L-15-325, Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805

Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805

ML15313A306
Person / Time
Site:	Beaver Valley
Issue date:	11/06/2015
From:	Emily Larson FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CAC MF3301, CAC MF3302, L-15-325
Download: ML15313A306 (33)

Text

FENOCTM .-..,

Beaver Valley Power Station P.O. Box 4 Shippingport, PA 15077 RrstEnergy Nuclear Operating Company Eric A. Larson 724-682-5234 Site Vice President Fax: 724-643-8069 November 6, 2015 L-15-325 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Beaver Valley Power Station, Unit Nos. 1 and 2 Docket No. 50-334, License No. DPR-66 Docket No. 50-412, License No. NPF-73 Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805 (CAC Nos. MF3301 and MF3302)

By letter dated December 23, 2013 (Accession No. ML14002A086), as supplemented by letters dated February 14, 2014; April 27, 2015; May 27, 2015; and June 26, 2015 (Accession Nos. ML14051A499, ML15118A484, ML15147A372, and ML15177A110, respectively), FirstEnergy Nuclear Operating Company (FENOC) submitted a license amendment request to change the Beaver Valley Power Station, Unit Nos. 1 and 2 fire protection program to one based on the National Fire Protection Association Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition.

By letter dated October 9, 2015 (Accession No. ML15280A074), the Nuclear Regulatory Commission (NRC) requested additional information to complete its review. FENOC's response to this request is attached.

There are no regulatory commitments included in this submittal. If there are any questions or if additional information is required, please contact Mr. Thomas A. Lentz, Manager- Fleet Licensing, at (330) 315-6810.

I declare under penalty of perjury that the foregoing is true and correct. Executed on November __k_, 2015.

Sincerely, Eric A. Larson

Beaver Valley Power Station, Unit Nos. 1 and 2 L-15-325 Page 2

Attachment:

Response to October 9, 2015 Request for Additional Information cc: Regional Administrator, NRC Region I NRC Resident Inspector NRC Project Manager Director BRP/DEP (without attachment)

Site BRP/DEP Representative (without attachment)

Attachment L-15-325 Response to October 9, 2015 Request for Additional Information Page 1 of 31 The Nuclear Regulatory Commission (NRC) staff provided a request for additional information (RAI) to FirstEnergy Nuclear Operating Company (FENOC) in a letter dated October 9, 2015 (Accession No. ML15280A074). The NRC requested information to complete its review of a FENOC license amendment request (LAR) for Beaver Valley Power Station (BVPS), Unit No. 1 (BVPS-1) and Unit No.2 (BVPS-2). The LAR would change the current fire protection program to one based on the National Fire Protection Association NFPA Standard 805 (NFPA 805), "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition. The NRC staff's RAI questions are provided below in bold text followed by the corresponding FENOC response.

Probabilistic Risk Assessment (PRA) Request for Additional Information (RAI) 01.f.ii.01 -Minimum Joint Human Error Probabilities (HEPs)

In the licensee's letter dated May 27, 2015 (ADAMS Accession No. ML15147A372),

the response to PRA RAI 01.f.ii provides the range of values and number of HEP pairs in the Fire PRA results for each unit, including the number of HEP pairs with joint probabilities less than 1E-05. The description explains that a team evaluation using NUREG-1921 guidance shows that HEP pairs with joint probabilities less than 1E-05 have zero dependency. For combinations of HEPs greater than two, the range of HEP values and number of joint HEPs used below 1E-05 are not provided. The NRC staff notes that the more HEPs that exist in a given cutset, the greater the chance for dependency between two or more of the HEPs, and the greater the potential impact of applying a minimum joint HEP floor.

Given that a joint HEP floor is not used in the BVPS Fire PRA, please: (1) describe the range of HEP values and number of joint HEPs with values below 1E-05 for combinations of HEPs greater than two; (2) discuss why the total number of joint HEPs below 1E-05 is reasonable for this application; and (3) confirm that a justification (e.g., narrative) for each HEP value below 1E-05 has been documented, and that the justification was developed by more than reviewing the generic dependency tree.

The NRC staff notes that one of the provided joint HEP examples is based on complete dependence and, thus, is rather a straightforward application of dependency. Please provide two additional examples of the lowest joint HEPs

Attachment L-15-325 Page 2 of 31 (i.e., with more than two HEPs) and your justification for why the assigned joint HEP is appropriate in each case.

Response

The range of HEP values and number of joint HEPs with values below 1E-05 for combinations of HEPs greater than two are:

• BVPS-1 o Range (1.63E-06 to 3.32E-48) o Number of joint HEPs =24,913 (of which 17,529 are independent, that is the combinations do not contain a depe.ndent operator action pairing)

• BVPS-2 o Range (8.18E-06 to 4. 70E-40) o Number of joint HEPs =3,977 (of which 3,937 are independent, that is the combinations do not contain a dependent operator action pairing)

BVPS-1 has approximately six times as many joint HEPs with values below 1E-05 for combinations of HEPs greater than two in comparison to BVPS-2, as the BVPS-1 combinations are comprised of 47 percent more unique operator actions in comparison to BVPS-2. BVPS-1 combinations have 109 unique operator actions, and BVPS-2 combinations have 74 unique operator actions. Also, the longest combination of HEPs for BVPS-1 is 23 HEPs and for BVPS-2 is 21 HEPs. This delta in the number of credited actions between the units is not unreasonable, because BVPS-1 first came online in 1976, prior to the current fire protection regulations, while BVPS-2 did not first come online until 1987 and incorporated many updated fire protection design features in its construction that are not present at BVPS-1. Therefore, it makes sense that BVPS-1 relies more heavily on operator actions following a fire than does BVPS-2.

Many of these joint HEPs have very low values; however it should be noted that contrary to what is typically presented in the dependency analysis of a large fault tree model, these joint HEPs do not represent minimal failure cutsets. The failure probability of a top event evaluated by a single fault tree for a given sequence in the BVPS PRA models is represented by a split fraction, which applies the set of boundary conditions imposed upon the fault tree by the initiating event (in this case, a fire scenario) and the success or failure state of previously evaluated top events in the sequence. Since each single split fraction represents a conditional solution to a single fault tree, a set of minimal cutsets can be defined for each split fraction and can be found in the split fraction cause table, ranked by total contribution to the overall failure probability of the split fraction. These joint HEPs listed in this response are reporting every human failure event (HFE) used in every cutset reported in the cause table for the split fraction used in the sequence. In other words, the joint HEPs reported here are not the simple part of a minimal cutset which is typically reported in the dependency analysis from a large fault tree model; instead, they contain the HFEs used in all possible cutsets for each fault tree, for the single sequence being evaluated. The RISKMAN PRA software used at

Attachment L-15-325 Page 3 of 31 BVPS does not solve a large fault tree model using cutset approximations. It is a large event tree software, and it solves each fault tree using a binary decision diagram (BDD) methodology which provides an exact solution instead of truncating the solution by using minimal cutsets. Minimal cutsets can be produced for each split fraction, primarily in order to verify proper construction of a fault tree and its split fractions, but these minimal cutsets cannot be individually linked to a single quantified sequence in which a particular split fraction is used. They represent the relative contribution of individual basic events to the total split fraction value.

As an example, a particular joint HEP defined for the BVPS-1 fire PRA (FPRA) model contains actions OPRHH1 F1, OPRHH3F1, OPRHH5F1, and OPRHH6F1, all from top event HH (high head safety injection I charging system). This is a fairly complicated top event and provides a good example of most types of idiosyncrasies (that is, multiple trains of equipment or multiple system alignments) which may be found in the BVPS FPRA models. All four of these HFEs have a measurable contribution to the value of split fraction HH102, which was used in this particular sequence. Examining the cause table for this split fraction, however, reveals that only a single action appears in any individual cutset which contributes to the total value of this split fraction (the cause table captured cutsets contributing to greater than 1E-06 percent of the total split fraction value, which yields 719 cutsets for this example). Thus, only one of these HFEs should actually appear in the true "joint HEP" for this sequence, instead of all four redundant HFEs. There are many other examples of this phenomena occurring in other top events, such that the reported range of joint HEP values is misleading and not consistent with joint HEP values as would be reported from a PRA model using a large fault tree software and quantification via minimal cutsets. Therefore, the two example joint HEPs provided below will be refined, using only the single lowest HEP of such redundant HFEs (to conservatively result in the lowest possible joint HEP for the purpose of this explanation) in all applicable cases.

The total number of joint HEPs shown here to be below a value of 1E-05 is reasonable for this application primarily because each such joint HEP is explicitly justified as to why the actions have zero dependence between them. Independence is established and justified by more than reviewing the generic dependency tree; specifically, an expert p~nel review was performed of individual operator action pairings that comprise every long independent string and their relevant accident sequence context, and these justifications were documented in the human reliability analysis (HRA) dependency analysis for each unit. Therefore, since each HEP is independent from the others except in a few cases which are also clearly defined and evaluated in the HRA dependency analysis for each unit, these joint HEPs are acceptable. The total number of different joint HEPs is not overly significant, because the joint HEPs represent all the unique ways the sequence of events could play out for each of the modeled fire scenarios. Additionally, if minimal core damage cutsets could be produced from the BVPS models (they cannot, because the large event tree software used at BVPS does not work that way), such minimal cutsets would actually show far shorter joint HEPs (containing fewer individual actions) with higher joint HEP values due to the way these

Attachment L-15-325 Page 4 of 31 actions are currently reported from all cutsets contributing to an individual split fraction in the BVPS models as described above.

A very low joint HEP from each BVPS unit will be discussed to address the requested two additional examples of the lowest joint HEPs representing independent strings of actions (strings of HEPs exhibiting zero dependence).

For BVPS-1, a very low joint HEP (value of 2.09E-40) with more than two HFEs is the following string of operator actions:

OPRD12-0PRD04-0PRDF1-0PRHH 1F1-0PRHH3F1-0PRHH5F1-0PRHH6F1-0PRMA 1F1-0PRMA2F1-0PROS1 F1-0PROT1-0PFCI1-0PRD08-0PRD1 0-0PRPR 1F1-0PRSM5-0PRC 11-0PRD06 The disposition of the longer operator action strings is completed by dissecting the string into pair-wise combinations of the operator actions. Note that this approach can produce operator action pairings that cannot occur in the accident sequence and would be deemed invalid, but it is guaranteed to capture all possible combinations. This technique was successfully used and documented for potentially dependent operator action strings in PRA-BV1-13-025 (BVPS-1 HRA dependency analysis) and PRA-BV2-12-002 (BVPS-2 HRA dependency analysis). Individual operator action pairings for the each PRA model were initially evaluated for dependence through the use of a generic dependency evaluation logic tree. These initial levels of dependence determined were subsequently reviewed by the BVPS PRA team members (including a former BVPS senior reactor operator, or SRO) to verify that they appropriately reflect the nature of the relationships among the HFEs in the context of the accident sequences in which they appear. Where adjustments were needed to the decisions made for selected attributes in the dependence tree logic, the reasons are documented and the dependency level between the affected operator actions was adjusted appropriately.

Leveraging the discussion above for joint HEPs defined for the BVPS-1 FPRA model containing actions OPRHH1 F1, OPRHH3F1, OPRHH5F1, and OPRHH6F1, these four operator actions will be replaced by the lowest HEP value action OPRHH5F1. Similarly, operator actions OPRD04 and OPRDF1 do not exist in the same minimal cutset and so only OPRDF1 (which has the lower of the two HEPs) will be used. Actions OPRC11 and OPRD06 do not exist in the same minimal cutset and so only OPRC11 (which has the lower of the two HEPs) will be used. Likewise, actions OPRD12 and OPFCI1 do not exist in the same minimal cutset so only OPRD12 (which has the lower of the two HEPs) will be used. Additionally, action OPROT1 has no effect on the success or failure of fire sequences, so it would not be in any minimal cutset in this analysis. The following operator action string results from these refinements:

OPRD12- OPRDF1-0PRHH5F1-0PRMA 1F1-0PRMA2F1-0PROS 1F1- OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PRC11

Attachment L-15-325 Page 5 of 31 Individual operator actions in this string are described in Table 1 below. Operator actions are also identified based on the procedures used to define the action (either emergency operating procedures [EOPs] or fire emergency procedures [FEPs]).

Table 1.

Operator Action Descriptions for BVPS-1 Independence Review of Joint HEP EOP Operator or Action Description Action FEP Operator Locally Closes Containment Isolation Valves, Related OPRD12 FEP to Decay Heat Removal Operator Locally Opens Alternate Water Supply OPRDF1 EOP (Demineralized Water Storage Tank, or DWST) to Dedicated AFWPump Operator Initiates Safety Injection (SI) on Loss of Normal OPRHH5F1 EOP Charging Flowpath Operator Supplies Alternative Makeup (DWST) to PPDWST OPRMA1F1 EOP with Onsite Power Available Operator Aligns River Water to Auxiliary Feed Water (AFW)

OPRMA2F1 EOP Pumps With Loss Of Offsite Power Operator Manually Actuates Sl with Solid State Protection OPROS1F1 EOP System Failure Operator Fails to Trip Reactor Coolant Pumps (RCPs) From OPRD08 FEP Main Control Room Operator Fails to Trip RCP Breakers Locally (Normal OPRD10 FEP Switchgear)

Operator Isolates Stuck-Open Pressurizer Pilot Operated OPRPR1F1 EOP Relief Valve (PORV) Using Block Valve OPRSM5 FEP Operator Operates Keylock Isolation Switch for PORVs Operator Isolates FCV-CH-122 (Normal Charging Flowpath) by OPRC11 FEP Locally ClosinQ CH-30 Imposing the above minimal cutset considerations on this joint HEP reduces the number of included HEPs from 18 to 11, and changes the total joint HEP value from 2.09E-40 to 1.69E-25, though this does not represent a true minimal core damage cutset since the cutsets in which these actions appear for their top events may actually involve any number of other equipment failures coincident with the actions. To ensure independence, all pair-wise operator action combinations of this string (55 total) are addressed in Table 2. The dependence category column records the initial dependence evaluation from the generic dependence evaluation logic tree from PRA-BV1-13-025 (BVPS-1 HRA dependency analysis). This tree provides a thorough review of the specific operator action pairing, including considerations of same crew, common cognition and cues, action performance within same time window, same location, and time separation of actions. In the Table 2 disposition column, a clear disposition is

Attachment L-15-325 Page 6 of 31 provided for those operator action pairings deemed initially with zero dependence (ZD),

as well as those with initial dependence, but were overridden to ZD.

As discussed in PRA-BV1-13-025 (BVPS-1 HRA dependency analysis), the FEP operator actions are independent among themselves and from the EOP actions as they involve strictly manipulation steps specified clearly in the procedures. There is no decision-making required from the local operator performing these actions; instead, these procedures are a step-by-step list of things to do following the fire. LAR AttachmentS, Table S-3, implementation items BV1-3060 and BV2-1579 commit BVPS to update the HRA for both units to specifically account for the new symptom-based fire procedures once they are complete, which will include an updated dependency analysis to properly reflect the new shutdown strategy.

Attachment L-15-325 Page 7 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0P RHH5F1-0P RMA1F1-0P RMA2F1-0P ROS1F1-OPRD08-0P RD1 O-OPRPR1 F1-0PRSM5 -0PRC11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Categ_o_!}'_1 FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRD12 OPRDF1 specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRD12 OPRHH5F1 ZD Same as previous.

OPRD12 OPRMA1F1 ZD Same as previous.

OPRD12 OPRMA2F1 ZD Same as previous.

OPRD12 OPROS1F1 ZD Same as previous.

OPRD12 OPRD08 ZD Same as previous.

OPRD12 OPRD10 ZD Same as previous.

OPRD12 OPRPR1F1 ZD Same as previous.

OPRD12 OPRSM5 ZD Same as previous.

OPRD12 OPRC11 ZD Same as previous.

Different functions (high head safety injection [HHSI] initiation for primary inventory control/cooling versus demineralized OPRDF1 OPRHH5F1 water storage tank [DWST] water alignment for secondary MD ZD inventory control or cooling), different cues, different execution locations (and different operators). As such, they may be considered independent.

Attachment L-15-325 Page 8 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1-0PRMA1F1 -0PRMA2F1-0PR OS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 Based on Internal Events (IE) dependency analysis of the OPRDF1-0PRMA 1 operator action pair (the relevant relational aspects are not altered by the fire conditions): zero dependence established based on different crews, different cues for cognition, and greater than 60 minutes time separation between the two actions. Initial zero dependence level subsequently reviewed by the BVPS PRA team members OPRDF1 OPRMA1F1 ZD (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

OPRDF1 initially aligns the dedicated AFW pump, whereas OPRMA 1F1 aligns an alternate tank to refill the primary AFW supply tank once it is exhausted - after AFW has already been running for a substantial period of time.

Based on IE dependency analysis of the OPRDF1-0PRMA 2 operator action pair (the relevant relational aspects are not altered by the fire conditions): the time separation in the overall system time window between the two operator actions is greater than 60 minutes which justifies these actions as NOT OPRDF1 OPRMA2F1 MD ZD of the same time and, hence, independent.

OPRDF1 initially aligns the dedicated AFW pump, whereas OPRMA2F1 aligns river water to refill the primary AFW supply tank once it is exhausted - after AFW has already been running for a substantial period of time.

Attachment L-15-325 Page 9 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH SF1-0PRMA 1 F1-0PRMA2F1-0 PROS1 F1- I OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Cate_g_o_ry 1 OPRDF1 is a local execution action to align the dedicated AFW pump, which is normally supplied from the TPDWST (but unavailable) to the DWST in order to maintain secondary cooling. OPROS1 F1 is a main control room (MCR) action to OPRDF1 OPROS1F1 MD ZD verify and actuate safety injection and/or AFW prior to the steam generators boiling dry given a Sl actuation condition is present, but one or both trains of SSPS fail. Different execution locations (and different operators) justifies these two actions as being independent.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRDF1 OPRD08 specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRDF1 OPRD10 ZD Same as previous.

Zero dependence established based on different cues for cognition and the time available to accomplish the OPRPR1 F1 action is significant (30-60 minutes) when compared to OPRDF1 OPRDF1. Initial zero dependence level subsequently OPRPR1F1 ZD reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident se_guences in which they_ appear.

Attachment L-15-325 Page 10 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1-0PRMA1F1 -0PRMA2F1-0PR OS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRDF1 specified clearly in the procedures that are deemed to have OPRSM5 ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRDF1 OPRC11 ZD Same as previous.

Based on IE dependency analysis of the OPRHH5-0PRM A 1 operator action pair (the relevant relational aspects are not altered by the fire conditions): zero dependence established based on different crews, different cues for cognition, and OPRHH5F1 greater than 60 minutes time separation between the two OPRMA1F1 ZD actions. Initial zero dependence level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident se_guences in which they appear.

Based on IE dependency analysis of the OPRHH5-0PRM A2 operator action pair (the relevant relational aspects are not altered by the fire conditions): OPRHH5 action is a time-critical, highly-trained action and will occur within the first few OPRHH5F1 OPRMA2F1 MD ZD minutes after reactor trip. OPRMA2 action has 4.3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time window. Due to significant time separation between required actions and the shift technical advisor (STA) involvement in cognition activities (considered additional crew), these operator actions can be justified as independent.

Attachment L-15-325 Page 11 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH5F1-0P RMA1F1-0PRMA2F1-0P ROS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PRC11 Operator Operator Dependency Override 1 Disposition Action 1 Action 2 Category 1 Based on IE dependency analysis of the OPRHH5-0PROS1 operator action pair (the relevant relational aspects are not altered by the fire conditions): HH5 action aligns the Sl flow path for non-SI conditions, when the normal charging flow path is unavailable. OS models operator actions to actuate Sl (in Sl OPRHH5F1 OPROS1 F1 CD ZD conditions) when the automatic actuation signal fails.

Therefore, these actions are required under different accident conditions (SI vs. non-SI) and will not realistically occur in the same sequence. They will not coexist in the same minimal cutset.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps specified clearly in the procedures that are deemed to have OPRHH5F1 OPRD08 ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRHH5F1 OPRD10 ZD Same as previous.

Zero dependence established based on different cues for cognition and the time available to accomplish the OPRPR1 F1 action is significant (30-60 minutes) when compared to OPRHH5F1. Initial zero dependence level subsequently OPRHH5F1 OPRPR1F1 ZD reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

Attachment L-15-325 Page 12 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1-0PRMA1F1 -0PRMA2F1-0PR OS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRHH5F1 OPRSM5 specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRHH5F1 OPRC11 ZD Same as previous.

Based on IE dependency analysis of the OPRMA 1-0PRMA2 operator action pair (the relevant relational aspects are not altered by the fire conditions): the time windows for these actions are very long (multiple hours). The actual starting and OPRMA1F1 OPRMA2F1 completion time of these actions should be well separated in CD ZD time to justify these two actions as being independent. Given their training and the copious time available, and the fact that these two actions will be cued from separate alarms at different tank levels, it is unlikely that the operators will forget the need for long-term AFW and neglect to perform both these actions.

Based on IE dependency analysis of the OPRMA1-0PROS1 operator action pair (the relevant relational aspects are not altered by the fire conditions): zero dependence established based on different crews, different cues for cognition, and OPRMA1F1 OPROS1F1 greater than 60 minutes time separation between the two ZD actions. Initial zero dependence level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

Attachment L-15-325 Page 13 of 31 Table 2.

BVPS-1 Independen ce Review of Joint HEP OPRD12- OPRDF1-0P RHH5F1-0P RMA 1F1-0PRMA2 F1-0PROS1 F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5 -0PRC11 Operator Operator Dependency Action 1 Override1 Disposition Action 2 Category 1 FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRMA1F1 OPRDOB specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRMA1F1 OPRD10 ZD Same as previous.

Based on IE dependency analysis of the OPRMA 1-0PRPR 1 operator action pair (the relevant relational aspects are not altered by the fire conditions): zero dependence established based on different crews, different cues for cognition, and OPRMA1F1 OPRPR1F1 greater than 60 minutes time separation between the two ZD actions. Initial zero dependence level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRMA1F1 OPRSM5 specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRMA1F1 OPRC11 ZD Same as previous.

Attachment L-15-325 Page 14 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1;.0PRMA1F1 -0PRMA2F1-0PR OS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 Based on IE dependency analysis of the OPRMA2-0PROS1 operator action pair (the relevant relational aspects are not altered by the fire conditions): OPROS1 action is a time-critical, highly-trained action and will occur within the first few OPRMA2F1 OPROS1F1 MD ZD minutes after reactor trip. OPRMA2 action has 4.3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time window. Due to significant time separation between required actions and the STA involvement in cognition activities (considered additional crew), these operator actions can be justified as independent.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRMA2F1 specified clearly in the procedures that are deemed to have OPRD08 ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRMA2F1 OPRD10 ZD Same as previous.

Based on IE dependency analysis of the OPRMA2-0PRPR1 operator action pair (the relevant relational aspects are not altered by the fire conditions): The time separation in the overall system time window between the two operator actions OPRMA2F1 OPRPR1F1 is greater than 60 minutes which justifies these actions as NOT MD ZD of the same time and, hence, independent. Furthermore, they would use separate cues since OPRPR1 F1 is a response to isolate primary leakage from the pressurizer PORV, while OPRMA2F1 provides long-term makeup to the secondary side for decay heat removal.

Attachment L-15-325 Page 15 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1-0PRMA 1 F1-0PRMA2F1-0 PROS1 F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PR C11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPRMA2F1 OPRSM5 specified clearly in the procedures that are deemed to have ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRMA2F1 OPRC11 ZD Same as previous.

OPROS1F1 OPRD08 ZD Same as previous.

OPROS1F1 OPRD10 ZD Same as previous.

OPROS1 F1 action is a time-critical, highly-trained action and will occur within the first few minutes after reactor trip.

OPRPR1 F1 action has a 68.2 minute time window. Due to significant time separation between required actions and the OPROS1 F1 OPRPR1F1 STA involvement in cognition activities (considered additional LD ZD crew), these operator actions can be justified as independent.

Furthermore, a failure of OPROS1 F1 to actuate Sl would only serve to enhance the subsequent indications of primary leakage (lowering pressurizer level) which would cue the need for OPRPR1 F1 to isolate the pressurizer PORV.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation steps OPROS1F1 specified clearly in the procedures that are deemed to have OPRSM5 ZD little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of

- - activities that must be done.

Attachment L-15-325 Page 16 of 31 Table 2.

BVPS-1 Independence Review of Joint HEP OPRD12- OPRDF1-0PRHH 5F1-0PRMA1F1 -0PRMA2F1-0PR OS1F1-OPRD08-0PRD1 O-OPRPR1 F1-0PRSM5-0PRC11 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 OPROS1F1 OPRC11 ZD Same as previous.

OPRD08 OPRD10 ZD Same as previous.

OPRD08 OPRPR1F1 ZD Same as previous.

OPRD08 OPRSM5 ZD Same as previous.

OPRD08 OPRC11 ZD Same as previous.

OPRD10 OPRPR1F1 ZD Same as previous.

OPRD10 OPRSM5 ZD Same as previous.

OPRD10 OPRC11 ZD Same as previous.

OPRPR1F1 OPRSM5 ZD Same as previous.

OPRPR1F1 OPRC11 ZD Same as previous.

OPRSM5 OPRC11 ZD Same as previous.

L_

1. ZD =Zero Dependence, LD =Low Dependence, MD= Medium Dependence, CD= Complete Dependence

Attachment L-15-325 Page 17 of 31 For BVPS-2, a very low joint HEP (value of 4.70E-40) with more than two HFEs is the following string of operator actions:

OPRCD1 F1-0PRCD5F1-0PRCD6F1-0PRCD7F1-0PRMA 1F1-0PROS6F1-0PRC11-0PRD06-0PRD16-0PRF03-0PRPR 1-0PRPR2F1-0PRSM 1F1-0PRWA2F1-0PRWA6F1-0PRWA2F1-0PRWA6F1-0PRHH 1F1-0PRHH5-0PRD08-0PRD1 0 The disposition of the longer operator action strings is completed by dissecting the string into pair-wise combinations of the operator actions similar to that completed in the BVPS-1 string above. This approach can produce operator action pairings that simply cannot occur in the accident sequence and would be deemed invalid (pairings which may be based on different boundary conditions or support system states).

The BVPS-2 string of operator actions above shows a repetitive operator action pairing of OPRWA2F1-0PRWA6F1. This is an artifact in the creation of the longer operator action strings. Both operator actions exist in top events WA and WB, and, for this sequence, both of these top events are failed in the support event tree. As such, both operator actions OPRWA2F1 and OPRWA6F1 are recorded as failed for each of these two top events. These top events are individual trains of the service water system, and the dependencies between trains are addressed using an intermediate top event WC which models both trains together in the system as a whole. Conditional split fraction equations tying together the split fractions from WA, WB, and WC are used such that the same actions are credited properly between trains, thus mitigating the apparent possibility of double-counting credit for operator actions that appear in more than one top event. This artifact manifests in many operator action strings with greater than two actions which subsequently leads to very long operator action strings with very low joint HEP values. To proceed with the dissection of the BVPS-2 string of operator actions above, the redundant instance of OPRWA2F1-0PRWA6F1 was removed from the string.

Leveraging a similar rationale from the discussion above for joint HEPs defined for the BVPS-1 FPRA model containing actions OPRHH1 F1, OPRHH3F1, OPRHH5F1, and OPRHH6F1, the four operator actions OPRCD1 F1, OPRCD5F1, OPRCD6F1, and OPRCD7F1 will be replaced by the lowest HEP value action OPRCD1 F1, and the two operator actions OPRWA2F1 and OPRWA6F1 will be replaced by the lowest HEP value action OPRWA6F1. Similarly, top event PR contains operator actions OPRC11, OPRD06, OPRD16, OPRF03, OPRPR1, and OPRPR2F1. The fault tree for PR is such that only certain limited combinations of these actions will coexist in a minimal cutset.

Furthermore, actions OPRPR1 and OPRF03 have a nominal value of 1.0. They are not actually credited in the current model, but the basic events were never removed from a prior version of the model. Therefore, the lowest value minimal cutset joint HEP that can result from this top event for this sequence is OPRD06-0PRPR2F1, which will replace the original list of actions in the final string. Top event YHH contains actions OPRHH5 and OPRHH1 F1, which are also mutually exclusive in minimal cutsets, so this pair will be replaced by the lowest HEP value action OPRHH5. Additionally,

Attachment L-15-325 Page 18 of 31 OPRSM1 F1 is no longer a credited action because new pump start logic results in there being always sufficient net positive suction head (NPSH) for the recirculation spray system (RSS) pumps when they start, even if quench spray (QS) fails (the RSS pumps start by a coincident containment isolation phase B signal and low refueling water storage tank [RWSl]level signal). The following operator action string results from these refinements:

OPRCD1 F1-0PRMA 1F1-0PROS6F1-0PRD06-0PRPR2F1-0PRWA6F1-0PRHH5-0PRD08-0PRD1 0 Individual operator actions in this string are described in Table 3 below. Operator actions are also identified based on the procedures used to define the action, that is, either EOPs or FEPs.

Table 3.

Operator Action Descriptions for BVPS-2 Independence Review of Joint HEP EOP Operator or Action Description Action FEP Operator Depressurizes and Cools Down Secondary Under OPRCD1F1 EOP Small Loss of Coolant Accident (LOCA) Conditions Operator Aligns Gravity Feed Makeup from DWST to Primary OPRMA1F1 EOP Plant DWST (PPDWST)

Operator Manually Actuates AFW with Solid State Protection OPROS6F1 EOP System Failure Operator Fails to Control Atmospheric Dump Valves OPRD06 FEP 2SVS-PCV101A, B, C OPRPR2F1 EOP Operator Isolates Stuck Open PORV with Block Valve OPRWA6F1 EOP Operator Aligns Alternate Supply of Service Water Seal Cooling OPRHH5 FEP Operator Initiates Sl on Loss of Normal Charging Flowpath OPRD08 FEP Operator Fails to Trip RCP from Main Control Room Operator Fails to Trip RCP Breakers Locally (Normal OPRD10 FEP Switchgear)

Attachment L-15-325 Page 19 of 31 Imposing the above minimal cutset considerations on this joint HEP reduces the number of included HEPs from 21 to 9, and changes the total joint HEP value from 4. ?OE-40 to 6.90E-21, though this does not represent a true minimal core damage cutset since the cutsets in which these actions appear for their top events may actually involve any number of other equipment failures coincident with the actions. To ensure independence, all pair-wise operator action combinations of this string (36 total) are addressed in Table 4. The dependence category, override, and disposition columns all serve the same purpose, as discussed in the BVPS-1 operator action string analysis previously.

Attachment L-15-325 Page 20 of 31 Table 4.

BVPS-2 Independence Review of Joint HEP OPRCD1 F1-0PRMA 1 F1-0PROS6F1-0 PRD06-0PRPR2 F1-0PRWA6F1-OPRHH5-0PRD0 8-0PRD1 0 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Catego_ry 1 The total time windows between these two actions are of the same order of magnitude. However, a long period of time is available and the actions can be completed long before the allowable time is depleted. Additionally, failing to perform OPRCD1 F1 (opening atmospheric steam dump valves OPRCD1F1 OPRMA1F1 [ASDVs] to initiate secondary cooldown) will further extend MD ZD the available time before OPRMA 1F1 (makeup to the AFW inventory tank) is required because less AFW inventory will be used if a cooldown is not being performed. As such, the time separation is longer than indicated, which justifies for sufficient time separation to be considered as being independent.

Zero dependence established based on different crews, different cues for cognition, and greater than 60 minutes time separation between the two actions. Initial zero OPRCD1F1 OPROS6F1 dependence level subsequently reviewed by the BVPS PRA ZD team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRCD1F1 OPRD06 steps specified clearly in the procedures that are deemed to ZD have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a

- list of activities that must be done.

Attachment L-15-325 Page 21 of 31 Table 4.

BVPS-2 Independence Review of Joint HEP OPRCD1 F1-0PRMA 1F1-0PROS6 F1-0PRD06- 0PRPR2F1- 0PRWA6F1-OPRHH5-0P RD08-0PRD 1 0 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 Zero dependence established based on different cues for cognition and the time available to accomplish the OPRCD1 F1 action is significant (greater than 60 minutes) when compared to OPRPR2F1. Initial zero dependence OPRCD1F1 OPRPR2F1 ZD level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

Zero dependence established based on different cues for cognition and the time available to accomplish the OPRCD1 F1 action is significant (greater than 60 minutes) when compared to OPRWA6F1. Initial zero dependence OPRCD1F1 OPRWA6F1 ZD level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which thev appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRCD1F1 OPRHH5 steps specified clearly in the procedures that are deemed to ZD have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRCD1F1 OPRDOB ZD Same as previous.

OPRCD1F1 OPRD10 ZD Same as previous.

Attachment L-15-325 Page 22 of 31 Table 4.

BVPS-21ndependence Review of Joint HEP OPRCD1F1-0PR MA1F1-0PROS6 F1-0PRD06-0PR PR2F1-0PRWA6 F1-OPRHH5-0PRD0 8-0PRD1 0 Operator Operator Dependency Override 1 Disposition Action 1 Action 2 Category 1 Zero dependence established based on different crews, different cues for cognition, and greater than 60 minutes time separation between the two actions. Initial zero OPRMA1F1 dependence level subsequently reviewed by the BVPS PRA OPROS6F1 ZD team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRMA1F1 steps specified clearly in the procedures that are deemed to OPRD06 ZD have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

Zero dependence established based on different cues for cognition and the time available to accomplish the OPRMA 1F1 action is significant (greater than 60 minutes) when compared to OPRPR2F1. Initial zero dependence OPRMA1F1 OPRPR2F1 ZD level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

Zero dependence established based on different cues for OPRMA1F1 OPRWA6F1 cognition and the time available to accomplish the ZD OPRMA 1F1 action is significant (greater than 60 minutes) when compared to OPRWA6F1. Initial zero dependence

Attachment L-15-325 Page 23 of 31 Table 4.

BVPS-2 Independence Review of Joint HEP OPRCD1 F1-0PRMA 1F1-0PROS6F1-0 PRP06-0PRPR2 F1-0PRWA6F1-OPRHH5-0PRD0 8-0PRD1 0 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Category 1 level subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRMA1F1 OPRHH5 steps specified clearly in the procedures that are deemed to ZD have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRMA1F1 OPRDOB ZD Same as previous.

OPRMA1F1 OPRD10 ZD Same as previous.

OPROS6F1 OPRD06 ZD Same as previous.

Zero dependence established based on different crews, different cues for cognition, and 15-30 minutes time separation between the two actions. Initial zero dependence OPROS6F1 OPRPR2F1 level subsequently reviewed by the BVPS PRA team ZD members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.

Zero dependence established based on different cues for OPROS6F1 OPRWA6F1 cognition and the time available to accomplish the ZD OPRWA6F1 action is significant (30-60 minutes) when compared to OPROS6F1. Initial zero dependence level

Attachment L-15-325 Page 24 of 31 Table 4. j BVPS-2 Independence Review of Joint HEP OPRCD1 F1-0PRMA 1F1-0PROS6F1-0PRD06- 0PRPR2F1-0PRWA6F1-OPRHH5-0PRD08-0PRD 1 0 i Operator Operator Dependency I Override 1 Disposition Action 1 Action 2 Category 1 subsequently reviewed by the BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident se_guences in which they appear.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPROS6F1 steps specified clearly in the procedures that are deemed to OPRHH5 ZD have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPROS6F1 OPRD08 ZD Same as previous.

OPROS6F1 OPRD10 ZD Same as previous.

OPRD06 OPRPR2F1 ZD Same as previous.

OPRD06 OPRWA6F1 ZD Same as previous.

OPRD06 OPRHH5 ZD Same as previous.

OPRD06 OPRD08 ZD Same as previous.

OPRD06 OPRD10 ZD Same as previous.

Support system failure can occur at any point during the mission time. The likelihood that these actions would occur within a short time window is low. Additionally, even though OPRPR2F1 OPRWA6F1 the total time window for OPRWA6F1 is listed as 55 MD ZD minutes, this time is conservative in that it neglects the cooling effect the spent fuel pool volume would have on CCP as CCP temperature increases due to loss of service

- L_ water. If this effect were considered in the calculation, the

Attachment L-15-325 Page 25 of 31 Table 4.

BVPS-2 Independence Review of Joint HEP OPRCD1 F1-0PRMA 1 F1-0PROS6 F1-0PRD06- 0PRPR2F1- 0PRWA6F1-OPRHH5-0P RD08-0PRD 1 0 Operator Operator Dependency Action 1 Override 1 Disposition Action 2 Catego_!Y 1 actual time to heat CCP would be much longer. As such, there is a likelihood that these actions are separated by a long period of time, which justifies these actions as being independent.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRPR2F1 OPRHH5 ZD steps specified clearly in the procedures that are deemed to .

have little cognition to consider and execute. There is no I

decision-making for the local operator; these actions are a list of activities that must be done.

OPRPR2F1 OPRD08 ZD Same as previous.

OPRPR2F1 OPRD10 ZD Same as previous.

OPRWA6F1 OPRHH5 ZD Same as previous.

OPRWA6F1 OPRD08 ZD Same as previous.

OPRWA6F1 OPRD10 ZD Same as previous.

OPRHH5 OPRD08 ZD Same as previous.

FEP operator actions are independent among themselves and from the EOP actions as they involve strict manipulation OPRHH5 OPRD10 ZD steps specified clearly in the procedures that are deemed to have little cognition to consider and execute. There is no decision-making for the local operator; these actions are a list of activities that must be done.

OPRD08 OPRD10 ZD Same as previous.

=Zero Dependence, LD =Low Dependence, MD =Medium Dependence, CD =Complete Dependence

1. ZD

Attachment L-15-325 Page 26 of 31 PRA RAI 04.01 - Use of Methods Not Accepted by the NRC In the licensee's letter dated June 26, 2015 (ADAMS Accession No. ML15177A110), the response to PRA RAI 04.01 acknowledges that the treatment of transient fires in the BVPS yard (i.e., Fire Compartment 3-YARD-1) deviates from NRC guidance but asserts that because NRC guidance is limited, FENOC developed its own approach. The response explains that transient fires (i.e., Bin 25 fires) in the yard are bounded by assuming a greater than 100-gallon fuel spill at locations that impact more than one electrical manhole or impact exterior transformers and then weighting those locations within the yard according to vehicle traffic. Locations within the yard that were determined not to be vulnerable to a fuel spill were excluded from evaluation and, therefore, no general transient fire scenarios were developed for these locations. It is not clear if assuming fires caused by large fuel spills captures the full risk from all potential transient fires, including those causing loss of a single manhole.

Justify that the FENOC approach for developing general transient fire scenarios for Fire Compartment 3-YARD-1 is sufficiently conservative, even though some locations within the yard that contain cables were not evaluated for general transient fires. If this approach cannot be justified, then model the additional general transient fires as part of the integrated analysis provided in response to PRA RAI 03.

Response

The FENOC approach for general transient fire scenarios (Bin 25) in 3-YARD-1 is sufficiently conservative due to the following reasons:

• Locations in the yard that do not contain FPRA targets are excluded from the analysis. Therefore, the frequency is only assigned to areas where damage to FPRA targets can occur, instead of the entire yard. As a result, each location where damage to FPRA targets is postulated is assigned a larger frequency.

• The transient fire frequency for Bin 25 was apportioned to manholes or FPRA targets in close proximity to parking lots, roads, walkways, and any other common off-road vehicle path. This ensures frequency is assigned to the areas with the highest likelihood of a fuel spill impact.

• A fuel spill fire scenario greater than 100 gallons was assumed with no fire severity factor. This ensures that the postulated damage set is conservative and includes damage to any manholes in close proximity to one another.

• Although most of the manholes are sealed, the analysis assumes the fuel spill breaches the seal and damages all cables in each affected manhole.

Attachment L-15-325 Page 27 of 31

• All manholes that contain FPRA targets were quantified for conditional core damage probability (CCDP) and conditional large early release probability (CLERP). Single manholes that were excluded from the analysis, because they were considered to be outside the vicinity of a spill, have an average CCDP I CLERP much lower than the average CCDP I CLERP of manholes that were included. Therefore, the risk is conservatively calculated based on a higher CCDP.

PRA RAI 08.01 - Placement of Transient Fires In the licensee's letter dated June 26, 2015, the response to PRA RAI 08 states that part of the criteria used to exclude certain areas of the plant from evaluation of transient fires was that [sic] fact that there is "no credible reason to expect transient material to accumulate (for example, areas on top of half-height rooms, confined areas behind a floor-to-ceiling stack of cable trays in the cable spreading room with no expected reason for access)." In contrast to this, Section 6.5.7.2 of NUREG/CR-6850, Final Report, "EPRI/NRC-RES, Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology,"

states: "It is assumed that transient fires may occur at all areas of a plant unless precluded by design and/or operation, such as inside a BWR [boiling-water reactor] drywell or torus during power operation." The examples of excluded areas provided in the response of out-of-the-way locations behind cable trays and at the top of half-height rooms do not appear to meet the definition of "precluded by design and/or operations." The NRC staff notes that such locations represent potential storage locations and locations out of normal view, where material could be left behind after maintenance activities or plant modifications.

In light of the guidance in NUREG/CR-6850, justify that these excluded locations are precluded by design or operation. Alternatively, include placement of transient fires at these excluded locations and evaluate the impact in the integrated analysis provided in response to PRA RAI 03.

Response

The following locations are precluded by design or operation and were therefore excluded from the BVPS transient analysis:

Attachment L-15-325 Page 28 of 31 Fire Area Justification Compartment Excluded Transient and hot work fires are not postulated in locations within fire compartments that are considered inaccessible (where precluded by design).

Inaccessible areas are defined as those occupied by permanent fixtures such as plant equipment, structural 1-CS-1 Floor area features, piping, and cable trays. Additionally, these 2-CB-1 occupied by permanent fixtures must either occupy the floor space 2-CV-1 cable trays entirely or be sufficiently low to the floor (2 feet or less), so as to obstruct the placement of transient material. Since the floor is occupied in these areas by permanent fixtures, the probability of a fire occurring in this floor space is considered negligible.

Cable trays are routed such that open spaces exist between adjacent tray stacks in this compartment.

Confined These spaces are not part of any normal travel path areas through the plant. The crowded tray spacing and 1-CS-1 behind configuration completely encloses the area, making it 2-CB-1 substantial extremely difficult to enter the space. The excluded cable tray locations in this fire compartment contain no stacks equipment, significantly minimizing or eliminating maintenance and modification activities.

For all other excluded transient areas that are not explicitly precluded by design or operation (for example, the top of half height rooms), FENOC will review and include transient fires (analyze target impacts) at these previously-excluded locations. FENOC will evaluate the impact of these scenarios in the integrated analysis provided in the response to PRA RAI 03.

PRA RAI11.01 - Main Control Room (MCR) Abandonment Modeling for Loss of Control In the licensee's letter dated June 26, 2015, the response to PRA RAI 11 states that a screening HEP of 0.1 is used in MCR abandonment scenarios due to loss of control (LOC) for actions to establish the transfer and for actions taken at the alternate shutdown panel for BVPS, Unit 2. The NRC staff notes that the criteria met to justify use of this screening HEP appear to be consistent with requirements presented in the most current guidance on MCR abandonment scenarios (i.e., "Supplemental Interim Technical Guidance on Main Control Room Abandonment Analysis," dated July 23, 2014 (ADAMS Accession No. ML14156A529)), except that this guidance is intended solely for MCR abandonment due to loss of habitability (LOH). The response acknowledges that

Attachment L-15-325 Page 29 of 31 one difference between MCR abandonment due to LOH and LOC is that the decision to abandon due to LOC will be more difficult. It is not clear to the NRC staff how this complexity, or the additional time that may be required, is addressed in use of the screening HEP, nor how this issue is addressed in the separately modeled recovery actions. The response states that under the new BVPS abandonment procedures, "The timing of when the MCR is abandoned is not so critical, as local actions [that] will be cued from individual fire failures."

The NRC staff observes that there will be operator judgment involved in diagnosing when functionality in the MCR has deteriorated to the extent that the MCR must be abandoned. It is not clear how this complexity, which allows the possibility that MCR abandonment is delayed, is addressed using the generic screening HEP.

In light of these observations:

a) Justify how potential delay to abandon the MCR due to LOC is addressed in use of the screening HEP of 0.1. Account for the added complexity of scenarios that may occur due to an LOC driven abandonment, from the delay to evacuate, and from the additional fire damage that can occur prior to evacuation. If these additional complexities are not considered in MCR abandonment scenarios due to LOC, then address this issue in the integrated analysis provided in response to PRA RAI 03.

b) Account for the potential delay to abandon for LOC and the time for transfer to the alternate shutdown panel in the analysis of risk of the recovery actions associated with abandonment. Account for the additional complexities that arise in the scenarios because of the lesser time to respond to the plant initiator due to these delay and transfer times. If your current approach cannot be justified, replace it with an acceptable approach in the integrated analysis provided in response to PRA RAI 03.

Response

None of the primary control station (PCS) actions encompassed by the HEP of 0.1 will be significantly affected by a delay in the decision to abandon the MCR because they are all cued by individual equipment failures. Similarly, the separately-modeled recovery actions will also not be significantly affected by a delay in the decision to abandon the MCR. The only time-critical action cued directly in response to MCR abandonment is activation of the alternate shutdown panel (ASP), and even this is time-critical only in the sense that the ASP must be activated quickly in order to maintain control of the plant once the MCR is abandoned. There are no required absolute timing criteria regarding activation of the ASP following reactor trip in response to a fire in order to achieve a safe and stable state, beyond the criteria associated with each individual credited action. At BVPS-2, the MCR abandonment procedures under the current safe shutdown fire protection program are built around strict timelines and

Attachment L-15-325 Page 30 of 31 carefully coordinated action sequences involving multiple operators in different areas of the plant. This is based on the safe shutdown requirement to achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In order to achieve cold shutdown in that time frame, the timing of actions to begin cooldown and depressurization is critical. If certain actions are not performed within certain limited-time windows following reactor trip, cold shutdown may not be reached within the required time. Under NFPA 805 there is no such requirement to reach cold shutdown within a limited period of time; instead, the requirement is to achieve a safe and stable state. A delay in the decision to abandon the MCR, and any associated delay in starting cool down and depressurization, will not have a significant effect on the operators' ability to achieve a safe and stable state, and therefore, such delay will not necessarily impact the required timing of individual actions relative to their respective cues and success criteria. The operators' response to the fire and approach to safe shutdown are not substantially changed by the decision to abandon the MCR; they perform remote control of plant parameters from a different remote location (ASP vs. MCR). There is not a significantly different set of recovery actions to be performed if the MCR has been abandoned, and safe shutdown via the ASP and local recovery actions does not rely on equipment which could be damaged by the fire if the decision to abandon the MCR is delayed. The MCR abandonment strategy does not attempt to credit performing actions as preventative measures prior to the occurrence of any fire damage. Therefore, such a delay in the decision to abandon the MCR would not introduce significant additional complexity to the operators' response, nor would it significantly affect the operators' ability to bring the plant to a safe and stable state following a significant fire. Furthermore, the HRA already assigns all post-fire operator actions as the highest possible stress level, which quantitatively bounds the use of the "complex" performance shaping factor in the analysis of each HEP.

Time-critical actions in the FPRA are typically defined beginning at time of reactor trip, but only because that is typically the conservative and limiting worst-possible failure case. Barring additional information regarding the specific timing of individual failures, the procedures are being validated this way to ensure all actions can be accomplished within their respective time requirements in the worst-case scenarios. The MCR abandonment procedures under NFPA 805 will be written to address individual equipment failures as they occur, and when a particular failure occurs the procedure will first instruct the operator to attempt recovery via normal MCR controls. If this does not work, a local operator will be dispatched as necessary. In some cases, a local operator may be dispatched to the ASP to take control of a specific failed component at the ASP, even if command and control is not fully shifted to the ASP. The procedures are being written to ensure the operators are cognizant of the time limits for individual time-critical actions, and will provide guidance on prioritizing actions in response to multiple concurrent failures.

A delay in abandoning the MCR will not result in less time available to respond to the plant initiator (the fire scenario). Under the new procedures, operators will not wait until after abandoning the MCR to begin performing required actions; instead, they will be responding with the appropriate actions as individual cues are received, whether before

Attachment L-15-325 Page 31 of 31 or after the decision to abandon the MCR is made. Therefore, a delay in the decision to abandon the MCR will not introduce significant additional delay into the timing of individual operator actions, aside from the minimal time required to travel to and activate the ASP if the cue for an action were to come in while transferring to the ASP, as discussed in the response to PRA RAI 11 (e), because each action is cued from specific failures. No credited actions except activation of the ASP are cued from the decision to abandon the MCR. Since NFPA 805 no longer requires the plant to achieve cold shutdown in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, success is no longer dependent on performing a carefully timed sequence of actions within narrow windows, which could be significantly disrupted by waiting for an extended period of time to abandon the MCR. Delaying MCR abandonment will not cause any significant delay in the performance of individual actions since they will be cued individually as failures occur. An exception would be related to fire-induced instrument failures which could interfere with the operators' ability to recognize the need for actions, but the procedures will lead the operators to quickly recognize that certain instruments are failed as a result of the fire and this will factor into the decision to abandon the MCR, or possibly to send a local operator to monitor certain plant parameters on the ASP, even while command and control remains in the MCR.

If the cue for an action is received as operators are in the process of abandoning the MCR and transferring command and control to the ASP, the time required to activate the ASP could be added as extra delay time in the performance of the action in order to bound the analysis. Upon reviewing the credited actions, it was determined that in almost all cases this is already bounded by existing time margin in the analysis and would not change the value of the respective HEPs. Only the local action to close the main steam isolation valves (MSIVs) would be potentially failed by the inclusion of this additional delay time. Even that is unlikely, as previously discussed in the response to PRA RAI 11 (e), if the MSIVs need to be closed the demand will almost certainly present within moments of reactor trip, so the operators should receive the cue for this action prior to abandoning the MCR which would allow the local operator to be dispatched without consideration of the additional delay time associated with transferring to the ASP. A similar review reveals that the actions performed at the ASP, which are credited within the HEP of 0.1, will not be affected by the addition of this delay time for ASP activation. The fire HRA includes versions of these actions as would be performed from the MCR for fires not requiring MCR abandonment, and the timing analyses for each of these HFEs can absorb the additional delay time associated with travel to and activation of the ASP without affecting the resulting HEPs.

Therefore, the BVPS-2 FPRA model appropriately accounts for the timing, complexity, and full range of fire damage associated with MCR abandonment and transfer to the ASP, including any potential delay in the decision to abandon the MCR. The response to PRA RAI 03 will properly account for these factors in the analysis of risk of the recovery actions associated with abandonment when the additional risk of recovery actions is calculated and presented in the revised LAR Attachment W (as discussed in the response to PRA RAI 18(a)).