ML11252A657

License Amendment Request 244, Evaluation of New Proposed Manual Actions, Attachment 5

ML11252A657
Person / Time
Site:	Kewaunee
Issue date:	08/30/2011
From:	Dominion, Dominion Energy Kewaunee
To:	Office of Nuclear Reactor Regulation
References
11-025A, LAR 244, TAC ME7110
Download: ML11252A657 (20)

Text

Serial No. 11-025A ATTACHMENT 5 LICENSE AMENDMENT REQUEST 244:

PROPOSED REVISION TO RADIOLOGICAL ACCIDENT ANALYSIS AND CONTROL ROOM ENVELOPE HABITABILITY TECHNICAL SPECIFICATIONS EVALUATION OF NEW PROPOSED MANUAL ACTIONS KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

Serial No. 11-025A Attachment 5 Page 1 of 19 EVALUATION OF PROPOSED NEW MANUAL ACTIONS Introduction In accordance with the revised RAA provided in Attachment 4, DEK is proposing two manual actions to ensure post-accident dose is maintained within limits. The revised RAA credits these manual actions to limit consequences of the Fuel Handling Accident (FHA) and Locked Rotor Accident (LRA). The proposed manual actions are as follows:

1. The revised RAA credits manual operator action to isolate the control room envelope (CRE) within one hour after initiation of an LRA. This manual action is required to compensate for the proposed TS changes that would discontinue credit for CRE auto-isolation using a high radiation signal from R-23.

2. The revised RAA assumes the CRE is isolated prior to movement of recently irradiated fuel assemblies (per new Note added to TS 3.7.10). In addition, the revised RAA credits manual initiation of the Control Room Post Accident Recirculation (CRPAR) system within 20 minutes of occurrence of a FAA.

1.0 Manual Action for the Locked Rotor Accident This proposed manual action would require operator action to isolate the CRE within one hour after initiation of an LRA. This manual action is required to compensate for the proposed TS changes that would discontinue credit for CRE auto-isolation using a high radiation signal from R-23. R-23 is a single channel non-safety related instrument, and therefore DEK has proposed not crediting this radiation monitor in the revised radiological analyses. The LRA scenario is described in Attachment 4, section 3.6.

Verification of successful action is provided in KPS Emergency Operating Procedure (EOP) E-0, Reactor Trip or Safety Injection. EOP E-0 provides direction regarding which status lights and annunciators will be illuminated if SI is actuated. In addition, verification of CRE isolation and CRPAR initiation is provided by observing status lights on the control board for the CRPAR fan and Control Room Air Conditioning (CRAC) fan.

If an automatic actuation of SI does not occur during this accident, the operators are directed to manually initiate both trains of SI once subcooling is lost. This action will isolate the CRE and start both CRPAR trains.

If the proposed manual action is accomplished within one hour of an LRA occurring, then control room doses will be maintained within the limits specified in 10 CFR 50.67.

2.0 Manual Actions for the Fuel Handling Accident This proposed manual action is based on the premise that upon initiation of a postulated FHA, the CRE will have been previously manually isolated in accordance with a

 Serial No. 11-025A Attachment 5 Page 2 of 19



proposed new Note in TS 3.7.10, Control Room Post Accident Recirculation (CRPAR)

System. The proposed new manual action consists of initiating one train of the CRPAR system within 20 minutes after the occurrence of a FHA. The revised FHA analysis is provided in Attachment 4, Section 3.3. The revised FHA analysis assumes that the CRE is isolated prior to moving recently irradiated fuel as required by TS 3.7.10. Upon occurrence of a FHA, the analysis assumes manual operator action to initiate one train of the CRPAR system. This manual operator action must be completed within 20 minutes following a FHA to ensure control room occupant dose remains within the limits specified in 10 CFR 50.67.

Control room operators would be promptly notified of a FHA by either of the following methods. These methods provide multiple and diverse means of alerting control room operators to the occurrence of a FHA.

1. KPS Procedure NF-KW-RRF-014, Fuel Movement During a Refueling Outage, requires direct communication be maintained between the control room and the containment operating floor whenever changes in core geometry are taking place.

This ensures that control room operators would be promptly alerted if an FHA event occurs.

2. The KPS Technical Requirements Manual (TRM) 8.9.4, Radiation Monitoring During Refueling Operations, requires continuous monitoring of radiation levels in the containment and spent fuel pool areas during refueling operations. TRM 8.9.4 is met by requiring radiation monitors R-2, R-5, R-12 and R-21 to be operating during refueling operations. Each of these radiation monitors alarms in the control room.

The proposed changes to TS 3.7.10 (see Attachment 1, Section 2.2.2) would require the CRE be isolated with no fresh air being supplied to the control room (outside air dampers closed and CRPAR fan off) during movement of recently irradiated fuel assemblies. In this configuration, the proposed manual action consists of initiating one train of the CRPAR system. One train of the CRPAR system is initiated by turning either the A (ES-46545) or B (ES-46546) control room hand switch for CRPAR Recirculation Fan to the ON position. Then, using control switch ES 40030 recirculation damper ACC3A is opened, or using control switch ES40031 recirculation damper ACC3B is opened, depending on which train is being started. Proper operation of the train would be verified by the operator using status lights on the control board for the CRPAR fan and CRAC fan. The revised RAA assumes one train of the filtration/recirculation system is placed in operation within 20 minutes of FHA initiation.

The proposed changes to TS 3.7.10 would require that the CRE be isolated with no fresh air being supplied to the control room (outside air dampers closed and CRPAR fan off) during movement of recently irradiated fuel assemblies. However, this TS can be modified with application of the existing TS 3.7.10 Note which permits the CRE boundary to be opened intermittently under administrative controls. In this less likely alignment, the manual action would consist of closing one outside air damper, in

 Serial No. 11-025A Attachment 5 Page 3 of 19



addition to initiating one train of the CRPAR system. In this configuration, the revised RAA assumes one train of the filtration/recirculation system is placed in operation within 20 minutes of FHA occurrence and the CRE is fully isolated.

In this configuration, the operator must release the control room switches for outside air dampers ACC-2 (ES-46827) and ACC-1A/1B (ES-46833) to perform the required alignment. To align fresh air to the control room with the CRPAR system operating (either train) requires the operator to hold the selector switch for ACC-1A/1B to the Normal (ACC-1A) or Alt (ACC-1B) position and hold the control switch for ACC-2 in the Open position. Since the operator is required to hold the switches in position, this configuration would be used sparingly and for short durations to provide fresh air to the control room. Therefore, this is considered an infrequent control room ventilation system configuration. Each of these control switches are spring return to Auto position and are interlocked to close the dampers when either CRPAR fan is running.

Therefore, when the operator releases the control switches, the CRE will return to the isolated configuration with at least one CRPAR fan running. No further actions would be required except to verify the correct alignment.

3.0 Acceptability of Proposed Manual Actions The NRC has provided guidance regarding the requirements for use of manual actions.

NRC RIS 2005-20, Revision 1, Section C.5 (reference 1), discusses the conditions under which temporary manual actions may be used in lieu of automatic actions in support of operability. NRC Information Notice (IN) 97-78 (reference 2) alerted licensees to the importance of considering the effects on human performance of such changes made to plant safety systems. Information Notice 97-78 states:

The original design of nuclear power plant safety systems and their ability to respond to design-basis accidents are described in licensees' FSARs [final safety analysis reports] and were reviewed and approved by the NRC. Most safety systems were designed to rely on automatic system actuation to ensure that the safety systems were capable of carrying out their intended functions. In a few cases, limited operator actions, when appropriately justified, were approved. Proposed changes that substitute manual action for automatic system actuation or that modify existing operator actions, including operator response times, previously reviewed and approved during the original licensing review of the plant will, in all likelihood, raise the possibility of an unreviewed safety question (USQ). Such changes must be evaluated under the criteria of 10 CFR 50.59 to determine whether a USQ is involved and whether NRC review and approval is required before implementation.... In the NRC staff's experience, many of the changes [involving operator actions] proposed by licensees do involve a USQ.

It is recognized that the NRC updated 10 CFR 50.59, to remove the USQ wording.

Nonetheless, the intent of IN 97-78 is still pertinent. That is, licensees still need to

 Serial No. 11-025A Attachment 5 Page 4 of 19



submit many of the changes in operator actions to the NRC for review and approval in accordance with 10 CFR 50.59.

The guidance presented in NUREG-1764 (reference 3) can be used to address safety-related operator actions (SROAs), as well as other required operator actions. The American National Standards Institute/American Nuclear Society defines "safety-related operator action" in ANSI/ANS-58.8-1994, as follows:

A manual action required by plant emergency procedures that is necessary to cause a safety-related system to perform its safety-related function during the course of any DBE (design-basis event). The successful performance of a safety-related operator action might require that discrete manipulations be performed in a specific order.

Per NUREG-1764 changes in human actions (HAs) (synonymous with the term operator actions) result from the following types of plant activities:

x Plant modifications.

x Procedure changes.

x Equipment failures.

x Justifications for continued operations (JCOs)1.

x Identified discrepancies in equipment performance or safety analyses.

NUREG-1764 provides guidance for the review of human actions. This document provides guidance for use in determining the appropriate level of human factors engineering (HFE) review of HAs based upon their risk-importance. This guidance uses a graded, risk-informed (RI) approach consistent with RG 1.174, Rev. 1 (reference 4).

This guidance uses a two-phased approach to reviewing HAs. Phase 1 is a risk screening and analysis of the affected HAs identified to determine their risk-importance and the level of HFE review that is appropriate in Phase 2. Phase 2 is an HFE review of those HAs that are found to be risk-important.

3.1. Phase I - Risk Screening KPS has elected to provide this application using non-risk informed (non-RI) analysis techniques. The non-RI screening process consists of the following steps:

1. Verify that the non-RI change request is appropriate.

2. Assess safety-significance of the HAs.

3. Qualitatively assess the safety-significance of HAs involved in the change request.

1 NOTE: The term JCO is no longer recognized by the NRC as valid. Per RIS 2005-20 (reference 29),

An SSC that is determined to be operable but degraded or nonconforming is considered to be in compliance with its TS LCO, and the operability determination is the basis for continued operation.

 Serial No. 11-025A Attachment 5 Page 5 of 19



4. Make an integrated assessment of HA safety-significance to determine the appropriate level of HFE review (i.e., Level 1, 2, or 3).

The assessment of these four steps is provided below. Requirements are in normal text and responses are provided in italics text.

1. The non-RI change request is appropriate NUREG-0800 (SRP) Chapter 19.2, (reference 5), Appendix D addresses the use of risk information in reviewing requests containing manual actions in non-RI license amendments. In accordance with the guidance, the risk implications of a non-RI submittal would warrant further risk informed analysis if the submittal:

x Significantly changes the allowed outage time (e.g., outside the range previously approved at similar plants), the probability of the initiating event, the probability of successful mitigative action, the functional recovery time, or the operator action requirement; Response: There is no significant change to allowed outage time. The proposed manual actions are limited to the response to the FHA and LRA. There is no change to the allowed outage time of any equipment designed to mitigate these accidents. DEK is proposing new TS requirements to isolate the control room prior to movement of recently irradiated fuel assemblies. This new requirement simplifies the necessary manual action in the event of a fuel handling accident.

Furthermore, the manual actions proposed do not change the probability of any initiating event or the probability of successful mitigation of events as discussed in Attachment 4. Finally, the proposed operator actions do not change the functional recovery time of any other accident scenario or change other operator actions required to recover from another accident.

x Significantly changes functional requirements or redundancy; Response: The proposed manual actions do not significantly change functional requirements or redundancy. Operation of the CRPAR system is required for radiological accidents and a CRE isolation is assumed. The proposed manual actions do not change the system operation. CRPAR system starting, filtering and redundancy requirements are not changed. CRE isolation redundancy requirements have not changed. There is no change in redundancy as both CRPAR trains are still required to be operable as well as the CRE per the proposed TS changes. Therefore, there is no change in the functional requirements or redundancy for the CRPAR system and CRE isolation.

x Significantly changes operations that affect the likelihood of undiscovered failures;

 Serial No. 11-025A Attachment 5 Page 6 of 19



Response: The proposed operator action does not significantly change operations that affect the likelihood of undiscovered failures. Failures of the CRPAR system or dampers to isolate are indicated by lights in the control room. Therefore, operators will be made aware of a failure of the CRPAR system or CRE through these lights. The manual actions proposed herein would not mask or hide any undiscovered failures of the CRPAR system or the CRE.

x Significantly affects the basis for successful safety function; Response: The KPS current licensing bases (CLB) relied on a non-redundant, non-safety related radiation monitor to initiate the CRPAR system and perform a partial CRE isolation. The proposed manual action relies upon redundant, safety related control switches for CRPAR initiation and CRE isolation prior to movement of recently irradiated fuel assemblies. The functionality of the CRPAR system is not changed and the safety function is enhanced by complete CRE pre-isolation.

x Could create special circumstances under which compliance with existing regulations may not produce the intended or expected level of safety and plant operation may pose an undue risk to public health and safety.

Response: No special circumstances are present in this application. There is no substantial increase in the likelihood or consequences of accidents that are beyond the design and licensing basis for KPS. There is no change in the levels of defense or cornerstones of reactor safety with this application. The proposed change does not significantly reduce the availability, or reliability of structures, systems, components or other human actions that are risk significant but are not required by regulations. Finally, the proposed change does not involve a change for which synergistic or cumulative effects could significantly impact risk.

The proposed HAs are simple and effective and are not subject to potential impacts of "special circumstances."

2. Assess the safety significance of the HAs NUREG-1764 discusses two methods for determining the safety-significance of HAs.

The first method, the Estimated Importance Method, requires an estimate of the risk-importance of the HA. The second, the Generic HA Method is based upon general risk information and some plant-specific information.

DEK has performed a safety significance review based on the Estimated Importance Method. This method was selected as the most appropriate based on the limited information in the KPS PRA regarding the proposed operator actions. This assessment is as follows:

Estimated Importance Method - Preliminary Screening

 Serial No. 11-025A Attachment 5 Page 7 of 19



The Locked Rotor Accident (LRA) is a Condition IV event, which means it is not expected to occur during the life of the plant. It is included in the General Transient category in the KPS PRA, which is standard practice among U.S. plants. The LRA is a core damage concern only if the reactor fails to trip. However, fuel damage is assumed in the LRA even with a reactor trip. The LRA with successful reactor trip is documented in the USAR as affecting only a small portion of the core. Note: The USAR Section 14 LRA does credit reactor trip on low flow AND assumes some fuel failure up to 25% of the fuel rods. Core damage for probabilistic risk assessment purposes is defined as uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage are anticipated and involving enough of the core, if released, to result in offsite public health effects (RG 1.200). Since an LRA causes damage to only a fraction of the core rather than the majority of the core (i.e. complete core uncovery), it does not meet that definition. The combined probability of an LRA with a failure of the reactor to trip is low enough that it is not modeled in probabilistic risk assessments (PRAs). Therefore, the operator action to initiate safety injection after an LRA is not modeled in the PRA and is preliminarily screened as Level III.

The Fuel Handling Accident (FHA) results in clad damage to only one fuel assembly.

Since a FHA results in only clad damage rather than fuel damage and affects only one fuel assembly rather than the entire core, it does not meet the definition of core damage. Therefore, the operator action to place control room ventilation in post-accident recirculation mode after a FHA is not modeled in the PRA and is preliminarily screened as Level III.

3. Qualitatively assess the safety-significance of HAs Three types of qualitative assessment are used:

a. Personnel Functions and Tasks

b. Design Support for Task Performance

c. Performance Shaping Factors Three types of assessments are discussed as follows:

a. Personnel Functions and Tasks This type of qualitative assessment examines the potential effects of the proposed HA for changes to operator tasks and the functions that they perform, under five major categories:

x Operating Experience: Does the requested change adversely affect the performance of an action that was previously identified as problematic based on experience/events at that plant or plants of similar design?

 Serial No. 11-025A Attachment 5 Page 8 of 19



Response: No, the requested change does not adversely affect the performance of an action that was previously identified as problematic.

Currently, there are no required actions associated with CRPAR performance or CRE isolation. Routine operator actions associated with CRPAR operation (verifying lights, verifying annunciators, damper position, etc.) are not impacted by the proposed manual operator actions. Manual initiation of SI during a LRA with fuel damage is already a required action to prevent loss of subcooling to the core. This manual action is not changed.

x New Actions: Does the requested change introduce new HAs? Are the new HAs associated with new responsibilities for the success of safety functions (or additional actions associated with existing responsibilities)?

Response: Yes, the change does introduce new HAs. The proposed HAs are associated with success of the safety function for protection of the control room occupants. For the FHA, the safety function associated with the HA is initiation of at least one train of the CRPAR system. The proposed HA supports long-term operation of KPS during and after a FHA by ensuring that control room occupants are exposed to as low a radiological dose as possible. For the LRA, the safety function associated with the HA is manual initiation of SI, which causes isolation of the CRE and initiation of the CRPAR system. The proposed HA supports long-term operation of KPS during and after a LRA by ensuring that control room occupants are exposed to as low a radiological dose as possible.

x Change in Automation: Has the requested change given personnel a new functional responsibility that they previously did not have and which differs from their normal responsibilities? For example, are operators now required to take an action in place of a previously automated one? Consider the example of simply being required to open a valve that previously was automatically operated, and where the action required to do so is similar to other valve-opening operations with which operators are familiar. This would not be a sufficient change (in and of itself) to warrant a "yes" to this question when considering task complexity. However, there may be increased workload if the aggregate of added actions is judged to be excessive, this may warrant a "yes."

Response: No, while new tasks are required as discussed above, the example in this question is directly applicable to the proposed HA. The HA for the FHA is simply to turn control room hand switches associated with CRPAR system.

This act is similar to the example of opening a valve that was previously automated. Operators are familiar with this type of action and routinely perform similar actions. This action is not complex and would be associated only with a FHA. For the LRA with fuel damage, the proposed HA is to manually initiate push buttons associated with Safety Injection. This is an action already

 Serial No. 11-025A Attachment 5 Page 9 of 19



required for loss of subcooling, and is therefore not a new action to the operators. Therefore, the proposed HAs are not excessive and are considered a minor increase in the workload for these events.

x Change in Tasks: Has the requested change significantly modified the way in which personnel perform their tasks (e.g., making them more complex, significantly reducing the time available to perform the action, increasing the operator workload, changing the operator role from primarily "verifier" to primarily "actor")? In this case, operators do not have a new functional responsibility; instead, the way that they perform their current functional responsibilities has significantly changed and is different from what they usually do.

Response: The proposed HAs do not significantly change the way in which operators perform their tasks. As described above, operators routinely monitor the control room indications and plant status during and after an event.

Initiation of one train of the CRPAR system is not complex and is consistent with the operators role during an event. In addition, for the LRA with fuel damage, an expected response of the operator is to manually initiate SI upon a loss of subcooling.

As discussed in Section 2.0, one train of the CRPAR system must be initiated within 20 minutes for the FHA event. The CRE is required by TS 3.7.10 to be isolated prior to moving recently irradiated fuel assemblies. As discussed in Section 1.0, at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is available from the initiation of an LRA before the HA is required to be completed. The HA consists of manually depressing SI signal push buttons, which causes isolation the CRE and initiation of the CRPAR system. Once these HAs are complete, the control room occupants will be provided protection during the FHA and LRA. Therefore, there is no significant new functional responsibility or significant change in responsibilities for operators during these events.

x Change in Performance Context: Has the requested changed created, in some way, a new context for task performance? Or, does the change identify a previously unrecognized context? Or, does the request address a context previously not modeled or considered? If so, what are the important differences in context (e.g., different plant mode, plant behavior, timing of plant symptoms)?

Response: The proposed HAs will not create or modify the context for task performance. As described above, the proposed HAs would be performed after occurrence of a FHA or LRA event. The context of performing HAs during an accident scenario is a function that is required to be understood by operators in their training for accident response. Therefore, the context is expected and has not changed.

 Serial No. 11-025A Attachment 5 Page 10 of 19



b. Design Support for Task Performance This type of qualitative assessment addresses how well the performance of the HAs is supported (e.g., with job aids):

x Change in Human-System Interfaces (HSIs): Has the requested change significantly changed the HSIs used by personnel to perform the task? For example, are personnel now performing their tasks at a computer terminal where previously they were performed at a control board with analog displays and controls?

Response: The proposed HAs would not change any HSIs. The proposed HAs require manipulation of controls that are known to the operators. No new controls or human-system interfaces are proposed. The proposed HAs are simple and routine for operators.

x Change in Procedures: Has the requested change significantly changed the procedures that personnel use to perform the task, or is the task not supported by procedures?

Response: A significant change to the procedures that operators use to perform the proposed HAs is not necessary. For the LRA with fuel damage, plant emergency procedures currently require manual initiation of SI if a loss of subcooling occurs. For the FHA, the manipulation of CRPAR system switches will be directed by station operating procedures as part of implementation of this amendment.

x Change in Training: Has the requested change significantly modified the training, or is the task not addressed in training?

Response: The proposed HAs have been provided to operators in training.

For the LRA with fuel damage, plant emergency procedures currently require manual initiation of SI if a loss of subcooling occurs. Operator training requires the operator to memorize this step. For the FHA, the initiation of one train of CRPAR system is provided in training and the reasons/basis for performing this HA is discussed in training.

c. Performance Shaping Factors This type of qualitative assessment addresses four performance shaping factors:

x Changes in Teamwork: Has the requested change significantly changed the team aspects of performing an action. For example, (1) is one operator now performing the tasks accomplished by two or more operators in the past? (2) is

 Serial No. 11-025A Attachment 5 Page 11 of 19



it now more difficult to coordinate the actions of individual crew members? or, (3) is task performance more difficult to supervise after the modification?

Response: No changes in teamwork are required. No additional operators are required in the control room to perform the proposed HAs. There is no greater level of difficulty and no increase in the level of supervision necessary to accomplish proposed HAs. Manipulation of control room switches is a routine evolution for operators, and no additional level of supervision is required.

x Changes in Skill Level of Individuals Performing the Action: Has the requested change kept the same HA but made it necessary for an individual who is less trained and has lower qualifications to take the action than was the case before the modification? Here, context is defined as the overall performance environment, including plant conditions and behavior that, for example, affect the time available for the operator response and the effectiveness of job aids under these conditions that lead to the assessment of performance shaping factors.

Response: The skill level of the operator performing the proposed HAs and the performance environment for the operator will not change. For the LRA with fuel damage, the procedural requirement to initiate SI is required to be memorized by operators. This has not changed. For the FHA, initiation of one train of the CRPAR system via hand switches is a routine type task. Job aids consist of control switch identification placards on the control boards and understanding when the SI manual push buttons and CRPAR system switches need to be initiated. These are simple routine tasks for operators and do not require new skills or additional training to accomplish.

x Change in Communication Demands: Has the requested change significantly increased the level of communication needed to perform the task? For example, must an operator now communicate with other personnel to perform actions that previously could be taken at a local panel containing all necessary HSIs?

Response: The proposed HAs do not require significantly increased levels of communication to accomplish. Direction communicated by the unit supervisor during an event is considered a routine communication. Accomplishment of the proposed HAs is easily verified by lights and annunciators in the control room.

In addition, operators are accustomed to working in pairs for peer checking and independent verification of system alignments.

x Change in Environmental Conditions: Has the requested change significantly increased the environmental challenges (such as radiation, or noise) that could negatively affect task performance?

 Serial No. 11-025A Attachment 5 Page 12 of 19



Response: No, the operator will be performing the proposed HAs to ensure the CRE does not become a high radiation environment. There is no change in noise level associated with the proposed manual actions as these are the dampers and systems that normally provide air to the control room.

4. Make an integrated assessment of HA Safety-Significance The results of the qualitative assessment of HA Safety Significance have determined that the action is well defined and can easily be performed (it is clear when to perform the action), procedural direction exists, there is sufficient time and staff available to perform the action, and the action is similar to those routinely performed. Based on this, the level of HF review could be reduced to Level III. The Level III classification is warranted since most of the areas reviewed were answered no and the analysis indicates very little change is being made.

However, since the action involves support of a safety function and failure to accomplish the proposed HAs could potentially result in the loss of a high risk component (loss of the control room, via high radiation dose, is a PRA initiating event),

the level classification will conservatively remain at Level II.

3.2. Phase II - HFE Review of Proposed HA using Level II Review Criteria Based on the results of the Phase I Risk Screening provided above, DEK has conservatively determined that the proposed HAs will be assessed using the Level II criteria identified in Section 4 of NUREG-1764. NUREG-1764 specifies that a Level II review include the following elements:

1. General Deterministic Review

2. Analysis

3. Design of Human System-Interfaces, Procedures and Training

4. Human Action Verification These four elements are assessed below:

1. General Deterministic Review Criteria Objective: The objective of this section is to verify that deterministic aspects of design, as discussed in RG 1.174, have been appropriately considered by the licensee. Deterministic aspects include verifying that the change meets current regulations and does not compromise defense-in-depth.

Scope: The deterministic review criteria are applicable to all modifications associated with Level II HAs.

Criteria:

 Serial No. 11-025A Attachment 5 Page 13 of 19



1) The licensee should provide adequate assurance that the change meets current regulations, except where specific exemptions are requested under 10 CFR 50.12 or 10 CFR 2.802. Examples of regulations that may be affected by a change, but that may be identified as risk-significant when using a standard PRA to screen for risk include the following: 10 CFR Part 20, Criterion 19 of Appendix A to 10 CFR Part 50, and Appendices C through R to 10 CFR Part 50.

Response: See discussions located in Attachment 1 and Attachment 4 related to compliance with regulations and conformance to accident analyses criteria.

See section 5.2 for a discussion of compliance with General Design Criteria applicable to KPS.

2) The licensee should provide adequate assurance that the change does not compromise defense-in-depth:

Response: Defense-in-depth is one of the fundamental principles upon which KPS was designed and built. Defense-in-depth uses multiple means to accomplish safety functions and to prevent the release of radioactive materials.

It is important in accounting for uncertainties in equipment and human performance, and for ensuring some protection remains even in the face of significant breakdowns in particular areas.

Defense-in-depth is not compromised or altered as a result of the proposed HAs. Defense-in-depth is accomplished in this particular case by having multiple reliable methods to contain highly radioactive materials during a design bases accident. The containment structure, shield building ventilation system, and auxiliary building special ventilation system all minimize the release or act upon the release of highly radioactive materials should barriers fail. Each of these systems has the goal of protecting the health and safety of the public and the control room occupants during an event. The proposed HAs ensure that the CRE is isolated and a filtered source of air is available for the control room occupants. This function is not compromised by performance of the proposed HAs.

The proposed HAs do not lead to an over-reliance on programmatic activities to compensate for weaknesses in plant design. System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

The proposed HAs preserve defenses against potential common cause failures, and there is no potential for the introduction of a new common cause failure mechanism. The proposed HAs include initiation of an SI signal which causes

 Serial No. 11-025A Attachment 5 Page 14 of 19



actuation of the CRPAR system. Therefore, the independence of barriers is not compromised. Defenses against human errors are preserved because the proposed HAs are included in procedures and are included in operator training.

Human errors, should they occur, are easily detectable by control room annunciators and equipment status lights.

2. Analysis Objective: The objective of the review is to verify that the licensee has analyzed the changes to HAs and identified HFE inputs for any modifications to the HSI, procedures, and training that may be necessary.

Scope: The review criteria are applicable to all modifications associated with Level II HAs.

Criteria:

1) Functional and Task Analysis The licensee should identify how the personnel will know when the HA is necessary, that it is performed correctly, and when it can be terminated.

Response: The need for performing the proposed HA associated with the LRA will be identified by multiple alarm conditions. The following conditions indicate the need for operator action during a LRA event (details are provided in section

3.6.1 above)

x A sudden decrease in core coolant flow which results in fuel damage as indicated by the RCS subcooling monitor (loss of sufficient cooling to the fuel).

x Upon indication of loss of subcooling, operators enter emergency operations procedures and initiate SI based on loss of subcooling.

x Initiation of an SI signal causes isolation of CRE dampers and initiation of the CRPAR system.

Indication of correct performance of this proposed HA is made by verifying that the train of SI selected to respond to the LRA is functioning by observing that the indicating lights associated with the selected control switch change color from green (Standby) to red (On). In addition, the train of CRPAR automatically selected by association with the selected SI train for the mitigation of a LRA is verified to be functioning by observing that indicating lights associated with the selected control switch change color from green (Standby) to red (On) and verifying that the associated CRAC fan automatically starts by observing the indicator light for this fan is red (On). Finally, the CRE boundary is verified to

 Serial No. 11-025A Attachment 5 Page 15 of 19



be intact by observing indication of damper positions in the closed position.

This can be done by observing indications on damper control switches.

Termination of CRPAR operation is not necessary until radiation conditions return to normal background levels, indicating that a radioactive release is no longer occurring.

The following conditions indicate the need for operator action during a FHA:

x Verbal communication from personnel on the containment operating floor or spent fuel pool area that indicates a FHA has occurred.

x High radiation alarm indicated on R-2, R-5, R-12 or R-21 indicates a FHA in containment or the spent fuel pool area has occurred.

Indication of correct performance of the proposed HA is made by verifying that the train of CRPAR selected for the mitigation of a FHA is functioning. This is done by observing that the indicating lights associated with the selected control switch change color from green (Standby) to red (On) and verifying that the associated CRAC fan automatically starts by observing the indicating light is red (On). The CRE boundary would have previously been verified to be intact by observing indication of damper positions in the closed position prior to moving recently irradiated fuel.

Termination of CRPAR operation is not necessary until radiological conditions return to normal background levels, indicating that a radioactive release is no longer occurring.

Task analyses should provide a description of what the personnel must do.

The licensee should identify how human tasks or performance requirements are being changed. The task analysis should identify reasonable or credible, potential errors and their consequences.

Response: Refer to Sections 1.0 and 2.0 for a detailed description of the proposed HAs. The proposed HAs are only required for the LRA and the FHA.

LRA There are a limited number of credible failures or errors that the operator can make during the LRA event. As shown above, proposed HA is not complex

 Serial No. 11-025A Attachment 5 Page 16 of 19



(only requires manipulation of the manual SI push buttons) and requires little effort to complete. However, human errors do occur and the proposed HA accounts for the consequences of such errors. For example, if an operator fails to initiate SI, then multiple alarms indicating high radiation conditions may occur at various locations (e.g. R-9, R-11, R-12, or R-21). If the SI signal fails to isolate the control room, then the alarm from control room radiation monitor R-1 will not clear without some action being taken. As a backup, R-23 (although not credited in the radiological accident analyses) is still functional and will actuate on a high radiation condition. Similarly, if the SI signal does not start the associated train of CRPAR, then a high radiation condition will continue to persist until the control room operator manually starts a train.

FHA There are a limited number of credible failures or errors that the operator can make during the manipulations. As shown above, the proposed HA is not complex and requires little effort to complete. However, human errors do occur and the proposed HA accounts for the consequences of such errors. For example, if an operator fails initiate the CRPAR system, then the alarm from radiation monitor R-1 will not clear without some action being taken. As a backup, R-23 (although not credited in the analyses is still functional) will actuate on a high radiation condition.

If the operator incorrectly manipulates the wrong control room switches, the most likely outcome will be that the CRPAR system will not be initiated and high radiation alarms in the control room would continue. This would alert the operator that the incorrect switch was manipulated and could be corrected immediately.

2) Staffing:

The effects of the changes in HAs upon the number and qualifications of current staffing levels of operations personnel for normal and minimal staffing conditions.

Response: is the proposed HAs would have no effect on the number and qualifications of operations personnel required to support operations in a post-event condition. It is routine for operators to monitor control room conditions and verify proper operation of equipment in the control room.

3. Design of Human System-Interfaces, Procedures, and Training Objective: The objective of the review is to verify that the licensee has supported the HAs by appropriate modifications to the HSI, procedures, and training.

 Serial No. 11-025A Attachment 5 Page 17 of 19



Scope: The review criteria are applicable to all modifications associated with Level II HAs.

Criteria:

1) HSIs:

Temporary and permanent modifications to the HSI should be identified and described. The modifications should be based on task requirements, HFE guidelines, and resolution of any known operating experience issues.

Response: No HSI modifications or new HSIs are required. The proposed HAs are simple and control room switches and push buttons are well marked.

2) Procedures:

Temporary and permanent modifications to plant procedures should be identified and described. The modifications should be based on task requirements and resolution of any known operating experience issues.

Justification should be provided when the plant procedures are not modified for changes in operator tasks.

Response: The appropriate modifications to plant procedures will be made as part of the implementation of this amendment request.

3) Training:

Temporary and permanent modifications to the operator training program should be identified and described. The modifications should be based on task requirements and resolution of operating experience issues. Justification should be provided when the training program is not modified for changes in operator tasks.

Response: Training lesson plans will be revised to incorporate the bases for performing the proposed HAs contingent upon approval of this amendment request. The requirements of the training will be developed using the process specified in DEK training development procedures.

4. Human Action Verification Objective: The objective of this review is to verify that the licensee has demonstrated that the HAs can be successfully accomplished with the modified HSI, procedures, and training.

 Serial No. 11-025A Attachment 5 Page 18 of 19



Scope: The review criteria are applicable to all modifications associated with Level II HAs.

Criteria:

1) An evaluation should be conducted at the actual HSI to determine that all required HSI components, as identified by the task analysis, are available and accessible.

Response: DEK has performed a walkdown of the control room and has verified that components required to perform the proposed HAs are accessible and available to the operator.

2) A walkthrough of the HAs under realistic conditions should be performed to determine that; x The procedures are complete, technically accurate, and usable.

x The training program appropriately addressed the changes in plant systems and HAs.

The HAs can be completed within the time criterion for each scenario that is applicable to the HAs. The scenario used should include any complicating factors that are expected to affect the crews' ability to perform the HAs.

Response: As part of the walkdown described above, DEK developed and verified the procedures to be used as guidance to the operators for performing the proposed HAs. The procedures are used during the training of the operators to achieve a simulated performance of operator actions during training sessions.

3) The walkthroughs should include at least one crew of actual operators.

Response: Operations personnel were included in the walkdown of the control room.

4.0 Conclusions This evaluation has demonstrated that the proposed HAs are acceptable. The Phase I Risk Screening (Section 3.1) demonstrated that the safety significance of the proposed HAs is minimal and warranted only a Level III Human Factor review. However, since the proposed HAs involved action that support a safety function, and failure to perform

 Serial No. 11-025A Attachment 5 Page 19 of 19



the proposed HAs could potentially result in the loss of a high risk component (a PRA initiating event), the classification level was conservatively left at Level II for the purposes of reviewing the HAs.

The results of the HFE review of the proposed HAs have determined that the four elements of the HFE review have been satisfied without identifying any obstacles to implementation. All the HFE elements of a Level II review were satisfied including:

x The technical review provides adequate assurance that the proposed HAs meet current regulations.

x The proposed HAs have been analyzed for their impact on current procedures, control room staffing, human system interfaces, and training.

x The proposed HAs are captured in procedures and in training.

x It has been demonstrated that the proposed HAs can be accomplished with the procedures and training provided.

5.0 References

1. RIS 2005-20, Revision 1, Revision to NRC Inspection Manual Part 9900 Technical Guidance, Operability Determination & Functional Assessments for Resolution of Degraded and Nonconforming Conditions Adverse to Quality or Safety, dated April 16, 2008.

2. Information Notice 97-78, Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times, dated October 23, 1997.

3. NUREG-1764, Revision 1, Guidance for the Review of Changes to Human Actions, dated January 2005.

4. Regulatory Guide 1.174, Revision 1, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, dated November 2002. [ADAMS Accession No. ML023240437]

5. NUREG-0800, Standard Review Plan, Chapter 19.2, Review of Risk Information Used to Support Permanent Plant Specific Changes to the Licensing Basis:

General Guidance, dated June 2007. [ADAMS Accession No. ML071700658]