliary building components are designed such that missile impact will not cause them to fall into the fuel pool.

Emergency Diesel Generators Separation and enclosure by reinforced concrete auxiliary building walls and slabs.

Diesel Fuel Oil System Separation and enclosure by reinforced concrete vault partially underground.

Service Water Pumps Separation and enclosure by reinforced concrete intake structure walls and slabs.

Auxiliary Feedwater Pumps Separation and enclosure by reinforced concrete Auxiliary Building walls and slabs Category 1 Electrical Cables Reinforced concrete cover Condensate Storage Tank (T41B) Reinforced concrete cover Pipe Trenches and Valve Pits Condensate Storage Tank T41B Reinforce concrete wall

Enclosure to 0CAN041904 Page 13 of 47 Protection from tornado-generated horizontal and vertical missiles was considered for the following components: Intake Structure Exhaust Fans and Air Intake, EDG Rooms Air Intake and Exhaust Fans, EDG Combustion Air Intake, Service Water Piping between Emergency Cooling Pond (ECP) and Intake Structure / Auxiliary Building (3-feet of earth), ECP Sluice Gate, and EDG Fuel Storage Tanks. Otherwise, only horizontal missiles were considered.

2.3 Reason for the Proposed Change In response to RIS 2015-06, Entergy performed walk downs at ANO to identify potential discrepancies with the ANO CLB related to tornado-generated missile protection. As part of the walk downs SSCs were identified as being nonconforming. The nonconforming SSCs were entered into the corrective action program. The conditions that satisfied reporting criteria of 10 CFR 50.72 and/or 10 CFR 50.73 were reported to the NRC as outlined in ANOs request to extend enforcement discretion (Reference 7) provided in EGM 15-002, which was subsequently approved by the NRC (Reference 8).

Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance" (References 5 and 6), and DSS-ISG-2016-01, "Clarification of Licensee Actions in Receipt of Enforcement Discretion per Enforcement Guidance Memorandum EGM 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance'" (Reference 9), with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status.

Compensatory actions will remain in effect until the SSCs have been restored to full qualification.

Several non-conformances have been resolved by plant modifications at significant cost. Those not resolved by plant modifications are addressed through the proposed application of TMRE and discussed below.

As documented by the NRC in EGM 15-002, in general, tornado missile scenarios do not represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados.

The staffs study established that the Core Damage Frequency (CDF) associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

Tables 1 and 2 (ANO-1 and ANO-2, respectively) outline the non-conformances that are planned for resolution via this amendment request.

Enclosure to 0CAN041904 Page 14 of 47 Table 1 ANO-1 Nonconforming (Safety-Related) SSC Vulnerabilities Item Vulnerability Description General Location Three small fire damper openings (FD-0135-02-0009 (22-inches x 22-inches), FD-0135-02-0022 (16-inches x 18-inches), and FD-0141-02-0011 (14-inches x 12-inches))

Controlled Access, 1 in the south wall of the Controlled Access point (commonly Elevation (EL.) 386 referred to as CA-1) are vulnerable to a northern bound missile. Green train safety-related electrical raceways could be impacted. (CR-ANO-1-2016-2752)

Unprotected conduits in the demineralizer area (Room 73) Room 73 (Unit 1 2 on the east side of the hallway near Column Line 5.9 were Bowling Alley, identified as nonconforming. (CR-ANO-1-2017-1171) EL. 354)

A cable tray opening in the reinforced concrete wall 3-S-23 Room 104 (Electrical 3 was identified between Rooms 103 and 104. Equipment Room, (CR-ANO-1-2017-1171) EL 368)

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line could be impacted by a 3-inch diameter, schedule 40 4 Above EL. 404' steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph. (CR-ANO-1-2015-3940) (Note 1)

Note 1: The P-7A EFW Pump Steam Supply Line vulnerability was identified in NRCs confirmatory action letter to ANO dated June 17, 2016 (0CNA061604, ML16169A193). The 4-inch steam supply line (above elevation 404') to the EFW turbine driven pump (P-7A) is vulnerable to a tornado missile strike. ANO has defined three possible tornado missiles (reference ANO-1 SAR Section 5.2.1.2.6 "Wind and Tornado Loads"). At the 404' elevation only the 3" diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph (147 ft/sec) is considered credible. There is no specific analysis of the effect of a missile of this size hitting the 4-inch schedule 40 EFW steam supply piping; therefore, P-7A is considered Operable but Degraded and Nonconforming. This lack of documentation is not under enforcement discretion; however, it is included in TMRE to document its design and licensing basis.

In addition to the above, several ANO-1 nonconforming conditions were safety-related features that had previously been evaluated to have a negligible impact on the RG 1.200 compliant ANO-1 Internal Events Probabilistic Risk Assessment (PRA) and, therefore, are not explicitly modeled. Because the TMRE Methodology uses the Internal Events PRA, the hypothetical impact of a tornado missile on those features also has a negligible impact on the risk associated with tornado missile protection. Non-conforming features in this category are listed below.

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-2752)

Small bore service water piping (HCD-65-2" and HCD-66-2") to VCH- 4A and 4B pumps (reference CR-ANO-1-2017-3702)

Enclosure to 0CAN041904 Page 15 of 47 Table 2 ANO-2 Nonconforming (Safety-Related) SSC Vulnerabilities Item Vulnerability Description General Location Room 2136 (Unit 2 2K-4A EDG could be impacted by a tornado-generated Controlled Access missile vulnerability associated with Conduit EC1373 which Area) and 1 contains safety-related cables that run between Switchgear Room 2145 Cabinet 2A-308 and the Diesel Generator No. 1 Meter and (Fire Brigade Area, Relay Cabinets (2E11 and 2E12). (CR-ANO-2-2017-1555)

EL 386).

2P-7A, EFW Pump Steam Supply Line could be impacted by a 3-inch diameter, schedule 40 steel pipe, 10-feet long 2 EL. 404 weighing 75.8 lbs. and traveling at 100 mph. (CR-ANO 2015-4851) (Note 1)

Diesel Exhaust Stacks - The EDGs, 2K-4A and 2K-4B, exhaust pipes are vulnerable to tornado missiles. The entire Auxiliary Building 3

vulnerable segment of piping is nonconforming. (CR-ANO-C- Roof 2018-02260) (Note 2)

Note 1: The 2P-7A EFW Pump Steam Supply Line vulnerability was identified in NRCs confirmatory action letter to ANO dated June 17, 2016 (0CNA061604, ML16169A193). ANO-2 FSAR, Table 3.5-6, "Tornado Missile Characteristics,"

defines three tornado missiles. At the 404' elevation only the 3" diameter, schedule 40 steel pipe, 10-feet long weighing 75.8 lbs. and traveling at 100 mph (147 ft./sec) tornado missile is considered credible. There is no specific analysis of the effect of a missile of this size hitting the 4"schedule 40 EFW steam supply piping; therefore, 2P-7A is considered Operable but Degraded and Nonconforming.

This lack of documentation is not under enforcement discretion; however, is included in TMRE to document its design and licensing basis.

Note 2: The ANO-2 EDG Exhaust Stack structural support system was recently analyzed for the licensing basis tornado missiles using reduced operability wind and missile velocities of 230 mph (versus design base wind loads of 300 mph) and reduced safety factors for steel members and concrete anchors were utilized to demonstrate the ANO-2 EDG Exhaust Stacks are functional. The EDG Exhaust Stacks are classified as Operable but Degraded and Nonconforming due to the evaluation being performed at reduced wind and missile velocities. This condition is not under enforcement discretion; however, it is included in TMRE as a non-conformance.

ANO-2 nonconforming conditions are explicitly modeled in the ANO-2 Internal Events PRA.

Enclosure to 0CAN041904 Page 16 of 47 2.4 Description of the Proposed Change Entergy requests NRC approval to incorporate the TMRE methodology into the ANO-1 and ANO-2 SARs. Entergy proposes to add the TRME methodology to the both units SARs to reflect it as the analysis method used to demonstrate that protection from tornado-generated missiles is acceptable for the defined areas. The proposed change supports the following:

ANO-1 ANO-2 Change SAR Section SAR Section Describe ANOs use of TMRE for SSCs as an NRC accepted method and state that it can only be applied 3.5.4, Barrier to discovered conditions where tornado missile 5.1.5, Wind and Design protection was not provided, and cannot be used to Tornado Loads Procedures avoid providing tornado missile protection in the plant modification process.

Add a new listing of Safety-Related SSCs that do not 3.5.4, Barrier require protection from tornado-generated missiles 5.1.5, Wind and Design based on Tornado Missile Risk Evaluator Methodology Tornado Loads Procedures (TMRE).

The ANO SAR markups are included in Attachment 4 and clean copies included in to this Enclosure.

To assist in the NRCs review of the proposed change, Attachment 2 of this Enclosure addresses each NRC Request for Additional Information (RAI) as requested of each pilot plant.

3.0 TECHNICAL EVALUATION

3.1 Tornado Missile Risk Evaluator Methodology The NRCs policy statement on PRA encourages greater use of the PRA technique to improve safety decision-making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments and technical specification changes under 10 CFR 50.90. TMRE is proposed as a PRA-based methodology for evaluating the risk impact of existing conditions where tornado missile protection is required in a licensees CLB, but the required protection was not provided. For conditions that meet the acceptance criteria, the ANO-1 and ANO-2 licensing bases would be revised.

GDC 2 requires that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions.

GDC 4 requires that SSC important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes. RG 1.117, "Tornado Design Classification," Revision 1, describes a

Enclosure to 0CAN041904 Page 17 of 47 method acceptable to the NRC staff for identifying those SSCs of lightwater-cooled reactors that should be protected from the effects of the Design Basis Tornado, including tornado missiles, and remain functional. TMRE is proposed as an alternative methodology for identifying whether certain SSCs must be protected from the effects of a tornado-generated missile. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The TMRE methodology employs a simplified, conservative assessment of risks to core damage and large early release posed by tornado-generated missiles at nuclear plants. The guidance for use of the methodology is found in NEI 17-02, "Tornado Missile Risk Evaluator Industry Guidance Document" (References 1, 2, and 3). The guidance document provides a detailed approach to gathering the necessary information and translating the information into a PRA model. The risk assessment methods and acceptance criteria of the NRC RG 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

3.2 Traditional Engineering Considerations Two of the five key principles of risk-informed decision making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins.

These two considerations are discussed below with respect to the proposed change to the ANO-1 and ANO-2 licensing bases.

The proposed change is consistent with a defense-in-depth philosophy Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

An evaluation of the seven considerations related to the defense-in-depth considerations contained in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," (Reference 11) is provided below.

The responses are applicable to both ANO-1 and ANO-2 unless otherwise noted.

1. A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

No new accidents or transients are introduced with the proposed change, and the facility remains sufficiently protected from tornado-generated missiles.

The proposed change does not significantly impact the availability and reliability of SSCs that provide safety functions which prevent challenges from progressing to core damage. The magnitude of the change is consistent with the guidance of RG 1.174.

Enclosure to 0CAN041904 Page 18 of 47 None of the nonconforming conditions in the TMRE model only affect the Large Early Release Frequency (LERF), which is an indication that there was no significant impact on prevention of containment failure.

The change does not significantly reduce the effectiveness of the emergency preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

2. Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided.

Implementation of the proposed change does not require compensatory measures.

The risk assessment associated with this amendment request gave no credit to compensatory measures implemented in response to the nonconforming conditions.

No plant operating procedures are being changed to implement the proposed amendment. However, some documents will require revision to remove compensatory measures currently being credited while enforcement discretion is in effect.

The proposed change does not rely upon proceduralized operator actions required to be performed within one hour of a tornado passing.

3. System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

The proposed change does not modify the redundancy, independence, or diversity described in ANO-1 or ANO-2 SAR. The proposed change does not result in a disproportionate increase in risk.

ANO-1 SAR Section 2.3.3.3.4 and ANO-2 SAR Section 2.3.1.3.5 document the frequency of tornados in the vicinity of the plants, which is an infrequent event and which is unaffected by this amendment request.

The proposed change does not impact the assumptions in the ANO accident analyses presented in the unit specific SAR.

The proposed change does not impact the availability or reliability of SSCs that could either initiate or mitigate accidents, with the exception of tornado missile protection, which is thoroughly evaluated in this amendment request.

Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile.

Critical equipment is stored in redundant structures that would prevent the loss of minimal equipment which may be needed to respond to a tornado event.

Conservatively, permanently installed and portable FLEX equipment are not modeled in the PRA.

Enclosure to 0CAN041904 Page 19 of 47

4. Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

ANO-1 In general, the nonconforming conditions are physically distributed about the ANO-1 site minimizing the likelihood of multiple SSCs being impacted. In addition, there is a low likelihood that counterpart equipment (i.e., similar or redundant components) would be impacted.

Nonconforming conduits in the ANO-1 demineralizer area if impacted by a tornado-generated missile could affect both trains of service water (SW).

Assuming all cabling is impacted, the Green train SW pump could be disabled along with one or more SW loop cross-tie valves which are physically located (and protected from tornado events) in the Intake Structure. This could require an Operator to manually manipulate one of the four cross-tie valves locally (at the Intake Structure, which is tornado protected) in order to separate the Red train SW loop from the Green train loop which was lost (depending on which SW pumps were in service at event initiation). The ANO-1 operating staff includes three non-licensed Operators, two licensed Reactor Operators (ROs), two licensed Senior Reactor Operators (SROs), and a Shift Technical Assistant (STA).

One non-license Operator is assumed to be available to align SW suction to any required EFW pump suction. One of the remaining two non-licensed operators would be available, if needed, to manipulate a SW cross-tie valve at the Intake Structure. It is qualitatively estimated that this evolution would take approximately 20-25 minutes, accounting for identification of the need for the action, transit time, and valve manipulation time. Operator cues are supported by low SW pressure indications (assuming only one pump is supplying both loops if the loops are cross-tied). To separate the SW loops from the Control Room, only one valve needs to remain available. While the tornado is the common-cause of the failure, TMRE PRA analysis demonstrates that the SW system will remain functional and the change in risk associated with a potential tornado-generated missile in this area is low. Apart from the potential impact of a tornado-generated missile, the plant design and operation (i.e., activities such as maintenance, testing, inspection, and qualifications) of the SW system are not impacted by the proposed change.

Both trains of EFW may also be impacted by a tornado-generated missile in the ANO-1 demineralizer area. The loss of DC Control Power could prevent capability of motor-driven EFW pump P-7B auto-start or start from the Control Room. In addition, the flow isolation valve (CV-2627) to Steam Generator (SG) "A" from steam-driven EFW pump P-7A could fail open. However, this path can be isolated from the Control Room if necessary using an in-series isolation valve. The TMRE PRA analysis demonstrates that the EFW system will remain functional with minimal change in risk associated with a potential tornado-generated missile.

Because a main steam line or main feedwater line break accident are not assumed coincident with a tornado event, the steam-driven EFW pump and both SGs are assumed to remain available for decay heat removal. The plant design and operation (i.e., activities such as maintenance, testing, inspection, and qualifications) of the EFW system is not impacted by the proposed change.

Enclosure to 0CAN041904 Page 20 of 47 Because both the ANO-1 SW and EFW systems remain functional from a TMRE PRA perspective, sufficient equipment is expected to remain available when considering the cumulative impact of tornado-generated missiles such that no common-cause failure will result in the complete loss of either system.

ANO-2 For ANO-2, the nonconforming conditions are physically distributed about the site minimizing the likelihood of multiple SSCs being impacted. In addition, there is a low likelihood that counterpart equipment (i.e., similar or redundant components) would be impacted. With the aforementioned physical distribution of the nonconforming conditions, sufficient equipment is expected to remain available when considering the cumulative impact of tornado-generated missiles such that no common-cause failure will result in the complete loss of any system.

5. Independence of barriers is not degraded.

Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles in either unit, and the containment building of each unit remains a robust tornado missile barrier.

The proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers and does not introduce a new event.

Although the proposed change does slightly increase the frequency of core damage, that increase is very small and has no significant impact on the fission product barriers.

6. Defenses against human errors are preserved.

ANO has symptom-based abnormal operating procedures and emergency operating procedures that would be utilized in the event of a tornado adversely impacting safety related equipment. The procedures provide guidance to operators for preservation of critical safety functions. The procedures include guidance in the event "response not obtained," which provide alternative actions if equipment was damaged by tornadoes or other reasons.

Implementation of the proposed change does not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado.

Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserve the defense against human errors.

Both ANO units have a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes post-tornado walkdowns for tornado missile vulnerable SSCs. It includes a reference to COPD-038 that describes the potential vulnerabilities to tornado-generated missiles and recovery actions to be considered that reduce the impact of a tornado

Enclosure to 0CAN041904 Page 21 of 47 missile affecting the identified SSCs. Following approval of this amendment request, documents will be revised as necessary as part of implementation of the TMRE methodology.

7. The intent of the plants design criteria is maintained.

This LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain vulnerable to tornado missiles. All other aspects of the plant design criteria are unaffected.

This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety.

The methodology cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the intent of the plants design criteria is maintained.

Identified SSCs would be reasonably assured to avoid damage if physically protected from design basis tornado missiles. In lieu of protection for the identified nonconforming SSCs, ANO-1 and ANO-2 have analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequential effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and is considered negligible.

Therefore, the intent of the plants design criteria is maintained.

The proposed change maintains sufficient safety margins The vast majority of each system important to safety remains protected from tornado missiles, consistent with the CLB. The identified vulnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains both being impacted by tornado missiles is much lower than the likelihood of a one train being impacted. The TMRE methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation. The number of potential missiles identified at ANO is less than the number of missiles assumed by the TMRE methodology. ANO has diverse and flexible coping strategies (FLEX) to restore critical safety functions in the event of a hypothetical loss of the primary functions. In some cases, non-safety related equipment, such as FLEX equipment, could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment.

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved by the NRC) continue to be met in accordance with the CLB of each unit. The proposed change is not in conflict with approved codes and standards relevant to the SSCs.

The safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change. The requirements credited in the accident analyses remain the same.

Therefore, the proposed change maintains sufficient safety margins and continues to protect public health and safety.

Enclosure to 0CAN041904 Page 22 of 47 3.3 Risk Assessment The TMRE methodology is used to estimate the quantitative risk associated with tornado-generated missiles associated with discrepancies with the ANO-1 and ANO-2 CLB related to tornado missile protection. The ANO-1 and ANO-2 internal events PRA models were utilized to estimate the risk associated with the passage of a tornado over ANO-1 and ANO-2.

The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific SSC (target) will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strikes on the CDFs and LERFs.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the number of potential missiles and the size and location of the target SSC being evaluated. The site-specific frequency of a tornado striking ANO-1 and ANO-2 is also used in the TMRE.

The outcome of the probabilistic element is an estimation of an increase in CDF and LERF associated with not protecting certain SSCs from tornado missiles.

3.3.1 High Wind Equipment List The ANO-1 and ANO-2 TMRE high winds equipment list (HWEL), which was created using industry guidance NEI 17-02, is a listing of the SSCs modeled in the internal events PRA model and credited for mitigating a tornado-induced loss of offsite power (LOOP). This list includes equipment associated with passive SSCs not explicitly included in the PRA model but that could impact functionality of equipment that is modeled in the PRA. Screening criteria were applied to the initial list to exclude or include equipment in the HWEL. The final HWEL contains SSCs that will be evaluated as part of the TMRE process. The following considerations were included in the development and update of the HWEL, consistent with the NEI 17-02 methodology:

The TMRE model uses the LOOP sequences with no offsite power recovery. The TMRE model was created from the internal events CDF and LERF PRA model of record for each unit. In each of these models the top gate was removed for accident initiator sequences that cannot be affected by high winds. The initiating events which cannot be affected by a tornado were set to FALSE and include reactor vessel rupture, very large LOCA for ANO-1, large LOCA, medium LOCA, small LOCA, SG tube rupture (SGTR),

reactor coolant pump (RCP) seal LOCA, and inadvertent opening of a safety relief valve for ANO-2.

A basic events (BE) report was created from the TRME model that was developed. Basic events that are not directly related to equipment, such as common cause failures, testing/

maintenance, flags, pre-initiators, and probability events, were removed from the HWEL.

Because SSCs located in Category I structures have the potential to be struck by tornado-generated missiles entering the structure through openings in the exterior, only SSCs that are located below grade (EL. 354-0) in Category I structures are screened

Enclosure to 0CAN041904 Page 23 of 47 out. It is assumed that rooms located below grade in Category I structures do not have penetrations that result in missile vulnerabilities. In addition, all SSCs located within the reactor building are screened from the HWEL. The random failure probabilities for the SSCs that were screened out were retained.

Components that require offsite power which are explicitly modeled in the PRA were screened from the HWEL. Piping and instrumentation drawings were reviewed for each mechanical SSC that was not screened out to locate support system SSCs and those within the system flow path that should be added to the HWEL. While SSCs that are located below the 354-foot elevation and those located in the reactor building are considered protected from tornado missiles, electrical or control cables that support these SSCs that could be affected by tornado-generated missiles are included in the HWEL.

SSCs located outside Class I structures that can be impacted directly by the high wind hazard or wind-borne missiles and may lead to failure of PRA equipment, were retained in the initial HWEL.

Operator actions were assessed based on the NEI 17-02 methodology. Internal events PRA data was used to perform the assessment of operator actions.

Operator interviews for the credited operator actions were performed during the development of the internal events model which the TMRE model is based on. In addition, an SRO was interviewed during TMRE development for insights related to tornado events.

ANO-1 The main insights were that the auxiliary operators would take shelter in safe areas, if possible, in Seismic Class 1 structures, and that operators have multiple paths in the Turbine Building (TB) by which access may be gained to the Auxiliary Building and to areas where ex-control room actions may be required. However, high priority actions at the diesel fuel storage building (DSB) to ensure a fuel supply to the EDGs are required. While there are two pathways to the DSB, the normal access may be damaged or blocked as a result of tornado debris and the secondary access requires support from security to access. Therefore, these actions are assumed to fail following a high wind event.

Access to the Main Steam Isolation Valve area is also limited from either an unprotected building or outdoors. If a gag were needed on a Main Steam Safety Valve, the feasibility of the action, as well as the accessibility of the area, are challenged in the high winds event; therefore, the action is assumed to fail following a high wind event.

Other actions are located in the Auxiliary Building which may be accessed via multiple pathways. Therefore, any impact on the failure probability of long-term operator actions within the Auxiliary Building by the effects of a tornado impacting ANO-1 is negligible.

Enclosure to 0CAN041904 Page 24 of 47 ANO-2 The main insights were that the auxiliary operators would take shelter in safe areas, if possible, in Seismic Class 1 structures, and that operators have multiple paths in the TB by which access may be gained to the Auxiliary Building and to areas where ex-control room actions may be required. In addition, for those areas that may have limited access, sufficient time exists before performance of the task would be needed. Considering the multi-access paths and timing of the needed actions, an operator is able to perform needed tasks with negligible impact.

3.3.2 Target Walkdowns Using the guidance contained in NEI 17-02, the scope of the walkdowns considered the following, as applicable:

Location and identification of the SSC to verify that the SSC is located as documented.

Support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers were also noted.

Barriers that could prevent or limit exposure of the SSC to tornado missiles were documented. This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

Horizontal and/or vertical directions from which tornado-generated missiles could strike the target.

Dimensions of the target SSCs, including any subcomponents or support systems, were verified and documented. Missile paths may limit target areas when missiles are blocked by barriers.

Proximity and potential correlation to other target SSCs were determined. Correlated targets are SSCs that can be struck by the same tornado missile.

Nearby large inventories of potential tornado missiles were noted.

Proximity of non-Class I structures to exposed target SSCs were documented. A non-Class I structure may collapse or tip-over and cause damage to an SSC.

Vent paths for tanks that may be exposed to atmospheric pressure changes were identified.

Because of the large, open nature of the ANO buildings in conjunction with the limited capacity of potential flood sources that could affect non-conforming SSCs, no additional flooding effects not already included in the direct effects of missile impacts would be expected.

The potential for the ANO-2 diesel exhaust stacks to be perforated and impair the ability of running diesels was examined. Given the 30-foot distance between the ANO-2 diesel exhaust and intake along with the vertical distance and buoyancy of the hot exhaust gas, it is considered incredible that failure of one diesel exhaust stack would impact the opposite train diesel intake.

Enclosure to 0CAN041904 Page 25 of 47 3.3.3 Missile Walkdowns The missile walkdown was performed in accordance with Section 3.4 of NEI 17-02. Personnel who performed the tornado missile walkdown were familiar with this section of NEI 17-02 as well as Section 4.3 of EPRI 3002008092, "Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants."

The walkdown area is defined by a 2500 feet radius from the center point between the two reactor buildings. To support the walkdowns the plant was divided into 38 zones. The potential missiles for each zone were determined.

Consistent with the guidance provided in NEI 17-02, Revision 1B, additional outage missiles were not considered as part of the TMRE walkdown. Not explicitly considering outage-related missiles is an acceptable approach as outage durations are short and at multi-unit sites such as ANO, the outages are staggered such that only one unit is in an outage at a time.

Additionally, scaffolding parts/accessories provide the majority of additional missiles during an outage. These scaffolding pieces are normally stored onsite and are already included in the missile count from a different plant area. Other equipment (machinery, trailers, and vehicles) will result in a small percentage increase as compared to the missile count of 240,000 that was used in the TMRE analyses. The total missile count at ANO is 196,498. Since this is bounded by the generic value of 240,000 provided in NEI 17-02, Revision 1, the missile count of 240,000 was conservatively utilized in calculating EEFPs. Any additional outage missiles at ANO which are not already included in the count for another area are expected to be bounded by the generic missile count of 240,000. The missile count is summarized in Table 3.

Table 3 TMRE Tornado Missile Count Summary Total Number of Zonal Missiles Zone (Trees, NonStructural and Structural) 1 199 2 242 3 2,218 4 25,595 5 131 6 208 7 1,693 8 431 9 7,438 10 10,551 11 449 12 3,534 13 7,610

Enclosure to 0CAN041904 Page 26 of 47 Total Number of Zonal Missiles Zone (Trees, NonStructural and Structural) 14 7,242 15 4,606 16 3,243 17 617 18 17,662 19 1,608 20 1,560 21 16,806 22 15,753 23 4,617 24 50 25 856 26 347 27 292 28 489 29 2,531 30 2,416 31 5,927 32 4,262 33 11,201 34 222 35 1,632 36 5,614 37 164 38 23,393 Fencing 3,089 Total Number of Missiles on Site (Trees, NonStructural 196,498 and Structural) 3.3.4 Tornado Hazard Frequency The guidance in NEI 17-02, Revision 1 and NUREG/CR-4461, "Tornado Climatology of the Contiguous United States" (Reference 10), was used to determine the tornado initiating events for ANO. The result was site-specific tornado frequencies for each relevant tornado category.

NUREG/CR-4461 tornado strike data for ANO is provided with wind speeds associated with varying frequencies per year. NUREG/CR-4461 does not provide values for F-scale (Fujita prime); therefore, F probabilities were derived from the site-specific Fujita scale data. The

Enclosure to 0CAN041904 Page 27 of 47 Fujita Scale Data from NUREG/CR-4461 was used as opposed to the Enhanced Fujita Scale data which results in higher and, therefore, more conservative strike frequencies. From this data, a site-specific tornado frequency curve (hazard curve) was developed, and the frequency of tornadoes considered in the TMRE (F2 through F6) was calculated.

The tornado initiating event frequencies were determined using the methodology described in NEI 17-02, Revision 1. The F-scale wind speed estimates for tornados of frequency 1.00E-05/yr, 1.00E-06/yr, and 1.00E-07/yr were determined from a review of NUREG/CR-4461 (Reference 10). A trend line was established and the resulting equation was used to calculate a frequency for tornado wind speeds from 40 mph to 300 mph.

Using the F-scale tornado intensity mph ranges, exceedance frequencies were determined for each tornado intensity F2 through F6. Subsequently, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequency.

The method used and described above is in accordance with the revised guidance in NEI 17-02, Revision 1B, Sections 4.3 through 4.6.

Using the trend line equation, exceedance probabilities for the upper ranges of each F category, F2 through F6, was calculated resulting in the following tornado initiating event frequencies.

Table 4 ANO Plant Specific Initiating Event Frequency Fujita Prime Frequency Per Year F2 6.69-04 F3 1.53E-04 F4 3.58E-05 F5 5.98E-06 F6 2.64E-07 3.3.5 Target Evaluation The failure probability of vulnerable SSCs is calculated using the EEFP methodology documented in NEI 17-02, Revision 1B (Reference 3). In accordance with NEI 17-02, Section 5.0 (Reference 3), for every applicable SSC, five (5) EEFP values will be calculated, one each for tornado categories F2 through F6.

The list of potentially vulnerable targets to tornado missiles that are modeled in the PRA are identified and characterized. These targets have been added to the TMRE model. The failure probability of the targets is calculated using the EEFP. The EEFP is the conditional probability that an exposed target is hit and failed by a tornado missile, given a tornado of a certain magnitude. For a single target, five EEFP values were calculated; one each for tornado categories F2 through F6.

Enclosure to 0CAN041904 Page 28 of 47 The EEFP can be calculated using the following equation:

EEFP = (MIP) x (Number of Missiles) x (Target Exposed Area) x Fragility Where:

Missile Impact Parameters (MIP) is the probability of a tornado missile hit on a target, per target square area, per missile, per tornado. Generic MIP values are provided in Table 5-1 of NEI 17-02 (Reference 3).

Number of Missiles is the number of damaging missiles. The generic values recommended in Table 5-1 and 5-2 of NEI 17-02 (Reference 3) are used.

Target Exposed Area is determined for each specific target.

Fragility is the conditional probability of the target failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0.

The generic missile count of 240,000 was conservatively utilized in estimating EEFPs. Table 5 provides the number of missiles for tornado categories F2 through F`6 based on missile of 240,000 with number of missiles increasing from F2 to F6.

The calculation of the EEFPs results for the non-conforming SSCs is provided in Table 6 (ANO-1) and Table 7 (ANO-2).

Table 5 Number of Missiles for EEFP Calculation (Common to Both Units)

Number of Missiles Tornado Category based on Missile Count of 240,000 F2 155,000 F3 155,000 F4 205,000 F5 240,000 F6 240,000

Enclosure to 0CAN041904 Page 29 of 47 Table 6 ANO-1 Summary of EEFPs Based on Tornado Category (Non-Conforming SSCs)

Area Elev. Robust Robust Missile Intensity EEFP EEFP Target Description MIP (Sq. ft.) >30 Description Missile % Count Scale Base Compliant Fire Damper Openings 100% 155000 F2 5.80E-11 1.06E-02 1.05E-02 1175.21 F2-0141-02-011 100% 155000 F3 2.00E-10 3.64E-02 3.62E-02 (Base)

F2-0135-02-0009 Non-Robust 100% 205000 F4 3.40E-10 8.19E-02 8.15E-02 Y

F2-0135-02-0022 Category J 100% 240000 F5 8.70E-10 2.45E-01 2.44E-01 1168.68 (128-A)

(Compliant) 100% 240000 F6 1.30E-09 3.67E-01 3.65E-01 (CR-ANO-1-2016-2752) 100% 155000 F2 1.40E-10 5.86E-04 0 Conduits and Cable Trays 100% 155000 F3 4.60E-10 1.93E-03 0 Non-Robust (73-A) 27.0 N 100% 205000 F4 7.90E-10 4.37E-03 0 Category J (CR-ANO-1-2017-1171) 100% 240000 F5 2.00E-09 1.30E-02 0 100% 240000 F6 3.10E-09 2.01E-02 0 100% 155000 F2 1.40E-10 1.95E-04 0 Conduits and Cable Trays 100% 155000 F3 4.60E-10 6.42E-04 0 Non-Robust (73-B) 9.0 N 100% 205000 F4 7.90E-10 1.46E-03 0 Category J (CR-ANO-1-2017-1171) 100% 240000 F5 2.00E-09 4.32E-03 0 100% 240000 F6 3.10E-09 6.70E-03 0 100% 155000 F2 1.40E-10 3.34E.04 0 Conduits and Cable Trays 100% 155000 F3 4.60E-10 1.10E-03 0 Non-Robust (73-C) 15.39 N 100% 205000 F4 7.90E-10 2.49E-03 0 Category J (CR-ANO-1-2017-1171) 100% 240000 F5 2.00E-09 7.39E-03 0 100% 240000 F6 3.10E-09 1.15E-02 0 100% 155000 F2 1.40E-10 8.79E-04 0 Conduits and Cable Trays 100% 155000 F3 4.60E-10 2.89E-03 0 Non-Robust (73-D) 40.50 N 100% 205000 F4 7.90E-10 6.56E-03 0 Category J (CR-ANO-1-2017-1171) 100% 240000 F5 2.00E-09 1.94E-02 0 100% 240000 F6 3.10E-09 3.01E-02 0 100% 155000 F2 1.40E-10 6.48E-04 4.72E-04 Blockout 29.87 (Base) 100% 155000 F3 4.60E-10 2.13E-03 1.55E-03 Non-Robust FB-103-4-0008 (104-EL) 21.75 N 100% 205000 F4 7.90E-10 4.84E-03 3.52E-03 Category J (CR-ANO-1-2017-1171) (Compliant) 100% 240000 F5 2.00E-09 1.43E-02 1.04E-02 100% 240000 F6 3.10E-09 2.22E-02 1.62E-02 50% 77500 F2 5.80E-11 3.64E-04 0 EFW Steam Piping 50% 77500 F3 2.00E-10 1.26E-03 0 Robust (170-EFW) 81.03 Y 50% 102500 F4 3.40E-10 2.82E-03 0 Category F (CR-ANO-1-2015-3940) 50% 120000 F5 8.70E-10 8.46E-03 0 50% 120000 F6 1.30E-9 1.26E-02 0 F - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3)) J - Not Robust Failure mode N/A (NEI 17-02, Table B-13 (Reference 3))

Enclosure to 0CAN041904 Page 30 of 47 Table 7 ANO-2 Summary of EEFPs Based on Tornado Category (Non-Conforming SSCs)

Area Elev. Robust Robust Missile Intensity EEFP EEFP Target Description MIP (Sq. ft.) >30 Description Missile % Count Scale Base Compliant 100% 155000 F2 5.80E-11 9.74E-05 0 Conduit EC1373 in Room 100% 155000 F3 2.00E-10 3.36E-04 0 Non-Robust 2136 10.8 Y 100% 205000 F4 3.40E-10 7.55E-04 0 Category J (CR-ANO-2-2017-1555) 100% 240000 F5 8.70E-10 2.26E-03 0 100% 240000 F6 1.30E-09 3.38E-03 0 50% 77500 F2 5.80E-11 1.57E-04 0 Steam Supply to EFW from 50% 77500 F3 2.00E-10 5.41E-04 0 Main Steam Header #1 Robust 34.9 Y 50% 102500 F4 3.40E-10 1.22E-03 0 (2155-EFW-1) Category F 50% 120000 F5 8.70E-10 3.65E-03 0 (CR-ANO-2-2015-4851) 50% 120000 F6 1.30E-09 5.45E-03 0 50% 77500 F2 5.80E-11 2.50E-04 0 Steam Supply to EFW from 50% 77500 F3 2.00E-10 8.64E-04 0 Main Steam Header #1 Robust 55.7 Y 50% 102500 F4 3.40E-10 1.94E-03 0 (2155-EFW-2) Category F 50% 120000 F5 8.70E-10 5.82E-03 0 (CR-ANO-2-2015-4851) 50% 120000 F6 1.30E-09 8.69E-03 0 50% 77500 F2 5.80E-11 1.21E-04 0 Common EFW Steam Supply 50% 77500 F3 2.00E-10 4.18E-04 0 Piping Robust 27.0 Y 50% 102500 F4 3.40E-10 9.39E-04 0 (2155-EFW-3) Category F 50% 120000 F5 8.70E-10 2.81E-03 0 (CR-ANO-2-2015-4851) 50% 120000 F6 1.30E-09 4.20E-03 0 35% 54250 F2 5.80E-11 7.69E-04 0 2K-4A Exhaust Stack 35% 54250 F3 2.00E-10 2.65E-03 0 Robust (2K-4A Exhaust) 244.46 Y 35% 71750 F4 3.40E-10 5.96E-03 0 Category E (CR-ANO-C-2018-02230) 35% 84000 F5 8.70E-10 1.79E-02 0 35% 84000 F6 1.30E-09 2.67E-02 0 35% 54250 F2 5.80E-11 7.69E-04 0 2K-4B Exhaust Stack 35% 54250 F3 2.00E-10 2.65E-03 0 Robust (2K-4B Exhaust) 244.46 Y 35% 71750 F4 3.40E-10 5.96E-03 0 Category E (CR-ANO-C-2018-02230) 35% 84000 F5 8.70E-10 1.79E-02 0 35% 84000 F6 1.30E-09 2.67E-02 0 E - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3))

F - Penetration or Global Failure mode (NEI 17-02, Table B-13 (Reference 3))

J - Not Robust Failure mode N/A (NEI 17-02, Table B-13 (Reference 3))

Enclosure to 0CAN041904 Page 31 of 47 3.3.6 Model Development The TMRE model was developed using the current unit specific internal events models. The method described below was used for model development for both ANO-1 and ANO-2.

The first step in developing a TMRE model is the establishment of the accident sequence logic that is reasonably expected to represent the tornado initiating events in the TMRE PRA. Since one of the basic assumptions of the TMRE method is that a tornado event that creates tornado missiles will, at a minimum, cause a LOOP and reactor trip, the transient event sequence logic initiated by a LOOP event (%TSW (ANO-1) / %T3 (ANO-2)) is considered the most representative logic for TMRE. The remaining initiating events were reviewed to confirm that a tornado could not cause the initiating event or the impact of the initiating event is represented in the %T3SW / %T3 initiated transient sequence logic. It was determined that the LOOP accident sequence adequately represents the plant response to the tornado.

The second step in developing the TMRE model was eliminating the unnecessary logic associated with the non-representative initiating events. The fault trees developed include only one initiator, Loss of Offsite Power (%T3SW / %T3).

Post initiator human failure events (HFEs) (i.e., operator actions) were screened based on NEI 17-02 guidance as the third step in the TMRE model development process. As described in the unit specific Human Reliability Analysis (HRA) for the TMRE PRA Model, HFEs performed in non-Category 1 structures and within one hour of the tornado strike are assumed to be failed (TRUE).

Step four in TMRE model development included the addition of failures of SSCs that can be struck and damaged by a tornado missile as new BEs in the TRME PRA fault tree. This was performed using the FRANX software to associate the BEs affected to the failure of the equipment in each correlation group within each room or area.

For each potentially vulnerable SSC identified in the EEFP, a BE for each of the tornado-induced failures identified was added to the fault tree logic using the FRANX software. The tornado-induced failure events were added under an OR gate along with the existing basic event representing random failure of the SSC.

3.3.7 Model Quantification Results The TMRE model was quantified with tornado hazard frequencies identified in Table 4. The CDF is truncated at 1E-12/yr for ANO-1 and 1E-11 for ANO-2 and the LERF is truncated at 1E-11/yr for ANO-1 and 1E-13 for ANO-2.

The CDF and LERF for the degraded and compliant cases are in Table 8 (ANO-1) and Table 9 (ANO-2).

Table 8 ANO-1 Quantification Results CDF / year LERF / year Degraded 9.78E-06 2.46E-06 Compliant 9.19E-06 2.41E-06 Delta 5.9E-07 5.1E-08

Enclosure to 0CAN041904 Page 32 of 47 Table 9 ANO-2 Quantification Results CDF / year LERF / year Degraded 1.12E-05 6.24E-07 Compliant 1.11E-05 6.18E-07 Delta 1.0E-07 6.0E-09 Per RG 1.174 (Reference 11), a risk-informed amendment request includes an evaluation of the change in risk (e.g., CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations: The Compliant Case (configuration with the plant built per the required design/licensing bases) and the Degraded Case (current plant configuration, including potential non-conformances for tornado missile protection).

The CDF and LERF are simply calculated as follows:

CDF = CDFDegraded - CDFCompliant LERF = LERFDegraded - LERFCompliant The TMRE results for ANO-1 are 5.9E-07 per year CDF and 5.1E-08 per year LERF.

The TMRE results for ANO-2 are 1.0E-07 per year CDF and 6.0E-9 per year LERF.

3.3.8 Tornado Intensity Contribution The ANO-1 tornado initiating event contribution is provided in Table 10 for the degraded and compliant model result.

Table 10 ANO-1 Tornado Initiating Event CDF and LERF Contribution CDF  % CDF CDF  % CDF Initiating Contribution Contribution Contribution Contribution Initiator Event Description Compliant Degraded

%A1-T-F2 4.20E-06 45.65% 4.38E-06 44.79% F2 tornado

%A1-T-F3 2.51E-06 27.28% 2.68E-06 27.41% F3 tornado

%A1-T-F4 1.39E-06 15.11% 1.50E-06 15.34% F4 tornado

%A1-T-F5 1.02E-06 11.09% 1.13E-06 11.56% F5 tornado

%A1-T-F6 7.96E-08 0.87% 8.88E-08 0.91% F6 tornado

Enclosure to 0CAN041904 Page 33 of 47 LERF  % LERF LERF  % LERF Initiating Contribution Contribution Contribution Contribution Initiator Event Description Compliant Degraded

%A1-T-F2 9.54E-07 39.56% 9.62E-07 39.07% F2 tornado

%A1-T-F3 7.28E-07 30.19% 7.39E-07 30.01% F3 tornado

%A1-T-F4 4.16E-07 17.25% 4.27E-07 17.34% F4 tornado

%A1-T-F5 2.89E-07 11.99% 3.08E-07 12.51% F5 tornado

%A1-T-F6 2.43E-08 1.01% 2.62E-08 1.06% F6 tornado The ANO-2 tornado initiating event contribution is provided in Table 11 for the degraded and compliant model result.

Table 11 ANO-2 Initiating Event CDF and LERF Contribution CDF  % CDF CDF  % CDF Frequency Contribution Frequency Contribution Initiator Initiating Event Description Compliant Degraded

%A2-T-F2 6.82E-06 61.69% 6.90E-06 61.48% F2 tornado

%A2-T-F3 3.21E-06 29.03% 3.27E-06 29.14% F3 tornado

%A2-T-F4 1.63E-07 1.47% 1.66E-07 1.48% F4 tornado

%A2-T-F5 8.10E-07 7.33% 8.32E-07 7.41% F5 tornado

%A2-T-F6 5.27E-08 0.48% 5.43E-08 0.48% F6 tornado LERF  % LERF LERF  % LERF Frequency Contribution Frequency Contribution Initiator Initiating Event Description Compliant Degraded

%A2-T-F2 3.38E-07 54.67% 3.40E-07 54.44% F2 Tornado

%A2-T-F3 1.99E-07 32.19% 2.02E-07 32.35% F3 Tornado

%A2-T-F4 1.13E-08 1.83% 1.14E-08 1.83% F4 Tornado

%A2-T-F5 6.54E-08 10.58% 6.65E-08 10.65% F5 Tornado

%A2-T-F6 4.51E-09 0.73% 4.59E-09 0.73% F6 Tornado 3.3.9 Sensitivities ANO-1 Section 7 of NEI 17-02 identifies two generic sensitivity studies that should be performed and documented. The first is relevant if the CDF or LERF between the compliant and the degraded case exceed 1.0E-7/yr or 1.0E-8/yr, respectively. As indicated above, the risk increase associated with not providing missile protection to preclude damage to non-conforming SSCs is 5.9E-07/yr CDF and 5.1E-08/yr LERF, which meets this criterion. Therefore, the TMRE Missile Distribution Sensitivity identified in Section 7.2.1 of NEI 17-02, Revision 1B, was

Enclosure to 0CAN041904 Page 34 of 47 performed. In addition, the sensitivity for compliant case conservatism described in NEI 17-02, Revision 1B, Section 7.2.2, was performed. Three additional sensitivities were performed as described below.

ANO-1 TMRE Missile Distribution Sensitivity This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to the missile distribution at the licensees site, as compared to the missile distribution for the EPRI NP-768 Plant A simulations.

As described in Section 7.2.1 of NEI 17-02, this sensitivity analysis only applies to tornado missile BEs for tornado categories F4, F5, and F6. BEs for F2 and F3 tornado missile failures are not considered in this sensitivity. The sensitivity was performed by first identifying the SSCs with a tornado missile failure BE risk achievement worth (RAW) > 2 for tornado categories F4, F5, and F6. In order to determine the target BE RAWs, the F4, F5, and F6 RAWs are combined using the following equation:

RAWTotal = 1 + (RAWF4 - 1) + (RAWF5 - 1) + (RAWF6 - 1)

As described in Section 7.2.1 of NEI 17-02, the MIP sensitivity is performed for highly exposed SSCs with tornado missile failure BE RAWs > 2. Highly exposed SSCs are defined as:

- Located outside of a Category I structure

- Not protected from horizontal missiles

- Having an elevation less than 30 above grade Also as described in Section 7.2.1 of the NEI 17-02, a greater multiplier may be required for highly exposed SSCs. The missile distribution for highly exposed SSCs was determined as part of additional walkdowns and the multipliers are determined. The MIP multipliers and calculated EEFPs for the highly exposed SSCs are included in the EEFP report.

The BE failure probabilities for events with RAW greater than two were multiplied by 2.75.

A missile distribution sensitivity is performed for highly exposed SSCs. Based on the missile inventory walkdown report, the number of missiles near the highly exposed SSCs are counted.

A multiplier is applied to the MIP values for those highly exposed SSCs depending on the number of missiles near the SSC. The BE failure probabilities for highly exposed SSCs are taken from the EEFP report. CDF and LERF were recalculated. The sensitivity results are presented below. The sensitivity shows that the CDF and LERF would be approximately 70%

and 90% higher, respectively, if a uniform missile distribution had been used, rather than the zonal distribution recommended in NEI 17-02 and used in the base analysis. Also, the CDF would be approximately 124% higher, and the LERF would be approximately 430% higher.

ANO-1 TMRE Missile Distribution Sensitivity Results CDF (/yr) LERF (/yr)

Degraded 1.56E-05 4.52E-06 Compliant 1.69E-05 4.79E-06 Delta 1.30E-06 2.70E-07

Enclosure to 0CAN041904 Page 35 of 47 Although the results of these sensitivity cases are slightly above the Region III guidelines of RG 1.174, the increase is dominated by conservative assumptions in the modeling. Specifically, for vulnerabilities affected by the sensitivity, it is assumed that a single missile could fail all SSCs in an impacted area. That assumption was made to simplify evaluation of cable routing which would be very labor intensive. It is expected that a detailed evaluation of the cable routing would allow fewer correlated failures and, as a result, a lower risk increase. These results would be similar to the single event cutset sensitivity discussed below.

ANO-1 Compliant Case Sensitivity The second sensitivity recommended by NEI 17-02 is the compliant case sensitivity. This sensitivity evaluates the impact of conservative assumptions in the compliant case that could impact the results. Specifically, this sensitivity is added to ensure that conservatisms in the compliant case do not mask changes in risk for non-conformances.

As described in Section 7.2.2 of NEI 17-02, the top 90% cutsets of the compliant case are reviewed for potential conservatisms. All TMRE BEs that are in the top 90% are identified as potentially over conservative due to the inherent conservatism built into the NEI 17-02 process as well as simplifying assumptions made as part of EEFP calculations. To evaluate the impact of the compliant case conservatism, the compliant TMRE BEs are removed from both the degraded and compliant case, and the CDF and LERF are recalculated. This is done by modifying the recovery rule file, which sets these compliant TMRE BEs to false. The sensitivity shows that the CDF would be 38% lower if all compliant vulnerabilities were removed from the TMRE model. Also, the LERF would be 79% lower if all compliant vulnerabilities were removed. The CDF and LERF are within the acceptance criteria in this sensitivity.

ANO-1 Compliant Case Sensitivity Results CDF (/yr) LERF (/yr)

Degraded 2.47E-06 8.70E-08 Compliant 2.11E-06 7.64E-08 Delta 3.6E-07 1.1E-08 ANO-1 Plant Grade Sensitivity In order to evaluate the uncertainty in the missile impact parameter between near ground and elevated targets, an additional sensitivity is performed using the near grade MIP value for all vulnerable targets. The EEFPs for this sensitivity are calculated in the EEFP report.

The sensitivity shows that the CDF and LERF would be approximately 60% higher, if all targets had been considered near ground, rather than elevated, as used in the base analysis. Also, the CDF would be approximately 55% higher, and the LERF would be approximately 195%

higher. Despite the increase, the CDF and LERF are still well within the acceptance criteria in this sensitivity.

Enclosure to 0CAN041904 Page 36 of 47 ANO-1 Plant Grade Sensitivity Results CDF (/yr) LERF (/yr)

Degraded 1.55E-05 3.94E-06 Compliant 1.46E-05 3.79E-06 Delta 9.0E-07 1.5E-07 ANO-1 Single Event Cutset Sensitivity The base CDF cutset results contain several single order cutsets (i.e. initiating event and one BE). The most important of the events include tornado failures for the Room 129 (Control Room), Room 98 (Corridor) and Room 97 (Cable Spreading Room). This sensitivity evaluates the uncertainty that a single missile strike may not damage enough equipment in those rooms to result in core damage.

This sensitivity assumes implementation of a modification that will ensure availability of a protected train when missiles fail equipment in rooms 129, 98, and 97. The sensitivity was performed by adding a BE representing a modification for each room to cutsets containing the rooms tornado failures (failure probability = 0.1). The sensitivity shows that the CDF would be approximately 40% lower and the LERF would be approximately 90% lower if the plant was modified to ensure availability of a protected train when missiles fail equipment in rooms 129, 98, and 97. Also, the CDF results are approximately 4% higher and LERF is approximately 19% lower.

ANO-1Single Event Cutset Sensitivity Results CDF (/yr) LERF (/yr)

Degraded 6.03E-06 7.33E-07 Compliant 5.43E-06 7.74E-07 Delta 6E-07 4.1E-08 ANO-1 HFE Sensitivity This sensitivity evaluates the potential impact of operator actions that occur more than one hour after the tornado and require transit outside Category 1 structures. All HFEs except (EDG-HFC-FO-DG1FO, EDG-HFC-FO-DG2FO, EDG-HFC-FO-DGFO2, EDG-HFC-FO-FOASX, and PCS-HFC-FO-MSGAG) were removed from the base model. A sensitivity is performed assuming that these long-term (greater than one-hour) events also fail. The HFEs were removed from the fault tree model using the flag file, A1 TMRE HRA Flags.caf, from the TMRE HRA report.

These longer-term actions (greater than one hour) human error probabilities were not impacted by the tornado event; CDF and LERF were the same as the base scenario.

Enclosure to 0CAN041904 Page 37 of 47 ANO-2 NEI 17-02 identifies two generic sensitivity studies that should be performed and documented.

The first is relevant if the CDF or LERF between the compliant and the degraded case exceed 1.0E-7/yr or 1.0E-8/yr, respectively. As indicated in the results above the CDF is equal to the criteria, so the sensitivities are performed for ANO-2. Two additional sensitivities were performed as described below.

ANO-2 TMRE Missile Distribution Sensitivity This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to the missile distribution at the licensees site, as compared to the missile distribution for the EPRI NP-768 Plant A simulations.

As described in Section 7 of NEI 17-02, this sensitivity analysis only applies to tornado missile BEs for tornado categories F4, F5, and F6. BEs for F2 and F3 tornado missile failures are not considered in this sensitivity. The sensitivity was performed by first identifying the SSCs with a tornado missile failure BE RAW > 2 for tornado categories F4, F5, and F6. In order to determine the target BE RAWs, the F4, F5, and F6 RAWs are combined using the following equation:

RAWTotal = 1 + (RAWF4 - 1) + (RAWF5 - 1) + (RAWF6 - 1)

As described in Section 7.2.1 of the NEI 17-02, a greater multiplier may be required for highly exposed SSCs. The missile distribution for highly exposed SSCs was determined as part of additional walkdowns, summarized in the Missile Inventory Report, and the multipliers are determined. The MIP multipliers and calculated EEFPs for the highly exposed SSCs are shown in the EEFP report.

The BE failure probabilities for BEs with RAWs greater than two were multiplied by 2.75. The BE failure probabilities for highly exposed SSCs are taken from the EEFP report. CDF and LERF were recalculated. The sensitivity results are presented below.

ANO-2 Results for TMRE Missile Distribution Sensitivity CDF (/yr) LERF (/yr)

Degraded 1.27E-05 7.70E-07 Compliant 1.25E-05 7.59E-07 Delta 2.0E-07 1.1E-08 ANO-2 Compliant Case Sensitivity The second sensitivity recommended by NEI 17-02 is the compliant case sensitivity. This sensitivity evaluates the impact of conservative assumptions in the compliant case that could impact the results. Specifically, this sensitivity is added to ensure that conservatisms in the compliant case do not mask changes in risk for non-conformances.

Enclosure to 0CAN041904 Page 38 of 47 As described in Section 7.2.2 of NEI 17-02, the top 90% cutsets of the compliant case are reviewed for potential conservatisms. All TMRE BEs that are in the top 90% are identified as potentially over conservative due to the inherent conservatism built into the NEI 17-02 process as well as simplifying assumptions made as part of EEFP calculations. In order to evaluate the impact of the compliant case conservatism, the BEs representing failures of components that are compliant with missile protection are removed from both the degraded and compliant case, and the CDF and LERF are recalculated. This is done by modifying the recovery rule file, which sets these compliant TMRE BEs to false.

The sensitivity shows that the CDF would be 60% higher if all compliant vulnerabilities were removed from the TMRE model. Also, the LERF would be 17% lower if all compliant vulnerabilities were removed. The CDF and LERF are within the acceptance criteria in this sensitivity.

ANO-2 Results for Compliant Case Conservatism Sensitivity CDF (/yr) LERF (/yr)

Degraded 4.89E-06 1.49E-07 Compliant 4.73E-06 1.44E-07 Delta 1.6E-07 5.0E-09 ANO-2 Plant Grade Sensitivity In order to evaluate the uncertainty in the missile impact parameter between near ground and elevated targets, an additional sensitivity is performed using the near grade MIP value for all vulnerable targets. The EEFPs for this sensitivity are calculated in the EEFP report. The sensitivity is performed by replacing the EEFP values for each tornado missile BE with the values provided in the EEFP report.

The sensitivity shows that the CDF and LERF would be approximately 20% and 30% higher, respectively if all targets had been considered near ground, rather than elevated, as used in the base analysis. Also, the CDF would be approximately 300% higher, and the LERF would be approximately 1000% higher. Regardless, the CDF and LERF remain well within the acceptance criteria in this sensitivity.

ANO-2 Results for Plant Grade Sensitivity CDF (/yr) LERF (/yr)

Degraded 1.34E-05 8.10E-07 Compliant 1.30E-05 7.49E-07 Delta 4.0E-07 6.1E-08

Enclosure to 0CAN041904 Page 39 of 47 ANO-2 Single Event Cutset Sensitivity The base Level 1 cutset results contain several single order cutsets (i.e., initiating event and one BE). The most important of the events include tornado failures for the Cable Spreading Room on El. 372 (Room 2098), the Health Physics Corridor (Room 2122), U2 Control Room (Room 2118), and the part of Electrical Raceway Room 2104 above El. 376-10. This sensitivity evaluates the uncertainty that a single missile strike may not damage enough equipment in those rooms to result in core damage.

The sensitivity CDF frequencies are approximately 40% lower than the base results and the CDF is approximately 70% higher than the base. The sensitivity LERF results are approximately 55% lower than the base results and the LERF is identical to the base case.

ANO-2 Single Order Cutset Sensitivity Results CDF (/yr) LERF (/yr)

Compliant 6.58E-06 2.74E-07 Degraded 6.75E-06 2.80E-07 Delta 1.7E-07 6.0E-09 ANO-2 HFE Sensitivity This sensitivity was not performed for ANO-2 because ANO-2 did not credit any operator actions outside of Category I buildings that occur more than one hour after the tornado.

3.3.10 Conclusions The TMRE guidance provided in NEI 17-02 was followed without exception and no deviations were applied.

The total change in risk associated with tornado missile damage to ANO-1 non-conforming conditions identified in Section 3.3.7, Model Quantification Results, is a risk increase of 5.9E-07 per year CDF and 5.1E-08 per year LERF. The tornado risk change for accepting ANO-1 non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

The total change in risk associated with tornado missile damage to ANO-2 non-conforming conditions identified in Section 3.3.7, Model Quantification Results, is a risk increase of 1.0E-07 per year CDF and 6.0E-09 per year LERF. The tornado risk change for accepting ANO-2 non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

3.4 Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at ANO for certain SSCs that are not fully protected from the effects of tornado missiles. The proposed change would revise the ANO-1 and ANO-2 SARs to make TMRE part of the unit specific licensing basis for conformance to 10 CFR 50, GDC 2 and 4. Future discovery of existing tornado missile

Enclosure to 0CAN041904 Page 40 of 47 protection non-conforming conditions will continue to be evaluated using the corrective action program. The TMRE methodology could be used to resolve those non-conforming conditions by revising the CLB under 10 CFR 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met. Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE methodology. The TMRE guidance, provided in NEI 17-02, Revision 1B, was followed without exception and no deviations were applied.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria The NRC requires that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated missiles, so as not to adversely impact the health and safety of the public in accordance with the requirements of 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, "Design Bases for Protection against Natural Phenomena," and GDC 4, "Environmental and Dynamic Effects Design Bases."

In addition to the above, methods acceptable to the NRC to comply with the aforementioned regulations are described in Regulatory Guides (RG) 1.117, Tornado Design Classification, Revision 1, and NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP), Section 3.5.1.4, "Missiles Generated by Natural Phenomena," and Section 3.5.2, "Structures, Systems, and Components to be Protected from Externally- Generated Missiles," Revision 2, July 1981.

SRP Sections 3.5.1.4 and 3.5.2, contain the current acceptance criteria governing tornado missile protection. These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to RG 1.117, lists the types of SSCs that should be protected from design basis tornadoes. In addition to the physical design methods, SRP Section 3.5.1.4 permits the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.

To use this probabilistic criterion, the Nuclear Energy Institute (NEI) developed the Tornado Missile Risk Evaluator (TMRE) methodology, NEI 17-02, Revision 1, which was transmitted to the NRC staff in September 2017 (Reference 1). As part of the NRCs review of pilot plant applications using the TMRE methodology, Revisions 1A and 1B were submitted to the NRC (References 2 and 3). NEI 17-02 contains guidance for application of the methodology and the technical basis for its acceptability. This LAR requests NRC approval for use of the TMRE methodology in lieu of the deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of SRP Section 3.5.1.4.

This LAR utilizes a risk-informed change process consistent with the guidelines of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk Informed Decision on Plant-Specific Changes to the Licensing Basis." As discussed in RG 1.174, in implementing risk-informed decision-making, licensing basis changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering

Enclosure to 0CAN041904 Page 41 of 47 decisions (e.g., defense-in-depth). While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

The proposed change continues to meet the intent of 10 CFR 50, Appendix A, GDC 2 and 4.

Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) were not licensed to the 10 CFR 50, Appendix A, GDC and were licensed prior to the issuance of RG 1.117.

Both units were originally designed to comply with the 70 "Proposed General Design Criteria for Nuclear Power Plant Construction Permits," published in July 1967.

However, the ANO-1 and ANO-2 Safety Analysis Reports (SARs) provide a comparison with the Atomic Energy Commission (AEC) GDC published as Appendix A to 10 CFR 50 in 1971.

The licensing basis for Criterion 2 described in ANO-1 SAR, Section 1.4.2, states, in part:

Systems and components identified in Criterion I have been designed to performance standards that will enable the facility to withstand, without loss of capability to protect the public, the forces or effects that might be imposed by natural phenomena.

Additionally, combinations of severe loadings have been considered. The designs are based upon the most severe natural phenomena recorded for the site, with an appropriate safety margin to account for uncertainties in the historical data, or upon the most severe conditions that are susceptible to synthetic analyses.

ANO-1 meets the intent of draft GDC 4, "Environmental and Missile Design Basis," for tornado-generated missiles though structural design and physical location of components, which includes redundant train separation (reference SAR Section 1.4.4).

ANO-1 SAR Sections 2.3, 5.1, and 5.2 contain detailed information related to wind and tornado design characteristics.

The licensing basis for Criterion 2, described in ANO-2 SAR Section 3.1.1, states, in part:

Design bases for other natural phenomena are established in Sections 2.3, Meteorology; 2.4, Hydrologic Engineering; 3.3, Wind and Tornado Loadings; 3.4, Water Level (Flood) Design; and parts of 3.5, Missile Protection. The application and combination of these bases with accident related plant process conditions are discussed in Chapter 15. Each system description evaluates functional performance under the appropriate natural phenomena conditions.

ANO-2 meets the intent of GDC 4 through conservative design methods, segregated routing of piping, missile shield walls, and engineered hangers and pipe restraints, all of which are used to accommodate dynamic effects of postulated accidents. These same features as well as the strength of the auxiliary building, containment and intake structure protect the safety-related equipment from missiles which might be generated either within or outside the plant (reference SAR Section 3.1.1).

Enclosure to 0CAN041904 Page 42 of 47 ANO-2 SAR Sections 3.3 and 3.3.2 contain detailed information related to wind and tornado design characteristics.

The SSCs important to safety are designed either to withstand the effects of natural phenomena without loss of the capability to perform their safety functions, or are designed such that their response or failure will be in a safe condition. Those SSCs vital to the shutdown capability of the reactor are designed to withstand the maximum probable natural phenomena at the site, determined from recorded data for the site vicinity, with appropriate margin to account for uncertainties in historical data.

Appropriate combinations of structural loadings from normal, accident, and natural phenomena are considered in the plant design.

No exemptions are requested or required to implement this amendment request upon approval by the NRC. SRP Section 3.5.1.4 permits relaxation of deterministic criteria if it can be demonstrated that the frequency of damage to unprotected safety-related features is sufficiently small. RG 1.174 establishes criteria, approved by the NRC, to quantify the "sufficiently small" frequency of damage. Application of the TMRE methodology to the unprotected features at ANO-1 and ANO-2 demonstrates that the RG 1.174 criteria are met.

2. The proposed change is consistent with a defense-in-depth philosophy.

This is discussed in Section 3.2 of this enclosure.

3. The proposed change maintains sufficient safety margins.

This is discussed in Section 3.2 of this enclosure.

4. When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

The NRCs policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

RG 1.174 provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments under 10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit. RG1.174 describes an acceptable method for the licensee and NRC staff to use in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

RG 1.174 also makes use of the NRCs Safety Goal Policy Statement. One key principle in risk-informed regulation is that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement.

The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of RG 1.174 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Enclosure to 0CAN041904 Page 43 of 47 Application of the TMRE methodology to the unprotected features at ANO demonstrates that the RG 1.174, Section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

NEI 17-02, Section 8, describes post license amendment configuration change control.

Entergy Operations, Inc. (Entergy) Design Control programs that meet 10 CFR 50 Appendix B will ensure that subsequent configuration changes are evaluated for their impact on the TMRE risk basis for accepting identified nonconforming conditions.

Entergy has confirmed that sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program. Temporary additional missiles from construction activities have been addressed in the TMRE analysis. Permanent changes that increase the site missile burden within the 2500 feet missile radius established for TMRE shall be included in the TMRE analysis.

The process includes provisions for monitoring issues affecting the PRA model (e.g.,

due to changes in the plant, errors, or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files. The process also includes re-evaluating the tornado-missile risk of nonconforming SSCs previously calculated to ensure the continued validity of the results.

The risk evaluation supporting this change was performed using the ANO unit specific Internal Events model. RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or in the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decision-making for light-water reactors. Calculations ENTGANO169-RPT-012, "ANO-1 PRA Model Development and Quantification," and ENTGANO169-RPT-013, "Unit 2 PRA Model Development and Quantification," provide documentation that the PRA evaluation is of sufficient quality to support the proposed change (see Attachments 1 and 2 to this Enclosure).

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met.

4.2 Precedent This amendment request is based on the NRC-approved LAR for Vogtle Electric Generating Plant, Units 1 and 2 dated January 11, 2019 (ML18304A394), and LARs submitted by Shearon Harris Nuclear Power Plant, Unit 1 dated October 19, 2017 (ML17292B648), and by Grand Gulf Nuclear Station, Unit 1 dated November 3, 2017 (ML17307A440). These three plants were chosen as Pilot plants to facilitate NRC review of the application of the TMRE methodology.

Enclosure to 0CAN041904 Page 44 of 47 4.3 No Significant Hazards Consideration Analysis Entergy Operations, Inc. (Entergy) has evaluated the proposed changes to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration.

Entergy proposes a change to the Arkansas Nuclear One, Unit 1 (ANO-1) and Unit 2 (ANO-2) unit-specific Safety Analysis Reports (SARs). The change would permit the use of the Tornado Missile Risk Evaluator (TMRE) methodology to demonstrate that identified nonconforming structures, systems and components in each unit do not require protection from tornado-generated missiles.

Basis for no significant hazards consideration determination: As required by 10 CFR 50.91(a),

Entergy analysis of the issue of no significant hazards consideration is presented below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming structures, systems, and components (SSCs) on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment does not involve an increase in the probability of an accident previously evaluated. The relevant accident previously evaluated is a Design Basis tornado impacting the ANO site. The probability of a Design Basis tornado is driven by external factors and is not affected by the proposed amendment. There are no changes required to any of the previously evaluated accidents in the SAR.

The proposed amendment does not involve a significant increase in the consequences of a Design Basis tornado. TMRE is a risk-informed methodology for determining whether certain safety-related features that are currently not protected from tornado-generated missiles require such protection. The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis."

The TMRE calculations performed by Entergy meet the acceptance criteria of RG 1.174.

Therefore, this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Enclosure to 0CAN041904 Page 45 of 47

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming SSCs on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The proposed amendment involves no physical changes to the existing plants; therefore, no new malfunctions could create the possibility of a new or different kind of accident. The proposed amendment makes no changes to conditions external to the plants that could create the possibility of a new or different kind of accident. The proposed change does not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The existing unit-specific SAR accident analyses will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, this change does not create the possibility of a new or different kind of accident from an accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No The proposed amendment is to revise the ANO-1 and ANO-2 unit-specific SARs by reflecting the results of the TMRE analysis, which demonstrated that tornado-generated missile protection is not required for identified nonconforming SSCs on each unit. TMRE is an alternative methodology which can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

The change does not exceed or alter any controlling numerical value for a parameter established in the ANO-1 or ANO-2 SAR or elsewhere in the ANO unit-specific licensing basis related to design basis or safety limits. The change does not impact any unit specific accident analyses, and those analyses remain valid. The change does not reduce diversity or redundancy as required by regulation or credited in the unit-specific SAR. The change does not reduce defense-in-depth as described in the unit-specific SAR.

Therefore, this change does not involve a significant reduction in a margin of safety.

Based upon the reasoning presented above, Entergy concludes that the requested change involves no significant hazards consideration, as set forth in 10 CFR 50.92(c), Issuance of Amendment.

Enclosure to 0CAN041904 Page 46 of 47 4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR Part 20, and would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

6.0 REFERENCES

1. NEI Technical Report 17-02, [Rev. 1], dated September 2017 (ML17268A033 and ML17268A036).

2. NEI Technical Report 17-02 [Rev. 1A] (ML18207A876) included in Vogtle Electric Generating Plant - Unit 1 and 2 Tornado Missile Risk Evaluator SNC Response to NRC Request for Additional Information, dated July 26, 2018.

3. NEI Technical Report 17-02 [Rev. 1B] (ML18262A328) included in Shearon Harris Nuclear Power Plant, Unit 1 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement and Request for Additional Information Response, dated September 19, 2018.

4. NRC Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015 (ML15020A419).

5. NRC memorandum, "Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," dated June 10, 2015 (ML15111A269).

6. NRC memorandum, "Enforcement Guidance Memorandum 15-002, Revision 1:

Enforcement Discretion for Tornado-Generated Missile Protection Non-Compliance,"

dated February 7, 2017 (ML16355A286).

7. Entergy letter to the NRC dated March 19. 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance memorandum 15-002 for Tornado-Generate Missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CAN031802) (ML18078B016).

Enclosure to 0CAN041904 Page 47 of 47

8. NRC letter to Arkansas Nuclear One dated April 12, 2018, "Request to Extend Enforcement Discretion Provided in Enforcement Guidance Memorandum 15-002 for Tornado-Generated missile Protection Non-Conformances Identified in Response to Regulatory Issue Summary 2015-06, 'Tornado Missile Protection'" (0CNA041801)

(ML18094A739).

9. NRC Interim Staff Guidance DSS-ISG-2016-01, Revision 1, "Clarification of Licensee Actions in Receipt of Enforcement Discretion Per Enforcement Guidance Memorandum EGM 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance,'" dated November 2017 (ML17128A344).

10. NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2, US Nuclear Regulatory Commission, February 2007.

11. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant Specific Changes to the Licensing Basis," Revision 3, January 2018 ATTACHMENTS

1. Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

2. Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

3. ANOs Review of Pilot Plant RAIs

4. Safety Analysis Report Page Markups

5. Retyped Safety Analysis Report Pages

Enclosure Attachment 1 to 0CAN041904 Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-1

Enclosure Attachment 1 to 0CAN041904 Page 1 of 34 ANO-1 Technical Adequacy

1. Overview The purpose of this attachment is to document the technical adequacy of the Arkansas Nuclear One, Unit 1 (ANO-1) Probabilistic Risk Assessment (PRA) model to support use of the Tornado Missile Risk Evaluator (TMRE) for evaluation of tornado missiles. The attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for the Arkansas Nuclear One Unit 1(ANO-1) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard Reference 6.4 as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" (Reference 6.1), at an appropriate capability category to support the ANO-1 TMRE program. This enclosure provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

Section 2 addresses the need for the PRA model to represent the as-built, as-operated plant, Section 3 discusses permanent plant changes that have an impact on those systems, structures, and components (SSCs) modeled in the PRA but have not been incorporated in the baseline PRA model.

Section 4 demonstrates that the ANO-1 PRA has been performed consistent with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Rev. 2. The peer review that has been conducted and the resolution of findings from those reviews are discussed in this section. The unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, Nuclear Energy Institute (NEI) 17-02 are also discussed in this section.

The conclusions on the technical adequacy of the ANO-1 PRA are provided in Section 5.

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2. Basis to Conclude that the PRA Model Represents the As-Built, As-Operated Plant The ANO-1 PRA models are controlled in accordance with Entergy procedure EN-DC-151 Reference 6.3) which is consistent with the requirements provided in the ASME/ANS PRA Standard. Entergy procedures and guidelines define the process to be followed to implement scheduled and interim PRA model updates and to control the PRA model files. In addition, the procedure also defines the process for identifying, tracking and implementing model changes, and for identifying and tracking model improvements or potential issues that may affect the model. Model changes that are identified are tracked via model change requests (MCRs),

which are entered in the Entergy MCR database.

Periodic PRA model updates are typically performed at least once every four years, with the option of extending the frequency for up to two years, such that the total update period does not exceed six years. Extensions are justified showing that the PRA model continues to adequately represent the as-built, as-operated plant and need to be approved by management.

Enclosure Attachment 1 to 0CAN041904 Page 2 of 34 The ANO-1 PRA model 5p01 was completed in 2016. The model follows the guidelines of RG 1.200 to demonstrate PRA technical adequacy. Sections 3 and 4 discuss the requirements in RG 1.200 to demonstrate PRA technical adequacy, as applicable to the current ANO-1 internal events model.

3. Identification of Permanent Plant Changes Not Incorporated in the PRA Model Per the Entergy Engineering Change Process (EN-DC-115), the responsible engineer for an Engineering Change (EC) notifies the PRA engineer if the EC potentially impacts the PRA model. The PRA engineer ensures that the potential PRA model change is entered into the MCR database. Potential model changes associated with ECs not yet implemented remain in the MCR database and are tracked until closure (i.e., cancelled, resolved, or implemented).

Per the Entergy PRA Maintenance and Update procedure (EN-DC-151), the responsible owner for an emergency operating procedure (EOP) change notifies the PRA engineer of a change, and the PRA engineer determines if the EOP change potential impacts the PRA model. If so, the PRA engineer ensures that the potential PRA model change is entered into the MCR database. During periodic PRA model updates, the PRA engineer performs a review of any other EOP changes as well as changes to Abnormal Operating Procedures (AOPs) and other operating procedures referenced in the PRA model to identify changes that may impact the model. An MCR is created for any change that may potentially impact the PRA model.

Therefore, the MCR database is used to capture and track plant changes that may potentially impact the PRA model, and can be used to identify such plant changes that are not yet implemented in the PRA model. Review of the MCR database for ANO-1 identified several plant changes not yet implemented which may potentially impact the PRA. These are listed in Table 11, along with a discussion of why the change does not impact the PRA results used to support the TMRE.

4. Conformance with ASME/ANS PRA Standard The following sections describe the conformance and capability of the ANO-1 PRA against the ASME/ANS PRA Standard.

4.1 Peer Review Facts and Observations (F&Os)

The ANO-1 PRA model has undergone several peer reviews and self-assessments which document the model quality and identify any areas with potential for improvement. The following assessments have been performed and documented for the ANO-1 model:

An industry peer review of the ANO-1 PSA model Revision 2p2 was conducted by the Babcock and Wilcox Owners Group in 2002 (Reference 6.5). The peer review concluded that there were several areas where the ANO-1 model needed improvement. The ANO-1 PSA model updates Rev 3p0 completed in August 2006 addressed the significant Finding-level F&Os from this peer review.

In preparation for ANO-1 to transition to the National Fire Protection Association (NFPA) 805 standard, a gap assessment of the ANO-1 PSA 3p0 internal events PRA model was completed in 2007 (Reference 6.6). The gaps impacting the fire PRA were closed to meet the NFPA transition schedule. The ANO-1 Internal Events PSA model was updated (Rev 4p0 finished in 2009) to meet the RG 1.200, Revision 1, standards.

Enclosure Attachment 1 to 0CAN041904 Page 3 of 34 A peer review of the Rev 4p02 ANO-1 PSA Model was performed in August 2009 and documented in Reference 6.2. This peer review documented eighty-six (86) new F&Os including forty-four (44) Findings and forty-one (41) Suggestions and. The conclusion of the review was that the ANO-1 PRA met the ASME PRA standard at Capability Category II or better for approximately 79% of the Standard SRs.

The ANO-1 internal events model revision 5p0 was completed in 2015 and follows the guidelines of RG 1.200, Rev. 2 (Reference 6.1). This is the current PRA model. The remaining open Findings related to the internal events PRA model are documented in the MCR database and are presented in Section 4.2.

4.2 Consistency with Applicable PRA Standards As discussed above the ANO-1 internal events PRA model was updated in 2015. Per Entergy procedure EN-DC-151, all Entergy PRA models are required to meet current industry standards for PRA model development and documentation. Specifically, the Entergy procedure requires to attempt to meet the ASME/ANS PRA standard (Reference 6.4) Capability Category II of all SRs. Current Entergy PRA documentation includes an individual self-assessment that documents how each high-level requirement (HLR) and SR are met.

The latest full-scope peer review for ANO-1 was conducted in July 2009 using RG 1.200 Rev 1.

Since then, model revision 5p0 was completed which ensured all the significant F&Os from the peer review were addressed properly. All the F&Os are captured and documented in the MCR database. A search of ANO-1 MCRs related to peer review F&Os was performed and 45 open MCRs were found. Seventeen (17) were Findings related to either the internal event or internal flooding models. Some of the F&O MCRs are resolved as part of the Revision 5p0 update, but have not been closed. Finding-level F&O MCRs that have not been resolved in the internal event model are listed in Table 10, along with the impact on the application for the internal events.

A summary of the assessment against each of the eight (internal flooding is not included) technical elements (i.e. high-level requirements,) of ASME/ANS RA-Sa-2009 is provided in Tables 1 through 8 of this attachment. Table 9 lists those SRs from the PRA Standard that have been identified in the TMRE Guidance Document as being applicable to the TMRE PRA.

A systematic review of these SRs relative to the ANO-1 TMRE model development was performed and documented in the "Additional ANO-1 TMRE Comments" column of Table 9.

5. Conclusions on PRA Technical Adequacy The information presented herein demonstrates that the ANO-1 PRA technical adequacy and capability evaluations, as well as the maintenance and update processes, conform to the ASME/ANS PRA Standard, which satisfies the guidance of RG 1.200.

Therefore, the ANO-1 internal events PRA model technical capability evaluations described in this report provide a robust basis for concluding that the ANO-1 PRA models are suitable for use in risk-informed applications including the TMRE.

Enclosure Attachment 1 to 0CAN041904 Page 4 of 34

6. References 6.1 Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," USNRC, March 2009.

6.2 "ANO-1 RG 1.200 PRA Peer Review Report Using ASME PRA Standard Requirements,"

August 2009.

6.3 EN-DC-151, Entergy Nuclear Management Manual, "PSA Maintenance and Upgrade,"

Revision 6.

6.4 ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, 2009.

6.5 38-1290272-00, "Arkansas Nuclear One - 1 Probabilistic Risk Assessment Peer Review Report," October 2002.

6.6 CEXI2007-00013, "Arkansas Nuclear One Unit 1 PSA RG 1.200 App. B / ASME PSA Standard "Gap" Assessment," June 2007 6.7 ENTGANO150-REPT-002, "Arkansas Nuclear One Unit 2 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, April 2017.

Enclosure Attachment 1 to 0CAN041904 Page 5 of 34 Table 1 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Initiating Events (IE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification IE-A1 ALL X X IE-A2 ALL X IE-A3 ALL X IE-A4 I/II X IE-A5 I/II X HLR-IE-A IE-A6 I/II X IE-A7 ALL X IE-A8 I/II X IE-A9 I/II X IE-A10 ALL X IE-B1 ALL X IE-B2 ALL X HLR-IE-B IE-B3 I/II X IE-B4 ALL X IE-B5 ALL X IE-C1 ALL X X IE-C2 ALL X IE-C3 ALL X X IE-C4 ALL X IE-C5 I/II X IE-C6 ALL X IE-C7 I ALL X HLR-IE-C IE-C8 ALL X IE-C9 ALL X IE-C10 ALL X IE-C11 ALL X IE-C12 ALL X IE-C13 I/II X IE-C14 I/II X IE-C15 ALL X X)

IE-D1 ALL X HLR-IE-D IE-D2 ALL X IE-D3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 6 of 34 Table 2 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Accident Sequences (AS), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A Clarification I II III AS-A1 ALL X X AS-A2 ALL X AS-A3 ALL X X AS-A4 ALL X X AS-A5 ALL X X HLR-AS-A AS-A6 ALL X AS-A7 III X AS-A8 ALL X AS-A9 I/II X AS-A10 ALL X X AS-A11 ALL X AS-B1 ALL X X AS-B2 ALL X AS-B3 ALL X X HLR-AS-B AS-B4 X AS-B5 ALL X AS-B6 ALL X AS-B7 ALL X X AS-C1 ALL X HLR-AS-C AS-C2 ALL X AS-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 7 of 34 Table 3 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Success Criteria (SC), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SC-A1 ALL X SC-A2 II/III X SC-A3 ALL X HLR-SC-A SC-A4 ALL X SC-A5 I/II ALL X SC-A6 ALL X SC-B1 I/II X SC-B2 II/III X X HLR-SC-B SC-B3 ALL X SC-B4 ALL X SC-B5 ALL X SC-C1 ALL X HLR-SC-C SC-C2 ALL X SC-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 8 of 34 Table 4 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SY-A1 ALL X SY-A2 ALL X SY-A3 ALL X SY-A4 II/III X X SY-A5 ALL X SY-A6 ALL X SY-A7 III X SY-A8 ALL X SY-A9 ALL X SY-A10 ALL X X SY-A11 ALL X X SY-A12 ALL X HLR-SY-A SY-A13 ALL X X SY-A14 ALL X X SY-A15 ALL X X SY-A16 I/II X X SY-A17 ALL X X SY-A18 ALL X SY-A19 ALL X SY-A20 ALL X SY-A21 ALL X SY-A22 I X SY-A23 ALL X SY-A24 ALL X SY-B1 II/III X SY-B2 I/II X SY-B3 ALL X SY-B4 ALL X HLAR-SY-B SY-B5 ALL X SY-B6 ALL X SY-B7 II X X SY-B8 ALL X X

Enclosure Attachment 1 to 0CAN041904 Page 9 of 34 Table 4 (continued)

ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SY-B9 ALL X SY-B10 II/III X SY-B11 ALL X HLAR-SY-B SY-B12 ALL X (continued)

SY-B13 ALL X SY-B14 ALL X X SY-B15 ALL X X SY-C1 ALL X HLR-SY-C SY-C2 ALL X SY-C3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 10 of 34 Table 5 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Human Reliability (HR)), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification HR-A1 ALL X HLR-HR-A HR-A2 ALL X HR-A3 ALL X HR-B1 X HLR-HR-B HR-B2 X HR-C1 ALL X HLR-HR-C HR-C2 I X HR-C3 ALL X HR-D1 ALL X HR-D2 III X HR-D3 II/III X HLR-HR-D HR-D4 ALL X HR-D5 ALL X HR-D6 ALL X HR-D7 I/II X HR-E1 ALL X HR-E2 ALL X HLR-HR-E HR-E3 II/III X X HR-E4 II/III X X HR-F1 III X HLR-HR-F HR-F2 II X HR-G1 III X HR-G2 ALL X HR-G3 II/III X HR-G4 II X HLR-HR-G HR-G5 II X X HR-G6 ALL X HR-G7 ALL X X HR-G8 ALL X HR-H1 III X X HLR-HR-H HR-H2 ALL X X HR-H3 ALL X HR-I1 ALL X HLR-HR-I HR-I2 ALL X HR-I3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 11 of 34 Table 6 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification DA-A1 ALL X X DA-A2 ALL X HLR-DA-A DA-A3 ALL X DA-A4 ALL X DA-B1 II X HLR-DA-B DA-B2 I/II X DA-C1 ALL X DA-C2 ALL X DA-C3 ALL X DA-C4 ALL X DA-C5 ALL X DA-C6 ALL X DA-C7 II/III X DA-C8 II/III X HLR-DA-C DA-C9 I/II X DA-C10 I X DA-C11 ALL X DA-C12 ALL X DA-C13 I X DA-C14 ALL X DA-C15 X DA-C16 ALL X DA-D1 III X DA-D2 X DA-D3 III X DA-D4 II/III X HLR-DA-D DA-D5 II X DA-D6 II X DA-D6a X DA-D7 III X DA-E1 ALL X HLR-DA-E DA-E2 ALL X DA-E3 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 12 of 34 Table 7 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification QU-A1 ALL X QU-A2 ALL X HLR-QU-A QU-A3 I X QU-A4 ALL X QU-A5 ALL X X QU-B1 ALL X QU-B2 ALL X QU-B3 ALL X QU-B4 ALL X QU-B5 ALL X HLR-QU-B QU-B6 ALL X QU-B7 ALL X QU-B8 ALL X QU-B9 ALL X QU-B10 ALL X QU-C1 ALL X HLR-QU-C QU-C2 ALL X QU-C3 ALL X QU-D1 ALL X QU-D2 ALL X QU-D3 ALL X HLR-QU-D QU-D4 I X QU-D5 ALL X X QU-D6 I X QU-D7 ALL X X QU-E1 ALL X X QU-E2 ALL X X HLR-QU-E QU-E3 III X QU-E4 ALL X X QU-F1 ALL X QU-F2 ALL X QU-F3 II/III X HLR-QU-F QU-F4 ALL X QU-F5 ALL X QU-F6 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 13 of 34 Table 8 ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification LE-A1 ALL X LE-A2 ALL X HLR-LE-A LE-A3 ALL X LE-A4 ALL X LE-A5 ALL X LE-B1 II X HLR-LE-B LE-B2 II X LE-B3 ALL X LE-C1 I X LE-C2 I X LE-C3 I X X LE-C4 I X LE-C5 I X LE-C6 ALL X HLR-LE-C LE-C7 ALL X LE-C8 ALL X LE-C9 I X LE-C10 I X LE-C11 I X LE-C12 I X LE-C13 I X LE-D1 I X LE-D2 I X LE-D3 I X HLR-LE-D LE-D4 I X LE-D5 I X LE-D6 I X LE-D7 I X LE-E1 ALL X LE-E2 II X HLR-LE-E LE-E3 II X LE-E4 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 14 of 34 Table 8 (continued)

ANO-1 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification LE-F1 II/III X HLR-LE-F LE-F2 ALL X LE-F3 ALL X LE-G1 ALL X LE-G2 ALL X LE-G3 I X HLR-LE-G LE-G4 ALL X LE-G5 ALL X LE-G6 ALL X

Enclosure Attachment 1 to 0CAN041904 Page 15 of 34 Table 9 ANO-1 Supporting Requirements (SRs) with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The initiating event analysis shall IE-A provide a reasonably complete identification of initiating events.

TMRE process should ensure Tornado initiating events will be that the initiating events consistent with the intervals defined caused by extreme winds that The only initiating events in the TMRE process. TMRE give rise to significant caused by extreme winds that considers all tornadoes will result in accident sequences and are considered in TMRE were IE-A1 a LOOP. Tornado initiating event accurately capture the 4.3, 6.2 tornados. Only tornados will frequencies will be based on a additional risk of the produce tornado missiles. The hazard curve that uses site specific unprotected SSCs (that TMRE process was followed.

data provided in Table 6.1 of should be protected per the NUREG 4461 [IE- C1]. CLB) are identified and used for this application.

For multi-unit sites with shared systems, INCLUDE multi-unit site IE-A10 initiators (e.g., multi-unit LOOP 6.2 events or total loss of service water) that may impact the model.

The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

IE-B the requirements for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

Enclosure Attachment 1 to 0CAN041904 Page 16 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments DO NOT SUBSUME multi- unit initiating events if they impact mitigation capability. Two unit sites IE-B5 should consider proximity of each unit 6.2 to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

The initiating event analysis shall The tornado IEFs should be estimate the annual frequency of based on a hazard curve that IE-C each initiating event or initiating uses site-specific data, such event group. as found in NUREG-4461.

Tornado initiating event frequencies The TMRE process was followed will be based on a hazard curve that IE-C1 4.1 as described. No additional uses site specific data provided in comments.

Table 6.1 of NUREG 4461 The TMRE process was followed Do not credit recovery of offsite IE-C3 Same comment as AS-A10 6.1, Appendix A as described. Offsite power power.

recovery was not credited.

The TMRE process was followed as described. As CHARACTERIZE the uncertainty in mentioned, NUREG 4461, the tornado initiating event Tornado Climatology, data frequencies and PROVIDE mean includes uncertainty.

IE-C15 values for use in the quantification 4.3 Additionally, the R-squared of the PRA results. NUREG 4461, value is provided to help Tornado Climatology, data includes characterize the uncertainty of uncertainty. the ANO-1 initiating event best fit interpolated/extrapolated frequencies.

Table 9

Enclosure Attachment 1 to 0CAN041904 Page 17 of 34 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Utilize the accident sequences (typically LOOP) provided in the AS-A internal events model and adjust as necessary to consider the consequences of a tornado event.

The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was utilized considering the Modify the internal events accident AS-A1 6.1, 6.3, 6.4, 6.5 consequences of a tornado event.

sequences in compliance with this SR SSCs are not credited in accordance with the TMRE process.

Operator actions are adjusted as necessary according to the TMRE process.

Review the FPIE success criteria and modify the associated system The TMRE process was followed as AS-A3 models as necessary to account for 6.1, 6.3, 6.4, 6.5 described. SSCs are not credited in the tornado event and its accordance with the TMRE process.

consequences.

Review the FPIE success criteria and The TMRE process was followed modify the associated operator as described. Operator actions are AS-A4 actions as necessary to account for 6.4 adjusted as necessary according to the tornado event and its the TMRE process.

consequences.

Enclosure Attachment 1 to 0CAN041904 Page 18 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Modify the FPIE accident The TMRE process was followed sequence model in a manner that as described. The transient is consistent with the plant-LOOP accident sequence event specific: system design, EOPs, tree from the internal events model abnormal procedures, and plant was utilized considering the transient response. Account for AS-A5 6.1, 6.3, 6.4, 6.5 consequences of a tornado event.

system functions that, as a Certain exposed SSCs are not consequence of the tornado event, credited in accordance with the will not be operable or potentially TMRE process. Operator actions degraded, and operator actions are adjusted as necessary that will not be possible or according to the TMRE process.

impeded.

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative Capability Category I. In modifying approach can be justified. Use the accident sequence models, of conservative assumptions in The TMRE process was followed INCLUDE, for each tornado the base model can distort the as described. Active components initiating event, INDIVIDUAL results and may not be not in Cat I structures are not EVENTS IN THE ACCIDENT 6.3, 7.2.3, AS-A10 conservative for delta CDF/LERF credited in accordance with the SEQUENCE SUFFICIENT TO Appendix A calculation. While use of TMRE process. This conservative BOUND SYSTEM OPERATION, conservative or bounding assumption can distort the delta TIMING, AND OPERATOR assumptions in PRA models is CDF/LERF.

ACTIONS NECESSARY FOR KEY acceptable, a qualitative or SAFETY FUNCTIONS.

quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

Enclosure Attachment 1 to 0CAN041904 Page 19 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

NEI 17-02 TMRE - ASME PRA Standard Supporting NRC Comments Additional Section Requirements Requiring Self-Assessment (No comments if blank) ANO-1 TMRE comments Addressing SR Dependencies that can impact the ability of the mitigating systems to AS-B operate and function shall be addressed.

For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the The TMRE process was followed as impact. INCLUDE the impact of described. Impacts on mitigating AS-B1 6.1, 6.3, 6.5, 6.6 initiating events on mitigating systems were included for all systems in the accident modeled tornado initiating events.

progression either in the accident sequence models or in the system models.

The TMRE process was followed IDENTIFY the phenomenological as described. Unique weather conditions created by the phenomena such as intense rain accident progression. Consider could be an issue during tornado concurrent impacts related to initiating events for structures that tornado missiles (e.g., the are not designed to withstand the possibility of multiple missile winds. Except as noted above AS-B3 5.6, 6.3, 6.4, 6.6 strikes in a given sequence. (AS-A10) active components in Also high winds and rains after non-Cat I structures were not the tornado event could result in credited in accordance with the hazardous conditions (e.g. debris TMRE process. Operator actions and structural instabilities) for that require travel through actions outside the control room. non-Cat I structures or areas are not credited.

Enclosure Attachment 1 to 0CAN041904 Page 20 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

NEI 17-02 TMRE - ASME PRA Standard Supporting NRC Comments Additional Section Requirements Requiring Self-Assessment (No comments if blank) ANO-1 TMRE comments Addressing SR Review FPIE time phased dependencies to identify model The TMRE process was followed as changes needed to address all described. Time phased the concurrent system functions AS-B7 6.1 dependencies were reviewed and failed by the tornado event; e.g.

no model changes were identified LOOP, instrument air, fire for the TMRE model.

protectionetc. Do not model offsite recovery.

The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the SC-A PRA shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

Consider impact on both units for the same tornado including the Shared components were SC-A4 6.1 mitigating systems that are included in the model.

shared.

The systems analysis shall provide a reasonably complete treatment of the causes of system SY-A failure and unavailability modes represented in the initiating events analysis and sequence definition

Enclosure Attachment 1 to 0CAN041904 Page 21 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The TMRE process was followed as described. Walkdowns were performed focusing on targets vulnerable to tornado missiles. The results were The systems analysis shall provide a recorded in the walkdown report. The reasonably complete treatment of the walkdowns also surveyed the plant for SY-A causes of system failure and unavailability Section 3 the missile inventory. Pathways for modes represented in the initiating events operator x-control room actions were analysis and sequence definition discussed with the site personnel; however, operator actions that require travel through non-Cat I structures or areas are not credited.

The TMRE process was followed as New basic events will be added to address described. New basic events and all the failure modes of the system targets flags were added to address all the exposed to tornado missiles; safety related SY-A11 6.3, 6.5, 6.6 failure modes of the safety related and non-safety related. The exclusions of system targets exposed to tornado SY-A15 do not apply for SSCs impacted by missiles in accordance with the TMRE tornado missiles.

process.

DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile verses The TMRE process was followed as SY-A12 crimped unless it can be shown this is true 5.2 described. No additional comment for for all missiles at all speeds. Exceptions the TMRE model.

would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

Enclosure Attachment 1 to 0CAN041904 Page 22 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The TMRE process was followed as described. Targets potential to cause a flow diversion when struck Consider the targets potential to by a tornado missile were SY-A13 cause a flow diversion when 8.5 considered. Beyond steam breaks struck by a tornado missile.

around main steam lines, no additional flow diversions were required to be modeled.

Missile targets will be assessed for all failure modes - some new failure modes may be identified The TMRE process was followed SY-A14 that are not in the FPIE model. 6.5 as described. SSCs were The exclusions of SY-A15 do assessed for all failure modes.

not apply for SSCs impacted by tornado missiles.

The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected The TMRE process was followed according to the CLB and any as described. The failure by unprotected targets that are not tornado missiles was included in in the CLB but are in the PRA The failure of SSCs due to the model for all unprotected model. This is to facilitate SY-A15 tornado missiles shall not use the 6.5 targets that are supposed to be sensitivity studies regarding exclusions of SY-A15. protected according to the CLB possible correlation of tornado and any unprotected targets that missile damage across are not in the CLB but are in the systems. It is not expected that PRA model.

the number of basic events added to the model for this analysis will be so large that this screening is necessary.

Enclosure Attachment 1 to 0CAN041904 Page 23 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Certain post initiator HFEs will be The TMRE process was followed SY-A17 modified to account for the 4.4 as described.

tornado event.

The thermal/hydraulic,structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for SY-B quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Capability Category I. BASE support system modeling on the The TMRE process was followed use of CONSERVATIVE as described. The systems SUCCESS CRITERIA AND analysis from the internal events SY-B7 TIMING. Sensitivity studies will Same comment as AS-A10 5.2.3 was the foundation for the TMRE be performed to identify where model. Credit given to available conservative assumptions may PRA SSCs was in accordance be distorting risk and adjusted with the TMRE process.

accordingly.

Consider spatial relationships The TMRE process was followed between components to identify as described. Correlation was correlated failures. Where the SY-B8 5.6 considered where the same missile same missile can impact targets can impact targets that are in close that are in close proximity to each proximity to each other.

other.

Enclosure Attachment 1 to 0CAN041904 Page 24 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile damage for specially separated Statistical correlation of tornado components is insignificant. There are no deviations taken missile damage between SY-B14 Until that information is Appendix B.4.4 from the TMRE guidance redundant and spatially separated reviewed and accepted by the document.

components is NOT required.

staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

The TMRE process was followed INCLUDE new operator as described. No new operator interface dependencies across SY-B15 6.4 interface dependencies across systems or trains related to the systems or trains were identified tornado event.

in the TMRE model development.

A systematic review of the relevant procedures shall be used HR-E to identify the set of operator responses required for each of the tornado accident sequences

Enclosure Attachment 1 to 0CAN041904 Page 25 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The TMRE process was followed as described. Operator interviews for the credited actions were Operators will be interviewed (if performed during the development necessary) to assess the need for of the internal events model that HR-E3 6.4 changes to operator actions for the the TMRE model is based on.

tornado initiating events. Furthermore, during the TMRE development an ANO-1 SRO was consulted for further considerations.

Operators talk- throughs or simulator observations will be conducted (if The TMRE process was followed necessary) to assess the need for as described. Operator changes to operator actions for the interviews/ talk throughs for the tornado [Note: this applies to new HR-E4 6.4 credited actions were performed sequences or failure combinations not during the development of the accounted for in the internal events model that the TMRE model is model. It is not intended that operator based on.

action timing needs be changed due to the tornado event alone]

The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses HR-G the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

Enclosure Attachment 1 to 0CAN041904 Page 26 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Operators will be interviewed and simulator observations conducted (if necessary) to assess the need for The TMRE process was followed changes to operator action timing as a as described. Operator result of the tornado event. [Note: this interviews / talk throughs for the HR-G5 applies to new sequences or failure 6.4 credited actions were performed combinations not accounted for in the during the development of the internal events model. It is not internal events model that the intended that operator action timing TMRE model is based on.

needs be changed due to the tornado event alone]

The TMRE process was followed Dependencies will be recalculated as described. No new HR-G7 when the model is quantified or 6.4 combinations were created or modified by inspecting cutsets.

credited.

Dependencies will be recalculated HR-G7 when the model is quantified or modified by inspecting cutsets.

The TMRE process was followed Dependencies will be recalculated as described. No new HR-G7 when the model is quantified or 6.4 combinations were created or modified by inspecting cutsets.

credited.

Each parameter shall be clearly defined in terms of the logic model, DA-A basic event boundary, and the model used to evaluate event probability.

Enclosure Attachment 1 to 0CAN041904 Page 27 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The TMRE process was followed as described. New basic events and flags were added to address all Develop new basic events for the failure modes of the safety DA-A1 tornado missile targets (all failure 8.3, 8.5, 8.6 related and non-safety related modes) in accordance with this SR.

system targets exposed to tornado missiles in accordance with the TMRE process.

The level 1 quantification shall quantify core damage frequency and QU-A shall support the quantification of LERF.

Do not credit recovery actions to restore functions, systems, or The TMRE process was followed components unless an explicit basis as described. Recovery actions to QU-A5 6.4 accounting for tornado impacts on restore functions, systems, or the site and the SSCs of concern is components were not credited.

provided.

Model quantification shall determine QU-C that all identified dependencies are addressed appropriately.

Identify new operator action The TMRE process was followed dependencies created as a result of as described. No new operator QU-C1 the changes to the internal events 6.4 actions or combinations were PRA model or failures associated created or credited.

with tornado events.

Enclosure Attachment 1 to 0CAN041904 Page 28 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments The quantification results shall be reviewed, and significant contributors to CDF (and LERF),

such as initiating events, accident sequences, and basic events QU-D (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

The TMRE process was followed Review nonsignificant cutset or as described. Cutsets were QU-D5 sequences to determine the 7.3 reviewed including significant and sequences are valid non-significant cutsets to ensure the sequences are valid.

The TMRE process was followed Review BE importance to make as described. BE importances QU-D7 7.3 sure they make logical sense. were reviewed to ensure they make logical sense.

Uncertainties in the PRA results shall be characterized. Sources of model uncertainty and related QU-E assumptions shall be identified, and their potential impact on the results understood.

7.1, Also see Identify sources of uncertainty The TMRE process was followed QU-E1 Appendices A related to MIP and missiles as described.

and B for bases.

Enclosure Attachment 1 to 0CAN041904 Page 29 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Identify assumptions made that are The TMRE process was followed QU-E2 different than those in the internal Section 6 as described.

events model The TMRE process was followed Identify how the model uncertainty as described. Assumptions related QU-E4 is affected by assumptions related 7.1, Appendix A to MIP and missiles unique to to MIP and missiles ANO-1 are described in an Entergy report.

The accident progression analysis The TMRE process was followed shall include identification of those LE-C 7.1, 7.3 as described. No additional sequences that would result in a comments.

large early release.

Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, systems, The TMRE process was followed 6.3, 7.2.3, LE-C3 or components unless an explicit Same comment as AS-A10 as described. No additional Appendix A basis accounting for tornado impacts comments.

on the site and the SSCs of concern is provided.

Enclosure Attachment 1 to 0CAN041904 Page 30 of 34 Table 9 ANO-1 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-1 TMRE comments Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in Various documentation SRs for The TMRE process was followed Multiple each HLR. The documentation Section 8 as described. No additional SRs should be sufficient to comments.

understand basis and facilitate review. Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Enclosure Attachment 1 to 0CAN041904 Page 31 of 34 Table 10 Listing of Open Findings against the ANO-1 Internal Events MCR MCR Applicable Current Status and Finding/Observation Number Grade SR Importance to application RG1.200 Peer Review Finding Some basic events (e.g., XMP119BBAF) applied in the calculation of IE frequencies developed for plant-specific fault trees have used calculation method 3 in CAFTA. The use of calculation method 3 (1-e-t) produces a probability (always < 1) rather than a frequency which can be greater than 1. Calculation method 1 (t) in CAFTA should be used for those The calculation type was basic events whose result is intended to be a frequency of failure, not a corrected during the Rev. 5 A1-3893 C IE-D1 probability of failure. model update. Therefore, no A discussion of the use of this calculation method is not provided, impact on TMRE.

although, during discussion of this issue, the PRA staff indicated that the limitations of the selected approach were understood.

Provide a description of the approach taken for calculation of the basic event values within support system initiating event fault trees, and include the limitations of the approach.

RG1.200 Peer Review Finding Section 5.3 of PRA-A1-01-001S06, Revision 2 identifies those initiating events that are quantified by means of a plant specific fault tree.

Appendices C, D, E, and F provide additional detail on each of the 4 The initiating event trees were modeled initiating events. extensively revised during the A1-3897 C IE-C8 Per Appendices E and F, the PSA logic model is used as the starting Rev. 5 model update.

point for the IE model; however, a number of modeling simplifications are Therefore, no impact on TMRE made as identified in Appendix C. These simplifications may cause the is expected.

model to fall out of compliance with the SY requirements.

Use the system fault tree with necessary data (exposure time) changes to evaluate IEs.

Note 1 - Open internal flooding and fire PRA findings are not included.

Enclosure Attachment 1 to 0CAN041904 Page 32 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 MCR EC or Description of Change Impact on TMRE Application Number Procedure Currently ANO-1 recirc lines for BWST through SFP purification loop are not The potential modification is seismically qualified. EC-3069 incorporates two valves CV-1438 and CV-1441 intended for seismic into line that will get a close signal on ESAS channel 1 and 2 respectively. If a A1-3050 EC-3069 considerations, and therefore is seismic event occurs, operations will be required to close these valves per the expected to have no impact on the procedure. The current estimation is that it will take the operations approximately TMRE applications.

30 minutes to take the action to close the valves.

The NFPA-805 circuit modification described in EC-41875 prevents spurious The modifications have been operation of the valves following fire impact to the associated circuits regardless incorporated in the fire PRA of where the cable is damaged. However, the Fire PRA (FPRA) was only model, but the MCR is not yet adjusted to remove the fire impact to the valves in fire zone 129-F. The impact in closed. Therefore, this plant A1-4837 EC-41875 other fire zones and fire areas has not been removed from the FPRA. change has been incorporated, The circuits being modified are for air-operated valves (AOVs) CV-1052, but as it is related to FPRA, has CV-4400, CV-7401, CV-7402, CV-7403, and CV-7404 as well as motor-operated no impact on the TMRE valves (MOVs) CV-1053, CV-4446, CV-5611, and CV-5612. application.

The modification and updated data has been incorporated in the During the FPRA model revision (re-baseline) for the NFPA-805 amendment FPRA model, but the MCR is not request responses to requests for additional information (RAIs), update the yet closed. Therefore, this plant A1-4862 EC-44500 random failure probability for the new DC supplies to bound the modification change has been incorporated, described in EC-44500. Also update the random failure probabilities assumed for but as it is related to FPRA, has the new Auxiliary Feedwater (AFW) pump if necessary to reflect that modification.

no impact on the TMRE application.

Enclosure Attachment 1 to 0CAN041904 Page 33 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 (continued)

MCR EC or Description of Change Impact on TMRE Application Number Procedure B5b actions/equipment can potentially be credited in the model to provide an alternate feedwater and Refueling Water Tank (RWT) / Borated Water Storage This modification involves use of Tank (BWST) makeup from the B5b portable fire pump. By having an additional equipment that is stored in non-pump to EFW/AFW for long term scenarios can provide some benefit for those Cat 1 structures and vulnerable to scenarios. tornado missiles. However, SDS-008 Also, procedure SDS-008 Change 002 contains the following statement that implementation of the mod would potentially lower CDF/LERF for A1-4933 OP-1202.008 could add additional actions in the PRA: IF Unit 2 has AC power, THEN both the compliant and degraded OP-1203.048 consider performing Security Event (OP-1203.048), Attachment G, Cross-Tying TMRE cases. Since the 4160 V Buses Between Units.

equipment is vulnerable in both Blackout Procedure OP-1202.008 Rev. 15 provides a reference to OP-1203.048 cases, delta CDF and LERF is for supplying power from Unit 2 to Unit 1 via 2A9. unlikely to change from the current Once procedure OP-1203.048 is reviewed, there may be additional actions that base case.

can provide enhancement to the PRA model.

EC 44044 and child ECs 46389, 46390, and 46391 make up the electrical portion This modification involves use of of ANO-1s Beyond-Design Basis External Event (BDBEE) plan. The scope of equipment that is stored in non-this project includes installing new breakers into the existing Load Center B-5 and Cat 1 structures and vulnerable to Motor Control Centers B-55, B-61, and B-65, and the permanent raceway, tornado missiles. However, cables, and termination panels required to use them during a BDBEE. Portable implementation of the mod would EC 44044 diesel generators will be stored outside of the protected area (Ref. EC-44045 lower CDF/LERF for both the A1-5051 and child ANO Flex Storage Building) at separate locations to assure availability of at compliant and degraded TMRE ECs least one post BDBEE. A portable generator will be moved into a position at the cases. Since the equipment is common Post Accident Sampling System (PASS) building on the west side of the vulnerable in both cases, delta Auxiliary Building between the ANO-1 BWST and the ANO-2 RWT. Once at this CDF and LERF is unlikely to location it will be connected to the permanently installed infrastructure previously change from the current base described. case.

Enclosure Attachment 1 to 0CAN041904 Page 34 of 34 Table 11 Summary of Plant Changes Not Yet Implemented ANO-1 (continued)

MCR EC or Description of Change Impact on TMRE Application Number Procedure Reviewing procedure OP-1106.006 Rev. 100 (dated 1/5/2017), a change was made in Section 8.3 for EFW pump suction transfer to transfer to Service Water (SW) instead of the Condensate Storage Tank (CST). This change removes the allowance to transfer to the CST. This change was based on the SW supply This modification would have no being judged as the preferred for transfer vice CST T-41 since it is the safety-impact on the TMRE analysis related water supply and it is currently unknown when vortexing might occur A1-5821 OP-1106.006 because the CSTs are failed in when aligned to the CST. However, the current revision (dated 4/6/2016) of both the compliant and degraded procedure OP-1203.012K Rev. 48, still maintains the CST T-41 as an option with cases.

CST T-41B empty when EFW pump P7A/P7B suction pressure is low, but references OP-1106.006 that does not credit T-41 in the EFW pump suction transfer section. The qualified CST (QCST) T-41B, CST T-41, and SW are credited in the PRA to provide flow to EFW.

Enclosure Attachment 2 to 0CAN041904 Probabilistic Risk Assessment Technical Adequacy Documentation - ANO-2

Enclosure Attachment 2 to 0CAN041904 Page 1 of 56 ANO-2 Technical Adequacy 1.0 Overview This Attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for Arkansas Nuclear One, Unit 2 (ANO-2) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard (Reference 6.1) as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," (Reference 6.1) at an appropriate capability category to support the ANO-2 Tornado Missile Risk Evaluator (TMRE) program. This enclosure provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

Section 2.0 addresses the need for the PRA model to represent the as-built, as-operated plant, Section 3.0 discusses permanent plant changes that have an impact on those systems, structures, and components (SSCs) modeled in the PRA but have not been incorporated in the baseline PRA model.

Section 4.0 demonstrates that the ANO-2 PRA has been performed consistent with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Revision 2. The peer review that has been conducted and the resolution of findings from those reviews are discussed in this section. The unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, NEI 17-02 are also discussed in this section.

The conclusions on the technical adequacy of the ANO-2 PRA are provided in Section 5.0.

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2.0 Basis to Conclude that the PRA Model Represents the As-Built, As-Operated Plant The ANO-2 PRA models are controlled in accordance with Entergy procedures consistent with the requirements provided in the ASME/ANS PRA Standard. Entergy procedures and guidelines define the process to be followed to implement scheduled and interim PRA model updates and to control the PRA model files. In addition, the procedure also defines the process for identifying, tracking and implementing model changes, and for identifying and tracking model improvements or potential issues that may affect the model. Model changes that are identified are tracked via model change requests (MCRs), which are entered in the Entergy MCR database.

Periodic PRA model updates are typically performed at least once every four years, with the option of extending the frequency for up to two years, such that the total update period does not exceed six years. Extensions are justified showing that the PRA model continues to adequately represent the as-built, as-operated plant and need to be approved by management.

Enclosure Attachment 2 to 0CAN041904 Page 2 of 56 The ANO-2 PRA model 5p00 was completed in 2016. The internal flood model upgrade was developed in 2016 and unresolved F&Os are currently being addressed. Both models follow the guidelines of RG 1.200. Section 3.0 discusses the requirements in RG 1.200 to demonstrate PRA technical adequacy, as applicable to the current ANO-2 internal events and internal flooding models.

3.0 Identification of Permanent Plant Changes Not Incorporated in the PRA Model Per the Entergy Engineering Change Process (EN-DC-115), the responsible engineer for an Engineering Change (EC) notifies the PRA engineer if the EC potentially impacts the PRA model. The PRA engineer ensures that the potential PRA model change is entered into the MCR database. Potential model changes associated with ECs not yet implemented remain in the MCR database and are tracked until closure (i.e., cancelled, resolved, or implemented).

Per the Entergy PRA Maintenance and Update procedure (EN-DC-151), the responsible owner for an emergency operating procedure (EOP) change notifies the PRA engineer of a change, and the PRA engineer determines if the EOP change potential impacts the PRA model. If so, the PRA engineer ensures that the potential PRA model change is entered into the MCR database. During periodic PRA model updates, the PRA engineer performs a review of any other EOP changes as well as changes to Abnormal Operating Procedures (AOPs) and other operating procedures referenced in the PRA model to identify changes that may impact the model. An MCR is created for any change that may potentially impact the PRA model.

Therefore, the MCR database is used to capture and track plant changes that may potentially impact the PRA model, and can be used to identify such plant changes that are not yet implemented in the PRA model. Review of the MCR database for ANO-2 identified several plant changes not yet implemented which may potentially impact the PRA. These are listed in Table 11, along with a discussion of why the change does not impact the PRA results used to support the TMRE.

The current ANO-2 Internal Events model (5p02, Reference 6.4) is based on the plant configuration as of April 2013 and plant-specific data through April 2013. It was a periodic model update of the previous revision of the model (4p02, Reference 6.3).

4.0 Conformance with ASME/ANS PRA Standard The following sections describe the conformance and capability of the ANO-2 PRA against the ASME/ANS PRA Standard.

4.1 Peer Review Facts and Observations (F&Os)

The ANO-2 PRA model has undergone several peer reviews and self-assessments which document the model quality and identify any areas with potential for improvement. The following assessments for PRA quality have been performed and documented for the ANO-2 model:

An industry peer review of the ANO-2 PSA model Revision 3p0 was conducted by the Combustion Engineering Owners Group (CEOG) in 2002 (Reference 6.6). The peer review concluded that there were several areas where the ANO-2 model needed improvement. The ANO-2 PSA model updates Rev 3p01, 3p02, 4p00, and 4p01 (4p01 completed in October 2006) addressed the Finding-level F&Os from this peer review.

Enclosure Attachment 2 to 0CAN041904 Page 3 of 56 In preparation for ANO-2s transition to National Fire Protection Association (NFPA) 805 standard, a gap assessment of the ANO-2 PSA 4p01 internal events PRA model was completed. The gaps impacting the fire PRA were closed to meet the NFPA transition schedule. The ANO-2 Internal Events PSA model was updated (Rev 4p02 finished December 2008) to meet the RG 1.200 Revision 1 standards.

In July 2008, a peer review of the Rev 4p02 ANO-2 PSA Model was performed and documented in LTR-RAM-II-08-020 (Reference 6.6). This peer review documented fifty-nine (59) new F&Os including thirty-three (33) Findings and twenty-six (26)

Suggestions. Most of the findings pertained to documentation issues. The conclusion of the review was that the ANO-2 PRA substantially met the ASME PRA standard at Capability Category (CC) II or better.

In September 2017, a self-assessment of all ANO-2 PRA models (internal events, external and shutdown) was performed. Several gaps were identified and are being tracked in the Entergys Paperless Condition Reporting System (PCRS).

The ANO-2 internal events model revision 5p00 was completed in 2016. This is the current PRA model as stated above. The peer review findings and their resolutions as well as the remaining unresolved findings related to the internal events PRA model are documented in the MCR database and are presented in Table 10.

The current ANO-2 internal flooding model was completed in 2016, and a focused scope peer review was completed in February 2017 against the current ASME/ANS PRA standard and RG 1.200. The results are detailed in report ENTGANO150-REPT-002 (ENERCON report)

(Reference 6.9). Internal flooding initiating accident sequences are not relevant to the TMRE analysis and, therefore, internal flooding F&Os from the 2017 are not addressed further.

4.2 Consistency with Applicable PRA Standards The ANO-2 PRA model revision 5p00 meets the ASME/ANS PRA standard (Reference 6.7)

CC II of the SRs. Current Entergy PRA documentation includes an individual self-assessment that documents how each high-level requirement (HLR) and SR are met. A gap in documentation related to this individual self-assessment was identified and documented in MCR A2-5585 (missing table from Success Criteria, Accident Sequence and System Analysis packages). This documentation issue is expected to be resolved as part of the model update.

The latest full-scope peer review for ANO-2 was conducted in July 2008 using RG 1.200 Rev 1.

Since then, model Revision 5p00 was completed which ensured all the significant F&Os from the peer review were addressed. All the F&Os are captured and documented in the MCR database. A search of ANO-2 MCRs related to the peer review F&Os was performed.

Finding-level F&O MCRs related to the internal event and internal flooding model are listed in Table 10, along with their disposition/resolution if resolved and the impact on the application.

A summary of the assessment against each of the eight technical elements (i.e., high-level requirements) of ASME/ANS RA-Sb-2005 is provided in Tables 1 through 8 of this attachment.

Table 9 lists those SRs from the PRA Standard that have been identified in the TMRE Guidance Document as being applicable to the TMRE PRA. A systematic review of these SRs relative to the ANO-2 TMRE model development was performed and documented in the "Additional ANO-2 TMRE Comments" column of Table 9. These SRs are from a later version of the Standard, ASME/ANS RA-Sa-2009 (Reference 6.7).

Enclosure Attachment 2 to 0CAN041904 Page 4 of 56 The peer review generated 59 F&Os: 33 Findings and 26 Suggestions. All of these F&Os are listed in Table 10, below; each was assigned an MCR. The status of each MCR is also documented in this table. All of the F&Os are considered closed with the exception of six suggestions and five findings which have been deferred to the next update. The five findings are related to LERF supporting requirements. All meet CC I or higher. Their impact with regard to TMRE is addressed in the MCR Status column.

5.0 Conclusions on PRA Technical Adequacy The information presented herein demonstrates that the ANO-2 PRA technical adequacy and capability evaluations, as well as the maintenance and update processes conform to the ASME/ANS PRA Standard, which satisfies the guidance of RG 1.200, Revision 1. Per Entergy letter 2CAN061406 (Reference 6.10), response to PRA RAI 20 explains that, after a detailed review was performed, the changes in the SR requirements between ASME RA-Sb-2005 and ASME/ANS RA-SA-2009, and changes between RG 1.200, Revision 1 and 2, do not invalidate the ANO-2 peer review or change any of the findings and observations.

Therefore, the ANO-2 internal events PRA model technical capability evaluations described in this report provide a robust basis for concluding that the ANO-2 PRA models are suitable for use in risk-informed applications including the TMRE.

6.0 References 6.1 ASME/ANS RA-Sb-2005, "Addenda to ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, New York, NY, December 2005.

6.2 Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

USNRC, January 2007.

6.3 PRA-A2-01-003, Revision 1, "ANO-2 PSA Level-1 Model 4p02 Summary Report,"

Entergy Operations, Inc., May 2, 2008.

6.4 PRA-ANO2-01, Revision 0, "ANO2 PSA - Summary Report for Model 5p00," Entergy Operations, Inc., July 10, 2015.

6.5 NEI 05-04, Revision 1 (Draft), "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events)," Nuclear Energy Institute, November 2007.

6.6 LTR-RAM-II-08-020, Letter from David Finnicum (Westinghouse) to Bradford Grimmel (Westinghouse), "RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements For The Arkansas Nuclear One, Unit 2 Probabilistic Risk Assessment, Final Deliverable," July 30, 2008.

6.7 ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," American Society of Mechanical Engineers, 2009

Enclosure Attachment 2 to 0CAN041904 Page 5 of 56 6.8 PSA-ANO2-01-PPCR, "Plant and Procedure Change Review (PPCR)", Revision 0, November 2016.

6.9 ENTGANO150-REPT-002, "Arkansas Nuclear One Unit 2 Internal Flooding Probabilistic Risk Assessment Peer Review," Revision 0, April 2017.

6.10 Entergy letter 2CAN061406, "Response to Request for Additional Information Adoption of National Fire Protection Association Standard NFPA-805, Arkansas Nuclear One, Unit 2, Docket No. 50-368, License No. NPF-6," June 2014.

Enclosure Attachment 2 to 0CAN041904 Page 6 of 56 Table 1 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Initiating Events (IE), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification IE-A1 ALL X X IE-A2 ALL X IE-A3 ALL X IE-A3a II X IE-A4 II X IE-A5 ALL X HLR-IE-A IE-A6 II X IE-A7 II X IE-A8 X IE-A9 X IA-10 ALL X IE-A6 II X IE-B1 ALL X IE-B2 ALL X HLR-IE-B IE-B3 II X IE-B4 ALL X IE-B5 ALL X IE-C1 ALL X X IE-C1a ALL X IEC1b ALL X X (IE-C3)

IE-C2 ALL X IE-C3 X IE-C4 ALL X IE-C5 I/II X HLR-IE-C IE-C6 ALL X IE-C7 ALL X IE-C8 ALL X IE-C9 ALL X IE-C10 X IE-C11 I/II X IE-C12 X IE-C13 ALL X X (IE-C15)

IE-D1 X HLR-IE-D IE-D2 ALL X IE-D3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 7 of 56 Table 2 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Accident Sequences (AS), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification AS-A1 ALL X X AS-A2 ALL X AS-A3 ALL X X AS-A4 X X AS-A5 X X HLR-AS-A AS-A6 ALL X AS-A7 III X AS-A8 ALL X AS-A9 III X AS-A10 X X AS-B1 X X AS-B2 X AS-B3 X X HLR-AS-B AS-B4 X AS-B5 ALL X AS-Ba ALL X AS-B6 X X (AS-B7)

AS-C1 ALL X HLR-AS-C AS-C2 X AS-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 8 of 56 Table 3 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Success Criteria (SC), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SC-A1 ALL X SC-A2 II/III X SC-A3 ALL X HLR-SC-A SC-A4 ALL X SC-A4a ALL X SC-A5 II/III X SC-A6 ALL X SC-B1 II X SC-B2 II/III X X HLR-SC-B SC-B3 ALL X SC-B4 ALL X SC-B5 ALL X SC-C1 ALL X HLR-SC-C SC-C2 ALL X SC-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 9 of 56 Table 4 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SY-A1 ALL X SY-A2 ALL X SY-A3 ALL X SY-A4 X X SY-A5 ALL X SY-A6 ALL X SY-A7 I/II X SY-A8 X SY-A9 X SY-A10 ALL X SY-A11 ALL X X (SY-A10)

SY-A12 ALL X X (SY-A11)

HLR-SY-A SY-A12a ALL X SY-A12b ALL X X (SY-A13)

SY-A13 ALL X X (SY-A14)

SY-A14 ALL X X (SY-A15)

SY-A15 I/II X X (SY-A16)

SY-A16 ALL X X (SY-A17)

SY-A17 ALL X SY-A18 ALL X SY-A18a ALL X SY-A19 ALL X SY-A20 II X SY-A21 ALL X SY-A22 ALL X SY-B1 II/III X SY-B2 I/II X SY-B3 ALL X SY-B4 ALL X HLR-SY-B SY-B5 ALL X SY-B6 ALL X SY-B7 II X X SY-B8 X X SY-B9 X

Enclosure Attachment 2 to 0CAN041904 Page 10 of 56 Table 4 (Continued)

ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for System Analysis (SY), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification SY-B10 ALL X SY-B11 II/III X SY-B12 ALL X HLR-SY-B SY-B13 ALL X (continued)

SY-B14 ALL X SY-B15 ALL X X (SY-B14)

SY-B16 ALL X X (SY-B15)

SY-C1 ALL X HLR-SY-C SY-C2 ALL X SY-C3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 11 of 56 Table 5 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Human Reliability (HR), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification HR-A1 ALL X HLR-HR-A HR-A2 ALL X HR-A3 ALL X HR-B1 II/III X HLR-HR-B HR-B2 ALL X HR-C1 ALL X HLR-HR-C HR-C2 I X HR-C3 ALL X HR-D1 ALL X HR-D2 II X HR-D3 I X HLR-HR-D HR-D4 ALL X HR-D5 ALL X HR-D6 X HR-D7 II/III X HR-E1 ALL X HR-E2 ALL X HLR-HR-E HR-E3 II/III X X HR-E4 II/III X X HR-F1 III X HLR-HR-F HR-F2 III X HR-G1 III X HR-G2 ALL X HR-G3 II/III X HR-G4 III X HLR-HR-G HR-G5 III X X HR-G6 X HR-G7 ALL X X HR-G8 X HR-G9 X HR-H1 II X X HLR-HR-H HR-H2 ALL X X HR-H3 ALL X HR-I1 ALL X HLR-HR-I HR-I2 ALL X HR-I3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 12 of 56 Table 6 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Data Analysis (DA), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification DA-A1 ALL X X DA-A1a X HLR-DA-A DA-A3 ALL X DA-A4 ALL X DA-B1 II X HLR-DA-B DA-B2 II X DA-C1 ALL X DA-C2 ALL X DA-C3 ALL X DA-C4 ALL X DA-C5 ALL X DA-C6 ALL X DA-C7 II/III X DA-C8 X HLR-DA-C DA-C9 III X DA-C10 I X DA-C11 ALL X DA-C11a ALL X DA-C12 I X DA-C13 ALL X DA-C14 ALL X DA-C15 X DA-D1 III X DA-D2 X DA-D3 III X DA-D4 II/III X HLR-DA-D DA-D5 II X DA-D6 II X DA-D6a X DA-D7 III X DA-E1 ALL X HLR-DA-E DA-E2 ALL X DA-E3 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 13 of 56 Table 7 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for Quantification (QU), ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification QU-A1 ALL X QU-A2a ALL X HLR-QU-A QU-A2b II X QU-A3 ALL X QU-A4 ALL X X (QU-A5)

QU-B1 ALL X QU-B2 ALL X QU-B3 ALL X QU-B4 ALL X QU-B5 ALL X HLR-QU-B QU-B6 ALL X QU-B7a ALL X QU-B7b ALL X QU-B8 ALL X QU-B9 ALL X QU-C1 ALL X HLR-QU-C QU-C2 ALL X QU-C3 ALL X QU-D1a ALL X QU-D1b ALL X QU-D1c ALL X HLR-QU-D QU-D3 I X QU-D4 ALL X X (QU-D5)

QU-D5a II/III X QU-D5b ALL X X (QU-D7)

QU-E1 ALL X X QU-E2 ALL X X HLR-QU-E QU-E3 II X QU-E4 II X X QU-F1 ALL X QU-F2 ALL X QU-F3 II/III X HLR-QU-F QU-F4 X QU-F5 ALL X QU-F6 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 14 of 56 Table 8 ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE),

ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification LE-A1 ALL X LE-A2 ALL X LE-A3 ALL X HLR-LE-A LE-A4 ALL X LE-A5 ALL X LE-A1 ALL X LE-B1 II X HLR-LE-B LE-B2 II X LE-B3 ALL X LE-C1 II X LE-C2a II/III X LE-C2b I X X (LE-C3)

LE-C3 II X LE-C4 II X LE-C5 ALL X HLR-LE-C LE-C6 ALL X LE-C7 ALL X LE-C8a I X LE-C8b X LE-C9a I X LE-C9b I X LE-C10 I X LE-D1a II X LE-D1b I X LE-D2 X HLR-LE-D LE-D3 I X LE-D4 II X LE-D5 II X LE-D6 I X LE-E1 ALL X LE-E2 II X HLR-LE-E LE-E3 II X LE-E4 X

Enclosure Attachment 2 to 0CAN041904 Page 15 of 56 Table 8 (continued)

ANO-2 Assessment of Supporting Requirement (SR) Capability Categories for LERF Analysis (LE),

ASME/ANS RA-Sb-2005 as endorsed by RG 1.200, Rev. 1 Capability Category SR TMRE HLR SR Met Not Met N/A I II III Clarification LE-F1a II/III X LE-Fb ALL X HLR-LE-F LE-F2 II X LE-F3 ALL X LE-G1 ALL X LE-G2 ALL X LE-G3 II/III X HLR-LE-G LE-G4 ALL X LE-G5 ALL X LE-G6 ALL X

Enclosure Attachment 2 to 0CAN041904 Page 16 of 56 Table 9 ANO-2 Supporting Requirements (SRs) with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The initiating event analysis shall IE-A provide a reasonably complete identification of initiating events.

TMRE process should ensure Tornado initiating events will be that the initiating events caused consistent with the intervals defined by extreme winds that give rise The only initiating events caused by in the TMRE process. TMRE to significant accident extreme winds that are considered considers all tornadoes will result in sequences and accurately in TMRE were tornados. Only IE-A1 a LOOP. Tornado initiating event 4.3, 6.2 capture the additional risk of the tornados will produce tornado frequencies will be based on a unprotected SSCs (that should missiles. The TMRE process was hazard curve that uses site specific be protected per the CLB) are followed as described.

data provided in Table 6.1 of identified and used for this NUREG 4461 [IE- C1].

application.

For multi-unit sites with shared systems, INCLUDE multi-unit site IE-A10 initiators (e.g., multi-unit LOOP 6.2 .

events or total loss of service water) that may impact the model.

The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

IE-B the requirements for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

Enclosure Attachment 2 to 0CAN041904 Page 17 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments DO NOT SUBSUME multi- unit initiating events if they impact mitigation capability. Two unit sites should consider proximity of each IE-B5 6.2 unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

The initiating event analysis shall The tornado IEFs should be estimate the annual frequency of based on a hazard curve that IE-C each initiating event or initiating uses site-specific data, such as event group. found in NUREG-4461.

Tornado initiating event frequencies will be based on a hazard curve that The TMRE process was followed as IE-C1 4.1 uses site specific data provided in described. No additional comments.

Table 6.1 of NUREG 4461 The TMRE process was followed as Do not credit recovery of offsite IE-C3 Same comment as AS-A10 6.1, Appendix A described. Offsite power recovery power.

was not credited.

The TMRE process was followed as CHARACTERIZE the uncertainty in described. As mentioned, the tornado initiating event NUREG 4461, Tornado Climatology, frequencies and PROVIDE mean data includes uncertainty.

IE-C15 values for use in the quantification of 4.3 Additionally, the R-squared value is the PRA results. NUREG 4461, provided to help characterize the Tornado Climatology, data includes uncertainty of the ANO-2 initiating uncertainty. event best fit interpolated /

extrapolated frequencies.

Enclosure Attachment 2 to 0CAN041904 Page 18 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Utilize the accident sequences (typically LOOP) provided in the AS-A internal events model and adjust as necessary to consider the consequences of a tornado event.

The TMRE process was followed as described. The transient LOOP accident sequence event tree from the internal events model was Modify the internal events accident utilized considering the AS-A1 sequences in compliance with this 6.1, 6.3, 6.4, 6.5 consequences of a tornado event.

SR SSCs are not credited in accordance with the TMRE process.

Operator actions are adjusted as necessary according to the TMRE process.

Review the FPIE success criteria and modify the associated system The TMRE process was followed as AS-A3 models as necessary to account for 6.1, 6.3, 6.4, 6.5 described. SSCs are not credited in the tornado event and its accordance with the TMRE process.

consequences.

Review the FPIE success criteria The TMRE process was followed as and modify the associated operator described. Operator actions are AS-A4 actions as necessary to account for 6.4 adjusted as necessary according to the tornado event and its the TMRE process.

consequences.

Enclosure Attachment 2 to 0CAN041904 Page 19 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The TMRE process was followed as Modify the FPIE accident sequence described. The transient LOOP model in a manner that is consistent accident sequence event tree from with the plant-specific system design, the internal events model was EOPs, abnormal procedures, and utilized consideriing the plant transient response. Account AS-A5 6.1, 6.3, 6.4, 6.5 consequences of a tornado event.

for system functions that, as a Certain exposed SSCs are not consequence of the tornado event, credited in accordance with the will not be operable or potentially TMRE process. Operator actions degraded, and operator actions that are adjusted as necessary will not be possible or impeded.

according to the TMRE process.

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative Capability Category I. In modifying approach can be justified. Use the accident sequence models, The TMRE process was followed as of conservative assumptions in INCLUDE, for each tornado initiating described. Active components not the base model can distort the event, INDIVIDUAL EVENTS IN THE in Cat I structures are not credited in results and may not be ACCIDENT SEQUENCE 6.3, 7.2.3, accordance with the TMRE process.

AS-A10 conservative for delta CDF/LERF SUFFICIENT TO BOUND SYSTEM Appendix A This conservative assumption can calculation. While use of OPERATION, TIMING, AND distort the delta CDF/LERF. A conservative or bounding OPERATOR ACTIONS specific sensitivity was performed to assumptions in PRA models is NECESSARY FOR KEY SAFETY address that possibility.

acceptable, a qualitative or FUNCTIONS.

quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

Enclosure Attachment 2 to 0CAN041904 Page 20 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Dependencies that can impact the ability of the mitigating systems to AS-B operate and function shall be addressed.

For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the The TMRE process was followed as extent of the impact. INCLUDE the described. Impacts on mitigating AS-B1 impact of initiating events on 6.1, 6.3, 6.5, 6.6 systems were included for all mitigating systems in the accident modeled tornado initiating events.

progression either in the accident sequence models or in the system models.

The TMRE process was followed as IDENTIFY the phenomenological described. Unique weather conditions created by the accident phenomena such as intense rain progression. Consider concurrent could be an issue during tornado impacts related to tornado missiles initiating events for structures that (e.g., the possibility of multiple are not designed to withstand the AS-B3 missile strikes in a given sequence. 5.6, 6.3, 6.4, 6.6 winds. Except as noted above Also high winds and rains after the (AS-A10) active components in tornado event could result in non- Cat I structures were not hazardous conditions (e.g. debris credited in accordance with the and structural instabilities) for actions TMRE process. Operator actions outside the control room. that require travel through non-Cat I structures or areas are not credited.

Enclosure Attachment 2 to 0CAN041904 Page 21 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Review FPIE time phased dependencies to identify model The TMRE process was followed as changes needed to address all the described. Time phased AS-B concurrent system functions failed by 6.1 dependencies were reviewed and the tornado event; e.g. LOOP, no model changes were identified instrument air, fire protectionetc. for the TMRE model.

Do not model offsite recovery.

The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA SC-A shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

Consider impact on both units for the Shared components were included SC-A4 same tornado including the 6.1 in the model.

mitigating systems that are shared.

The systems analysis shall provide a reasonably complete treatment of the causes of system failure and SY-A unavailability modes represented in the initiating events analysis and sequence definition.

Enclosure Attachment 2 to 0CAN041904 Page 22 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The TMRE process was followed as described. Walkdowns were performed focusing on targets vulnerable to tornado missiles. The Capability Category II. Walkdowns results were recorded in the focusing on targets vulnerable to walkdown report. The walkdowns tornado missiles will be performed.

also surveyed the plant for the SY-A4 Walkdown will include a missile Section 3 missile inventory. Pathways for inventory and a review of pathways operator x-control room actions available to the operators for were discussed with the site ex-control room actions.

personnel; however, operator actions that require travel through non-Cat I structures or areas are not credited.

New basic events will be added to The TMRE process was followed as address all the failure modes of the described. New basic events and system targets exposed to tornado flags were added to address all the SY-A11 missiles; safety related and non- 6.3, 6.5, 6.6 failure modes of the safety related safety related. The exclusions of system targets exposed to tornado SY-A15 do not apply for SSCs missiles in accordance with the impacted by tornado missiles. TMRE process.

Enclosure Attachment 2 to 0CAN041904 Page 23 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile The TMRE process was followed as verses crimped unless it can be SY-A12 5.2 described. No additional comment shown this is true for all missiles at for the TMRE model.

all speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

The TMRE process was followed as described. Targets potential to cause a flow diversion when struck Consider the targets potential to by a tornado missile were SY-A13 cause a flow diversion when struck 8.5 considered. Beyond steam breaks by a tornado missile.

around main steam lines, no additional flow diversions were required to be modeled.

Missile targets will be assessed for 6.5 The TMRE process was followed as all failure modes - some new failure described. SSCs were assessed for modes may be identified that are all failure modes.

SY-A14 not in the FPIE model. The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

Enclosure Attachment 2 to 0CAN041904 Page 24 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected according to the CLB and any The TMRE process was followed as unprotected targets that are not described. The failure by tornado in the CLB but are in the PRA missiles was included in the model The failure of SSCs due to tornado model. This is to facilitate for all unprotected targets that are SY-A15 missiles shall not use the exclusions 6.5 sensitivity studies regarding supposed to be protected according of SY-A15.

possible correlation of tornado to the CLB and any unprotected missile damage across systems. targets that are not in the CLB but It is not expected that the are in the PRA model.

number of basic events added to the model for this analysis will be so large that this screening is necessary.

Certain post initiator HFEs will be The TMRE process was followed as SY-A17 modified to account for the tornado 4.4 described.

event.

The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for quantification of CDF SY-B and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Enclosure Attachment 2 to 0CAN041904 Page 25 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Capability Category I. BASE The TMRE process was followed as support system modeling on the use described. The systems analysis of CONSERVATIVE SUCCESS from the internal events was the CRITERIA AND TIMING.

SY-B7 Same comment as AS-A10 5.2.3 foundation for the TMRE model.

Sensitivity studies will be performed Credit given to available PRA SSCs to identify where conservative was in accordance with the TMRE assumptions may be distorting risk process.

and adjusted accordingly.

Consider spatial relationships The TMRE process was followed as between components to identify described. Correlation was correlated failures. Where the SY-B8 5.6 considered where the same missile same missile can impact targets can impact targets that are in close that are in close proximity to each proximity to each other.

other.

The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile Statistical correlation of tornado damage for specially separated missile damage between redundant components is insignificant. There are no deviations taken from SY-B14 Appendix B.4.4 and spatially separated components Until that information is reviewed the TMRE guidance document.

is NOT required. and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

The TMRE process was followed as INCLUDE new operator interface described. No new operator SY-B15 dependencies across systems or 6.4 interface dependencies across trains related to the tornado event. systems or trains were identified in the TMRE model development.

Enclosure Attachment 2 to 0CAN041904 Page 26 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments A systematic review of the relevant procedures shall be used to identify HR-E the set of operator responses required for each of the tornado accident sequences The TMRE process was followed as described. Operator interviews for the credited actions were performed Operators will be interviewed (if during the development of the necessary) to assess the need for HR-E3 6.4 internal events model that the TMRE changes to operator actions for the model is based on. Furthermore, tornado initiating events.

during the TMRE development an ANO-2 SRO was consulted for further considerations.

HR-E4 Operators talk- throughs or simulator observations will be conducted (if necessary) to assess The TMRE process was followed as the need for changes to operator described. Operator interviews/ talk actions for the tornado [Note: this throughs for the credited actions applies to new sequences or failure 6.4 were performed during the combinations not accounted for in development of the model that the the internal events model. It is not TMRE model is based on.

intended that operator action timing needs be changed due to the tornado event alone].

Enclosure Attachment 2 to 0CAN041904 Page 27 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the plant-specific and HR-G scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

Operators will be interviewed and simulator observations conducted (if necessary) to assess the need for The TMRE process was followed as changes to operator action timing described. Operator interviews / talk as a result of the tornado event.

throughs for the credited actions

[Note: this applies to new HR-G5 6.4 were performed during the sequences or failure combinations development of the internal events not accounted for in the internal model that the TMRE model is events model. It is not intended that based on.

operator action timing needs be changed due to the tornado event alone]

HR-G7 Dependencies will be recalculated 6.4 The TMRE process was followed as when the model is quantified or described. No new combinations modified by inspecting cutsets. were created or credited.

Enclosure Attachment 2 to 0CAN041904 Page 28 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and HR-H feasible for those scenarios to which they are applied. Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

Do not credit recovery actions to restore functions, systems, or The TMRE process was followed as components unless an explicit basis described. Recovery actions to HR-H1/H2 6.4 accounting for tornado impacts on restore functions, systems, or the site and the SSCs of concern is components were not credited.

provided.

Each parameter shall be clearly defined in terms of the logic model, DA-A basic event boundary, and the model used to evaluate event probability.

The TMRE process was followed as described. New basic events and flags were added to address all the Develop new basic events for failure modes of the safety related DA-A1 tornado missile targets (all failure 8.3, 8.5, 8.6 and non-safety related system modes) in accordance with this SR.

targets exposed to tornado missiles in accordance with the TMRE process.

Enclosure Attachment 2 to 0CAN041904 Page 29 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The level 1 quantification shall quantify core damage frequency QU-A and shall support the quantification of LERF.

Do not credit recovery actions to restore functions, systems, or The TMRE process was followed as components unless an explicit basis described. Recovery actions to QU-A5 6.4 accounting for tornado impacts on restore functions, systems, or the site and the SSCs of concern is components were not credited.

provided.

Model quantification shall determine QU-C that all identified dependencies are addressed appropriately.

Identify new operator action The TMRE process was followed as dependencies created as a result of described. No new operator actions QU-C1 the changes to the internal events 6.4 or combinations were created or PRA model or failures associated credited.

with tornado events.

The quantification results shall be reviewed, and significant contributors to CDF (and LERF),

such as initiating events, accident sequences, and basic events QU-D (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

Enclosure Attachment 2 to 0CAN041904 Page 30 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments The TMRE process was followed as Review nonsignificant cutset or described. Cutsets were reviewed QU-D5 sequences to determine the 7.3 including significant and non-significant sequences are valid cutsets to ensure the sequences are valid.

The TMRE process was followed as Review BE importance to make described. BE importances were QU-D7 7.3 sure they make logical sense. reviewed to ensure they make logical sense.

Uncertainties in the PRA results shall be characterized. Sources of model uncertainty and related QU-E assumptions shall be identified, and their potential impact on the results understood.

7.1, Also see Identify sources of uncertainty The TMRE process was followed as QU-E1 Appendices A and B related to MIP and missiles described.

for bases.

Identify assumptions made that are The TMRE process was followed as QU-E2 different than those in the internal Section 6 described.

events model The TMRE process was followed as Identify how the model uncertainty described. Assumptions related to MIP QU-E4 is affected by assumptions related 7.1, Appendix A and missiles unique to ANO-2 are to MIP and missiles described in an Entergy report.

The accident progression analysis shall include identification of those The TMRE process was followed as LE-C 7.1, 7.3 sequences that would result in a described. No additional comments.

large early release.

Enclosure Attachment 2 to 0CAN041904 Page 31 of 56 Table 9 ANO-2 SRs with Unique TMRE Considerations (continued)

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional Requirements Requiring Self-Assessment (No comments if blank) Addressing SR ANO-2 TMRE comments Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, 6.3, 7.2.3, The TMRE process was followed as LE-C3 systems, or components unless an Same comment as AS-A10 Appendix A described. No additional comments.

explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for Multiple each HLR. The documentation The TMRE process was followed as Section 8 SRs should be sufficient to described. No additional comments.

understand basis and facilitate review. Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Enclosure Attachment 2 to 0CAN041904 Page 32 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG 1.200 Peer Review F&O IE-C3-01, Finding Issue: ANO2 explicitly calculated the total reactor critical years as total reactor critical hours divided by 8766 hours0.101 days <br />2.435 hours <br />0.0145 weeks <br />0.00334 months <br /> per year and used this to calculate the Initiating Events Frequencies (IEFs). However, there This issue was is no evidence that ANO2 adjusted Data sheets were set up to resolved and therefore A2-3093 Resolved IE-C3 these IEFs to reflect average plant automatically adjust for capacity has no impact on availability. This is, in essence, factor. Documented in IE Notebook TMRE.

equivalent to assuming that the plant operates at full power all year. ANO2 needs to adjust their initiating event frequencies to account for average plant availability.

Adjust the initiating event frequencies to account for the average plant availability.

RG 1.200 Peer Review F&O IE-C10-01, Finding No comparison of results to generic data sources was provided with a discussion and explanation of the This documentation Table 13 of PSA-ANO2-01-IE differences. This is a requirement to issue was resolved A2-3094 Resolved IE-C10 compares the IE frequencies to meet IE C-10 and is important to and therefore has no generic values.

assessing the validity of the initiating impact on TMRE.

event frequency results. The ISLOCA IEF needs to be reviewed, compared and understood. This IEF value is very low.

Enclosure Attachment 2 to 0CAN041904 Page 33 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Compare the results to the generic A2-3094 values in NUREG/CR-5750 and (continued) NUREG/CR-6928, and provide and explain any significant differences.

RG1.200 Peer Review F&O IE-C12-01, Also affects SR LE-D3, Finding Some of the components in the In addition to the comment in this ISLOCA fault tree model appear to MCR, the peer review team have incorrect mission times. The mentioned that the failure rate should Low Pressure Safety Injection (LPSI) be based on Large Internal Leakage Motor Operated Valve (MOV), e.g. rather than Large External Leakage.

2CV5017 rupture, has a mission time Therefore, the probability of Type of 36 hrs. However, the mission time Code MVG V 2 is changed from should probably be 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> 1.0E-09/hour to 3.0E-09/hour and the This issue was IE-C12 because the MOV rupture is not likely probability of Type Code CVG V 2 is resolved and therefore A2-3095 Resolved changed from 2.0E-09/hour to 3.0E-LE-D3 to be annunciated in the control room has no impact on as assumed. Therefore, it could 08/hour. TMRE.

potentially be in an undetected failed Based on a review of the ISLOCA state for an extended period. The events, the mission times for several same comment may apply to the events were changed from 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> second check valve. It could be to 18 months.

potentially in an undetected failed In addition, the initiator events were state for an extended period. changed to EQU gates with new Reconsider and change the mission events tied to the Type Code file.

times for the time the downstream valves can be in an undetected state.

Enclosure Attachment 2 to 0CAN041904 Page 34 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O IE-D1-01, Finding Some of the documentation is not adequate to meet this requirement. (1) The updated data split reactor trip The following items should be and turbine trip events using RADS addressed: database.

(1) What is the basis for the 80/20 (2) The success criteria notebook split between reactor trip and turbine provides documentation of the small trip events? (Assumption 8, Section and medium LOCA equivalent break 2.2 and Section 5.1 page 19). size (2) Where is the documentation for (3) The value based on IEFT the small and medium break sizes Appendix C is different from the that are used in the model? The number based on actuarial This issue was lower limit for the large LOCA break calculation. Compensator BE to resolved and therefore A2-3096 Resolved IE-D1 size has a reference (see Table 2). adjust the IEFT estimation is used to has no impact on (3) Appendix C contains calculations equalize the IEFT result with the TMRE.

for loss of feedwater/condensate (T2). actuarial calculation. Provided Page 48 contains the Bayesian discussion on this.

update for this event. Recommend (4) %T500 is documented in LOSP explaining how these are used in the notebook draft ECH-NE-12-00099.

PRA model and which is used in the The update for %T500 includes data base model. The value in Table 7 up to 2011. %TST3 (Startup appears to be from the Bayesian Transformer 3 fails as an Initiating update which is inconsistent with the Event) is documented in the updated discussion in Section 5.3.1. IE notebook draft.

(4) Table 7: Its not clear where the frequencies for T500KV and TST3 come from. This should be explained.

Enclosure Attachment 2 to 0CAN041904 Page 35 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application (5) The RR file with the quantification information contains frequencies for the following events that are not in the (5) T3SD, T3SW, TSDCA, IE documentation: T3SD, T3SW, TSDCAML, TSDCB, TSDCBML, TSDCA, TSDCAML, TSDCB, TSDCISO are not in the mitigating TSDCBML, TSDCISO, V5+, and VS+. model so this is out of scope. V5+

A2-3096 and VS+ are documented in the (6) Loss of Lake Dardanelle IE - need updated IE Notebook. All events (continued) to document the change from except T3SW are part of the 2E-04/yr to 1E-05/yr - it should be Shutdown PSA for ANO-2. T3SW is explained how the IE frequency for documented in PSA-ANO2-01-IE-01 this event was reduced to 1E-05/yr.

(6) See MCR A2-4697.

Provide documentation for the above six items.

RG1.200 Peer Review F&O AS-A4-01, Finding Even though some operator actions required to achieve the identified success criteria are mentioned in portions of the initiating event This issue was Operator actions were included in the analyses, these operator actions are resolved and therefore A2-3099 Resolved AS-A4 Success Criteria and Accident not consistently identified and has no impact on Sequence notebooks documented. Entergy should TMRE.

explicitly identify all operator actions needed to achieve the success criteria for each of the key safety functions defined for the modeled initiating events.

Enclosure Attachment 2 to 0CAN041904 Page 36 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O AS-A5-01, Finding There is no reference to the System design, Emergency Operating Procedures (EOPs), or abnormal This issue was EOPs and AOPs are documented in procedures in the accident sequence resolved and therefore A2-3100 Resolved AS-A5 related tables in the Success Criteria notebook. It would be helpful if the has no impact on Notebook EOP or abnormal procedure used for TMRE.

each accident sequence was noted.

Add a table showing the EOPs or abnormal procedures used for each accident sequence.

RG1.200 Peer Review F&O AS-A10-01, Finding The operation actions are not specified in either the accident Operator actions were included in the sequence detailed description or the Success Criteria and Accident This issue was event tree. An example would be a Sequence notebooks. Detailed resolved and therefore A2-3101 Resolved AS-A10 detailed discussion of the once discussions regarding operator has no impact on through cooling and the operator actions are found in the HRA TMRE.

actions required. notebook.

Specify the operator actions in either the accident sequence detailed description RG1.200 Peer Review F&O AS-B1-01, Finding This issue was A table was added to the Accident resolved and therefore A2-3102 Resolved AS-B1 The special initiators do not address Sequence notebook to address the has no impact on the impact of these initiators on the issue.

TMRE.

mitigating systems.

Enclosure Attachment 2 to 0CAN041904 Page 37 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Proposed resolution as depicted in ILRT extension RAI to NRC:

ANO-2 uses a linked fault tree approach where the initiating events A2-3102 are placed in the tree with the appropriate system model. A table (continued) will be added to the accident sequence report to show how the IE fails both the front line and support systems. This finding will not impact any applications.

RG1.200 Peer Review F&O AS-B2-01, Finding The Event Trees and discussion address required systems. Operator he dependencies are not addressed This issue was actions and dependencies are in the Accident Sequence notebook. resolved and therefore A2-3103 Resolved AS-B2 included in the HRA notebook.

This is especially true of operator has no impact on System dependencies are actions and how the failure of an TMRE.

documented in the systems operator action would affect notebooks.

subsequent operator actions.

RG1.200 Peer Review F&O AS-B3-01, Finding No assumption or statement is made that plant equipment will perform in A2-3104 Resolved AS-B3 the environment for which it was A2-3104 Resolved designed. There also was no evidence that equipment not specified in the SAR for accident mitigation but still credited in the PRA were reviewed for environmental affects.

Enclosure Attachment 2 to 0CAN041904 Page 38 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application This could be an assumption that the equipment meets the environmental A2-3104 qualification. Equipment that is not (continued) environmentally qualified need to be analyzed on the impact they have on the applicable accident sequence.

RG1.200 Peer Review F&O AS-B6-01, Finding This SR was not met because there was no discussion of the following: changes 20 minutes instead of 40 minutes in environmental conditions, shifting of has been used for RCP running the Condensate Storage Tanks (CSTs), without CCW cooling in AS and and operator actions. Questions were SC notebook.

This issue was raised in that ANO2 uses 40 minutes as 20 Minutes has been used in the resolved and therefore A2-3105 Resolved AS-B6 the time that the Reactor Coolant Pump PRA, updated in the HRA has no impact on (RCP) can run without Component spreadsheets and documented in TMRE.

Cooling Water (CCW) cooling. The the AS and SC notebooks.

industry practice (WCAP-16175) uses 20 Environmental issue was minutes. This difference should be discussed in system analyzed and resolved. documentation.

Discuss the following: changes in environmental conditions, shifting of the CSTs, and operator actions.

RG1.200 Peer Review F&O AS-C2-01, Finding This issue was The documentation does not show that All the items in the SR were resolved and therefore A2-3107 Resolved AS-C2 the items in this SR have been incorporated in the Accident has no impact on addressed. Sequence documentation.

TMRE.

Address all the items in this SR in the assumption section.

Enclosure Attachment 2 to 0CAN041904 Page 39 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Fire PRA walkdowns for NFPA-805 RG1.200 Peer Review F&O are documented in ANO Calculation SY-A4-01, Finding CALC-08-E-0016-01, Appendix D.

While this walkdown documents Walkdowns will need to be performed This issue was some spatial and environmental in order to support National Fire resolved and therefore A2-3116 Resolved SY-A4 impacts due to a fire in the area, the Protection Association (NFPA) 805 has no impact on documentation for internal events is Fire PRA and Flooding initiator. This TMRE.

somewhat different. MCR A2-3119 SR can be accomplished during this addresses the documentation of process. walkdowns and operator interviews for internal events.

The diesel generator air start system is considered part of the emergency RG1.200 Peer Review F&O diesel generator component SY-A8-01, Finding boundary as discussed in This issue was The EDG air start system is included NUREG/CR-6928 and Echelon resolved and therefore A2-3118 Resolved SY-A8 in the component boundary of the Calculation PRA-ES-01-003.

has no impact on EDG for failure rate and common Therefore, the diesel air start basic TMRE.

cause but is still modeled in the fault events will be set to a probability of tree with non-zero probabilities. 0.0 in the ANO-2 database. The events will be retained in the model for EOOS purposes.

System walkdowns and interviews RG1.200 Peer Review F&O were performed during the ANO-2 SY-B8-01, Finding PRA Model 5p00 update and This issue was documented in the system resolved and therefore A2-3119 Resolved SY-B8 No documentation of spatial and notebooks. All PRA systems that are has no impact on environmental hazards assessment normally accessible were physically TMRE.

was found. walked down to assess both special and environmental hazards.

Enclosure Attachment 2 to 0CAN041904 Page 40 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application LKB Comments 9/4/2014 - MCRs MCR A2-5337 documents the plan to A2-2462 and A2-2466 is Resolved to walkdown systems located inside containment. This issue was this MCR due to similar PSA Gap A2-3119 resolved and Resolved SY-B8 Analysis finding. Ensure that any For each walked down system, an (continued) therefore has no additional issues from MCR A2-2462 interview was also conducted with impact on TMRE.

and A2-2466 are addressed as part the responsible system engineer to of this MCR. discuss the state of each system.

A discussion of how the system will respond in harsh environments has been added in the Rev 6 model documentation.

In order to address the generic review/comment, this discussion was RG1.200 Peer Review F&O expanded to state the following:

SY-B15-01, Finding The internal flooding analysis There was no indication in any of the performed walkdowns of the steam three systems reviewed that an and water lines in the plant, and A2-3121 Unresolved SY-B15 identified the PRA credited A2-3121 assessment was completed to determine if the SSCs will be required equipment in each room that was to operate in conditions beyond their potentially susceptible to flooding, environmental qualifications. spray, and a steam environment due to a pipe break in the room. The internal flood analysis includes scenarios that model these impacts specifically, so they are not duplicated in the internal events PRA. Refer to the ANO-2 internal flood analysis for additional details.

Enclosure Attachment 2 to 0CAN041904 Page 41 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application The ability of the system equipment to continue to operate following a loss of HVAC in the areas where system equipment is installed is addressed by either by modeling a loss of HVAC as a failure of the impacted equipment, or justifying the basis for why the equipment is reasonably expected to continue to A2-3121 operate with HVAC. The original bases (continued) for why a loss of HVAC does not fail the equipment in the system is documented in Section #.2.2, if applicable. The success criteria notebook may revise these assumptions if additional room heat-up analyses are performed which provide additional insights into the impact of a loss of HVAC on the system equipment RG1.200 Peer Review F&O HR-C2-01, Finding A review of ANO-2 Condition Reports was CC-I was assessed to be met, but performed. The resulting search yielded there is no direct evidence that ANO2 39 condition reports. The review of these evaluated plant-specific or generic CRs showed most of the events involved This issue was operating experience to check for instruments that were slightly out of resolved and A2-3124 Resolved HR-C2 other pre-initiators. Documentation of calibration. Other events resulted in therefore has no a review of plant specific information equipment that remained Operable and impact on TMRE.

or industry Licensee Event Reports thus would not be PSA Applicable. The (LERs) from other similar plants and CR review spreadsheet is included in App incorporating this information into the I of PSA-ANO2-01-HR.

HRA assessment is required to receive a CC-II/III rating.

Enclosure Attachment 2 to 0CAN041904 Page 42 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Incorporate an assessment of the A2-3124 plant-specific or generic operating Resolved HR-C2 (continued) experience information into the HRA assessment.

A review of quality of ANO-2 procedures was performed. A review of Condition Reports identified two condition reports associated with procedure quality.

CR-ANO-C-2009-00716 and CR-ANO-C2010--01876 were written to correct issues with RG1.200 Peer Review F&O procedure quality.

HR-D3-01, Finding CR-ANO-C-2009-00716 is based on Not assessed consistent with CC II an INPO Area for Improvement and since the evaluation does not provide includes more than 200 corrective actions that have been completed. This issue was an assessment of the quality of the CR-ANO-C-2010-01876 provides 4 resolved and therefore A2-3125 Resolved HR-D3 procedures or the quality of the recommendations from an INPO has no impact on human-machine interface.

Assist Visit that resulted in an TMRE.

Provide an assessment of the quality of the procedures and the human- additional 31 corrective actions.

machine interaction. If this has been Text was added to the HRA done, provide the documentation. Notebook regarding general procedure quality. A discussion was also added to the section on Quantification Using the Cause-Based Approach to highlight that it does consider specific aspects of the quality of the procedures (in decision trees e-g) and human-machine interface (in decision trees a-d).

Enclosure Attachment 2 to 0CAN041904 Page 43 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O A conversion formula was added to HR-D6-01, Finding the bottom of each of the individual ANO2 uses the HRA Toolbox for hfe_a events and to the a_template quantifying their pre-initiator HEPs. templates in the HRA Toolbox so that For the pre-initiator HEPs, ANO2 future pre-accident HRAs will have basically uses the ASEP approach the conversion from medians to means. This issue was and treats the ASEP Basic HEPs as resolved and therefore A2-3126 Resolved HR-D6 means with the associated error The median to mean conversion is has no impact on factors. However, as defined on page shown in cell I64 and the mean TMRE.

xv of NUREG/CR-4772, the ASEP probability is shown in cell F64. In BHEP values are medians for a log- addition, cell AH41 was changed to normal distribution. Thus, the equal F64 to provide the mean value treatment of the BHEP values for the to the hfe_summary.xls.

pre-initiators is mathematically The values are changed in incorrect. PRA-A2-01-003S03, Revision 2.

RG1.200 Peer Review F&O HR-G6-01, Finding This SR requires a check of consistency of the post-initiator HEP quantification. This requires a review This issue was HRA events were reviewed for of the HFEs and their final HEPs resolved and therefore A2-3127 Resolved HR-G6 consistency and was documented in relative to each other to check their has no impact on the HRA notebook.

reasonableness. There is no TMRE.

evidence that this consistency check has been done. If done this should be documented, if not done this should be completed.

Enclosure Attachment 2 to 0CAN041904 Page 44 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application This can be addressed by adding an explicit process for reviewing the HEPs for internal consistency with respect to scenario, context, procedures and timing.

Specifically this can evaluate the HEPs with respect to certain expected patterns such as increasing HEPs with decreasing time available, increasing HEPs A2-3127 with increasing stress levels, and (continued) increasing HEPs with increasing complexity of the procedures for accomplishing the desired successful outcome. A statement that such an evaluation was performed and, where there were deviations from the expected patterns and either provides a basis for the deviation or what was done to correct it.

RG1.200 Peer Review F&O HR-G9-01, Finding The execution errors in hfe_cp.xls are This requires the use of means shown in cells CC16:CC61. These values This issue was values. NUREG-1278 contains are medians. To convert to means, the resolved and A2-3128 Resolved HR-G9 median values that do not appear median values were moved to cells therefore has no to be converted to means before CE16:CE61. The error factors from impact on TMRE.

being used in the ANO2 PRA. For NUREG/CR-1278 were added in cells example, spread sheet used for CF16:CF61.

HRA at ANO2.

Enclosure Attachment 2 to 0CAN041904 Page 45 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Cells CC16:CC61 are changed to

=CE??*EXP(POWER(1/1.645*LN(K6 1),2)/2) where ?? is the associated median value in the accompanying CE cell. This change was made in all hfe_cp worksheets including A2-3128 cp_template, in the HRA Toolbox, (continued) which will ensure that future procedural operator actions will be calculated based on means rather than medians. The values are changed in PRA-A2-01-003S03, Revision 2 RG1.200 Peer Review F&O DA-A1a-01, Finding Boundary developed for EDG starting air was outlined in PRA-ES-01-003 included the start air system inside Starting air basic events were set to This issue was the component boundary. The 0.0 in basic event file but left in resolved and therefore A2-3129 Resolved DA-A1a CAFTA model had the starting air model to allow EOOS modeling if has no impact on modeled with Basic Events (BEs) set needed. TMRE.

greater than zero, effectively placing the starting air outside the component boundary. See F&O SY-A8-01 for details.

Enclosure Attachment 2 to 0CAN041904 Page 46 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O DA-C10-01, Finding CAT I given based on information listed in Procedure PRA-A2-01-003S05 does not address decomposing the component failure mode into sub-elements (or causes) that are fully tested, then using tests that exercise specific sub-elements in their evaluation. Documented in the Data Analysis This issue was May be over-counting demands and Notebook. Data provided addresses resolved and therefore A2-3130 Resolved DA-C10 run-hours for component boundaries the component boundaries and re- has no impact on that are not tested during evolution. testing. TMRE.

Need to review component boundaries and tests counted in data collection to ensure that one sub-element does not have many more successes than another.

Update procedure CE-P-05.07 with process details that ensure the requirements described in CAT II/III are met.

Enclosure Attachment 2 to 0CAN041904 Page 47 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O DA-C12-01, Finding Procedure PRA-A2-01-003S05 addresses evaluating maintenance outage as a function of plant status.

CAT I given since there is no evidence of INTERVIEW the plant maintenance and operations staff to generate estimates of ranges in the Actual plant data were obtained for unavailable time per maintenance act most risk significant unavailability for components, trains, or systems for terms in the model. The other risk which the unavailabilities are significant terms used estimates that significant basis events. As a were provided by the PRA staff and suggestion, need to include interviews the Maintenance Rule Coordinator. This is a and shared equipment between See Section 1.4 and Table 7 of documentation issue A2-3131 Unresolved DA-C12 ANO1 and ANO2 (i.e., air PSA-ANO2-01-DA, Revision 1. and has no impact on compressors) in procedure Procedure CE-P-05.07 has been TMRE.

PRA-A2-01-003S05 superseded by fleet procedure EN-DC-151. In addition, engineering Need to document interviews in order guide EN-NE-G-007 includes to meet Category II/III. guidance to obtain and document Update procedure CE-P-05.07 with data from plant personnel.

process to perform interviews with plant maintenance and operations staff to generate estimates of ranges in the unavailable time per maintenance act for components, trains, or systems for which the unavailabilities are significant basis events. Document interviews.

Enclosure Attachment 2 to 0CAN041904 Page 48 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O IF-A1-01, Finding, Applicable to all IF SRs.

At the time of the peer review, the ANO2 IF analyses had not been completed to the point that it could be reviewed. Entergy intends to use the same IF methodology for all three of An internal flood analysis update was their PWRs with the Waterford-3 plant completed and met standard This issue was being the lead plant. The Waterford-3 requirements. The analysis resolved and therefore A2-3133 Resolved IF-A1 IF analysis had been completed. incorporates updated walkdowns and has no impact on Entergy requested that the peer quantifies scenarios that were TMRE.

review team review the IF screened out in previous revisions.

methodology for Waterford to confirm that the methodology met the standard. Entergy needs to complete the ANO2 IF analyses using the Waterford-3 methodology. Entergy will need to specifically address dual unit issues for ANO1 and ANO2.

RG1.200 Peer Review F&O IF-C2c-01, Finding Flooding documentation forms have input for height above floor, but only Equipment height off floor appears to This issue was filled them in for cases where the be not recorded for most of the resolved and therefore A2-3134 Resolved IF-C2c components might be susceptible to equipment on the walk down sheets. has no impact on inundation from flood sources.

For example, flood area TB-15-250 TMRE.

Therefore, no additional information walkdown sheet on page 460 only 3 needed.

of 26 items listed include a height.

Enclosure Attachment 2 to 0CAN041904 Page 49 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Spatial location in the area (for example height off floor) and any flooding mitigative features (e.g.,

shielding, flood or spray capability ratings) is not recorded for most of A2-3134 the PRA components listed on the (continued) walkdown sheets. Therefore, for a particular flood height in a room, it is not clear whether or not a component is affected. Complete the walkdown sheets.

RG1.200 Peer Review F&O IF-C3-01, Finding The walk down sheets identify the components located inside the flood area. This SR requires that components in a flood area be Flooding documentation forms have identified and include whether the input for height above floor, but only This issue was component is susceptible to failure by filled them in for cases where the resolved and therefore A2-3135 Resolved IF-C3 submergence or spray. The components might be susceptible to has no impact on walkdown sheets are formatted to inundation from flood sources.

TMRE.

allow recording whether or not the Therefore, no additional information component is vulnerable to spray. needed.

Only several walkdown sheets have the column filled out for vulnerability to spray. It is not clear whether blanks indicate not susceptible to spray or not.

Enclosure Attachment 2 to 0CAN041904 Page 50 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application RG1.200 Peer Review F&O IF-D6-01, Finding Operator error contributions to flooding are discussed at a very high level. However, basically the only floods considered were catastrophic failures. The flood scenario frequencies were quantified using generic pipe rupture data and plant-A2-3137 Unresolved IF-D6 A2-3137 Unresolved specific pipe length. The generic flood frequency sources do not include floods caused by human actions during maintenance. While the operator induced floods may be less severe than the catastrophic pipe failure floods, the frequencies will be higher so should be considered explicitly.

RG1.200 Peer Review F&O QU-F4-01, Finding Selection process for determining important assumptions and sources Appendix 1 of the Sensitivity and This issue was of uncertainty was not delineated. Uncertainty includes a review of the resolved and therefore A2-3142 Resolved QU-F4 LKB Comment 9/8/2014 - MCR sources of uncertainty using EPRI has no impact on A2-2464 is closed to this MCR. 1016737. TMRE.

Ensure that the issues from MCR A2-2464 are addressed when closing this MCR.

Enclosure Attachment 2 to 0CAN041904 Page 51 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Status Finding/Observation Disposition Importance to Application Number SR(s)

Minimal or no impact on the RG1.200 Peer Review F&O LE-D1b-01, results since assumptions are Finding The LERF model conservative.

There is no evidence of an evaluation of the and As noted in Table 8, SR LE-D1b impact of the accident progression conditions documentation is (LE-D2 in ASME/ANS RA-Sb-on containment seals, penetrations, etc. The being updated as 2013 and Table 9) is met to CC I.

model this is based on is related to part of the Rev 6 The ANO-02 LERF model is A2-3144 Unresolved LE-D1b NUREG/CR-6595 so consistency with update to include based on NUREG/CR-6595 NUREG/CR-6595 meets CC-I, but there is no impact of accident which meets CC-I. Table 9 does discussion of the accident progression progression not identify any specific TMRE conditions on these elements. Provide a conditions on comments for LE-D2.

discussion or assessment of the accident containment seals, progression conditions on the containment penetrations, etc. This Unresolved F&O does not conditions noted in the SR. impact the PRA quality and has no impact on the TMRE analysis.

RG1.200 Peer Review F&O LE-D6-01, Minimal or no impact on the Finding results.

Containment isolation is addressed by top The LERF documentation and event (question) 3. This is based on a calc system notebooks and model are that is noted not to have been maintained up being updated as part of the to date. Since it has not been maintained up- Containment Rev 6 model revision.

to-date, there is no confidence that the isolation model is As noted in Table 8, SR LE-D6 analysis represents a realistic assessment; currently being (LE-D7 in ASME/ANS RA-Sb-A2-3145 Unresolved LE-D6 therefore, this does not meet CC II. updated as part of 2013 and Table 9) is met to CC I.

The containment isolation calc needs to be the Rev 6 model The ANO-02 LERF model is updated or demonstrated (confirmed) to be up update based on NUREG/CR-6595 to date. This should include an assessment which meets CC-I. Table 9 does of the containment penetrations to provide an not identify any specific TMRE assessment of the total number of comments for LE-D7. Therefore, penetrations required to provide a realistic this open item has no impact on evaluation of containment isolation reliability. the TMRE analysis.

Enclosure Attachment 2 to 0CAN041904 Page 52 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Fixed recovery file for LERF to deal with potentially dependent HEP combinations. About 5 new HEP dependency combinations were RG1.200 Peer Review F&O identified and entered in the HRA tool LE-E4-01, Finding box using the method of iterative review of the top 100 cutsets.

Although the majority of the SR requirements in these three top high Assumption 35 was added to the level requirements are met, there is LERF notebook that states the no indication that dependencies following:

between multiple HFEs have been "Assumption: HRA dependencies addressed. The Level 1 assessment among Level 1 and Level 2 human A2-3147 Resolved LE-E4 completed an evaluation of the failure events and among multiple A2-3147 dependencies between human Level 2 human failure events does actions in the model. A similar not require additional modeling.

analysis should be completed for the Justification: The Level-1 and Level-2 human actions in the Level 2 operator actions were assumed to be analyses and between the Level 2 independent, because they are and Level 1 analyses to ensure all performed by different plant HEP dependencies are identified and personnel and at different plant addressed appropriately. conditions and are separated by time. Dependencies between Level-2 operator actions were also assumed to be independent of each other.

Enclosure Attachment 2 to 0CAN041904 Page 53 of 56 Table 10 ANO-2 PRA Peer Review Facts and Observations from Letter LTR-RAM-II-08-020 (Reference 6.6) (continued)

Status as of 12/13/2017 MCR Applicable Importance to Status Finding/Observation Disposition Number SR(s) Application Most of the Level 2 operator actions are included in the split fraction for various Level 2 phenomena; these phenomenological events are conservatively modeled based on the uncertainty of post-core damage A2-3147 activities. Those that are explicitly (continued) modeled were judged to be independent, because they address unique plant conditions or phenomena. The dependence between operator actions is included in the uncertainty of the Level 2 split fractions."

RG1.200 Peer Review F&O LE-F1b-01, Finding Minimal or no impact There is no documented evidence on the results. This is that ANO2 compared their LERF a documentation issue A2-3148 Unresolved LE-F1b results to the results of other similar only. This Unresolved plants to confirm the reasonableness F&O does not impact of the results with respect to relative TMRE.

contribution and frequency and ranking of contributors.

Enclosure Attachment 2 to 0CAN041904 Page 54 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 MCR EC or Description of Change Impact on TMRE Application Number Procedure B5b actions/equipment can potentially be credited in the model to provide an alternate feedwater and Refueling Water Tank / Borated Water Storage Tank This modification involves use of (RWT/BWST) makeup from the B5b portable fire pump. By having an equipment that is stored in non-additional pump to Emergency Feedwater / Auxiliary Feedwater (EFW/AFW) Cat 1 structures and vulnerable to for long term scenarios can provide some benefit for those scenarios. tornado missiles. However, Also procedure SDS-007, Change 002, contains the following statement that implementation of the modification could add additional actions in the PRA: IF Unit 1 has AC power, THEN would potentially lower CDF/LERF A2-4934 OP-2202.008 consider performing Security Event (OP-1203.048), Attachment G, Cross-Tying for both the compliant and 4160 V Busses Between Units. degraded TMRE cases. Since the Blackout Procedure 2202.008, Rev. 12, provides a reference to OP-1203.048 equipment is vulnerable in both for supplying power from Unit 1 to Unit 2 via 2A9. Once procedure cases, delta CDF and LERF is OP-1203.048 is reviewed, there may be additional actions that can provide unlikely to change from the current enhancement to the PRA model. For crediting B5b equipment/procedures, base case.

reference to the security procedure, Security Event (OP-1203.048).

Event occurred documented in CR-ANO-1-2009-0225 where reactor was tripped due to air intrusion into the Intermediate Cooling Water (ICW) system The ICW pumps as well as the as a result of a blown gasket on the Service Air (SA) compressor C-3A. service and instrument air Resulted in a loss of cooling water to Control Rod Drive motors. Root Cause compressors rely on offsite power A2-5242 EC-35406 Evaluation determined original system design was inadequate in the Unit 1 SA which is assumed lost for the compressors. This change will result in the removal of Unit 1 Compressors TMRE models. Therefore, this C-2A, C-2B, C-3A and C-3B. This change impacts the Unit 2 Instrument Air item would have no impact on the (IA) via the cross-tie with Unit 1. Incorporate the changes from these MCRs in TMRE application.

the Unit 2 model.

The service and instrument air EC-58330 and EC-58331 are proposed to replace the existing IA compressors compressors rely on offsite power EC-58330 & with more robust compressors. Check valves (2IA-1A, 2IA-1B) will be removed which is assumed lost for the TRE A2-5410 58331 in these ECs since there will be internal check valves (2IA-401A/B) that are models. Therefore, this item already included which are modeled. would have no impact on the TMRE application.

Enclosure Attachment 2 to 0CAN041904 Page 55 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 (continued)

MCR EC or Description of Change Impact on TMRE Application Number Procedure This modification has to the potential to lower the TMRE CDF/LERF results. While these tanks may survive global wind and Associated with Diverse and Flexible Coping Strategies (FLEX), and tornado missile forces credit for the actions applying RG 1.76, Rev. 1, to the qualified condensate storage tank within one hour is not allowed. Use of the (QCST), BWST, and RWT for FLEX strategy. This EC calculates the equipment beyond one hour requires the A2-5773 EC-54590 duration of time the QCST/BWST/RWT are available post the initiation of initial success of equipment for which the a beyond-design-basis-external-event. The time available can be used equipment would be used. Because the by the success criteria calculation to determine when/how to credit these PRA model does not include such time strategies.

phasing, modelling of these items is not possible and, therefore, this item would have no impact on the TMRE application.

ANO2 Auxiliary Building High Energy Line Break (HELB) analysis. This analysis can be used in the PRA to identify which PRA modeled This modification is intended for HELB equipment is potentially susceptible to HELB environments, and can accident sequences and therefore is A2-5774 EC-28690 potentially help justify crediting equipment operation in these expected to have no impact on the TMRE environments or making sure that equipment that are susceptible to applications.

these environments are not credited without justification under accident scenarios that could create the HELB environment.

NFPA 805 Common Feedwater (CFW) Unit 2 Piping. In order to mitigate a loss of EFW during a plant fire, two separate CFW pumps that provide condensate independent of the existing EFW/AFW systems are installed at ANO. The CFW design installs a CFW system, capable of CFW system requires offsite power and, providing an alternate source of condensate to the steam generators of therefore, cannot be credited in the TMRE A2-5829 EC-58247 either unit in the event of certain fire scenarios. model. Therefore this modification would have no impact on the TMRE application.

The CFW system includes two (2) electric AC motor-driven pumps that meet the Unit 2 minimum performance requirements for the existing EFW pump 2P-7B.

Enclosure Attachment 2 to 0CAN041904 Page 56 of 56 Table 11 Summary of Plant Changes Not Yet Implemented ANO-2 (continued)

MCR EC or Description of Change Impact on TMRE Application Number Procedure Per the engineering change, the new LPSI pump meets all the associated Unit 2 Low Pressure Safety Injection (LPSI) system pump 2P-60B (500 HP) design criterion required. The A2-5936 EC-72499 Allis-Chalmers motors inboard or drive end bearing is damaged and difference in model number and rated replaced with a Siemens motor (450 HP). horsepower do not affect thee PRA success criteria. This modification has no impact on the TMRE application.

The PRA model assumes that the HPSI pumps would require minimum High Pressure Safety Injection (HPSI) System Operation: When HPSI pump flow recirculation only for small loss of 2P-89C (swing HPSI pump) is aligned to the red train, manual valve 2SI-66 coolant accident (LOCA) events in the HPSI mini-flow recirc line should be locked open and 2SI-67 should be during the initial period of the event A2-6020 OP-2104.039 closed. And, when HPSI pump 2P-89C is aligned to the green train, manual when Reactor Coolant System (RCS) valve 2SI-66 should be closed and 2SI-67 should be open. The current pressure is greater than shutoff head model does not account for the green train alignment; the model should be of the pumps. Tornado events do not revised to address this issue. result in small LOCA events, therefore, this item would have no impact on the TMRE application.

Enclosure Attachment 3 to 0CAN041904 ANOs Review of Pilot Plant RAIs

Enclosure Attachment 3 to 0CAN041904 Page 1 of 26 ANOs Review of Pilot Plant RAIs Table 1 provides a matrix of the NRCs Request for Additional Information (RAIs) by RAI number as requested of each pilot plant and for communication purposes the corresponding item number Entergy Operations, Inc. (Entergy), has assigned to each. If N/A is assigned as the Arkansas Nuclear One (ANO) Item number, the pilot RAI has been reviewed and determined to be not applicable to ANO. Following the table, Entergy has provided the original text from only one of the applicable pilot RAIs, including pilot plant specific information, and Entergys response to assist in the NRCs review.

Table 1 - RAI Matrix ANOs Item # Vogtle Harris GGNS RAI Subject 1 1 1 1 Containment Building Missile Hit Probabilities (MIP) for 2 2 2 2 Elevated Targets Process for Determining 3 3 3 3 Near-Ground and Elevated Targets; Hit Probabilities 4 N/A 4a 4 Other Initiating Event 5 4 4b 5 Secondary Effects Construction-Related / Temporary 6 5a 5a 6a Missiles 7 5b 5b 6b Outage-Related Missiles 8 5c 5c 6c Building Missile Count 9 6 6 7 Missile Types and Robust Targets 10 7 11 N/A De Minimis Penetrations 11 8 8 8 Vertical and Directional Missiles Structures, Systems, and 12 9 9 9 Components (SSCs) Important to Safety 13 10 N/A 12 Defense-in-Depth 14 11 10 13 Safety Margin Grand Gulf Nuclear Station (GGNS)

N/A N/A N/A 10 Plant Specific Defense-in-Depth Regulatory Guide (RG) 1.174 15 12 11 14 Acceptance Guidelines

Enclosure Attachment 3 to 0CAN041904 Page 2 of 26 Table 1 - RAI Matrix ANOs Item # Vogtle Harris GGNS RAI Subject GGNS Plant Specific Use of Diverse and Flexible Coping Strategies (FLEX)

N/A N/A N/A N/A FLEX was not credited in ANO Tornado Missile Risk Evaluator (TMRE) Probabilistic Risk Assessment (PRA) 16 13 12 15 TRME Implementation 17 14 13 16 SSC Failure Modes 18 15 14 17 Operator Actions 19 16 15 18 Exceedance Probabilities Vogtle Plant Specific Failure of N/A 17 N/A N/A SSCs in Non-Category 1 Structures.

Vogtle Generation III Westinghouse shutdown seals N/A 18 N/A N/A ANO does not have Westinghouse shutdown seals GGNS Plant Specific Inconsistency N/A N/A N/A 19 in Information related to vulnerable SSCs GGNS Plant Specific Facts and Observations (F&Os) question is N/A N/A N/A N/A N/A; however FLEX portion of question applies FLEX was not credited at ANO N/A N/A N/A 21 GGNS Plant Specific F&Os N/A N/A N/A 22 GGNS Plant Specific F&Os GGNS Plant Specific Loss of Offsite N/A N/A N/A 23 Power (LOOP) initiators 20 19 16 24 Sensitivity Analysis Uncertainties with Missile Impact 21 20 17 25 Distribution 22 21 N/A 28 Key Assumptions N/A N/A N/A 26a GGNS Plant Specific Truncation GGNS Plant Specific Inconsistent N/A N/A N/A 26b Information Related to Compliant Case Quantification

Enclosure Attachment 3 to 0CAN041904 Page 3 of 26 Table 1 - RAI Matrix ANOs Item # Vogtle Harris GGNS RAI Subject GGNS Plant Specific CST Dominant N/A N/A N/A 26c Contributor GGNS Plant Specific Sensitivity /

N/A N/A N/A 27 Basic Event Failure Probability Item 1 - Containment Building Request:

Section B.2.3, Selection of Target Missile Hit Probabilities (P) For Developing MIP [Missile Hit Probabilities], of Nuclear Energy Institute (NEI) topical report NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, September 2017, which contains the TMRE methodology (ADAMS Accession No. ML17268A023), states, in part:

Choosing the most conservative target MIP from NP-768 [Electric Power Research Institute, Topical Report EPRI NP-768, Tornado Missile Risk Analysis, May 1978.

https://www.epri.com/#/pages/product/NP-768/] (Target 4) would lead to overly conservative results for many targets at a NPP [nuclear power plant]. Therefore, the normalized tornado missile impact probability from All Targets in NP-768 (from Table 3-15) is proposed for use in the TMRE. This results in a MIP that is based on the combined hits on all modeled surfaces in NP-768, Plant A.

The derivation of the MIP includes the containment building (Target 1). As stated in NEI 17-02, Revision 1, Section B.2.3, in part:

[t]he containment building is surrounded by other buildings so only the upper part of the containment is exposed to tornado missiles.

Additionally, the elevation of the exposed upper part of the containment is different from the elevation of other targets included in the calculation of near ground missiles.

Due to the overall height and the large surface area of the containment building, many missiles may be unable to reach upper portions of the containment building, which reduces the overall density of missile strikes and could become unrepresentative of other shorter plant buildings.

Section 3.2.3.2, Missile Impact and Damage Probability Estimates, of the Electric Power Research Institute (EPRI) topical report NP-768, Tornado Missile Risk Analysis, May 1978, states, in part:

[t]he individual target contributions to the total hit probability is generally greater for the larger targets but least for the containment structure (7.65 x 10-10, Table 3-8) which is shielded from impact for the first 60 feet [(ft.)] above ground elevation.

Enclosure Attachment 3 to 0CAN041904 Page 4 of 26 Justify including Target 1 (containment building) of Plant A in EPRI NP-768 in computing the average MIP for targets less than 30 ft. above grade, given that the containment building is shielded by other buildings and is not impacted by near ground missiles. Discuss how inclusion of Plant A containment building in computation of the average MIP for targets less than 30 ft.

above grade impacts this application.

Entergys Response:

The need to explicitly address the issue identified in this series of RAIs has been obviated by the change in MIP values provided in Revision 1B of NEI 17-02. In that revision, the containment building was removed from the calculation of near-ground MIP values presented in Table 5-1. These revised MIP values were used in the external equipment failure probability (EEFP) calculations.

Item 2 - Missile Impact Parameter for Elevated Targets Request:

Section B.4, MIP Values for Use in the TMRE, of NEI 17-02, Revision 1, provides two sets of MIP values, one for elevated targets and one for near ground targets. The demarcation between near ground and elevated targets is 30 ft. above the primary missile source for a target. For targets near the ground, the MIP appears to be derived using the target areas listed in Table B-2 of NEI 17-02, Revision 1, which generally excludes the area of the roof (with an exception for Target 6, which includes the area of the roof). For the elevated MIP value, the area used to derive the MIP includes all the areas listed in Table B-1 of NEI 17-02, Revision 1, which includes roof areas.

a. The EPRI topical report NP-768 Plant A targets vary in height from 20 to 230 ft. With the exception of the Target 1 (containment building), the buildings range in height from 20 to 80 ft. The weighted average (weighted by the wall area) height of all targets is 94 ft. The weighted average (weighted by the wall area) height of the targets is 56 ft. if Target 1 is excluded.

Provide the basis for the 30 ft. demarcation between near ground and elevated targets, given that EPRI NP-768 Plant A buildings range in height from 20 to 230 ft.

b. The MIPs calculated for elevated targets in Section B.4 are about 54 percent of the MIPs calculated for near ground targets. This percentage seems to reflect the assumptions with respect to areas included in calculation of MIPs for elevated and near ground targets. The difference in area appears to be the only factor that determined the difference between MIPs for elevated and near ground targets. One of the sensitivity analyses in Appendix E of NEI 17-02, Revision 1, examines the impact of target elevation on target hit probabilities.

Revision 1 of NEI 17-02 states that the results of this sensitivity analysis show that in general as target elevation increases, hit probability decreases.

Describe the relationship between the numerical results shown in Appendix E and address whether the Appendix E results are generally consistent with the ratio of elevated to near ground MIPs calculated in Appendix B, Bases for MIP and Missile Inventories. If Appendix E numerical results are not consistent with the ratio calculated in Appendix B, provide a justification.

Enclosure Attachment 3 to 0CAN041904 Page 5 of 26 Entergys Response:

a. The need to explicitly address the issue identified in this series of RAIs has been obviated by the use of Revision 1B of NEI 17-02. In that revision, Section B.3.4 was added to provide the bases for the 30-foot demarcation.

b. The need to explicitly address the issue identified in this series of RAIs has been obviated by the use of Revision 1B of NEI 17-02. In that revision, Section B.3.4 was added to provide the bases for the 30-foot demarcation.

Item 3 - Process for Determining Near Ground and Elevated Targets and Hit Probabilities Request:

Section 5, Evaluate Target and Missile Characteristics, of NEI 17-02, Revision 1, states, in part, that:

[t]he <30 ft. MIP value can be used in cases where it is difficult to determine if the target is

>30 ft. above all missile sources.

Table 5-1 in NEI 17-02, Revision 1, refers to targets that are 30 ft. above or below grade, and Note 2 to the table explains:

[t]he term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

The above discussions in Sections 5 and 5.1 of NEI 17-02, Revision 1, seem to provide different guidance regarding how to determine elevated targets (for which the MIP values are different).

The U.S. Nuclear Regulatory Commission (NRC) staff notes that missiles may exist at elevations above some nominal plant grade or that targets exist at elevations that are above and below the nominal plant grade.

a. Describe the process that Grand Gulf Nuclear Station (GGNS) has used for determining near ground and elevated targets considering various elevations of targets and missiles.

The description should include how this process ensures proper consideration of missile source applicability for each target relative to the demarcation height.

b. The hit frequency in EPRI NP-768 is a function of the insertion height of the missiles. In EPRI NP-768, the missiles were assumed inserted from heights ranging from 5 to 50 ft.,

except for cars, which were assumed inserted from 5 to 10 ft.

Address whether the range of cited insertion heights underestimates the hit probabilities.

Enclosure Attachment 3 to 0CAN041904 Page 6 of 26 Entergys Response:

a. The reference elevation for the ANO site was established as 354 feet. For convenience, the missile walkdowns within the 2500 foot radius were segregated into 38 zones. The total number of missiles in each zone along with the average elevation in each zone were noted as part of the site missile inventory analysis. The average elevation of nearly all the zones was at or near 354 feet. Only four of the zones had an average elevation above 360 feet and those zones contained a total of only 13,378 potential missiles or less than 7%

of the total missile population. Furthermore, those four areas were located at the outer edge of the 2500 foot radius thereby necessitating that any potential missiles in these zones travel farther than the majority of missiles to impact plant components. Given the relative flatness of the site and that the vast majority of missiles are located in areas at or near the reference elevation, the use of the 354-foot reference elevation is considered appropriate.

b. The TMRE guidance does not require that individual licensees validate missile injection heights based on the data provided in Section B.3.4 of NEI 17-02. Since the NP-768 missile insertion heights are bounded by the sampled data, which is representative of nuclear plant sites in the U.S., it is not required that any individual plant perform this analysis.

Item 4 -Another Initiating Event Request:

Section 3.3.1 of the submittal states, in part, that PRA logic and components that do not support mitigating a [LOOP (loss of offsite power)] can be screened since the TMRE model uses non-recoverable LOOP sequences. Section 6.1, Event Tree/Fault Tree Selection, of NEI 17-02, Revision 1, states that in addition to LOOP event trees, other internal initiating events should also be reviewed to ensure that either (1) a tornado event cannot cause another initiating event or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. It was not clear whether the review discussed in Section 6.1 of NEI 17-02 was performed by Entergy Operations, Inc. (the licensee) to support this submittal. For example, the standby service water cooling tower (SSW CT) fans are an identified vulnerability which, according to Section 3.3.9 of the Enclosure to the submittal, are important in that they support the operation of the emergency diesel generators and the

[emergency core cooling] ECCS systems. The SSW CT fans do not appear to have been reviewed as initiators or as support system losses that need to be included in the sequences.

The walkdowns also appear to have been performed with a focus on the LOOP mitigation and other initiators or support system failures do not appear to have been considered during the walkdowns.

Describe whether a review was performed to ensure that a tornado event cannot cause another initiating event or the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. Provide the results of this review including a discussion of any potential impact on and from walkdowns.

Enclosure Attachment 3 to 0CAN041904 Page 7 of 26 Entergys Response:

The transient tree for ANO-1 and ANO-2 is used to model all transient events such as loss of service water, reactor trip, loss of offsite power, and transient induced consequential events such as anticipated transient without scram, reactor coolant pump seal failure or induced steam generator tube rupture. Therefore, regardless of the immediate cause of the reactor trip signal, the effect of all equipment failures is considered by the logic model. Equipment failed as a result of tornado-induced missiles is added to the CAFTA logic model with the failure probability determined in the EEFP calculations.

Item 5 - Secondary Effects Request:

NEI 17-02, Revision 1, Section 3.2.3, SSC Failure Modes, references consequential failures and describes treatment of identified and documented cases to be addressed in Section 6, Develop TMRE PRA Model, of NEI 17-02, Revision 1. Specifically, the first bullet in Section 3.2.3 characterizes tanks and piping as passive components.

Section 3.2.3 does not appear to include guidance on consideration of secondary effects. Such effects include consideration for fluid-filled tanks and pipes, combustion motor intake effects (loss of oxygen from inert gas tank rupture or exhaust re-direction scenarios), and other potential secondary effects to the SSCs function.

Describe how secondary effects that may result from failure of non-conforming conditions were considered for identification of the initiating events and failure modes in the licensees TMRE development.

Entergys Response:

Section 3.2.3 of NEI 17-02 was updated in Revision 1A to describe secondary effects that should be noted during the walkdown. Section 6.1 was revised and Section 6.5.2 was added to NEI 17-02 in Revision 1B to require evaluation of the secondary effects of tornado missile impacts on nonconforming SSCs.

Because of the large, open nature of the ANO buildings in conjunction with the limited capacity of potential flood sources that could affect non-conforming SSCs, no additional flooding effects not already included in the direct effects of missile impacts would be expected.

The potential for the ANO-2 diesel exhaust stacks to be perforated and impair the ability of running diesels was examined. Given the 30-foot distance between the ANO-2 diesel exhaust and intake along with the vertical distance and buoyancy of the hot exhaust gas, it is considered incredible that failure of one diesel exhaust stack would impact the opposite train diesel intake.

Enclosure Attachment 3 to 0CAN041904 Page 8 of 26 Item 6 - Construction-Related / Temporary Missiles Request:

Section 3.4.3, Temporary Missiles, of NEI 17-02, Revision 1, states that the expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas information in Sections 3.4.2, Non-Structural Missile Inventory, and 3.4.4, Structural Missiles, along with design and construction information. The section states that the basis and assumptions used for the estimated number of post-construction missiles will be documented. The November 3, 2017 license amendment request (LAR)

(ADAMS Accession No. ML17307A440), does not appear to provide a basis for the adequacy of missile counts for post-construction site.

Section 3.4.3 of NEI 17-02, Revision 1, states the total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles. The NEI guidance further states that the basis and assumptions used to determine the conservative construction missile estimate should be documented. The LAR does not appear to provide a basis for the adequacy of construction-related missile counts.

Describe and justify the approach that will be used for the classification of the construction-related missiles in GGNSs future implementation of the TMRE methodology.

Entergys Response:

In future applications of the TMRE methodology, it is unlikely that the number of missiles included in the ANO TMRE calculations will change significantly because ANO is not currently planning any large-scale construction projects. If a proposed construction activity would cause the site missile inventory to increase above the missile count used in the TMRE analysis, an assessment is needed to verify the higher missile count still meets the risk metric thresholds in Section 7.3 or prior NRC approval would be required. Non-permanent construction-related missiles would be considered during plant changes that trigger a TMRE evaluation, and would either be included in the primary analysis or will be analyzed through a sensitivity study.

The ANO missile walkdown was performed in accordance with Section 3.4 of NEI 17-02, Revision 1B. To support the walkdowns the plant was divided into 38 zones and the potential missile count for each zone was determined. The estimate of the number of potential tornado-generated missiles at ANO is 196,498. This estimate includes an estimate of the number of missiles that will be added as part of the London North substation along with non-permanent construction-related missiles associated with the project and identified during the walkdowns.

Non-permanent construction-related missiles will be considered if additional non-conforming SSCs are identified, and will either be included in the primary analysis or will be analyzed through a sensitivity analysis per NEI 17-02, as a matter of process.

Enclosure Attachment 3 to 0CAN041904 Page 9 of 26 Item 7 - Outage-Related Missiles Request:

Section 3.4.3 of NEI 17-02, Revision 1, states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site.

It does not appear that GGNS has considered additional equipment (such as outage conditions) in estimating the number of missiles.

Clarify whether plant specific outage-related missiles were considered in the total number of missiles used for GGNS TMRE implementation. Provide a justification if those missiles are not considered in estimating the total number of missiles at the site.

Entergys Response:

Consistent with the guidance provided in NEI 17-02, Revision 1B, additional outage missiles were not considered as part of the TMRE walkdown. Not explicitly considering outage-related missiles is an acceptable approach as outage durations are short and at multi-unit sites such as ANO, the outages are staggered such that only one unit is in an outage at a time.

Additionally, scaffolding parts/accessories provide the majority of additional missiles during an outage. These scaffolding pieces are normally stored onsite and are already included in the missile count from a different plant area. Other equipment (machinery, trailers, and vehicles) would result in a small percentage increase as compared to the missile count of 240,000 that was used in the TMRE analyses. The total missile count at ANO is 196,498. Since this is bounded by the generic value of 240,000 provided in NEI 17-02, Revision 1, the missile count of 240,000 was conservatively utilized in calculating EEFPs. Any additional outage missiles at ANO, which are not already included in the count for another area, are expected to be bounded by the generic missile count of 240,000.

Item 8 - Building Missile Count Request:

Section 3.4, Tornado Missile Identification and Classification, of NEI 17-02, Revision 1, provides guidance for verifying the number of missiles resulting from the deconstruction of various types of buildings through the TMRE walkdown.

The guidance does not appear to involve walkdowns to count the potential missiles a non-Category I building contains inside the structure or to count missiles that would be generated by the deconstruction of the structure itself. The guidance should ensure that the missile inventories from building deconstruction are not under predicted for a specific plant.

i. For each type of building addressed in NEI 17-02, Revision 1, explain how plant specific missile count considers building contents (i.e., materials that are not part of the building itself but available to become missiles if the building is hit).

Enclosure Attachment 3 to 0CAN041904 Page 10 of 26 ii. For those types of buildings where the NEI 17-02, Revision 1, methodology was applied, verify that the overall estimate of non-structural missiles within buildings is representative or bounding.

Entergys Response:

i. As detailed in Section 3.4.4 of NEI 17-02, Revision 1B, building contents are included in Tables 3-3 through 3-8 and validation of sitespecific building contents is not required by individual licensees.

ii. As detailed in Section 3.4.4 of NEI 17-02, Revision 1B, building contents are included in Tables 3-3 through 3-8 and validation of sitespecific building contents is not required by individual licensees.

Item 9 - Missile Types and Robust Targets Request:

Sections 5.2, Missile Inventories, and 5.2.1, Missile Inventory Example, of NEI 17-02, Revision 1, explain that a bounding inventory of missiles was developed from a survey of five plants along with a generic distribution of missile types. These sections explain that the missile types and target robustness categories are used to determine if a target fails. Section 5.2 explains that in using the TMRE approach, the missiles at a specific plant should be counted to ensure that the missile inventory at the plant is bounded by the inventory used in the TMRE methodology based on the survey. Finally, Section B.6, Missiles Affecting Robust Targets, of NEI 17-01, Revision 1, states that the number of missiles used in the Exposed Equipment Failure Probability (EEFP) calculation can be adjusted to account for the population of missiles that can damage an SSC and provides the percentage of the total missile inventory for each type of robust target. These percentages appear to depend on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, B-16, and B-17.

The sections of NEI 17-02, Revision 1, cited above do not appear to provide guidance for adjusting the relative contribution of each missile type based on plant-specific information. A skewed distribution of missile types at a specific plant site could have an impact on the risk results of the TMRE PRA, because certain missiles (from certain missile robustness categories) can fail a greater number of SSCs than missiles from lesser robustness categories.

Describe how any future use of the TMRE guidance for adjusting the number of missiles for robust targets at GGNS will be performed to ensure GGNS evaluation will ensure that the contribution of each missile type to the overall missile population in NEI 17-02, Revision 1, is representative of the contribution of each missile type to the overall missile population GGNS.

Entergys Response:

Justification for the technical adequacy of the NEI 17-02 methodology has been added to Revision 1B. Any future use of the TMRE guidance for adjusting the number of missiles for robust targets at ANO would be performed in accordance with that guidance, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants. This will provide reasonable assurance that the contribution of each missile type to the overall missile population is adequate for the risk evaluation.

Enclosure Attachment 3 to 0CAN041904 Page 11 of 26 Item 10 - De Minimis Penetrations Request:

Section 3.1, Vulnerable SSC Walkdown Preparation, of NEI 17-02, Revision 1, states that SSCs that are potentially exposed to tornado missiles through a De Minimis penetration can be screened. Section 1.5, Definitions, of NEI 17-02, Revision 1, defines a De Minimis penetration to be:

[a]ny penetration in a tornado-generated missile resistant reinforced concrete wall or other tornado-generated missile resistant structure that is less than 10 square feet.

a. For any exposed penetrations found during TMRE walkdowns, clarify whether any penetration was screened based on the above criteria.

b. For any current or future penetrations screened, provide justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g., single penetration area and/or combined penetration area), and for excluding De Minimis penetrations from the risk analysis.

Entergys Response:

a. No penetrations at ANO were screened based on any "De Minimis" criteria.

b. Any future use of the TMRE guidance will be performed in accordance with NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants. However, it is not anticipated that any "De Minimis" criteria will be employed.

Item 11 - Vertical and Directional Missiles Request:

Section 5.3, Target Exposed Area, of NEI 17-02, Revision 1, provides the method for calculating the area of an SSC that is exposed to being struck by a tornado missile for various types of SSCs and how their target exposed area should be calculated for the EEFP. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) are susceptible to potential missiles in the vertical direction that could result in additional exposed area. The GGNS licensing basis defines parameters for missile velocities in both horizontal and vertical directions in the GGNS UFSAR, Table 3.5.1-6, Tornado Missiles Considered in the GGNS Design.

Section 3.3.2, Target Walkdowns, of the Enclosure to the submittal provides the scope of TMRE walkdowns. The third bullet of Section 3.3.2 includes identifications of directions from which tornado missiles could strike the target in the scope of walkdowns. It does not appear to differentiate between horizontal and vertical missiles consistent with the GGNS licensing basis.

Enclosure Attachment 3 to 0CAN041904 Page 12 of 26 Considering that tornado missiles could strike from all directions, describe how the above bulleted item in Section 3.3.2 of the Enclosure to the submittal was performed and how vertical missiles and directional aspects are included in the GGNS TMRE.

Entergys Response:

Missiles were considered capable of striking from all directions. Vertical missiles were included except in situations where the target was shielded from vertical missiles. Target shielding was considered as presented in Section 5.3.2 of NEI 17-02.

Item 12 - SSCs Important to Safety Request:

One of the key principles in RG 1.174, Revision 2 states that the proposed change meets the current regulations unless it is explicitly related to a requested exemption.

Section 2.2, Current Licensing Basis (CLB), of the Enclosure to the submittal states that GGNS was designed to meet General Design Criterion (GDC) 2, Design bases for protection against natural phenomena, and GDC 4, Environmental and dynamic effects design bases, in Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR). GDC 2 states that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 states that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

Section 4.1, Applicable Regulatory Requirements/Criteria, of the Enclosure to the submittal states that Section 3.5.1.4, Missiles Generated by Tornadoes and Extreme Winds, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants (SRP), allows for a probabilistic basis for relaxation of deterministic criteria for tornado missile protection of SSCs. The submittal further states that RG 1.174 establishes criteria to quantify the sufficiently small frequency of damage discussed in the SRP. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines.

Address how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornados or other external events without loss of capability to perform their safety function.

Entergys Response:

Use of the proposed methodology will continue to provide reasonable assurance of the protection of public health and safety and the environment as described in either the ANO-1 and ANO-2 Safety Analysis Report (SAR) without loss of the tornado safe shutdown capability.

Enclosure Attachment 3 to 0CAN041904 Page 13 of 26 Use of the proposed methodology will not result in an increase in the likelihood of a tornado.

The design basis tornado frequency is driven by external factors and is not affected by use of this methodology. Further, use of this methodology does not increase the consequences of a tornado. Use of the methodology does not alter any input assumptions or the results of the accident analysis. Use of the methodology results in a more realistic assessment of the very low likelihood of unacceptable consequences from a tornado event. Use of the methodology results in no physical changes to the facility; therefore, no new types of malfunctions or accidents are created. The types of accidents, accident precursors, failure mechanisms and accident initiators already evaluated in the ANO-1 or ANO-2 SAR remain unaltered. Finally, use of the methodology does not reduce the margin of safety in the ANO-1 or ANO-2 SAR. Use of the methodology does not exceed or alter any controlling numerical value for a parameter established in the ANO-1 or ANO-2 SAR Chapter 6 and 14/15 accident analyses (analyses remain valid). Use of the methodology does not reduce redundancy or diversity of safety systems, nor does it reduce defense-in-depth as described in the ANO-1 or ANO-2 SAR.

Item 13 - Defense-in-Depth Request:

Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states that the engineering evaluation should evaluate whether the impact of the proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy.

Section 3.2.1, Defense-in-Depth, of Enclosure 1 to the LAR discusses the licensees assessment of defense-in-depth considerations for this application. The assessment does not appear to fully address all seven defense-in-depth considerations discussed in regulatory position 2.1.1.

Provide an evaluation of the impact of the proposed changes, individually and cumulatively, on the following defense-in-depth considerations contained in RG 1.174:

• System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

• Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

• The intent of the plants design criteria is maintained.

Entergys Response:

The proposed change does not modify the redundancy, independence, or diversity of systems described in the ANO-1 or ANO-2 SAR. Challenges to the systems, considering the frequency, consequence, and uncertainties of events, are evaluated in the LAR. The availability and reliability of SSCs that can either initiate or mitigate events is not changed, except for the tornado missile protection of the SSCs listed and thoroughly evaluated in the LAR. Equipment credited for Diverse and Flexible Coping Strategies (FLEX) is available both onsite and offsite.

This equipment could be utilized if needed to mitigate the impact of a tornado missile. The equipment is stored in structures that ensure availability in the case of a tornado or tornado missile.

Enclosure Attachment 3 to 0CAN041904 Page 14 of 26 The non-conforming conditions described in the LAR are spatially distributed about the ANO site with differing orientation and elevation. Any combination of non-conforming conditions that could realistically be struck by the same missile are correlated within the analysis and evaluated as such.

The LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety. The LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain not protected from tornado missiles. All other aspects of the plant design criteria are unaffected. Additionally, the methodology utilized in the LAR cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. The methodology only applies to legacy plant issues. Protection of the identified non-conforming SSCs would assure that SSCs would not be damaged by design basis tornado missiles. In lieu of protection for the identified non-conforming SSCs, ANO has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequential effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known and is considered negligible. Therefore, the intent of the plants design criteria is maintained.

Item 14 - Safety Margin Request:

Regulatory Position 2.1.2 in RG 1.17 4, Revision 2, discusses safety margin as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states, in part, that with sufficient safety margin, the safety analysis acceptance criteria in the licensing basis (e.g., final safety analysis report, supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Section 7.5, "Defense-in-Depth and Safety Margin," of NEI 17-02, Revision 1, calls for a discussion of defense-in-depth reflecting the actual design, construction, and operational practices of the plant. It explains that engineering evaluation should be performed to assess whether the proposed licensing basis change maintains safety margin and identify conservatisms in the risk assessment to show that safety margin is maintained.

Section 3.2, "Traditional Engineering Considerations, "of the enclosure to the LAR discusses defense in depth and safety margin and states "safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change" but provides no basis for that statement.

Section 2.3, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states that tornado missile failures do not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, and/or 1-inch steel plate. The guidance requires no analysis for evaluating the risk of non-conforming conditions that are protected as described in Section 2.3 of NEI 17-02, Revision 1, and implies that no protection against the tornado-generated missiles is needed for those SSCs. Revision 1 of NEI 17-02 provides similar guidance in Sections 5 and 6.5 as well.

Enclosure Attachment 3 to 0CAN041904 Page 15 of 26

a. Describe the basis for the conclusion that the safety analysis acceptance criteria in the licensee's safety analysis are unaffected by the proposed change.

b. Discuss any non-conforming conditions that were (or if identified in the future, will be) screened from HNP TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Revision 1. For those non-conforming conditions, demonstrate that the safety analysis acceptance criteria in the licensing basis are met or that proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Entergys Response:

a. The safety analysis acceptance criteria in the ANO-1 and ANO-2 SAR described in Chapters 6 and 14/15 are not affected by the change, as those events do not assume a tornado coincident with a design basis accident, except to the extent that the tornado has the potential to initiate any of the design basis accidents. The objective for protection from tornado as an external event is to place the reactor in a safe and stable shutdown condition during or following a tornado. Special considerations such as single failure criteria are not required. The ANO TMRE analyses document that only a very small fraction of available SSCs which could be used to accomplish the objective are not protected from the effects of tornado missiles, and the remaining unaffected components provide reasonable assurance the objective would be achieved. In the event exposed components of one train of safety related equipment is affected by a tornado missile, there is reasonable assurance that opposite train equipment would be available to provide the safety function. In addition to the equipment credited in the safety analysis described in the SAR, on-site and near-site FLEX equipment is also available, which provides further assurance that the objective would be achieved. These factors provide reasonable assurance that the safety analysis acceptance criteria in the licensees accident analyses are not impacted by the proposed change.

b. The analyses performed for the ANO TMRE did not use criteria in NEI 17-02, Revision 1, Section 2.3, to screen non-conforming conditions from further analysis. However, NEI 17-02, Section B.6.3, was revised in Revision 1B to add justification for screening. Any future application of NEI 17-02, Revision 1B, will be consistent with any terms and conditions established in the NRC safety evaluation for the pilot plants.

Item 15 - RG 1.174 Acceptance Guidelines Request:

Vogtle Plant-Specific RAI Regulatory Position 2.4 in RG 1.174, Revision 2, discusses the risk acceptance guidelines.

Section 7.3, Comparison to Risk Metric Thresholds, of NEI 17-02, Revision 1, indicates that the delta risk between the compliant case and the degraded case PRA results should be evaluated against the very small change in risk acceptance guidelines given in RG 1.174, Revision 2 (change in CDF of smaller than 10-6 per year and change in LERF of smaller than 10-7 per year), and states, in part, that:

[i]t is possible that some licensees may exceed these thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR.

Enclosure Attachment 3 to 0CAN041904 Page 16 of 26 Section 2.5, Quantify Risk, Perform Sensitivity Analyses, and Compare to Thresholds, of NEI 17-02, Revision 1, states, in part, that:

[i]f CDF or LERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate.

And

[i]f further reductions to CDF and LERF are not possible [by refining the analysis], the licensee will need to decide whether physical modifications should be made and to which SSCs.

Section 7.3 of NEI 17-02, Revision 1, appears to allow providing more information about defense-in-depth if the change-in-risk thresholds of RG 1.174 are exceeded, whereas Section 2.5 appears to allow analysis refinement and plant modification if the thresholds are exceeded.

Describe the licensees approach if performance-monitoring programs indicate that the risk acceptance guidelines for very small change-in-risk in RG 1.174, Revision 2, are exceeded.

Clarify whether any additional refinements beyond the guidance in NEI 17-02, Revision 1, will be made if acceptance guidelines are exceeded.

Entergys Response:

Sections 8.1 and 8.2 of NEI 17-02, Revision 1B, are significant revisions from the guidance provided in Revision 1. These revisions provide clarity to the guidance for future performance monitoring. If performance monitoring programs indicate that the risk acceptance guidelines for very small change in risk as defined in RG 1.174, Revision 2, are exceeded, then any subsequent TMRE evaluations at ANO would be performed in accordance with the guidance of NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluations for the pilot plants.

Item 16 - TRME Implementation Request:

Regulatory Position 3, Element 3: Define Implementation and Monitoring Program, in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. Section 8.1, Plant Configuration Changes, of NEI 17-02, Revision 1, states that design control programs meeting 10 CFR Part 50 Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, will ensure subsequent plant configuration changes are evaluated for their impact on non-conforming SSC risk using TMRE. Section 8.1 also states, in part, that:

[l]icensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Enclosure Attachment 3 to 0CAN041904 Page 17 of 26 Section 4.1, Applicable Regulatory Requirements/Criteria, of the Enclosure to the submittal states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. Permanent changes that increase the site missile burden within the 2500-ft.

missile radius established for TMRE should be reviewed for impact on the TMRE analysis.

a. Describe the mechanism(s) and approach(es) that will be followed by the licensee to determine whether a particular change to the facility is significant for evaluation of the impact to the TMRE basis.

b. Describe the licensees mechanisms that assure temporary and permanent changes to site missile sources will be evaluated.

c Describe the process(es) that ensure changes that could affect GGNS TMRE results (e.g.,

plant design changes, changes made to the licensees base internal events PRA model and new information about the tornado hazard at the plant) are considered in future implementation of the licensees TMRE.

d. Describe, with justification, the treatment of the currently identified non-conforming conditions in future uses of the licensees TMRE PRA model.

e. Describe, with justification, how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decision making (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals).

Entergys Response:

a. Changes to previous non-conforming SSCs that would increase the target EEFP (e.g.,

affect the target exposed area by increasing the exposed exhaust pipe height, affect a robust missile percentage by changing pipe material or thickness) are not allowed under TMRE. Only changes that result in increased site missile burden require a TMRE analysis update.

Entergy Engineering Design procedures require the impact of design changes to be considered by various organizations, including the impact on plant risk. The new Standard Design Process IP-ENG-001 has been implemented at ANO. Individuals performing design change activities in accordance with that procedure are responsible for completing an impact review where PRA is a stakeholder. Impact reviews verify that affected items (procedures, equipment, programs, etc.) and interfaces have been identified. The design change Responsible Engineer is responsible for ensuring key stakeholder/impact review comments have been appropriately incorporated into the Engineering Change. A design change that affects the parameters of TMRE would have to be evaluated with TMRE prior to being implemented.

b. The new Standard Design Process IP-ENG-001 assures that permanent changes to site missile sources will be evaluated for PRA model impacts. In accordance with Section 8.1 of NEI 17-02, Revision 1B, permanent changes that increase the site missile burden within the 2500 ft missile radius shall be included in the TMRE analysis. These changes would be captured in reviews by impacted departments. Stakeholders from other departments, areas, or programs are included in reviews of the impacts and this list includes PRA.

Enclosure Attachment 3 to 0CAN041904 Page 18 of 26

c. The process used to update the TMRE analysis will be in accordance with NEI 17-02, Revision 1B. Entergy Risk Informed Engineering Procedures will be updated accordingly as part of the amendment implementation process.

d. Targets that are treated as non-conforming in the initial application of the TMRE will continue to be considered non-conforming in future revisions of the TMRE model. There may be exceptions in the following cases where the targets:

Have been physically protected in such a way that they would no longer be considered non-conforming at the time of the revision and can be removed from the TMRE analysis, or Were conservatively treated as non-conforming in the initial analysis, but had not been identified as non-conforming during discovery walkdowns, or Would not otherwise be considered non-conforming at the time of the revision because engineering calculations have demonstrated conformance.

e. For the purpose of decision-making related to those SSCs, the change in risk calculated from the TMRE is intended to be an estimate that reasonably bounds the risk from tornado missiles due to non-conforming SSCs. Once incorporated into the license, the TMRE may continue to be used to evaluate additional non-conforming SSCs in accordance with NEI 17-02, Revision 1B, guidance. Any further use of the TMRE model is beyond the scope of the industry guidance as documented in Section 8.1 of NEI 17-02, Revision 1B.

Item 17 - SSC Failure Modes Request:

Regulatory Position 2.3.2 in RG 1.174, Revision 2, states that the level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. This Regulatory Position further states that the characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated.

Section 6.5, Target Impact Probability Basic Events, of NEI 17-02, Revision 1, states, in part, that:

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models Section 6.5 then provides four relevant examples (i.e., flow diversion and/or leaks, tank vent failures, valve position transfer - spurious actuations, and ventilation damper failures). The section does not provide guidance about when and to what extent such failure modes should be considered.

Describe how the potential failure modes stated in Section 6.5 of NEI 17-02, Revision 1, were considered by the licensee during the TMRE walkdown, identified, and included in the licensees TMRE PRA model used to support this application.

Enclosure Attachment 3 to 0CAN041904 Page 19 of 26 Entergys Response:

Section 6.5 of NEI 17-02 has been revised to address SSC failures caused by tornado missile strikes. Section 6.5.1 in NEI 17-02, Revision 1B, addresses SSC functional failures and Section 6.5.2 addresses secondary effects.

Section 6.5.1 clarifies that the TMRE PRA model should consider the functional failures of SSCs that are struck by tornado missiles. The bulleted list of examples in NEI 17-02, Revision 1B, has been edited to remove the example implying that spurious equipment operation should be modeled, as this was not the intent of the example.

These revisions to the guidance document obviate the need for a plant-specific response to this RAI.

Item 18 - Operator Actions Request:

Section 3.3, Ex-Control Room Action Feasibility, of NEI 17-02, Revision 1, states that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure (in a location for which the operator must travel outside a Category I structure), but can be considered in the PRA after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Guidance in this section states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted.

Discuss, with justification, the assessments performed to ensure that environmental conditions will not affect operator actions that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the licensees TMRE PRA model used to support this application.

Entergys Response:

ANO-1 The ANO-1 Human Reliability Analysis identifies 5 basic events (EDG-HFC-FO-DG1FO, EDG-HFC-FO-DG2FO, EDG-HFC-FO-DGFO2, EDG-HFC-FO-FOASX, and PCS-HFC-FO-MSGAG) that are longer-term actions performed outside Category I structures. As noted in NEI 17-02, "It is not expected that longer term action (greater than one hour) human error probabilities will be noticeably impacted by the tornado event." Therefore, for the base case, the PRA model was quantified with the human error probability (HEP) for each of these events at nominal values. Additionally, a sensitivity analysis was performed with all five events set to TRUE. No change in either CDF or LERF was identified by the sensitivity analysis.

Other longer-term operator actions are performed inside Category I structures. Operators were interviewed to identify pathways from where the operators shelter during a tornado to the areas where the actions are performed. The operators identified multiple, diverse pathways to all rooms inside Category I structures where actions are required. Therefore, it is concluded that any impact on the failure probability of the long-term operator actions by the effects of a tornado impacting ANO-1 is negligible.

Enclosure Attachment 3 to 0CAN041904 Page 20 of 26 ANO-2 The ANO-2 Human Reliability Analysis identified no longer-term actions performed outside Category I structures.

For longer-term operator actions which are performed inside Category I structures, operators were interviewed to identify pathways from where the operators shelter during a tornado to the areas where the actions are performed. The operators identified multiple, diverse pathways to all rooms inside Category I structures where actions are required. Therefore, it is concluded that any impact on the failure probability of the long-term operator actions by the effects of a tornado impacting ANO-2 is negligible.

Item 19 - Exceedance Probabilities Request:

Section 4.6, Calculate Exceedance Probabilities, of NEI 17-02, Revision 1, states that exceedance probabilities should be generated for the upper ranges for each F [Fujita prime]

category, F2 through F6, using the trendline equation. The figure provided in Section 4.6 suggests that the largest exceedance probability for each F category, which corresponds to the lowest tornado speed for each F category, is used.

Describe how the exceedance probabilities influence on the initiating event frequencies were determined using the guidance in Section 4.6 of NEI 17-02, Revision 1 in the TMRE methodology.

Entergys Response:

The tornado initiating event frequencies were determined using the methodology described in NEI 17-02, Revision 1. The F'-scale wind speed estimates for tornados of frequency 1.00E-05/yr, 1.00E-06/yr, and 1.00E-07/yr were determined from a review of NUREG/CR-4461, Revision 2. A trend line was established and the resulting equation was used to calculate a frequency for tornado wind speeds from 40 MPH to 300 MPH.

Using the F-scale tornado intensity MPH ranges, exceedance frequencies were determined for each tornado intensity F2 through F6. Subsequently, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequency.

The method used and described above is in accordance with the revised guidance in NEI 17-02, Revision 1B, Sections 4.3 through 4.6.

Enclosure Attachment 3 to 0CAN041904 Page 21 of 26 Item 20 - Sensitivity Analysis Request:

Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This Regulatory Position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

Section 7.2, Sensitivity Analysis, of NEI 17-02, Revision 1, address the steps that should be taken if the change in CDF and LERF from the sensitivity analyses exceed 10-6 per year and 10-7 per year, respectively.

a. Describe the GGNS process if change-in-risk estimates from sensitivity analyses exceed the RG 1.174, Revision 2, acceptance guidelines for very small change in risk in implementation of TMRE methodology.

b. Describe how the importance measures are determined from the TMRE PRA model in the context of the binning approach for the tornado categories employed in the model.

Describe whether and how the same basic events, which were discretized by binning during the development of the TMRE PRA model, are combined to develop representative importance measures. For same basic events that are not combined, provide a justification that includes discussion of any impact on the results.

c. Identify the non-conforming conditions and vulnerabilities that met all the characteristics of a highly exposed SSC per Section 7.2.1, TMRE Sensitivities, of NEI 17-02, Revision 1.

The discussions in Section 7.2 of NEI 17-02, Revision 1, do not address whether sensitivity analyses will be aggregated in future implementations of the TMRE methodology. For example, it is unclear whether the licensee will combine the sensitivity analyses related to any future open PRA facts and observations (F&Os), sensitivities that address compliant case conservatism and TMRE sensitivity analyses.

d. Describe, with justification, whether sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1, will be aggregated in future implementation of the TMRE methodology.

The discussion in Section 7.2.3, Compliant Case Conservatisms, and Section A.2.1.3, Non-Category I Structures and Exposed Non-Safety Related SSCs, of NEI 17-02, Revision 1, recognizes that the TMRE PRA could produce non-conservative change-in-risk results if conservatively assumed failures in the Compliant Case mask change-in-risk. Accordingly, Section 7.2.3 of NEI 17-02, Revision 1, states, in part, that:

Enclosure Attachment 3 to 0CAN041904 Page 22 of 26

[the] licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failure (opposed to offsite power recovery or operator actions) that could impact results.

Section 7.2.3 of NEI 17-02, Revision 1, also explains that the licensee should perform sensitivity studies associated with these conservatisms as directed in Appendix D of the TMRE guideline for PRA standard supporting requirements (SRs) AS-A10, LE-C3, and SY-B7 to address equipment failures in the compliant case that may be masking change-in-risk but does not provide guidance on how such a sensitivity can be performed.

Section 3.3.10 Sensitivities and Uncertainties, of the Enclosure to the submittal describes a sensitivity assessment performed to ensure conservative modeling treatments in the compliant case do not affect the risk assessment conclusions.

e. Describe any future sensitivity analysis that will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case of the TMRE PRA model.

Modeling operator actions, could contribute to underestimating the change-in-risk calculation associated with non-conforming SSCs. Appendix D, Technical Basis for TMRE Methodology, of NEI 17-02, Revision 1, does not appear to address the concern described above could also apply to conservative human reliability analysis modeling (e.g., SR HR-G3 and HR-G7).

f. Describe how GGNS will address the potential impact of TMRE assumptions related to certain human error probabilities within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the accident on the compliant case.

Entergys Response:

ANO-1

a. Currently, the ANO-1 sensitivity results exceed the very small risk change thresholds for one of the two required sensitivity analyses required by NEI 17-02, Revision 1B. For the TMRE missile distribution sensitivity, the CDF and LERF values of 1.3E-06 per year and 2.7E-07 per year, respectively, slightly exceed the very small risk threshold definitions.

The reason for the increase is the conservative modelling assumptions incorporated to simplify evaluations of cable routing. Specifically, for vulnerabilities affected by the sensitivity, it is assumed that a single missile could fail all SSCs in an impacted area. It is expected that a detailed evaluation of the cable routing would allow fewer correlated failures and, as a result, a lower risk increase. Additionally, correlation of SSCs impacted by tornado missiles was treated conservatively. For example, a missile impacting a row of large conduits end-on was assumed to fail all of the conduits and no kinetic reduction of the missiles was considered. Any reduction in these modelling conservatisms would reduce the increase in risk shown in the sensitivity analysis. Furthermore, much of the risk increase is caused by the multiplier applied to targets in the bowling alley area of the turbine building. This area is located below a concrete floor and between the Category 1 auxiliary building and an 18-inch thick reinforced concrete wall. As a result, it is not likely that a tornado could increase the distribution of missiles in that area. Therefore, it is concluded that the increase in risk shown by the sensitivity study is much larger than would be expected and the overall conclusions of the TMRE evaluation are valid.

Enclosure Attachment 3 to 0CAN041904 Page 23 of 26

b. The importance measures for the TMRE model are determined as detailed in Section 7.2.1 of NEI 17-01, Revision 1B.

c. The following ANO-1 SSCs meet the characteristics of highly exposed as specified in Section 7.2.1 of NEI 17-02, Revision 1. None of these highly exposed SSCs are considered non-conformances.

SSC Component Type 197-EC-01 Correlation Group Consisting of conduits:

EC1254 EC1255 EC1256 Conduit EC1056 Conduit Conduit EC1054 Conduit Conduit EJ1004 Conduit EFW pump P-7A Exhaust pipe Fuel oil storage tanksT-57A and B Vent pipes (correlated)

ANO-2

a. Currently, the ANO-2 TMRE evaluations have determined that the sensitivity results have not exceeded the very small risk change thresholds.

NEI 17-02, Revision 1A, Section 7.3, was revised to document that if the results of a sensitivity study exceed the acceptance guidelines, NRC approval is required.

b. Importance measures used to perform the required sensitivity analyses were determined as described in Section 7.2 1 of NEI 17-02, Revision 1B.

c. The following ANO-2 SSCs meet the characteristics of highly exposed as specified in Section 7.2.1 of NEI 17-02, Revision 1. None of these highly exposed SSCs are considered non-conformances.

Enclosure Attachment 3 to 0CAN041904 Page 24 of 26 SSC Component Type 2200-A Correlation Group Consisting of conduits:

EJ1013 EJ1032 EJ2009 EJ2038 EJ3001 EJ4001 EJ4016 Fuel oil day tank 2T-30A vent Vent pipe Fuel oil day tank 2T-30B vent Vent pipe Fuel oil storage tanks 2T-57A and B Vent pipes (correlated)

ANO-1 and ANO-2

d. Revision 1B to NEI 17-02 has obviated the need to address the issue identified in this RAI.

e. Revision 1B to NEI 17-02 has obviated the need to address the issue identified in this RAI.

Entergy will follow the guidance in Section 7.2.3 of NEI 17-02, Revision 1B, if such sensitivity analyses are required in the future.

f. Short term operator actions (defined as occurring within one hour of the tornado event) that require transit or execution outside Category I structures are also assumed to fail in the TMRE method. These are reasonable assumptions and generally consistent with current high wind PRAs. NEI 17-02, Section A.2.1.2, has been updated to provide some considerations for this treatment. Therefore, no evaluation is required to assess the potential impact of the one-hour operator action on the compliant case risk.

Item 21 - Uncertainties with Missile Impact Distribution Request:

Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Enclosure Attachment 3 to 0CAN041904 Page 25 of 26 The discussion in Section A.7, Zonal vs. Uniform (Z vs U) Sensitivity, of Appendix A, Technical Basis for TMRE Methodology, to NEI 17-02, Revision 1, recognizes differences between zonal and uniform missile distributions without justification. Targets were categorized in Appendix A to separate intuitive from non-intuitive trends and an adjustment factor is proposed to account for zonal distribution of missiles.

Describe, with justification, how uncertainties associated with the impact of the missile distribution on the licensees target hit probability are handled in the GGNS TMRE methodology.

Entergys Response:

NEI 17-02, Section 7.2.1 was revised in Revision 1A and further revised in Revision 1B. The current ANO TMRE analyses were performed in accordance with the revised guidance. In the future, the uncertainties associated with the missile distribution will be managed in accordance with NEI 17-02, Revision 1B, consistent with any terms and conditions established in the NRC safety evaluation.

Item 22 - Key Assumptions Request:

Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014), states, in part, that:

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Further, Section 4.2, Licensee Submittal Documentation, of RG 1.200, Revision 2, states, in part, that:

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

RG 1.200, Revision 2, defines the terms key assumption and key source of uncertainty in Section 3.3.2, Assessment of Assumptions and Approximations.

Section 5.0, Key Assumptions and Approximations, of Enclosure 3 to the LAR states, in part, that assumptions and approximations are reviewed and assessed during the risk assessment to determine the impact on the TMRE risk assessment as required by the NEI 17-02 guidance.

The submittal does not describe the key assumptions and key sources of uncertainties were identified in VEGP internal events PRA model and how those assumptions and uncertainties were addressed.

a. Describe the key assumptions and key sources of uncertainties in VEGP internal events PRA that may impact this application.

b. Describe how each key assumption and key source of uncertainty was dispositioned for this application.

Enclosure Attachment 3 to 0CAN041904 Page 26 of 26 Entergys Response:

The current ANO-1 and ANO-2 PRA internal events model do not identify plant-specific key assumptions. While a list of generic key sources of uncertainty are identified, no plant-specific key sources of uncertainty are identified. Action to identify the key assumptions and sources of uncertainty, along with any potential impact on the TMRE application in the PRA model of record, is being tracked via a Condition Report.

Enclosure Attachment 4 to 0CAN041904 Safety Analysis Report Page Markups (2 pages)

ARKANSAS NUCLEAR ONE Unit 1

2. Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

3. Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH- 4A and 4B pumps (reference CR-ANO-1-2017-3702).

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures. Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings Amendment No. 5.1-15

ARKANSAS NUCLEAR ONE Unit 2 C. For missiles which are generated by release of stored strain energy, the strain energy is equated to kinetic energy in determining missile velocity. The ultimate stress of the material is used resulting in a large amount of energy than would be present at fracture. Losses due to heating, friction, and the relaxation of the material are ignored.

3.5.3.3 Tornado Missiles Appropriate parameters identifying the characteristics of tornado generated missiles are given in Table 3.5-6.

3.5.4 BARRIER DESIGN PROCEDURES The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

3.5.4.1 Reinforced Concrete Targets Missile resistant concrete barriers and structures were designed to withstand and absorb missile impact loads without being fully penetrated in order to prevent damage to protected components.

The design procedures and calculations used to predict local damage in the impact area included estimating the depth of penetration, minimum thickness required to prevent perforation, and minimum thickness required to preclude spalling. Table 3.5-7 shows results of calculations performed for the selected missiles discussed in Section 3.5.3. The penetration and perforation formulae assumed that the missile strikes the target normal to the surface, and the axis of the missile was assumed parallel to the line of flight. These assumptions resulted in a conservative estimate of local damage to the target.

Amendment No. 3.5-14

Enclosure Attachment 5 to 0CAN041904 Retyped Safety Analysis Report Pages (2 pages)

ARKANSAS NUCLEAR ONE Unit 1

2. Lateral force on the structures will be assumed as the force caused by a tornado funnel having a peripheral tangential velocity of 300 mph and a forward progression of 60 mph. The tornado resistant design of the ANO Units was completed prior to the issuance of Regulatory Guide 1.76. As a result, the radius of maximum rotational speed is not significant to the ANO design, and Category I structures were designed considering a uniform pressure resulting from the 300 mph wind velocity (Reference 0CAN059609), except for casks which are governed by Holtec HI-Storm and VSC-24 CFSARs. The applicable portions of wind design methods described in ASCE paper 3269 are used, particularly for shape factors. The provisions for gust factors and variations of wind velocity with height do not apply.

3. Tornado driven missiles equivalent to an airborne 4" x 12" x 12' plank traveling end-on at 300 mph or a 4,000-pound automobile flying through the air at 50 mph and at not more than 25 feet above the ground is assumed.

The NRC approved a license amendment request for ANO-1 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Green train safety-related electrical raceways that are vulnerable to a northern bound tornado-generated missile through small fire damper openings FD-0135-02-0009, FD-0135-02-0022, and FD-0141-02-0011 in the south wall of Controlled Access on Elevation (EL) 386 (reference CR-ANO-1-2016-2752).

Unprotected conduits in the demineralizer area (Room 73, Unit 1 Bowling Alley, EL 354) on the east side of the hallway near Column Line 5.9 (reference CR-ANO 2017-1171).

A cable tray opening in the reinforced concrete wall 3-S-23 between Electrical Equipment Rooms 103 and 104 on EL 368 (reference CR-ANO-1-2017-1171).

P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-1-2015-3940).

Conduit EC1493 which includes the reactor head vent solenoid valve (reference CR-ANO-1-2016-02752).

Small bore service water piping (HCD-65-2 and HCD-66-2) to VCH- 4A and 4B pumps (reference CR-ANO-1-2017-3702).

The design bases for tornado loads for the reactor building are presented in Section 5.2.1.2.6.

Components in Class 1 buildings, such as penetrations, locks, doors, large openings, spent fuel pool, emergency diesel generator rooms, etc., are inherently tornado protected by virtue of their being housed in tornado resistant structures. Penetrations which are not located within a tornado resistant structure or protected by a missile shield are the main steam line and purge line penetrations. These penetrations will withstand tornado winds and pressure drop loadings Amendment No. 5.1-15

ARKANSAS NUCLEAR ONE Unit 2 C. For missiles which are generated by release of stored strain energy, the strain energy is equated to kinetic energy in determining missile velocity. The ultimate stress of the material is used resulting in a large amount of energy than would be present at fracture. Losses due to heating, friction, and the relaxation of the material are ignored.

3.5.3.3 Tornado Missiles Appropriate parameters identifying the characteristics of tornado generated missiles are given in Table 3.5-6.

3.5.4 BARRIER DESIGN PROCEDURES The procedures and calculations employed in design of missile resistant barriers are described in the following sections. Intervening SSCs including large equipment and structural members may be utilized as missile barriers provided they are qualified for the applicable design loads including tornado winds and differential pressure. For missile barrier design, BC-TOP-9A in conjunction with EPRI NP-440 may be utilized. EPRI NP-440 provides a basis for missile deformation and impact characteristics for designing missile barriers.

The NRC approved a license amendment request for ANO-2 that authorized the use of the Tornado Missile Risk Evaluator (TMRE) methodology [Reference NRC SE letter number].

TMRE is a risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and may be used as an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE evaluation demonstrated that tornado-generated missile protection is not required for the following:

Safety-related cables related to 2K-4A Emergency Diesel Generator (EDG) in conduit EC1373 located in Unit 2 Controlled Access Area Room 2136 and Fire Brigade Area Room 2145, EL 386 (reference CR-ANO-2-2017-1555).

2P-7A Emergency Feed Water (EFW) Pump Steam Supply Line located above EL 404 (reference CR-ANO-2-2015-4851).

2K-4A and 2K-4B EDG Exhaust Stacks located on the Auxiliary Building roof (reference CR-ANO-C-2018-2260).

3.5.4.1 Reinforced Concrete Targets Missile resistant concrete barriers and structures were designed to withstand and absorb missile impact loads without being fully penetrated in order to prevent damage to protected components.

The design procedures and calculations used to predict local damage in the impact area included estimating the depth of penetration, minimum thickness required to prevent perforation, and minimum thickness required to preclude spalling. Table 3.5-7 shows results of calculations performed for the selected missiles discussed in Section 3.5.3. The penetration and perforation formulae assumed that the missile strikes the target normal to the surface, and the axis of the missile was assumed parallel to the line of flight. These assumptions resulted in a conservative estimate of local damage to the target.

Amendment No. 3.5-14