Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402

CNL-18-068

November 29, 2018 10 CFR 50.69 10 CFR 50.90

ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

Watts Bar Nuclear Plant, Units 1 and 2 Facility Operating License Nos. NPF-90 and NPF-96 NRC Docket Nos. 50-390, 50-391, and 72-1048

SUBJECT: Watts Bar Nuclear Plant, Units 1 and 2, Application to Adopt 10 CFR 50.69, "Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors” (WBN-TS-17-24)

References: TVA letter to NRC, CNL-18-067, Application for Technical Specifications Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (WBN-TS-16-02), dated October 12, 2018 (ML18288A352)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.69 and 10 CFR 50.90, Tennessee Valley Authority (TVA) is submitting for Nuclear Regulatory Commission (NRC) approval, a request for an amendment to Facility Operating License Nos. NFP-90 and NPF-96 for the Watts Bar Nuclear Plant (WBN), Units 1 and 2, respectively.

The proposed license amendment request (LAR) would modify the WBN Facility Operating Licenses to allow for the implementation of the provisions of 10 CFR, Part 50.69, “Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.” The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Enclosure 1 to this letter provides the basis for the proposed change to the WBN, Units 1 and 2 Facility Operating Licenses. The categorization process being implemented through this change is consistent with Nuclear Energy Institute (NEI) 00-04, “10 CFR 50.69 SSC Categorization Guideline," Revision 0, dated July 2005, which was endorsed by the NRC in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," Revision 1 dated May 2006. U.S. Nuclear Regulatory Commission CNL-18-068 Page 2 November 29, 2018

Attachment 1 to Enclosure 1 provides a list of categorization prerequisites. Use of the categorization process on a plant system would only occur after these prerequisites are met.

In the referenced letter, TVA submitted a separate LAR for Technical Specification Task Force (TSTF)-425, Surveillance Frequency Control Program using the same Probabilistic Risk Assessment (PRA) models described in this LAR. TVA requests that the NRC coordinate their review of the PRA technical adequacy description in Sections 3.2 and 3.3 of Enclosure 1 for both applications. This action would reduce the number of TVA and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action (RLA), as the details of the PRA models in each LAR are complete, which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other.

Enclosure 2 to this letter provides the existing WBN Unit 1 and Unit 2 Operating Licenses marked-up to show the proposed changes. Enclosure 3 to this letter provides the existing WBN Unit 1 and Unit 2 Operating Licenses pages to show the proposed changes.

TVA has determined that there are no significant hazards consideration associated with the proposed change and that the license amendment qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9). Additionally, in accordance with 10 CFR 50.91 (b)(1 ), TVA is sending a copy of this letter and enclosures to the Tennessee Department of Environment and Conservation.

TVA requests approval of the proposed license amendment within 15 months of the date of this letter with implementation within 90 days following NRC approval.

There are no new regulatory commitments made in this letter. Please address any questions regarding this submittal to Tony Brown at (423) 751-3275.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 29th day of November 2018.

E. K. Henderson Director, Nuclear Regulatory Affairs

Enclosures: 1. Evaluation of the Proposed Change 2. Proposed Changes (Mark-Ups) to WBN Operating Licenses for Unit 1 and Unit 2 3. Proposed Changes (Final Typed) to WBN Operating Licenses for Unit 1 and Unit 2 cc: See Page 3 U.S. Nuclear Regulatory Commission CNL-18-068 Page 3 November 29, 2018

cc: NRC Regional Administrator - Region II NRC Senior Resident Inspector - Watts Bar Nuclear Plant NRC Project Manager - Watts Bar Nuclear Plant Division of Radiological Health - Tennessee State Department of Environment and Conservation

Enclosure 1 Evaluation of the Proposed Change

Table of Contents 1, Summary Description ...... 3 2, Detailed Description ...... 3 2.1 CURRENT REGULATORY REQUIREMENTS ...... 3 2 .2 Reason for Proposed Change ...... 4 2.3 Description of the Proposed Change...... S 3. Technical Evaluation ...... 6 3.1 Categorization Process Description (10 CFR 50.69(b)(2)(i)) ...... 6 3.1.1 Overall Categorization Process ...... 6, 3.1.2 Passive Categorization Process ...... 11 3.2 Technical Adequacy Evaluation (10 CFR 50.69(b)(2)(ii)) ...... 11 3.2.1 Internal Events and Internal Flooding ...... 12 3.2.2 Fire Hazards ...... 12 3.2.3 Seismic Hazards ...... 13 3.2.4 Other External Hazards ...... 13 3.2.5 Low Power & Shutdown ...... 14 3.2.6 PRA Maintenance and Updates ...... ,... 14 3.2.7 PRA Uncertainty Evaluations ...... 14 3.3 PRA Review Process Results (10 CFR 50.69(b)(2)(iii)) ...... 15 3.4 Risk Evaluations (10 CFR 50.69(b)(2)(iv)) ...... 16 3.5 Feedback and Adjustment Process (10 CFR 50.69(e) ...... 16 4. REGULATORY EVALUATION ...... 17 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA ...... 17 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS ...... 17 4.3 CONCLUSIONS ...... 18 5. ENVIRONMENTAL CONSIDERATION ...... 19 6. REFERENCES ...... 19

CNL-18-068 E1-1 of 46 Enclosure 1 Evaluation of the Proposed Change

LIST OF ATTACHMENTS

Attachment 1: List of Categorization Prerequisites ...... 21 Attachment 2: Description of PRA Model Used in Categorization ...... 22 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items ...... 23 Attachment 4: External Hazards Screening ...... 32 Attachment 5: Progressive Screening Approach for Addressing External Hazards ...... 44 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty ...... 46

CNL-18-068 E1-2 of 46

Enclosure 1 Evaluation of the Proposed Change

1. SUMMARY DESCRIPTION

The proposed amendment modifies the Tennessee Valley Authority (TVA) Watts Bar Nuclear Plant (WBN), Units 1 and 2 licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, “Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.” The provisions of 10 CFR 50.69 (Reference 1) allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

2. DETAILED DESCRIPTION

.2.1 CURRENT REGULATORY REQUIREMENTS

The Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures, human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. The structures, systems, and components (SSCs) necessary to defend against the DBEs are defined as "safety-related.” These SSCs are the subject of many regulatory requirements, herein referred to as “special treatments,” designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations. The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the General Design Criteria (GDC) of Appendix A to 10 CFR 50 is not explicitly defined.

CNL-18-068 E1-3 of 46

2.2 REASON FOR PROPOSED CHANGE

A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRA) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation (i.e., 10 CFR 50.69). The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by Nuclear Energy Institute NEI 00-04, “10 CFR 50.69 SSC Categorization Guideline” (Reference 2), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant (HSS), existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow TVA to improve focus on equipment that has safety significance resulting in improved plant safety.

CNL-18-068 E1-4 of 46

2.3 DESCRIPTION OF THE PROPOSED CHANGE

TVA proposes to revise the Operating Licenses (OL) of WBN Units 1 and 2 to document the NRC's approval of the use of 10 CFR 50.69. The following is the proposed revision to the WBN Unit 1 OL. A similar change is also being made to the WBN Unit 2 OL.

(12) The Licensee shall comply with the following conditions on the schedule as noted below: WBN is approved to implement 10 CFR 50.69 using the processes for categorization of Risk- Informed Safety Class (RISC)-1, RISC-2, RISC- 3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and seismic hazards; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, fire hazards by use of the fire protection program (FPP) safe shutdown equipment list (SSEL), and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa- 2009, as specified in Unit 1 License Amendment No. [XXX] dated [DATE].

WBN will complete the implementation items listed in Attachment 1 of TVA letter to NRC dated November 29, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused - scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA model of record prior to implementation of the 10 CFR 50.69 categorization process. Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from using the FPP SSEL approach to an internal fire probabilistic risk assessment approach).

Enclosure 2 to this letter provides the existing WBN Unit 1 Operating License marked-up to show the proposed change. Enclosure 3 to this letter provides the proposed change in a re-typed version in the WBN Unit 1 Operating License.

Enclosure 2 of this letter contains a similar markup of the WBN Unit 2 Operating License. Enclosure 3 to this letter provides the proposed change in a re-typed version in the WBN Unit 2 Operating License.

CNL-18-068 E1-5 of 46

3. TECHNICAL EVALUATION

10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

“A licensee voluntarily choosing to implement this section shall submit an application for license amendment under § 50.90 that contains the following information:

(i) A description of the process for categorization of RISC–1, RISC–2, RISC–3, and RISC–4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet § 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).”

Each of these submittal requirements are addressed in the following sections of this enclosure.

TVA also submitted a separate license amendment request (LAR) for Technical Specification Task Force (TSTF)-425, Surveillance Frequency Control Program (Reference 3) using the same PRA models described in this enclosure. TVA requests that the NRC coordinate their review of the PRA technical adequacy description in Sections 3.2 and 3.3 of this enclosure for both applications. This action should reduce the number of TVA and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action (RLA), as the details of the PRA models in each LAR are complete, which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(I))

3.1.1 Overall Categorization Process

TVA will implement the risk categorization process in accordance with the NEI 00-04, Revision 0, as endorsed by Regulatory Guide (RG) 1.201, Revision 1, “Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance” (Reference 4). NEI 00-04 Section 1.5 states, “Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant.” A separate evaluation is

CNL-18-068 E1-6 of 46

appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The process to categorize each system will be consistent with the guidance in NEI 00-04. RG 1.201 states that “the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence” and that “all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv).” However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible and, as long as they are all completed, they may even be performed in parallel. Note that NEI 00-04 only requires Item 3 to be completed for components/functions categorized as low safety significance (LSS) by all other elements. Similarly, NEI 00-04 only requires Item 4 to be completed for safety related active components/functions categorized as LSS by all other elements. 1. PRA-based evaluations (e.g., the internal events, internal flooding, seismic, fire PRAs) 2. Non-PRA approaches (e.g., fire safe shutdown equipment list (SSEL), seismic safe shutdown equipment list (seismic SSEL), other external events screening, shutdown assessment) 3. Seven qualitative criteria in Section 9.2 of NEI 00-04 (See Section 3.2 of this enclosure) 4. The defense-in-depth assessment 5. The passive categorization methodology Categorization of SSCs will be completed per the NEI 00-04 process, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization [i.e., High Safety Significant (HSS) or LSS] that is presented to the Integrated Decision-making Panel (IDP). Note: the term “preliminary HSS or LSS” is synonymous with the NEI 00-04 term “candidate HSS or LSS.” A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 3-1. The safety significance determination of each element, identified above, is independent of each other; therefore, the sequence of the elements does not impact the resulting preliminary categorization of each component or function. Consistent with NEI 00-04, the categorization of a component or function will only be “preliminary” until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final RISC category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS; however, the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04. Table 3-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

CNL-18-068 E1-7 of 46

Table 3-1: IDP Changes from Preliminary HSS to LSS IDP Drives Categorization Step - Evaluation Change Element Associated NEI 00-04 Section Level HSS to Functions LSS Internal Events Base Not Yes Case – Section 5.1 Allowed Fire, Seismic and Other External Events Allowable No Risk (PRA Base Case Component Modeled) PRA Sensitivity Allowable No Studies Integral PRA Not Assessment – Section Yes Allowed 5.6 Fire, Seismic and Not Other External Component No Risk (Non- Allowed Hazards – modeled) Shutdown – Section Not Function/Component No 5.5 Allowed Core Damage – Not Function/Component Yes Defense- Section 6.1 Allowed in-Depth Containment – Section Not Component Yes 6.2 Allowed Qualitative Considerations – Function Allowable1 N/A Criteria Section 9.2 Not Passive Passive – Section 4 Segment/Component No Allowed Note:

1 The assessments of the qualitative considerations are agreed upon by the IDP in accordance with NEI 00-04 Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDP’s consideration; however, the final assessments of the seven considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69-categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all of the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e., all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the qualitative criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with

CNL-18-068 E1-8 of 46

mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal events PRA or Integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS; and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potential LSS components that may have been initially associated with a HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g. passive, non-PRA-modeled hazards - see Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped. Therefore, if a HSS component is mapped to a LSS function, that component will remain HSS. If an LSS component is mapped to an HSS function, that component may be driven HSS based on Table 3-1 above, or may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

• The IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

• The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in- depth philosophy and requirements to maintain this philosophy.

• The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to § 50.69(f)(1) will be documented in TVA procedures. Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. However, a simple majority of the panel is sufficient for final decisions regarding safety significance and LSS.

• Passive characterization will be performed using the processes described in Section 3.1.2 of this enclosure. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

• An unreliability factor of three will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of three was chosen as it is representative of the typical error factor of basic events used in the PRA model.

• NEI 00-04, Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in NEI 00-04, Section 5, but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5. This requirement is further clarified in the Vogtle SER (Reference 5), which states “…if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.”

CNL-18-068 E1-9 of 46

• Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The IDP must intervene to assign any of these HSS Function components to LSS.

• With regard to the criterion that considers whether the active function is called out or relied upon in the plant emergency/abnormal operating procedures, TVA will not take credit for alternate means unless the alternate means are proceduralized and included in licensed operator training.

The following exception is taken to the NEI 00-04 categorization process:

• NEI 00-04, Section 5.2 states that the fire safety significance process takes one of two forms. Either the use of Fire Induced Vulnerability Evaluation (FIVE) or a Fire PRA. However, Section 3.2.2 of this enclosure describes an alternate approach, which implements the Appendix R Safe Shutdown analysis that will be used in the WBN categorization process to evaluate safety significance related to the fire hazard.

The risk analysis to be implemented for each hazard is described below.

• Internal event (including internal flooding) risks: internal events including internal flooding PRA model, Revision 3, March 2017

• Fire risks: fire protection program SSEL

• Seismic risks: Seismic PRA model (WBN Unit 1 Revision 2, June 2017 and WBN Unit 2 Revision 2, May 2017)

• Other external risks (e.g., tornados, external floods): Using the IPEEE screening process as approved by the NRC in Reference 6. The other external hazards were determined to be insignificant contributors to plant risk.

• Low power and shutdown risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, “Guidance for Industry Actions to Assess Shutdown Management” (Reference 7), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above (e.g., change from a Fire protection program SSEL approach to a fire probabilistic risk assessment approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements.

1. Program procedures used in the categorization 2. System functions, identified and categorized with the associated bases 3. Mapping of components to support function(s) 4. PRA model results, including sensitivity studies 5. Hazards analyses, as applicable 6. Passive categorization results and bases 7. Categorization results including all associated bases and RISC classifications 8. Component critical attributes for HSS SSCs 9. Results of periodic reviews and SSC performance evaluations 10. IDP meeting minutes and qualification/training records for the IDP members

CNL-18-068 E1-10 of 46

3.1.2 Passive Categorization Process

For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology contained in Reference 8 consistent with the related Safety Evaluation (SE).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., DID, safety margins) in determining safety significance. Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in Reference 5. The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization, as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. The passive categorization process is intended to apply the same risk-informed process accepted in the ANO Unit 2 Approval of Request for Alternative (2-R&R-004) (Reference 8) for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N-660 and N-662 as published in Regulatory Guide 1.147, Revision 18. Both code cases employ a similar risk- informed safety classification of SSCs in order to change the repair/ replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned HSS, for passive categorization, which will result in HSS for its risk-informed safety classification and cannot be changed by the IDP. Therefore, this methodology and scope for passive categorization is acceptable and appropriate for use at WBN for 10 CFR 50.69 SSC categorization.

3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(II))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in TVA letter to NRC CNL-17-071 (Reference 10) with routine maintenance updates applied.

CNL-18-068 E1-11 of 46

3.2.1 Internal Events and Internal Flooding

The WBN categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The TVA risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the WBN units. Attachment 2 of this enclosure identifies the applicable internal events and internal flooding PRA models.

3.2.2 Fire Hazards

The WBN categorization process will use the fire SSEL for evaluation of safety significance related to fire hazards. The fire safe shutdown paths identify the safety functions and associated sets of equipment credited to achieve and maintain safe shutdown under postulated fire conditions as defined by 10 CFR 50, Appendix R, (Reference 11) and NRC Branch Technical Position CMEB 9.5-1 (Reference 12). The fire SSEL identifies the credited equipment on these fire safe shutdown paths. This approach also considers regulatory exemptions related to the fire safe shutdown program and fire-induced multiple spurious operations (MSOs) to identify any additional equipment.

The use of the fire SSEL is a screening approach. There are no importance measures used in determining safety significance related to the fire hazard. Instead, using the fire SSEL would identify all credited equipment as HSS regardless of their fire damage susceptibility or frequency of challenge. This approach ensures the SSCs that are credited to establish and maintain safe shutdown capability are retained as safety-significant. If a component is credited on the fire SSEL, it is considered HSS. As stated in NEI 00-04, an SSC identified as HSS by a non-PRA method to address fire “may not be re-categorized by the IDP.”

Furthermore, regulatory exemptions related to the fire safe shutdown program and previously identified fire-induced MSOs were reviewed and additional equipment that is relied upon to establish and maintain safe shutdown will be retained as HSS. The results of this review have been documented by the site and are available for NRC audit. Figure 3-1 illustrates how the fire SSEL and the additional identified equipment are reviewed to determine if the component being evaluated is HSS.

This approach is an alternate process from the NEI 00-04 endorsed approaches. Similar to the NEI 00-04 FIVE approach, this approach uses the SSEL as a screening tool. However, the development of the fire SSEL is not based on a successive screening methodology and is the starting point for the FIVE methodology. Therefore, industry assessments have shown that this fire SSEL approach leads to many additional SSCs being identified as HSS making it more conservative in determining safety significance than the NEI 00-04 FIVE approach or a Fire PRA.

The WBN fire safe shutdown program is an active regulatory program that is routinely inspected by NRC. It was confirmed that this program ensures that the fire SSEL and the identification of additional equipment relied upon to establish and maintain safe shutdown reflects the current as-built, as-operated plant and that changes to the plant will be evaluated to determine their impact to the equipment list and the categorization process.

CNL-18-068 E1-12 of 46

Select Component

No Candidate Low Safety Significant

Candidate High Safety Significant

Identify Safety Significant Attributes of Component

Figure 3.1: Safety Significance Process for Structures, Systems, and Components Addressed in Fire Safe Shutdown Program 3.2.3 Seismic Hazards

The WBN categorization process for seismic hazards will use a peer reviewed plant-specific seismic PRA (SPRA) model. The TVA risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for both of the WBN units. Industry standard methods were utilized in the development of the seismic hazards for the SPRA. Updates to seismic hazard curves will be reflected in the PRA used for the categorization in accordance with the PRA model maintenance process.

ASME/ANS PRA Standard ASME/ANS RA-Sb-2013 (Reference 9) is credited for the peer review performed on the WBN SPRA. The seismic analysis is based on the latest available hazard curves. Attachment 2 identifies the applicable SPRA model.

3.2.4 Other External Hazards

All other external hazards were screened from applicability to WBN per a plant-specific evaluation in accordance with Generic Letter (GL) 88-20 (Reference 13) and updated to use the criteria in ASME PRA Standard RA-Sa-2009 (Reference 14). Attachment 4 provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards.

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS.

CNL-18-068 E1-13 of 46

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process

3.2.5 Low Power & Shutdown

Consistent with NEI 00-04, the WBN categorization process will use the shutdown safety management plan described in NUMARC 91-06 (Reference 7), for evaluation of safety significance related to low power and shutdown conditions.

The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function. The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs.

SSCs that meet the two criteria (i.e., considered part of a “primary shutdown safety system” or a failure would initiate an event during shutdown conditions) described in Section 5.5 of NEI 00-04 will be considered preliminary HSS.

3.2.6 PRA Maintenance and Updates

The TVA risk management process ensures that the applicable PRA model(s) used in this application continues to reflect the as-built and as-operated plant for each of the WBN units. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner, but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, TVA will implement a process that addresses the requirements in NEI 00-04, Section 11, “Program Documentation and Change Control.” The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

3.2.7 PRA Uncertainty Evaluations

Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in NEI 00-04 Section 8 “Risk Sensitivity Study,” and in the prescribed sensitivity studies discussed in Section 5, “Component Safety Significance Assessment.”

CNL-18-068 E1-14 of 46

In the overall risk sensitivity studies, TVA will utilize a factor of three to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle (Reference 5). Consistent with the NEI 00-04 guidance, TVA will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in all identified PRA models for all systems that have been categorized are increased by a factor of three. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

The detailed process of identifying, characterizing, and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 (Reference 15) and Section 3.1.1 of EPRI TR-1016737 (Reference 16). Revision 0 of NUREG 1855 was the version in effect at the time the uncertainty calculation was created. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those that would be significant for the evaluation of this application. If the WBN PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.

Key WBN PRA model specific assumptions and sources of uncertainty for this application were identified and dispositioned in Attachment 6. The conclusion of this review is that no additional sensitivity analyses are required to address WBN PRA model specific assumptions or sources of uncertainty.

3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 have been assessed against RG 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” Revision 2 (Reference 17), consistent with “NRC Regulatory Issue Summary 2007-06 Regulatory Guide 1.200 Implementation” (Reference 18).

The internal events PRA model with internal flooding was subjected to a self-assessment and a full-scope peer review conducted in November 2009. The review was conducted consistent with NEI 05-04, Revision 2

The SPRA model was subject to a self-assessment and a full-scope peer review conducted in March 2016. The SPRA Peer Review was conducted consistent with NEI 12-13, Revision 0, “External Hazards PRA Peer Review Process Guidelines,” (Reference 19) and addressed all NRC comments (Reference 20).

A finding closure review was conducted on the identified PRA models in June 2017 (internal events with internal flooding) and April 2017 (seismic). Closed findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and

CNL-18-068 E1-15 of 46

NEI 12-13, “Close-out of Facts and Observations” (F&Os) (Reference 21) as accepted by NRC in Reference 22. The results of this review have been documented and are available for NRC audit. Attachment 3 provides a summary of the remaining findings and open items, including:

• Open items and disposition from the WBN RG 1.200 self-assessment. • Open findings and disposition of the WBN peer reviews. • Identification of and basis for any sensitivity analysis needed to address open findings. The attachment identified above demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required by 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The WBN 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the NEI guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of 10 CFR 50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF). The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, and human errors). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

3.5 FEEDBACK AND ADJUSTMENT PROCESS (10 CFR 50.69(e))

If significant changes to the plant risk profile are identified, or if it is identified that a RISC-3 or RISC-4 SSC can (or actually did) prevent a safety significant function from being satisfied, an immediate evaluation and review will be performed prior to the normally scheduled periodic review. Otherwise, the assessment of potential equipment performance changes and new technical information will be performed during the normally scheduled periodic review cycle.

Scheduled periodic reviews no longer than once every two refueling outages will evaluate new insights resulting from available risk information (i.e., PRA model or other analysis used in the categorization) changes, design changes, operational changes, and SSC performance. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process will be updated. This review will include: • A review of plant modifications since the last review that could impact the SSC categorization • A review of plant specific operating experience that could impact the SSC categorization • A review of the impact of the updated risk information on the categorization process results • A review of the importance measures used for screening in the categorization process

CNL-18-068 E1-16 of 46

• An update of the risk sensitivity study performed for the categorization In addition to the normally scheduled periodic reviews, if a PRA model or other risk information is upgraded, a review of the SSC categorization will be performed.

4. REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA

The following NRC requirements and guidance documents are applicable to the proposed change.

• The regulations in 10 CFR Part 50.69, (Reference 1) • RG 1.201, (Reference 4). • RG 1.174, (Reference 23). • RG 1.200, (Reference 17).

The proposed change is consistent with the applicable regulations and regulatory guidance.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS

Tennessee Valley Authority (TVA) proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, “Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.” The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

TVA has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of structures, systems, and components (SSCs) subject to Nuclear Regulatory Commission (NRC) special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety

CNL-18-068 E1-17 of 46

analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC. Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any safety limits or operating parameters used to establish the safety margin. The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSIONS

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission’s regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

CNL-18-068 E1-18 of 46

5. ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES

1. Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors” 2. Nuclear Energy Institute, NEI 00-04, “10 CFR 50.69 SSC Categorization Guideline," Revision 0, dated July 2005 3. TVA letter to NRC, CNL-18-067, Application for Technical Specifications Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (WBN-TS-16-02), dated October 12, 2018 (ML18288A352) 4. Regulatory Guide 1.201, “Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,” Revision 1, dated May 2006 (ML061090627) 5. NRC Letter to Southern Nuclear Operating Company, “Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments RE: Use of 10 CFR 50.69 (TAC Nos. ME9472 and ME9473),” dated December 17, 2014 (ML14237A034) 6. NRC Letter to TVA, “Watts Bar Nuclear Plant, Unit 2 - Review of Individual Plant Examination of External Events Design Report (TAC No. ME4482),” dated September 20, 2011 (ML111960300) 7. NUMARC 91-06, “Guidelines for Industry Actions to Assess Shutdown Management,” dated December 1991 (ML14365A203) 8. NRC Letter to Entergy, “Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High /Energy Systems (TAC No. MD5250),” dated April 22, 2009 (ML090930246) 9. ASME/ANS RA-Sb-2013, “Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” dated September 30, 2013

CNL-18-068 E1-19 of 46

10. TVA letter to NRC, CNL-17-071, “Seismic Probabilistic Risk Assessment for Watts Bar Nuclear Plant, Units 1 and 2 - Response to NRC Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,” dated June 30, 2017 (ML17181A485) 11. “Appendix R to10 CFR Part 50 Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979” 12. Branch Technical Position CMEB 9.5-1, “Guidelines for Fire Protection for Nuclear Power Plants,” Revision 3, dated July 1981 (ML070660454) 13. Generic Letter 88-20, “Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4,” dated June 1991 14. ASME/ANS RA-Sa-2009, “Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” dated February 2, 2009 15. NUREG-1855, “Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making,” Revision 0, dated March 2009 (ML090970525) 16. EPRI TR-1016737, “Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments,” dated December 2008 17. Regulatory Guide 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” Revision 2, March 2009 (ML090410014) 18. NRC Regulatory Issue Summary 2007-06, “Regulatory Guide 1.200 Implementation,” dated March 22, 2007 (ML070650428) 19. NEI 12-13, “External Hazards PRA Peer Review Process Guidelines," Revision 0, Nuclear Energy Institute, August 2012 (ML12240A027) 20. NRC Letter to NEI, “U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, ‘External Hazards PRA Peer Review Process Guidelines,’ Dated August 2012,” dated November 16, 2012 (ML12321A280) 21. NEI Letter to NRC, “Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os),” dated February 21, 2017 (ML17086A450 and ML17086A451) 22. NRC Letter to NEI, “U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close-Out of Facts and Observations (F&Os),” dated May 3, 2017 (ML17079A427) 23. Regulatory Guide 1.174, “An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,” Revision 3, dated January 2018 (ML17317A256)

CNL-18-068 E1-20 of 46

Attachment 1: List of Categorization Prerequisites

TVA will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

• IDP member qualification requirements.

• Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary HSS or LSS based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2 of this enclosure). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting, an LSS function are categorized as preliminary LSS.

• Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

• Assessment of DID and safety margin. Safety-related components that are categorized as preliminary LSS are evaluated for their role in providing DID and safety margin and, if appropriate, upgraded to HSS.

• Review by the IDP. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

• Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to CDF and LERF and meets the guidelines of Regulatory Guide 1.174.

• Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

• Documentation requirements per Section 3.1.1 of the enclosure.

• Findings and Observations (F&Os) items 2-28 and 7-10. The issues associated with these F&Os will be corrected.

CNL-18-068 E1-21 of 46

Attachment 2: Description of PRA Models Used in Categorization

Units Model Baseline CDF Baseline LERF Comments

This model Internal Events With represents the Internal Flooding current WBN Computer Aided Fault Unit 1 Full 1 9.08E-06/yr 1.01E-06/yr Tree Analysis Power Internal (CAFTA) Rev. 3 Events (FPIE) March 2017 PRA Model of Record (MOR).

This model Internal Events With represents the 2 Internal Flooding 8.98E-06/yr 1.00E-06/yr current WBN CAFTA Rev. 3 Unit 2 FPIE March 2017 PRA MOR.

This model represents the Seismic PRA current WBN 1 Rev. 2 2.60E-06/yr 1.70E-06/yr Unit 1 Seismic June 2017 PRA MOR.

This model represents the Seismic PRA current WBN 2 Rev. 2 2.61E-06/yr 1.73E-06/yr Unit 2 Seismic May 2017 PRA MOR.

CNL-18-068 E1-22 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The closure review team stated that while most of the entries in the Type Code (.TC) and Database (.RR) files contain uncertainty information, there still appears to be some entries that miss such information. Uncertainty information is not included in the database file for dependent human error probability (HEP) combinations, some recovery sequences, failure of residual heat removal MDN-000-999-2008-0145 (RHR) legs, failure of safety injection (SI) piping, common [Data Analysis] Section 5.3 cause combinations generated by the Common cause documents the Bayesian failure (CCF) tool, and interfacing system loss of coolant update process used for WBN. accident (ISLOCA) basic events. Uncertainty information Both mean and Error Factor is not included in the type code file for some operator (EF) values are produced for actions. CC-II each type code. However, it was noted that uncertainty 1-6 DA-D3 Quantification of the PRA model uses point estimates for interval data was not entered the calculation of CDF and LERF; therefore, uncertainty into the WSBN2.RR file and information as described in the closure review would not that extraneous information cause a change in the point estimate results. The from previous versions of the categorization of systems in the 50.69 application only uses database were being applied the quantification of the PRA model in the point estimate to the factor (demands or mode and therefore, is not affected by finding described in exposure time) field of the the closure review. Some entries do not have uncertainty Basic Event (BE) table. information. The NEI 00-04 categorization process, which TVA will follow, exercises key areas of uncertainty in the PRA (e.g., human reliability, CCF and no maintenance plant configurations). If an SSC that had been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration.

CNL-18-068 E1-23 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The closure review team stated that Appendix F of the Human Reliability Analysis "In order to satisfy this, the recovery rule file was developed to limit the joint probability MDN-000-999-2008-0144 of each combination to be no less than 1.0E-05.” However, (Human Reliability Analysis) review of dependency recovery file revealed that not all Appendix F addresses HEP combinations were replaced with a probability no less identification of dependencies. than 1E-05. A few examples of combinations with I/II/III The criteria are met since the probabilities less than 1.0E-05 still exist. I/II/III HR-D5 analysts followed common Not Met HR-G7 practice. However, the stated The NEI 00-04 categorization process, which TVA will 2-28 I/II/III QU-C1 rule for application of a lower follow, exercises key areas of uncertainty in the PRA QU-C2 limit (1E-5) on the combined (e.g., Human Reliability, Common Cause Failures and No HEP was not applied in the Maintenance Plant Configurations). If an SSC that had Qrecover File. been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration. TVA intends on correcting the recovery rule file to ensure no combinations less than 1E-05 are used in the quantification.

CNL-18-068 E1-24 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The closure team stated that discussion of sources of modeling uncertainty for ISLOCA, CCF, and HEP dependent events are included in the current version of the Uncertainty and Sensitivity notebook. However, this F&O Section 5.8 of the and the associated SRs pertain to parametric uncertainty. Quantification Notebook The Uncertainty and Sensitivity notebook specifically notes provides a result of the that the state of knowledge correlation was not applied in parametric uncertainty the ISLOCA calculation of valve failure probabilities (as analysis. The analysis does required by supporting requirement QU-A3). It does not not include the uncertainty QU-A3 I appear that the items identified in this F&O have been 3-6 parameters for the CCF events QU-E3 I addressed. and ISLOCA events. In addition, the HRADEP It is recognized that some entries do not have uncertainty recovery events found in the information. The NEI 00-04 categorization process, which recovery files are not treated TVA will follow, exercises key areas of uncertainty in the properly in the parametric PRA (e.g., Human Reliability, CCF and No Maintenance uncertainty analysis. Plant Configurations). If an SSC that had been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration.

CNL-18-068 E1-25 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The peer closure team stated: Based on the actions taken, supporting requirement (SR) LE-C9 may be considered to be MET at Capability Category (CC) II-III; SR LE-C2 remains MET at CC I because there are several examples of Operator Actions following the onset of core damage that were treated conservatively and not updated to address the The operator action failure F&O (e.g., operator actions to recover equipment were not probabilities considered in the specifically considered, actions to ‘blind’ feed the steam LERF analysis were not generators were not credited, and manual actuation of the correctly estimated. After core nitrogen backup system were not credited). LE-C2 I damage, the operation steps in LE-C7 I/II/III the Severe Accident 5-8 This finding addresses over-conservatisms with respect to LE-C9 I Management Guidelines operator actions that are not credited following the onset of LE-E1 I/II/III (SAMGs) would be much core damage. different from the steps in the Emergency Operating The risk-informed categorization process assessing the Procedures (EOPs) before risk-significance of modelled SSCs is based on the Risk core damage. Achievement Worth and Fussell-Vesely importance measures. The absence of crediting operations is an over- conservatism that would potentially result in more HSS SSCs, RISC-1 and RISC-2 than LSS RISC-3 and RISC-4 if credit had been taken.

CNL-18-068 E1-26 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The peer closure team stated that they confirmed that the discussion in Section 5.4.1 of the internal flooding notebook provides the information identified in the F&O response, however, no impacts of these actions were able to be identified. It is noted that the justifications for Main Control Room (MCR) actions all identify EPRI Guidance items 3.4 and 4.3 as the basis for making no changes to MCR HEPs; however, both items 3.4 and 4.3 state they only apply to Human Failure Events (HFEs) for which there is more than one hour available for the operator action. The MCR The analysis in Section 5.4.1 actions listed in the table vary from 10 min. to 14.4 hr. For [Internal Flooding Notebook] actions that have greater than one hour for response or are includes an assessment that only in response to Internal Events (IEs) that cannot be evaluates existing human caused by a flood initiator, items 3.4 & 4.3 are valid actions. From a cursory justification for no change to the HEP. For the HEPs that review, the main impact seems are required in less than 1 hour and required to respond to 7-10 IFQU-A6 Not Met to be an exclusion of non-Main a flood initiator, items 3.4 and 4.3 are not valid and, in Control Room (MCR) actions these cases, items 4.1 and 4.2 should apply and these given a flood event. There require consideration of an increased stress level to appears to be little if any account for flood stress levels and consideration of an adjustment to the other actions increased median response time to account for the flood that are performed in the effects, (e.g., higher stress and flood distractions). Based MCR. on the current documentation, it is not possible to determine whether/how these latter effects were considered to reach the conclusion that there are no numerical effects on the MCR HEPs that are required for a flood initiators in less than one hour. As a result, the actions implied by the F&O resolution response cannot be confirmed for these HEPs.

This finding addresses a documentation issue that does not support review in a manner to determine, or to confirm the

CNL-18-068 E1-27 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) conclusion of “no numerical effects.” The NEI 00-04 categorization process, which TVA will follow, exercises key areas of uncertainty in the PRA (e.g., Human Reliability, CCF, and No Maintenance Plant Configurations). If an SSC that had been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration. TVA Intends to review and adjust HEPs, as necessary, for actions less than 1-hour.

The peer closure team stated that the flooding initiating basic events contained in the current CAFTA database file include the error factors and distribution information. The values shown are consistent with the error factors noted in Table 5-16 of the internal flooding notebook. However, it appears that pipes of multiple sizes (and possibly piping from various systems) were lumped together into a single initiating event. It is not clear from the documentation how the selected error factor was calculated in cases where The range factors are different error factors are shown for various pipe sizes. developed for the flood SR IFQU-A7 states: "PERFORM internal flood-induced 7-21 IFEV-B3 Not Met initiating events; however, accident sequence quantification in accordance with the there is no propagation requirements described in 2-2.7 as applicable to flood- through the model. induced accident sequences.” Section 2-2.7 dictates how quantification is to be performed for internal events and includes SR QU-E3, which requires parametric uncertainty, be performed. While the WBN IF logic was included in the parametric uncertainty analysis using UNCERT, the absence of error factors for many of the basic events (see F&O 3-6) tends to nullify the validity of the analysis. This finding addresses a documentation issue that does not support review of how the selected error factor was

CNL-18-068 E1-28 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) calculated in certain cases. This finding will require sensitivity studies to be performed as needed to support evaluation in the 50.69-categorization process. Although it is recognized that some omissions of uncertainty information for some entries, the NEI 00-04 categorization process, which TVA will follow, exercises key areas of uncertainty in the PRA (e.g., Human Reliability, CCF, and No Maintenance Plant Configurations).

If a SSC that had been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration. The peer closure team confirmed that the Level 2 notebook includes an assumption that there is no consideration of secondary side isolation capability, even though it is The secondary side isolation recognized that there is likely source term reduction if SG of a ruptured Steam Generator Power Operated Relief Valves / Main Steam Safety Valves (SG) was modeled in the (PORVs / MSSVs) are cycling vs stuck-open. Addition of Steam Generator Tube this assumption has no impact on the level of realism used Rupture (SGTR) event tree to model secondary side isolation for SGTR sequences, so 7-22 LE-D5 I (top event small LOCA SR LE-D5 remains MET at Cat I. (SLOCA)). After core damage, there was no consideration of The result of not taking credit for secondary side isolation the secondary side isolation for an SGTR results in an over-conservatism that would capability in the accident potentially cause more SSCs to be categorized as HSS, progression sequences. RISC-1 and RISC-2 than LSS RISC-3 and RISC-4 if credit had been taken.

CNL-18-068 E1-29 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) The peer closure team stated that a revised version of Appendix III [Seismic Induced Dam Failure and Flooding] summarizes the methodology and results of the analyses used to evaluate the potential for flooding at WBN due to the potential seismic failure of upstream dams. The analyses summarized in Appendix III indicate that one scenario (involving the failure of multiple dams upstream of WBN as a result of ground motions equal to ½ of 1.0E-04 Mean Annual Frequency of Exceedance (MAFE) coincident with a 500-yr flood) results in a flood that exceeds plant grade (728 ft). For this scenario, Appendix III notes that Analyses have been several conservative assumptions were made regarding performed that indicate that in the timing of the failure of the immediate upstream dam numerous scenarios involving (Watts Bar) and the assumed stability of the downstream the seismic-induced failure of dam (Chickamauga Dam). Appendix III also points out that earthen and concrete dams flood protection for the plant is provided to elevation 738.9 20-5 SHA-I1 I/II/III upstream of WBN, the feet and that procedures are in place to respond to a flood resulting flood evaluation at warning within 27 hours. For the scenario that exceeds WBN does not exceed 728 ft. plant grade, over 30 hours warning is available. Finally, However, these analyses are Appendix III also provides results that indicate if more not adequately summarized in realistic, less conservative assumptions were made for the the SPRA documentation. scenario that exceeds plant grade, the resulting flood elevation is reduced by nearly seven feet to elevation 723 feet (five feet below plant grade).

The preponderance of evidence provided in Appendix III and in supporting documentation supports a conclusion that failure of upstream dams during a seismic event is unlikely to lead to flooding that could not be mitigated at the plant and thus can be screened out as a potential seismic hazard. However, the case that is made does not systematically recognize, discuss and address the potential

CNL-18-068 E1-30 of 46 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

Capability Finding Supporting Category Description Disposition for 50.69 Number Requirement(s) (CC) sources of uncertainty in the dam breach process, in the estimation of flooding levels and thus does not present a complete case for screening out this hazard based on the results of the analyses. The F&O Closure Peer Review Team concluded that the issue associated with F&O 20-5 has been technically resolved and pertains only to a suggestion for documentation enhancements. As such, there is no change that the proposed suggestions to the SPRA CDF or LERF.

This open F&O which is a documentation issue only, presents no impact to the categorization of SSCs under the 50.69 program. .

CNL-18-068 E1-31 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

There is one federal airway passing within two miles of WBN. A conservative upper bound probability was estimated for aircraft impact (2.0E-09/yr). This is PS2 less than the Standard Review Y Plan criteria of 1.0E-07/yr. Aircraft Impact PS4 There are no airports located within five miles of WBN. There are no military installations or any airspace use that might present a hazard to the site.

WBN is located in the Tennessee Valley on the Tennessee River. Y C3 Avalanches are not a viable Avalanche external initiator because of climate and topography, as WBN is located within a temperate zone. Chemical additives including biocide injection and corrosion inhibitors are added as required for Y C5 biological and corrosion control of Biological Event raw water systems. Chemicals may also be periodically injected as necessary to prevent organic fouling. WBN is located in the Tennessee Y C3 Coastal Erosion Valley; therefore, coastal erosion is not a concern as a credible hazard. Plant design eliminates drought as a concern. In addition, this event is slowly developing. TVA Y C5 Drought regulation of the Tennessee River is such that drought will not jeopardize the ultimate heat sink’s capability.

CNL-18-068 E1-32 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

WBN conforms to regulatory position of RG 1.59, “Design Basis Floods for Nuclear Power Plants,” including position 2.

Flood protection plans, designed to minimize impact of floods above plant grade on safety-related facilities are in place (including wave run-up) and procedures for PS1 predicting rainfall floods, Y arrangements to warn of upstream External Flooding PS2 dam failure floods, and lead times available and types of action to be taken to meet safety requirements for sources are thoroughly analyzed and compensatory measures are well planned.

Snowmelt is not a factor in generating maximum floods at the plant site due to the plant location, which is within a temperate zone.

CNL-18-068 E1-33 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

The WBN Category I structures are designed for a 95-mph wind (including a 1.3 gust factor) 30 feet above grade with a 100-year period of recurrence. The basis was determined from American Society of Civil Engineers (ASCE) Paper 3269, “Wind Forces on Structures.”

The WBN initial design conditions for the reactor shield building and other safety-related structures are designed for tornados having a maximum rotational velocity of 300 Extreme Wind or Y PS1 mph, and up to a translational Tornado speed of 60 mph. For structure, including the additional Diesel Generator Building whose construction was started after July 1979, the design was for tornados having a maximum rotational velocity of 290 mph, and up to a translational speed of 70 mph.

WBN has been designed to resist tornado wind and missile effects equivalent to the Design Basis Tornado and meets the intent of RG 1.76.

Fog and mist may increase the frequency of accidents involving aircraft, ships, or vehicles. This Fog Y C4 weather condition is included implicitly in the accident rates for these Transportation Accidents.

CNL-18-068 E1-34 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

In accordance with NUREG-1407, the potential effect from a nearby forest fire would be a loss of offsite power (LOOP) initiating event, which is subsumed in the LOOP Y C3 Forest or Range Fire initiating event frequency. Areas within and immediately adjacent to WBN to the protected area fence are procedurally required such that vegetation will not present a fire hazard to the plant. Implicitly included in weather- related LOOP, such as hail and snow. Furthermore, WBN meets design criteria 22, which requires Frost Y C4 that the design of protection systems assures that the effects of natural phenomena and other conditions do not result in a loss of the protection function. Hail events could cause complete or partial LOOP (NUREG/CR-5042 Supplement 2). The potential effect of a LOOP and station C1 blackout is addressed by the Y Internal Events PRA and the Hail C4 frequency of hail events is subsumed by the LOOP initiating event frequency for weather related events. Therefore, this event is bounded by other events for which the plant is designed.

CNL-18-068 E1-35 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

WBN meets GDCs 22 and 23 that require the design of protection systems assures that the effects of natural phenomena and other conditions do not result in a loss of the protection function.

Furthermore, the design of protection systems fail in the safe C1 state or into a state determined to High Summer Y be acceptable on some other Temperature C4 defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air) or postulated adverse environments (e.g., extreme heat, cold) are experienced.

See Drought for effects on the Ultimate Heat Sink WBN conforms to regulatory position of RG 1.59, “Design Basis High Tide, Lake Level, Y C4 Floods for Nuclear Power Plants.” or River Stage See External Flooding for additional information. Due to the location of WBN in the Tennessee Valley, a hurricane is not a credible event. However, the C3 downgraded storm is expected to Y cause other hazards, which are Hurricane C4 covered under Extreme Wind or Tornadoes, and Intense Precipitation (i.e., External Flooding).

CNL-18-068 E1-36 of 46

Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

Because of WBN’s location in a temperate climate, significant amounts of ice do not form on Tennessee Valley rivers and lakes.

Y C3 Ice Cover Additionally, WBN meets GDC 22, which requires the design of protection systems assures that the effects of natural phenomena and other conditions do not result in a loss of the protection function. There are no significant industrial facilities near WBN. No other Industrial or Military Y C3 significant industrial land use, Facility Accident military facilities, or transportation routes are in the vicinity of the nuclear plant.

N N/A WBN has an Internal Flooding Internal Flooding PRA Model

N N/A Addressed in Section 3.2.2 of this Internal Fire enclosure.

Not applicable to WBN because of Y C3 Landslide topography.

CNL-18-068 E1-37 of 46

Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

Lightning strikes causing LOOP or turbine trip are contributors to the initiating event frequencies for these events. However, other causes are also included in the LOOP initiator. Impacts from C1 lighting are no greater than already Y Lightning modeled in the internal events C4 PRA. WBN meets the requirements of NFPA Code No. 78-1975 and has no additional operating experience indicating that anything other than LOOP would result from a lightning strike.

This event is slowly developing and well controlled based on TVA’s Low Lake Level or Y C5 management of the Tennessee River Stage River.

Extended freezing temperatures are rare in the Tennessee Valley C1 where the WBN plant is located. Low Winter Y The plant is designed for such Temperature C5 events, and their impacts are slow to develop.

Extraterrestrial activity includes both natural and manmade objects that enter earth’s atmosphere from space. According to Meteorite or Satellite Y PS4 NUREG-1407, the probability of a Impact meteorite strike is less than 1E-09. Therefore, the event can be dismissed on the basis of its very low initiating event frequency.

CNL-18-068 E1-38 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

There are no pipelines carrying Y C3 Pipeline Accident petroleum products located in the vicinity of WBN. The evaluation performed for Release of Chemicals Y C2 control room habitability concluded in Onsite Storage that there is no hazard posed by any chemical stored onsite. River (Channel) diversion is not a potential problem for WBN. Currently no channel diversions upstream of the plant would cause diverting or rerouting of the source of the plant cooling water. The present configuration of the river channel indicates that in this Y C3 River Diversion stretch of the river southeastward migration would be progressing even today were it not for the artificial conditions created by man in impounding Chickamauga Lake. The lake essentially creates an artificial base level, which impedes lateral erosion processes in the river channel.

Y C3 Due to plant location, WBN is not Sand or Dust Storm subject to sand or dust storms.

WBN is located on the Tennessee River (Chickamauga Lake). Seiches pose no threats because Y C3 Seiche of the size and configuration of the lake and the elevation difference between normal lake level and plant grade.

N N/A Seismic Activity WBN has a Seismic PRA.

CNL-18-068 E1-39 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

Because of WBN’s location in a temperate climate, significant amounts of snow do not form on Tennessee Valley rivers and lakes. Y C3 Snow Additionally, WBN meets GDC 22, which requires the design of protection systems assures that the effects of natural phenomena and other conditions do not result in a loss of the protection function. Settlement of concrete structures is typically not considered an issue at WBN due to previous settlement monitoring programs and a preponderance of structures being founded on bedrock, piles, or engineered fill material. The Soil Shrink-Swell Y C5 Updated FSAR, Chapter 2.5.4 Consolidation discusses the issues of soil settling. Such issues have been considered in the design of the plant. In addition, it is judged that these are sufficiently slow developing events to allow adequate time for safe shutdown of the plant. WBN is located in the Tennessee Valley on the Tennessee River Y C3 having a relatively small, narrow Storm Surge lake, low water levels resulting from storm surges is not a potential problem.

CNL-18-068 E1-40 of 46

Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

The MCR habitability during postulated hazardous chemical releases at or near the plant was evaluated by TVA. No hazard to control room habitability is posed by any of the chemicals stored on site, offsite within a five-mile radius, or transported by barge, rail, or road within a five-mile Y C2 radius. Toxic Gas

WBN conforms to RG 1.78. Therefore, the MCR habitability is not jeopardized by accident releases of the chemicals with exception of carbon dioxide and nitrogen. The quantity for each shipment is small for all chemicals. Therefore, no hazard to control room personnel is expected. An examination of the impact from potential accidents on the transportation routes (i.e., railroad, aircraft, highways, and barge traffic) concluded that their contribution to plant risk is negligible. IPEEE, Section 1.4.3 determined that the plant meets Transportation Y the Standard Review Plan for Accident transportation accidents.

The MCR habitability during postulated hazardous chemical releases at or near the plant was evaluated by TVA. No hazard to control room habitability is posed by those transported by barge, rail, or road within a five-mile radius.

CNL-18-068 E1-41 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

PS2 Railroads - The nearest in-service railroad is located about seven miles west of the site and significantly greater than the RG 1.91 safe-distance characterization. There is a spur that leads into the plant; however, it would require repair prior to use.

Aircraft - see Aircraft Impact

C3 Highways - The nearest land transportation route is about 1-mile north of the site. All highways Transportation used for transportation of Accident (Continued) hazardous materials are significantly greater than the RG 1.91 safe distance characterization.

C4 Barge Traffic - A study of the products and materials transported past the site by barge reveals no potential explosion hazard exists.

Protection of the intake channel and station against blockage or impact by river traffic is afforded by its location. WBN is located in the Tennessee Valley, which is not adjacent to any Y C3 Tsunami large bodies of water. Therefore, a tsunami event is not applicable to the plant because of location.

CNL-18-068 E1-42 of 46 Attachment 4: External Hazards Screening

Screening Result

External Hazard Screening Screened? Criterion Comment (Y/N) (See Attachment 5)

The turbine missile protection criterion utilized in the design of WBN was that the probability of unacceptable damage should not be significant. In this instance, an event having a probability of Turbine-Generated Y PS4 causing unacceptable damage on Missiles the order of about 1E-07 per year per reactor unit at the plant is not considered significant. Because WBN is two-unit plant, an event having a probability of occurrence less than 2E-07 will fulfill this criterion. WBN is located in the Tennessee Y C3 Volcanic Activity Valley, which is not prone to volcanic activity. WBN is located in the Tennessee Valley and not adjacent to any large body of water that can result C3 in significant waves. Therefore, Y large wave events are not Waves C4 applicable to the WBN site.

Note: Waves associated with External Flooding are covered under that hazard. Note: See Attachment 5 for the screening criteria definitions.

CNL-18-068 E1-43 of 46 Attachment 5: Progressive Screening Approach for Addressing External Hazards

Event Analysis Criterion Source Comments

NUREG/CR-2300 C1. Event damage and ASME/ANS potential is < events for Standard which plant is designed. RA-Sa-2009

C2. Event has lower mean NUREG/CR-2300 frequency and no worse and ASME/ANS consequences than Standard other events analyzed. RA-Sa-2009

NUREG/CR-2300 C3. Event cannot occur Initial Preliminary and ASME/ANS close enough to the Screening Standard plant to affect it. RA-Sa-2009

Not used to NUREG/CR-2300 C4. Event is included in screen. Used and ASME/ANS the definition of another only to include Standard event. within another RA-Sa-2009 event.

C5. Event develops slowly, ASME/ANS allowing adequate time Standard to eliminate or mitigate RA-Sa-2009 the threat.

CNL-18-068 E1-44 of 46 Attachment 5: Progressive Screening Approach for Addressing External Hazards

Event Analysis Criterion Source Comments

PS1. Design basis hazard ASME/ANS cannot cause a core Standard damage accident. RA-Sa-2009

PS2. Design basis for the NUREG-1407 and event meets the criteria ASME/ANS in the NRC 1975 Standard Standard Review Plan RA-Sa-2009 (SRP). Progressive PS3. Design basis event Screening NUREG-1407 as mean frequency is modified in < 1E-5/y and the mean ASME/ANS conditional core Standard damage probability is RA-Sa-2009 < 0.1.

NUREG-1407 and PS4. Bounding mean CDF ASME/ANS is < 1E-6/y. Standard RA-Sa-2009

Screening not successful. NUREG-1407 and PRA needs to meet ASME/ANS Detailed PRA requirements in the Standard ASME/ANS PRA RA-Sa-2009 Standard.

CNL-18-068 E1-45 of 46

Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty

Assumption/Uncertainty Discussion Disposition

The accident sequence The UETs used in the WBN The UETs associated with the low analysis Anticipated analysis are generic values from reactivity core in WCAP-15831 Transient Without Scram WCAP-15831 “WOG Risk- were applied. Because the (ATWS) does not use Informed ATWS Assessment WBN Units 1 and 2 core designs plant specific Unfavorable and Licensing Implementation should meet the basis for the Exposure Times (UETs). Process,” for a low reactivity ATWS Rule (as discussed in core. WCAP-15831, Section 10), it is not expected that plant specific UETs will differ significantly from the low reactivity core by such a degree that ATWS risk will become significant. As such, the impact on the application is judged to be insignificant.

The assumption is made WBN data was included in the The NEI 00-04 categorization that data from data collection for process, which TVA will follow, NUREG/CR-496 NUREG/CR-6928, “Industry- exercises key areas of uncertainty “Evaluation of Loss of Average for Components and in the PRA (e.g., Human Offsite Power Events at Initiating Events at U.S. Reliability, Common CCF, and No Nuclear Power Plants: Commercial Nuclear Power Maintenance Plant 1980 - 1996,” and Plants,” and WCAP 16672-P. Configurations). If an SSC that WCAP 16672-P,”Common had been initially identified as LSS Cause Failure Parameter is found to exceed the safety Estimates for the significance thresholds in a PWROG” with respect to sensitivity study, this information CCFs are representative is provided to the IDP for of the operating practices consideration as a candidate HSS and CCF rates for WBN. component. Internal flooding HEP HEP screening inputs can The NEI 00-04 categorization screening inputs. introduce uncertainty in operator process, which TVA will follow, action success. exercises key areas of uncertainty in the PRA (e.g., Human Reliability, CCF, and No Maintenance Plant Configurations). If an SSC that had been initially identified as LSS is found to exceed the safety significance thresholds in a sensitivity study, this information is provided to the IDP for consideration as a candidate HSS component.

CNL-18-068 E1-46 of 46 Enclosure 2

Proposed Changes (Mark-Ups) to WBN Renewed Operating Licenses for Unit 1 and Unit 2

Proposed Changes (Mark-Ups) to WBN Renewed Operating License for Unit 1

CNL-18-068 4b

(10) By May 31, 2018, TVA shall ensure that a listing organization acceptable to the NRC (as the Authority Having Jurisdiction) determines that the fire detection monitoring panel in the main control room either meets the appropriate designated standards or has been tested and found suitable for the specified purpose.

(11) The licensee shall replace the WBN, Unit 1 upper compartment cooler cooling coils with safety-related cooling coils to eliminate a potential source of containment sump dilution during design basis events prior to increasing the number of Tritium Producing Burnable Absorber Rods (TPBARs) loaded in the reactor core above 704.

D. The following exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security. Therefore, these exemptions are granted pursuant to 10 CFR 50.12.

(1) Deleted

Facility License No. NPF-90 Amendment No. 98, 105, 107

Enclosure 2

Proposed Changes (Mark-Ups) to WBN Renewed Operating Licenses for Unit 1 and Unit 2

Proposed Changes (Mark-Ups) to WBN Renewed Operating License for Unit 2

CNL-18-068 - 4-

TVA may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(9) By May 31, 2018, TVA shall report that a listing organization acceptable to the NRC (as the Authority Having Jurisdiction) has determined that the fire detection monitoring panel in the main control room either meets the appropriate designated standards or has been tested and found suitable for the specified purpose.

(10) TVA will verify for each core reload that the actions taken if Faw(Z) is not within limits will assure that the limits on core power peaking Fo(Z) remain below the initial total peaking factor assumed in the accident analyses.

(11) TVA will implement the compensatory measures described in Section 3.4, "Additional Compensatory Measures," of TVA letter CNL-18-012, dated January 17, 2018, during the timeframe the temperature indicator for RCS hot leg 3 is not required to be operable for the remainder of Cycle 2. If the RCS hot leg 3 temperature indicator is returned to operable status prior to the end of Cycle 2, then these compensatory measures are no longer required.

D. The licensee shall have and maintain financial protection of such types and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

E. This license is effective as of the date of issuance and shall expire at midnight on October 21, 2055.

FOR THE NUCLEAR REGULATORY COMMISSION

original signed by

William M. Dean, Director Office of Nuclear Reactor Regulation

Appendices: 1 . Appendix A - Technical Specifications 2. Appendix B - Environmental Protection Plan

Date of Issuance: October 22, 2015

Amendment No. 19

Enclosure 3 Proposed Changes (Final Typed) to WBN Renewed Operating Licenses for Units 1 and 2

Proposed Changes (Final Typed) to WBN Renewed Operating License for Unit 1

CNL-18-068 4b

(10) By May 31, 2018, TVA shall ensure that a listing organization acceptable to the NRC (as the Authority Having Jurisdiction) determines that the fire detection monitoring panel in the main control room either meets the appropriate designated standards or has been tested and found suitable for the specified purpose.

(11) The licensee shall replace the WBN, Unit 1 upper compartment cooler cooling coils with safety-related cooling coils to eliminate a potential source of containment sump dilution during design basis events prior to increasing the number of Tritium Producing Burnable Absorber Rods (TPBARs) loaded in the reactor core above 704. (12) The Licensee shall comply with the following conditions on the schedule as noted below: WBN is approved to implement 10 CFR 50.69 using the processes for categorization of Risk- Informed Safety Class (RISC)-1, RISC-2, RISC- 3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and seismic hazards; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards; fire hazards by use of the fire protection program (FPP) safe shutdown equipment list (SSEL), and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa- 2009, as specified in Unit 1 License Amendment No. [XXX] dated [DATE].

WBN will complete the implementation items listed in Attachment 1 of TVA letter to NRC dated November 29, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused - scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA model of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from using the FPP SSEL approach to an internal fire probabilistic risk assessment approach).

Facility License No. NPF-90 Amendment No. 4c

D. The following exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security. Therefore, these exemptions are granted pursuant to 10 CFR 50.12.

(1) Deleted

Facility License No. NPF-90 Amendment No.

Enclosure 3 Proposed Changes (Final Typed) to WBN Renewed Operating Licenses for Units 1 and 2

Proposed Changes (Final Typed) to WBN Renewed Operating License for Unit 2

CNL-18-068 4-

TVA may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(9) By May 31, 2018, TVA shall report that a listing organization acceptable to the NRC (as the Authority Having Jurisdiction) has determined that the fire detection monitoring panel in the main control room either meets the appropriate designated standards or has been tested and found suitable for the specified purpose.

(10) TVA will verify for each core reload that the actions taken if Faw(Z) is not within limits will assure that the limits on core power peaking Fo(Z) remain below the initial total peaking factor assumed in the accident analyses.

(11) TVA will implement the compensatory measures described in Section 3.4, "Additional Compensatory Measures," of TVA letter CNL-18-012, dated January 17, 2018, during the timeframe the temperature indicator for RCS hot leg 3 is not required to be operable for the remainder of Cycle 2. If the RCS hot leg 3 temperature indicator is returned to operable status prior to the end of Cycle 2, then these compensatory measures are no longer required.

(12) The Licensee shall comply with the following conditions on the schedule as noted below: WBN is approved to implement 10 CFR 50.69 using the processes for categorization of Risk- Informed Safety Class (RISC)-1, RISC-2, RISC- 3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and seismic hazards; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards; fire hazards by use of the fire protection program (FPP) safe shutdown equipment list (SSEL), and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa- 2009, as specified in Unit 2 License Amendment No. [XXX] dated [DATE].

WBN will complete the implementation items listed in Attachment 1 of TVA letter to NRC dated November 29, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused - scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard Unit 2 Facility Operating License No. NPF-96 Amendment No. - 4a -

(ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA model of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from using the FPP SSEL approach to an internal fire probabilistic risk assessment approach).

D. The licensee shall have and maintain financial protection of such types and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

E. This license is effective as of the date of issuance and shall expire at midnight on October 21, 2055.

FOR THE NUCLEAR REGULATORY COMMISSION original signed by

William M. Dean, Director Office of Nuclear Reactor Regulation Appendices: 1 . Appendix A - Technical Specifications 2. Appendix B - Environmental Protection Plan

Date of Issuance: October 22, 2015

Amendment No.