Text

Probabilistic Safety Review for License Amendment Request Nos. 302 and 173
	ML051670270
Person / Time
Site:	Beaver Valley
Issue date:	06/14/2005
From:	Pearce L; FirstEnergy Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	L-05-104
	Download: ML051670270 (49)
	v • d • e

FENOC RPO.

Beaver Valley Power Station Box 4 FirstEnergy Nuclear Operating Company Shippingport, PA 15077-0004 L. William Pearce 724-682-5234 Vice President Fax: 724-643-8069 June 14, 2005 L-05-104 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001

Subject:

Beaver Valley Power Station, Unit Nos. 1 and 2 BV-1 Docket No. 50-334, License No. DPR-66 BV-2 Docket No. 50412, License No. NPF-73 Probabilistic Safety Review for License Amendment Request Nos. 302 and 173 By letter (L-04-125 dated October 4, 2004) to the U.S. Nuclear Regulatory Commission (NRC), FirstEnergy Nuclear Operating Company (FENOC) submitted an Extended Power Uprate (EPU) application for Beaver Valley Power Stations (BVPS) Unit Nos. 1 and 2. The proposed amendments would change the BVPS Unit Nos. 1 and 2 operating licenses to increase the maximum authorized power level from 2689 megawatts thermal (MWt) to 2900 MWt. This change represents an increase of approximately 8 percent above the current maximum authorized power level.

By letter dated January 6, 2005, the NRC provided the results of the staff's acceptance review of the EPU application for BVPS Unit Nos. 1 and 2 (license amendment requests 302 and 173). The NRC letter requested that additional technical information be provided in sufficient detail to enable the staff's independent assessment regarding the acceptability of the proposed amendments in terms of regulatory requirements and the protection of public health and safety. Areas that required additional information to be submitted were identified in Sections 1.0 through 6.0 of the enclosure to the January 6, 2005 NRC letter.

By letter L-05-026 (dated February 23, 2005), FENOC transmitted the requested information for five of the six areas identified in the January 6, 2005 NRC letter.

FENOC letter L-05-026 also committed to provide the remaining information to the NRC for the sixth area by June 30, 2005.

Beaver Valley Power Station, Unit Nos. 1 and 2 Probabilistic Safety Review for License Amendment Request Nos. 302 and 173 L-05-104 Page 2 of this letter provides the additional information requested in the January 6, 2005 NRC letter (Section 2.0 - Probabilistic Safety Review). The information presented in Enclosure 1 addresses the impact associated with the EPU, including the Unit No. 1 replacement steam generators, and is meant to supersede Section 10.16 of Enclosure 2 of the EPU submittal (L-04-125). Attachment A of Enclosure 1 provides a summary of a peer review of the BVPS Probabilistic Risk Assessment performed by the Westinghouse Owners Group (WOG) in July 2002. Although Attachment A was provided by FENOC letter L-03-160 (dated October 24, 2003), which was submitted as response to a request for additional information in support of Unit No. 2 license amendment request 180, it is included with this submittal for completeness. Enclosure 1 also contains Attachment B which provides a cross-reference of the Section numbers in Enclosure 1 and the items listed in Section 2.0 - Probabilistic Safety Review of the January 6, 2005 NRC letter.

The information provided in this transmittal has no impact on the proposed Technical Specification changes, or the no significant hazards consideration, transmitted by FENOC letter L-04-125.

There are no new regulatory commitments made in this submittal. If you have questions or require additional information, please contact Mr. Henry L. Hegrat, Supervisor -

Licensing, at 330-315-6944.

I declare under penalty of perjury that the foregoing is true and correct. Executed on June l ,2005.

Sincerely,

. William Pearce

Enclosure:

1 Section 2.0 - Probabilistic Safety Review

Beaver Valley Power Station, Unit Nos. 1 and 2 Probabilistic Safety Review for License Amendment Request Nos. 302 and 173 L-05-104 Page 3 c: Mr. T. G. Colburn, NRR Senior Project Manager Mr. P. C. Cataldo, NRC Senior Resident Inspector Mr. S. J. Collins, NRC Region I Administrator Mr. D. A. Allard, Director BRP/DEP Mr. L. E. Ryan (BRP/DEP)

L-05-104 Enclosure 1 Section 2.0 - Probabilistic Safety Review The following reflects the section numbering of the Beaver Valley Power Station (BVPS)

Extended Power Uprate Licensing Report (Enclosure 2 of L-04-125). These pages are meant to supersede Section 10.16 of the Extended Power Uprate Licensing Report and consider the impact associated with the BVPS Unit No. 1 replacement steam generators. Attachment A of this enclosure provides a summary of the Probabilistic Risk Assessment (PRA) Category A and B facts and observations that potentially impacted the PRA models.

10.16 IMPACT ON PLANT RISK The impact of the Extended Power Uprate (EPU) including containment conversion (CC) on Beaver Valley Power Station Unit No. 1 (BVPS-1) and Beaver Valley Power Station Unit No. 2 (BVPS-2) plant risk was evaluated by reviewing the plant changes associated with the EPU and the plant-specific Probabilistic Risk Assessment (PRA) for internal and external events at power, and the available shutdown risk evaluation information. Furthermore, the impact of the replacement steam generators was considered for BVPS-1.

The guidance provided in Regulatory Guide (RG) 1.174 (Reference 1), "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RS-001 (Reference 2), "Review Standard for Extended Power Uprates," as well as the January 6, 2005 NRC letter to FirstEnergy Nuclear Operating Company (Reference 10), were used to perform an analysis of the plant changes associated with the EPU including containment conversion. The analysis focused on the impacts of EPU including containment conversion impacts on core damage frequency (CDF) and large early release frequency (LERF) due to internal events, external events, and shutdown operations. The analysis of these risk areas is described in the following subsections. Although the EPU is not a risk informed application, this risk analysis is provided for information. The analysis made use of the current BVPS-1 (BVIREV3, 2003) and BVPS-2 (BV2REV3D, 2003) PRA models, which contain equipment unavailability due to maintenance.

This PRA considers all aspects of the EPU, including EPU and CC operating conditions (e.g.

system setpoints, pressures, temperatures), as they relate to PRA, and plant hardware modifications, such as the addition of the auxiliary feedwater cavitating venturis and the main feedwater fast-acting isolation valves. The impact of these, and other changes, is discussed in the following subsections.

10.16.1 Level 1 Internal Events An analysis was performed to evaluate the changes due to the EPU including containment conversion implementation for their potential impact on the PRA models for internal events in the following key areas: initiating event frequency, component reliability, system success criteria, and operator response. Each of these areas is specifically addressed in the following subsections, followed by a description of the overall impacts on CDF and LERF from internal events for the EPU including containment conversion.

L-05-104 Enclosure 1 Page 2 of 32 10.16.1.1 Initiating Event Frequency The BVPS-1 and BVPS-2 Level 1 Internal Events PRAs address Loss-of-Coolant Accidents (LOCA), steam generator tube rupture (SGTR), loss-of-offsite power (LOSP), transients, loss of support systems, and anticipated transients without SCRAM (ATWS), among others. The underlying contributors to these initiating events were reviewed to determine the potential effects of the EPU on the initiating event frequencies.

The Loss of Coolant Inventory category includes five LOCA events ranging from excessive LOCA to small LOCA (isolable and non-isolable). The LOCA events including excessive, large, and medium LOCA are based on potential passive structural failures. Also included are the interfacing system LOCA (ISLOCA) and SGTR events. The initiating event frequencies for these events have been derived from industry data and are not affected by the EPU.

For the small LOCA (non-isolable) pipe break, the frequency has been derived from industry data and is not affected by the EPU.

The small LOCA (isolable) event represents a pressurizer Power Operated Relief Valve (PORV) that has opened and failed to close, but is isolated by the operator action to close the block valve.

Plant changes associated with the EPU and containment conversion would not affect the probability of failure to reclose a PORV. The normal Reactor Coolant System (RCS) operating pressure and the PORV setpoints remain the same, so additional challenges to the valves are not expected. Therefore, the small LOCA (isolable) initiating event frequency remains applicable for the EPU conditions.

The ISLOCA event is initiated by a failure in the interface between the RCS and low-pressure system piping or components, resulting in a failure which allows reactor coolant to be released outside containment. This event is quantified using a simplified fault tree. The RCS normal operating pressure does not change for the EPU; the valve arrangements for the interfacing systems do not change; the RCS leakage surveillance and testing frequencies do not change; and the number of challenges to the isolation valves as a result of normal plant operation is not expected to change. Therefore, the ISLOCA initiating event frequency is not affected by the EPU.

The BVPS-1 SGTR initiating event frequency is derived from industry data. The BVPS-1 replacement steam generators (RSG) have been designed and evaluated for the EPU conditions including containment conversion. The evaluations demonstrate that the RSG will perform acceptably at the EPU power level. The evaluations for the RSG include thermal hydraulic performance, structural integrity, and tube wear. The Alloy 690 tubes in the RSG are less susceptible to tube ruptures than the tubes in the BVPS-1 original steam generators. Therefore, the BVPS-1 SGTR initiating event frequency has been requantified specific to the Alloy 690 RSG tubes. The result is a mean SGTR initiating event frequency of 6.96E-04 per year per steam generator. The SGTR frequency for the original steam generators is 1.48E-03 per year per steam generator. This reduction in SGTR frequency will reduce the internal events core damage frequency and large early release frequency.

L-05-104 Enclosure 1 Page 3 of 32 The BVPS-2 SGTR event initiating event frequency is based on generic industry data, and the BVPS-2 steam generators have been evaluated at the EPU conditions including containment conversion. The generic SGTR initiating event frequency will not be impacted by BVPS-2 EPU plant-specific modifications. Therefore, the BVPS-2 SGTR initiating event frequency will not be affected by the EPU including containment conversion.

The transients initiating event frequencies were derived by using plant-specific data and generic industry data through a Bayesian updating process. As part of the EPU effort, plant systems have been reviewed for continued operability at the EPU conditions. In some cases, system changes have been made so that the systems will adequately perform their functions at the EPU conditions. An example of these changes is resetting control and protection system instrument setpoints so that adequate analysis and operating margins are maintained for both units. Based on this, no changes to the initiating event frequencies for transients have been included in the EPU evaluation and none are anticipated while operating at EPU conditions.

The LOSP initiating event frequency was derived by using plant-specific data and generic industry data (Reference 3) through a Bayesian updating process. The mean BVPS-1 LOSP frequency is 3.16E-02 per year and the mean BVPS-2 LOSP frequency is 2.31E-02 per year.

The frequency of LOSP events is dictated by the reliability of the switchyard and grid. Examples of plant modifications are changes to the 4160 volt tap positions for transformers associated with nonsafety-related 480 volt buses for BVPS-1 and the modification of the cooling system for the BVPS-2 main electrical transformer to increase the cooling margin. The grid reliability is not degraded by EPU. Equipment related to the switchyard and to the stability of onsite power has been evaluated and no modifications to the PRA models are required for the EPU. The evaluations and modifications of the plant electrical systems provide assurance that the frequency of a LOSP event is not adversely affected by the EPU conditions.

The support system fault initiating event frequencies were quantified using fault trees that model plant components. The initiating event frequencies quantified in this manner include those for loss of AC or DC power sources, loss of service water, loss of primary or secondary component cooling water, loss of station instrument air, and loss of containment instrument air. For the AC and DC power sources, evaluations of the plant electrical systems (including modification for EPU conditions) show that the frequency of losing electrical components leading to an initiating event is not adversely affected by the EPU conditions. For the remaining systems, there are no changes related to the EPU including containment conversion that would affect system success criteria, and therefore initiating event frequency, as modeled in the PRA. It is concluded that the components and their reliability are not affected by the EPU conditions; therefore, the calculated initiating event frequencies remain applicable.

Failure of the reactor to trip automatically following an initiating event (i.e., ATWS) is considered in the PRA models in the course of developing plant response scenarios. Therefore, ATWS events are not defined as a separate initiating event category. A separate set of event trees is developed instead for transients and support system faults that are followed by a failure of reactor trip. The Nuclear Steam Supply System (NSSS) control systems were evaluated for stability and operability, and the control rod drive mechanisms were evaluated. These

L-05-104 Enclosure 1 Page 4 of 32 evaluations show that the frequency of an ATWS event from rod control failures is not affected by the EPU conditions.

The EPU and containment conversion effort included review of plant systems for continued operability under the EPU conditions (see Section 10.16.1.3). It is concluded that the reliability of the plant systems is not adversely affected and the initiating event frequencies in the PRA remain applicable.

It is concluded that the EPU including containment conversion will have no adverse affect on the internal events PRA initiator frequencies and any future deviations in initiating event frequencies will be identified by existing monitoring processes such as licensee event reports, condition reporting, and industry events databases and will be included in the periodic PRA updates. In addition, safety system actuations are evaluated for trends under the Maintenance Rule as an indicator of unnecessary challenges of safety-related equipment. The trend data is incorporated into the PRA data analysis during regular PRA maintenance.

10.16.1.2 Component Availability and Reliability A review of the engineering change packages associated with the EPU including containment conversion was performed to determine their affect on systems and associated equipment that are important to plant risk.

The units will rely on existing component monitoring programs, such as preventive maintenance, and the Maintenance Rule, to identify any additional degradation as a result of the EPU including containment conversion. While the EPU including containment conversion may result in some components being refurbished or replaced more frequently, which may result in increased unavailability if performed while the plant is on-line, the functionality and reliability of components will be maintained to the current standard. These existing monitoring programs are also expected to identify any future deviations in component failure rates. The PRA maintenance and update process in place at BVPS-1 and BVPS-2 provides the means for identifying any future impact on component failure rates and unavailability and addressing them in the PRA model.

Modifications are being made to improve the performance of certain plant equipment and systems so that they will continue to be operated within design constraints and so that component failure rates and unavailability will not change with the implementation of the EPU including containment conversion.

Two plant modifications were evaluated to be impacts on the BVPS-1 model. Those modifications are the installation of three cavitating venturis in the BVPS-1 auxiliary feedwater system and the addition of fast-acting isolation valves in the BVPS-1 main feedwater system.

The failure probability for auxiliary feedwater cavitating venturi "fails due to plugging" has previously been developed for BVPS-2. That failure probability was assigned to the new BVPS-1 cavitating venturis. The failure probability for main feedwater fast-acting isolation valve "fail-to-open" and "transfer closed" has previously been developed for BVPS-2. That failure probability was assigned to the new BVPS-1 fast-acting isolation valves.

L-05-104 Enclosure 1 Page 5 of 32 No BVPS-2 EPU plant modifications significantly impact risk.

10.16.1.3 Important Systems and Functions An evaluation was performed to identify the effects of the EPU including containment conversion on the functionality of plant systems. Systems related to decay heat removal, containment, steam conversion, reactor coolant system inventory, engineered safety features, reactivity control, and electrical/instrumentation and controls were evaluated.

The functionality of those systems is not expected to be impacted by the EPU including containment conversion. Some system components are being modified or added, and some instrumentation setpoints are being changed to accommodate the EPU including containment conversion implementation. Examples of such include, installation of auxiliary feedwater cavitating venturis and main feedwater fast-acting isolation valves at BVPS-1 (both related to CC), and moisture separator pilot relief valve modification in BVPS-2. In some instances, these changes are being made specifically to preserve functionality of the system under EPU conditions including containment conversion. For example, in BVPS-2, the orifice plate in the turbine plant component cooling water system is being modified to accommodate new flow conditions, and various system instrumentation and control setpoints in both BVPS-1 and BVPS-2 are being changed to accommodate EPU conditions.

The evaluation of the potential for plant changes associated with the EPU including containment conversion to affect plant risk concluded that these changes will have no adverse effect on system functions important to plant risk. Plant modifications were made to maintain or improve the performance of certain equipment under EPU and containment conversion conditions so that plant systems and equipment will continue to be operated within design constraints and that component failure rates and unavailability will not significantly change with the implementation of the EPU, including containment conversion. Thus, system functionality is not impacted.

10.16.1.4 Success Criteria '

Detailed analyses were performed to account for the effect of the increase in the BVPS-1 and BVPS-2 thermal power level on the internal events PRA success criteria. Success criteria are defined for the accident sequences modeled in the Probabilistic Risk Assessment (PRA) to establish, via analysis or other suitable means, whether or not core damage occurs. In the BVPS-1 and BVPS-2 PRAs, core damage is defined as when the loss of core heat removal progresses beyond the point of core uncovery, core exit temperatures exceed 1,200'F, and peak fuel node temperature exceeds 1,800'F. The success criteria specify the plant systems and equipment required to function to address critical safety functions. These critical safety functions include reactivity control, RCS pressure control/pressure boundary integrity, RCS and core heat removal, RCS inventory control, and long-term RCS inventory control and heat removal.

The following paragraphs discuss the effects of the EPU including containment conversion and the BVPS-1 replacement steam generators on important PRA success criteria for BVPS-1 and BVPS-2:

L-05-104 Enclosure I Page 6 of 32 Station Blackout (SBO) - The increase in core power will impact heat load to the steam generators. SBO sequences with smaller reactor coolant pump (RCP) seal leak sizes are sensitive to the time of primary plant demineralized water storage tank (PPDWST) inventory depletion, as illustrated in Table 10.16-1. Other sequences are sensitive to timing of steam generator dryout. A sensitivity study was performed, which showed that the change in core power decreases the time to deplete the PPDWST useable volume. But, for sequences in which core damage is already modeled as a result of insufficient PPDWST inventory and/or steam generator dryout, the change in timing is of small consequence to plant risk.

Thus, regardless of core power, the conclusions remain the same. Namely, if Auxiliary Feedwater (AFW) is lost due to PPDWST depletion, then the expected outcome is core damage within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In addition, no impact is expected as a result of the EPU and containment conversion on timing for operators to complete actions related to RCS cooldown. The minimum time to dryout the steam generators will change slightly at BVPS-1 and BVPS-2 following the EPU. Since the time required to perform the action, as modeled in the PRA, is 30 minutes, based on plant simulator results, this change will not have a significant impact on the calculated human error probabilities.

Further, calculations performed for the EPU indicate that the capacity of the steam generator atmospheric steam dump valves (ASDVs) for both units will be adequate for the EPU conditions and changes to the PRA success criteria for these valves are not required.

Table 10.16-1: SBO Time to Core Damage l RCP Seal RCS Cooldown/ PPDWST Current PRA EPU PRA Leakage Size Depressurization Makeup Time to Core Time to Core Successful? Available Damage Damage BVPS-1 21 gpm Yes Yes >48 hours >48 hours Yes No 19.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 16.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months No Yes >48 hours > 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months No No 19.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 16.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months 182 gpm Yes Yes 27.0 hours0 days 0 hours 0 weeks 0 months 30.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Yes No 18.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 15.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months No Yes 8.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 8.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months No No 8.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 8.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months BVPS-2 21 gpm Yes Yes > 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months >48 hours Yes No 18.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 16.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months No Yes > 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months >48 hours No No 18.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 16.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 182 gpm Yes Yes 34.0 hours0 days 0 hours 0 weeks 0 months 33.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Yes No 17.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months 15.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months No Yes 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 8.0 hours0 days 0 hours 0 weeks 0 months No No 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 8.0 hours0 days 0 hours 0 weeks 0 months

L-05-104 Enclosure I Page 7 of 32 Electric Power Recovery - The electric power recovery model in the PRA considers the non-recovery of electric power in sequences for which emergency AC power is lost. MAAP (Modular Accident Analysis Program) thermal-hydraulic analyses for SBO provided time to core damage (see Table 10.16-1) for the electric power recovery sequences. The STADIC code was executed, using the time to core damage results of the MAAP thermal-hydraulic analyses as input, to calculate an electric power non-recovery factor for each SBO sequence.

The BVPS-1 and BVPS-2 model for the recovery of electric power during a specific event scenario accounts for the causes and timing of the power failure events, the sequencing of failures and recovery actions, and the available time window for success before the onset of core damage. Equipment failures and recovery can occur at any time during the 24-hour study period after event initiation. Thus, the BVPS-1 and BVPS-2 electric power recovery model is a time-integrated model for failures and recovery actions that are necessary to assess the effect of diverse failure causes and to model corresponding responses that require different amounts of time to complete and that are started at different times after event initiation.

As shown in Table 10.16-1, the time to core damage for most of the SBO sequences decreases with the EPU conditions. In the time-integrated model for BVPS-1 and BVPS-2, this results in a higher probability of non-recovery for each of the SBO scenarios.

Small LOCA - Small LOCA sequences are defined in the PRA as those smaller than 2 inches equivalent diameter but larger than breaks for which the normal charging system could provide continuous makeup. Those small LOCA sequences that are dependent on bleed and feed cooling for decay heat removal, or dependent on steam generator cooldown and depressurization, could be affected by increases in core power. The bleed and feed success criteria, as currently modeled in the PRA, require a single operable pressurizer power-operated relief valve (PORV). The analyses show that a single PORV will still be adequate after EPU. For either unit, the steam generator cooldown and depressurization success criteria will not change because the steam generator atmospheric steam dump valve capacity has been shown to be adequate for EPU conditions.

The addition of a cavitating venturi in the auxiliary feedwater lines to the steam generators was evaluated for impact on the BVPS-1 success criteria. Since BVPS-1 success criteria is one AFW pump supplying one steam generator, the venturi flow limit of 310 gpm could impact the steam generator water level during operator actions, such as cooldown and depressurization. A sensitivity study was performed in which a small LOCA occurs with emergency cooldown and depressurization and failure of high-head safety injection. After a temporary decrease in steam generator water level sufficient primary-to-secondary heat transfer is still maintained. In conclusion, the success criterion is not impacted.

The higher normal operation (initial) containment pressure resulting from the containment conversion may lead to an earlier receipt of the CIB (Containment Isolation Phase B) signal.

This in turn leads to an earlier quench/containment spray initiation and an earlier time for transfer to recirculation. Hence, upon transfer to recirculation, the earlier CIB signal leads to lower sump water temperatures. Sensitivity cases indicate core damage will not occur as a result of the EPU modifications.

L-05-104 Enclosure 1 Page 8 of 32 MAAP analyses have been performed that show that after EPU implementation, for a small LOCA with failed High Head Safety Injection (HHSI), operators will still be able to depressurize the RCS with sufficient time available to use Low Head Safety Injection (LHSI) to prevent core damage.

Medium and Large LOCA - The medium LOCA break spectrum includes breaks ranging from 2 inches up to 6 inches equivalent diameter. The smaller end of the break spectrum may have sensitivities similar to those found for the small LOCA scenarios. The success criteria for the larger end of the medium break spectrum, and the large break spectrum, are not expected to be affected by core power or containment condition changes, given that the PRA models the design basis criteria (e.g., one of two LHSI pumps delivering flow through two-of-two intact cold leg injection paths and injection from two-of-two intact cold leg accumulators), which remain unchanged.

General Transients - The transient case considered is a loss of all feedwater with feed and bleed initiated at 13% wide range steam generator level per plant procedures. A single pressurizer PORV and a single HHSI pump are used for the feed and bleed action.

For BVPS-1 with RSGs the 13% wide range level results in less secondary side inventory available than for the 13% level in the original steam generators. Thus, with the RSG there is less margin for successful completion of the plant-specific feed and bleed procedure. Feed and bleed is initiated at 0.495 hours0.00573 days 0.138 hours 8.184524e-4 weeks 1.883475e-4 months and is initially successful at depressurizing the primary system and maintaining RCS coolant level. However, once the steam generators dry out at approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , all core decay heat must then be removed through the single open pressurizer PORV. Because of the limited capacity of the single PORV to pass water, the primary system repressurizes and the HHSI flow is insufficient to prevent core uncovery. Eventually the pressurizer level decreases and there is enough steam flow through the PORV to depressurize the RCS sufficiently to allow HHSI injection and RCS level is recovered. During the period of core uncovery, the peak core node temperature reaches 1740'F. In summary, for BVPS-1 with RSGs and feed and bleed entry at 13% wide range level, the core will uncover temporarily, but no core damage will occur.

Because the BVPS-1 RSGs have less inventory remaining at the 13% wide range level than the BVPS-2 original steam generators and because the BVPS-1 presssurizer PORV capacity is less than the BVPS- 2 capacity, the BVPS-1 transient is bounding for BVPS-2, so the same success criteria apply.

Loss of Service Water/Loss of River Water (LOSWILORW) - The primary core damage mechanism resulting from a LOSW/LORW is a consequential RCP seal LOCA. Thus, this category of sequences would have similar sensitivities to the EPU as were discussed for SBO.

Anticipated Transient Without SCRAM (ATWS) - There is one change associated with the EPU that affects ATWS-related CDF. The addition of cavitating venturis to the AFW system in BVPS-1 precludes the ability to deliver full flow from all three AFW pumps to the steam generators. However, the existing PRAs already take no credit for full AFW delivery in response

L-05-104 Enclosure 1 Page 9 of 32 to ATWS, thereby resulting in a somewhat conservative prediction of ATWS CDF, which is therefore unaffected by the EPU.

Human Reliability Analysis (HRA) - EPU has the general effect of reducing the time available for the operators to complete recovery actions, because of the higher decay heat level after EPU implementation. Reduced time available can increase the probability of operator failure. The available times from the thermal-hydraulic analyses were input into the BVPS-1 and BVPS-2 PRA HRA model to assess the effect of the EPU on the operator actions used in the model. A comprehensive list of the post-initiator operators actions whose available times (and possibly their error probabilities) changed as a result of the EPU are listed in Table 10.16-2. The table provides the operator failure event, its description, the times available to perform the operator action from the current BVPS-1 or BVPS-2 PRA and for EPU conditions, and the human error probabilities (HEP) from the current BVPS-1 or BVPS-2 PRA and for EPU conditions.

It should be noted that there are other operator failures that occur in the PRA models that did not change as a result of the EPU. Furthermore, the MAAP analyses performed in support of the PRA model for EPU were more realistic than much of the thermal-hydraulic hand calculations supporting the current model; thus, many of the EPU times available are longer than in the current model. For the purposes of this analysis, a conservative approach was utilized where the current PRA time available was used in the instances when the EPU time available increased.

Therefore, the only human error probabilities that were affected were those in which the time available decreased, as shown in Table 10.16-2.

L-05-104 Enclosure 1 Page 10 of 32 Table 10.16-2: Impact of EPU on HRA rime Available (° Event Description Current Current EPU Time EPU Name PRATime PRA Human Available Human Available Error Error Probability Probability BVPS-1 HRA ZHEAFI Operator opens manual valve MS- 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 5.29E-03 0.51 hours5.902778e-4 days 0.0142 hours 8.43254e-5 weeks 1.94055e-5 months 7.23E-03 17 to supply steam to the turbine-drive from steam generator 1C.

ZHECCI Operator starts the manual standby 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 4.21E-03 13 minutes(2 ) 5.80E-03 reactor-side component cooling system (CCR) on loss of the operating and the automatic standby CCR, to restore component cooling water (CCW) flow to the RCP thermal barriers.

ZHECC2 Operator aligns the normally 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 6.92E-03 13 minutes(2) 7.71E-03 isolated CCR cooler to river water in the event that river water to the normally aligned cooler is lost.

ZHECD1 Operator depressurizes the RCS to 5.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months 1.71E-03 1.23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months (3) 2.68E-02 400 psig by dumping steam through the steam generator atmospheric steam dumps to depressurize and cool down the secondary side (small LOCA).

ZHECD2 Same as ZHECD1 except that AC 5.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months 2.58E-03 2.02 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (3) 3.77E-02 orange power has failed and operators have to locally manipulate the steam generator atmospheric steam dumps to cooldown.

ZHECD5 Operator depressurizes the RCS to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 1.94E-02 2.68 hours7.87037e-4 days 0.0189 hours 1.124339e-4 weeks 2.5874e-5 months 2.56E-02 400 psig by locally manipulating the steam generator atmospheric steam dumps to relief steam during a SBO.

ZHECI1 Operator locally closes the RCP 1.18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months 2.22E-03 0.91 hours0.00105 days 0.0253 hours 1.50463e-4 weeks 3.46255e-5 months 2.45E-03 seal return isolation valves outside the containment given a loss of all AC power (station blackout).

L-05-104 Enclosure 1 Page 11 of 32 Table 10.16-2: Impact of EPU on HRA Time Available ("

Event Description Current Current EPU Time EPU Name PRA Time PRA Human Available Human Available Error Error Probability Probability ZHEDF1 Operator opens manual valve FW- 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 2.82E-03 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 3.13E-03 543 to supply alternate water supply to the dedicated aux feed pump.

ZHEIA1 Given LOSP, operators locally 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 5.87E-03 13 minutes(2) 0.0(4) start the diesel air compressor.

ZHEIC2 Operators crosstie station 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 2.73E-03 13 minutes (2) 1.22E-02 instrument air to containment instrument air by locally opening manual valve IA-90.

ZHEMA1 Operators supply alternate 2.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 1.26E-03 1.89 hours0.00103 days 0.0247 hours 1.471561e-4 weeks 3.38645e-5 months 1.55E-03 makeup to PPDWST (WT-TK-10). .__

ZHEMA2 Operators align river water to the 2.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 1.23E-03 1.89 hours0.00103 days 0.0247 hours 1.471561e-4 weeks 3.38645e-5 months 1.52E-03 aux feedwater pumps suction.

ZHEMU1 Operators provide borated makeup 4.03 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 8.41E-03 0.46 hours5.324074e-4 days 0.0128 hours 7.60582e-5 weeks 1.7503e-5 months (3) 1.89E-02 water to the RWST initially from the spent fuel pool, and, in the long term, from blending operations following a steam generator tube rupture.

ZHEMU2 Operators provide borated makeup 1.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months 1.01E-02 0.38 hours4.398148e-4 days 0.0106 hours 6.283069e-5 weeks 1.4459e-5 months (3) 2.07E-02 water to the RWST initially from the spent fuel pool, and, in the long term, from blending operations following a small LOCA.

ZHEOF2 Operators align main feedwater or 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 1.97E-04 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 2.29E-04 the dedicated aux feedwater given aux feed fails and no CIA signal.

ZHEOF3 Same as ZHEOF2 except main 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 4.87E-04 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 5.80E-04 feedwater is unavailable.

ZHEOF4 Same as ZHEOF2 except CIA 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 2.82E-04 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 3.32E-04 signal is present.

ZHEOF5 Same as ZHEOF2 except main 0.95 hours0.0011 days 0.0264 hours 1.570767e-4 weeks 3.61475e-5 months 4.87E-04 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 5.80E-04 feedwater is unavailable and a CIA signal is present.

I L-05-104 Enclosure 1 Page 12 of 32 Table 10.16-2: Impact of EPU on 1IRA Time Available (

Event Description Current Current EPU Time EPU Name PRA Time PRA Human Available Human Available Error Error Probability Probability ZHEOS1 Operator manually actuates safety 1.03 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 6.42E-03 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 7.68E-03 injection and verifies operation of certain safety equipment on loss of solid state protection system (SSPS) due to actuation relay failure given a transient initiating event that leads to SI conditions.

On failure of manual safety injection actuation, the operator manually aligns the safety equipment.

ZHEOS6 Operator starts AFW given failure 1.03 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 8.15E-04 0.73 hours8.449074e-4 days 0.0203 hours 1.207011e-4 weeks 2.77765e-5 months 1.12E-03 of SSPS for sequences in which there is no safety injection; e.g.,

turbine trip sequences.

ZHEPI1 Operator isolates the RCS relief 1.18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months 5.51E-04 0.91 hours0.00105 days 0.0253 hours 1.50463e-4 weeks 3.46255e-5 months 6.14E-04 paths due to stuck-open pressurizer PORVs after they were used to depressurize the RCS, by closing the PORV block valves associated with the stuck-open PORVs.

ZHEPK1 Operator isolates the RCS relief 1.18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months 6.39E-04 0.91 hours0.00105 days 0.0253 hours 1.50463e-4 weeks 3.46255e-5 months 7.10E-04 paths due to stuck-open pressurizer PORVs after they were used to limit pressure surge or for establishing an emergency boration path following an ATWS, by closing the PORV block valves associated with the stuck open PORV.

L-05-104 Enclosure 1 Page 13 of 32 Table 10.16-2: Impact of EPU on HRA Time Available ° Event Description Current Current EPU Time EPU Name PRA Time PRA Human Available Human Available Error Error Probability Probability ZHERE5 Operator re-energizes the 3.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1.01E-02 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months 1.24E-02 emergency buses IAE and 1DF by closing OCB 83 and OCB 92 to energize transformers lA and lB, replacing one or more of the fast transfer breakers, then opening ACB 41C and ACB 341D, and closing ACB 41A and ACB 341B.

ZHERE6 Same as ZHERE5 except that a 1.18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months 1.77E-02 0.91 hours0.00105 days 0.0253 hours 1.50463e-4 weeks 3.46255e-5 months 2.26E-02 transient-induced small LOCA had occurred.

ZHEWA1 Operator manually starts and 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 7.81E-03 13 minutes( 2 ) 1.88E-02 aligns auxiliary river water pumps to the required river water header given no LOSP.

BVPS-2 HRA ZHECC1 Operator starts the manual standby 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 3.24E-03 13 minutes(2 ) 5.82E-03 component cooling pump (CCP) on loss of the operating and the automatic standby CCPs, to restore component cooling water (CCW) flow to the RCP thermal barriers.

ZHECD1 Operator depressurizes the 12.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 9.06E-04 1.04 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (3) 1.39E-03 Reactor Coolant System (RCS) to 400 psig by dumping steam through the steam generator atmospheric steam dumps to depressurize and cool down the secondary side (small LOCA).

ZHECD2 This is the same as ZHECD1 12.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 4.90E-03 3.62 hours7.175926e-4 days 0.0172 hours 1.025132e-4 weeks 2.3591e-5 months (3) 6.56E-03 except that AC Orange power has failed and operators have to locally manipulate the steam generator atmospheric steam dumps to cool down.

L-05-104 Enclosure I Page 14 of 32 Table 10.16-2: Impact of EPU on HRA Time Available ° Event Description Current Current EPU Time EPU Name PRA Time PRA Human Available Human Available Error Error Probability Probability ZHECD5 Operator depressurizes the RCS to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 1.84E-02 2.61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months 2.36E-02 400 psig by locally manipulating the steam generator atmospheric steam dumps to relief steam during a station blackout (SBO).

ZHECS1 Operator restores service water to 0.84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months 2.06E-02 0.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 2.37E-02 the secondary component cooling system heat exchangers to maintain cooling to the station instrument air compressor, by opening appropriate motor-operated valves (MOVs)

A following a containment isolation (Phase A) signal.

ZHEOF1 Operators reestablish main 0.84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months 1.20E-03 0.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 1.59E-03 feedwater following a safety injection signal by resetting the safety injection system, opening the feedwater isolation valves, and starting the startup feed pump or main feed pump.

ZHEOF2 Operator opens main feed bypass 0.84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months 3.37E-04 0.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 4.46E-04 valves following a partial feed water isolation event after a plant trip.

ZHEOS1 Operator manually actuates safety 1.05 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 1.04E-02 0.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 1.33E-02 injection and verifies operation of certain safety equipment on loss of both trains of SSPS due to actuation relay failure. On failure of manual safety injection actuation, the operator manually aligns the safety equipment.

Though there is no loss-of-coolant accident (LOCA) present, a valid safety injection condition has occurred; for example, steamline break.

L-05-104 Enclosure I Page 15 of 32 Table 10.16-2: Impact of EPU on HRA Time Available (l)

Event Description Current Current EPU Time EPU Name PRA Time PRA Human Available Human Available Error Error Probability Probability ZHERES Reenergize the emergency buses 3.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 7.54E-03 2.61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months 8.67E-03 2AE and 2DF by closing OCB 85 and OCB 94 to energize transformers 2A and 213, replacing one or more of the fast transfer breakers, then opening ACB 42C and ACB 342D, and closing ACB 42A and ACB 342B. May also use motor-operated disconnect switch for transformer 2A.

ZHERE6 This is the same as ZHERE5 3.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 7.54E-03 2.61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months 8.67E-03 except that a transient-induced small LOCA had occurred.

ZHERED This is the same as ZHERE5 3.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 4.45E-04 2.61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months 5.93E-04 except that breakers need not be replaced.

ZHEREE This is the same as ZHERE5 3.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 2.69E-03 2.61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months 3.23E-03 except that breakers need not be replaced and that a transient-induced small LOCA had occurred.

ZHETB1 Operator cross-ties station 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 7.94E-04 13 minutes( 2 ) 2.85E-03 (ZHEIC1) instrument air to containment instrument air.

ZHETB2 Operator resets containment 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1.10E-02 13 minutes(2) 1.71E-02 (ZHEIC2) isolation Phase A (CIA) and restores containment instrument air.

ZHEWA1 Operator manually stops the EDG 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 7.93E-02 13 minutes() 1.30E-01 and racks the spare service water (SWS) pump onto the bus prior to restarting the EDG during a loss of offsite power.

(1 This table only contains operator actions adversely impacted by EPU.

(2) The 13 minutes is based on the expected time of occurrence of potential RCP seal popping or binding failures given in WCAP-15603, Revision I-A. The current HEP value was based on the maximum expected time of RCP seal failure of 60 minutes.

3) These timings did not credit resetting the CIB signal and stopping quench spray flow; whereas, the current HEP analysis does. nWis assumption maximizes the EPU impact on the HEP.

(4) ZHEIA1 is considered guaranteed success since the diesel air compressor will auto-start.

L-05-104 Enclosure 1 Page 16 of 32 10.16.1.5 PRA Level 2/LERFAnalysis An evaluation was performed to identify the effects of the EPU including containment conversion on the BVPS-1 and BVPS-2 containment and the contributors to the Large Early Release conditional probability. The dominant contributors to Large, Early Release Frequency (LERF) in the BVPS-1 and BVPS-2 PRAs include events that are either faulted SGTR events or interfacing system LOCAs outside containment (Y-sequence). These contributors are unaffected by the changes in the containment conditions associated with containment conversion (i.e. from sub-atmospheric to slightly sub-atmospheric conditions) since the containment plays no role in mitigating fission product releases for these sequences. Other plant changes associated with the EPU were determined to have an insignificant or no adverse impact on these contributors.

As faulted SGTR events strongly contribute to LERF, the impact on LERF due to the BVPS-1 RSG was considered. The current BVPS-1 SGTR initiating event frequency for the original steam generators is 1.48E-03 per year per steam generator. The RSGs are Westinghouse Model 54F with Alloy 690 material tubes. The Alloy 690 material has shown resiliency against the failure mechanisms that occur in the original steam generator design, such as primary water stress corrosion cracking. Thus, the new SGTR initiating event frequency was calculated to be 6.96E-04 per year per steam generator. Consequently, the BVPS-1 LERF is expected to decrease as a result of the lower SGTR initiating event frequency.

The effect of the containment changes on Direct Containment Heating (DCH) was modeled using the Pilch DCH screening model (Reference 5). The model predicts peak containment pressure above the cutoff containment pressure for which containment rupture (failure) is considered in the PRA. This results in an increased contribution to LERF that is well within the criteria established in the RG 1.174 (increases less than 1.OE-07 /year for LERF). Since the Pilch screening methodology is known to yield conservative results and the additional contribution to LERF is less than the 1.0E-07 RG 1.174 criteria for LERF, no further analyses were performed.

Other LERF contributions were explicitly considered as part of this review, namely hydrogen bums and containment isolation failures. Current sub-atmospheric containment modeling in the PRAs assumes no pre-existing containment isolation failures. This assumption remains valid for the EPU including containment conversion (i.e. slightly subatmospheric conditions) as the containment vacuum pumps are not expected to maintain the slightly subatmospheric condition for pre-existing containment isolation failures; however, a sensitivity study was performed to quantify the impact of pre-existing containment isolation failures on LERF. Results show that the addition of pre-existing containment isolation failures to the PRA model results in a less than 0.01% increase in LERR The LERF point estimate value for the current BVPS-1 PRA is 1.03E-06 per year. A 0.01% increase results in a small increase in LERF of 1.03E-10 per year. If the RSG SGTR initiating event is considered for BVPS-1, then the LERF is expected to decrease.

The LERF point estimate value for the current BVPS-2 PRA is 1.12E-06 per year. A 0.01%

increase results in a small increase in LERF of 1.12E-10 per year. Both of these increases in LERF are considered small and acceptable with respect to the acceptance criterion in RG 1.174.

L-05-104 Enclosure 1 Page 17 of 32 The EPU including containment conversion plant changes were reviewed for impact on other potential LERF contributors, namely steam explosions and induced SG tube ruptures. The review included consideration of a potential containment bypass through the RWST scenario that results due to changes related to the containment conversion. The scenario exists if the check valves in the Quench Spray System (QSS) do not reseat properly following Quench Spray termination after the RWST depletion and the operators fail to close the QSS Pump discharge motor operated valves (MOVs) in accordance with existing emergency operating procedures (EOPs). In addition, the check valves should only be open when the Quench Spray Pumps are operating. Therefore, it is concluded that the changes have an insignificant effect on containment bypass frequency. This bypass scenario was precluded in the existing PRA model since the containment was assumed to be sub-atmospheric prior to the RWST depletion, given that Quench Spray was successful.

Late containment failures modeled in the BVPS-1 and BVPS-2 PRAs include those attributed to overpressurization due to steam, overpressurization due to non-condensables, late hydrogen burn, and failure due to overtemperature. The plant changes reviewed were determined to have an insignificant or no adverse impact on the total failure contribution from these contributors.

The containment conversion cavity hole modification for BVPS-1 and BVPS-2 may result in the bottom of the reactor vessel being wetted by water in the cavity. Typically, the initial containment pressure rise due to a wet cavity is greater than that for a dry cavity. Generally, containment failures are postulated to occur 48 to 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months after core melt. The timing changes associated with the containment conversion changes are bounded by a 5 to 10% decrease in these times. Since these timing changes take place very late in the accident progression, they have insignificant or no adverse impact on Level 2 late containment failure results.

10.16.1.6 Summary of Internal Events Analysis Results The internal events risk assessment of the BVPS-1 and BVPS-2 EPU was performed via the revision and quantification of the existing BVPS-1 and BVPS-2 PRA models to account for the above noted changes in operator failure and SBO non-recovery probabilities. Included in the quantification is the BVPS-1 RSG SGTR initiating event frequency and the BVPS-1 added components to the AFW and Main Feedwater (MFW) systems. Two PRA models were used for each plant in the assessment of the risk impact of the EPU.

EPU Model The EPU operator failures and SBO non-recovery probabilities were used to update the current internal events PRA models, including internal flooding, to create the EPU models.

Furthermore, the BVPS-1 EPU model includes a new SGTR initiating event frequency and added components to the AFW and MFW systems.

Current (pre-EPU) Model The current internal events PRA models of record, including internal flooding, were used as a baseline for the EPU models.

L-05-104 Enclosure 1 Page 18 of 32 All models were quantified and their results compared in order to assess the effect of the EPU on the internal events Level 1 risk. As a result of this assessment, the effect of the BVPS-1 EPU was to decrease the internal events CDF from 7.45E-06 per year to 6.85E-06 per year. The decrease in CDF is due to the reduction in the SGTR initiating event frequency. Also as a result of this assessment, the effect of the BVPS-2 EPU was to increase the internal events CDF from 2.01E-05 per year to 2.02E-05 per year, an increase of 1.36E-07 per year. Table 10.16-3 provides the effect of the BVPS-1 EPU on the CDF results by top initiating event contributors.

Table 10.16-4 provides the effect of the BVPS-2 EPU on the CDF results by top initiating event contributors.

Table 10.16-5 is provided to indicate the operator action importances for Level 1 Internal Events for EPU conditions. Included in this table are the Fussell-Vesely importance values, which determine how much of a reduction in CDF would be observed if the operator action is assumed to be perfectly reliable, such that it never failed. The risk achievement worth (RAW) ranking is also presented and represents yet another way of determining operator action risk importance, as it shows how much the CDF would increase if the operator action is guaranteed failed. A RAW value of 1.0 would indicate no change in risk if the associated operator action would fail.

Not considering the reduced BVPS-1 RSG SGTR initiating event frequency, the BVPS-1 and BVPS-2 LERF results show that the addition of pre-existing containment isolation failures to the PRA models results in a less than 0.01% increase in LERF. The LERF value for the current BVPS-1 PRA is 1.03E-06 per year. A 0.01% increase results in a small increase in BVPS-1 LERF of 1.03E-10 per year. If the BVPS-1 RSG SGTR initiating event is considered, then the BVPS-1 LERF is expected to decrease. The LERF value for the current BVPS-2 PRA is 1.12E-06 per year. A 0.01% increase results in a small increase in a BVPS-2 LERF of 1.12E-10 per year.

RG 1.174 states that "when the calculated increase in CDF is very small, which is taken as being less than 1.0E-06 per reactor year, the change will be considered regardless of whether there is a calculation of the total CDF." Moreover, RG 1.174 also states that "when the calculated increase in LERF is very small, which is taken as being less than 1.0E-07 per reactor year, the change will be considered regardless of whether there is a calculation of the total LERF." Although the EPU license amendment is not being requested as a risk-informed change, the changes in risk measures (CDF and LERF) are considered small and meet the acceptance guidelines of RG 1.174.

L-05-104 Enclosure 1 Page 19 of 32 Ta'hlg- 1A 16-A. iRVP.C.-l rnitnrhuvifnn nf'Tnn Infprnn] Iniftinin E~venft sn (tDF Initiator Description EPU PRA Current PRA % Change('l Contribution Contribution to to CDF CDF (Iyear)

(/year)

AOX LOSS OFEMERGENCY4160V ORANGE 7.74E-07 6.83E-07 1.32%

DPX LOSS OF EMERGENCY 125VDC PURPLE 7.73E-07 8.18E-07 -0.65%

LAX LOSS OF STATION INSTRUMENT AIR 7.45E-07 7.42E-07 0.04%

DOX LOSS OF EMERGENCY 125V DC ORANGE 5.17E-07 5.40E-07 -0.34%

BPX LOSS OF EMERGENCY 4160V AC PURPLE 4.09E-07 4.35E-07 -0.38%

LOSP LOSS OF OFFSITE POWER 3.04E-07 3.04E-07 0.00%

PAB FLOOD AT EL 735 TRN A - NOT PABF2A SOLATED 2.82E-07 2.82E-07 0.0 1%

PAB FLOOD AT EL 735 TRN B -NOT PABF2B SOLATED 2.82E-07 2.82E-07 0.00%

NVCX OSS OF RIVER WATER HEADERS A & B 2.67E-07 2.67E-07 -0.01%

ELOCA EXCESSIVE LOSS OF COOLANT ACCIDENT 2.66E-07 2.66E-07 0.00%

RTRIP REACTOR TRIP 2.02E-07 1.92E-07 0.14%

SGTRA STEAM GENERATOR A TUBE RUPTURE 1.93E-07 4.08E-07 -3.14%

GTRB STEAM GENERATOR B TUBE RUPTURE 1.93E-07 4.08E-07 -3.14%

GTRC STEAM GENERATOR C TUBE RUPTURE 1.93E-07 4.08E-07 -3.15%

RP URBINE TRIP 1.76E-07 1.67E-07 0.13%

LMFW ARTIAL LOSS OF MAIN FEEDWATER 1.41lE-07 1.34E-07 0.10%

SIV CLOSURE OF ONE MSIV 1.35E-07 1.28E-07 0.11%

LOCN SMALL LOCA, NONISOLABLE 1.12E-07 1.09E-07 .0.05%,.

INTERFACING SYSTEMS LOCA SX (V-SEQUENCE) 8.06E-08 8.06E-08 0.00%

BFL INE BUILDING FLOOD 7.83E-08 7.76E-08 0.01%

INADVERTANT SAFETY INJECTION SI INITIATION 6.76E-08 6.38E-08 0.06%

MFW OTAL LOSS OF MAIN FEEDWATER - ATWS 4.54E-08 4.19E-08 0.05%

CX CNMT INSTRUMENT AIR INITIATING EVENT 4.48E-08 4.46E-08 0.00%

XFW EXCESSIVE FEEDWATER FLOW 4.46E-08 4.23E-08 0.03%

LMFWA ARTIAL LOSS OF MAIN FEEDWATER - ATWVS 4.45E-08 4.46E-08 0.00%

MEDIUM LOSS OF COOLANT ACCIDENT IN OCAA LOOPA 4.19E-08 4.19E-08 0.00%

MEDIUM LOSS OF COOLANT ACCIDENT IN OCAB LOOPB 4.19E-08 4.19E-08 0.00%

MEDIUM LOSS OF COOLANT ACCIDENT IN OCAC LOOPC 4.19E-08 4.19E-08 0.00%

1)Percent change is calculated as percent of total current PRA CDF.

L-05-104 Enclosure 1 Page 20 of 32

_Table 10.16-4: BVPS-2 Contribution of Initiating Ev ents to CDF Initiator Description EPU PRA Current PRA % Change°')

Contribution Contribution to CDF to CDF (/year)

(/year)

AOX LOSS OF EMERGENCY 4160V ORANGE 5.56E-06 5.55E-06 0.07%

BPX LOSS OF EMERGENCY 4160V PURPLE 5.08E-06 5.07E-06 0.05%

EXFV EXCESSIVE FEEDWATER FLOW 8.55E-07 8.54E-07 0.01%

LOSS OF CONTAINMENT INSTRUMENT ICX AIR SUPPLY 7.52E-07 7.50E-07 0.01%

LOSS OF STATION INSTRUMENT AIR IAX SUPPLY 6.39E-07 6.38E-07 0.00%

LOSS OF EMERGENCY 125V DC DOX ORANGE 5.73E-07 5.711E-07 0.01%

LOSS OF EMERGENCY 125V DC DPX PURPLE 5.60E-07 5.57E-07 0.01%

LOSP LOSS OF OFFSITE POWER 5.23E-07 4.93E-07 0.15%

TLMFW TOTAL LOSS OF MAIN FEEDWATER 5.18E-07 5.17E-07 0.00%

TTRIP TURBINE/GENERATOR TRIP 4.53E-07 4.45E-07 0.04%

SGTRB STEAM GENERATOR TUBE RUPTURE 3.37E-07 3.31E-07 0.03%

SGTRA A STEAM GENERATOR TUBE RUPTURE 3.36E-07 3.30E-07 0.03%

SGTRC C STEAM GENERATOR TUBE RUPTURE 3.36E-07 3.30E-07 0.03%

SLOCN SMALL LOCA, NONISOLABLE B 3.35E-07 3.34E-07 0.00%

INTERFACING SYSTEMS LOCA VSX (V-SEQUENCE) 2.80E-07 2.80E-07 0.00%

RTRIP REACTOR TRIP 2.67E-07 2.62E-07 0.03%

EXCESSIVE LOSS OF COOLANT ELOCA ACCIDENT 2.66E-07 2.66E-07 0.00%

S. SAFEGUARDS TRAIN AAREA .,

SGFL1A FLOOD, ISOLATED 2.58E-07 2.57E-07 0.01%

BOTH SAFEGUARDS AREA FLOOD, SGFL2 NONISOLATED 2.34E-07 2.28E-07 0.03%

PLMFWV PARTIAL LOSS OF MAIN FEEDWATER 2.07E-07 2.04E-07 0.02%

LB2A LOSS OF 4160V BUS 2A 1.38E-07 1.38E-07 0.00%

IMSIV CLOSURE OF ONE MSIV 1.31E-07 1.14E-07 0.08%

LCV LOSS OF CONDENSER VACUUM 1.30E-07 1.30E-07 0.00%

LB2D LOSS OF 4160V BUS 2D 1.1 lE-07 1.11E-07 0.00%

PARTIAL LOSS OF MAIN FEEDWATER -

PLMFWA ATWS 1.01E-07 1.011E-07 0.00%

INADVERTANT SAFETY INJECTION ISI INITIATION 8.77E-08 7.94E-08 0.04%

WBXX LOSS OF SERVICE WATER TRAIN B 7.3 1E-08 7.27E-08 0.00%

WAX LOSS OF SERVICE WATER TRAIN A 6.90E-08 6.85E-08 0.00%

(1)Percent change is calculated as percent of total current PRA CDF.

L-05-104 Enclosure 1 Page 21 of 32 Table 10.16-5: HRA ImDortances (based on CDF) for EPU Conditions")

Event Name 1 Description Fussell- Risk Achievement l_ _ Vesely Worth BVPS-1 HRA OPRAFI Operator opens manual valve MS-17 to supply 2.63E-10 1.00E+00 steam to the turbine-drive from steam generator IC.

OPRCC1 Operator starts the manual standby reactor-side 2.07E-05 1.00E+00 component cooling system (CCR) on loss of the operating and the automatic standby CCR, to restore component cooling water (CCW) flow to the RCP thermal barriers.

OPRCC2 Operator aligns the normally isolated CCR 4.87E-09 1.00E+00 cooler to river water in the event that river water to the normally aligned cooler is lost.

OPRCD1 Operator depressurizes the RCS to 400 psig by 5.36E-04 1.02E+00 dumping steam through the steam generator atmospheric steam dumps to depressurize and cool down the secondary side (small LOCA).

OPRCD2 Same as ZHECD1 except that AC orange 2.39E-05 1.00E+00 power has failed and operators have to locally manipulate the steam generator atmospheric steam dumps to cooldown.

OPRCD5 Operator depressurizes the RCS to 400 psig by 4.33E-03 1.16E+00 locally manipulating the steam generator atmospheric steam dumps to relieve steam during a SBO.

OPRCI 1 Operator locally closes the RCP seal return N/A 1.OOE+00 isolation valves outside the containment given

a loss of all AC power (station blackout). '

OPRDF1 Operator opens manual valve FW-543 to 7.22E-10 1.00E+00 supply alternate water supply to the dedicated auxiliary feed pump.

OPRIAI Given LOSP, operators locally start the diesel 6.13E-04 1.05E+00 air compressor.

OPRIC2 Operators cross-tie station instrument air to N/A 1.001E+00 containment instrument air by locally opening manual valve IA-90.

OPRMA1 Operators supply alternate makeup to N/A 1.00E+00 PPDWST (WT-TK-10).

OPRMA2 Operators align river water to the auxiliary N/A 1.00E+00 feedwater pumps suction.

OPRMUI Operators provide borated makeup water to the 0.00E+00 1.00E+00 RWST initially from the spent fuel pool, and, in the long term, from blending operations following a steam generator tube rupture.

L-05-104 Enclosure 1 Page 22 of 32 Table 10.16-5: HRA Importances (based on CDF) for EPU Conditions("

Event Name Description Fussell- Risk Achievement Vesely Worth OPRMU2 Operators provide borated makeup water to the 2.65E-03 1.13E+00 RWST initially from the spent fuel pool, and, in the long term, from blending operations following a small LOCA.

OPROF2 Operators align main feedwater or the 5.01E-05 1.22E+00 dedicated auxiliary feedwater given auxiliary feed fails and no CIA signal.

OPROF3 Same as ZHEOF2 except main feedwater is 6.1OE-05 1.IOE+00 unavailable.

OPROF4 Same as ZHEOF2 except CIA signal is present. 1.14E-05 1.03E+00 OPROF5 Same as ZHEOF2 except main feedwater is N/A 1.00E+00 unavailable and a CIA signal is present.

OPROSI Operator manually actuates safety injection and 8.37E-03 2.08E+00 verifies operation of certain safety equipment on loss of SSPS due to actuation relay failure given a transient initiating event that leads to SI conditions. On failure of manual safety injection actuation, the operator manually aligns the safety equipment.

OPROS6 Operator starts AFW given failure of SSPS for 1.15E-02 1.13E+O1 sequences in which there is no safety injection; e.g., turbine trip sequences.

OPRPII Operator isolates the RCS relief paths due to N/A 1.001E+00 stuck-open pressurizer PORVs after they were used to depressurize the RCS, by closing the PORV block valves associated with the stuck-open PORVs. .

OPRPK1 Operator isolates the RCS relief paths due to N/A 1.00E+00 stuck-open pressurizer PORVs after they were used to limit pressure surge or for establishing an emergency boration path following an ATWS, by closing the PORV block valves associated with the stuck open PORV.

OPRWA1 Operator manually starts and aligns auxiliary 6.27E-02 4.28E+00 river water pumps to the required river water header given no LOSP.

Re-energize the emergency buses 1AE and 2.86E-03 1.23E+00 1DF by closing OCB 83 and OCB 92 to energize transformers IA and lB, replacing one or more of the fast transfer breakers, then opening ACB 41C and ACB 341D, and closing ACB 41A and ACB 341B.

RE6( 2 ' Same as RE5 except that a transient-induced 5.81E-03 1.25E+00 small LOCA had occurred. II

L-05-104 Enclosure 1 Page 23 of 32 Table 10.16-5: RA IMDortances (based on CDF) for EPU Conditions___

Event Name Description Fussell- Risk Achievement I Vesely Worth BVPS-2 HRA OPRCC1 Operator starts the manual standby component 6.69E-06 1.00E+00 cooling pump (CCP) on loss of the operating and the automatic standby CCPs, to restore component cooling water (CCW) flow to the RCP thermal barriers.

OPRCD1 Operator depressurizes the Reactor Coolant 1.07E-04 1.08E+00 System (RCS) to 400 psig by dumping steam through the steam generator atmospheric steam dumps to depressurize and cool down the secondary side (small LOCA).

OPRCD2 This is the same as ZHECD1 except that AC N/A 1.00E+00 Orange power has failed and operators have to locally manipulate the steam generator atmospheric steam dumps to cool down.

OPRCD5 Operator depressurizes the RCS to 400 psig by N/A 1.00E+00 locally manipulating the steam generator atmospheric steam dumps to relieve steam during a station blackout (SBO).

OPRCS 1 Operator restores service water to the 8.98E-04 1.04E+00 secondary component cooling system heat exchangers to maintain cooling to the station instrument air compressor, by opening appropriate motor-operated valves (MOVs) following a containment isolation (Phase A) signal.

OPRICI Operator cross-ties station instrument air to N/A 1.00E+00 containment instrument air.

OPRIC2 Operator resets containment isolation Phase A 1.07E-03 1.06E+00 (CIA) and restores containment instrument air.

OPROFI Operators reestablish main feedwater following 5.65E-04 1.35E+00 a safety injection signal by resetting the safety injection system, opening the feedwater isolation valves, and starting the startup feed

_pump or main feed pump.

OPROF2 Operator opens main feed bypass valves 3.31E-03 8.42E+00 following a partial feedwater isolation event after a plant trip.

L-05-104 Enclosure 1 Page 24 of 32 Table I0.16-5: HRA Imnnrtances (based on CDR for EPU Conditions°)

Event Name Description Fussell- Risk Achievement Vesely Worth OPROSI Operator manually actuates safety injection and 5.89E-03 1.44E+00 verifies operation of certain safety equipment on loss of both trains of SSPS due to actuation relay failure. On failure of manual safety injection actuation, the operator manually aligns the safety equipment. Though there is no loss-of-coolant accident (LOCA) present, a valid safety injection condition has occurred; for example, steamline break.

OPRNVA1 Operator manually stops the EDG and racks 2.23E-03 1.01E+00 the spare service water (SWS) pump onto the bus prior to restarting the EDG during a loss of offsite power.

RE5( Reenergize the emergency buses 2AE and 2DF 1.32E-03 1.15E+00 by closing OCB 85 and OCB 94 to energize transformers 2A and 2B, replacing one or more of the fast transfer breakers, then opening ACB 42C and ACB 342D, and closing ACB 42A and ACB 342B. May also use motor-operated disconnect switch for transformer 2A.

RE6 t2) This is the same as RE5 except that a 1.85E-03 1.03E+00 (2 _ transient-induced small LOCA had occurred.

RED2 This is the same as RE5 except that breakers 0.OOE+00 0.OOE+00 need not be replaced.

REEW This is the same as RE5 except that breakers 0.OOE+00 O.OOE+00 need not be replaced and that a transient-induced small LOCA had occurred.

') This table only contains operator actions adversely impacted by EPU.

(2 The RE (electric.power recovery) operator actions are not explicitly modeled as basic events in the Beaver Valley PRA models, they are "built into" the RISKMAN split fractions; thus, the split fraction importance measures are reported.

L-05-104 Enclosure 1 Page 25 of 32 10.16.2 External Events Analyses were performed to assess the impact of the changes due to EPU including containment conversion on the external events analyses, specifically seismic events, fires, high winds, floods, and other external events. Each of these is individually addressed in the following subsections.

10.16.2.1 Internal Fires The BVPS-1 and BVPS-2 PRA external events analysis fire assessment employs a scenario-based approach that meets the intent of NUREG-1407, "Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Reference 6) to systematically identify fire and smoke hazards and their associated risk impact. An analysis of the plant changes resulting from the EPU including containment conversion indicates that these changes are not expected to result in new internal fire initiators, nor are they expected to result in new internal fire core damage or LERF scenarios.

The fire initiating event frequency is dictated by combustible loading within the area and is, therefore, not affected by the EPU. Plant changes associated with the EPU and containment conversion do not create any additional external fire hazards, nor do the changes increase the intensity of existing hazards.

The plant changes do have a small impact on the performance of necessary mitigation systems in the event a fire occurs. Changes to the HRA, as well as plant modifications to the AFW and NIFW systems (e.g. the additional AFW cavitating venturis add an additional system failure mode), result in a small increase in risk. In the BVPS-1 fire PRA, the CDF due to internal fires is expected to increase 2.10E-09 per year. This increase is considered small per the RG 1.174 acceptance criteria. In the BVPS-2 fire PRA, the CDF due to internal fires is expected to increase 3.60E-09 per year. This increase is also considered small per the RG 1.174 acceptance guidelines.

10.16.2.2 Seismic Analysis The methodology used in the BVPS-1 and BVPS-2 seismic PRA is consistent with the procedures contained in NUREG/CR-2300, "PRA Procedures Guide" (Reference 7). A review of the BVPS-1 and BVPS-2 seismic PRA determined that the dynamic response of the RCS, considering system operating parameters, is sufficiently consistent with the EPU including containment conversion that the original analysis remains applicable to the EPU conditions. An analysis of the plant changes resulting from the EPU indicates that these changes are not expected to result in changes in SSC response to a seismic initiator, nor do they result in new seismic core damage or LERF scenarios. The plant changes have a negligible impact on the structural response of the plant, and they have a small impact on the availability and performance of necessary mitigation systems for a seismic event. Equipment installed or modified as a result of EPU will meet seismic design criteria.

At both BVPS-1 and BVPS-2, the change in Seismic CDF is small, (i.e. less than 1.OE-09 per year). This small change is due to function of the mitigating systems, such as AFW, which have been impacted by the EPU.

L-05-104 Enclosure I Page 26 of 32 10.16.2.3 High Winds, Floods, and Other External Events For the PRA external events evaluation of high winds, floods, and other external events, the PRA external events evaluation used the progressive screening approach described in NUREG-1407, "Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Reference 6). The plant modifications related to the EPU including containment conversion do not affect the high winds, floods, and other external events analysis. Thus, the PRA external events evaluation is applicable to the EPU conditions.

10.16.3 Shutdown Risk 10.16.3.1 Background BVPS-1 and BVPS-2 do not have quantitative PRA shutdown risk assessment models. The impact of the EPU including containment conversion on plant risk at low power and shutdown risk was evaluated in a qualitative manner by addressing the questions posed in Table III-1 of Standard Review .Plan (SRP) 19.0, "Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decision-Making: General Guidance" (Reference 4), to determine if the impacts on shutdown risk would be important. Based upon the responses to the SRP 19.0 questions on shutdown risk, the increase in decay heat is expected to result in a small decrease in the time available for operator actions during shutdown operations.

The Beaver Valley Power Station Units 1 and 2 Shutdown Safety Administrative Procedure provides guidance for evaluation of shutdown safety and for surveillance during plant operating Modes 3, 4, 5 and 6, for planned and forced outages. This procedure is consistent with the guidance in NUMARC 91-06 (Reference 9). It requires monitoring of the plant defense-in-depth features available during these operating modes, and provides guidance for evaluating the adequacy of protective measures and specifies actions to be taken to ensure that there are adequate protective measures in place. The administrative procedure requires development of a Pre-Outage Shutdown Safety Review of key shutdown safety functions. This guidance will continue to be used following the EPU.

The evaluation of the questions posed by SRP 19.0 follows.

10.16.3.2 Evaluation

1. Will these changes affect shutdown schedule?

The Residual Heat Removal System (RHRS) performance evaluation documented in Section 9.3 of the EPU licensing report indicates that "The RHRS design functions.. .are not impacted by EPU conditions." The evaluation is comparable to that described in Section 9.3 (BVPS-1) and Section 5.4.7 (BVPS-2) of the Updated Final Safety Analysis Reports with considerations for the effects of the EPU and system changes since the original evaluation. The RHRS remains adequate to maintain refueling temperatures and a uniform boron concentration in the RCS.

L-05-104 Enclosure 1 Page 27 of 32 Since the decay heat levels are expected to be slightly higher at EPU conditions, it may take a few hours longer to achieve cold shutdown. This will cause very little change in the shutdown schedule, and has no direct safety impacts on the schedule.

2. Will these changes affect operator ability to respond?

The following shutdown safety functions are tracked during an outage:

a) RCS Decay Heat Removal b) RCS Inventory Control c) AC Power Availability d) Reactivity Control e) Containment Integrity f) Spent Fuel Pool Cooling The possible initiating events during shutdown are generally defined as loss of the shutdown safety functions. The EPU does not increase the frequency of these initiators, but may impact the operators' ability to respond to loss of shutdown safety functions.

RCS Decay Heat Removal The RHRS performance evaluation notes that the RHRS remains adequate to maintain refueling temperatures and a uniform boron concentration in the RCS. The increase in decay heat due to EPU will decrease the time for the operators to respond to a loss of shutdown cooling.

Maintaining an adequate defense'in-depth for this safety function at all times, via the Beaver Valley Power Station Units 1 and 2 Shutdown Safety Administrative Procedure, minimizes the impact of this decreased response time. A Pre-Outage Shutdown Safety Review is prepared for each refueling outage according to the guidance of the administrative procedure. The current revision of this procedure includes guidance for evaluating the defense-in-depth of RCS decay heat removal via the following methods:

a) An RCS loop is considered available to remove decay heat if the loop is filled, unisolated and capable of natural circulation. At least one method of feed is available and steam generator water level is either in the narrow range or the steam generator is capable of holding water.

b) An RHRS train must include an intact pathway from the RCS loop A hot leg to either loop B or loop C cold leg. All pumps and MOVs in a given path must be functional, and each pump must have an operational power source.

c) Additional methods of decay heat removal, such as bleed and feed cooling and refueling cavity water level, are credited when they are available.

L-05-104 Enclosure 1 Page 28 of 32 RCS Inventory Control The increase in RCS temperature and the increase in decay heat will decrease the time for the operators to respond to a loss of RCS inventory control. Maintaining an adequate defense-in-depth for this safety function at all times, via the Pre-Outage Shutdown Safety Review minimizes the impact of this decreased response time. The Pre-Outage Shutdown Safety Review is prepared according to the guidance of the Shutdown Safety Administrative Procedure. The procedure includes guidance for evaluating the defense-in-depth of RCS inventory control via the following methods:

a) High head and low head safety injection pumps are available to supply flow to the RCS if the RCS pressure is below the pump shutoff head or can be depressurized, and if injection flow paths can be aligned.

b) Gravity feed from the Refueling Water Storage Tank is available if the RCS is at atmospheric pressure or can be readily depressurized, and an injection flow path can be aligned.

c) Water in the refueling cavity can also be credited for RCS inventory control if the core upper internals have been removed.

AC Power Availability The increase in RCS temperature and the increase in decay heat will decrease the time for the operators to respond to a loss of electrical systems. Since the electrical systems support the systems required for the other safety functions, maintaining an adequate defense-in-depth for this safety function minimizes the impact of this decreased response time. In addition to the requirements for the other safety functions, the Shutdown Safety Administrative Procedure includes guidance for evaluating the defense-in-depth of AC power availability via the following methods:

a) Each unit at Beaver Valley Power Station has 2 emergency diesel generators (EDG). An EDG is considered available and capable of supplying an emergency bus if the EDGQ along with its associated output breaker, miscellaneous controls and emergency bus are operable.

An EDG is also considered available if manual actions can restore an inoperable EDG to functional status within 1/2 the time to RCS boiling.

b) Offsite System Station Service Transformers (SSST) are available to supply power to the emergency buses.

c) The Unit Station Service Transformers (USST) are considered available to supply power if the Main Unit Generator links are removed.

d) An electrical cross-tie to the operating unit is available.

L-05-104 Enclosure 1 Page 29 of 32 Reactivity Control The non-LOCA safety analysis section of the EPU Licensing Report, specifically Section 5.3.5, describes the analysis of the uncontrolled boron dilution event for EPU conditions. The increase in rated power was found to have a negligible impact on the results of the boron dilution event.

The analysis showed that for dilution during refueling, dilution during cold shutdown with the RCS filled, and dilution during cold shutdown with the RCS partially drained the operator is alerted to the event with more than the minimum response time available.

Containment Integrity The containment integrity safety function provides the capability to close the containment following a loss of another safety function. Thus, the response time for this safety function is decreased by the decreased response time for the other safety functions. Maintaining an adequate defense-in-depth for this safety function, at all times, via the Shutdown Safety Administrative Procedure minimizes the impact of this decreased response time. Administrative containment closure controls are required to be implemented during fuel movement or whenever the calculated time to RCS boiling is less than 60 minutes.

Spent Fuel Pool Cooling Section 9.9 of the EPU Licensing Report notes that the spent fuel cooling systems were evaluated with consideration of EPU. Under normal and abnormal conditions, the fuel pool water temperature does not exceed limits associated with the pool structure, liner, cooling system or system components.

3. Will changes affect shutdown equipment reliability?

Existing component monitoring programs, as discussed in Section 10 of the EPU Licensing Report, will account for any additional equipment wear as a result of EPU. While the EPU may result in some components being refurbished or replaced more frequently, the functionality and reliability of components will be maintained to the current standard.

4. Will changes affect availability of equipment or instrumentation used for contingency plans?

Existing component monitoring programs, as discussed in Section 10 of the EPU Licensing Report, will account for any additional equipment wear as a result of EPU. While the EPU may result in some components being refurbished or replaced more frequently, the functionality and availability of equipment or instrumentation used for contingency plans will be maintained to the current standard.

10.16.3.3 Conclusion The increase in decay heat will result in a small decrease in the time available for operator actions during shutdown. However, maintaining an adequate defense-in-depth for the shutdown safety functions at all times, via the Beaver Valley Power Station Units 1 and 2 Shutdown Safety

L-05-104 Enclosure 1 Page 30 of 32 Administrative Procedure, minimizes the impact of this decreased response time. The EPU will have no unique or significant impacts on shutdown risk.

10.16.4 Quality of Probabilistic Risk Assessment The quality required of the PRA used to support a license application depends on the role that the PRA results play in the decision-making process and should be commensurate with the degree of rigor needed to provide a valid technical basis for the NRC staff's decision.

The BVPS-1 and BVPS-2 PRAs are maintained and controlled in a manner that allows them to be used to assess risks associated with the plant as currently configured. The PRAs and the supporting models and calculations have been internally independently reviewed. In addition, by procedure, plant changes, including hardware and procedural changes are periodically reviewed and prioritized in terms of their impact on the PRA model, and these plant changes are incorporated into the model in a manner consistent with their priority.

The NRC staff evaluation reports on the BVPS-1 (9/30/96) and BVPS-2 (5/13/93) Individual Plant Examinations (IPE) were issued and concluded that the IPEs met the intent of Generic Letter (GL) 88-20. The PRAs have been updated several times since the staff review relative to GL 88-20, to maintain consistency with the as-built plant. The most recent update was completed for BVPS-2 in May 2003 and for BVPS-1 in September 2003. Design calculations and reports document the development of all major elements of the initial and updated versions of the PRA models, and these calculations have been internally independently reviewed and are retained in a manner consistent with quality records. Similarly, the PRA evaluation performed in support of the BVPS-1 and BVPS-2 EPU has been internally independently reviewed, and the specific calculations and reports will be retained as quality records.

A PRA peer review was performed on the BVPS-2 internal events at power PRA by the Westinghouse Owners Group in July 2002. Significant observations from that review have been incorporated in the latest PRA model updates (BVIREV3, 2003), (BV2REV3D, 2003). Included in the peer review observations were:

Issues with the PRA RCP Seal Model (Category A), and

Issues with using data from the initial year of commercial operation to quantify initiating event frequency (Category B).

All Category A and B facts and observations resulting from the peer review have been resolved through the Beaver Valley Corrective Action process. A description of the Category A and B facts and observations that potentially impacted the PRA models, as well as their resolution, is provided in Attachment A.

The NRC staff evaluation reports on the BVPS-1 (12/11/00) and BVPS-2 (12/11/00) PRA external events concluded, based on the staff's screening review, that they were capable of identifying the most likely severe accidents and severe accident vulnerabilities and, therefore, met the intent of Supplement 4 to GL 88-20 (Reference 8). As noted in previous sections, the BVPS-1 and BVPS-2 PRAs include CDF and LERF scenarios involving seismic and internal fire

L-05-104 Enclosure 1 Page 31 of 32 initiators that were identified as significant via the PRA external events and also through updates subsequent to the PRA external events.

Given the above discussion, and the fact that the BVPS-1 and BVPS-2 PRAs are maintained, controlled, and documented so that they reflect the as-built, as-operated plant, the BVPS-1 and BVPS-2 internal and external events analyses are appropriate for this license application.

10.16.5 Summary of Risk Impacts The impact of the EPU, including consideration of BVPS-1 RSG and CC for both units, is small for initiating event frequencies, component reliability, important systems and system functions, and Level 2/LERF, as modeled in the internal events at power PRA. The EPU will affect certain PRA success criteria and timing of some modeled human actions, due to the increased decay heat level and other factors previously discussed. Based on the analysis of these potential impacts, it is concluded that the risk increases due to these impacts of the EPU conditions is small and the RG 1.174 acceptance criteria are not exceeded.

There is a detailed process for managing plant risk during shutdown operations, and the risk impact due to the EPU including containment conversion during these operations is expected to be small. The risk increases from external events under EPU are small and the RG 1.174 acceptance criteria are not exceeded.

*N

L-05-104 Enclosure 1 Page 32 of 32 10.16.6 References

1. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, November 2002.

2. Review Standard RS-001, "Review Standard For Extended Power Uprates," Revision 0, December 2003.

3. EPRI Technical Report 1000158, "Losses of Off-Site Power at U.S. Nuclear Power Plants -

Through 1999," July 2000.

4. Standard Review Plan 19.0, "Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decision-Making: General Guidance," Revision 1, November 2002.

5. SAND-91-2407C, "Adiabatic Equilibrium Models for Direct Containment Heating," M.

Pilch, Sandia National Laboratories, 1991.

6. NUREG-1407, "Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," J. T. Chen, et al., U. S.

Nuclear Regulatory Commission, May 1991.

7. NUREG/CR-2300, "PRA Procedures Guide," U. S. Nuclear Regulatory Commission, January 1983.

8. Generic Letter GL88-20, "Individual Plant Evaluation for Severe Accident Vulnerabilities,"

U. S. Nuclear Regulatory Commission, November 23, 1988.

9. NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management,"

December 1991.

10. Beaver Valley Power Station, Unit Nos. 1 and 2 (BVPS-1 and BVPS-2) - Extended Power Uprate (EPU) Acceptance Review (TAC Nos. MC4645 and MC4646), from the U.S. NRC to FirstEnergy Nuclear Operating Company, dated January 6, 2005. we

L-05-014 Enclosure 1, Attachment A WOG PRA Peer Review Significance A & B Facts and Observations Regulatory Guide 1.174, Section 2.23 states that the quality of a PRA analysis used to support an application is measured in terms of its appropriateness with respect to scope, level of detail and technical acceptability, and that these are to be commensurate with the application for which it is intended.

The technical acceptability of the PRA model used in the development of this Extended Power Uprate application has been demonstrated by a peer review process. This peer review was conducted in July 2002 by the Westinghouse Owner's Group (WOG), with the final documentation of the review issued in December 2002. After the peer review, the preliminary Category A and B facts and observations that potentially impacted the model were entered into the BVPS Corrective Action Program, dispositioned, and incorporated into updated PRA models (BVIREV3, BV2REV3D). These updated PRA models were then used to quantify EPU PRA for BVPS-1 and BVPS-2.

A summary of the PRA peer review results that were classified as Category A facts and observations and the Category B facts and observations that potentially impacted the PRA models are provided below. Although the facts and observations were written for the BVPS-2 model, the resolution was applied to the BVPS-1 model as applicable. The Westinghouse Owner's Group peer review team did not identify any facts and observations specific to only BVPS-1.

Category A Observations (CR 02-09037)

Corrective Action 02-09037-01 Summary: This observation was identified in the Accident Sequence Analysis Sub-element regarding the RCP seal LOCA model. It was recognized that the BVPS RCP seal LOCA model used WCAP 15603, Rev. 0 as a basis, but in a way that is more optimistic than most other Westinghouse plants. The BV2REV3A PRA model, RCP seal LOCA success criteria was developed from best estimate MAAP runs performed specifically for BVPS Unit 2. Since certain MAAP results did not go to core uncovery in the assumed 24-hour mission time for the smaller break seal LOCA sizes, they were binned into the success (non CDF) end state, even though electric power or service water was not restored. The peer review team felt that additional MAAP analyses should be performed to investigate the impact of varying MAAP input parameters on the resultant time to core uncovery, and extend the run time to show stable plant conditions.

Resolution: Additional MAAP uncertainty cases for BVPS-2 were performed using pessimistically biased values along with setting input parameters to their high or low limits.

These cases were run out to 48-hours or until core damage occurred. The success state for the BV2REV3D PRA model was redefined as any case (including uncertainties) that did not go to core damage before 48-hours. For cases that went to core damage before 48-hours but after 20-hours, additional electric power recovery values were used, based on NUREG/CR-5496. For cases that lead to core uncovery before 20-hours, a plant specific electric power recovery model

L-05-104 Enclosure 1, Attachment A Page 2 of 13 was used. If electric power recovery was successful for these cases, the sequence was also binned to the success end state.

Corrective Action 02-09037-02 Summary: This observation was identified in the Thermal Hydraulic Analysis Sub-element regarding room heatup calculations. This observation found that the loss of ventilation room heatup analysis for the Safeguards Building, which houses Auxiliary Feedwater, Low Head Safety Injection, and Quench Spray Pumps, used heat loads based on non-DBA conditions with only the AFW pump operating. This resulted in a room heatup that was well below the Equipment Qualification (EQ) temperature limits, and therefore, the ventilation dependency for these pumps was not modeled in the BV2REV3A PRA. The peer review team recommended that the room heatup calculation be re-evaluated using the appropriate DBA heat loads, and determine the impact on the affected components.

Resolution: A new room heatup analysis was performed for the Safeguards Building using realistic time-dependent DBA heat loads, based on MAAP generated success criteria. The results of this analysis were reviewed and compared to the EQ temperature limits to see if the necessary components to mitigate core damage or containment failures would be functional at the time that they were required to function (up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). It was concluded that all PRA modeled equipment located within the Safeguards Building would be available to perform its PRA function during a loss of all ventilation for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Therefore, it was determined that the Safeguards Building ventilation system is not required for support of the PRA modeled equipment located within the area, and the BV2REV3A PRA modeling assumptions regarding this remain valid. The BV2REV3D PRA model was not changed as a result of this observation.

Corrective Action 02-09037-03 Summary: This observation was identified in the Data Analysis, Failure Probability Sub-element. It was observed that the number of demands for several components seemed very high, and that the BVPS-2 plant specific Bayesian updating of independent failure data for these components resulted in more optimistic failure rates than most other Westinghouse plants. The peer review team recommended that the component demands be verified.

Resolution: As a resolution to this PRA Peer Review observation, the success data (demands and hours of operation) for all Unit 2 components that used Bayesian updating of their failure rates were checked against the Maintenance Rule estimated success data, and were revised as needed if discrepancies were found. Additionally, all RISKMAN failure data distributions that were Bayesian updated in the BV2REV3A PRA model were revised in the BV2REV3D PRA model using the results of review for estimated demands and hours of operation. All Top Events were requantified in the BV2REV3D PRA model using these revised component failure rates, which were then used to requantify the CDF and LERE

L-05-104 Enclosure 1,Attachment A Page 3 of 13 Corrective Action 02-09037-04 Summary: This observation was identified in the Human Reliability Analysis (HRA), Post-Initiator Human Actions Sub-element. It was observed that the BVPS human error rates were developed using the Success Likelihood Index Methodology (SLIM) based on calibration curves from other plant HRAs from the mid-1980's. The peer review team recommended that these calibration curves be updated with current operator performance in the nuclear power industry.

Resolution: As a resolution to this PRA Peer Review observation all operator actions having a Risk Achievement Worth (RAW) greater than 2 (generally accepted as the risk significant threshold) were compared to similar actions for all Westinghouse plants by using the WOG/B&WOG PSA Comparison Database (Revisions 2 and 3). Additionally, a smaller subset of these plants was also looked at. These consisted of Westinghouse 3-loop plants (since these were assumed to have similar operation action completion times based on plant power to heatup volume ratios), plants that also used the SLIM process, and Indian Point 2, which received a superior finding in their Human Reliability Analysis peer review. The results of this comparison show that the human error rates used in the BV2REV3A PRA model are all within the range of both comparison groups defined above, except for human action OPRCD3 (operator fails to cooldown and depressurize during a SGTR). However, the BV2REV3A value is of the same order of magnitude as most of the other plants reviewed and is not considered to be an outlier. It is therefore believed that the basic error curves used in the calibration of the BV2REV3A HRA are not significantly out of date and that the current human error rates used in the PRA model are acceptable as is. Moreover, as a final resolution to this observation, future updates of the BVPS PRA models will use the EPRI HRA Calculator, which uses a more current and robust methodology. The BV2REV3D PRA model was not changed as a result of this observation.

Corrective Action 02-09037-05 Summary: This observation was identified in the Data Analysis, Dependence Among Actions Sub-element. It was observed that the BVPS HRA did not have a documented process to perform a systematic search for dependent human actions credited on individual sequences and a method to adjust dependencies between multiple human error rates in the same sequence. The peer review team recommended that a robust technique be developed, documented, and used for the identification and quantification of dependent human error rates (HER).

Resolution: In the initial development of the IPE HRA, an effort was made to eliminate the dependency between human actions by adjusting the split fraction value of the second dependent action, given that the first action failed. For example, if the operators failed to manually reestablish Main Feedwater following the failure of Auxiliary Feedwater, the human error rate for implementing Bleed and Feed cooling later in the accident progression was adjusted upwards.

If the dependent actions were required to take place in the same period of time during the accident progression, the second dependent action was assigned to be a guaranteed failure. For example, if the operators failed to cooldown and depressurize the RCS by using the secondary coolant system, no credit was given to the operators to depressurize the RCS using the Pressurizer PORVs. However, as a resolution to this PRA Peer Review observation a method was established to verify that all dependent operator actions were captured by reviewing

L-05-104 Enclosure 1, Attachment A Page 4 of 13 sequences with two or more failed split fractions that have a contribution from human actions.

Of the sequences reviewed, the human actions were either previously adjusted during the IPE HRA, or were determined to be independent between split fractions. This independence was based on the actions not being conducted by the same set of operators (e.g., control room Reactor Operator action vs. local Auxiliary Plant Operator action), or different procedures being used separated by sufficient time in the accident progression (e.g., actions to makeup to the RWST given SI recirculation failures, following operator actions to align a spare Service Water pump earlier in the accident sequence progression). Human actions that are modeled in a single top event have appropriate dependencies modeled in the fault trees. Moreover, as a final resolution to this observation, future updates of the BVPS PRA models will use the EPRI HRA Calculator, which uses a more current and robust methodology. The BV2REV3D PRA model was not changed as a result of this observation.

Categorv B Observations That May Impact the PRA Model (CR 02-09042)

Corrective Action 02-09042-01 Summary: This observation was identified in the Initiating Event Sub-element regarding the plant-specific experience data. The subtier criteria required that initiating event data from the initial year of commercial operation be excluded from the initiating event frequency determination, contrary to the BV2REV3A PRA model since data from 1987 was used.

Resolution: The initiating event frequencies were reanalyzed using data from January 1, 1989 through May 31, 2001. In addition, LOCA initiating event frequencies were reanalyzed to address aging-related failure mechanisms based on the interim LOCA frequencies from Table 4.1 of the "Technical Work to Support Possible Rulemaking for a Risk-Informed Alternative to 10CFR 50.46 / GDC 35, Revision 1," dated July 2002. The results of this reanalysis were incorporated into the BV2REV3D by updating the initiating event frequencies.

Corrective Action 02-09042-02 Summary: This observation was identified in the Initiating Event Sub-element regarding the data and consistency with industry experience. The peer review team identified that although the interfacing systems LOCA initiating event frequency was consistent with current industry values, it was derived from references developed in 1985. The peer review team recommended that the interfacing systems LOCA model be checked against more recent references.

L-05-104 Enclosure 1, Attachment A Page 5 of 13 Resolution: The interfacing systems LOCA initiating event frequency was reanalyzed using the following documents:

1. G Bozoki, P. Kohut, and R. Fitzpatrick, "Interfacing Systems LOCA Pressurized Water Reactors," prepared for U.S. NRC, NUREG/CR-5102, BNL-NUREG-52135, February 1989.

2. E. T. Bums, K. Mohammadi, T.P., Mairs, V. M. Anderson, and B. Hannaman, "ISLOCA Evaluation Guidelines," prepared for Electric Power Research Institute, NSAC-154, September 1991.

3. D. A. Wesley, T. R. Kipp, D. K. Nakaki, H. Hadid-Tamjed, "Pressure-Dependent Fragilities for Piping Components - Pilot Study on Davis-Besse Nuclear Power Station," prepared for U.S. NRC, NUREG/CR-5603, TI91 002465, October 1990.

The results of this revised analysis were incorporated into the BV2REV3D by updating the interfacing systems LOCA initiating event frequency.

Corrective Action 02-09042-03 Summary: This observation was also identified in the Initiating Event Sub-element regarding the data and consistency with industry experience. The peer review team identified concerns that the use of Bayesian updating data with zero failures would result in posterior values much lower than the prior or what plant specific data could justify. The peer review team recommended developing rules that limit Bayesian updating of data whenever there are zero failures, or when one failure occurs with the number of demands/hours much lower than the implied prior.

Resolution: While there are indeed situations that Bayesian updating with zero failures could cause the posterior mean to be significantly lower than the prior mean, these are due to the use of using moment matching. This refers to the practice of changing a prior that is presumably a lognormal distribution, to a gamma distribution by matching the' mean" and the standard deviation. After the Gamma distribution is updated with plant data analytically, the resulting gamma distribution is converted back to the lognormal distribution again using the moment matching method. It is known that in this practice, if there should be zero failures, the resulting posterior gamma distribution has a mean value significantly lower than the prior mean.

The BVPS analysis did not use the moment matching methodology. Instead, the Bayesian update functionality provided by RISKMAN was used. There are two classes of priors used in the BVPS analysis. The first class is the lognormal distributions based on parameters from industry studies (e.g., LOCA initiators). Updating a lognormal distribution with zero events in about 10 years does not change the mean in most cases (or there is a slight change in the third significant number).

The second class, which is a more general type of priors, is the industry data. These priors consist of three parts. The first and most important part is the failure and success data for a set of PWR power plants. The second part is the so-called grid, which consists of a set of values for the median (of the assumed prior curve), and a set of values for the range factor (of the assumed

L-05-104 Enclosure 1,Attachment A Page 6 of 13 prior curve). The selection of median and range factor should be such that the resulting distribution should not be skewed toward either end of the median or range factor in the grid (grid is the matrix of median and range factor values). The third part of a prior is the so-called lambdas, which is a set of values for the possible bin values that the distribution can locate. The lambdas do not affect the posterior mean distribution as long as it has sufficient range and sufficient number of values (typically 20 bins are sufficient for a distribution). It should be pointed out that for the industrial data type of prior, updating it with zero failures typically results in a smaller mean value for the posterior then the prior. However, the decrease is much smaller in magnitude than the moment matching approach, and it should be treated as a normal behavior of the Bayesian analysis (i.e., zero failures always provide information leading to a lower estimate).

In response to this observation, each posterior distribution that was Bayesian updated with zero failures was reexamined to assure that there was no skewing of results on the grid, and that there were no abnormally large values (excessive probabilities) in a single lambda bin. In some cases a few more lambdas were added to actually bring the probability per each lambda lower than 0.1.

However, in these cases the posterior distribution changed little compared to the BV2REV3A original set of lambdas (note, the grid was not changed in this response because these were checked in the original analysis and quality was assured). The results of the review did not identify any concerns, so confidence in the Bayesian update results using zero failures based on the discrete probabilistic distribution approach, which is a robust process, was maintained.

For the BV2REV3D PRA model, since the success time changed from 11 critical years to 9.93 critical years in response to Corrective Action 02-09042-01 (to remove the first year of commercial operation), the posterior mean shifted slightly higher than the original BV2REV3A PRA model analysis.

Corrective Action 02-09042-04 Summary: This observation was identified in the System Analysis (Fault Trees) Sub-element regarding the support system requirements. The peer review team identified that although the components required to swap the charging/HHS1 pump suction source over to the RWST for the loss of Component Cooling Water due to the increased VCT suction temperatures were modeled, the operator action to do so was not. The peer review team recommended that an analysis be performed to determine the increase in charging pump suction temperature and determine if/when this would result in the potential for common cause failure of all charging pumps.

Resolution: An evaluation was performed to see at what temperature the available NPSH would be lower than the required NPSH at the charging/HHSI pump design flowrate. The results of this evaluation revealed that the VCT temperature would have to increase by more than 123 'F for this condition to be true and result in a loss of NPSH. With multiple high temperature alarms coming in at more than 100 0F prior to reaching this temperature, there would be plenty of time available to operators to perform mitigating actions. Moreover, a loss of NPSH would only impact the running charging pump, since the standby pump does not automatically start, unless a Safety Injection Signal is present, in which case the suction would automatically swap over to the RWST. The third pump would only be manually aligned and started following the failure of

L-05-104 Enclosure 1, Attachment A Page 7 of 13 the first two normally aligned pumps. Therefore, this observation was not considered to be a valid common cause failure mechanism of the charging/HHSI pumps, so the operator action was not included in the BV2REV3D PRA model.

Corrective Action 02-09042-06 Summary: This observation was identified in the System Analysis (Fault Trees) Sub-element regarding the modeling of generic system failure modes observed in the industry. The peer review team identified that some initiator dependent component failure modes associated with the LHSI pump miniflow did not appear to be modeled. The peer review team recommended that the LHSI system fault tree be revised to include initiator dependent failure modes for the pump miniflow components. They also recommended that other systems be reviewed to determine the potential for initiator specific success criteria.

Resolution: The LHSI initiator success criteria were reviewed to address the specific PRA peer review concerns. One such concern was that the LHSI fault tree modeled the failure to open of the miniflow MOVs during a small break LOCA, but did not model the transfer closed failure.

Typically the PRA only modeled passive failures (e.g., transfer closed) if there were no active failure modes (e.g., failure to open) modeled, since the active failures dominate the components failure probability (usually by three orders of magnitude). Therefore, this concern was not incorporated into the BV2REV3D PRA model update. Another concern was that the LHSI fault tree always queried the opening of the pump miniflow valves even though they would not be required to open during a large break LOCA, and that doing so may provide a flow diversion. To address this concern the BVPS-2 LHSI fluid flow model was reviewed for large LOCAs with and without the miniflow value opened. It was concluded that the difference in flow delivered to the reactor vessel was less than 75 gpm if the miniflow valve remained open. Therefore, this was not determined to be a valid flow diversion path and was not incorporated into the BV2REV3D PRA model. Additionally, while including the miniflow valve failure to open for large break LOCAs is not required, the large break LOCA contribution to total CDF is less that 0.1 percent, so it was not considered to be vital to remove it from the BV2REV3A PRA model.

The other Top Event fault trees for systems with miniflow protected pumps were reviewed to ensure that there was no obvious potential for initiator specific success criteria missing from the model. It was found that the Recirculation Spray System Trains C and D also have the same type of miniflow valve failure modes modeled as the LHSI pumps, so the above justification also applies. No other systems with miniflow valves were considered to be dependent on the initiating event.

Corrective Action 02-09042-08 Summary: This observation was identified in the System Analysis (Fault Trees) Sub-element regarding the availability of system inventory requirements for the entire mission time. The peer review team identified that the ultimate makeup source to the RWST credited in the PRA model was from an unborated Service Water supply. Since this function was shown to be important in the BV2REV3A PRA model, the peer review team suggested that a stronger technical basis be developed to ensure that recriticality does not occur during the mission time, due to boron dilution of the RCS.

L-05-104 Enclosure 1, Attachment A Page 8 of 13 Resolution: An evaluation was performed using the BVPS Unit 2 Cycle 10 core design analysis (WCAP-15779, Rev. 0) boron requirements for shutdown (k=0.99) at beginning of life and hot zero power as the minimum required boron concentration to prevent recriticality. The results of this evaluation determined that the boron concentration delivered to the RCS would be above the minimum required to maintain subcriticality for the entire 24-hour mission time, when using unborated water for makeup to the RWST at the flowrates determined in the MAAP LOCA success criteria analyses. Additional operator actions to add boron to the RWST via the spent fuel pool, to increase the shutdown margin, could be implemented, but were not credited in the PRA model. The BV2REV3D PRA model was not changed as a result of this observation.

Corrective Action 02-09042-10 Summary: This observation was identified in the Data Analysis, Guidance Sub-element to ensure that sufficient detail is provided for reproducing the evaluation. It was observed that the estimated average number of demands per year computed by the peer review team did not match the demands used in the BV2REV3A PRA model. The peer review team recommended that the information used for the number of demands for Unit 2 components be captured in the documentation.

Resolution: This is really a documentation issue that does not impact the PRA model; however, the estimated number of demands was revised as part of the resolution to Corrective Action 02-09037-03, identified earlier, so it is included in response to this RAI.

Corrective Action 02-09042-13 Summary: This observation was identified in the Data Analysis, Failure Probability Sub-element. It was observed by comparing failure probabilities that the diesel generators were far more reliable than their circuit breakers and 4V feeder breakers, which was thought to be counter-intuitive. The peer review team recommended that the data for the diesel generator and circuit breakers be verified. '

Resolution: As part of the resolution to Corrective Action 02-09037-03, identified previously, the diesel generator and circuit breaker failure probabilities were revised.

Corrective Action 02-09042-15 Summary: This observation was identified in the Data Analysis, System/Train Maintenance Unavailabilities Sub-element. It was observed by the peer review team that the test and maintenance unavailabilities for the Unit 1 diesel generators, used for the electric power cross-tie during a Station Blackout, may not include periods during shutdown conditions. The peer review team recommended that the Unit 1 diesel generator test and maintenance unavailabilities during shutdown conditions be verified to be properly accounted for in the PRA model.

Resolution: As resolution to this observation, the Diesel Generator System Engineer was contacted to obtain the historical diesel generator unavailability during plant shutdown conditions. For the Unit 1 emergency diesel generators, the shutdown unavailability was based

S L-05-104 Enclosure 1, Attachment A Page 9 of 13 on data obtained from October 1997 through September 2001. These values were then combined with the assumed on-line maintenance unavailability values to determine the total Unit 1 emergency diesel generator unavailability, which was used in the BV2REV3D electric power cross-tie model.

Corrective Action 02-09042-16 Summary: This observation was identified in the Thermal Hydraulic Analysis Sub-element regarding room heatup calculations. It was observed by the peer review team that the Unit 2 Ventilation and Room Cooling Analysis Notebook lists an operator action to setup portable fans in the control room following the loss of all ventilation; however, this action was not included in the PRA model. The peer review team recommended that an operator action to add portable fans be incorporated into the PRA model or that the control room HVAC be included in the PRA model.

Resolution: The Unit 2 Ventilation and Room Cooling Analysis Notebook only looked at a loss of ventilation in the Unit 2 side of the Control Building. In reality, the Unit 1 and Unit 2 Control Rooms are located within the same building separated by a partial wall (there is no wall above the "egg crate" ceiling), so a loss of ventilation at one unit will not result in the total loss of ventilation to the common Control Building. As resolution to this observation, a separate calculation (8700-DMC-3467, Rev. 1) was reviewed, which was previously performed in response to an Appendix R Unit 1 Control Room Ventilation fire. This calculation combined the Control Room volumes and heat loads, and took credit for the Unit 2 HVAC to cool both Control Room areas. While it was noted that this calculation was performed assuming a loss of Unit I HVAC, it was determined to be applicable to a loss of Unit 2 HVAC as well, since the HVAC flow rate were similar at each unit. The results of this analysis concluded that during a loss of ventilation at one Unit, the Control Building temperature would remain below the Equipment Qualification limits during a 24-hour mission time, even without setting up portable ventilation fans. This analysis assumed a homogenous mixture of air existed between the Control Rooms, so it was assumed that the operators would open the common doors between the Control Rooms to aid in cooling. This action was assumed to be a guaranteed success in the PRA model, since both Control Rooms are continuously manned and human nature would drive the operators to do so after they begin to feel uncomfortable. It was determined that this observation did not impact the PRA model, so the recommend changes were not incorporated into the BV2REV3D PRA model.

Corrective Action 02-09042-17 Summary: This observation was identified in the Accident Sequence Sub-element regarding the interface with Emergency Procedures. It was observed by the peer review team that the operator action to trip the RCPs prior to implementing Bleed and Feed, as stated in the Success Criteria Notebook, was not accounted for in either the HER or elsewhere in the model. The peer review team recommended the inclusion of this operator action for tripping the RCPs and that the impact on the timing for this action from the MAAP runs be documented.

L-05-104 Enclosure 1, Attachment A Page 10 of 13 Resolution: As resolution to this observation, existing documents were reviewed. Based on the EOP Background document for FR-H.1, steam generator dryout is expected to occur at 33.1 minutes if all RCPs remain running during a loss of all secondary cooling. If the RCPs are tripped 5 minutes after the reactor trip, steam generator dryout is expected to occur at 40.9 minutes. This difference of less than 8 minutes is not expected to significantly impact the human error rates calculated for Top Event OB, since the actions to trip the RCPs, initiate SI and open a PORV are fairly simple actions that can be accomplished within minutes. Therefore, these actions are all assumed to be accounted for in the current human action failure rate, so the HER was not revised in the BV2REV3D PRA model.

Corrective Action 02-09042-18 Summary: This observation was identified in the Human Reliability Analysis Modeling Sub-element regarding the consideration of pre-initiator human interactions in the model. It was observed by the peer review team that miscalibration errors were not considered in the model.

The peer review team recommended verification that the generic common cause database includes miscalibration errors within the equipment failures, or that miscalibration errors that fail redundant trains be included in the model.

Resolution: This observation is not totally correct, since the solid state protection system (SSPS) model did include instrument string miscalibration errors in the fault tree model.

Additionally, common cause miscalibration errors between trains are considered to be rare events since the On-line Maintenance Program is developed to alternate work between trains on different weeks. Furthermore, a search in the Corrective Action database and EPIX did not reveal any such miscalibration errors between trains at BVPS. Therefore, this observation was assumed to be resolved by the instrument string miscalibration errors already accounted for in the SSPS model. No further miscalibration errors were incorporated into the BV2REV3D PRA.

Corrective Action 02-09042-23 Summary: This observation was identified in the Dependency Related Grades Sub-element regarding the identification of susceptible SSCs located in the flood area to flood induced failure mechanisms. It was observed by the peer review team that there was no discussion of the impact of failure mechanisms on SSCs from flood initiators in the flooding documentation. The peer review team recommended that the flood locations modeled in the PRA be reviewed for potential impacts.

Resolution: In response to this observation, the work that was completed for the Beaver Valley Unit 2 Risk-Informed In-Service Inspection (RI-ISI) Indirect (Spatial) Consequence Evaluation was reviewed. As a part of this evaluation process, an assessment of the postulated indirect (spatial) consequences associated with piping failures was made in order to further distinguish the piping segments. The indirect effects assessment was accomplished through an investigation of existing plant documentation on pipe breaks, flooding, and plant layout along with a focused plant walkthrough. The indirect effects that were specifically looked at included: pipe whip, jet impingement, sprays, and flooding resulting from pipe breaks or leaks. The results of this indirect effects evaluation did not identify any viable SSC impacts due to flood induced failure

L-05-104 Enclosure 1, Attachment A Page 11 of 13 mechanisms that were not already addressed in the PRA flooding analysis documentation. No further flooding impacts were incorporated into the BV2REV3D PRA.

Corrective Action 02-09042-27 Summary: This observation was identified in the Dependency Related Grades Sub-element regarding the consideration of flood barrier structural capacity when credited for limiting flood propagation. It was observed by the peer review team that the flooding analysis has not been updated since the IPE, which treated flood barriers deterministically and were thought to succeed. The peer review team recommended that the flooding analysis be updated to address potential failures of flood doors and other flood barriers.

Resolution: In response to this observation, the work that was completed for the Beaver Valley Unit 2 Risk-Informed In-Service Inspection (RI-ISI) Indirect (Spatial) Consequence Evaluation and several updated flooding analyses performed after the IPE submittal were reviewed. The results of this review determined that the flooding analyses did consider the potential of flood barrier failures due to the flood water static head on the door latching mechanisms. It was concluded that the IPE flooding analysis assumptions regarding the propagation of flood waters did consider flood barrier failures, and remain valid. No further flooding impacts were incorporated into the BV2REV3D PRA.

Corrective Action 02-09042-28 Summary: This observation was identified in the Quantification Related, Dominant Sequences/Cutsets Sub-element. The peer review team observed that the dominant sequences were based on a Level 2 quantification, so the individual sequences for core damage were getting split up (fractionalized). This fractionalizing of the sequences made them appear less dominant and difficult to compare with industry values for similar sequences. The peer review team recommended that the containment event free be suppressed in the CDF quantification, so that the Level 1 results could be better compared to expected values and insights.

Resolution: In response to this observation, a new top event was included in the BV2REV3D PRA model, which contained a switch to bypass the containment event tree top events. This allowed for the Level 1 (CDF only) sequences to be quantified and reviewed, while also maintaining the ability to provide Level 2 sequence results, when needed.

Corrective Action 02-09042-32 Summary: This observation was identified in the Quantification Related, Non-Dominant Sequences/Cutsets Sub-element. Several concerns were identified during the review of the non-dominant sequences regarding the split fraction logic rules used in the CDF quantification. The peer review team recommended that the split fraction logic rules be verified, and establish an explanation if they are justified, or correct them if in error.

L-05-104 Enclosure 1, Attachment A Page 12 of 13 Resolution: In response to this observation, the split fraction logic rules were re-examined and compared to the dependency matrices. The specific concerns identified by the peer review were reviewed and corrected in the BV2REV3D PRA model when in error. The BV2REV3D PRA model was then quantified using only the Level 1 Top Events so that a review of the CDF sequences could be performed to verify that the revised split fraction logic rules made sense.

This included looking at non-dominant sequences 5 orders of magnitude lower than the total CDF value. Other concerns identified that were not in error, were determined to have sufficient justification provided in the System Notebooks and Dependency Matrices.

Corrective Action 02-09042-35 Summary: This observation was identified in the Quantification Related, Uncertainty Sub-element regarding the use of a point estimate value for the interfacing systems LOCA initiating event frequency. The peer review team noted that the Monte Carlo generated value was slightly higher and would only result in a minor CDF increase, but that the increase would impact LERF to a higher degree. It was recommended that the Monte Carlo value be used for the interfacing systems LOCA initiating event frequency.

Resolution: In response to this observation, the Monte Carlo value generated for the updated interfacing systems LOCA initiating event frequency in response to CA 02-09042-02 previously identified, was used in the quantification of the BV2REV3D PRA model.

Corrective Action 02-09042-36 Summary: This observation was identified in the Containment Performance Analysis, Containment Capability Assessment Sub-element regarding the inclusion of both leakage and large failures in the analysis. It was observed by the peer review team that all SGTR core damage sequences with wet steam generators (i.e., successful AFW) were classified in the small early release frequency without regard to specific sequence conditions, based solely on scrubbing as the justification. The peer review team recommended that supporting sensitivity analyses be performed to further justify that scrubbed SGTRs do not result in large releases.

Resolution: In response to this observation, the BV2REV3D PRA model was revised to incorporate WCAP-15955 "Steam Generator Tube Rupture PSA Notebook" classification of SGTRs into LERF. In the BV2REV3D PRA model update, all steam generator tube ruptures that are faulted and have a depleted RWST, or have a loss of all secondary cooling and consequential challenge to the steam relief valves are considered to be LERF contributors. For these cases it is assumed that leakage from the RCS will continue indefinitely through a faulted steam generator and the core will uncover after the RWST depletes.

L-05-104 Enclosure 1, Attachment A Page 13 of 13 Corrective Action 02-09043-25 Summary: This observation was identified in the Quantification Related Grades regarding the dominant sequences/cutsets. It was observed by the peer review team that the simplified assumption regarding the subsequent failure of operators to emergency borate, given the failure of the operators to trip the reactor as an immediate action is overly conservative. The peer review team recommended that the ATWS model be revised to appropriately account for human error rates in the EOPs, giving consideration to the timing and dependencies between the actions.

Resolution: In response to this observation, the BV2REV3D PRA model was revised to incorporate giving credit for the longer term operator action to emergency borate, even though the earlier actions to manually trip the reactor or to insert the control rods may have failed.

L-05-014 Enclosure 1, Attachment B Cross-reference of NRC January 6, 2005 Letter Section 2 Items to Enclosure 1 Sections The list of information required by the Nuclear Regulatory Commission (NRC) to perform a review of an Extended Power Uprate (EPU) license amendment request is derived from RS-001, Review Standards for Extended Power Uprates, and is reflected in the January 6, 2005 NRC acceptance letter. Attachment 1 to Matrix 13 of RS-001 provides the risk information needed for NRC review. The information contained within is broken down into three areas, Internal Events, External Events, and Shutdown Operations. The content and format of Enclosure I of this submittal has been structured in a similar manner. The contents requirements of RS-001 and the NRC acceptance letter has been reviewed to ensure that all requirements have been addressed.

The attached table documents this review by providing a correlation between the NRC January 6, 2005 acceptance letter items and where the information can be found in Enclosure 1 of this submittal.

Letter Item Number Section Number 2a 10.16.4 2b 10.16.1.6 Summary 10.16.1 through 10.16.4 CDF 10.16.1.5 LERF 2c 10.16.1 through 10.16.4 2d 10.16.4 2e 10.16 2f Not Applicable. All modifications were identified.

2g Not Applicable. Did not exceed RG 1.174 guidance.

2h 10.16.2 2i Not Applicable. Did not exceed RG 1.174 guidance.

2j 10.16.3 21 10.16.3.1 2m 10.16.3.2 2n 10.16.3.1

v t e Letter Sequence Request
TAC:MC4645, (Approved, Closed)
Initiation Request, Request, Request, Request, Request Acceptance, Acceptance, Acceptance Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement Administration Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance Meeting, Meeting, Meeting, Meeting Questions 11 March 2005 5 May 2005 2 August 2005 30 September 2005 1 November 2005 Answers 6 September 2005 Results Approval, Approval, Approval Other: ML060330262, ML061770605
MONTHYEAR2005-07-28 [Table View]

L-05-104, Probabilistic Safety Review for License Amendment Request Nos. 302 and 173

Text

Subject:

Enclosure:

Navigation menu

L-05-104, Probabilistic Safety Review for License Amendment Request Nos. 302 and 173

Text

Subject:

Enclosure:

Navigation menu

Search