L-15-118, Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805

Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805

ML15118A484
Person / Time
Site:	Beaver Valley
Issue date:	04/27/2015
From:	Emily Larson FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-15-118, TAC MF3301, TAC MF3302
Download: ML15118A484 (70)

Text

Beaver Valley Power Station P.O. Box 4

~ Shippingport, PA 15077 RrstEnergy Nuclear Operating Company Eric A. Larson 724-682-5234 Site Vice President Fax: 724-643-8069 April 27, 2015 L-15-118 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Beaver Valley Power Station, Unit Nos. 1 and 2 Docket No. 50-334, License No. DPR-66 Docket No. 50-412, License No. NPF-73 Response to Request for Additional Information Regarding License Amendment Request to Adopt National Fire Protection Association Standard 805 (TAC Nos. MF3301 and MF3302)

By letter dated December 23, 2013 (Agencywide Documents Access and Management System [ADAMS] Accession No. ML14002A086), as supplemented by letter dated February 14, 2014 (ADAMS Accession No. ML14051A499), FirstEnergy Nuclear Operating Company (FENOC) submitted a license amendment request to change the Beaver Valley Power Station, Unit Nos. 1 and 2 fire protection program to one based on the National Fire Protection Association Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition.

The Nuclear Regulatory Commission (NRC) requested additional information in a letter dated March 4, 2015 to complete its review of the license amendment request (ADAMS Accession No. ML15049A507).

In accordance with Enclosure 2 to the March 4, 2015 letter, the FENOC response due within 60 days is attached. The remaining responses due within 90 and 120 days will follow. The probabilistic risk assessment (PRA) model will be updated at the conclusion of these responses to answer PRA questions 3 and 19. A supplement to the license amendment request with the changes described in the responses will then be submitted.

There are no regulatory commitments included in this submittal. If there are any questions or if additional information is required, please contact Mr. Thomas A Lentz, Manager- Fleet Licensing, at (330) 315-6810.

Beaver Valley Power Station, Unit Nos. 1 and 2 L-15-118 Page 2 I declare under penalty of perjury that the foregoing is true and correct. Executed on April ) 7-, 2015.

Sincerely, Eric A. Larson

Attachment:

Response to Request for Additional Information cc: Regional Administrator, NRC Region I NRC Resident Inspector NRC Project Manager Director BRP/DEP Site BRP/DEP Representative

Attachment L-15-118 Response to Request for Additional Information Page 1 of68 The Nuclear Regulatory Commission (NRC) staff provided a request for additional information (RAI) in a letter dated March 4, 2015 (Agencywide Documents Access and Management System [ADAMS] Accession No. ML15049A507) to complete its review of the FirstEnergy Nuclear Operating Company (FENOC) Beaver Valley Power Station, Unit No. 1 (BVPS-1) and Unit No.2 (BVPS-2) license amendment request (LAR). This LAR is to change the fire protection program to one based on the National Fire Protection Association (NFPA) Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition. The NRC staffs RAI questions are provided below in bold text followed by the corresponding FENOC response.

Fire Protection Engineering (FPE} Request for Additional Information (RAJ} 03 The compliance basis in LAR Attachment A, Table B-1 for NFPA 805, Section 3.6.4, regarding standpipe and hose stations states "Complies with Clarification."

However, LAR Table 5-3 states compliance with NFPA 805, Section 3.6.4 is "via previous approval." Provide a clarification as to which compliance strategy is correct and revise the LAR as necessary.

Response

The NRC accepted the BVPS interior hose configurations in Section 4.3.1.4 of "SER

[Safety Evaluation Report] by the Office of Nuclear Reactor Regulation Related to Amendment No. 18 to Facility Operating License No. DPR-66" dated June 6, 1979.

4.3.1.4 Interior Hose Stations Interior hose stations are provided throughout the turbine building, service building, primary auxiliary building and the intake structure. Hose stations are not provided in the safeguards area, diesel generator cubicles, and safety-related portions of the sector cubicles, and safety-related portions of the service building ....

We find that, ... , the interior fire hose stations satisfy the objectives identified in Section 2.2 of this report and are, therefore, acceptable.

The interior hose station configurations have not changed since approval in the SER.

Therefore, the approval still applies and remains valid.

In addition, Regulatory Information Notice (RIN) 3150-AG48 (included in Federal Register Vol. 69, No. 115,) that promulgated adoption of NFPA 805 states:,

Attachment L-15-118 Page 2 of68 A commenter noted that Appendix A to BTP APCSB 9.5-1 did not require seismically qualified standpipes and hose stations for operating plants and plants with construction permits issued prior to July 1, 1976. NRC agrees that Appendix A to BTP [Branch Technical Position] ABCSB 9.5-1 made separate provisions for operating plants and plants with construction permits issued prior to July 1, 1976, and did not require seismically qualified standpipes and hose stations for those plants. Therefore, the requirement in Section 3.6.4 of NFPA 805 is not applicable to licensees with nonseismic standpipes and hose stations previously in accordance with Appendix A to BTP APCSB 9.5-1.

BVPS received the construction permit prior to July 1, 1976; therefore, seismically qualified standpipes and hose stations are not required, per the RIN.

BVPS-1 complies by prior approval with the provisions of NFPA 805 Section 3.6.4. LAR Table 5-3 correctly indicates the compliance strategy, "via previous approval." A revision to LAR Attachment A, Table 8-1 to indicate the correct compliance strategy will be provided in a future transmittal.

FPE RAI 05 LAR Attachment A, Table B-1 uses the compliance strategy "Complies with Clarification" on numerous attributes. The NRC endorsed guidance in NEI 04-02, Section 4.3.1, Revision 2, describes this clarification strategy as items that are not in "literal compliance" with NFPA 805 but should be transitioned. The example given in NEI 04-02 illustrates this strategy is applied in circumstances such as compliance methods that could be considered editorial in nature. There are numerous applications of this compliance strategy in LAR Table B-1 that are not considered by the NRC staff to be of the same nature as an editorial clarification, such as described in NEI 04-02.

a} Provide a more suitable compliance strategy or additional justification for applying the "complies with clarification" strategy for the following attributes based on the issues identified:

vii. The compliance basis for NFPA 805, Section 3.8.2, in LAR Attachment A, Table B-1, identifies "Complies with Clarification" in numerous fire areas (e.g., 2-PA-3, 2-SG-1N, 2-SG-1S, and 2-PT-1}. NFPA 805, Section 3.8.2 requires that fire detection be installed in accordance with NFPA 72, "National Fire Alarm Code," and its applicable appendixes. The licensee appears to justify code non-compliances with evaluations of individual compartment conditions such as "no fire hazard." Use of evaluations to justify deviations from code requirements are not considered clarifications.

Attachment L-15-118 Page 3 of68

Response

The compliance basis for NFPA 805, Section 3.8.2 in LAR Attachment A, Table B-1, for the fire compartments listed below will be changed to compliance with existing engineering equivalency evaluation (EEEE), or "Complies with EEEE."

Fire Compartment 2-PA-3 Fire Compartment 2-PT-1 Fire Compartment 2-SG-1 N Fire Compartment 2-SG-1 S The response to FPE RAis 01 (a), (b), and (c) will document the revised "Complies with EEEE" records and LAR Attachment A, Table B-1 will be updated.

FPE RAI 05 a) Provide a more suitable compliance strategy or additional justification for applying the "complies with clarification" strategy for the following attributes based on the issues identified:

viii. The compliance basis for NFPA 805, Section 3.9.4, in LAR Attachment A, Table B-1, identifies an SER, and LAR Attachment T clarification as prior approval of that configuration. This appears to be compliance based on previous NRC approval and not a clarification.

Response

The following excerpts are provided to show compliance by prior NRC approval.

The June 6, 1979, BVPS-1 SER, Section 5.13, "Intake Structure," subsection 5.13.3, "Consequences if No Fire Suppression," states:

An unmitigated fire in the intake structure would not result in compromising safe shutdown capability because of the separation and barriers between redundant safety-related equipment. The river water pumps are located in separate compartments and cabling is in conduit. A separate alternate water intake structure with redundant river water pumps is provided 1800 feet away.

Because of the curbing at the diesel day tank and the trench to the diesel engine, a leak from the tank or supply lines would not spread to other areas.

The June 6, 1979, BVPS-1 SER, Section 5.13, "Intake Structure," subsection 5.13-6, "Modifications," also states:

Attachment L-15-118 Page 4 of68 The licensee will remove all unnecessary combustibles from the intake structure and will allow only fire retardant treated lumber to be used within the building.

The licensee will also provide automatic fire detectors in the safety-related pump compartments IS-1, IS-2 and IS-3 arranged to alarm in the control room.

We find that, upon implementation of the above described modifications, the Intake Structure fire protection satisfies the objectives identified in Section 2.2 of this report and is, therefore, acceptable.

In a letter from Duquesne Light Company to the NRC dated October 27, 1976, a response to Branch Technical Position (BTP) 9.5.1 Position IV C.2.c states:

The source of water for fire protection is the Ohio River. Heated fire pump rooms are located in the Intake Structure.... The pumps are located in separate seismic Class I cubicles with walls in excess of three hour fire rating.

The presence of the fire pumps located in the intake structure was reiterated in the BVPS-2 NUREG 1057, "Safety Evaluation Report related to the operation of Beaver Valley Power Station," Unit No. 2, Docket No. 50-412, dated May 1987, Section 9.5.1.5 that states in part ....

The fire pumps are located in the intake structure and are separated by 3-hour fire-rated barriers.

Based on the above, the fire detection systems are installed and are credited for transitioning as listed in LAR Table 4-3 and in LAR Attachment A2, Section 3.8.2 records for compartments 3-IS-1, 3-IS-2, and 3-IS-3.

In addition, the requirement in NFPA 805 Section 3.9.4 for suppression over an engine driven fire pump is a new requirement and is not a requirement of construction prior to the issuance of Appendix A to BTP APCSB 9.5-1 or a requirement in the BVPS 1970 NFPA 20, "Centrifugal Fire Pumps," code of record.

Based on the above excerpts, the compliance statement should be "Complies by Prior Approval." LAR Attachment A, Table B-1 section 3.9.4, will be revised to reflect this change. Additionally, LAR Attachment T- Prior Approval Clarification Request No. 15 will be withdrawn, and LAR Attachment K- Licensing Action for BVPS-2 Item No. 30 and LAR Section 4.1.2.2 will be updated. These changes will be provided in a future submittal.

Attachment L-15-118 Page 5 of68 FPE RAI 05 a) Provide a more suitable compliance strategy or additional justification for applying the "complies with clarification" strategy for the following attributes based on the issues identified:

ix. The compliance basis for NFPA 805, Section 3.10.8, in LAR Attachment A, Table B-1, identifies "Complies with Clarification" for Fire Area 1-CR-4 for a Halon 1301 system; however, NFPA 805, Section 3.10.8 applies to carbon dioxide systems.

Response

Fire Compartment 1-CR-4 has a Halon suppression system. Therefore, NFPA 805 Section 3.1 0.8 requirement does not apply. The compliance statement in LAR Attachment A, Table B-1 for fire compartment 1-CR-4 will be revised to indicate "N/A."

This change will be provided in a future submittal.

FPE RAI 06 The compliance basis in LAR Attachment A, Table B-1, for NFPA 805, Section 3.3.3, states "Complies with Clarification;" however, the compliances basis states "the existing original interior wall, ceiling, and floor finish is considered to be compliant with NFPA 805 standards."

a) Provide more information with regard to what is being clarified.

b) NFPA 805, Section 3.3.3, states, in part, that "interior wall or ceiling finish classification shall be in accordance with NFPA 101, Life Safety Code, requirements for Class A materials. Interior floor finishes shall be in accordance with NFPA 101 requirements for Class I interior floor finishes." NFPA 101 Class A also requires a smoke developed index, which is not addressed in this attribute. Additionally, Class I for interior floor finish requirements is not mentioned. The LAR attribute states that the plant "is considered to be compliant with NFPA 805 standard." Explain how the plant meets the NFPA 805 requirements for interior floor, wall, and ceiling finish.

Response

a) The compliance statement "Complies by Clarification" for NFPA 805, Section 3.3.3, is not applicable. The compliance strategy should indicate "Complies by Previous NRC Approval," the basis for which is provided below.

Attachment L-15-118 Page 6 of68 b) With respect to compliance with NFPA 805, Section 3.3.3 for interior wall or ceiling classification, the below excerpts from letters between Duquesne Light Company and the NRC reveal that this attribute was previously approved by the NRC.

BVPS-1 was previously required to meet the fire protection requirements for interior coatings from BTP APCSB 9.5.1 Position IV.B.1.d which states; Interior wall and structural components, thermal insulation materials, and radiation shielding materials and soundproofing should be noncombustible.

Interior finishes should be non-combustible or listed by a nationally recognized testing laboratory, such as Factory Mutual or Underwriters Laboratory, Inc. for flame spread, smoke and fuel contribution of 25 or less in its use configuration (ASTM E-84 Test, "Surface Burning Characteristics of Building Materials.")

In a letter from Duquesne Light Company to the NRC dated October 27, 1976, the response to Position IV.B.1.d states:

Acoustical inner lining for ductwork is rigid 1 in. thick fiberglass and complies with NFPA-90A. The adhesive used in conjunction with the insulating liner is self-extinguishing and conforms to Mil Spec. MIL-A-3316. All pipe and duct insulation is listed by the Underwriters' Laboratories and has a flame spread and smoke developed rating of not more than 25 and 50 respectively, in compliance with NFPA-90A.

Interior coatings at BVPS I [BVPS-1] consist of epoxy or alkyd, enamel paint over concrete block, reinforced concrete walls and slabs, or steel substrate. These coatings, in general, have a flame spread rating of less than 25 based on information presently available from coating manufacturers.

BVPS I [BVPS-1] is in compliance with the intent of this position.

The "Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No.18 to Facility Operating License No. DPR-66," dated June 6, 1979, does not reiterate the BTP APCSB 9.5.1 Position IV.B.1.d as noted above.

The October 1985 BVPS-2 SER NUREG-1057, "Safety Evaluation Report Related to the Operation of Beaver Valley Power Station" Section 9.5.1.4 "General Plant Guidelines" also states:

Interior walls and structural components, radiation shielding materials and sound-proofing and interior finishes are non-combustible or listed by a nationally recognized testing laboratory, such as Factory Mutual (FM) or UL, for flame

Attachment L-15-118 Page 7 of68 spread, smoke, and fuel contribution of 25 or less. This is in accordance with BTP CMEB 9.5-1, and is, therefore, acceptable.

The technical basis remains valid since the Beaver Valley Fire Protection Program addresses the requirements from BTP APCSB 9.5.1 Position IV.B.1.d.

The above excerpts demonstrate that interior finishes for both BVPS-1 and BVPS-2 have a flame spread rating of less than 25 per American Society for Testing and Materials (ASTM) E-84 or equivalent, and this aspect was specifically approved and reiterated by the NRC in NUREG-1057.

For BVPS-1 and BVPS-2, the compliance to NFPA 101 within NFPA 805 Section 3.3.3 is a new requirement; therefore, in order to transition to NFPA 805 new and replacement coatings will be required to meet the applicable NFPA 101 sections for interior floor, wall, and ceiling finishes. The requirements for NFPA 101 will be incorporated and referenced in the appropriate procurement and plant documents in LAR AttachmentS, Table S-3. The LAR Attachment A, Table B-1 record that addresses NFPA 805 section 3.3.3 compliance statement will be revised to indicate "Complies by Previous NRC Approval." These changes will be provided in a future submittal.

FPE RAI 07 LAR Attachment A, Table B-1 attributes 3.3.1.2(1 ), 3.3.1.2(3), 3.3.1.2(4), 3.3.1.3.4, 3.3.3, 3.3.4, 3.3.10, and 3.3.11 use the compliance strategy "Comply with the Use of Commitment." The commitments identify the need to update a plant procedure, procurement specification, or other document. However, the commitments contain the phrase, " ... to be revised to more closely reflect the subject NFPA 805 requirements ... " It is unclear whether this commitment means the revised documents will meet the applicable NFPA 805 requirement. For each applicable use of this phrase, "more closely reflect the subject NFPA 805 requirements," describe whether the revised procedure(s) and\or specification(s) will meet the applicable NFPA 805 code requirement.

Response

The subject attributes will be revised to state "Administrative procedures to be revised to include the subject NFPA 805 requirement." These changes will be provided in a future submittal.

Attachment L-15-118 Page 8 of68 FPE RAI 08 LAR Attachment A, Table B-1, Sections 3.2.2.4, 3.2.3(2), 3.3.1.2(5), 3.3.3, 3.3.4, 3.3. 7.1, and 3.3.8 state, in part, that compliance will be achieved through completion of an update to Procedure 1/2-ADM-1900 and references Open Item BV1-2908. However, LAR AttachmentS, Table S-3, Implementation Item BV1-2908, only addresses an update to enhance controls of flammable gas, which is associated with attribute 3.3.7.1. Explain the reason for not including the other attributes that cite BV1-2908 in the scope of the implementation item description in LAR AttachmentS, Table S-3, or revise the scope of the implementation item.

Response

The scope of implementation item BV1-2908 in LAR Attachment S, Table S-3 will be revised to include statements that require updating from NFPA 805 Sections 3.2.2.4, 3.2.3(2), 3.3.1.2(5), 3.3.3, 3.3.4 and 3.3.8. This change will be provided in a future submittal.

FPE RA115 LAR Section 4.5.2.2, "Fire Risk Approach," states that Fire Risk Evaluations were performed in accordance with NFPA 805 Section 4.2.4.

NFPA 805, Section 2.4.3.3, states that the use of the Fire Risk Evaluation performance-based approach requires that "The PSA [probabilistic safety approach], methods and data shall be acceptable to the AHJ" (which is the NRC).

LAR AttachmentS, Table S-2 identifies the installation of a Very Early Warning Fire Detection System (VEWFDS) in low voltage cabinets located in fire compartments 1-CR-4, 2-CB-1, and 2-CB-6 to reduce the likelihood of fire propagation outside the cabinets (i.e., Items BV1-1875 and BV2-0829). Provide more detailed description of the proposed modification including:

a) Identify the NFPA code(s) of record, the proposed installation configuration (inside cabinets or area-wide, common piping or individual cabinet piping),

and the equipment manufacturers recommendations regarding design, installation, and piping.

Attachment L-15-118 Page 9 of68

Response

a. NFPA Codes of Record

i. NFPA 72-2010, NFPA 76-2009

b. Proposed installation configuration

i. Tubing/Piping sample points will be installed inside cabinets. There will be individual piping zones throughout the room, with each zone containing multiple sample points.

ii. The VEWFDS will be connected to interface with the Control Room annunciation system. LAR AttachmentS, Table S-2 will be revised to add two plant modifications that interface the BVPS-1 and BVPS-2 VEWFDS with the Control Room annunciation system.

These changes will be provided in a future submittal.

c. Manufacturers Design Requirements

i. Shall consist of a high sensitivity type detector using Cloud Chamber Detection (CCD) technology that can detect from 0.000 to 100 percent obscuration per foot (obs/ft) without the use of a laser.

ii. Shall be air sampling by utilizing a system aspirator, selector valve (multi-zone systems) and micro-controller.

iii. Shall be self-contained, including micro-controlled base technology with optional unit liquid crystal display (LCD) showing graphic display of system integrity and particle background.

iv. Shall consist of an air sampling pipe and/or tubing system network to continuously transport air from protected areas utilizing either 1, 2, 3, or 4 zones to the detection system.

v. Must include intelligent remote operating software.

vi. The system will also be furnished with an ultra-sensitive, handheld, portable air sampling detector using a charge-coupled device (CCD). The handheld portable detector must be battery powered, less than 14 pounds (lbs) and must have the capability of detecting inside cabinets via a non-conductive sample probe. The portable detector must also be capable of detecting an invisible, odorless fire down to the source. Upon notification of an early warning from the system, the portable detector can be used to determine the location of the alarm. The equipment in question can then be powered down and inspected, or the source removed.

vii. The system shall have four individually programmable alarm levels which each can be set to any of ten different sensitivity settings.

The detector must be able to automatically change the individual

Attachment L-15-118 Page 10 of68 sensitivity settings three times per day with the ability to be set different for each day of the week.

viii. Each alarm level must be capable of being set to simulate four different types of smoke/fire detectors.

ix. Shall report any equipment related fault through a fault output relay.

x. The system must be fully networkable via an RS485 loop and have the capability of graphically displaying, via LCD display, the system parameters and system status. The remote display must be capable of programming each detector on the loop or just display.

xi. The system must be immune to dust, dirt, gases, and pollutants that normally cause false alarms. Time delays and signal averaging will not be acceptable.

xii. Shall be installed to comply with NFPA standards and the Authority Having Jurisdiction.

d. Manufacturers Installation Requirements

i. Detection System: Installation of the system shall be in accordance with the manufacturer's installation recommendations and the Installation and Operational Manual recommendations.

ii. Air Sampling System Pipe/Tubing network:

1. All pipe/tubing work shall be accomplished using proper tools for cutting and de-burring.

2. All pipe/tubing shall be made leak tight. All pipe and tubing connections shall be securely tightened. Use only light pressure on a wrench at the inlet manifold connections, if used.

3. All bends in the pipe/tubing must not have a reduced cross-section. For sharp bends, elbows shall be used. Radius elbows are the preferred method for low pressure installation when changing pipe direction.

4. All pipe/tubing shall be appropriately anchored and labeled.

e. Air Sampling System Piping/Tubing

i. Shall consist of rigid metallic or non-metallic pipe and/or tubing.

ii. Shall be constructed using suitable materials needed to meet the requirements of local building codes.

iii. Shall be designed to provide optimum system efficiency for each zone.

Attachment L-15-118 Page 11 of 68 iv. Sample transport time from the most remote sampling point shall not exceed 60 seconds per NFPA 76.

b) Describe the acceptance testing, sensitivity and setpoint control(s), alarm response procedures and training, and routine inspection, testing, and maintenance that will be implemented to credit the VEWFDS.

Response

a. Acceptance Testing Acceptance testing will be performed by the vendor to ensure all equipment is operating as designed. The acceptance testing covers the following:

i. Verification of communication from each detector to the laptop personal computer.

ii. Verification of each detector fan speed being set to 99 percent or 100 percent.

iii. Verification that millimeters (mm) of water measured across the zone manifold is greater than zero using a manifold differential pressure (dP) meter.

iv. Verification that each pipe/tube has an airflow value between 15 and 85 percent.

v. Verification that each detector zone alarms within 60 seconds when testing the last sample point with the Veri-Fire (heat gun) testing device.

vi. Software Verification Acceptance testing will also cover verification of Control Room Annunciator alarm from each detector.

b. Sensitivity Settings

i. Gain can be set in the range of 1 to 10, with 10 being the most sensitive. Gain will be set to 5 on each detector, which is the factory default setting.

ii. Alarm thresholds (Pre-alarm, Fire 1, Fire 2, Fire 3) can be set from 20 percent to 90 percent. Thresholds will be set to the factory default setpoints of 30 (Pre-alarm), 50 (Fire 1), 70 (Fire 2), and 90 percent (Fire 3).

Attachment L-15-118 Page 12 of68

c. Setpoint Controls Each detector will have an associated setpoint document that contains the alarm setpoints. The setpoint documents will be subject to design control program requirements engineering group and will be available in the document and records file control system.

d. Alarm Response Procedures Alarm response procedures will be developed throughout the modification process for both BVPS-1 and BVPS-2. Upon a VEWFDS alarm the operators will refer to the appropriate alarm response procedure and at a minimum pursue the following actions:

i. Verification of which detector and associated zone is in alarm ii. Establishment of a fire watch until alarm is cleared or source has been identified and addressed accordingly iii. Use of the Portable Incipient Detector to determine source of alarm iv. Investigation of the alarm source

e. Training Introductory training has already been provided to operations personnel for the VEWFDS, which included discussions on the following:

i. Description of the VEWFDS and equipment ii. Equipment arrangement for both BVPS-1 and BVPS-2 iii. Function of the VEWFDS equipment iv. Alarm levels and settings

v. Alarm response procedure vi. Annual system testing Additional operations personnel training will be performed as part of the modification process. Training will initially be provided to maintenance personnel through vendor training.

f. Routine Inspection Periodic checks and maintenance will be in accordance with vendor requirements that include daily checks, three-month checks, and annual checks.

Attachment L-15-118 Page 13 of68

g. Testing Initial site acceptance testing will be performed by the vendor upon installation completion. Annual testing of the system will be completed by operation surveillance testing procedures, developed throughout the modification process in accordance with vendor recommendations.

h. Maintenance System maintenance procedures will be developed (throughout the modification process) and performed in accordance with the vendor maintenance requirements.

c) Describe the configuration and design control process that will control and maintain the setpoints for both alert and alarm functions from the VEWFDS.

Response

Detector setpoints will be controlled via setpoint document information that is developed and controlled in accordance with the BVPS setpoint document program. A setpoint document will be completed for each detector throughout the modification process for both BVPS-1 and BVPS-2.

d) Describe the instructions that will be given to the first responders until the degrading component is repaired, the cabinet is de-energized, or the alarm is satisfactorily reset in the event of a VEWFDS actuation.

Response

In accordance with the current procedure, the first responders will identify the source of the alarm with the portable VEWFDS detector. Once the source of the alarm has been identified, operations personnel will determine what appropriate actions are required. If the source of the alarm cannot be identified, the alarm will attempt to be reset. If the alarm cannot be reset, a condition report will be initiated to further evaluate cause of the alarm. A change to this procedure is planned through the VEWFDS modification process to establish a fire watch which will remain in place until the alarm is cleared or the source has been identified and addressed accordingly.

Attachment L-15-118 Page 14 of68 Safe Shutdown Analysis (SSD) RAI 02 NFPA805, Section 2.4.2, "Nuclear Safety Capability Assessment," requires licensees to perform a nuclear safety capability assessment (NSCA). RG 1.205, endorsed the guidance in NEI 00-01, Chapter 3, as one acceptable approach to perform an NSCA.

Attribute 3.5.2.1 of NEI 00-01 states that, "an open circuit on a high voltage (e.g.,

4.16 kV) ammeter current transformer (CT) circuit may result in secondary damage." In LAR Attachment B, Table B-2, the licensee stated that the safe shutdown analysis is "Not in Alignment" with this guidance and referred to an analysis of high voltage current transformers. The licensee also stated that "any modifications required will be determined when the guidance is finalized as to which current transformers pose a credible risk of secondary damage upon an open circuit."

a) Describe the scope, assumptions, and results of the high voltage current transformers analysis, including the secondary fire areas of concern, and describe any potential methods of resolving the design concern due to open-circuited current transformers, including potential plant modifications.

Response

The alignment basis for attribute 3.5.2.1 of Nuclear Energy Institute (NEI) 00-01 was not intended to imply that aCT open circuit failure analysis was performed. The scope of the referenced high voltage CT report was to provide the BVPS NFPA 805 transition team with detailed information in regards to each current transformer's secondary circuit installed at BVPS-1, BVPS-2, and the switchyard. This information included CT ratios and which CT circuits left the switchgear enclosure unprotected. As discussed in the NEI alignment basis, no further action to resolve the CT open circuit secondary fire concern was taken pending further guidance and/or possible testing on open circuited CTs.

Since the resolution of this issue may not support the BVPS 805 transition schedule, BVPS will complete a plant-specific CT open circuit analysis described in the response to SSD RAI 02(b). The analysis will be performed on CTs with no open circuit protection and a turns-ratio greater than 1200:5. The turns-ratio analysis is based upon NUREG/CR-7150 which has previously concluded that secondary fires from CTs with an open circuited secondary and a turns-ratio of 1200:5 or less are not credible. Any CT identified as continuing to present a secondary fire risk will be modified per implementation items BV1-2706 and BV2-1020 in order to eliminate such risk.

Attachment L-15-118 Page 15 of68 SSD RAI 02 b) Describe the NRC correspondence identified in LAR AttachmentS, Table 5-3, Implementation Items BV1-2706 and BV2-1 020, and provide an implementation item to address the resolution of this issue.

Response

The NRC correspondence identified in LAR AttachmentS, Table S-3, Implementation Items BV1-2706 and BV2-1020 refers to a draft version of NUREG/CR-7150, "Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE),

Volume 2: Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure." However, NUREG/CR-7150 Volume 2 has since been published and does not contain information regarding the credibility associated with an open circuit on the secondary of a CT. Implementation Items BV1-2706 and BV2-1020 in LAR Attachment S, Table S-3 will be revised to state, "Current Transformer Secondary Open Circuit Analysis will be performed on CTs with no open circuit protection and a turns-ratio that exceeds 1200:5. Any CT identified as continuing to present a secondary fire risk will be modified in order to eliminate such risk." These changes will be provided in a future submittal.

SSD RAI 03 NFPA 805 Section 2.4.2, Nuclear Safety Capability Assessment, requires licensees to perform a nuclear safety capability assessment (NSCA). Regulatory Guide 1.205, endorsed the guidance in NEI 00-01 Chapter 3 as one acceptable approach to perform an NSCA.

LAR Section 4.2.1.1 and the alignment basis for NEI 00-01, Section 3.2.1.2 in LAR Attachment B, Table B-2, stated that where feasibility reviews called into question the use of manual valves in the fire compartment after the fire was extinguished, the recovery strategy was modified to ensure recovery actions (RAs) could be successfully and reliably credited. NEI 00-01, Attribute 3.2.1.2 requires that any post-fire operation of a rising stem valve should be well justified using an engineering evaluation. As such, provide the following clarifications:

a) Identify fire areas where RAs require manual operation of rising stem valves that may be subjected to the effect of fire exposure.

b) Describe the engineering analysis justifying the post-fire operation of these valves per the guidance of NEI 00-01 and the "modified" recovery strategy.

Attachment L-15-118 Page 16 of68

Response

a) A review of the NSCA results indicated that there are no recovery actions that require manual valve operation (rising stem, diaphragm, butterfly, etc.) in the fire affected compartment.

b) Since there are no manual valve operations required in the fire affected compartment, an engineering evaluation is not required.

SSD RAI 07 NFPA 805, Section 2.4.2, "Nuclear Safety Capability Assessment," requires licensees to perform a NSCA. RG 1.205 endorsed the guidance in NEI 00-01 Chapter 3 as one acceptable approach to perform an NSCA.

Attribute 3.1.2.5 of NEI 00-01 requires that the process monitoring function be provided for all safe shutdown paths, and in particular, neutron flux monitoring (source range) is identified as acceptable instrumentation to support monitoring reactivity control. In LAR Attachment 8, Table 8-2, the licensee stated that 8VPS-1 has an approved exemption (Licensing Action11.24) to have a source range monitor operational within 80 minutes of the event. However, in LAR Attachment K, "Licensing Action 11.24," the licensee stated that a portable drawer (for source range monitoring) can be hooked up within one hour (60 minutes). Clarify the discrepancy between the approved licensing action time frame of 60 minutes to have source range indication available, and the 80 minutes as described in LAR Attachment 8, Table 8-2.

Response

A letter from Duquesne Light Company (J.J. Carey) to NRC (Steven A. Varga),

dated December 10, 1982, states in part ... , "Per telecon on December 6, 1982, a mutual agreement was reached to provide source range monitoring indication external to the control room. Duquesne Light Company will provide a source range instrument drawer at the Backup Indication Panel (BIP) to be installed in the East Cable Vault (CV-2), with the ability to hook up to the pre-amplifier output within one (1) hour after the time at which source indication would be available after a reactor trip."

A Duquesne Light Company evaluation determined that source range indication would not become available until 20 minutes after a reactor trip, which then starts the one-hour time clock for installation of the external source range monitor.

Thus the total time required to install the external source range monitor is 80

Attachment L-15-118 Page 17 of68 minutes following a reactor trip. This methodology meets the requirements of Licensing Action 11.24.

LAR Attachment B, Table B-2 and LAR Attachment K, Licensing Action 11.24 will be changed to explicitly specify that source range indication normally becomes available 20 minutes after a reactor trip, and the external source range monitor at the BIP will be installed within one hour after the time source range indication would normally be available. These changes will be provided in a future submittal.

SSD RAI 09 NFPA 805, Section 2.4.2.4, requires that "An engineering analysis shall be performed in accordance with the requirements of Section [2.4] for each fire area to determine the effects of fire or fire suppression activities on the ability to achieve the nuclear safety performance criteria of Section 1.5."

RG 1.205, Revision 1 endorsed NEI 04-02, Revision 2, as one acceptable approach to performing and documenting the engineering analyses required to transition to a risk-informed, performance-based fire protection program in accordance with 10 CFR 50.48(c) and NFPA 805. On a fire area basis, NEI 04-02 requires that the licensee document how the nuclear safety performance criteria are met. The guidance in NEI 04-02 recommends that this information be presented in Table B-3, "Fire Area Transition." In LAR Section 4.2.4, "Overview of the Evaluation Process,"

Step 5 - Disposition, the licensee states that the final disposition of VFDRs should be documented in Attachment C (NEI 04-02 Table B-3).

In LAR Attachment C, Table 8-3, the licensee identified VFDR BV2-0411 as being applicable to Fire Area 2-WH-1 only. However, the FREs for Fire Areas 2-CV-1 and 2-MS-1 indicated that VFDR BV2-0411 is also applicable to these areas.

a) Discuss the basis for only identifying VFDR BV2-0411 for fire area 2-WH-1, and not for other fire areas whose FRE may include this VFDR in the engineering analysis (e.g., fire areas 2-CV-1 and 2-MS-1 ).

Response

a) VFDR BV2-0411 was resolved by the BVPS-2 NFPA 805 Associated Circuits Review and is not applicable to fire areas 2-CV-1, 2-MS-1, and 2-WH-1. This VFDR should not have been attributed to fire compartment 2-WH-1 in LAR Attachment C, Table B-3. The LAR correction will be provided in a future submittal.

Attachment L-15-118 Page 18 of68 SSD RA110 NFPA 805, Section 2.4.2.4, requires that "An engineering analysis shall be performed in accordance with the requirements of Section [2.4] for each fire area to determine the effects of fire or fire suppression activities on the ability to achieve the nuclear safety performance criteria of Section 1.5."

RG 1.205, Revision 1 endorsed NEI 04-02, Revision 2 as one acceptable approach to performing and documenting the engineering analyses required to transition to a risk-informed, performance-based fire protection program in accordance with 10 CFR 50.48(c) and NFPA 805. On a fire area basis, NEI 04-02 requires that the licensee document how the nuclear safety performance criteria are met. The guidance in NEI 04-02 recommends that this information be presented in Table B-3, "Fire Area Transition." In LAR Section 4.2.4, "Overview of the Evaluation Process," Step 5- Disposition, the licensee states that the final disposition of VFDRs should be documented in Attachment C (NEI 04-02 Table B-3).

In LAR Attachment C, Table 8-3, "Fire Compartment 2-CV-1 ,"the licensee stated that VFDR BV2-0502 involves fire damage to power cables associated with high-low pressure interface valves 2RHS-MOV701A-PP, 2RHS-MOV701B-P, 2RHS-MOV702A-P and 2RHS-MOV702B-P due to three-phase hot shorts. The licensee further stated that the VFDR will be corrected by a plant modification. However, LAR Attachment S did not identify a modification associated with VFDR BV2-0502 or with the subject residual heat removal (RHR) valves. Describe the modification and include the modification item in LAR Attachment S, as appropriate.

Response

The resolution to VFDR BV2-0502 identified that a plant modification was required to correct the potential spurious operation of a three-phase AC motor hot short. Subsequently, NUREG/CR-7150, "JACQUE-FIRE, Vol. 1", issued October 2012, page 8-3 states in part; " ... Specifically, the PIRT [phenomena identification and ranking table] panel concluded the following: The spurious operation of a three-phase AC [alternating current] motor due to proper polarity hot shorts on three-phase cabling is incredible." Therefore, the modification is unnecessary, and was removed from Table S-2.

Since the three-phase AC hot short was determined not to be credible, LAR Attachment C, Table B-3, "Fire Compartment 2-CV-1" no longer requires evaluation and modifications are not required. Revised LAR Attachment C, Table B-3 records removing VFDR BV2-0502 will be provided in a future submittal.

Attachment L-15-118 Page 19 of68 SSD RAI12 NFPA 805, Section 2.4.2, "Nuclear Safety Capability Assessment," requires licensees to perform a nuclear safety capability assessment (NSCA). RG 1.205, endorsed the guidance in NEI 00-01 Chapter 3 as one acceptable approach to perform an NSCA.

Attribute 3.5.2.5 of NEI 00-01 states that circuit failures due to common enclosure concerns could result in the possibility of causing secondary failures due to fire damage to a circuit either whose isolation device fails to isolate the cable fault or protect the faulted cable from reaching its ignition temperature, or the fire propagates along the cable into adjoining fire areas. LAR Attachment 8 stated that the plant has incorporated the post-fire safe shutdown analysis into SAFE, which identifies failed safe shutdown cables and equipment for each fire compartment through various software logics. Describe how this process addresses common enclosure concerns with respect to protective device coordination, fault protection, cable sizing, and barriers and penetration designs as described in the guidance of Attribute 3.5.2.5 of NEI 00-01.

Response

SAFE was not used to evaluate common enclosure concerns. A separate associated circuits review was conducted for both BVPS-1 and BVPS-2. This review included a protective device interrupting rating review and a cable protection review which identified potential common enclosure issues. These issues were then evaluated to ensure they did not adversely impact any credited fire probabilistic risk assessment (PRA) I safe shutdown (SSD) components. LAR Attachment B, Table B-2 attribute 3.5.2.5 of NEI 00-01 will be revised to correct this. This change will be provided in a future submittal.

Attachment L-15-118 Page 20 of68 Fire Modeling (FM) RAJ 01 NFPA 805, Section 2.4.3.3 states that the PRA approach, methods, and data shall be acceptable to the NRC. The NRC staff noted that fire modeling comprised the following:

• The algebraic equations implemented in NUREG-1805, "Fire Dynamics Tools (FDTs): Quantitative Fire Hazard Analysis Methods for the U.S.

Nuclear Regulatory Commission Fire Protection Inspection Program,"

December 2004 (ADAMS Accession No. ML043290075) were used to characterize flame height, plume centerline temperature, flame radiation (heat flux), plume radius, hot gas layer (HGL) temperature, ceiling jet temperature, smoke and heat detector actuation, and sprinkler activation.

• The FLASH-CAT model was used to calculate the fire propagation in a vertical stack of horizontal cable trays.

• The Consolidated Model of Fire and Smoke Transport (CFAST) was used in HGL and multi-compartment analysis (MCA) calculations for various compartments, the Main Control Room (MCR) abandonment calculations, and the temperature sensitive equipment HGL study.

• Fire Dynamics Simulator (FDS) was used in the temperature sensitive equipment zone of influence (ZOI) and plume/HGL interaction studies.

LAR Section 4.5.1.2, "Fire PRA" states that fire modeling was performed as part of the Fire PRA development (NFPA 805, Section 4.2.4.2). Reference is made to LAR Attachment J, "Fire Modeling V&V," for a discussion of the acceptability of the fire models that were used.

Regarding the acceptability of the FPRA approach, methods, and data:

g) Describe how high energy arcing fault initiated fires are treated in the HGL development timing.

Response

The guidance in Appendix M of NUREG/CR-6850, Volume 2 was used to determine fire damage due to high energy arcing faults (HEAFs). Fire PRA targets within the initial HEAF ZOI were considered damaged and/or ignited in HEAF scenarios at time zero in accordance with the guidance in NUREG/CR-6850, Section M.4.2.

The ensuing cabinet fire occurring after the HEAF event has been modeled as a 211 kilowatt (kW) fire, with peak heat release rate occurring at time zero and remaining at peak for a duration of 20 minutes. Decay begins at 20 minutes and also lasts for a

Attachment L-15-118 Page 21 of68 duration of 20 minutes. The 40 minute total duration of the subsequent fire scenarios bounds the total recommended timing for electrical cabinet fires in Table G-2 of NUREG/CR-6850.

The electrical cabinet heat release rates given in Appendix G of NUREG/CR-6850 are based on fires occurring in one or more cable bundles. The HEAF event is expected to be severe enough to consume interior cable bundles substantially and therefore limit the amount of combustibles available for burning after the HEAF event. Therefore, the lower 211 kW value that is based on a fire in a single bundle is considered appropriate.

Fire propagation to secondary combustibles in HEAF fire scenarios is modeled as follows:

The first overhead cable tray within the ZOI of the HEAF was assumed to be damaged and ignited at time zero, that is, at the time of the electrical fault. For horizontal cable trays, the cable tray flame spread rate and the heat release rate per unit area (HRRPUA) were determined using methods recommended by NUREG/CR-7010, Volume 1, Section 9.2.2. The total area of the exposed cable trays and combustibles within the ZOI of the HEAF scenario are assumed ignited at time zero. Any remaining trays in a stack ignite in a time period consistent with or more conservative than the timing rules in Section R.4.2.2 of NUREG/CR-6850 and NUREG/CR-701 0.

Fire propagation to adjacent cabinet sections was considered in accordance with NUREG/CR-6850, Appendix S. Unless precluded by cabinet design, fire propagation to adjacent cabinet sections was assumed to occur at 10 minutes. In the majority of fire scenarios, the adjacent electrical cabinet section is vented at the top. Therefore, an internal hot gas layer plenum in the cabinet is not postulated and fire spread between adjacent vertical sections of the cabinet is assumed not to occur.

FM RAI 01 j) Specifically regarding the use of CFAST in the MCR abandonment calculations for Units 1 and 2:

viii. For the case where a cabinet fire spreads to a vertical cable tray in the Unit 1 MCR, describe in detail how the time to ignition of the cable tray was calculated.

Response

The limiting cabinet fire to vertical cable tray time to ignition analysis for the BVPS-1 MCR is described as follows.

Attachment L-15-118 Page 22 of68 A vertical section of cable tray rises from the top of cabinet (PNL-ERFS-52) (labeled as retired in place). The cable tray was assumed to contain unqualified cable. The closest ignition source for this cable tray is cabinet (PNL-BLDG-SERV), the edge of which is located 7 inches horizontally from the cable tray. PNL-BLDG-SERV is modeled as a multi-bundle closed cabinet containing unqualified cable.

The first step in determining the cable tray ignition time utilizes FDT 05.1 to estimate the heat release rate (HRR) from cabinet PNL-BLDG-SERV required to expose the target cable tray to a heat flux which exceeds the 6 kW per meter2 damage criteria of thermoplastic cable. Using the Point Source calculation within FDT 05.1 and setting a separation distance between the source and target of 7 inches, a radiant fraction of 0.4 and taking a conservative fuel area of 0 feet2 , resulted in a minimum required cabinet HRR of6 kW.

The final step is to determine the time for a cabinet fire to grow sufficiently to produce a HRR of 6 kW. Based on a t2 function for the growth phase:

t = r* J Q, Qpeak where; t =time to reach HRR Ot (s)

-r is the time to reach the peak HRR (s) assumed to be 12 minutes based on NUREG/CR 6850 Appendix G Otis the intermediate HRR during the growth phase HRR (kW)

Opeak is the peak HRR (kW) assumed to be the 98th percentile HRR for a multi-bundle, unqualified, closed door cabinet taken from Table E-1 of NUREG I CR-6850 (that is, 464 kW)

Solving fort gives a time to reach 6 kW, and thereby ignite the cable tray, of 82 seconds. The abandonment analysis conservatively uses a time to ignition oft = 1 minute.

Note: During the original walkdown used to support the BVPS-1 MCR analysis, it was noted this vertical cable tray emerged from the top of cabinet PNL-ERFS-52 and the cabinet was labeled as retired in place. Consequently the cabinet was not included as an ignition source. Following a more recent walkdown, it was observed that the front side of this cabinet had active indication, and thus only the rear face of the cabinet is retired. This new information will be captured in the re-evaluation of the MCR CFAST abandonment calculation under PRA RAI 03 to address the risk significance of other related RAis (that is, FM RAI 1.j (i), (ii), (iii), and (vii)).

Attachment L-15-118 Page 23 of68 FM RAI 01 j) Specifically regarding the use of CFAST in the MCR abandonment calculations for Units 1 and 2:

x. Describe the cabinet, cable tray and transient fire elevations and areas that were used in the CFAST calculations, and provide technical justification for the assumed values.

Response

Fire Elevations For the cabinet, cable tray and transient fires considered in the BVPS-1 and BVPS-2 CFAST MCR abandonment calculation, the fire elevation was assumed to be 1 meter (3.3 feet) above floor level for each case.

For electrical cabinet fires (including any secondary combustible involvement) this fire elevation deviates from the recommended approach given in FAQ 08-0043 of fixing the fire elevation 0.3 meter (approximately 1 foot) below the top of the cabinet (when there are no cabinet vents) or at the height of the cabinet vent. If this approach were to be fully adhered to, the fire elevation would be fixed higher than 6 feet above the floor which is the hot gas layer (HGL) abandonment height. Under these circumstances, the fire duration would be curtailed once the HGL descends to the fire elevation. This would lead to non-conservative results as the HGL would be inhibited from descending any further and reaching the 6 feet above floor level abandonment criteria. However since the fire could start at any height within a cabinet, fires have been modeled as starting at an average height between the floor and the HGL critical limit of 1 meter (3.3 feet) above floor level. This is considered to be the most reasonably representative fire height.

For the MCR abandonment analysis, the fire elevation for transient fires is 1 meter (3.3 feet) above the floor. This was considered appropriate and conservative for contained trash bin transient fires. Transient MCR fire scenarios are low risk contributors and the overall risk is not expected to be sensitive to transient fire elevation. The sensitivity of the abandonment risk to transient fire elevation will be further investigated in response to FM RAI 01 O)(ix) related to loose trash fires. A review of the transient fire elevation will be performed following any transient fire modeling changes resulting from FM RAI 01 U)(ix) and will be implemented as part of PRA RAI 03.

The single cable tray fire modeled in the BVPS-1 MCR is a secondary combustible fire, and consequently was modeled as an extension of the source cabinet fire. The HRR of the source cabinet fire was increased appropriately and consequently the fire elevation remains fixed at the cabinet fire elevation of 1 meter (3.3 feet). Further, setting the

Attachment L-15-118 Page 24 of68 cable tray fire elevation to a higher elevation is considered to be non-conservative as this would limit the extent to which the HGL could descend.

Fire Areas For the cabinet, cable tray and transient fires considered in the BVPS-1 and BVPS-2 CFAST MCR abandonment calculation, a fire area of 1 meter2 (10.8 feet 2 ) was used.

Since the CFAST analysis was used to calculate the HGL development, the item of foremost importance is the amount of energy (heat release rate) being released into the fire zone. The heat release rate profile for the MCR fires has therefore been specifically defined within the CFAST model. As a consequence, the fire area parameter becomes less critical and sensitivity runs have confirmed varying the fire area had no impact on the abandonment times reported.

FM RAI 01 j) Specifically regarding the use of CFAST in the MCR abandonment calculations for Units 1 and 2:

xii. Explain why there are slight differences in the calculated abandonment times and resulting probabilities for abandonment between BVPS Units 1 and 2 MCRs.

Response

The reason for the discrepancy between the BVPS-1 and BVPS-2 abandonment times and resulting probabilities of abandonment can be explained by the ambient air temperature used in the CFAST modeling. The BVPS-1 MCR analysis set the ambient air temperature in the control room as being 20 degrees centigrade (0 C}, while the BVPS-2 MCR analysis ambient air temperature was set to 25 °C. For the BVPS-2 MCR analysis, performed after the BVPS-1 MCR analysis, the ambient temperature parameter was increased to 25 oc to make it consistent with what was used in the detailed fire modeling calculations for other fire compartments.

To address the noted inconsistency between the BVPS-1 and BVPS-2 MCR ambient temperatures, the effect of increasing the control room ambient air temperature was determined by performing a sensitivity study. This involved repeating the CFAST analysis for an electrical cabinet fire with the highest discretized distribution bin and with the room temperature increased from 20 degrees centigrade (0 C} to 25 °C. The results of the sensitivity study showed the 5 °C increase in ambient air temperature resulted in marginally faster times for the hot gas layer (HGL) to reach the critical 93 °C. The increase in ambient temperature had negligible effect on the optical density of the smoke layer and the layer height. As abandonment conditions based on the optical density of the smoke layer is the dominating condition (compared with HGL

Attachment L-15-118 Page 25 of68 temperature), it was concluded therefore, that the abandonment times and probabilities are not sensitive to the initial room temperature within the range 20 °C to 25 °C.

Consequently, the BVPS-1 MCR abandonment analysis was not reevaluated. In summary, the 5 °C difference in ambient air temperature modeled for BVPS-1 and BVPS-2 MCRs resulted in a slight difference in the calculated abandonment times and resulting probabilities.

The MCR CFAST abandonment calculation will be re-evaluated under PRA RAI 03 to address the significance of other related RAis (that is, FM RAI 1.j [i], [ii], [iii], and [vii]).

When this analysis is performed, the ambient room temperature setting will be fixed at 25 °C.

Attachment L-15-118 Page 26 of68 Probabilistic Risk Assessment (PRA) RAI 01 - Fire PRA Facts and Observations (F&Os)

Section 2.4.3.3 of NFPA 805 states that the PSA (PSA is also referred to as PRA) approach, methods, and data shall be acceptable to the AHJ, which is the NRC.

RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, "Guidance for Implementing a Risk-Informed, Performance-Based Fire Protection Program Under 10 CFR 50.48(c)", Revision 2 (ADAMS Accession No. ML081130188), as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. RG 1.200 describes a peer review process utilizing an associated ASME/ANS standard (currently ASME/ANS-RA-Sa-2009) as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established for evaluations that could influence the regulatory decision. The primary results of a peer review are the Facts and Observations (F&Os) recorded by the peer review and the subsequent resolution, or disposition, of these F&Os.

Clarify the following dispositions to Fire PRA F&Os and Supporting Requirements (SRs) assessment identified in LAR, Attachment V, that have the potential to impact the BVPS Unit 1 and 2 Fire PRA results and do not appear to be fully resolved:

a) CF-A1-01 (Circuit Failure Mode Likelihood Analysis)

The disposition states that the fire risk model was revised to use Option #2 from NUREG/CR-6850 to determine circuit failure mode likelihood. New guidance on using conditional probabilities of spurious operation for control circuits is in a letter from the NRC to NEI, "Supplemental Interim Technical Guidance on Fire-induced Circuit Failure Mode Likelihood Analysis,"

(ADAMS Accession Nos. ML14086A165 and ML14017A135) and in Section 7 of NUREG/CR-7150, Volume 2. This guidance includes: 1) replacement of the conditional hot short probability tables in NUREG/CR-6850 for Option #1 (including removal of credit for Control Power Transformers (CPTs) and conduit) with new circuit failure probabilities for single break and double break control circuits (Option #2 in NUREG/CR-6850 is no longer an adequate method and should not be used); 2) replacement of the probability of spurious operation duration figure in FAQ 08-0051 (NUREG/CR-6850 Supplement 1) for AC control circuits and additional guidance to address duration for DC control circuits; 3) a method for incorporation of the uncertainty values for the circuit failure probabilities and spurious operation duration in the state-of-knowledge correlation (SOKC) for developing the mean Core Damage Frequency/Large Early Release Frequency (CDF/LERF);

Attachment L-15-118 Page 27 of68 and, 4) recommendations on the hot short probabilities to use for other cable configurations, including panel wiring, trunk cables, and instrument cables.

Provide an assessment of the assumptions used in the Fire PRA for Units 1 and 2 relative to the updated guidance in NUREG/CR-7150, Volume 2, specifically addressing each of these items. If the Fire PRA assumptions are not bounded by the new guidance provide a justification for each difference or provide updated risk results as part of the integrated analysis requested in PRA RAI 03, utilizing the guidance in NUREG/CR-7150, Volume 2. Justify the proposed treatment of circuit failure probabilities during post transition for self-approval of risk-informed changes.

Response

The assumptions currently used in the Fire PRA for BVPS-1 and BVPS-2 are consistent with the guidance presented in NUREG/CR-6850, and are not necessarily bounded by the new guidance in NUREG/CR-7150, Volume 2. Therefore, BVPS-1 and BVPS-2 Task 9 "Detailed Circuit Failure Analysis" and Task 10 "Circuit Failure Mode Likelihood Analysis" calculations will be revised in order to be consistent with updated guidance in NUREG/CR-7150 Volume 2, per FENOC procedure. The results of the revised calculations will be incorporated in the Fire PRA model to be included in the Integrated Analysis discussed in PRA RAI 03, as well as in the post-transition model to be used for self-approval of changes, in accordance with FENOC procedures "Probabilistic Risk Assessment Program," "Probabilistic Risk Assessment Model Management," and "Probabilistic Risk Assessment Applications Management."

PRA RAI 01 b) IGN-A1-01 (Sensitivity Analysis on FAQ 08-0048 Fire Bin Frequencies)

The F&O disposition indicates the final Fire PRA models used the updated fire ignition frequencies provided in NUREG/CR-6850, Supplement 1 (i.e., in FAQ 08-0048, ADAMS Accession No. ML092190457) were used in the Fire PRA. The guidance in FAQ 08-0048 states that a sensitivity study should be performed using the mean fire frequency for those bins in Section 6 of NUREG/CR-6850 with an alpha value less than or equal to one. Explain whether the acceptance guidelines of RG 1.174 may be exceeded if this sensitivity study would be applied to the integrated analysis requested in PRA RAI 3. If these guidelines may be exceeded, provide a description of fire protection, or related measures that can be taken to provide additional defense in depth, as discussed in FAQ 08-0048.

Attachment L-15-118 Page 28 of68

Response

The sensitivity study using the mean fire frequency for those bins in Section 6 of NUREG/CR-6850 with an alpha value less than or equal to one was performed on the fire PRA models used for the BVPS NFPA 805 LAR submittal, and the results showed that the acceptance guidelines of RG 1.174 would not be exceeded for BVPS-1, and would be only marginally exceeded for CDF at BVPS-2. The same sensitivity study will be again performed on the updated fire PRA model which will be used to answer PRA RAI 03, and the results of the study will be discussed in the response to PRA RAI 03. If the acceptance guidelines of RG 1.174 are exceeded, a description will be provided of fire protection, or related measures that can be taken to provide additional defense in depth, as per FAQ 08-0048.

PRA RAI 01 c) QNS-C1-01 (Quantitative Screening Based on Sample)

The disposition to this F&O states that a sample of the scenarios quantitatively screened on CDF were evaluated against LERF criteria and that all the scenarios also met LERF screening criteria. Explain how evaluating a sample of screened scenarios provides confidence that the CC-II requirements associated with LERF contribution for this SR are met (namely, that the sum of the LERF contributions for all screened fire scenarios is <10% of the estimated total LERF for fire events).

Response

Since the BVPS BVPS-2 quantitative screening model was structured differently to allow faster quantification, and CDF and LERF were both considered in the screening for all scenarios, this issue was identified for and applies to BVPS-1 only.

Quantitative screening of detailed fire scenarios based on LERF was initially not performed as part of the BVPS-1 screening, due to the time required to quantify the initial screening model. LERF needs to be run at an even lower truncation and requires even more time than an identical set of CDF quantifications, and several months had already been required to quantify the CDF results. It was also determined that the LERF results at the compartment level quantification (whole-room burn-up) proved consistent with normal expectations, in that the LERF was typically an order of magnitude (or more) lower than the CDF for each compartment, so it was deemed reasonable to assume LERF results would be approximately an order of magnitude lower than CDF. In response to Peer Review F&O QNS-C1-01, however, it was decided to perform quantitative screening of LERF on a sampling of originally screened-out scenarios, to confirm the validity of the original assumption and screening results, and to satisfy requirements QNS-A 1 and QNS-C 1 of the American Society of

Attachment L-15-118 Page 29 of68 Mechanical Engineers (ASME) PRA Standard. Since scenarios having a CDF of 1E-08 or higher were already retained for the final fire PRA model, it was decided to perform the LERF screening on scenarios originally quantified with a CDF between 1E-08 and 1E-09. It is judged to be a reasonable assumption that scenarios whose CDF is less than 1E-09 would not contribute noticeably to the total LERF. Since the reactor core must typically suffer damage before LERF can even be considered, it may be assumed that all such scenarios whose CDF is less than 1E-09 would show LERF values also less than 1E-09 and would therefore screen according to the quantitative criteria.

Further, any scenario involving a direct release of reactor coolant outside containment would also be evaluated as a loss of coolant accident (LOCA) with no possibility of long term recirculation, leading to core damage and resulting in a CDF value at least as high as the LERF value. Further, the BVPS-2 quantitative screening fully considered both CDF and LERF, and the results from this sister unit were reviewed to verify they exhibited no outlier scenarios for which LERF did not follow the normal expected pattern of quantifying approximately an order of magnitude (or more) below the CDF value.

The same screening values were used for the BVPS-2 quantification, and the screened LERF was determined to be only 0.03 percent of the total LERF.

Per the peer review team recommendation, the additional LERF screening on a sample of initially screened scenarios was performed using the integrated BV1 REVSF Fire PRA model in order to reflect the most recent state of knowledge of the model, and to bypass the issue of excessive quantification time which was the primary reason for not quantifying LERF in the screening model initially. The total fire LERF against which the results are compared to validate the screening for requirement QNS-C1 is similarly evaluated using the normal integrated model quantification, which is yielding even lower results because the scenarios which were already screened out based on CDF are not included in the total LERF result. Therefore the total LERF is represented in this sampling as lower than actual, such that the percentage of LERF screened out is conservatively shown as higher than actual.

Even with the screening performed in this conservative manner, the compartments and scenarios screened for LERF combined to a total of 3.78 percent of the total LERF, as compared to the total of 10 percent allowed by CC-II of the American Society of Mechanical Engineers (ASME) I American Nuclear Society (ANS) PRA Standard. This leaves considerable margin to the total allowable screened LERF contribution, while already accounting for all scenarios with LERF values greater than or equal to 1E-09 as well as a great many of the scenarios with LERF less than 1E-09 via the screening sample.

As a further measure to ensure the validity of the quantitative screening performed, all fire scenarios for both BVPS units will be re-screened for the final implementation FPRA models prior to self-approval, accounting for both CDF and LERF in accordance with RG 1.200 Rev. 2, as part of the Table S-3 implementation items BV1-3108 and BV2-1622 created in response to PRA RAI 22.

Attachment L-15-118 Page 30 of68 PRA RAI 01 e) CS-81-02 (Open Circuits)

The disposition to this F&O indicates that the evaluation of fire-induced open circuits on the secondary side of current transformers (CTs) has not been completed and refers to an on-going effort to track resolution of this industry issue (Implementation Item BV2-1 020 in Table S-3 of the LAR). Explain how these fire-induced open circuits are treated in the Fire PRA. Specifically discuss if the issue is treated by postulating secondary fires in accordance with NUREG/CR-7150, Volume 2, concerning the turns-ratio in a CT. If not, provide justification for the treatment and discuss the impact on the Fire PRA results reported in the LAR.

Response

Fire-induced open circuits on the secondary side of CTs are not modeled within the BVPS fire PRA. Final Disposition of this concern is in the responses to SSD RAI 02(a) and 02(b) which refer to a plant-specific CT open circuit analysis to be completed in order to resolve this issue. As a result of the analysis, any CT identified as continuing to present a secondary fire risk will be modified in order to eliminate such risk. Therefore, since this failure mode will either be evaluated as not presenting a credible risk of causing a secondary fire at the CT enclosure, or eliminated due to plant modifications per implementation items BV1-2706 and BV2-1 020, no additional modeling of this concern in the Fire PRA will be necessary.

PRA RAI 02 - Internal Events PRA F&Os Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. RG 1.200 describes a peer review process utilizing an associated ASME/ANS standard (currently ASME/ANS-RA-Sa-2009) as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established. The primary results of a peer review are the F&Os recorded by the peer review and the subsequent resolution of these F&Os.

Clarify the following dispositions to Internal Events F&Os and SRs assessment identified in the LAR supplement dated February 14, 2014 that have the potential to impact the Unit 1 and 2 Fire PRA results and do not appear to be fully resolved:

Attachment L-15-118 Page 31 of68 a) DA-09 (From Tables 1-1 and 2-1 ): (Common Cause Modeling of Diesels)

The F&O states that: "[a] discussion of decoupling the Unit 2 diesels from the Unit 1 should be included", as part of documentation needed of Common Cause Failure (CCF) modeling. The F&O disposition does not address this specific concern of "decoupling" CCFs for the Unit 1 and 2 diesels. Describe the CCF modeling for the diesel generator, and justify "decoupling" CCF modeling for Unit 1 diesels from Unit 2 diesels.

Response

Currently, each Units' emergency diesel generators (EDGs) model common cause failures between their respective EDGs for failures to start, failure to load and run during the first hour, and failure to run for both 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />. Each unit also includes CCF modeling between their following EDG supporting components.

• Normal supply breakers fail to open

• EDG output breakers fail to close

• Fuel oil level switch fails on demand

• Fuel oil pumps fail to start

• Fuel oil pumps fail to run

• Fuel oil check valves fail to open

• Service/River water cooling motor operated valves fail to open

• Ventilation dampers fail to open

• Ventilation fans fail to start

• Ventilation fans fail to run In accordance with ASME/ANS-RA-Sa-2009 Supporting Requirement SY-82, Capability Category 2, there are no requirements to model inter-system common cause failures, which forms the basis for "decoupling" the EDGs between the Units. Further justification for "decoupling" the CCFs of the BVPS-1 and BVPS-2 EDGs are as follows:

1. The BVPS-1 and BVPS-2 EDGs have different manufactures, designs, and specifications. The BVPS-1 EDGs consist of a diesel engine directly coupled to a synchronous generator equipped with a regulated static type exciter. The EDGs are manufactured by General Motors (Electro-Motive Division), and are 20 cylinder, 2 cycle, turbocharged "V" diesel engines rated at 3,950 brake horsepower (BHP). The two BVPS-1 EDGs each have a continuous rating of 2,850 kW at 2,000 hour/year. The BVPS-2 EDGs also consist of a diesel engine that is coupled directly to a synchronous generator equipped with a regulated static type exciter; but the diesel engines are manufactured by Colt-Pielstick, and are 12 cylinder, 4 cycle "V" diesel engines rated at 5,899 BHP. The two BVPS-2 EDGs each have a continuous rating of 4,238 kW at 8, 760 hour/year.

Attachment L-15-118 Page 32 of68

2. Each of the BVPS-1 and BVPS-2 EDGs are located in different buildings at the site, are physically and electrically isolated from each other, and have their own independent room heating and cooling ventilation system.

3. The BVPS-1 and BVPS-2 EDGs do not share any support systems (such as the fuel oil system, air starting system, cooling water system, lube oil system, combustion air intake and exhaust system).

4. The BVPS-1 and BVPS-2 EDGs have different operating and maintenance procedures, and unavailability from planned, repetitive activities (such as Operating Surveillance Tests) are typically scheduled during different weeks.

Therefore, since the BVPS-1 and BVPS-2 EDGs do not share common designs, common locations, common supporting systems, common procedures or maintenance activities they are considered to be "decoupled" from common cause failures.

PRA RAI 02 b) SY-01 (from Tables 1-1 and 2-1): (Common cause failure of charging pumps)

This F&O identifies potential common mode failure (CCF) of the charging pumps when seal heat exchanger cooling because of increased water temperature in the Volume Control Tank (VCT). It appears that "swap-over" from the VCT to the Refueling Water Storage Tank (RWST) will prevent a temperature increase (i.e., 123 °F) that would fail the charging pumps.

Neither the operator actions to "swap-over" from the VCT to the RWST tank nor actions to monitor the temperature in the VCT are modeled in the Fire PRA. Provide further justification for not modeling this CCF failure in the Fire PRA or incorporate this CCF into the integrated analysis provided in response to PRA RAI 3.

Response

In the fire PRA models for both BVPS-1 and BVPS-2, the RWST is the credited suction source to the charging pumps. The VCT is not credited because it relies on normal operation of the letdown system for inventory, which includes a number of fail-closed air-operated valves (AOVs). Since the instrument air system cannot be relied upon following a fire, it is set to a guaranteed failure in the fire PRA models for all fires. This assumption causes letdown to be isolated once the AOVs are closed resulting in a low-low VCT level and the automatic swap-over to the RWST, which places a demand on the VCT isolation valves to close and the RWST supply valves to open. This swap-over to the RWST will then prevent the heat-up of the charging pump suction water that could fail the pumps if the non-regenerative heat exchanger cooling is lost. The direct automatic swap-over to the RWST on a safety injection signal following fires is also

Attachment L-15-118 Page 33 of68 credited, if such a signal is generated. The fire PRA models account for both the independent failures and CCFs of the valves that perform these actions.

If this automatic swap-over to the RWST does not occur due to fire-induced failures of the suction valves, operators are credited to manually perform the swap-over by performing operator action OPRC 16 to locally align the RWST to the suction of the charging pumps, and operator action OPRC17 to locally close the VCT outlet valves.

Additionally, if a fire induces a spurious closure of a VCT isolation valve the low-low VCT level signal will not be generated for the automatic swap-over to the RWST, thereby cutting off the charging pump suction supply from the VCT. For these fire scenarios, the running charging pump is assumed to be lost due to cavitation, and operator actions OPRHH6F1, OPRHH6F2, and OPRHH6F3 are credited to identify that the VCT valves have closed (depending on the instrumentation available) and to perform a manual swap-over of the charging pump suction source to the RWST before starting an additional pump. If the seal water heat exchanger also loses cooling directly due to a fire, operator action OPFCI1 isolates the reactor coolant pump (RCP) seal return line to prevent hot sealleakoff water from mixing in with the charging pump suction water and challenging the available pump net positive suction head (NPSH).

Failure of this action is assumed to fail all three charging I high head safety injection (HHSI) pumps.

Although success of these operator actions credited in the fire PRA models will ensure that at least two charging pumps are available if the VCT NPSH is lost, it does not currently model the preemptive actions taken by the operators to manually perform a swap-over from the VCT to the RWST given that a fire occurs, if the loss of instrument air is delayed or does not occur at all in a real fire. These actions were assumed to be guaranteed success in the current PRA models. In response to PRA RAI 03, the operator actions to perform this preemptive manual swap-over to the RWST for all fires for both BVPS Units will be properly aligned as a sensitivity, and the results will be reported accordingly.

PRA RAI 02 c) TH-02 (From Tables 1-1 and 2-1): (MCR HVAC Dependency)

The F&O disposition states that heat-up calculations for the common Main Control Room (MCR) indicate that if MCR HVAC fails it takes longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the ambient air temperature to exceed 115 oF when air mixing is assumed. To ensure air mixing, operators must immediately ("within 10 minutes") open all of the common doorways between the control rooms (and setting up portable fans is recommended). It is not clear whether opening all common doorways is a proceduralized action or whether there may other reasons to keep the doors shut (sic). Provide justification for

Attachment L-15-118 Page 34 of68 not modeling HVAC dependency or operator actions required to ensure air mixing. If justification cannot be provided, then model HVAC dependency as part of the integrated analysis provided in response to PRA RAJ 3.

Response

Subsequent to the disposition of this facts and observations (F&O), a modification was made to the BVPS control rooms to remove the common partitioning wall and doorways between the units, and make the BVPS control room one common area. With the common wall removed, the requirement for the operator action to open all common doorways between the control rooms when the heating, ventilation, and air conditioning (HVAC) for one unit is unavailable, as recommended in the heat-up calculation, are no longer required to ensure air mixing. In July 2005, the heat-up calculation was revised to evaluate the effect of the removal of the common wall between the control rooms, and was shown not to have an adverse impact on the original results. The completely open space between the control rooms that now exists is beneficial for the natural buoyancy driven air flow, and provides an unobstructed recirculation path for the development of a homogeneous air mixture.

Operator action to ensure air mixing is no longer required with the removal of the common wall, and with the failure of the BVPS-1 or BVPS-2 MCR HVAC it still takes longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the MCR ambient air temperature to exceed 115 °F. This provides the justification for not modeling HVAC dependency or operator actions to ensure air mixing.

PRA RAJ 02 d) LE-05 (From Tables 1-2 and 2-2): (Severe accident SGTR)

The F&O disposition does not address the acceptability of the analysis of thermally induced SGTRs raised in the F&O. Provide a description of the analysis method used and a justification for the acceptability of the method.

Response

In order to disposition F&O LE-05, the BVPS induced steam generator tube rupture (SGTR) analyses were revised to use a more realistic approach based on the degree of degradation of the steam generator tubes, which includes input from both plant-specific and more recent industry information obtained from NUREG-1570 "Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture," and Electric Power Research Institute (EPRI) Report TR-107623-V1 "Steam Generator Tube Integrity Risk Assessment." These revised analyses were performed for the pressure induced SGTR (PI-SGTR) and thermally induced SGTR (TI-SGTR) by the same vendor that developed

Attachment L-15-118 Page 35 of68 the WCAP-16341 "Simplified Level2 Modeling Guidelines" methodology to realistically treat induced SGTRs and meet the technical adequacy of the ASME PRA Standard Capability Category II criteria. In that respect, the BVPS induced SGTR analyses used an acceptable methodology to treat TI-SGTRs that is consistent with the same approach developed in WCAP-16341, by incorporating plant-specific procedures, failure data, design features, and conditions that could impact SG tube failure probabilities.

The BVPS TI-SGTR methodology and results are documented in Appendix F of the PRA-BV1-AL-R05a-LE and PRA-BV2-AL-R05a-LE Level 2 LERF analysis notebooks.

The important features that define the TI-SGTR analysis include: (1) whether the RCS is not depressurized, (2) end state probabilities for the number of steam generators (SGs) depressurized from the PI-SGTR analysis, (3) the condition of the RCP loop seals and core barrel, and (4) whether a cleared loop seal occurs in an intact or depressurized SG. A brief description of the BVPS TI-SGTR analysis, which is comprised of a small, five top event tree is provided below:

Top Event: RCS Not Depressurized The first Top Event in the TI-SGTR tree assumes that the sequences propagating through this tree have high RCS pressure, a dry steam generator, and that a PI-SGTR did not occur. This implies that a loss of feedwater occurs at some point during the accident scenario. It is assigned a split fraction of 1.0.

Top Event: End States from PI-SGTR The number of SGs depressurized is an important parameter in both PI-SGTR and TI-SGTR event trees. The TI-SGTR split fractions are determined from the end states of the PI-SGTR event trees. These end states indicate when no PI-SGTR has occurred for a given number of depressurized SGs. The values used in this top event's split fractions are normalized to remove the probability of having a PI-SGTR.

Top Event: Loop Seal and Core Barrel Cleared This top event addresses whether the RCS crossover leg loop seal to the RCP is cleared or intact. During station blackout (SBO) sequences, the RCS loop seal can be cleared by a 480 gallon per minute (gpm) RCP seal failure. Therefore, the split fraction value is the same probability of having a 480 gpm seal leak used in the BVPS Level 1 PRA model. For non-SBO sequences, this analysis does not credit the operator action to "bump the RCPs," so the probability of having a loop seal cleared is similar to the SBO value.

Top Event: Loop Seal Cleared in Depressurized Steam Generator This question applies to sequences that result in a cleared RCS crossover loop seal with at least one SG at high pressure and at least one SG at low pressure.

Attachment L-15-118 Page 36 of68 This question asks whether the cleared RCS loop seal occurs in the intact or depressurized SG. This methodology assumes that there is no connection between the RCS loop with a depressurized SG and a cleared loop seal.

Therefore, there is a random chance of having the cleared loop seal on the depressurized SG (that is, the cleared loop seal has equal chances of occurring on the loop with the pressurized SGs as on the loop with the depressurized SG).

Top Event: IS (TI-SGTR)

This question summarizes relevant information regarding TI-SGTR. The methodology to determine the likelihood of a TI-SGTR given the RCS and SG conditions determined earlier in the TI-SGTR event tree is based on the values presented in EPRI TR-1 07623-V1.

PRA RAI 02 e) SC-A5 (From Tables 1-2 and 2-2) and AS-1 0 (From Tables 1-1 and 2-1 ):

(Modeling of actions needed after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to reach a stable state)

The F&O disposition addresses evaluation of the potential need to refill the RWST after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to achieve a stable state but does not state whether additional evaluations may be needed for actions associated with other sequences. Justify that stable plant conditions for all sequences are achieved in the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time or that appropriate mission times are used for sequences that extend beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, in accordance with the PRA standard.

Response

For the BVPS PRA models, core damage is assumed to occur when the loss of core heat removal progresses beyond the point of core uncovery, and the Modular Accident Analysis Program (MAAP) predicted core exit temperatures exceed 1,200 degrees Fahrenheit (°F) and peak fuel node temperatures exceed 1,800 °F. If RCS conditions are controllable at or near desired values, and these core damage conditions do not occur within the mission time for the evaluated accident sequence groups, generally defined as 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> beginning with the occurrence of the initiating event, the plant is considered to be in a stable state.

In order to determine if the evaluated accident sequence groups resulted in a stable state, the MAAP output parameters were plotted to show that the reactor vessel level was stable and not trending towards core uncovery, and that the core temperatures were not increasing towards the core damage threshold values at the end of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. If these parameters were found to be trending towards core uncovery or core damage temperatures, the accident sequence group was assumed to go to core

Attachment L-15-118 Page 37 of68 damage, even though they did not reach the core damage threshold values at the end of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time.

All accident sequence groups that were modeled as success showed stable reactor vessel levels and core temperatures, and were determined to achieve a stable state in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> based on the MAAP success criteria output documented in the appendices of the PRA-BV1-AL-R05a-SC and PRA-BV2-AL-R05a-SC Level 2 success criteria analysis notebooks. Additionally, the disposition of F&O SC-A 1-01 justified the success of some accident groups that relied on operator actions to provide continued makeup to the RWST beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in order to maintain the stable plant conditions (that is, accident groups that could not provide long term recirculation cooling from the containment sump).

Furthermore, for some evaluated accident groups, the plant may be trending towards the core damage threshold parameters at times well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> because of known RCS leakage conditions without any means to make up lost inventory (that is, SBO-induced RCP seal failures). In order to justify that the stable plant conditions are maintained for these SBO accident sequence groups, the MAAP run times were extended to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and the output parameters were plotted to show that the reactor vessel level was stable and not trending towards core uncovery, and that the core temperatures were not increasing towards the core damage threshold values at the end of the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. If they were found to be trending towards the core damage threshold values, they too were considered to go to core damage.

PRA RAI 02 f) HR-PR-006 (From Tables 1-3 and 2-3): (Time window inconsistency)

The F&O disposition indicates significantly different time windows for HFE ZHEMA2 for the two units (4.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> vs 13.26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br />). Explain the reason for this difference, and justify that this does not represent a modeling inconsistency.

Response

ZHEMA2 for BVPS-1 has a system time window (Tsw) of 258 minutes(= 4.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />) based on MAAP Runs. The BVPS-1 Tsw represents the timeframe from when the primary plant demineralizer water storage tank (PPDWST) level is at 7.5 feet (t = 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />) to the time when the PPDWST is emptied and requires river water system makeup (= 4.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />). The cue delay time from reactor trip in this case is accounted for prior to entering the Tsw, such that reactor trip occurs more than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> before the Tsw for this human failure event (HFE) is assumed to begin. Also, this Tsw does not account for the additional time from the point when the PPDWST is empty until the steam generators boil dry.

Attachment L-15-118 Page 38 of68 ZHEMA2 for BVPS-2 has a Tsw of 795.6 minutes (=13.26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br />) based on MAAP-DBA runs. The BVPS-2 Tsw represents the timeframe from plant trip (t = 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />) to cue delay time (Tdelay = 8.49 hours5.671296e-4 days <br />0.0136 hours <br />8.101852e-5 weeks <br />1.86445e-5 months <br />) at which point PPDWST requires service water system makeup plus the time from PPDWST empty to SGs boiling dry. This Tsw includes the entire event, beginning at reactor trip, even though more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> pass before the cue to trigger this HFE is received.

The BVPS-1 and BVPS-2 ZHEMA2 actions are not modeled fundamentally differently; however, they did use different timing in both cue delay timing and use of SGs boiling time versus time to minimum PPDWST level. To be consistent, FENOC will update the BVPS-1 HFE to reflect the BVPS-2 ZHEMA2 cue delay timing approach in the human reliability analysis (HRA) calculator. This will then result in a more consistent Tsw comparison for HFE ZHEMA2 for the two units (12.92 hours0.00106 days <br />0.0256 hours <br />1.521164e-4 weeks <br />3.5006e-5 months <br /> for BVPS-1 vs 13.26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> for BVPS-2). Note that since the effective allowable time window for action following the cue is not significantly different, and since a great deal of time margin is still available beyond the time required to perform the action, updating to this timing for the BVPS-1 ZHEMA2 action has no impact on the HFE value that would be used in the RISKMAN model, that is the HEP = 2.7E-03 with EF=5 remains the same. Hence, there is no impact on the risk numbers. Additionally, the BVPS-2 ZHEMA2 should not have included the time for the SGs boiling dry; rather the system time window should conclude at the time when the required PPDWST level is at a level that would prevent a vortex from forming in the tank (similar to the BVPS-1 approach). Modeling the BVPS-2 ZHEMA2 HFE in this manner increased the HEP from 2.2E-03 to 6.9E-03, which subsequently increased the base internal events CDF an insignificant amount (2.0E-10).

In response to PRA RAI 03, the ZHEMA1 and ZHEMA2 actions for both BVPS Units will be properly aligned as a sensitivity, and the results will be reported accordingly.

PRA RAI 06 - Reduced Transient Heat Release Rates Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. In letter dated July 12, 2006, to NEI (ADAMS Accession No. ML061660105), the NRC established the ongoing FAQ process where official agency positions regarding acceptable methods can be documented until they can be included in revisions to RG 1.205 or NEI 04-02. Methods that have not been determined to be acceptable by the NRC staff require additional justification to allow the NRC staff to complete its review of the proposed method.

Attachment L-15-118 Page 39 of68 The licensee's analysis indicates that although a bounding 98% heat release rate (HRR) of 317 kW from NUREG/CR-6850 was typically used, reduced transient fire HRRs were applied as part of detailed fire modeling for some fire areas. Discuss the key factors used in Unit 1 and 2 Fire PRAs to justify the reduced rate below 317 kW per the guidance endorsed by the June 21, 2012, memo from Joseph Giitter to Biff Bradley, "Recent Fire PRA Methods review Panel Decisions and EPRI 1022993, 'Evaluation of Peak Heat Release Rates in Electrical Cabinets Fires"' (ADAMS Accession No. ML 120172A406) and associated documentation (ADAMS Accession No. ML113130446). Include in this discussion:

d) Explanation of the impact of using reduced HRRs on the analysis.

Response

Reducing the transient HRR, where reasonable and justifiable, allows for a more realistic transient fire ZOI. The reduced ZOI, for the applicable transient fire scenarios, results in fewer secondary combustibles involved and a smaller fire PRA target damage set. This ultimately provides for a more realistic core damage frequency and large early release frequency for the transient scenarios and respective fire compartments.

PRA RAI 13 - PRA Treatment of Dependencies between Units 1 and 2 Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. In letter dated July 12, 2006, to NEI (ADAMS Accession No. ML061660105), the NRC established the ongoing FAQ process where official agency positions regarding acceptable methods can be documented until they can be included in revisions to RG 1.205 or NEI 04-02. Methods that have not been determined to be acceptable by the NRC staff or acceptable methods that appear to have been applied differently than described require additional justification to allow the NRC staff to complete its review of the proposed method.

In Tables W-2a and W-2b of the LAR, with the exception of common fire compartments associated with the Intake Structure and the off-site power transformers, the risk associated with fire in Unit 1 fire compartments do not appear to contribute to Unit 2 fire risk, and risk associated fires in Unit 2 fire compartments do not appear to contribute to Unit 1 fire risk. Attachment B and K of the LAR indicate that systems are shared between units (e.g., fire pumps). It is not clear how the risk of fire in opposite unit and the risk associated with shared systems were addressed in the Fire PRA. Explain how the risk contribution of fires in one unit is addressed for the other unit due to the physical layout of the

Attachment L-15-118 Page 40 of68 units and the interdependency of shared systems. Include identification of locations where fire in one unit can affect components in the other unit and a description of shared systems. Note that discussion in PRA RAI 10 which refers to dual unit MCR abandonment is an example of this interdependency. If the contribution of fires originating in one unit is not addressed for the other unit, and/or if the interdependency of shared systems is not accounted for in the Fire PRA, provide justification to show there is no impact on the application or incorporate this modeling as part of the integrated analysis provided in response to PRA RAI3.

Response

BVPS-1 and BVPS-2 are physically separate units with few inherently shared (permanently aligned) systems except for the fire water pumps and non-safety Emergency Response Facility (ERF) busses, and only a few additional systems which can be shared by use of deliberate off-normal alignments. The internal events PRA models credit one such off-normal alignment whereby one unit's emergency diesel generator can be aligned to power an emergency buss at the opposite unit, but the fire PRA models do not credit this alignment due to the time required to make the connections in conjunction with the increased human action delay time associated with the response to the fire itself. Any other potentially shared systems are not credited in the Fire PRA models.

In terms of the potential for a single fire to affect both units simultaneously, the fire PRA models for BVPS-1 and BVPS-2 are completely separate and the plant partitioning task was performed in such a manner as to maintain this separation. When defining the physical analysis units (fire compartments) to support the NFPA 805 transition, each compartment was assigned a unit designator of "1-" (BVPS-1 ), "2-" (BVPS-2), or "3-"

(shared BVPS-1 I BVPS-2 compartment). This designator was assigned based on the equipment and cables contained within the compartment, and any compartment containing equipment and/or cables credited in the fire PRA for both units received a "Unit 3" designation. The "Unit 3" compartments were included in the fire PRA models for both BVPS-1 and BVPS-2, and ignition sources from both units were counted in the fire scenarios created for each unit. One example is the common intake structure pump cubicle B. This room is defined as fire compartment 3-IS-2, and was considered in the fire PRA for each unit. Contained within this compartment are the BVPS-1 river water pump 1B, as well as the BVPS-2 service water pump 1C. The BVPS-1 river water pump is an ignition source in the BVPS-2 detailed fire modeling, and the BVPS-2 service water pump is likewise an ignition source in the BVPS-1 detailed fire modeling.

Furthermore, since this is a common compartment it contains HVAC support equipment installed for both units; however, such cross-unit support systems are conservatively not credited in the fire PRA models (that is, BVPS-1 HVAC is not credited to support the BVPS-2 pump, and the BVPS-2 HVAC is not credited to support the BVPS-1 pump).

Thus, both the BVPS-1 and BVPS-2 fire PRA models have the appropriate fire effects

Attachment L-15-118 Page 41 of68 from the opposite unit built into each individual plant model, in such a way as to properly support their existence as completely separate PRA models.

With regard to the fire pumps as mentioned above, the motor-driven fire pump is located in intake structure pump cubicle A (3-IS-1 ), and the diesel-driven fire pump is located in intake structure pump cubicle D (3-IS-4). Since these compartments share the "Unit 3" designation, fires in these compartments are postulated in both the BVPS-1 and BVPS-2 fire PRA models. They are modeled only as whole-room damage scenarios at each unit, and did not need to be refined via detailed fire modeling. Each cubicle uses the whole-room fire ignition frequency at both BVPS-1 and BVPS-2, since all sources in the compartment were counted at each unit. The ERF busses are also similarly housed in "Unit 3" compartments, which are likewise treated as whole-room damage scenarios at both units.

Since there is no longer a dividing wall between BVPS-1 and BVPS-2, the MCR is another common "Unit 3" fire compartment with potential to cause dual unit impacts. In particular, the potential for dual unit MCR abandonment due to habitability issues is of concern. Given the specialized nature of the analysis performed in support of this issue, the details of the potential for dual unit MCR abandonment due to habitability concerns will be discussed in the response to PRA RAI 10.

PRA RAI14- State of Knowledge Correlation (SOKC)

Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. In letter dated July 12, 2006, to NEI (ADAMS Accession No. ML061660105), the NRC established the ongoing FAQ process where official agency positions regarding acceptable methods can be documented until they can be included in revisions to RG 1.205 or NEI 04-02. Methods that have not been determined to be acceptable by the NRC staff or acceptable methods that appear to have been applied differently than described require additional justification to allow the NRC staff to complete its review of the proposed method.

LAR Section 4.7.3 explains that sources of uncertainty in the Fire PRA were identified and specific parameters were analyzed for sensitivity in support of the NFPA 805 Fire Risk Evaluation process. It is further explained that the sensitivity to uncertainty associated with specific Fire PRA parameters was quantitatively addressed in stand-alone analyses for both Units 1 and 2. Based on this explanation it is appears that the risk results presented in Attachment W of the LAR are point estimates and do not include parameter uncertainty. Explain how

Attachment L-15-118 Page 42 of68 state-of-knowled ge correlations (SOKCs) were taken into account in the Unit 1 and 2 Fire PRA quantifications, including random failure probabilities, circuit failure likelihood and hot short duration, and non-suppressio n probabilities.

Explain whether the LAR Attachment W risk estimates adequately account for the impact of SOKC on the mean results. If SOKC for these parameters were not accounted for in the Fire PRA quantification, then include the impact of the SOKC for these parameters in the integrated analysis performed in response to PRA RAI 3.

Response

Since the structure of the BVPS-1 and BVPS-2 models and PRA software (RISKMAN) do not allow for a complete uncertainty calculation within a reasonable time frame, the risk metrics in the LAR Attachment Ware presented in the form of point estimate values. The mean values of CDF and LERF estimated from the uncertainty analysis are expected, in general, to be higher than the point estimates calculated using the input parameter mean values, depending on the degree to which the input parameters are correlated. The purpose of the uncertainty analysis performed for both units was to demonstrate the significance of the difference between the point estimate and mean values of the risk results.

Overall Fire Risk Quantification Uncertainty Analysis The CDF and LERF for each fire scenario are given by:

and where

= Scenario ignition source bin frequency

= Scenario ignition source weighting factor (SF.Pns)~k = Probability of scenario fire induced damage state CCOP~k = Conditional core damage probability (CCDP) for scenario fire induced damage state CLERP~k = Conditional large early release probability (CLERP) for scenario fire induced damage state

Attachment L-15-118 Page 43 of68 The summations are performed over all scenario damage states to quantify the total CDF and LERF for the plant.

In the point estimate analysis, mean values are used for each of the parameters involved, giving estimates of the mean values of CDF and LERF for the scenario. The scenario CDFs and LERFs are summed over all scenarios to derive the overall mean CDF and LERF for the plant.

In the uncertainty analysis, the terms in the above expressions are replaced by probability distributions representing the uncertainty in each term. For the risk-significant scenarios, the uncertainty distributions for the total CDF and LERF are calculated by combining these probability distributions, as products in the above expressions for the scenario CDF and LERF and then as summations for the total CDF and LERF for risk-significant scenarios. It should be noted that since the mean value is only affected by SOKC of the probabilities of the basic events appearing in the same cutset (NUREG-1855, Vo.l1), the ignition frequency, weighting factor and probability of fire damage state (SF.Pns) from the equation above are considered independent. In this way the only term affected by SOKC is CCDP (CLERP) for a given fire scenario.

Uncertainty in the fire-induced CCDP and CLERP SOKC can be attributed to uncertainty in the following parameters:

• Component random and common cause failure rates

• Circuit failure mode likelihood (hot short probability)

• Human error probability Note that the hot short duration has not been considered as a mitigation factor in the current BVPS-1 and BVPS-2 Fire PRA models, although it will be considered in the response to PRA RAI 03.

The CCDP and CLERP analysis was performed using the "Big Loop" monte carlo calculation function of the RISKMAN software. The method used in RISKMAN essentially samples all the parametric distributions in the model and applies each sample value of each parameter to all the basic events which have the same parameter.

The system/top event failure probabilities are next re-quantified using the sampled value from all the parameters (including component failure rates and unavailability values, human error probability, hot short probability, etc.). The fire-induced accident sequences are next quantified using the updated system/top event split fraction values to obtain a sample CCDP and LERF value. The process is repeated thousands of times to obtain sufficient number of CCDP and CLERP sample values to develop the distributions for the fire-induced CCDP and CLERP. The "Big Loop" monte carlo approach therefore inherently considers SOKC.

Attachment L-15-118 Page 44 of68 In response to PRA RAI 03, the uncertainty analysis for the fire-induced CDF and LERF will be re-evaluated taking into account the SOKC as described above. The mean CDF value and the mean LERF value from the uncertainty analysis will be compared to the CDF and LERF values calculated using the point estimate, and the adequacy of the results will be appropriately addressed.

PRA RAI 15 - Use of NUREG-1921 Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. In Jetter dated July 12, 2006, to NEt (ADAMS Accession No. ML061660105), the NRC established the ongoing FAQ process where official agency positions regarding acceptable methods can be documented until they can be included in revisions to RG 1.205 or NEI 04-02. Methods that have not been determined to be acceptable by the NRC staff or acceptable methods that appear to have been applied differently than described require additional justification to allow the NRC staff to complete its review of the proposed method.

LAR Section 4.5.1.2 indicates that a draft version of NUREG-1921 was used to develop the Unit 1 and 2 Fire PRAs. Discuss the impact of using the draft NUREG-1921 rather than the final NUREG-1921 on the risk results presented in the LAR. If necessary, include the impact in the integrated analysis performed in response to PRA RAJ 3.

Response

The version of NUREG-1921 that is indicated is the draft that was published for public comment in the Federal Register (74 FR 6581 0) on December 11, 2009. The final version of NUREG-1921, "EPRI/NRC-RES Fire Human Reliability Analysis Guidelines,"

was issued July 2012. LAR section 4.5.1.2 was written using words from an earlier version of the fire human reliability analysis (HRA) documentation which supported peer review; however, the HRA used in the LAR submittal does reflect the July 2012 final report, and is properly characterized in the current BVPS fire HRA PRA notebooks as indicated below. Hence, there is no impact on the risk results presented in the LAR.

The BVPS-1 Fire HRA PRA Notebook which supported the peer review was originally dated January 20, 2011 as Revision 5. The BVPS-2 Fire HRA PRA Notebook which supported the peer review was originally dated February 3, 2012 as Revision 5. Both notebooks state:

Attachment L-15-118 Page 4S of68 The review and evaluations conducted by this task are performed in accordance with NUREG/CR-68SO (Reference 4.7) Task 12 and NUREG-1921 (EPRI1019196),

EPRI/NRC-RES Fire Human Reliability Analysis Guidelines, which was released for public comment in November 2009 (Reference 4.3).

The current BVPS-1 Fire HRA PRA Notebook which directly supports the LAR submittal was dated December 19, 2013 as Revision SF. The current BVPS-2 Fire HRA PRA Notebook which directly supports the LAR submittal was dated December 19, 2013 as Revision SF. Both notebooks now state:

The review and evaluations conducted by this task are performed in accordance with NUREG/CR-68SO (Reference 4.7) Task 12 and NUREG-1921, EPRI/NRC-RES Fire Human Reliability Analysis Guidelines, which was released in July 2012 (Reference 4.3).

PRA RAI 16 - Fire PRA Credit for Westinghouse RCP Seals NFPA 805 Section 2.4.3.3 states that the PRA approach, methods, and data shall be acceptable to the NRC. Section 2.4.4.1 of NFPA-805 further states that the change in public health risk arising from transition from the current fire protection program to an NFPA-805 based program, and all future plant changes to the program, shall be acceptable to the AHJ. RG 1.174 provides quantitative guidelines on core damage frequency, large early release frequency, and identifies acceptable changes to these frequencies that result from proposed changes to the plant's licensing basis and describes a general framework to determine the acceptability of risk-informed changes. The NRC staffs review of the information in the LAR has identified the following information that is required to fully characterize the risk estimates.

LAR AttachmentS, Table S-2, presents a modification (i.e., BV1-3062 and BV2-0828) to install a low leakage reactor coolant pump (RCP) shutdown seals (SDS). The LAR indicates that the upgraded seals are credited in the Fire PRA and Attachment W shows that they have an appreciable impact on reducing risk.

Given recent concerns about the operation of the new Westinghouse RCP shutdown seals, the risk reduction credit that might be taken in this application for upgraded RCP seals may be optimistic. The NRC is accepting models of SDS failure based on the best available information at the time of transition when accompanied by assurance that accepted models will be used when available.

For Units 1 and 2:

a) Describe the RCP seal upgrade identified in Attachment S of the LAR;

Attachment L-15-118 Page 46 of68 b) Identify the technical basis (e.g., the topical report) and discuss the credit taken in the Fire PRA for the RCP seal upgrade. If the most recent topical report submitted to the NRC for the Westinghouse Gen Ill Shutdown Seals (i.e., PWROG-14001-P/NP) is not the basis for the credit taken, then justify the technical basis for credit taken in the Fire PRA; and, c) Provide a Table S-3 implementation item stating that BVPS will use NRC accepted SDS failure models as these become available to confirm, as a minimum, that the transition change-in-risk estimates will not exceed the RG 1.205 acceptance guidelines. The implementation item should also clarify that self-approved changes that rely on the SDS failure model will not be undertaken before acceptable models have been developed.

Response

a) FENOC will install the Westinghouse Generation Ill reactor coolant pump SHIELD passive thermal shutdown seal at both BVPS-1 and BVPS-2.

b) The credit for shutdown seals taken in the current BVPS-1 and BVPS-2 fire PRA models is based on the Westinghouse Generation II SDS design, which was current at the time of the BVPS NFPA 805 LAR submittal, in accordance with WCAP-171 00-P Supplement 1 and the implementation guidance in WCAP-17541-P Rev. 2. The credit in the fire PRA will be altered to reflect the newest model in topical report PWROG-14001-P, as part of the aggregate analysis performed in response to PRA RAI 03. This topical report, submitted to the NRC for the Westinghouse Generation Ill shutdown seals, will form the basis for the credit to be taken in the response to PRA RAI 03.

c) BVPS NFPA 805 project open items BV1-3109 and BV2-1623 have been created for BVPS-1 and BVPS-2, respectively. These open items contain the following text (unit-specific differences are denoted by the use of brackets- that is, BV1

[BV2]):

Following NRC acceptance of the Westinghouse Generation Ill shutdown seal model, and prior to using the Fire PRA model for self-approval of fire protection program changes, the Fire PRA model will be updated to account for the NRC accepted SDS failure model per FENOC procedures NOPM-CC-6000, "Probabilistic Risk Assessment Program," NOBP-CC-6001, "Probabilistic Risk Assessment Model Management," and NOBP-CC-6002, "Probabilistic Risk Assessment Applications Management."

This update will be included in the final update for implementation item BV1-3108 [BV2-1622], which will also compare the change in risk and total risk results to the appropriate risk acceptance guidelines and take any necessary action to reduce the change in risk or total risk to meet the acceptance guidelines.

Attachment L-15-118 Page 47 of 68 The description of the implementation items that are planned to be added to LAR Attachment S, Table S-3 is as follows:

Update of Westinghouse SDS modeling in the FPRA model, using NRC accepted failure models, to support self-approval of fire protection program changes.

Appropriate updates to the LAR will be provided in a future submittal.

PRA RAJ 17 - Calculation of VFDR ~CDF and ~LERF Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. Section 2.4.4.1 of NFPA-805 further states that the change in public health risk arising from transition from the current fire protection program to an NFPA-805 based program, and all future plant changes to the program, shall be acceptable to the NRC. RG 1.174 provides quantitative guidelines on core damage frequency, large early release frequency, and identifies acceptable changes to these frequencies that result from proposed changes to the plant's licensing basis and describes a general framework to determine the acceptability of risk-informed changes. The NRC staff review of the information in the LAR has identified the following information that is required to fully characterize the risk estimates.

Section W.2.1 of the LAR provides some description of how the change-in-risk and the additional risk of recovery actions associated with VFDRs is determined but not enough detail to make the approach completely understood. Provide the following:

a) A detailed definition of both the post-transition and compliant plant models used to calculate the reported change-in-risk. Include description of the model adjustments made to remove VFDRs from the compliant plant model, such as adding events or logic, or use of surrogate events. Also, include explanation of how VFDR and non-VFDR modifications are addressed for both the post-transition and compliant plant models. Include explanation of whether the approach is consistent with guidance in FAQ 08-0054, "Demonstrating Compliance with Chapter 4 of NFPA 805," and FAQ 07-0030, "Establishing Recovery Actions."

Response

In the case of each fire compartment for which quantitative VFDR evaluations are performed, the PRA model undergoes two stages of changes in order to calculate the reported change-in-risk. A description of this process is given below:

Attachment L-15-118 Page 48 of68 The evaluation begins with the post transition PRA model and this model includes all proposed modifications. This model is referred to as the R1 model.

A sensitivity model is then created from the R 1 model described above, by removing credit for those modifications designated as overall risk-reduction measures (specifically, installation of RCP shutdown seals and incipient detection systems) which will be used to calculate risk offset. This model is referred to as the R3 model. The change in risk associated with removal of these modifications equates to the risk offset applied to the fire compartment.

Using the R3 model, VFDRs are resolved in turn by making adjustments to the model to remove the VFDR, which are described in more detail below. This creates the compliant case model and is referred to as the R4 model. It should be noted that the R3 and R4 models both credit the same set of modifications.

Compliant case models are created for each individual VFDR in order to calculate the change-in-risk associated with each VFDR. The cumulative change-in-risk associated with all VFDRs for a given fire compartment is calculated by resolving all VFDRs simultaneously.

The absolute delta risk associated with each VFDR is then calculated by subtracting the compliant case risk (R4) from the R3 case described above.

The net delta risk for the compartment is then calculated by adding the risk offset to this absolute delta risk.

Model adjustments were made to the post transitioning model described above in order to remove VFDRs and create a compliant case. Model adjustments performed to evaluate VFDRs were consistent with the guidance of FAQ 08-0054. Modeling of the compliant case is performed by protecting components associated with the VFDR from fire damage. This is implemented in the PRA model using one or more of the following methods:

The specific component fire basic events associated with the VFDR were set to guaranteed success; or for certain VFDRs, it was more appropriate to set operator manual action(s) to guaranteed success to remove the VFDR. This was performed by setting the fire human error probability (HEP) values associated with the operator manual action to guaranteed success (0.0), consistent with the guidance presented in FAQ 07-0030 regarding additional risk of recovery actions.

When a VFDR was related to loss of instrumentation, the fire operator manual actions reliant on those indicators were determined. To eliminate the VFDR, for these actions the loss of all instrumentation (F3) basic event and partial loss of instrumentation (F2) basic event were set to their no impact (F1) state.

For top events that model fire impact on components but do not include random failures, a split fraction representing "success" (that is, no fire damage) of the

Attachment L-15-118 Page 49 of68 component is used within the logic rule in order to model/reflect the condition that the component is protected from fire damage.

For top events that model fire impact on components and include random failures, a split fraction representing only the random failure of the component/train is used to replace the split fraction representing the random failure and the impact of fire on the component/train within the logic rule in order to model/reflect the condition that the component is protected from fire damage.

In addition, some VFDRs were not modeled in the FPRA due to their low risk contribution. These are discussed in the response to PRA RAI 17(c).

PRA RAI17 b) A separate description of both the post-transition and compliant plant models used to calculate the change-in-risk for the MCR and other abandonment areas. Include a description of the model adjustments made to model the compliant plant and how modifications are credited in the post-transition and compliant plant models.

Response

The post-transition and compliant plant models used for the MCR and all other abandonment areas follow the same description as was provided in response to PRA RAI 17(a), which covers non-abandonment areas. Creation of the R3 and R4 models from the R1 model, as explained in the response to PRA RAI 17(a), is identical for abandonment areas and non-abandonment areas, including treatment of credit for modifications. The modeling adjustments made to create the compliant case also follow a similar approach to that described in response to PRA RAI 17(a), in which the basic event or HEP related to a particular VFDR are set to success (0.0), or split fraction logic rules are used to force success of a component/train/system, to create the compliant case. The factor which distinguishes the compliant case modeling adjustments for the abandonment areas relates to the potential for transfer of command and control outside the MCR, in the event of loss of sufficient control within the MCR or loss of MCR habitability, and is discussed below.

Dealing with the loss of habitability first, all loss of habitability fire scenarios for BVPS-1 and BVPS-2 were screened out on the basis of their low frequency and contribution to CDF, and as a consequence the delta risk contribution from such scenarios was deemed to be negligible.

The change in risk contribution for other fire scenarios was addressed as follows:

Attachment L-15-118 Page 50 of68 For BVPS-1, abandonment fire areas (namely the MCR (3-CR-1), 1-CS-1 and 1-CR-4) under the current licensing basis may require actions to be taken outside the MCR including actions taken at the BIP. Due to the minimal control and indication available on the BIP, it was determined that, in the absence of MCR habitability issues, command and control will always be maintained in the MCR under NFPA 805. Specifically, component control and instrumentation monitoring may be performed at the BIP and other plant locations to mitigate fire induced failures, but the overall command and control functions will remain in the MCR. In this case, any actions taken outside of the MCR are deemed "recovery actions" and their associated risk was quantified.

Similarly, for BVPS-2 abandonment areas (namely the MCR (3-CR-1), 2-CB-1, and 2-CB-6), fire damage may require manual actions to be taken at the Alternate Shutdown Panel (ASP) and at other plant locations. However, the ASP for BVPS-2 supports control and indication for a substantial array of equipment required for safe shutdown and therefore for BVPS-2 it was determined that command and control may be transferred from the MCR to the ASP in the event of loss of significant control within the MCR. In this case, individual BVPS-2 abandonment fire area fire scenarios were designated as "non-abandonment" or "abandonment," depending upon the associated degree of damage. The delta risk associated with each type of scenario was evaluated as follows:

1. For non-abandonment scenarios for which command and control remains in the MCR, manual actions credited in the plant model and taken at the ASP or other plant locations were treated as recovery actions, and the associated risk was evaluated in the usual manner.

2. For abandonment scenarios, for which command and control would be transferred to the ASP, manual actions taken at the ASP were not designated as recovery actions. No associated risk of these actions was evaluated. Additional risk was evaluated for actions taken at all other locations.

PRA RAI17 c) An explanation of any major changes made to the Fire PRA model or data for the purpose of evaluating VFDRs.

Response

Step 2 of the BVPS NFPA 805 VFDR analysis task plan requires the analyst tore-examine the fire PRA model in order to first identify whether the FPRA addresses the specific VFDR issue and its associated consequences, and if not, whether the change in risk should be addressed qualitatively (that is, to demonstrate a negligible change in risk) or whether a change to the FPRA model is required in order to perform a quantitative evaluation.

Attachment L-15-118 Page 51 of68 The following VFDR issues were identified as requiring further supporting analysis as their consequences were not captured directly in the FPRA:

BVPS-1

• Inadvertent Boron Dilution

• Loss of Reactor Coolant System Subcooling Without the Use of Pressurizer Heaters

• Loss of the Credited BVPS-1 Main Control Room HVAC System Train

• Loss of Charging Pump Cubicle Ventilation

• Fire Damage To the Atmospheric Steam Dump Valves and/or the Residual Heat Release Valve May Cause Failure to Open

• Loss of Nuclear Instrumentation Channels

• Reactor Vent Valve Failure to Open

• Letdown Failure to Isolate (results in LOCA)

• Main Steam Isolation Valves (MSIVs) Fail to Close (results in overcooling with re-criticality and PTS concerns)

• Fire Damage Results in High Airborne Activity in the Auxiliary Building BVPS-2

• Inadvertent Boron Dilution

• Loss of Reactor Coolant System Subcooling Without the Use of Pressurizer Heaters

• Loss of the Credited BVPS-2 Main Control Room HVAC System Train A

• Loss of Charging Pump Cubicle Ventilation

• Fire Damage To the Atmospheric Steam Dump Valves and/or the RHR Valve May Cause Failure to Open

• Loss of Ex-Core Nuclear Instrumentation Channels

• Reactor Head and Pressurizer Vent Valves Failure to Open

• Loss of Emergency Switchgear and Battery Room Cooling

• Letdown Failure to Isolate (results in LOCA)

• MSIVs Fail to Close (results in overcooling with re-criticality and PTS concerns)

After a detailed review, all of the above listed VFDRs, with the exception of fire damage to the MCR HVAC and fire damage to the atmospheric steam dump valves, were dispositioned qualitatively and shown to be negligible risk contributors. The qualitative evaluation of those VFDRs is discussed in the response to PRA RAI 17(d).

The treatment of the MCR HVAC and the atmospheric steam dump valves VFDRs, which were addressed by applying appropriate quantitative modeling or data changes, is summarized in Table 17c:

Attachment L-15-118 Page 52 of68 Table 17c- Treatment of VFDRs Requiring Model or Data Changes VFDR Description Method of Evaluation I Applicability Loss of the The method is described for the BVPS-1 VFDR evaluation. The Credited Main equivalent BVPS-2 evaluation is identical.

Control Room HVAC System Description Train The potential loss of BVPS-1 MCR HVAC ventilation is a I BVPS-1, BVPS-2 challenge to the Nuclear Safety Performance Criteria (NSPC) for RCS inventory and pressure control and vital auxiliaries.

Potential recovery actions to address VFDRs

1. Reliance on the BVPS-2 MCR HVAC systems if available.

2. Install portable ventilation fans to force fresh outside air into the MCR.

Assumptions a) Heat up analysis indicates temporary ventilation must be installed in 1-CR-3 within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. A revised analysis performed as part of the FRE indicates that the critical room temperature will not be exceeded within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The probability of failure is therefore assumed negligible given equipment is staged and tested and over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is available to install.

b) Heat up analysis indicates temporary ventilation must be installed in 1-CR-4 within 1.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />, a revised analysis performed as part of the FRE indicates that the critical room temperature will not be exceeded within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The probability of failure is therefore assumed negligible given equipment is staged and tested and over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is available to install.

Transitioning Case For the transitioning case all fire scenarios modeled in the FPRA compartments of concern are assumed to result in loss of both trains of BVPS-1 MCR ventilation. The frequency of core damage and LERF due to loss of all MCR HVAC is expressed as:

A coF =Ai x [Pf u1 HVAC x Pf u2 HVAC x (PfcR-1TV + PfcR-3TV + PfcR-4TV )]

x CCDP ALERF is assumed to be 0.1 x A.coF where:

Attachment L-15-118 Page 53 of68 VFDR Description Method of Evaluation I Applicability Ai: Frequency of fire in compartment (i) being investigated. This is the sum of the frequencies of all risk significant fire scenarios.

Pf u1 HvAc: BVPS-1 MCR HVAC failure probability= 1.0. For the base case analysis all fires are assumed to lead to loss of all BVPS-1 HVAC.

Pf u2 HvAc: BVPS-2 MCR HVAC failure probability= 3.32E-04.

This is calculated using the fault tree developed to support the Fire Risk Evaluations.

PfcR1-TV: Temporary Ventilation installed to cool MCR = 0.1. The failure probability of temporary ventilation installation is assigned a screening value of 0.1. Given 30 minutes is available, operators would be well aware of the need for action but written procedures are currently not available.

PfcR-3TV: Temporary Ventilation installed to cool 1-CR-3; Pf = 0.0 (see assumption (a) above)

PfcR-4TV: Temporary Ventilation installed to cool 1-CR-4; Pf = 0.0 (see assumption (b) above)

CCDPMcR: Core damage probability given MCR overheats is assumed Pf = 1.0, (no recovery is credited if any of those rooms heats up).

Compliant Case The compliant case is calculated following the same approach as the base case but restoring the train A BVPS-1 MCR HVAC system such that Pf u1 HvAc = 3.64E-03. This is calculated using the fault tree developed to support the Fire Risk Evaluations.

The compliant CDF and LERF are then calculated using the expression above.

Delta Risk The absolute delta risk is the transition risk minus the compliant risk.

Fire Damage To The method is described for the BVPS-1 VFDR evaluation. The

Attachment L-15-118 Page 54 of68 VFDR Description Method of Evaluation I Applicability the Atmospheric equivalent BVPS-2 evaluation is similar (at BVPS-2 the valves are Steam Dump not air-operated and so are not assumed to always fail).

Valves (ASDVs) and/or the Description Residual Heat Fire induced failure to open of the ASDVs and the RHR valve will Release (RHR) challenge the NSPC for decay heat removal. Such failures can be Valve May Cause caused by impacts to the cabling tied to the valves themselves or Failure to Open due to the presumed loss of instrument air. In the event that a I BVPS-1, BVPS-2 main steam safety valve is stuck open, an excessive cooldown will occur. This will challenge the NSPC for reactivity, decay heat removal, and RCS inventory and pressure control.

Potential Recovery Actions Station an operator in the main steam valve room (1-MS-1) to manually control the ASDVs or RHR valve to stabilize the unit.

Transitioning Case Due to the redundancy offered by the SG safety relief valves, failure of the ADVs or RHR valve to open has been shown to present negligible risk in terms of loss of decay heat removal.

However, reliance on a local manual action to open the ASDV or RHR valves has been shown to result in an additional likelihood of an Sl signal due to cycling of the main steam safety valves (MSSVs), with an overall probability of 1.39E-02 or 3.97E-02 for an MSSV to stick open given 70 safety relief valves (SRV) and 200 SRV cycles, respectively. Top event YSIS has been modified to capture this additional failure, by adding basic event XXMSSVSI to YSIS fire-induced safety injection (SI) logic and assigned a value of 1.39E-02 for fires in all compartments except 1-MS-1, and 3.97E-02 for fires in compartment 1-MS-1. The increased probability for 1-MS-1 reflects the fact that entry into this compartment would be required in order to manually control the ADVs or RHR valve and therefore the number of SRV cycles before control could be established would be substantially increased.

Complaint Case The compliant case is modelled by reflecting the fact that the steam generator RHR valve and its associated air supply and control power are free of fire damage by applying the following basic event settings

Attachment L-15-118 Page 55 of68 VFDR Description Method of Evaluation I Applicability RESIDUAL HEAT RELEASE VALVE HCV-1MS-104 FAILS DUE TO FIRE (new basic event added to YSIS fire-induced Sllogic)

Additionally, the condition XXIRIAF=S has been set for split fractions CDE1 through CDE4 in top event CD, to ensure instrument air and control power availability.

Delta Risk The compliant case risk and delta risk for VFDRs associated with loss of ASDVs and the RHR valve is evaluated in each individual FRE PRA input analysis using the above common approach and the absolute delta risk computed as the difference.

Note: The transitioning risk and compliant risk cases referred to above do not credit the replacement RCP seal packages or incipient detection. These non-VFDR design changes are credited later in the risk offset in order to establish the net change in risk.

PRA RAI17 d) A description of the type of VFDRs identified, and discussion whether and how the VFDRs identified, but not modeled in the Fire PRA, impact the risk estimates. Explain whether VFDRs were identified differently for abandonment areas compared to non-abandonment areas, including, any qualitative rational for excluding VFDRs from the change-in-risk calculations.

Response

For BVPS-1 and BVPS-2, VFDRs were written based on separation issues identified in the NSCA analysis. If the plant-specific NSPC were not satisfied for a particular function in a particular area, a VFDR was written. This identification of VFDRs was performed identically for abandonment and non-abandonment areas. The only difference is that an additional VFDR was written for abandonment areas at BVPS-2 (since BVPS-1 never credits abandonment) to capture the potential case in which abandonment may be assumed in the FPRA model for certain scenarios, but operators instead choose to maintain command and control in the control room. In this case the VFDR identifies the use of risk-relevant components available on the ASP as requiring recovery actions, so the delta risk is calculated to represent their use if the ASP is not the Primary Control Station.

Attachment L-15-118 Page 56 of68 VFDRs were also written for additional failures due to issues which are not strictly separation issues. For example, VFDRs are written to capture the effect of assumed failures, such as instrument air (lA), or plant-specific features, such as long-term auxiliary feedwater (AFW) supply. At BVPS-1, the ASDVs and RHR valve are air-operated. Since the lA system is assumed to fail in a fire due to low-temperature components (such as copper pipes and soldered joints) whose survival cannot be ensured if directly exposed to a fire, a VFDR is written identifying the need for a recovery action to locally operate the ASDVs or RHR Valve. Similarly, the credited long-term AFW supply at both units comes from the river water I service water system, which requires a local recovery action to align once the normally aligned tank is depleted. This recovery action is required for all fires, due to plant design, even though there is no specific fire-induced failure of separation which directly causes the need for manual action. For all VFDRs, however, the method of identification was not treated differently between abandonment and non-abandonment areas, excepting the one abandonment-specific VFDR described above.

Please see response to PRA RAI 17 (a) for the overall approach of performing change-in-risk calculations for VFDRs. Step 2 of the BVPS NFPA VFDR analysis task plan requires the analyst to re-examine the fire PRA model in order to first identify whether the FPRA addresses the specific VFDR issue and its associated consequences, and if not, whether the change in risk could be addressed qualitatively or quantitatively outside the fire PRA model (that is, to demonstrate negligible change in risk}, or whether a change to the FPRA model is required in order to perform a quantitative evaluation.

The same process applies to both abandonment and non-abandonment areas.

The following VFDR issues were identified as requiring further supporting analysis:

BVPS-1

• Inadvertent Boron Dilution

• Loss of Reactor Coolant System Subcooling Without the Use of Pressurizer Heaters

• Loss of the Credited BVPS-1 Main Control Room HVAC System Train

• Loss of Charging Pump Cubicle Ventilation

• Fire Damage To the Atmospheric Steam Dump Valves and/or the RHR Valve May Cause Failure to Open

• Loss of Nuclear Instrumentation Channels

• Reactor Head Vent Valve Failure to Open

• Letdown Failure to Isolate (results in LOCA)

• MSIVs Fail to Close (results in overcooling with re-criticality and PTS concerns)

• Fire Damage Results in High Airborne Activity in the Auxiliary Building

Attachment L-15-118 Page 57 of68 BVPS-2

• Inadvertent Boron Dilution

• Loss of Reactor Coolant System Subcooling Without the Use of Pressurizer Heaters

• Loss of the Credited BVPS-2 Main Control Room HVAC System Train A

• Loss of Charging Pump Cubicle Ventilation

• Fire Damage To the Atmospheric Steam Dump Valves and/or the RHR Valve May Cause Failure to Open

• Loss of Ex-Core Nuclear Instrumentation Channels

• Reactor Head and Pressurizer Vent Valves Failure to Open

• Loss of Emergency Switchgear and Battery Room Cooling

• Letdown Failure to Isolate (results in LOCA)

• MSIVs Fail to Close (results in overcooling with re-criticality and PTS concerns)

The following VFDRs were evaluated probabilistically either by changing the fire PRA model or outside of the fire PRA model:

• Loss of the Credited BVPS-1 Main Control Room HVAC System Train

• Loss of the Credited BVPS-2 Main Control Room HVAC System Train A

• Fire Damage To the Atmospheric Steam Dump Valves and/or the RHR Valve May Cause Failure to Open The treatment of these VFDRs is described in the PRA RAI 17 (c) response.

The remaining VFDRs listed above were addressed qualitatively or by performing deterministic calculations as described in Table 17d:

Attachment L-15-118 Page 58 of68 Table 17d - VFDRs Dispositioned as Negligible Risk Contributors VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations Inadvertent Boron The discussion provided below is based on BVPS-1. BVPS-2 is Dilution similar.

I BVPS-1, BVPS-2 Potential Recovery actions to address VFDRs:

Fire induced spurious Both inadvertent dilution paths will be terminated by closure of failure of blender the VCT isolation valves (MOV-1 CH-115C or MOV-1 CH-115E) components and or by closing the primary grade water (PGW) make up control associated valves valve PCV-1 PG-117.

may lead to inadvertent dilution of Discussion the RCS. The Even under various postulated failure modes, the potential rate principle means of of dilution is limited to values which, with indications by alarms, causing an will allow sufficient time to respond to terminate the dilution. The inadvertent boron status of core reactivity and RCS make-up is continuously dilution involves the available to the operator by:

opening of the Primary Grade Water 1. Indication of boric acid and blender flow rates Makeup valve and 2. Chemical volume and control system (CVCS) and PGW failure of the blend indicator lights system valves. 3. PGW header low pressure alarm Spurious opening of 4. Deviation alarms if the boric acid and blended flow rates PCV-1 PG-117 and deviate by more than 10 percent from preset values FCV-1 CH-114A 5. Source range flux indication when reactor is sub-critical together with FCV- High flux at shutdown alarm 1CH-113B or FCV- Indicated source range neutron flux count rates 1CH-114B may result Audible source range neutron flux rate in RCS dilution via 6. With reactor critical the blender makeup Axial flux difference alarm to the VCT inlet or Control Rod Insertion Limit Low and Low-Low Alarm outlet. The resulting Over temperature delta T alarm uncontrolled Over temperature delta T turbine run back reduction in boron Over temperature delta T Reactor Trip concentration Power Range Neutron Flux presents a direct challenge to the An analysis of this event is provided in Section 14.1.4 of the NSPC for reactivity BVPS-1 Updated Final Safety Analysis Report (UFSAR) which control.

assumes two charging pumps are operating with the reactor at maximum pressure giving a dilution rate of 231 gpm. The initial boron concentration is 1800 parts per million (ppm) and the critical concentration is 1500 ppm corresponding to hot zero

Attachment L-15-118 Page 59 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations power, all rods inserted (minus the most reactive rod cluster control assembly, or RCCA), no Xenon condition (300 ppm change is a conservative minimum value). With the reactor in manual control and no operator action to terminate the transient, the power and temperature rise will cause the reactor to reach the over temperature delta T set point, resulting in reactor trip. After reactor trip with all loops in service there will be at least 15 minutes for operator action prior to returning to criticality. This analysis has been reviewed and refined, taking into consideration the worst BVPS-1 stuck rod worth (from cycle

22) that the UFSAR did not credit and the maximum possible dilution flow rate of 160 gpm (limited by FE-1CH-168). Based on these changes, the new estimated time for dilution tore-criticality is approximately 81 minutes.

However, the design basis analysis is a worst case scenario.

While excess reactivity present in the core at the beginning of a cycle is sufficient to overcome the control rods when combined with boron dilution, the impact of dilution is reduced throughout the cycle since there is less excess reactivity resulting in a lower critical boron concentration. Consequently the time required to go re-critical increases, as does the critical flow rate.

At some point during the cycle there is no longer sufficient positive reactivity to overcome the control rods at which point boron dilution is no longer a threat.

Conclusion:

Given the assessment provided above, boron dilution causing a return to criticality is possible for an unfavorable combination of time in core life cycle, number of operating charging pumps, and available un-borated water flow.

However various mitigating circumstances prevail:

The multiple diverse ways of detecting and terminating a boron dilution event prior to a reactor trip induced by the event and before return to power.

The post fire proceduralized practice of isolating the VCT and transferring charging pump suction to the RWST (thereby terminating the boron dilution event and re-establishing shutdown margin).

The limited time of exposure to unfavorable conditions under which a return to power is possible due to the event.

Attachment L-15-118 Page 60 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations An analysis of this event under a bounding set of conditions indicates at least 81 minutes would be available to take action before the boron dilution was sufficient to result in a return to criticality.

As a result, spurious boron dilution does not warrant inclusion into the fire PRA model and the delta risk associated with this VFDR is considered to be negligible.

Loss of Reactor The discussion provided below is based on BVPS-1. BVPS-2 is Coolant System similar.

Subcooling Without the Use of Potential Recovery actions to address VFDRs:

Pressurizer Heaters Local operator action will be required to close the breakers at I BVPS-1, BVPS-2 the switchgear to operate at least one group of pressurizer heaters.

Fire damage to the pressurizer heater Discussion breaker control The BVPS fire PRA, like the internal events PRA, does not circuits from the MCR require or model the pressurizer heaters for successful core results in loss of the cooling because the PRA does not require sub-cooling for ability to remotely success. Nor does the PRA require RCS makeup from the close the breakers for charging pumps, which could also be used to maintain reactor the pressurizer inventory and pressure control following normal transients.

heaters. Without Rather, charging pumps are only required for RCP seal control of at least one injection and LOCA mitigation. This includes RCP seal group of pressurizer degradation resulting in leakage of greater than 76 gpm per heaters, RCS RCP (RCP LOCA size is "medium" or "large", as defined in the subcooling cannot be PRA model).

shown to be maintained over the An analysis justifying the lack of necessity to maintain sub-long-term. This cooling and RCS make-up specific to fires was not performed; presents a challenge instead, reliance is placed on the thermal hydraulic analysis to the NSPC for RCS available for the internal events PRA which indicates success inventory and can be achieved without sub-cooling or charging pump make-pressure control. up; specifically the SBO analysis and the SBO procedures and background documents which direct operators to cooldown and depressurize the RCS.

Conclusion:

Fire damage to the pressurizer heaters and RCS make-up resulting in loss of RCS sub-cooling and inventory control does

Attachment L-15-118 Page 61 of 68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations not prevent transient mitigation, with an RCP seal LOCA not exceeding 76 gpm per pump, provided cooldown and depressurization are initiated in a timely manner. Following a LOCA, including RCP seal leakage of greater than 76 gpm per RCP, RCS pressure and inventory control is required and maintained using Sl.

Loss of Charging The discussion provided below is based on BVPS-1. BVPS-2 is Pump Cubicle similar.

Ventilation I BVPS-1, BVPS-2 Potential Recovery Actions Local operator action will be required to install temporary Fire-induced spurious ventilation fans for the credited charging pump within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

failures of the dampers (1 VS-D Discussion 1A/B, 1VS-D-4-2A/B, Room heat up evaluations have been performed for the 1VS-D-4-4A/B, charging pump cubicles for normal plant operating conditions 1VS-D-4-7 AlBA) or and design basis analysis (DBA) conditions assuming complete the Exhaust Fan loss of charging pump cubicle ventilation. It has been shown in (1VS-F-4A/B) could BVPS-1 Charging Pump Cubicle Heat Up Following DBA and lead to the loss of Loss of All Ventilation, PRA Analysis that the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> success HVAC cooling to the criterion is still achieved even if the charging pump cubicle charging pump HVAC is unavailable for the entire 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period.

cubicles and pump overheating and

Conclusion:

damage. The Based on this, the likelihood of damage to the charging pumps potential loss of due to prolonged loss of cubicle ventilation is considered charging pump negligible, and consequently, the ventilation system is not cubicle ventilation is included within the PRA model. The VFDR contribution to risk is a challenge to the therefore considered to be negligible.

NSPC for RCS inventory and pressure control and vital auxiliaries.

Attachment L-15-118 Page 62 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations Loss of Nuclear The discussion provided below is based on SVPS-1. SVPS-2 is Instrumentation similar.

Channels I SVPS-1, SVPS-2 Potential Recovery actions to address VFDRs:

None Fire damage may require actions to be Discussion taken at the SIP while Fire-induced failure of the reactor protection system leading to command and control failure of reactor shutdown has been shown in the multiple are maintained in the spurious operation (MSO) expert panel review report to be a MCR. Specifically, negligible risk contributor. The other mechanism for loss of nuclear reactivity control is a boron dilution event resulting from instrumentation spurious actuation of the primary grade water makeup valves monitoring using Nl- and failure of the blender system valves. However, this 1NI-32A source mechanism has also been demonstrated to be low risk and will range nuclear be mitigated by the action of operators to isolate the VCT and instrumentation (NI) transfer suction of the charging pumps to the RWST.

may be performed at the SIP to mitigate

Conclusion:

fire induced failures The risk associated with operators not having access to Nl in while the overall the MCR is negligible.

command and control functions remain in the MCR.

Reactor Head Vent The discussion provided below is based on SVPS-1. SVPS-2 is Valve Failure to Open similar.

I SVPS-1, SVPS-2 Potential Recovery actions to address VFDRs:

The loss of reactor Use power operated relief valve (PORV) if available or control head vents during a pressurizer level by adjusting charging flow.

fire can cause the loss of ability to vent Discussion and

Conclusion:

to lower RCS level. Pressurizer level is assumed to be controlled by a combination This challenges the of RCS inventory shrinkage resulting from RCS cooldown and NSPC requirement the control of RCS make up from charging if necessary. Failure for RCS inventory of the operator to control pressurizer level by manually and pressure control controlling charging flow bounds the contribution from failure of the letdown path via the head vents. The delta risk associated with this VFDR is therefore negligible.

Loss of Emergency Potential Recovery Actions Switchgear and Local operator action will be required to install temporary

Attachment L-15-118 Page 63 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations Battery Room ventilation fans in the credited train of switchgear within 24 Cooling hours.

I BVPS-2 Discussion Fire-induced spurious The emergency switchgear and battery room ventilation system failures of the Train A is not modeled within the internal events or the Fire PRA. The emergency rationale for this is provided in the PRA BVPS-2 HVAC review.

switchgear isolation Room heat-up evaluations have been performed for the dampers (2HVZ- emergency switchgear and battery rooms. It has been shown MOD21A/22A), cross in BVPS-2 PRA Notebook (VA) Ventilation and Room Cooling connect damper System that temperatures will not exceed equipment 2HVZ-MOD23A), qualification limits of 120 degrees Fahrenheit, even if the HVAC switchgear is unavailable for the entire 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period under both normal temperature element station alignment and post trip alignments.

(2HVZ-TE21A/21A 1),

area temperature switch (2 HVZ- Conclusion TS21A), fan Based on this, the likelihood of damage to emergency discharge pressure switchgear and battery chargers due to prolonged loss of transmitter (2HVZ- ventilation is considered negligible and consequently the PT21A), or area ventilation system is not included within the PRA model. The supply/exhaust fans VFDR contribution to risk is therefore also considered to be (2HVZFN261 A/262A) negligible.

could lead to the loss of HVAC for the emergency switchgear rooms and battery rooms.

The potential loss of emergency switchgear and battery ventilation is a challenge to the NSPC for vital auxiliaries.

Letdown Fails to The discussion provided below is based on BVPS-1. BVPS-2 is Isolate (results in similar.

LOCA)

I BVPS-1, BVPS-2 Potential Recovery actions to address VFDRs The keylock isolation switch in the West Cable Vault is used Fire-induced cable outside the control room to de-energize and fail closed the air

Attachment L-15-118 Page 64 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations damage could result operated letdown isolation valve.

in the inability to isolate letdown to the Discussion VCT via LCV-1 CH- The MAAP analysis used for substantiation of the PRA success 460A. This could criteria indicates that with a total RCS leakage in the range of challenge the ability 63 to 238 gpm, unlimited AFW and SG level indication coupled to achieve the NSPC with controlled RCS cooldown, depressurization, and for RCS inventory accumulator injection will prevent core uncovery for greater and pressure control. than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Consequently the letdown path was not considered a significant LOCA pathway in the FPRA or contributor to CDF. The pathway has, however, been modeled in top event Cl as a potential mode for containment isolation failure, and the impact on delta LERF is evaluated for each compartment, where applicable.

Conclusion The delta CDF risk associated with failure of letdown to isolate is negligible. The impact on delta LERF risk has been evaluated for each applicable compartment.

MSIVs Fail to Close The discussion provided below is based on BVPS-1. BVPS-2 is (results in similar.

overcooling with re-criticality and Potential Recovery actions to address VFDRs:

pressurized thermal Isolate instrument air and vent air which will close the MSIVs.

shock, or PTS This is performed in the AFW pump room.

concerns)

I BVPS-1, BVPS-2 Discussion With respect to PTS, BVPS-1 was one of three pilot plants Fire-induced evaluated in an NRC effort to re-evaluate the risk of pressurized damaged results in thermal shock. These efforts are summarized in NUREG-1806 loss of the ability to and NUREG-1874. The total mean TWCF (CDF) for BVPS-1 is remotely isolate the predicted to be 6.84E-09 lyr for internal initiating events. Based MSIVs- TV-1 MS- on a bounding assessment, the contribution from external 101AIBIC events, including seismic and fire, is shown to be less than that (BVPS-2 : 2MSS- from internal events. Uncontrolled reactor vessel cooldown AOV101A I 8 I C). resulting in vessel failure as a result of a LOCA, Uncontrolled repressurization event, or excess steam demand has a continued steam flow negligible impact on core damage frequency or LERF.

from one or more steam generators The potential for re-criticality is not modeled in the BVPS-1 could result in RCS internal events PRA for two reasons: first, the frequency of such

Attachment L-15-118 Page 65 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations overcooling, which sequences is low; and second, the impact of going re-critical is will result in a not expected to alter the success criteria for mitigating systems.

challenge to the Based on the latter reasoning, re-criticality is not expected to be NSPC for reactivity, a risk significant contributor for the fire initiators.

decay heat removal, and RCS inventory Conclusion and pressure control. The contribution to delta risk arising from fire-induced overcooling transients leading to PTS or re-criticality is negligible. However, the potential for such transients to cause a consequential safety injection with subsequent challenge to the PORVs and/or the loss of the AFW turbine driven pump is evaluated for applicable fire compartments.

Fire Damage Results Potential Recovery Actions in High Airborne De-energize and manually close the associated valve/valves.

Activity I BVPS-1 Discussion High airborne radiation in the PAB and this charging pump Fire damage results diversion flowpath are not modeled in the internal events or fire in high airborne PRA. A proposal has been made for a manual valve alignment radiation in the change which will result in the specified flow diversion path primary auxiliary being isolated during plant operation, and thus not susceptible building (PAB) and to fire induced spurious actuation.

charging pump diversion (to the PAB Conclusion sump) through It is proposed that this VFDR be resolved by a plant change spurious operation or and no further assessment is required at present. This functional failure of modification is in LAR Table S-2 as BV1-3024.

cold leg injection MOVs (MOV-1SI-867 A I B) and failure of the recirculation valves TV-1SI-884A and B to close.

The flow to the sump could potentially cause high airborne/gaseous radioactivity levels in the auxiliary building, causing a significant

Attachment L-15-118 Page 66 of68 VFDR Description Rationale for Excluding VFDRs From the Change-in-Risk I Applicability Calculations delay in the performance of operator actions in the area. The diversion of charging flow to the auxiliary building sump challenges the NSPC for RCS inventory and _Qressure control.

PRA RAJ 22 - Implementa tion Item Impact on Risk Estimates Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. Section 2.4.4.1 of NFPA-805 further states that the change in public health risk arising from transition from the current fire protection program to an NFPA-805 based program, and all future plant changes to the program, shall be acceptable to the NRC. RG 1.174 provides quantitative guidelines on core damage frequency, large early release frequency, and identifies acceptable changes to these frequencies that result from proposed changes to the plant's licensing basis and describes a general framework to determine the acceptability of risk-informe d changes. The NRC staff review of the information in the LAR has identified the following information that is required to fully characterize the risk estimates.

Table S-3 of the LAR lists implementat ion items that will be completed prior to adopting the new NFPA 805 fire protection program. This list does not appear to include a commitmen t to update the Fire PRA for Units 1 and 2 following completion of modification s and other implementa tion items, and does not provide a plan of action if the updated as-built Fire PRA results in risk estimates that exceed RG 1.174, Revision 2, guidelines.

Provide an implementat ion item that commits to update the Fire PRA for Units 1 and 2 following completion of modification s and other implementat ion items, and provides a plan of action if the updated as-built Fire PRA results in risk estimates that exceed RG 1.174, Revision 2, guidelines, such as implementin g additional modification s or refining the analytic estimates.

Attachment L-15-118 Page 67 of68

Response

BVPS NFPA 805 project open items BV1-3108 and BV2-1622 have been created for BVPS-1 and BVPS-2, respectively. These open items contain the following text:

Following completion of all modifications in Table S-2 which are credited in the Fire PRA model, and all implementation items in Table S-3 which are determined to affect the Fire PRA model, and prior to its use for self-approval of fire protection program changes, the Fire PRA model will be updated to account for the actual as-built, as-operated configuration of the plant in support of NFPA 805 and in accordance with FENOC procedures NOPM-CC-6000, "Probabilistic Risk Assessment Program," NOBP-CC-6001, "Probabilistic Risk Assessment Model Management," and NOBP-CC-6002, "Probabilistic Risk Assessment Applications Management." This will include updated quantitative screening of fire scenarios against the updated model in accordance with the criteria endorsed in Regulatory Guide 1.200, rev. 2, as well as quantification of total CDF and LERF values. The change-in-risk values will also be updated using this post-transition model. If the actual change-in-risk and/or total risk exceeds the acceptance guidelines of Regulatory Guide 1.174, the model will be reassessed and new modifications or refinements will be implemented, as necessary, to meet the acceptance guidelines prior to its use in support of self-approval of changes to the fire protection program.

The description of the implementation items that are planned to be added to LAR Attachment S, Table S-3 is as follows:

Final update of FPRA model, risk metrics, and change-in-risk values following completion of risk-relevant modifications and implementation items, to support self-approval of fire protection program changes.

Appropriate updates to the LARwill be provided in a future submittal.

PRA RAI 24 - Model Changes and Focused Scope Reviews after the Full Peer Review NFPA 805 Section 2.4.3.3 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting a Fire PRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. RG 1.200 describes a peer review process utilizing an associated ASME/ANS standard (currently ASME/ANS-RA-Sa-2009) as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established.

Attachment L-15-118 Page 68 of68 The NRC staff notes that a number of revisions and updates were made in response to peer review F&Os. Identify any changes made to the Internal Events PRA or Fire PRA since the last full-scope peer review of each of these changes that are consistent with the definition of a "PRA upgrade" in ASME/ANS-RA-Sa-2009. If any changes are characterized as a PRA upgrade, indicate if a focused-scope peer review was performed for these changes consistent with the guidance in ASME/ANS-RA-Sa-2009 and describe any findings from that focused-scope peer review and the resolution of these findings. If a focused-scope peer review has not been performed for changes characterized as a PRA upgrade, describe what actions will be implemented to address this issue.

Response

As described in the supplement to the BVPS NFPA 805 LAR dated February 14, 2014, the BVPS internal events PRA models were fully peer reviewed in 2002. Since that time, only the HRA and the internal flooding have been changed consistent with the definition of a "PRA upgrade" in ASME/ANS-RA-Sa-2009. A focused-scope peer review covering the upgraded HRA for both units was performed in 2007. A focused-scope peer review covering the upgraded internal flooding models for both units was performed in 2011. F&Os from these peer reviews, together with their resolutions and/or dispositions, are provided in the supplement to the BVPS NFPA 805 LAR.

The BVPS-1 fire PRA model was peer reviewed in 2009, with a follow-on focused-scope peer review performed in 2011.

The BVPS-2 fire PRA model was peer reviewed in 2012.

No other changes were made to the BVPS-1 and BVPS-2 internal events PRA or fire PRA that would be consistent with the definition of a "PRA upgrade" in ASME/ANS-RA-Sa-2009, so no further peer reviews were required to be performed.

As a further measure to ensure use of peer reviews when appropriate, FENOC Nuclear Operating Business Practice, "Probabilistic Risk Assessment Model Management" explicitly requires any changes meeting the definition of a "PRA upgrade" in ASME/ANS-RA-Sa-2009 to be peer reviewed, and all resulting F&Os addressed, before the affected PRA model may be made effective.