NOC-AE-13002962, License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability

License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability

ML13212A243
Person / Time
Site:	South Texas
Issue date:	07/23/2013
From:	Rencurrel D South Texas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NOC-AE-13002962
Download: ML13212A243 (182)

Text

Nuclear Operating Company South Teras Pro/ectElectric Generatilj, Station PO BHa289 Wldsworth. Tews 77483 'v-July 23, 2013 NOC-AE-1 3002962 10CFR50.90 10CFR50.48 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 South Texas Project Units I & 2 Docket Nos. STN 50-498, STN 50-499 License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability Pursuant to 10 CFR 50.90, STP Nuclear Operating Company (STPNOC) hereby requests a license amendment for approval of a revision to the South Texas Project (STP) Fire Protection Program (FPP) related to the Alternative Shutdown Capability. Specifically, STPNOC requests crediting the performance of operator actions in the control room, including one automatic operation, in the event a fire requires evacuation of the control room. These operations will ensure that regulatory requirements and commitments concerning the STP FPP are satisfied.

STPNOC has determined that reliance on these operations meets the threshold for an adverse effect on the ability to achieve and maintain safe shutdown in the event of a fire. Therefore, per License Condition 2.E of each Unit's Operating License, STPNOC is requesting approval by the Nuclear Regulatory Commission for making the changes to the STP FPP. Enclosure 1 to this letter provides a safety evaluation demonstrating that no significant hazards will result from this change.

The proposed change to the Operating Licenses is provided as Enclosures 2 and 3 of this letter.

The STPNOC Plant Operations Review Committee has reviewed and concurred with the proposed change.

In accordance with 10 CFR 50.91(b), STPNOC is notifying the State of Texas of this request for license amendment by providing a copy of this letter and its enclosures.

Upon approval of this request, a change will be made to the STP Fire Hazards Analysis Report as presented in Enclosure 4 to this letter. The licensing commitment for implementing this change is provided as Enclosure 5 to this letter. There are no other commitments in this letter.

STI: 33653627

NOC-AE- 13002962 Page 2 This license amendment request is submitted to resolve a long standing deficiency with the STP FPP and is the subject of Notice of Violation EA-12-227 (ML12325A789) dated November 20, 2012 for untimely corrective action. The next Triennial Fire Protection Program inspection for STPNOC is scheduled for June 2014. Therefore, it is requested that this amendment receive an expedited review for approval by May 30, 2014 with a 45-day implementation period to provide time to revise the applicable STP licensing documents.

If there are any questions regarding this amendment request, please contact Ken Taplett at (361) 972-8416 or me at (361) 972-7867.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on 7 .-.*3 12 -3 Date

&.A~n cu ffel Senior Vice President, Operations KJT

Enclosures:

1. Evaluation of the Proposed Change Attachment 1 - Thermal-Hydraulic Analyses for the Proposed Operator Actions Attachment 2 - Defense-in-Depth Thermal-Hydraulic Analyses Attachment 3 - Main Control Room CFAST Fire Model

2. Proposed Change to South Texas Project, Unit 1, Operating License No. NPF-76

3. Proposed Change to South Texas Project, Unit 2, Operating License No. NPF-80

4. Annotated Fire Hazards Analysis Report Pages

5. List of Commitments

NOC-AE-1 3002962 Page 3 cc:

(paper copy) (electronic copy)

Regional Administrator, Region IV A. H. Gutterman, Esquire U. S. Nuclear Regulatory Commission Morgan, Lewis & Bockius LLP 1600 East Lamar Boulevard Arlington, Texas 76011-4511 Balwant K. Singal U. S. Nuclear Regulatory Commission Balwant K. Singal John Ragan Senior Project Manager Chris O'Hara U.S. Nuclear Regulatory Commission Jim von Suskil One White Flint North (MS 8B 1) NRG South Texas LP 11555 Rockville Pike Rockville, MD 20852 Kevin Pollo NRC Resident Inspector Richard Pena U. S. Nuclear Regulatory Commission City Public Service P. 0. Box 289, Mail Code: MN116 Wadsworth, TX 77483 C. M. Canady Peter Nemeth City of Austin Crain Caton & James, P.C.

Electric Utility Department 721 Barton Springs Road C. Mele Austin, TX 78704 City of Austin Richard A. Ratliff Texas Department of State Health Services Robert Free Texas Department of State Health Services

Enclosure I NOC-AE- 13002962 ENCLOSURE 1 Evaluation of the Proposed Change

Enclosure 1 NOC-AE-13002962 Page 1 of 50 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION 2.1 Proposed Change to Operating License 2.E 2.2 Proposed Change to FHAR, Section 2.4.4 2.3 Proposed Change to FHAR, Section 3.2 for Fire Area 1 2.4 Proposed Change to FHAR, Section 4.1, Comparison of STP Units with Requirements of Appendix R 2.5 Proposed Change to FHAR, Section 2.3.1, General Guidelines

3.0 TECHNICAL EVALUATION

3.1 General Description of Fire Protection Shutdown Capability 3.2 Background 3.2.1 Current STP Alternative Shutdown Capability 3.2.2 Proposed Revision to STP Alternative Shutdown Capability 3.3 Overview of the Evaluation 3.4 Description of the Proposed Operator Actions 3.4.1 Reason for the Proposed Operator Actions 3.4.2 Thermal-Hydraulic Evaluation of the Proposed Operator Actions 3.4.3 Uncertainty Analysis of the Proposed Operator Actions 3.5 Automatic Turbine Trip Analysis 3.6 Electrical Isolation Capability Analysis 3.7 Human Performance Reliability Analysis of the Proposed Operator Actions 3.8 Defense-in-Depth (DID) Analyses 3.8.1 Fire Prevention Objective 3.8.2 Detect, Control and Extinguish Fires Objective 3.8.3 Protect SSCs so that Fires Will Not Prevent Safe Shutdown Objective 3.8.4 DID Thermal-Hydraulic Analyses 3.8.5 Fire Modeling 3.8.6 DID Summary 3.9 Technical Evaluation Conclusion

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.1.1 Regulatory Requirements 4.1.2 Regulatory Guidance 4.2 Precedent 4.3 Significant Hazards Consideration 4.4 Conclusions

6.0 REFERENCES

Enclosure I NOC-AE-13002962 Page 2 of 50 FIGURES:

Figure 1 - Control Room Control Panel Switch Orientation Figure 2 - Control Room Panel Steel-Enclosed Barrier Figure 3 - Fire Area 1 Separation Scheme Figure 4 - Relay Room SSPS and ESF Cabinet Separation/Layout ATTACHMENTS:

Al Thermal-Hydraulic Analyses for the Proposed Operator Actions AL.1 Initiate main steam isolation Al .2 Close both pressurizer power-operated relief valve (PORV) block valves A1.3 Secure the RCPs Al1.4 Close feedwater isolation valves A1.5 Secure the SUFP A1.6 Isolate RCS letdown A1.7 Secure the centrifugal charging pumps (CCP)

A 1.8 Uncertainty Analysis of Proposed Operator Actions A2.1 Defense-in-Depth Thermal-Hydraulic Analyses Overview A2.2 Offsite Power Assumed Available A2.2.1 Assumptions A2.2.2 Case 1: Spurious Opening of One Bank of Steam Dump Valves A2.2.3 Case 2: Spurious Opening of One Pressurizer PORV A2.2.4 Case 3: Spurious Opening of One Pressurizer Normal Spray Valve A2.2.5 Case 4: Spurious Opening of One Feedwater Regulating Valve (FWRV)

A2.3 Offsite Power Assumed not Available (LOOP)

A2.3.1 Assumptions A2.3.2 Model Considerations A2.3.3 Sequence of Events A2.3.4 Case la Results (SI available)

A2.3.5 Case lb Results (SI not available)

A2.3.6 Acceptable Use of RETRAN-3D Code A3 Main Control Room CFAST Fire Model A3.1 Introduction A3.2 Methodology A3.3 Assumptions A3.4 Results A3.5 Conclusion

Enclosure 1 NOC-AE-13002962 Page 3 of 50 Evaluation of the Proposed Change 1.0 Summary Description The proposed amendment requests Nuclear Regulatory Commission (NRC) approval, pursuant to Facility Operating License Condition 2.E, to make changes to the approved South Texas Project (STP) Fire Protection Program (FPP) as described in the STP Fire Hazards Analysis Report (FHAR). This evaluation supports a request to amend Facility Operating Licenses NPF-76 and NPF-80 for the South Texas Project, Units I and 2, respectively. The proposed changes to the FPP are based on the reactor coolant system (RCS) thermal-hydraulic response for a control room fire related to the alternative shutdown capability.

The proposed change requests crediting the performance of operator actions in the control room in the event a fire requires evacuation of the control room in addition to the action to trip the reactor that is currently credited in STP FPP licensing basis. The proposed change also includes crediting one automatic operation. Performance of additional operator actions and the automatic operation will ensure that the requirements of Section II1.L of 10 CFR 50, Appendix R are met and that STPNOC is in compliance with the STP Licensing Basis. The Section III.L requirements are part of the STP FPP licensing basis.

The proposed change has been determined to adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Therefore per Facility Operating License Condition 2.E, prior Commission approval is required.

This license amendment request is submitted to resolve a long standing deficiency with the STP FPP and is the subject of Notice of Violation EA-12-227 (Reference 6.1) received on November 20, 2012 for untimely corrective action. The next Triennial Fire Protection Program inspection for STPNOC is scheduled for June 2014. Therefore, it is requested that this amendment receive an expedited review for approval by May 30, 2014 with a 45-day implementation period to provide time to revise the applicable STP licensing documents.

2.0 Detailed Description 2.1 Proposed Change to Operating License Condition 2.E License Condition 2.E for Unit I and [Unit 21 is revised to state STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 55 [62] and the Fire Hazards Analysis Report through Amendment No. ý4-xx, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; and as approved in the

Enclosure 1 NOC-AE-13002962 Page 4 of 50 SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

2.2 Proposed Change to FHAR, Section 2.4.4 2.4.4 Alternate Shutdown Capability Alternate shutdown capability is provided to respond to a large fire occurring within the main control room. Following p from the control room, the transfer of control from the control room to the auxiliary shutdown panel and local control stations is accomplished from outside the control room using transfer switches which are predominately located in the three redundant switchgear rooms. The remaining transfer switches are on the auxiliary shutdown panel in the train related diesel generator rooms and at the Essential Cooling Water Intake Structure ventilation fan MCCs. When transferred, these circuits are independent of the control room. Safe shutdown from outside the control room is discussed in FSAR Section 7.4.1.9.

If a loss of offsite power occurs, all three Class 1E standby diesel generators receive an automatic start signal. No single control circuit failure due to a control room fire can disable all standby diesel generators. The sequencer circuits for the standby diesel generators are on separate paths outside the control room. The sequencers are located within their own fire area separated from the control room fire area. When control of a standby diesel generator is transferred to the local control station, the diesel will remain operating. Only one standby diesel generator is required to achieve safe shutdown. [1]

Enclosure 1 NOC-AE-13002962 Page 5 of 50

'. STP Safe Shutdown Compliance Analysis, Calculation 5A 11MC6023 2.3 Proposed Change to FHAR, Section 3.2 for Fire Area 1 D. Redundant Safe Shutdown Assessment In the event of a Control Room or Relay Room fire, cold shutdown can be achieved and maintained from the auxiliary shutdown panel, transfer switch panels or other local control stations and MCCs.

However, before control room evacuation, operator action should be taken from the control room to trip the reactor, secure the reactor coolant pumps t p and CVCS charging pumps, and close the pressurizer PORV block tvalves MSIV. and F. Deviations from BTP APCSB 9.5-1 Appendix A and/or 10CFR50 Appendix R with Respective Justifications m.Apni A1..

Deviation Justification Liene medmntNo. xfrUiIanLiesAmn etNox ornt

Enclosure I NOC-AE-13002962 Page 6 of 50 2.4 Proposed Change to FHAR, Section 4.1, Comparison of STP Units with Requirements of Appendix R STP POSITION III.G. (Cont'd)

3. Alternate shutdown capability for all three trains is provided outside the control room fire area to respond to a large control room fire. Following 9 gj

.... ei , the transfer of control to the auxiliary shutdown panel and other points of control is accomplished from outside the control room fire area. These circuits when transferred are independent of the control room fire area.

2.5 Proposed Change to FHAR, Section 2.3.1, General Guidelines o The fire is assumed concurrent with or without a loss of offsite power. Required operator actions w based on The changes to FHAR Sections 2.4.4, 3.2 and 4.1 reflect the operator actions required to be performed in the control room prior to evacuation in the event of a fire. The change to FHAR Section 2.3.1 reflects that for the fire resulting in control room evacuation, the limiting case is analyzed to be with offsite power maintained as discussed in Section 3.4.2.

The proposed change to the Unit I and 2 Operating Licenses is provided in Enclosures 2 and 3 to this letter.

The annotated FHAR pages affected by this proposed change are provided in Enclosure 4 to this letter. Upon approval of this request, the changes in Enclosure 4 will be documented in the STP FHAR. See the Licensing Commitment described in Enclosure 5 to this letter.

3.0 Technical Evaluation 3.1 General Description of Fire Protection Shutdown Capability STP is composed of two units, each having an identical pressurized water reactor (PWR) Nuclear Steam Supply System (NSSS) and turbine generator (TG). The units are arranged using a "slide-along" concept which results in Unit 2 being similar to Unit 1. Although the fire water supply system is shared between the units, the fire protection system within each power block is identical. The unique design for STP includes three trains, or pathways, of equipment capable of bringing the plant to safe shutdown conditions. Although only one pathway is required, many fire areas at STP will have two pathways available. Other exceptional nuclear safety features

Enclosure 1 NOC-AE-13002962 Page 7 of 50 included in this design include additional separation, plant layout which complements fire protection design, extensive shutdown capability outside the control room and power, controls, and instrumentation design with unique isolation capabilities.

Alternate shutdown capability is provided to respond to a large fire occurring within the main control room. Following reactor trip from the control room, the transfer of control from the control room to the auxiliary shutdown panel and local control stations is accomplished from outside the control room using transfer switches which are predominately located in the three redundant switchgear rooms. The remaining transfer switches are on the auxiliary shutdown panel (ASP), in the train related diesel generator rooms and at the essential cooling water intake structure ventilation fan motor control centers (MCC). When transferred, these circuits are independent of the control room. Safe shutdown from outside the control room is discussed in Section 7.4.1.9 of the STP Updated Final Safety Analysis Report.

If a loss of offsite power occurs, all three Class I E standby diesel generators receive an automatic start signal. No single control circuit failure due to a control room fire can disable all standby diesel generators. The sequencer circuits for the standby diesel generators are on separate paths outside the control room. The sequencers are located within their own fire area separated from the control room fire area. When control of a standby diesel generator is transferred to the local control station, the diesel will remain operating. Only one standby diesel generator is required to achieve safe shutdown 3.2 Background 10 CFR 50.48 "Fire Protection" paragraph (a) applies to STP Units 1 and 2. The 10 CFR 50, Appendix R technical requirements apply to licensed nuclear power electric generating plants that were operating before January 1, 1979. STP Units 1 and 2 began operations post-1979. The STP FPP licensing basis was reviewed against the requirements of Appendix R and meets the requirements of Appendix R with minimal alternative design configurations. The STP FPP licensing basis is consistent with Section III.L, "Alternate and Dedicated Shutdown Capability", of Appendix R.

NRC Integrated Inspection Report 05000498/2006002 and 05000499/2006002 (Reference 6.2) dated May 18, 2006 documented a Green non-cited violation of 10 CFR Part 50, Appendix R, Section III.L. 1, because thermal-hydraulic analyses for demonstrating that safe shutdown conditions could be achieved for the alternate shutdown capability were inconsistent with actions allowed in the STP FPP licensing basis for a control room evacuation. Specifically, the analyses inappropriately credited certain control room manual actions that are required to be performed in the field.

NRC Triennial Fire Protection Inspection Report 05000498/2011006 and 05000499/2011006 (Reference 6.3) dated August 10, 2011 documented a Green non-cited violation involving the failure to implement and maintain in effect all provisions of the approved STP FPP. During this inspection, the team identified that the STPNOC. had failed to implement timely corrective actions to correct conditions adverse to fire protection.

Enclosure 1 NOC-AE-13002962 Page 8 of 50 STPNOC submitted license amendment requests on February 4, 2008 (Reference 6.4) and on June 2, 2011 (Reference 6.5) to resolve the violation documented in NRC Integrated Inspection Report 05000498/2006002 and 05000499/2006002. Both amendments requested the approval of operator actions performed within the control room prior to evacuation in the event of a fire.

Each license amendment request was subsequently withdrawn because insufficient information had been provided to justify approval.

On November 20, 2012, STPNOC received a Notice of Violation EA-12-227 (Reference 6.1) for failure to implement and maintain in effect all provisions of the approved fire protection program.

STPNOC conducted pre-licensing meetings with the NRC staff on October 11, 2012 (Reference 6.6) and on March 5, 2013 (Reference 6.7) to discuss the proposed change and to reach a conmnnon understanding of the regulatory criteria and standards to be applied in the NRC's review of proposed change to the STP FPP licensing basis.

Approval of the proposed change will restore compliance with regulatory requirements and commitments.

3.2.1 Current STP Alternative Shutdown Capability The STP FPP is described in the FHAR. The STP alternative shutdown capability is described in Section 2.4.4 of the FHAR. Section 2.4.4 only credits the operator action to trip the reactor from the control room prior to evacuation. In addition, the STP fire safe shutdown analysis does not assume the occurrence of automatic operations within the fire area unless the automatic operation adversely impacts the response to the fire.

Alternative shutdown capability is provided to respond to a fire occurring within the main control room that results in evacuation. Following reactor trip from the control room, the transfer of control from the control room to the ASP and local control stations is accomplished from outside the control room using transfer switches located predominantly in the three redundant switchgear rooms. When transferred, these circuits are independent of and are electrically isolated from the control room circuits.

The alternative shutdown capability provides the controls and direct reading indications to monitor the process variables necessary to perform reactivity control, reactor coolant makeup and inventory control, and reactor heat removal.

The NRC review of the STP alternative shutdown capability is documented in NUREG-0781, "Safety Evaluation Report related to the operation of the South Texas Project, Units I and 2."

The following discussion regarding the performance of actions prior to control room evacuation is documented in Supplement 2 to NUREG-0781, dated January 1987 (Reference 6.8) as follows:

Enclosure 1 NOC-AE-13002962 Page 9 of 50 In addition to scramming the reactor from the control room, the applicant has included procedures for other actions that are to be performed before the control room is evacuated.

These actions, however, can be performed outside the control room regardless of circuit damage within the control room. They include tripping the reactor coolant pumps, closing the PORV block valves, isolating the steam generators, and securing the charging pumps. The above actions could prevent a very unlikely series of events, which include spurious actuations, the failure of specific automatic functions, and the operation of other specific automatic functions, from causing RCS process variables to exceed those limits predicted for a loss of normal ac power.

The current description of the alternative shutdown capability is provided in Section 2.4.4 of the FHAR. Section 2.4.4 states:

Alternate shutdown capability is provided to respond to a large fire occurring within the main control room. Following reactor trip from the control room, the transfer of control from the control room to the auxiliary shutdown panel and local control stations is accomplished from outside the control room using transfer switches which are predominately located in the three redundant switchgear rooms. The remaining transfer switches are on the auxiliary shutdown panel in the train related diesel generator rooms and at the Essential Cooling Water Intake Structure ventilation fan MCCs. When transferred, these circuits are independent of the control room.

Therefore, the current alternative shutdown capability depends on transfer of control from the control room to alternative shutdown stations and performing actions at the alternative shutdown stations to prevent the effects of spurious actuations, failure of specific automatic functions, and the operation of other specific automatic functions from impeding the assurance that RCS process variables do not exceed the limits predicted for a loss of normal ac power.

Although transfer of control from the control room to alternative shutdown stations remains part of the STP FPP licensing basis for assuring safe shutdown, updated thennal-hydraulic analyses have determined that certain actions within the control room must be successful to assure that RCS process variables do not exceed the limits predicted for a loss of normal ac power (i.e.,

Appendix R,Section III.L requirement) until control is successfully transferred.

3.2.2 Proposed Revision to STP Alternative Shutdown Capability In addition to manually tripping the reactor, the proposed change credits the performance of the following operator actions in the control room prior to evacuation due to a fire.

" Initiate main steam line isolation

" Closing the pressurizer power-operated relief valves (PORV) block valves

• Securing all reactor coolant pumps

• Close feedwater isolation valves

• Securing the startup feedwater pump

" Isolating reactor coolant system letdown

Enclosure 1 NOC-AE-1 3002962 Page 10 of 50 Securing the centrifugal charging pumps In addition, the proposed change credits the automatic trip of the main turbine upon the initiation of a manual reactor trip.

Section 5.4.4 of NRC Regulatory Guide (RG) 1.189, Revision 2, "Fire Protection for Nuclear Power Plants", (Reference 6.9) states:

The only operator action in the control room before evacuation for which credit is usually given is a reactor trip. For any additional control room actions deemed necessary before evacuation, a licensee should be able to demonstrate that such actions can be performed.

Additionally, the licensee should ensure that such actions cannot be negated by subsequent spurious actuation signals resulting from the postulated fire. The design basis for the control room fire should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system. After control of the plant is achieved by the alternative or dedicated shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plant's approved FPP.

The proposed change credits the performance of certain operator actions within the control room until the actions are backed up from stations outside the control room. The actions are backed up outside the control room with alternative circuits by transferring control to local control stations outside of the control room. The transfer electrically isolates the circuits in the control room from the alternative shutdown circuits so that any circuit failures in the control room following transfer will not adversely affect the safe shutdown function. The proposed change assumes one spurious actuation occurs before control of the plant is achieved through the alternative shutdown system. In addition, the proposed change credits an automatic trip of the main turbine upon initiation of the manual reactor trip.

The proposed operator actions are currently part of the plant response procedure to a fire that results in a control room evacuation. The proposed operator actions have been demonstrated to be feasible and reliable. The automatic main turbine trip upon a reactor trip is an integral part of plant design.

Performance of the additional actions inside the control room ensures that the RCS process variables remain within those values predicted for a loss of normal a-c power as required by Section III.L.1 to 10 CFR Part 50, Appendix R and that the performance goals of Section III.L.2 are met. The STP fire hazards analysis is based on meeting the requirements of Sections III.L. 1 and III.L.2 to 10 CFR Part 50, Appendix R.

3.3 Overview of evaluation The proposed change is based on a deterministic approach that relies on both qualitative and quantitative analyses.

Enclosure 1 NOC-AE-13002962 Page 1 of 50 The STP fire hazards analysis for demonstrating the alternative shutdown capability follows the guidelines of Section 5.4 of RG 1.189. Section 5.4.4 states that for control room fires, the only operator action in the control room before evacuation for which credit is usually given is reactor trip. The STP fire hazards analysis and current licensing basis credits the operator action to manually trip the reactor prior to evacuation. Crediting the manual reactor trip pre-alerts the operators to perform the control room operator actions proposed by this amendment request.

Thus, the time requirements for completion of the proposed operator actions are based on defining the initiating time (t = 0) as the time when the reactor is manually tripped.

Damage to systems in the control room from a fire that causes evacuation of the control room cannot be predicted. For the case where the fire occurs in a cabinet or panel that initiates a plant trip, operators respond to the trip by entering the emergency operating procedure for a plant trip.

For this case, it is expected that the fire would be localized to a single cabinet or panel and would not propagate to a point where control room evacuation would be required.

For a scenario where a plant transient may be initiated by a fire resulting in the spurious opening of a pressurizer PORV and circuit damage to the associated PORV block valve preventing the block valve from being closed, operators enter the off-normal operating procedure for a loss of automatic pressurizer pressure control which may lead to a manual reactor trip and initiation of safety injection (SI). Again, it is expected that the fire would be localized to the single panel and would not propagate to a point where control room evacuation would be required. Attachment 3 to this enclosure provides the results of a fire modeling study that demonstrates that a fire in the panel serving the pressurizer PORV and its associated block valve will not propagate to other panels and cause other control circuits to fail. It can be concluded firom this study that this type of localized fire would not lead to a control room evacuation.

In the scenarios discussed above, detectors are located in the panels or cabinets to alert the operators and the fire brigade of the source of the fire so that it can be readily extinguished.

The cases above are provided to illustrate that a fire in a panel or cabinet that could initiate a plant transient would be unlikely to lead to a control room evacuation and plant procedures are in place to address the event. It is expected that plant transients resulting from other fire-induced circuit faults within a control panel would be similarly localized and controlled using off-normal operating procedures.

Because damage to systems in the control room from a fire cannot be predicted for all cases, a defense-in-depth analysis (see Attachment 2) was performed, where none of the proposed operator actions (i.e. there is not sufficient time to pre-alert the operators for performing the proposed control room operator actions) other than the reactor and turbine trip were successful, to demonstrate that core cooling and fuel integrity is maintained.

The description of the proposed operator actions is provided in Section 3.4. Table I provides a reason for each proposed action for ensuring compliance with the STP FPP licensing basis. A summary of the thermal-hydraulic analysis response for each proposed operator action is provided in Section 3.4.2 with a detailed discussion provided in Attachment 1 to this enclosure.

The analysis indicates the more limiting case is when offsite power is available. A loss of offsite

Enclosure 1 NOC-AE- 13002962 Page 12 of 50 power is less limiting as explained in Section 3.4.2. The analysis results confirm that the requirements of Appendix R,Section III.L are met. The plant stabilizes with pressurizer and steam generator levels in the indicating band and are maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Because the thermal-hydraulic evaluation reflected nominal conditions and set points, Section 3.4.3 provides an analysis if assumptions with regard to the initial conditions of the plant consider the standard thermal design procedure in addition to considering other uncertainties.

The analysis demonstrates that with uncertainties applied to the licensing basis analysis, plant safe shutdown can be achieved and maintained without adversely impacting fuel integrity. The details of this analysis are provided in Attachment I to this enclosure.

An analysis of the automatic turbine trip is provided in Section 3.5. The electrical isolation capability between the control room circuits and the alterative shutdown stations is provided in Section 3.6.

The successful performance of the proposed operator actions is required to meet the STP FPP licensing basis. Section 3.7 provides a human perforlnance reliability analysis to provide reasonable assurance that the proposed operator actions can be successfully performed.

Section 3.8 provides a defense-in-depth evaluation of the fire protection features that demonstrates evacuation of the control room due to fire is unlikely. In addition, Section 3.8 provides a summary of the results of defense-in-depth thermal-hydraulic analytical results and the results of a fire modeling study. provides the details of defense-in-depth thermal-hydraulic analytical results when no credit is given for performning the proposed operator actions (i.e., the analysis assumes the operator actions other than the manual reactor trip with automatic turbine trip are not performed until transfer is established at the alternate shutdown stations). Separate analyses were performed with offsite power available and with offsite power not available.

The limiting defense-in-depth case is where the pressurizer PORV spuriously opens at the initiation of reactor trip and the associated RCS discharge path is not secured until the PORV or its associated block valve is closed at the ASP; a loss of offsite power occurs; and safety injection does not actuate. The analysis results demonstrate that although a loss of subcooling margin occurs, the loss does not impact the ability of the plant to establish and maintain natural circulation. The results also demonstrate that the core remains sub-critical and covered thus ensuring the integrity of the fuel is maintained. Finally, pressurizer and steam generator levels are restored to the indicating band and maintained until charging and letdown are available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

For the limiting defense-in-depth case, a fire modeling study of the main control room was performed to determine if the case is credible. The results of the study demonstrated it is reasonable to conclude that a fire will not propagate in a manner to result in the limiting case.

Details of the fire modeling are provided in Attachment 3 to this enclosure.

Enclosure I NOC-AE-13002962 Page 13 of 50 The technical evaluation conclusion is provided in Section 3.9.

3.4 Description of the Proposed Operator Actions 3.4.1 Reason for the Proposed Operator Actions Table I describes each operator action and the reason it is performed.

Enclosure 1 NOC-AE- 13002962 Page 14 of 50 Table 1 Proposed Operator Actions Operator Action Credited Recent Reason for the action Licensing Basis Time 2 demonstrated Requirement 4 (seconds) time 3 (seconds)

Initiate main steam 30 7 To protect against an uncontrolled cool down of the RCS Appendix R, Section isolation in the event of a fire-induced spurious opening of a III.L.2.b.

(single switch) secondary steam-side valve such as in the steam dump system.

Close both 60 17 To protect against an uncontrolled depressurization of Appendix R, Section pressurizer and loss of RCS inventory in the event of a fire-induced III.L.2.b PORV 5 block valves spurious opening of a pressurizer PORV.

(two switches)

Secure all reactor 120 24 To protect against an uncontrolled depressurization of Appendix R, Sections coolant pumps the RCS in the event of a fire-induced circuit failure III.L. I (RCP) causes a pressurizer spray valve to spuriously open. and (four switches) In addition, the centrifugal charging pumps (CCP) are III.L.2.b secured which provide seal water to the RCPs. Tripping the RCPs protects the RCP seals which in turn protects the primary coolant boundary.

Close feedwater 120 34 To protect against an uncontrolled cool down of the RCS Appendix R, Section isolation valves in the event of a fire-induced spurious start of the startup III.L.2.b.

(four switches) feedwater pump (SUFP).

In addition, the steam generator water level would go off scale high due to overfilling the steam generator.

Secure the SUFP 120 40 To protect against an uncontrolled cool down of the RCS Appendix R, Section (one switch) in the event of a fire-induced spurious opening of a III.L.2.b.

feedwater isolation valve.

In addition, the steam generator water level would go off scale high due to overfilling the steam generator.

Enclosure 1 NOC-AE-13002962 Page 15 of 50 Isolate reactor 120 50 To reduce the possibility of an uncontrolled loss of RCS Appendix R, Section coolant system inventory because charging (i.e. RCS makeup) is III.L.2.b.

letdown secured.

(two switches)

Secure the CCPs 120 58 To protect against an uncontrolled depressurization of Appendix R, Section (two switches) the RCS in the event of a fire-induced spurious opening III.L.1.

of a pressurizer auxiliary spray valve, and To protect the CCPs for use later to achieve cold III.L.2.b shutdown. With the CCPs running, a fire-induced spurious closure of the volume control tank isolation valves would result in damage to the pumps. The CCPs are required to achieve and maintain cold shutdown conditions as required by Appendix R,Section III.L. 1.d.

1 Switches for performing the operator actions are located on adjacent control panels in the control room. See Figure 1 to this enclosure.

2 Time "0" is the initiation of a manual reactor trip.

3 Capability to perform the operator action is demonstrated in the aggregate. The operator actions are timed in sequence such that the time to perform any individual action is dependent on successfully performing the previous action(s).

4 STP FPP licensing basis requires the fire hazards analysis to meet the requirements of Appendix R,Section III.L. The requirements of Appendix R,Section III.L are provided in Section 4.1.1 of this enclosure.

5 Power-operated relief valve

Enclosure I NOC-AE-13002962 Page 16 of 50 3.4.2 Thermal-hydraulic Evaluation of the Proposed Operator Actions Section 5.4.4 of NRC Regulatory Guide (RG) 1.189, Revision 2, "Fire Protection for Nuclear Power Plants", states:

Any additional control room actions deemed necessary before evacuation should not be negated by subsequent spurious actuation signals resulting from the postulated fire such that the requirements of Appendix R are satisfied. The design basis for the control room fire should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system. After control of the plant is achieved by the alternative shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered in accordance with the plant's approved FPP.

The results of a single spurious actuation effect on each of proposed operator actions before the action can be backed up by an action performed outside of the control room following transfer and circuit isolation was evaluated.

Transfer switches isolate the control room circuit from the ASP or local panel circuits to ensure that the effects of a fire in the control room will not impact the ability to safely shutdown the plant. Therefore, single or multiple spurious actuations that occur in the fire-affected area (i.e., control room) after transfer of safe shutdown control functions need not be considered.

Thermal-hydraulic analyses were performed to demonstrate that the proposed operator actions assure that Appendix R,Section III.L requirements were met. The thermal-hydraulic analyses used the RETRAN computer code. The computer model is similar to the model described in WCAP 14882-P-A (Reference 6.10). The model was modified to reflect nominal conditions and set points as opposed to the worst case conditions and set points assumed in the design bases safety analysis. of this enclosure provides the detailed results of the analyses of the proposed operator actions.

Initiate main steam isolation The purpose of closing the main steam isolation valves is to protect against an uncontrolled cool down of the RCS in the event of a fire-induced spurious opening of a secondary steam-side valve such as in the steam dump system. Analysis shows that indicated pressurizer water level momentarily goes below the indicating range and then returns to the indicating range when operators stabilize the plant at the auxiliary shutdown station as long as main steam isolation is initiated within 30 seconds of the manual reactor trip. A loss of off-site power is less limiting because the RCPs and main condenser would be immediately lost. The immediate loss of the RCPs and main condenser reduces the amount of energy

Enclosure I NOC-AE-1 3002962 Page 17 of 50 being removed from the RCS which would reduce the temperature decrease of the RCS fluid and mitigate the associated shrink of the pressurizer water level.

The operator action would not be negated by a single subsequent spurious actuation because both a main steam isolation valve and a downstream secondary steam-side valve would have to open due to fire-induced spurious actuations for an uncontrolled cool down of the RCS to occur.

Close both pressurizer PORV block valves The purpose of closing both pressurizer PORV block valves is to protect against an uncontrolled depressurization of the RCS and loss of RCS inventory in the event of a fire-induced spurious opening of a pressurizer PORV. Analysis shows that indicated pressurizer water level momentarily goes below the indicating range and then returns to the indicating range when operators stabilize the plant at the auxiliary shutdown station as long as the closing of the pressurizer PORV block valve is initiated within 60 seconds of the manual reactor trip. A loss of off-site power is less limiting for this scenario because a loss of offsite power would result in the immediate loss of the RCPs, a failure of the SUFP to start and a delay in the delivery of auxiliary feedwater due to the sequencing of the AFW pumps onto the standby diesel generator. The loss or delay of this equipment delays the transfer of heat from the RCS, thus reducing the shrink in the RCS which mitigates the reduction of pressurizer water level.

This operator action would not be negated by a single subsequent spurious actuation because both the pressurizer PORV and the associated pressurizer PORV block valve would have to open due to fire-induced spurious actuations for an uncontrolled depressurization and loss of RCS inventory to occur.

Secure all RCPs The purpose of tripping all RCPs is to protect against an uncontrolled depressurization of the RCS in the event a fire-induced circuit failure causes a pressurizer spray valve to spuriously open. In addition, tripping the RCPs protects the RCP seals which in turn protects the primary coolant pressure boundary. Analysis confirns that indicated pressurizer water level will remain on-scale as long as the RCPs are tripped within 120 seconds of the manual reactor trip. A loss of off-site power is less limiting because the RCPs would immediately trip so that the motive force for pressurizer spray would not be available to result in an uncontrolled depressurization.

This operator action would not be negated by a single subsequent spurious actuation because both a RCP would have to spuriously start and a pressurizer spray valve would have to open due to fire-induced spurious actuations for an uncontrolled depressurization to occur.

Enclosure 1 NOC-AE- 13002962 Page 18 of 50 Close feedwater isolation valves The purpose of closing the main feedwater valves is to protect against an uncontrolled cool down of the RCS in the event of a fire-induced spurious start of the SUFP. The second purpose of closing the main feedwater valves is to prevent overfilling the steam generator.

Analysis confirms that indicated pressurizer water level and steam generator level will remain on-scale as long as feedwater isolation is completed within 120 seconds of the manual reactor trip. A loss of off-site power is less limiting because the SUFP will not start because the power source to the pump motor is not diesel-backed.

This operator action would not be negated by a single subsequent spurious actuation because both the SUFP would have to start and a main feedwater isolation valve would have to open due to fire-induced spurious actuations for an over cooling of the RCS and an overfilling of a steam generator to occur.

Secure the SUFP The purpose of preventing the SUFP from starting is to protect against an uncontrolled cool down of the RCS in the event of a fire-induced spurious opening of a feedwater isolation valve. The second purpose is to prevent overfilling the steam generator. Analysis confirms that the pressurizer level and the steam generator level will remain on-scale if the SUFP is secured by placing the pumps in PULL-TO-LOCK condition within 120 seconds of the manual reactor trip. A loss of off-site power is less limiting because the SUFP will not start because the power source to the pump motor is not diesel-backed.

This operator action would not be negated by a single subsequent spurious actuation because both the SUFP would have to start and a main feedwater isolation valve would have to open due to fire-induced spurious actuations for an over cooling of the RCS and an overfilling of a steam generator to occur.

Isolate RCS letdown The purpose of isolating letdown is to reduce the possibility of an uncontrolled loss of RCS inventory because charging (i.e. RCS makeup) is secured. The analyses for each proposed operator action did not assume an additional reduction in pressurizer water level after two minutes due to letdown flow. Therefore, to ensure the analyses for the other proposed operator actions remain valid, operators will be required to secure letdown within two minutes of reactor trip.

There is no single subsequent spurious actuation scenario that negates this operator action because more than one valve would have to spuriously actuate.

Enclosure 1 NOC-AE- 13002962 Page 19 of 50 Secure the CCPs The purpose of preventing the CCPs from starting is to protect against an uncontrolled depressurization of the RCS in the event of a fire-induced spurious opening of a pressurizer auxiliary spray valve. Another purpose is to protect the pumps for use later to achieve cold shutdown. Analysis confirms that the pressurizer level will remain on-scale as long as the CCPs are secured within 120 seconds of the manual reactor trip. A loss of offsite power is less limiting because the CCPs do not automatically sequence and load on the emergency electrical bus.

If one CCP spuriously starts and automatic functions do not occur to provide an alternate source of makeup water, the inventory in the volume control tank (i.e., the normal source of water to the CCP suction) would quickly deplete leading to air binding in the pump.

However, the second CCP remains available.

There is no single subsequent spurious actuation scenario that negates this operator action.

3.4.3 Uncertainty Analysis of Proposed Operator Actions The model to perform the thermal-hydraulic analyses for the proposed operator actions reflected nominal conditions and set points. Based on the results presented in Attachment 1 to this enclosure, maintaining pressurizer level in the indicating range is the limiting criteria with regard to compliance with Section III.L of Appendix R. To evaluate the impact of uncertainties on the initial conditions, analysis of the spuriously opened pressurizer PORV was performed.

The assumptions and results of the uncertainty analysis are presented in Section A 1.8 of to this enclosure. The results demonstrate that although pressurizer level decreases below the indicating span, the pressurizer does not empty. Adequate sub-cooling margin is maintained throughout the event.

When applying uncertainties to the licensing basis analysis, plant safe shutdown can be achieved and maintained without adversely impacting fission product boundary integrity.

3.5 Automatic Turbine Trip Analysis The proposed change credits the automatic turbine trip upon a manual trip of the reactor. An automatic turbine trip will prevent a rapid cool down of the RCS so that pressurizer level remains within the indicating range.

When the reactor trip breakers open in response to a manual reactor trip signal, an automatic turbine trip signal is generated in each of two independent solid state protection system logic and actuation trains. A signal is generated to the turbine electro-hydraulic control system cabinet (located outside the control room) to trip solenoids for repositioning valves in the turbine

Enclosure 1 NOC-AE-13002962 Page 20 of 50 electro-hydraulic control system that dump oil pressure and allow the turbine throttle and governor valves to rapidly close under spring pressure thus securing steam flow to the main turbine. Once oil is unloaded, the fire-induced circuit failure can not fail in a condition where oil would be re-directed to re-open the turbine throttle and governor valves.

Regarding the control panels within the main control room where the manual reactor trip and the automatic turbine trip control circuitry is located, physical and electrical separation is provided between the Class I E Control Circuits, Class 1E Instrumentation Circuits (Post-Accident Monitoring), Balance of Plant (BOP), and the non-Class 1E Circuits to preserve redundancy and to ensure that the effects of a single postulated event (such as a fire or short circuit) will not impact the operation of the redundant circuits.

The separation requirements for these circuits are in accordance with Section 5.6 of the IEEE 384 (Reference 6.11), and NRC Regulatory Guide 1.75 (Reference 6.12). The methods for achieving the separation requirements consist of any of the following methods or a combination thereof:

" Mounting the Class 1E devices on physically separate control bench boards.

• Providing a fire-retardant barrier or air space for redundant Class I E devices in close proximity. This separation consists of:

1. Six-inch physical separation between devices,

2. One-inch air space between device and barrier, or

3. Thermal insulating material as a barrier only when one-inch air space is unachievable.

" Enclosed metal wire ways.

" Metallic Conduit.

The Class 1E logic and control circuits, reactor trip and engineered safety features (ESF) actuation barrier switches, Class 1E instrumentation circuits, and the non-Class 1E circuits meet the separation criteria described above.

The separation between redundant Class I E devices and between Class 1E and non-Class 1E devices mounted in close proximity is achieved by a flame-retardant barrier.

Redundant Class 1E circuits that are located in close proximity to one another are routed in either an all-metal wire way system that has removable covers or metallic conduit between the first wire connection point (within a few feet of the board-mounted device) and the control board termination area.

For any exposed wiring up to a termination point, a minimum distance of six inches is maintained between separation groups. If the separation criteria cannot be met, a physical barrier is utilized. Where this physical barrier is utilized, a minimum one-inch air space is provided

Enclosure 1 NOC-AE-13002962 Page 21 of 50 between the Class 1E circuits (or devices) and the barrier. If the one-inch air space cannot be provided, thermal insulating material is used.

The wiring for the Class 1E and non-Class 1E circuitry is flame-retardant as required by Section 2.5 of IEEE 383 (Reference 6.13) and Section 4.3 of IEEE 420 (Reference 6.14)

Additionally, the function of a manual reactor trip from within the Control Room is a redundant function. In the Control Room, there are two separate control panels where a reactor manual trip switch is located. Each of the control panels where these reactor trip switches are located meet the separation criteria described above and the panels are separated from one another by a distance of approximately ten feet. Because the control room is continuously occupied, it is not concluded that a fire would go undetected to the point where both control panels are affected before the required action to manually trip the reactor is performed. Therefore, the turbine trip is assured.

The manual reactor trip and the automatic turbine trip circuitry are independent of one another and meet the separation criteria described in the preceding paragraphs. A turbine trip is initiated as the result of a manual reactor trip and the redundant manual reactor trip circuits within the control room would not be impacted by a single fire-induced circuit failure in a manner that would prevent accomplishment of the turbine trip function. It is reasonable to conclude that a single fire will not affect a turbine or any other redundant trip signal (i.e., manual reactor trip) for a control room fire. Based on the mechanics of the manual reactor and the automatic turbine trip functions and the electrical separation attributes between redundant features, it is reasonable to conclude that an automatic turbine trip would be initiated as the result of a manual reactor trip and would not subsequently be negated by a fire-induced circuit failure.

3.6 Electrical Isolation Capability Analysis If evacuation of the control room is required, the operators can establish and maintain the plant in a safe shutdown condition from outside the control room through the use of controls located at the auxiliary shutdown panel (ASP), transfer switch panels in the emergency switchgear rooms and other local control stations. These stations outside the control room provide the capability, in conjunction with limited local manual actions, for implementing cold shutdown from outside the control room.

The controls on the ASP are electrically isolated from those in the control room by transfer switches and fuses located on the transfer switch panels, with the exception of the controls associated with the turbine-driven auxiliary feedwater (AFW) pump train and associated flow regulation. The transfer switches for the turbine-driven AFW pump and associated flow regulation controls are located on the ASP.

Six transfer switch panels are located in the Electrical Auxiliary Building with two of the panels located in each of their associated switchgear rooms on elevations 10 foot, 35 foot, and 60 foot.

Enclosure 1 NOC-AE- 13002962 Page 22 of 50 The switches and controls provided on the transfer switch panels are Class 1E. Electrical and physical separation is maintained between the separation groups. The transfer switch panels provide control transfer between the control room and the ASP control circuits. In addition, control is provided on the transfer switch panels for equipment that requires one time or infrequent control during safe shutdown.

The transfer switches isolate the control room circuit from the ASP or local panel circuit to ensure that the effects of a fire in the control room will not impact the ability to safely shutdown the plant. The alternate shutdown stations have the capability of accepting a contact input from the transfer switch for the transfer of control from the control room to the ASP or local panels and vice-versa. Connection to the operator interface modules (OIMs) are provided with adequate isolation or buffering such that a short, hot short, open circuit or ground through the non-active OIM or its cabling will not affect control by the active OIM or the functioning of the remainder of the system. The active OIM is selected through a separate transfer switch.

There are three types of control circuit configurations that are implemented at STP.

(1) The first control circuit configuration uses a transfer switch to perform the "transfer" and "isolation" functions. When the transfer switch is placed in the ASP/Local position, two sets of switch contacts operate in a "break-before-make" configuration. The first set of contacts open to electrically isolate the control room's control circuit. A second set of contacts close to transfer the component's control to the alternate control panel.

(2) The second control circuit configuration uses qualified data processing system (QDPS) to perform the "transfer" and "isolation" functions. The transfer switch provides a "control position" input signal to QDPS which then transfers and isolates the component's control capability.

(3) The third control circuit configuration uses a transfer switch to perform the transfer function. The isolation function is performed by a combination of a transfer switch and fuses. The transfer switch functions as described in (1) above. The fuses are sized to electrically isolate the control room circuit before a loss of any upstream interrupting device causes loss of a common power source.

3.7 Human Performance Reliability Analysis of the Proposed Operator Actions Although the decision to evacuate the control room is impacted by the unpredictability of the time from detection of a fire to the time the fire progresses to the point where the control room must be evacuated, the fire hazards analysis assumes that the operators will be pre-alerted to perform the proposed operator actions because the actions are not required until the reactor is manually tripped. There are numerous fire detectors located throughout the control room fire area, as described in Section 3.8.2, to pre-alert the operators. Operator walk down performance demonstrates (see preceding Table 1) that these actions can be performed in rapid succession

Enclosure 1 NOC-AE- 13002962 Page 23 of 50 following the initiation of the reactor trip to support the time line that assures that the requirements of Appendix R,Section III.L are met.

The following are qualitative human-system interface time-motion study analyses to demonstrate that it is reasonable to conclude that the proposed control room operator actions can be performed reliably within the time required by the thermal-hydraulic analyses. An STP qualified Human Factors Engineer and Senior Reactor Operator observed the time validation exercises.

3.7.1 Does adequate time exist to perform the proposed operator actions?

Yes.

The initiation of a fire in the control room will be rapidly diagnosed by the control room operators. Progression of the fire and the need for evacuation should be readily apparent so that time will be available to prepare for the actions. Once a decision to evacuate the control room is made, the control room operator uses a procedure to direct the actions to be taken.

Hence, the operator is pre-staged to rapidly perform the actions because initiation is not required until direction is made to manually trip the reactor.

The capability to perform the operator actions following a reactor trip is assessed in the aggregate. The validation of the operator actions are timed in sequence such that the time to perform any individual action is dependent on performing the prior required action(s).

Operator walk down performance data indicates that these actions can be performed in less than 90 seconds (a recent performance demonstrated that the steps were performed in 58 seconds) following initiation of the reactor trip. This meets the thermal-hydraulic analysis which requires all the actions to be completed in less than 120 seconds.

In conclusion, adequate time is available to perform the proposed operator actions.

3.7.2 Were environmental aspects considered that impact the performance of the proposed operator actions?

Yes.

A fire in the control room that is progressing to a condition where control room evacuation is required will result in a stressful environment for the control room operators. However, the operators are in an area that they routinely perform plant operations during normal, off normal and emergency conditions. The required actions for the control room evacuation are many of the same actions that operators routinely train on in response to other emergencies.

The operators are already in the area and manning the panels where the actions are required to be performed. The control room is in a non-radiological controlled area. No special

Enclosure I NOC-AE-13002962 Page 24 of 50 protective clothing is required to perform the actions. Sufficient emergency lighting exists in the control room. The actions can be performed using normal face-to-face communications.

The actions are performed by a single operator in the control room from adjacent panels. See Figure 1 of this enclosure.

In conclusion, the environmental conditions in the control room will not impede the performance of the proposed operator actions.

3.7.3 Will the required equipment to achieve and maintain a post-fire hot shutdown condition remain functional and accessible?

Yes.

The controls to perform the proposed operator actions are readily accessible at adjacent control board panels in the control room. The proposed operator actions would not be negated by subsequent spurious actuation signals resulting from the postulated fire.

The equipment necessary to achieve and maintain post-fire hot shutdown are outside the control room. The alternate circuits to operate this equipment are isolated from the control room circuits and will not be damaged or otherwise adversely affected by a fire in the control room.

In conclusion, the equipment necessary to achieve and maintain post-fire hot shutdown remains functional and accessible.

3.7.4 Are indications readily available to detect and diagnose the initiation of a control room fire and to perform the proposed operator actions?

Yes.

Ionization smoke detectors are provided in each fire zone in Fire Area 1 that includes the manned control room. A fire in the control room will be rapidly detected by the control room operators. Operator actions are performed rapidly in the control room prior to evacuation without further diagnosis. The actions are backed up from outside the control room within a short period-of-time. Sufficient control room instrumentation is available to perform the proposed operator actions.

In conclusion, indications are readily available to detect and diagnose the initiation of a control room fire and to perform the proposed operator actions.

Enclosure 1 NOC-AE- 13002962 Page 25 of 50 3.7.5 Is equipment available to support communications among personnel required to perform the proposed operator actions?

Yes.

The operator manual actions will be performed using face-to-face communications in the control room. The equipment used to establish communications with the ASP station are a combination of sound-powered telephone circuits and portable radios. None of the communications equipment outside the control room will be adversely affected by a fire within the control room.

In conclusion, communications capability is available to assure the performance of the proposed operator actions.

3.7.6 Is necessary portable equipment available to support the performance of the proposed operator actions?

Portable equipment is not required to support the performance of the proposed operator actions.

Portable radios and sound powered phones are used by Plant Operators to establish communications with the ASP station in order to transfer equipment needed to achieve hot shutdown conditions and isolate the control room circuits. The radios are part of the normal equipment carried by the Plant Operators such that functionality is routinely verified during the shift. Plant Operators are trained in the routine use of the portable radio equipment. Head sets for the sound-powered phone system are pre-staged at the alternate shutdown stations.

The functionality of the sound-powered phone circuit is checked quarterly.

In conclusion, although portable equipment is not required to support the performance of the proposed operator actions in the control room, portable radios and sound-powered phones remain functional and accessible for transferring equipment and controls needed to achieve and maintain hot shutdown conditions.

3.7.7 Is personnel protection equipment available to support the performance of the proposed operator actions?

Personnel protection equipment is not required to perform the operator manual actions.

3.7.8 Do procedures and training exist to support the reliability of performing the proposed operator actions?

Yes.

Enclosure 1 NOC-AE- 13002962 Page 26 of 50 Fires in control room leading to evacuation are addressed by procedure, OPOP04-ZO-000 1, "Control Room Evacuation". The procedure is structured such that once the decision is made to evacuate the control room, the operator actions are performed in sequence by a single operator prior to performing any other steps in response to a fire. The procedure was validated to have the required level of detail, understandability, plant compatibility, and operator compatibility to perform the proposed operator actions. The plant operations staff is trained on the use of this plant procedure through initial licensed operator training and periodically through the licensed operator requalification program. The operator actions are straightforward and familiar to the operators. Once the fire condition is diagnosed and control room evacuation is needed, the operator actions are performed in sequence without further diagnosis.

In conclusion, written procedures and training support the reliability of performing the proposed operator actions.

3.7.9 Are there adequate numbers of qualified personnel on site at all times to support the reliability of performing the proposed operator actions?

Yes.

The proposed operator actions are performed by a single on shift operator assigned to the control room. The operator has no other responsibilities during the performance of these actions.

In conclusion, adequate numbers of qualified personnel are on site at all times to support the reliability of performing the proposed operator actions.

3.7.10 Have the proposed operator actions been demonstrated that they can be achieved in a reliable manner?

Yes.

The actions are performed by a single operator in the control room at adjacent panels (see Figure 1). The actions involve operations performed in response to other emergency operations that the operators are routinely trained to perform.

Training and practice on the control room evacuation procedure is done at a frequency consistent with that established in existing training programs on abnormal procedures in compliance with 10 CFR 50.120. A demonstration was completed by a randomly selected crew to validate that the actions can be performed within the required times consistent with the thermal-hydraulic analysis. Subsequently, each operations crew has been trained and evaluated to ensure that the operator actions can be completed within the required times.

Enclosure 1 NOC-AE-13002962 Page 27 of 50 Operator walk down performance data indicates that the proposed operator actions can be performed in less than 90 seconds (a recent performance demonstrated that the steps were performed in 58 seconds) following initiation of the reactor.

During the 2011 Triennial Fire Protection inspection (Reference 6.3), the inspection team performed timed operator walk-downs of the alternative shutdown procedure (i.e. the control room evacuation procedure). The inspection team determined that operators completed the manual actions inside the control room (i.e., the proposed operator actions) within the time required by the thermal-hydraulic analysis.

In conclusion, the proposed operator actions been demonstrated that they can be achieved in a reliable manner.

3.7.11 Conclusion The proposed operator actions have been validated and demonstrated such that it is reasonable to conclude that the proposed control room operator actions can be successfully performed within the time required by the thermal-hydraulics analysis.

3.8 Defense-in-Depth (DID) Analyses The concept of DID, described in 10 CFR 50, Appendix R, is applied to fire protection in fire areas important to safety. The following three FPP objectives were evaluated:

1. Prevent fires from starting;

2. Detect rapidly, control, and extinguish promptly those fires that do occur; and,

3. Provide protection of structures, systems and components (SSC) important to safety so that a fire that is not promptly extinguished by fire suppression activities will not prevent the safe shutdown of the plant.

In addition, the concept of DID is supported by the following:

" The control room was fire modeled to assess the likelihood of fire propagation from one control panel to an another control panel.

" Thermal-hydraulic analyses were performed to determine the impact of the limiting spurious actuations on the capability of the plant to achieve safe shutdown conditions if "none" of the proposed operator actions other than manual reactor trip and automatic turbine trip were performed prior to leaving the control room.

Enclosure I NOC-AE- 13002962 Page 28 of 50 3.8.1 Fire Prevention Objective The area of the plant where the fire could occur that would require the operator actions to be performed has combustible loading allowances and limitations on hot work or other activities that are similar to other plant areas. Flammable liquids are not stored within the control room boundary. In situ combustible loading is IEEE 383 cable (which is thermoset material) and ordinary Class A combustibles. The cabling is designed to meet the requirements of IEEE-383 and consists of control and instrumentation circuits. There are no other combustible materials above the suspended ceiling except power cables for lighting which are encased in steel conduit.

The combustible material in the overhead is IEEE 383 cable which is fire resistant and has a very low flame spread rating. Therefore, self ignited cable fires are not postulated due the fire retardant properties of the thermoset cables. Controls are in place to ensure that fire barrier breaches are tracked and that compensatory measures are established, when required.

The objective of fire prevention continues to be met with the proposed change.

3.8.2 Detect, Control and Extinguish Fires Objective A fire within the control room will be detected in its incipient stages and alarm in the control room. It is unlikely that a fire within the main control room would prompt a control room evacuation due to the spatial separation between control panel circuits. Any fires within the main control room are expected to be short lived.

The control room is Fire Zone Z034 in Fire Area 1. Fire Zone Z032 (the relay cabinet area of the control room) and Fire Zone Z083 (the watch supervisor's office) are also part of Fire Area 1.

Fire Area 1 is located at elevation 35 foot in the electrical portion of the Mechanical/Electrical Auxiliary Building.

Ionization smoke detectors are provided in each fire zone in Fire Area 1. The operating area of the control room is enclosed by a seismically-designed suspended ceiling and architectural barriers, all of which are constructed of materials with a flame spread rating of 50 or less. Fire detection is provided throughout the control room both above and below the suspended ceiling and in the safe-shutdown control cabinets, including each main control panel, to pre-alert the control room operators of the initiation of a fire. The detectors alarm at the local fire panel and inside the control room itself. Detector spacing is such that the number of detectors employed is several times that required by NFPA 72E- 1978 (Reference 6.15).

Fire protection is effected through portable water and carbon dioxide agent extinguishers as well as hose streams from standpipes strategically located near the control room entrances and adjacent to Fire Zone Z036. Fire Zone Z036 is located immediately outside of the control room entrance door. The majority of cables can be effectively reached by these hose streams from the floor level.

There are only 38 cable trays (of which approximately 20% are covered) above the suspended

Enclosure 1 NOC-AE-1 3002962 Page 29 of 50 ceiling. These trays are 40% filled. The cable trays have been grouped into 5 clusters and separated to provide ready access for manual fire fighting efforts. All cable trays that enter this area terminate in this area.

The main control room overhead area is provided with a seismically-designed catwalk to provide easy access for manual suppression in the event of this area needs to be accessed to extinguish a fire. A fire in the overhead would be short-lived because the fire should slowly progress and the area is easily accessed from the continuously occupied main control room operating area below.

Smoke and soot originating from a fire in the main control room is not expected to propagate outside of the control room panel to adjacent areas where alternative shutdown functions are performed. The control room boundary is a 3-hour rated fire barrier except for those portions described in Section 3.8.3 that are rated at 1-1/2 hour or better. The control room has its own ventilation system for purging smoke to the outside atmosphere.

The heating, ventilation and air conditioning (HVAC) system return ducts contain smoke detectors which, upon activation, close dampers and divert airflow into a purge and cleanup mode. The HVAC system has manual override capability. The space above the suspended ceiling is not used as an HVAC plenum and contains limited combustibles.

STP has an essential lighting system in the control room with power provided by engineered safety feature diesel generators A and C. If power is lost to essential lighting, emergency Appendix R lights exist throughout the control room.

Automatic Halon suppression is provided in the relay portion of the control room (i.e. Fire Zone Z032). Ventilation system dampers are provided that close on actuation of the suppression system to isolate the occupied main control room from the relay room. The isolation dampers prevent the suppression gas from leaving the relay room area to aid in suppressing a fire. The safety-related actuation cabinets containing plant protective actuation circuitry are of heavy metal construction and separated by a two-inch air gap to provide assurance that a single fire would not affect redundant safety trains.

The control room is continuously manned by at least a Senior Reactor Operator and Reactor Operator to meet minimum manning requirements, and typically manned by five Licensed Operators. This makes is highly likely that a fire will be detected in its incipient stages. License Operators are familiar with the application of manual fire suppression agents so that most fires would be controlled and/or extinguished by a control room staff member before the fire brigade arrives at the scene.

Automatic fire suppression has not been provided in the control room as the use of manual suppression by trained personnel provides a high reliability against accidental introduction of fire protection agents into this safety-related area. Considering the high density early warning detection provided, the wide spacing of the trays, the type of cables and size of trays, the full accessibility of manual hose streams, and the continuous manning of the control room below, the use of automatic systems in this room is neither justified nor necessary.

Enclosure 1 NOC-AE- 13002962 Page 30 of 50 The objective of detecting, controlling, and extinguishing fires continues to be met with the proposed change.

3.8.3 Protect SSCs so that Fires Will Not Prevent Safe Shutdown Objective Existing fire protection regulations rely on passive fire protection through fire barriers that, when functional, have a high level of reliability to prevent the damage to redundant trains required for safe shutdown. In the event of a main control room or relay room fire, cold shutdown can be achieved and maintained from the ASP, transfer switch panels in the emergency switchgear rooms, other local control stations and motor control cabinets. Transfer switches located outside the control room isolate the control room circuits from the ASP or local panel circuits to ensure that the affects of a fire in the control room will not impact the ability to safely shutdown the plant.

The walls, floors, and ceilings of Fire Area 1 are all 3-hour rated fire barriers except those portions of Fire Zones Z032 and Z034 that are adjacent to Fire Area 19. Fire Area 19 is a stairwell that has a 2-hour fire rating with Class B labeled doors and 1-1/2 hour rated fire dampers. The structural steel supporting the fire barrier is fireproofed to the same rating as that required of the barrier. Doors and penetrations contained in these fire barriers have fire ratings compatible with that of the barrier. Ventilation duct penetrations in fire barriers are provided with 3-hour rated fire dampers installed in accordance with the manufacturer's instructions. In Fire Zone Z005, the ventilation duct in the south wall at the 10 foot elevation is not provided with a three-hour fire damper. To compensate for the lack of the fire damper, the duct that extends from the wall to the nearest fire damper is provided with 3-hour fire-rated coating.

Although the Fire Area 1 fire zone boundary penetrations are not provided with rated penetration seals or HVAC dampers, Fire Area 1 has substantial boundaries between Fire Zones and the boundary encompassing the Fire Area to limit the spread of fire.

Robust circuit separation exists between safety trains within the control room. No safety-related circuits are routed directly from the control room panels to the relay room. All safety-related trains are routed back to the respective switchgear or cable spreading room before being routed back to the relay room. Typically, safety train A circuits are routed down through the floor and safety train B and C circuits are routed up or to the side of the control room from the panels.

Safety train B and C circuits are routed in steel-enclosed cable barrier/channels (see Figure 2 to the enclosure) to their respective cable tray outside of the control panel.

3.8.3.1 Main Control Room/Relay Room Separation The robust separation between the main control room and the relay room in Fire Area I makes the propagation of fire from one zone to the other unlikely. The control room is divided into two main areas, the main control room and the relay room. See Figure 3 to this enclosure. The main control room is an independent fire zone from the relay room fire zone.

The zone boundary between the main control room Fire Zone 034 and the relay room Fire

Enclosure 1 NOC-AE- 13002962 Page 31 of 50 Zone 032 is separated by a 12-inch concrete wall with dampers to isolate the main control room from the relay room. The wall dampers close on actuation of the fire suppressant Halon system in the relay room and prevent Halon from entering the main control room. All penetrations in the wall are sealed to prevent the spread of fire. In Unit I only, a 1-1/2 hour-rated fire door exists between the main control room and the relay room.

The separation of Fire Zone 32 from Fire Zone 34 provides a high likelihood that the performance of the requested actions in the main control room will be successful should a fire initiate in the relay room. Likewise, the automatic functions in the relay room are expected to be successful if a fire initiates in the main control room.

Cable and panel layouts help reduce the likelihood that a fire in the relay room will progress to a point where control room evacuation is necessary. In the unlikely event that a fire occurs within the relay room and progresses to where the fire started affecting circuits and challenging continued operation of the plant, the requested operator actions can be performed from within the main control room because this area is independent of the relay room. In addition, assuming a fire in the relay room started to adversely impact circuits, automatic functions are expected to be successful in at least one safety train due to relay room train separation layout, as discussed above.

The DID layout of the main control room and relay room is discussed below:

3.8.3.1.1 Main Control Room Layout The main control room consists of the main control panels and overhead cable trays. Fire detectors are installed in each main control panel. The main control room is continuously manned. A fire within the control room will be detected in its incipient stages and alarm in the control room. Fires within the main control room are expected to be short-lived.

The separation requirements for the control panel circuits are in accordance with Section 5.6 of the IEEE 384 standard, and NRC Regulatory Guide 1.75. The methods for achieving the separation requirements consist of any of the following methods or a combination thereof-

" Mounting the Class 1E devices on physically separate control bench boards.

• Providing a fire retardant barrier or air space for redundant Class 1E devices in close proximity. This separation consists of-

1. Six-inch physical separation between devices, or

2. Rigid metal barrier.

• Enclosed metal wireways.

• Metallic conduit.

The Class 1E logic and control circuits, reactor trip and ESF actuation barrier switches, Class I E instrumentation circuits, and the non-Class 1E circuits meet the separation criteria described above. The separation between redundant Class 1E devices and

Enclosure 1 NOC-AE-1 3002962 Page 32 of 50 between Class 1 E and non-Class 1E devices mounted in close proximity is achieved by a flame-retardant barrier. Redundant Class 1E circuits that are located in close proximity to one another are routed in either an all-metal wireway system that has removable covers or metallic conduit between the first wire connection point (within a few feet of the board-mounted device) and the control board termination area. For any exposed wiring up to a termination point, a minimum distance of six inches is maintained between separation groups. If spatial separation criteria cannot be met, a physical barrier is utilized. The wiring for the Class IE and non-Class IE circuitry is flame retardant as required by IEEE 383, Section 2.5 and IEEE 420, Section 4.3.

3.8.3.1.2 Relay Room Layout The relay room provides for a robust separation of solid state protection system (SSPS) and ESF actuation trains cabinets. See Figure 4 of this enclosure.

The SSPS is comprised of two redundant logic trains (R and S) and three ESF actuation trains (A, B, and C) that are physically and electrically independent. Inputs to the SSPS logic trains are derived from various sensors that monitor nuclear and non-nuclear variables. Most of these signals are processed in the analog protection system racks and result in bistable outputs to the SSPS. Inputs to ESF actuation trains are derived from those plant components which prevent or mitigate damage to the reactor core and which prevent or mitigate the release of radioactivity to the environment. The ESF actuation train cabinets take inputs from both SSPS logic train cabinets and actuate specific components.

Both physical and electrical separation of redundant analog channels is maintained from the process sensors to the analog protection equipment racks using separate cable trays, conduit, and penetrations. The separation is maintained through these equipment racks to the input compartments of the SSPS logic circuits. Separate cable trays are used to carry the interconnecting wiring between the bistable output and the input compartment of each logic train. Separation and isolation between the analog and logic systems are achieved by way of the electrical and physical separation between the coil and contact of the input relays.

The redundant SSPS logic train actuation cabinets are separated by approximately 36 feet. The ESF actuation train cabinets are located between the SSPS logic train cabinets.

The cabinets are heavy gauge (1/4")steel and separated from each other by a 2-inch air gap with no intervening combustibles. The "A" train circuits in the relay room enter the room from below the room while "B" and "C" circuits are routed from the top and rear of the room.

The objective of protecting SSCs so that fires will not prevent safe shutdown continues to be met with the proposed change.

Enclosure 1 NOC-AE-13002962 Page 33 of 50 3.8.4 DID Thermal-Hydraulic Analyses Thermal-hydraulic analyses were perfonrmed to determine the impact of the limiting spurious actuations on the capability of the plant to achieve safe shutdown conditions if "none" of the requested operator actions other than a manual reactor trip and automatic turbine trip were perfonried prior to leaving the control room. For these analyses, Appendix R,Section III.L was not required to be met. The acceptance criteria for ensuring that safe shutdown can be achieved and maintained are:

" Sufficient core cooling is established and maintained throughout the transient.

" Fuel cladding integrity is not challenged.

" Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

" Charging and letdown are restored to support cooldown to cold shutdown conditions.

The DID analyses assume that automatic actuations within the control room area relay room function for at least one safety train because of the control room/relay room separation discussed previously in Section 3.8.3.1. Events were analyzed where:

(1) Offsite power is assumed to be available, and (2) A loss of offsite power (LOOP) is assumed to occur.

Summary of Limiting Event The limiting event impacting the capability of the plant to achieve safe shutdown conditions was determined to be an event where:

• No operator actions are performed prior to control room evacuation other than the manual reactor trip and automatic turbine trip,

" A pressurizer PORV spuriously opens immediately following reactor trip and remains open for ten minutes until control of the PORV and the PORV block valve is transferred to the ASP so that either the PORV or the PORV block valve is closed, and

• A LOOP occurs at the initiation of the transient.

Two cases were considered for this event, one case (Case 1a) with safety injection (SI) available and one case (Case lb) with no SI available.

Case la results With SI available, RCS flow decreases immediately when the RCPs trip because of the LOOP. Natural circulation is established and maintained throughout the transient. The pressurizer and the pressurizer surge line do not empty during the transient.

Enclosure I NOC-AE- 13002962 Page 34 of 50 Subcooling margin is maintained throughout the event and no voiding occurs in the hot legs or vessel. Therefore, fuel cladding integrity is not challenged. Sufficient core cooling is established and maintained. The reactor remains subcritical.

The transient is tenninated after 16,000 seconds (i.e., approximately four hours). At this time, indicated pressurizer level is within the range of 20 to 100%, and the indicated steam generator narrow range water level is within the range of 22 to 100%. The plant is stable and in a condition to commence cooling down to cold shutdown conditions.

Case lb results Without SI flow, the RCS pressure does not rapidly recover when the spuriously opened pressurizer PORV is closed which results in a loss of subcooling margin. Voiding in the RCS results in the indicated pressurizer level going off-scale high after 446 seconds but the pressurizer does not go water solid. With the closing of the spuriously opened pressurizer PORV and throttling of auxiliary feedwater (AFW) flow at 610 seconds, pressurizer pressure increases as a function of the hot leg saturation temperature.

With loss of off-site power, the RCPs are lost and natural circulation flow begins in the RCS.

As pressurizer pressure decreases due to the spuriously open pressurizer PORV, voiding results in two-phase flow in the RCS. Two-phase natural circulation flow is momentary lost in RCS loops 1 and 4, but is quickly regained as RCS pressure is restored. Two-phase natural circulation flow is maintained in RCS loops 2 and 3 ensuring flow through the core.

These conditions preclude reflux cooling from occurring. Adequate heat transfer to the secondary is maintained such that the RCS pressure stabilizes based on the set point pressure for the SG PORVs after 1626 seconds into the event.

Operators are able to control SG level at approximately 50 percent with AFW flow until voiding in the RCS decreases to such a point that indicated pressurizer water level is restored.

Core peak exit fluid temperature remains well below approaches 1200'F so that fuel integrity is not challenged.

The transient is tenrinated after 6,000 seconds (i.e., approximately 1.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). At this time, indicated pressurizer level is within the range of 20 to 100%, and the indicated steam generator narrow range water level is within the range of 22 to 100%. The plant is stable and in a condition to commence cooling down to cold shutdown conditions.

In both Case I a and Case Ib, the reactor remains subcritical. Natural circulation is maintained so that sufficient core cooling is established throughout the transient. The core exit thermocouples remain well below 1200°F so that fuel cladding integrity is not challenged. Pressurizer indicated level returns to within the range of 20 to 100%. Steam generator indicated level returns to within the range of 22 to 100%. Charging and letdown are restored to support cooldown to cold shutdown conditions.

Enclosure 1 NOC-AE- 13002962 Page 35 of 50 A detailed description of the DID thermal-hydraulic analyses and results is provided in to this enclosure.

3.8.5 Fire Modeling The limiting event concerned a fire-induced spuriously opened pressurizer PORV with a LOOP and with SI or without SI actuation. The controls and associated cabling for the pressurizer PORVs, offsite power breaker controls, and the SI system controls are physically separated in the main control room. The physical separation in the main control room allows for fire modeling to be used to determine if a credible fire in the main control room could affect both pressurizer PORV controls and the offsite power breakers controls or both a pressurizer PORV controls and the SI system controls.

A Consolidated Model of Fire Growth and Smoke Transport (CFAST) fire model was used for the purpose of this analysis. Specifically, the CFAST model was used to predict the fire conditions that the controls and associated cabling for the pressurizer PORVs, offsite power breakers, and SI system would be subjected to by bounding credible fire events. The fire conditions are compared with documented acceptance criteria for the controls and associated cabling to determine whether or not a credible fire event could cause either a spurious opening of a pressurizer PORV and a LOOP, or a spurious opening of a pressurizer PORV and a loss of the SI system.

The bounding fire scenario was determined to be a fire that originates in the SI system controls cabinet, CPOO. The fire is of sufficient severity to fail the target controls and associated cables within CPOO1, but the conditions that the pressurizer PORV cabinet, CP004, and the offsite power breaker cabinet, CPO10, are subjected to during the fire scenario are only marginally above ambient conditions. The fire scenario created by a fire originating in CPOO1 was determined to bound fire scenarios where the fire originates in CP004 or CP010.

The results of the CFAST fire model show that it is reasonable to conclude that a fire initiating in one main control room control panel will not propagate to affect both the pressurizer PORV controls and the offsite power breaker controls or both the pressurizer PORV controls and the SI system controls. Therefore, it is reasonable to conclude that the limiting event analyzed in Section 3.8.4 will not occur. The details of the fire modeling analysis are provided in Attachment 3 to this enclosure.

3.8.6 DID Summary The following FPP objectives continue to be met with the proposed change.

" Fire prevention,

" Detecting, controlling, and extinguishing fires, and

" Protecting SSCs so that fires will not prevent safe shutdown

Enclosure 1 NOC-AE- 13002962 Page 36 of 50 The robust separation between the main control room and the relay room in Fire Area 1 makes the propagation of a fire from one zone to the other unlikely so that one of the zones remains available to support safe shutdown while control is being transferred to the alternative shutdown stations.

Thermal-hydraulic analyses demonstrate that for the limiting case analyzed:

• Sufficient core cooling is established and maintained throughout the transient.

0 Fuel integrity is not challenged.

• Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

• Charging and letdown are restored to support cooldown to cold shutdown conditions Fire modeling demonstrates it is reasonable to conclude that a fire initiating in one main control room panel will not affect both the pressurizer PORV controls and the offsite power breaker controls or both the pressurizer PORV controls and the SI system controls so that it is reasonable to conclude that the limiting analyzed case will not occur.

3.9 Technical Evaluation Conclusion

" Thermal-hydraulic analyses demonstrate that the successful performance of the proposed operator actions will assure that the requirements of Appendix R,Section III.L are met.

• The proposed actions will not be negated by any one of subsequent fire-induced spurious actuations resulting from the postulated fire.

" The capability to shutdown the plant and achieve safe shutdown conditions is maintained when uncertainties are applied to nominal conditions and set points.

• Based on the mechanics of the reactor and turbine trip functions and the electrical separation attributes between redundant features, it is reasonable to conclude that an automatic turbine trip will be initiated as the result of a reactor trip and will not subsequently be negated by a fire-induced circuit failure.

• The proposed operator actions have been validated and demonstrated such that it is reasonable to conclude that the proposed control room operator actions can be successfully performed within the time required by the thermal-hydraulics analysis.

" Sufficient defense-in-depth is provided by fire protection features so that it is highly unlikely that the initiation of a fire in the control room would result in evacuation.

• Analyses demonstrate that the fire safe shutdown capability is maintained in the event none of the proposed actions in the control room are successful prior to evacuation other

Enclosure 1 NOC-AE-13002962 Page 37 of 50 than the manual reactor trip and automatic turbine trip.

4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria 4.1.1 Regulatory Requirements 10 CFR 50.48 "Fire Protection" paragraph (a) applies to STP. 10 CFR 50.48 paragraph (a)(1) states "Each holder of an operating license issued under this part or a combined license issued under part 52 of this chapter must have a fire protection plan that satisfies Criterion 3 of appendix A to this part."

10 CFR 50, Appendix A, General Design Criteria for Nuclear Power Plants Criterion 3 - Fireprotection.

Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on structures, systems, and components important to safety. Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components.

Criterion 19-Controlroom.

A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant accidents. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident.

Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.

Applicants for and holders of construction permits and operating licenses under this part who apply on or after January 10, 1997, applicants for design approvals or certifications under part 52 of this chapter who apply on or after January 10, 1997, applicants for and

Enclosure 1 NOC-AE- 13002962 Page 38 of 50 holders of combined licenses or manufacturing licenses under part 52 of this chapter who do not reference a standard design approval or certification, or holders of operating licenses using an alternative source term under §50.67, shall meet the requirements of this criterion, except that with regard to control room access and occupancy, adequate radiation protection shall be provided to ensure that radiation exposures shall not exceed 0.05 Sv (5 rem) total effective dose equivalent (TEDE) as defined in §50.2 for the duration of the accident.

The STPNOC License Condition 2.E for Unit 1 [Unit 2] specifies, STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No.

55 [62] and the Fire Hazards Analysis Report through Amendment No. 19, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; and as approved in the SER (NUREG-0781 ) dated April 1986 and its Supplements, subject to the following provision[s]:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

STP was licensed after January 1, 1979 and is not required to meet Appendix R. The approved STP FPP was reviewed by the NRC and is documented in the STP FHAR. The STP Fire Hazards Analysis Report (FHAR) provides an analysis of how the safe shutdown strategy for each fire area meets regulatory requirements.

The following are results of the FHAR analysis of how STP meets applicable sections of Appendix R.

Appendix R Requirements F STP Position III.G - Fire Protection of Safe Shutdown Capability

3. Alternative or dedicated shutdown 3. Alternate shutdown capability for all three capability and its associated circuits,-2 trains is provided outside the control room fire independent of cables, systems or components area to respond to a large control room fire.

in the area, room or zone under consideration, Following reactor trip from the control room, shall be provided: the transfer of control to the auxiliary shutdown panel and other points of control is

a. Where the protection of systems whose accomplished from outside the control room function is required for hot shutdown does not fire area. These circuits when transferred are satisfy the requirement of paragraph G.2 of independent of the control room fire area.

this section; or 1 A fixed fire suppression system has not been

Enclosure I NOC-AE- 13002962 Page 39 of 50 Appendix R Requirements STP Position

b. Where redundant trains of systems required provided throughout the control room. A for hot shutdown located in the same fire area detailed justification for this deviation is may be subject to damage from fire presented in Section 3.10 of the FHAR. The suppression activities or from the rupture or control room is continuously occupied and is inadvertent operation of fire suppression provided with portable fire extinguishers systems. inside the control room and fire hose stations near the entrances. Fire detection is provided In addition, fire detection and a fixed fire in the control room and the relay portion of suppression system shall be installed in the the control room is provided with an area, room, or zone under consideration. automatic Halon suppression system.

2 Alternate shutdown capability is provided by rerouting, relocating or modifying of existing systems; dedicated shutdown capability is provided by installing new structures and systems for the function of post-fire shutdown.

III.L - Alternate and Dedicated Shutdown Capability

1. Alternative or dedicated shutdown 1. Alternative shutdown capability is capability provided for a specific fire area provided where redundant safe shutdown shall be able to (a) achieve and maintain trains do not meet separation criteria. With subcritical reactivity conditions in the this capability, the plant can achieve and reactor; (b) maintain reactor coolant maintain subcritical reactivity conditions in inventory; (c) achieve and maintain hot the reactor; maintain reactor coolant standby conditions for a PWR (hot inventory; achieve and maintain hot shutdown 3 for a BWR); (d) achieve cold standby; achieve cold shutdown conditions shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; and within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown (e) maintain cold shutdown conditions conditions thereafter. With this capability, thereafter. During the postfire shutdown, the the reactor coolant system process variables reactor coolant system process variables can be maintained within those limits shall be maintained within those predicted predicted for a loss of normal ac power and for a loss of normal a.c. power, and the the fission product boundary can be fission product boundary integrity shall not maintained during the post-fire shutdown.

be affected; i.e., there shall be no fuel clad damage, rupture of any primary coolant An area by area analysis of the boundary, or rupture of the containment consequences of a fire in a given fire area is boundary. provided in Chapter 3.0 of the FHAR.

2. The performance goals for the shutdown 2. The performance goal for the shutdown functions shall be: functions are:

a. The reactivity control function shall be a. Reactivity control is provided by the

Enclosure I NOC-AE-13002962 Page 40 of 50 Appendix R Requirements STP Position capable of achieving and maintaining control rods and boration to achieve and cold shutdown reactivity conditions. maintain cold shutdown reactivity conditions.

b. The reactor coolant makeup function shall be capable of maintaining the b. The chemical volume and control reactor coolant level above the top of the system provides for primary coolant core for BWRs and be within the level makeup from the refueling water indication in the pressurizer for PWRs. storage tank or boric acid tanks through the charging pumps. Level monitoring

c. The reactor heat removal function shall is provided with pressurizer level be capable of achieving and maintaining instrumentation.

decay heat removal.

c. Heat removal is provided through the

d. The process monitoring function shall steam generators or residual heat be capable of providing direct readings of removal system.

the process variables necessary to d. Indications of process variables perform and control the above functions. required to achieve and maintain safe shutdown are provided in the main

e. The supporting functions shall be control room and at the auxiliary capable of providing the process cooling, shutdown panel.

lubrication, etc., necessary to permit the operation of the equipment used for safe e. The supporting functions are capable shutdown functions. of providing the process cooling, lubrication, etc., necessary to permit the operation of the equipment used for safe shutdown functions.

4.1.2 Regulatory Guidance NRC Regulatory Guide (RG) 1.189, Revision 2, "Fire Protection for Nuclear Power Plants" Section 5.4.1 The licensee should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system for fires in areas that require alternate or dedicated shutdown. After the operators transfer control from the control room to the alternative or dedicated shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plant's approved FPP.

Section 5.4.4

Enclosure 1 NOC-AE- 13002962 Page 41 of 50 The control room fire area contains the controls and instruments for redundant shutdown systems in proximity. (Separation is usually a few inches.) Alternative or dedicated shutdown capability for the control room and its required circuits should be independent of the cables, systems, and components in the control room fire area.

The damage to systems in the control room for a fire that causes evacuation of the control room cannot be predicted. The licensee should conduct a bounding analysis to ensure that safe conditions can be maintained from outside the control room. This analysis is dependent on the specific design. The following assumptions usually apply:

a. The reactor is tripped in the control room.

b. Offsite power is lost, as well as automatic starting of the onsite ac generators and the automatic function of valves and pumps with control circuits that could be affected by a control room fire.

The analysis should demonstrate that the capability exists to manually achieve safe-shutdown conditions from outside the control room by restoring ac power to designated pumps, ensuring that valve lineups are correct, and assuming that any malfunctions of valves that permit the loss of reactor coolant can be corrected before unrestorable conditions occur.

The only operator action in the control room before evacuation for which credit is usually given is reactor trip. For any additional control room actions deemed necessary before evacuation, a licensee should be able to demonstrate that such actions can be performed.

Additionally, the licensee should ensure that such actions cannot be negated by subsequent spurious actuation signals resulting from the postulated fire. The design basis for the control room fire should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system. After control of the plant is achieved by the alternative or dedicated shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plant's approved FPP.

4.2 Precedent The NRC has in the past accepted the use of operator actions in addition to tripping the reactor in order to meet regulatory requirements prior to evacuating the control room.

For the Susquehanna facility, the NRC accepted the use of operator actions for tripping both units, closure of the main steam isolation valves, closure of the feedwater discharge valves and tripping of the feedwater turbine prior to evacuating the control room. (Reference 6.16) The NRC concluded that since all actions, including the manual trip of the reactor, could be accomplished in rapid succession by a single operator at one location, this approach provided a suitable means of precluding potential spurious operations that could affect the shutdown

Enclosure 1 NOC-AE-13002962 Page 42 of 50 capability, while satisfying the concern for limiting the number of actions within the control room prior to evacuation.

For the Watt's Bar facility, the NRC found that the crediting of two actions (i.e., reactor trip and reactor coolant pump trip) prior to control room evacuation, for preventing overcooling caused by a spurious actuation of pressurizer spray valves, were adequately demonstrated during a July 1995 site visit and, therefore, is acceptable. (Reference 6.17)

For the Callaway plant, the NRC found that the crediting of two actions (i.e., reactor trip and closing the main steam isolation valves) prior to control room evacuation were acceptable for meeting the alternative shutdown capability. (Reference 6.18)

For the San Onofre facility, the NRC found that the crediting of the following actions, in addition to tripping the reactor prior to control room evacuation, was acceptable. The NRC found that these actions and other similar actions have been previously approved by the NRC staff at other power plants. (Reference 6.19)

" Trip the reactor coolant pumps

• Trip the charging pumps

• Close the main steam isolation valves and main feedwater isolation valves 4.3 Significant Hazards Consideration STPNOC has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change credits operations in the control room prior to evacuation in the event of a fire in order to meet safe shutdown performance criteria. The design function of structures, systems and components (SSC) are not impacted by the proposed change. The proposed change will not initiate an event. The proposed change does not alter or prevent the ability of SSCs from performing their intended function to mitigate the consequences of an initiating event. The proposed change does not increase the probability of occurrence of a fire or any other accident previously evaluated.

The proposed operations are feasible and reliable and demonstrate that the unit can be safely shutdown in the event of a fire with no significant increase in consequences.

Therefore, the proposed change does not involve a significant increase in the probability

Enclosure I NOC-AE-13002962 Page 43 of 50 or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change credits operations in the control room prior to evacuation in the event of a fire in order to meet safe shutdown performance criteria. The proposed change does not install or remove any plant equipment. The proposed change does not alter the design, physical configuration, or mode of operation of any plant structure, system or component.

Therefore, the proposed change does not introduce any new failure mechanisms or malfunctions that can initiate an accident.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change credits operations in the control room prior to evacuation in the event of a fire in order to meet safe shutdown performance criteria. The proposed change has no effect on the availability, operability, or performance of safety-related systems and components. The proposed change does not alter the design, configuration, operation, or function of any plant structure, system or component. The ability of any structure, system or component to perform its designated safety function is unaffected by the proposed change.

Thermal-hydraulic analyses demonstrate that the proposed operations to be performed in the control room will ensure that the reactor coolant system process variables remain within those values predicted for a loss of normal a-c power, as required by Section IIhL of 10 CFR 50, Appendix R. After control of the plant is achieved by the alternative shutdown system, the plant can be safely transitioned to cold shutdown conditions. A single fire-induced spurious actuation will not negate the proposed operations.

Considerable fire protection defense-in-depth features exist such that it is unlikely that a fire in the control room would result in evacuation. In the remote likelihood that control room evacuation is required and none of the proposed operator actions other than the manual reactor trip and automatic turbine trip are performed prior to arrival at the alternative shutdown stations, analyses confirm that adequate core cooling is maintained so that fuel cladding integrity is not challenged. The capability to achieve and maintain safe shutdown is maintained.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Enclosure I NOC-AE- 13002962 Page 44 of 50 Based on the above, STPNOC concludes that the proposed amendments do not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusion Based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 Environmental Consideration A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c) (9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 References 6.1 NRC letter dated November 20, 2012, "South Texas Project Electric Generating Station - NRC Problem Identification and Resolution Inspection Report 05000498/2012007 and 05000499/2012007 and Notice of Violation" (ML12325A789) (ST-AE-NOC-12002364) 6.2 South Texas Project Electric Generating Station - NRC Integrated Inspection Report 05000498/2006002 and 05000499/2006002, dated May 18, 2006.

(ML061390160) (ST-AE-NOC-06001496) 6.3 South Texas Project Electric Generating Station, Units 1 and 2 NRC Triennial Fire Protection Inspection Report 05000498/2011006 and 05000499/2011006, dated August 10, 2011 (ML11223A193) (ST-AE-NOC- 11002136) 6.4 Letter from David W. Rencurrel, STPNOC, to NRC Document Control Desk dated February 4, 2008, "License Amendment Request for Deviation from Fire

Enclosure 1 NOC-AE-13002962 Page 45 of 50 Protection Program Requirements." (ML080390483) (NOC-AE-07002212) 6.5 Letter from G. T. Powell, STPNOC, to NRC Document Control Desk dated June 2, 2011, "License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability." (MLI I 161A143) (NOC-AE-1 1002643) 6.6 Summary of October 11, 2012, Pre-Licensing Public Meeting with STP Nuclear Operating Company to Discuss the Proposed License for Approval of the Revised Fire Protection Program Related to the Alternate Shutdown Capability Documented in the Fire Hazards Analysis (TAC Nos. ME9182 and ME9183),

dated November 27, 2012. (ML12297A331) 6.7 Summary of March 11, 2013, Pre-Licensing Conference Call Public Meeting with STP Nuclear Operating Company to Discuss the Proposed License Amendment Request for Approval of the Revised Fire Protection Program Related to the Alternate Shutdown Capability Documented in the Fire Hazards Analysis (TAC Nos. MF0578 and MF0579), dated March 29, 2013. (ML13070A213) 6.8 NUREG-0781, Supplement No. 2, Safety Evaluation Report related to the operation of South Texas Project, Units 1 and 2, dated January 1987.

(NRC Agency Legacy #8702190398) 6.9 NRC Regulatory Guide 1.189, Revision 2, "Fire Protection for Nuclear Power Plants," dated October 2009.

6.10 WCAP-14882-P-A, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, April, 1999 6.11 IEEE 384 - "Standard Criteria for Independence of Class 1E Equipment and Circuits", and NRC Regulatory Guide 1.75, "Criteria for Independence of Electrical Safety Systems" 6.12 NRC Regulatory Guide 1.75, Revision 2, "Physical Independence of Electric Systems," dated September 1978 6.13 IEEE 383 - "Standard for Type Test of Class I E Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations" 6.14 IEEE 420 - "Standard for the Design and Qualification of Class IE Control Boards, Panels, and Racks used in Nuclear Power Generating Stations".

6.15 NFPA 72E-1978, Standard for Automatic Fire Detectors

Enclosure I NOC-AE- 13002962 Page 46 of 50 6.16 Letter from Chester Poslusny, NRC, to Robert G. Byram, Pennsylvania Power &

Light Company, dated October 21, 1997, "Evaluation of Fire Protection Issues, Safe Shutdown Methodology and Analysis of Associated Circuits, Susquehanna Steam Electric Station (SSES), Units 1 and 2." (TAC Nos. M90600 and M90601)

(NRC Agency Legacy Document No. 9711040196) 6.17 NUREG-0847, Supplement No. 18, Safety Evaluation Report related to the operation of Watts Bar Nuclear Plant, Units 1 and 2, October 1995.

(NRC Agency Legacy #9511290117) 6.18 NUREG-0830, Supplement No. 4, Safety Evaluation Report related to the operation of Callaway Plant, Unit 1, October 1984.

(NRC Agency Legacy #8411070331) 6.19 Letter from Donald Hickman, NRC, to Kenneth Baskin, Southern California Edison Company and Gary Cotton, San Diego Gas and Electric Company, dated June 29, 1988, "Revision 1 to the Fire Hazards Analysis Evaluation for San Onofre Units 2 & 3 (TAC Nos. 54814 and 54815) 0

Figure 1 Control Room Control Panel Switch Orientation

-097 W4S- ZC4-M wC-963 CONTROL ROOM

]ISOLAT ION SWITCH 4P I.REATO TRIPS POR BLOCK VALVE SWITCHES (TWOI ITCHES (UFOR) 8 5L FEEOWATER I!SILATIOSI SWITCH t(L)

&. STARTUP FEE )WATER PUMP PULL-TO-LOCK SWITCH LATION SWITCHES (TWO)

L CHARGING PU SPULL-TO-LOCK SWlTTOES (TWO)

E8 NOTE.

El ALL SaICTOES ARE ON UENOUMONMO PsAr Or PANEL EXCEPT SWITCHES 3 b 7 WHICH SAE ON VERTICAL I SECT ION OF PNEL.

SOUTH TEXAS PROJECT UNITS 16 2 CONTi1L NMO COMMnTLPAmD.

WIlTCHRI*INTAT IONI rI* I I 1O REVISIM I 0

Enclosure I NOC-AE- 13002962 Page 48 of 50 Figure 2 Control Room Panel Steel-Enclosed Barrier

Enclosure 1 NOC-AE- 13002962 Page 49 of 50 Figure 3 Fire Area 1 Separation Scheme 12" CONCRETE WALL WITH HALON DAMPERS

Enclosure 1 NOC-AE-1 3002962 Page 50 of 50 Figure 4 Relay Room SSPS and ESF Cabinet Separation/Layout

Attachment 1 to Enclosure 1 NOC-AE- 13002962 to Enclosure 1 Thermal-Hydraulic Analyses for the Proposed Operator Actions

Attachment 1 to Enclosure I NOC-AE-13002962 Page 1 of 42 Al Thermal-hydraulic Analysis for the Proposed Operator Actions Thermal-hydraulic analyses were performed to demonstrate that the proposed operator actions assure that Appendix R,Section III.L requirements are met. The analysis assumed a single fire-induced spurious actuation. The analyses used the RETRAN-02, MOD 005.3 computer code. Analyses using RETRAN-02, MOD 005.3 were performed within the conditions and limitations described in Reference A1.l as amended in References A1.2 and A1.3. The RETRAN-02 MOD005.3 code is the same as the RETRAN MOD 005.2 coded with error corrections. No new models are added to the code. A summary of the error corrections is reported in Reference A1.6. The model used in the analyses is described in WCAP 14882-P-A (Reference A1.4) as approved by Reference A1.5.

The model to perform the thermal-hydraulic analyses for the proposed operator actions reflects nominal conditions and set points. The results demonstrated that pressurizer level is the limiting criterion with regards to compliance with Section III.L of Appendix R. To evaluate the impact of uncertainties in the initial conditions, the results of the analyses presented in Section Al.l through A1.7 were reviewed to select the most challenging event with regard to fuel integrity as measured by subcooling. The spuriously opened pressurizer PORV event (Section A1.2) is used to evaluate the impact of uncertainties in the initial conditions. This uncertainty analysis was performed using the RETRAN-02 MOD005.3 computer code with the results presented in Section A1.8 of this Attachment.

References:

AL .1 Letter from Ashok Thadani, NRC, to James Boatwright, Chairman RETRAN02 Maintenance Group, dated November 1, 1991, "Acceptance for Use of RETRAN MOD005.0" A1.2 Letter from Martin Virgilio, NRC, to C. R. Lehmann, dated April 12, 1994, Chairman RETRAN Maintenance Group, dated April 12, 1994, "Acceptance for Referencing of the RETRAN-02 MOD005.1 Code" A1.3 Letter from Greg Swindlehurst to James Lyons, NRC, dated March 27, 1997, "RETRAN-02 MOD005.02 Code Version Request for Extension of RETRAN-02 MOD005.0 SER" A 1.4 WCAP- 14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis," dated April 1999 A1.5 Letter from F. Akstulewicz to H. Sepp, dated February 11, 1999, "ACCEPTANCE FOR REFERENCING OF LICENSING TOPICAL REPORT WCAP-14882, "RETRAN-02 MODELING AND QUALIFICATION FOR WESTINGHOUSE PRESSURIZED WATER REACTOR NON-LOCA SAFETY ANALYSIS" (TAC NO.M99107)" (NRC Agency Legacy Document No. 9903090172)

A1.6 Letter from Roland Dunn to Christopher Jackson dated May 30, 2013, "RETRAN-02 MOD005.3 Code Version Notification of Code Release" (ML13165A028)

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 2 of 42 Acceptance Criteria

" Appendix R,Section III.L. 1 requirements are met ensuring that during post-fire shutdown, the reactor coolant system (RCS) process variables are maintained within those predicted for a loss of normal a.c. power, and the fission product boundary integrity is not affected; i.e., there is no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary.

• Appendix R,Section III.L.2 performance goals for shutdown functions are met.

" Upon plant stabilization, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Assumptions

1. The plant is at full power, steady-state nominal conditions at the time of the reactor trip.

2. Off-site power is available. A loss of offsite power (LOOP) is less limiting for each case analyzed for reasons stated in the discussion of the analysis results for each proposed operator action.

3. The analysis does not take credit for automatic controls in the control room unless the controls make the event more limiting.

4. Only one fire-induced spurious actuation is assumed to occur prior to transferring control to the alternate shutdown stations. All potential spurious actuations are mitigated by the proposed operator actions.

5. Transfer of control to the alternative shutdown system is assumed to occur when all isolation and transfer switches have been manipulated per procedure OPOPOl-ZO-0001.

These switches are located outside the control room.

6. The main turbine automatically trips in 3.5 seconds following a reactor trip.

7. Operators successfully perform the proposed actions in the time frame identified in Table 1 of enclosure 1.

8. Auxiliary feedwater (AFW) starts after reactor trip when steam generator water level decreases to 20%. Operators throttle back AFW flow at the alternate shutdown station within 10 minutes per procedure after the reactor trip.

9. Charging and letdown function until secured by the operators 120 seconds into the event.

10. No safety injection (SI) occurs. Initiation of SI is less limiting for each case analyzed for reasons stated in the discussion of the analysis results for each proposed operator action.

11. The startup feedwater pump (SUFP) has a capacity of approximately 20 per cent feedwater flow at full power. The SUFP automatically starts when any of the main feedwater turbines receive a trip signal. Power to the SUFP is not diesel-backed. Flow

Attachment I to Enclosure I NOC-AE-13002962 Page 3 of 42 from this pump starts when the main steam isolation valves are closed, which secures steam to and trips the main feedwater turbines. Flow from the SUFP is assumed to continue until the main feedwater isolation valves are closed.

AI.1. Initiate main steam isolation The analysis performed to support the proposed operator action for evaluating the requirement to close the main steam isolation valves (MSIV) assumed a fire-induced spurious opening one bank of steam dump valves coincident with the operator-initiated reactor trip. The purpose of closing the MSIV is to protect against an uncontrolled cooldown of the RCS. The analysis assumes offsite power is maintained. A time sequence of events is presented on Table Al.1. A plot of key plant parameters is presented on Figures Al.1.1 through Al.1.9. Other RCS loops will provide results similar to loop 1.

The analysis assumes the operators trip the reactor and successfully perform the proposed actions in Table 1 of enclosure 1 in the time frame requested. At the time when the operator trips the reactor, one bank of steam dump valves is assumed to spuriously open. Steam flow from all steam generators continues until the operator initiates closure of the MSIVs 30 seconds later.

The analysis assumes the MSIVs are fully closed within 5 seconds of a closure signal, consistent with Technical Specification requirements. The analysis also assumes the SUFP starts at this time further exacerbating the cooling of the RCS until feedwater is isolated. The reactor trip and steam release from the steam dump system results in an overcooling of the RCS. The overcooling of the RCS shrinks the primary system fluid, resulting in a decrease in pressurizer pressure and water level. The rate of decrease in RCS temperature is slowed with the closure of the MSIVs, but RCS temperature continues to decrease due to initiation of AFW flow to the steam generators. The decrease in RCS pressure and pressurizer water level are reversed when the operators throttle back the AFW flow at the alternate control station 10 minutes into the event as directed by procedure.

Results show sub-cooling margin is maintained so that significant RCS voiding does not occur.

The reactor remains sub-critical throughout the event. Results also show that indicated pressurizer water level goes off-scale low at approximately 484 seconds into the event, but is restored in less than 7 minutes at 873 seconds into the event. The actual liquid level decreases to the lower pressurizer level tap. The indicated pressurizer water level is restored when the operators throttle AFW flow from the auxiliary shutdown panel.

The case where off-site power is available is bounding because a loss of off-site power would result in the immediate loss of the reactor coolant pumps (RCP), unavailability of the automatic steam dump system, and failure of the SUFP to start. The immediate loss of the RCPs, unavailability of the automatic steam dump system, and failure of the SUFP to start reduces the amount of energy being removed from the RCS which would reduce the temperature decrease of the RCS fluid and mitigate the associated shrink of the pressurizer water level. The analysis also conservatively does not take credit for SI that initiates on low pressurizer pressure. SI would add water mass to the system which would increase pressurizer water level and increase sub-cooling margin.

Attachment I to Enclosure 1 NOC-AE- 13002962 Page 4 of 42 Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Table A1.1 Time Line For Spurious Case With One Bank of Steam Dumn Valves Snuriouslv Onen

. . B. ank

.. . . Stea..... . . ... alve .. ......

riv -- _ne Actions Time (seconds)

Reactor Trip 10 One bank steam dump valves spuriously open 10 Main Turbine Automatically Trips 13.5 SUJFP Automatically Starts 45 Main Steaniline Isolation (Includes 5 second 45 valve closure time)

Steam Generator Level Low Low Signal (< 20 % 56.8 narrow range scale(NRS))

AFW Flow to Steam Generators 66.1 Operators secure RCPs 130 Operators initiate feedwater isolation 130 Operators place SUJFP in PULL-TO-LOCK 130 Operators secure letdown 130 Operators secure centrifugal charging pump 130 Indicated Pressurizer water level off-scale low 484 Operators throttle AFW Flow 610 Indicated Pressurizer water level returns to scale 873

Attachment I to Enclosure I NOC-AE-13002962 Page 5 of 42 2300 2200 2100 2000 N

1900 1800 1700 1600 0 200 400 600 800 1000 Time (s)

Figure AI.1.1: Pressurizer Pressure for the Case of One Bank of Steam Dump Valves Spuriously-Open 60 0

50 -

40 - -------------- -----------------------------------------

N Ct) 30 - --------------- ---------------------------- ----------

Ct)

-o 20 - - ------

C.)

10 - --- ------

0 0 200 400 600 800 1000 Time (s)

Figure A1.1.2: Indicated Pressurizer Water Level for the Case of One Bank of Steam Dump Valves Spuriously-Open

Attachment 1 to Enclosure I NOC-AE- 13002962 Page 6 of 42 2.68 2.67 o 2.66

.1 2.65

- 2.64 2.63 N

" 2.62 Lower Pressurizer Water Le-e Tap 2.61 2.60 '

< 2.59 2.58 600 620 640 660 680 700 Time (s)

Figure A1.1.3: Actual Pressurizer Water Level for the Case of One Bank of Steam Dump Valves Spuriously-Open 640 620 E 600 0

to 580 540 520 E

0 200 400 600 800 1000 Time (s)

Figure Al.l.4: Loop 1 RCS Hot-leg and Cold-leg Temperatures for the Case of One Bank of Steam Dump Valves Spuriously-Open

Attachment 1 to Enclosure I NOC-AE-13002962 Page 7 of 42 1150

• . 1100 1050 1000 950 900 0 200 400 600 800 1000 Time (s)

Figure A1.1.5: Loop 1 Steam Generator Pressure for the Case of One Bank of Steam Dump Valves Spuriously-Open 80 60

- 40 s 2020 0

0 200 400 600 800 1000 Time (s)

Figure A1.1.6: Loop 1 Steam Generator Water Level for the Case of One Bank of Steam Dump Valves Spuriously-Open

Attachment I to Enclosure 1 NOC-AE-1 3002962 Page 8 of 42

.0 0.8 -

z 0.6 -

0) 0.4 -

I-I-

0.2 -

0 4 I I I 0 200 400 600 800 1000 Time (s)

Figure A1.1.7: Core Power for the Case of One Bank of Steam Dump Valves Spuriously-Open 2500 gooo 4500

• 000 E

.6500 0

0 200 400 600 800 1000 Time (s)

Figure A1.1.8: Total Steam Dump flow Rate for the Case of One Bank of Steam Dump Valves Spuriously-Open

Attachment 1 to Enclosure 1 NOC-AE- 13002962 Page 9 of 42 80 75 70 65 0*, 60 0~ 55 50 45 40 35 30 0 200 400 600 800 1000 Time (s)

Figure A1.1.9: Sub-Cooling Margin for the Case of One Bank of Steam Dump Valves Spuriously-Open

Attachment I to Enclosure 1 NOC-AE-13002962 Page 10 of 42 A1.2 Close both pressurizer power-operated relief valve (PORV) block valves The analysis performed to support the proposed operator action for evaluating the requirement to close both pressurizer PORV block valves assumed a fire-induced spurious opening of one pressurizer PORV coincident with the operator initiated reactor trip. The purpose of closing the pressurizer PORV block valves is to protect against an uncontrolled depressurization of the RCS and loss of RCS inventory. The analysis assumes offsite power is maintained. A time sequence of events is presented on Table A 1.2. A plot of key plant parameters is presented on Figures A 1.2.1 through A1.2.9. Other RCS loops will provide results similar to loop 1.

The analysis assumes the operators trip the reactor and successfully perform the proposed actions in Table 1 of enclosure I in the time frame requested. At the time when the operator trips the reactor, one pressurizer PORV is assumed to spuriously open. The RCS begins to rapidly depressurize until the operator initiates closure of the pressurizer PORV block valves within 60 seconds of the reactor trip. The analysis assumes the pressurizer PORV block valves are fully closed within 18 seconds of a closure signal. RCS pressure and pressurizer level continue to decrease due to the shrinkage of the RCS fluid due to the initiation of AFW flow to the steam generators. RCS depressurization and the decrease in pressurizer water level are reversed when the operators throttle back on AFW flow at the alternate control station 10 minutes after the initiation of the event as directed by procedure.

Results show sub-cooling margin is maintained so that significant RCS voiding does not occur.

The reactor remains sub-critical throughout the event. Results also show that indicated pressurizer water level goes off-scale low at approximately 598 seconds into the event, but is restored in less than 2 minutes at 715 seconds into the event. The actual liquid level remains above the lower pressurizer level tap. The indicated pressurizer water level is restored when the operators throttle AFW flow from the auxiliary shutdown panel.

The case where off-site power is available is bounding because a loss of off-site power would result in the immediate loss of the RCPs, a failure of the SUFP to start, and a delay in the delivery of auxiliary feedwater while the AFW pumps sequence onto the standby diesel generator. The loss or delay of this equipment from starting delays the transfer of heat from the RCS thus reducing the shrink in the RCS and mitigating the reduction of pressurizer water level.

The analysis also conservatively does not take credit for SI. SI would add water mass to the system which would increase pressurizer water level and increase sub-cooling margin.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 11 of 42 A1.2:

Time Line For Spurious Case With One Pressurizer PORV Opens Actions Time (seconds)

Reactor Trip 10 One Pressurizer PORV spuriously opens 10 Main Turbine Automatically Trips 13.5 SUFP Starts 45.0 Operator closes Main Steamline Isolation 45.0 (Includes 5 second valve closure time)

Steam Generator Level Low Low Signal (< 20 % 49.6 NRS)

AFW Flow to Steam Generators 58.9 Operators initiate closing both pressurizer PORV 70.0 block valves Pressurizer PORV block valves closed 88.0 Operators secures RCPs 130 Operators initiate feedwater isolation 130 Operators place SUFP in PULL-TO-LOCK 130 Operators isolate Letdown 130 Operators secure Centrifugal Charging Pump 130 Indicated Pressurizer water level off-scale low 598 Operators throttle AFW Flow 610 Indicated Pressurizer water level returns to scale 715

Attachment I to Enclosure 1 NOC-AE-13002962 Page 12 of 42 2300 2200 C,)

2100 2000 Cl) 1900 Cl) 1800 N

1700 Cd)

Cd) 1600 1500 1400 0 200 400 600 800 1000 Time (s)

Figure A1.2.1: Pressurizer Pressure for the Case of One Pressurizer PORV Spuriously Opens 0 60 50 40 N

Cl) 30 Cl) 20 10 0

0 200 400 600 800 1000 Time (sec)

Figure A 1.2.2: Indicated Pressurizer Water Level for the Case of One Pressurizer PORV Spuriously Opens

Attachment I to Enclosure I NOC-AE-13002962 Page 13 of 42 25 4-.

20 15 N

10 cj~

LowerPressurzer Water Level Top 5

Q 0

0 200 400 600 800 1000 Time (s)

Figure A1.2.3: Actual Pressurizer Water Level for the Case of One Pressurizer PORV Spuriously Opens 640 620 600

[.. 580 560

" 540 2

0 520 0 200 400 600 800 1000 Time (s)

Figure A1.2.4: Loop I RCS Hot-Leg and Cold-Leg Temperatures for the Case of One Pressurizer PORV Spuriously Opens

Attachment 1 to Enclosure I NOC-AE-13002962 Page 14 of 42 1150 1100 o1050 o 1000 9

950 900 !

0 200 400 600 800 1000 Time (s)

Figure A1.2.5: Loop I Steam Generator Pressure for the Case of One Pressurizer PORV Spuriously Opens 80 r70 60 S50 40 k 30 S20 S10 0

0 200 400 600 800 1000 Time (s)

Figure A1.2.6: Loop 1 Steam Generator Water Level for the Case of One Pressurizer PORV Spuriously Opens

Attachment I to Enclosure 1 NOC-AE- 13002962 Page 15 of 42 S0.8 C

0.6 0.4 0.2 0

0 0 200 400 600 800 1000 Time (s)

Figure A1.2.7: Core Power Level for the Case of One Pressurizer PORV Spuriously Opens 60 O 50 S40 0

> 30

• 2020 N

10 0

0 200 400 600 800 1000 Time (s)

Figure A1.2.8: Pressurizer PORV Flow Rate for the Case of One Pressurizer PORV Spuriously Opens

Attachment 1 to Enclosure 1 NOC-AE- 13002962 Page 16 of 42 70 60 50 0

40 C.)

30 Q

20 10 0 200 400 Time (s) 600 800 1000 Figure A1.2.9: Sub-Cooling Margin for the Case of One Pressurizer PORV Spuriously Opens

Attachment 1 to Enclosure I NOC-AE- 13002962 Page 17 of 42 A1.3 Secure the RCPs The analysis performed to support the proposed operator action for evaluating the requirement to trip the RCPs assumed a fire-induced spurious opening of the pressurizer spray valve coincident with the operator initiated reactor trip. The purpose of tripping the RCPs is to protect against an uncontrolled depressurization of the RCS. Another purpose of tripping the RCPs is to protect the RCP seals thus protecting the primary coolant boundary. The analysis assumes offsite power is maintained. A time sequence of events is presented on Table Al.3. A plot of key plant parameters is presented on Figures Al.3.1 through A1.3.8. Other RCS loops will provide results similar to loop 1.

The analysis assumes the operators trip the reactor and successfully perform the proposed actions in Table 1 of enclosure 1 in the time frame requested. At the time when the operator trips the reactor, the pressurizer spray valve is assumed to spuriously open. The RCS begins to rapidly depressurize until the RCPs are secured within 120 seconds of the reactor trip. RCS pressure and pressurizer level continues to decrease due to the shrinkage of the RCS fluid due to the initiation of AFW flow to the steam generators. RCS depressurization and the decrease in pressurizer water level are reversed when the operators throttle back AFW flow at the alternate control station 10 minutes after the initiation of the event as directed by procedure.

Results show sub-cooling margin is maintained so that significant RCS voiding does not occur.

The reactor remains sub-critical throughout the event. Results also show that indicated pressurizer water level is maintained throughout the event.

The case where off-site power is available is bounding because a loss of off-site power would result in the immediate loss of the RCPs which provides the motive force for the spray flow. The analysis also conservatively does not take credit for SI. SI would add water mass to the system which would increase pressurizer water level and increase sub-cooling margin.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Attachment I to Enclosure 1 NOC-AE- 13002962 Page 18 of 42 Table A1.3:

Time Line For Spurious Opening Of Pressurizer Snrav Valve Onen Actions Time (seconds)

Reactor Trip 10 Pressurizer Normal Spray Fails Open 10 Main Turbine Automatically Trips 13.5 Operator closes Main Steamnline Isolation (Includes 45.0 5 second valve closure time)

SUJFP Starts 45.0 Steam Generator Level Low Low Signal (< 20 % 49.4 NRS)

AFW Flow to Steam Generators 58.7 Operator secures RCPs 130 Operators initiate feedwater isolation 130 Operators place SUFP in PULL-TO-LOCK 130 Operators isolate letdown 130 Operators secure Centrifugal Charging Pump 130 Operator throttle AFW Flow 610 Pressurizer Minimum Water Level 638.6 [3.15 %]

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 19 of 42 2400

-. 2200 2000 N 1800

• 1600 1400 0 200 400 600 800 1000 Time (s)

Figure A1.3.1: Pressurizer Pressure for the Case of Spurious Open Pressurizer Spray Valve 60

,-50

>40 30 N

.90 410 0 200 400 600 800 1000 Time (s)

Figure A1.3.2: Indicated Pressurizer Water Level for the Case of Spurious Open Pressurizer Spray Valve

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 20 of 42 640 620 o 600 580 o 560 U

540 520 0 200 400 600 800 1000 Time (s)

Figure A1.3.3: Loop 1 RCS Hot-leg and Cold-leg Temperatures for the Case of Spurious Open Pressurizer Spray Valve 1250 1200

• 1150

- 1100 0

1050 1000 950 900 0 200 400 600 800 1000 Time (s)

Figure A1.3.4: Loop 1 Steam Generator Pressure for the Case of Spurious Open Pressurizer Spray Valve

Attachment I to Enclosure 1 NOC-AE- 13002962 Page 21 of 42 100 80 z

60 1~

1~

0.) 40 0.)

S 0.) 20 0

0 200 400 600 800 1000 Time (s)

Figure A1.3.5: Loop 1 Steam Generator Water Level for the Case of Spurious Open Pressurizer Spray Valve I

0.8 0

0.6 0.4 U

0.2 0

0 200 400 600 800 1000 Time (s)

Figure A1.3.6: Core Power for the Case of Spurious Open Pressurizer Spray Valve

Attachment 1 to Enclosure I NOC-AE-13002962 Page 22 of 42 80 70 - ------------ ----- ---- -------- -------------- ---- -

60- ------ ------ ------------------ -----------------

E

~-50 -

0

~40- ----------- - ----- -------------------------------------------

30- ------- --- ----- ---------------------

S20 - --------- -----------

10 -

0 200 400 600 800 1000 1200 Time (s)

Figure A1.3.7: Pressurizer Spray flow Rate for the Case of Spurious Open Pressurizer Spray Valve 80 70 - ------------------------------------------------------------------------ ------------------- -----------------------

60 - ------------ -------- ------------ ------------------------------------ ------ -------------- ---- --------------

03 -------------------------------------------------------

50 - -- ---------------- ------------------------------------

40 - ------ --- -------------------- -- ---------------------------------- -------------- ---- ------------------

04 30 - ------------------ ----------------------- ----------------------

20 0 200 400 600 800 1000 Time (s)

Figure A1.3.8: Sub-Cooling Margin for the Case of Spurious Open Pressurizer Spray Valve

Attachment 1 to Enclosure I NOC-AE-13002962 Page 23 of 42 A.1.4 Close feedwater isolation valves The analysis performed to support the proposed operator action for evaluating the requirement to initiate feedwater isolation accounts for the automatic starting of the SUFP when the main feedwater turbines trip following closure of the MSIVs. The purpose of initiating feedwater isolation is to protect against an uncontrolled cooldown of the RCS. Another purpose is to prevent overfilling the steam generator. The analysis assumes offsite power is maintained. A time sequence of events is presented on Table A 1.4. A plot of key plant parameters is presented on Figures A1.4.1 through Al1.4.8. Other RCS loops will provide results similar to loop 1.

The analysis assumes the operators trip the reactor and successfully perform the proposed actions in Table I of enclosure 1 in the time frame requested. When the operator closes the MSIVs 30 seconds into the event, steam to the main feedwater pump turbines is secured resulting in a trip of that equipment. The SUFP, which has a capacity of approximately 20% feedwater flow at full power, is designed to automatically start upon a trip of the main feedwater pump turbines.

Should the operator fail to close the feedwater isolation valves, flow from the SUFP could result in an overcooling of the RCS. The analysis assumes that the feedwater flow from the SUFP begins 35 seconds following the reactor trip when the MSIVs are closed and continues for another 85 seconds until the operators close the main feedwater isolations valves. The results show that by isolating feedwater within two minutes, the additional feedwater from the SUFP will not have a significant effect on the pressurizer pressure and level. The pressurizer pressure and level will decrease after feedwater isolation due to the addition of AFW flow to the steam generators. The pressurizer pressure and level begin to increase after the operators throttle back AFW flow at the alternate control station 10 minutes into the event as directed by procedure.

Results show sub-cooling margin is maintained so that significant RCS voiding does not occur.

The reactor remains sub-critical throughout the event. Results also show that indicated pressurizer water level is maintained throughout the event.

The case where off-site power is available is bounding because the SUFP would not start with a loss of off-site power because the pump motor is not diesel-backed. The analysis also conservatively does not take credit for SI. SI would add water mass to the system which would increase pressurizer water level and increase sub-cooling margin.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Attachment 1 to Enclosure 1 NOC-AE- 13002962 Page 24 of 42 Table AI.4:

Time Line For Spurious Case With Feedwater Isolation Signal with SUFP Auto-Starts Actions Time (seconds)

Reactor Trip 10 Main Turbine Automatically Trips 13.5 Operator closes Main Steamline Isolation (Includes 45.0 5 second valve closure time)

SUFP Starts 45.0 Steam Generator Level < 20% NRS Signal 49.6 AFW Flow to Steam Generators 58.9 Operator secures RCPs 130 Operators initiate feedwater isolation 130 Operators place SUFP in PULL-TO-LOCK 130 Operators isolate letdown 130 Operators secure Centrifugal Charging Pump 130 Operators throttle AFW Flow 610 Indicated Pressurizer Water at Minimum Level 668 (1.26 %)

Attachment I to Enclosure 1 NOC-AE-13002962 Page 25 of 42 2300 2200

"- 2100 2000 N

= 1900 1800 1700 0 200 400 600 800 1000 Time (s)

Figure A1.4.1: Pressurizer Pressure for the Case of Feedwater Isolation (FWI) with SUFP Auto Start 60

.- 50 0>40

-.go

' 30 2

N "r20

• 10 0

0 200 400 600 800 1000 Tine (s)

Figure A1.4.2: Indicated Pressurizer Water Level for the Case of FWI with SUFP Auto Start

Attachment 1 to Enclosure I NOC-AE-1 3002962 Page 26 of 42 640

'*" 620

• 600 E

to 580

©560 I540 520 0 200 400 600 800 1000 Time (s)

Figure A1.4.3: Loop 1 RCS Hot-Leg and Cold-Leg Temperatures for the Case of FWI with SUFP Auto Start 1200

-;" 1150 1100 1050 (D 1000 950 900 0 200 400 600 800 1000 Time (s)

Figure A1.4.4: Loop 1 Steam Generator Pressure for the Case of FWI with SUFP Auto Start

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 27 of 42 80 C,)

70 Z 60 50 40 S30 E 20 10 0

0 200 400 600 800 1000 Time (s)

Figure A1.4.5: Loop 1 Steam Generator Water Level for the Case of FWI with SUFP Auto Start

.* 0.8 S

0 z

0.6 ---------------

0

" 0.4 0.2-0 0 I I I I I I I I I I I I I I I I I I 0 200 400 600 800 1000 Time (s)

Figure A1.4.6: Core Power for the Case of FWI with SUFP Auto Start

Attachment 1 to Enclosure 1 NOC-AE- 13002962 Page 28 of 42 1400 1200 1000

'2 800 600 400 200 0

0 200 400 600 800 1000 Time (s)

Figure A1.4.7: Main feedwater Flow Rate per Loop 1 Steam Generator for the Case of FWI Does Not Occur, SUFP Auto-Start 80 70 60 bO 50 0

0 0

40 Q

30 20 0 200 400 600 800 1000 Time (s)

Figure A1.4.8: Sub-Cooling Margin for the Case of FWI Does Not Occur, SUFP Auto-Start

Attachment I to Enclosure 1 NOC-AE-13002962 Page 29 of 42 A.1.5 Secure the SUFP The analysis performed to support the proposed operator action for evaluating the requirement to secure the SUFP by placing the pump in PULL-TO-LOCK is the same as that described in Section A. 1.4. The purpose of placing the SUFP in PULL-TO-LOCK is to protect an uncontrolled cooldown of the RCS. Another purpose is to prevent overfilling the steam generator.

As discussed in Section A. 1.4 above, the SUFP will automatically start when the main feedwater turbines receive a trip signal, which will occur when the operators close the MSIVs with off-site power available. With flow from the SUFP, a spurious opening a feedwater isolation valve could result in overcooling the RCS and overfilling a single steam generator. By securing the SUFP in the same time frame as the main feedwater valves are closed, such an event is avoided making the analysis presented in Section A. 1.4 bounding.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

A.1.6 Isolate RCS letdown Normal RCS letdown is approximately 120 gpm. The indicated pressurizer water level span contains approximately 13,067 gallons, or approximately 130 gal/% span. Failure to secure letdown would result in a decrease in indicated pressurizer level slightly greater than I%/minute.

The analysis presented for each proposed operator action did not assume this additional reduction in pressurizer water level after two minutes. Therefore, to ensure the analysis for the other proposed operator actions remains valid, operators will be required to secure letdown within two minutes of reactor trip.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Attachunent 1 to Enclosure 1 NOC-AE-13002962 Page 30 of 42 A.1.7 Secure the Centrifugal Charging Pumps (CCP)

The analysis performed to support the proposed operator action for evaluating the requirement to secure the CCPs by placing the pumps in PULL-TO-LOCK assumed a fire-induced spurious opening of the pressurizer auxiliary spray valve coincident with the operator-initiated reactor trip. The purpose of placing the CCPs in PULL-TO-LOCK is to protect against an uncontrolled depressurization of the RCS. Another purpose is to protect the pumps for use later to achieve cold shutdown. The analysis assumes offsite power is maintained. A time sequence of events is presented on Table AL.7. A plot of key plant parameters is presented on Figures A1.7.1 through A1.7.8. Other RCS loops will provide results similar to loop 1.

The analysis assumes the operators trip the reactor and successfully perform the proposed actions in Table 1 of enclosure 1 in the time frame requested. At the time when the operator trips the reactor, the auxiliary pressurizer spray valve is assumed to spuriously open. The RCS begins to rapidly depressurize until the CCPs are placed in PULL-TO-LOCK within 120 seconds of the reactor trip. RCS pressure and pressurizer level continue to decrease due to the shrinkage of the RCS fluid due to the initiation of AFW flow. RCS depressurization and the decrease in pressurizer water level are reversed when the operators throttle back on AFW flow at the alternate control station 10 minutes after the initiation of the event as directed by procedure.

Results show sub-cooling margin is maintained so that significant RCS voiding does not occur.

The reactor remains sub-critical throughout the event. Results also show that indicated pressurizer water level is maintained throughout the event.

The case where off-site power is available is bounding because a loss of off-site power would result in the loss of CCPs which provides the motive force for the spray flow. The CCPs are not automatically sequenced onto the emergency electrical buses after a loss of off-site power. The analysis also conservatively does not take credit for SI. SI would add water mass to the system which would increase pressurizer water level and increase sub-cooling margin.

Therefore, the requirements of Appendix R,Section III.L are met. The plant stabilizes, pressurizer and steam generator levels are in the indicating band and maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

Attachment I to Enclosure 1 NOC-AE- 13002962 Page 31 of 42 A1.7:

Time Line For Spurious Case With Spurious Auxiliary Pressurizer Spray Valve Opens Actions Time (seconds)

Reactor Trip 10 Pressurizer Auxiliary Spray Starts 10 Main Turbine Automatically Trips 13.5 Operator closes Main Stean-ine Isolation (Includes 45.0 5 second valve closure time)

SUFP Starts 45.0 Steam Generator Level Low Low Signal (< 20 % 49.6 NRS)

AFW Flow to Steam Generators 58.9 Operators secure RCPs 130 Operators initiate feedwater isolation 130 Operators place SUFP in PULL-TO-LOCK 130 Operators isolate letdown 130 Operators secure Centrifugal Charging Pumps 130 Operators throttle AFW Flow 610 Indicated Pressurizer Water at Minimum Level 668.2 (4.78 %)

Attachment 1 to Enclosure I NOC-AE-13002962 Page 32 of 42 2400

-,2200 2000 N 1800 1600 1400 0 200 400 600 800 1000 Time (s)

Figure A1.7.1: Pressurizer Pressure for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens 60

>40

'-20

~-0 0 200 400 600 800 1000 Time (s)

Figure A1.7.2: Indicated Pressurizer Water Level for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens

Attachment 1 to Enclosure I NOC-AE- 13002962 Page 33 of 42 640 620 o600 Of 580

-o 3 560 540 520 0 200 400 600 800 1000 Time (s)

Figure A1.7.3: Loop 1 RCS Hot-Leg and Cold-Leg Temperatures for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens 1200

? 1150 1 1100 C 1050 1000 950 900 0 200 400 600 800 1000 Time (s)

Figure A1.7.4: Loop 1 Steam Generator Pressure for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens

Attachment 1 to Enclosure 1 NOC-AE-13002962 Page 34 of 42 80 Cd)

Z 60

• 40 20 0

0 200 400 600 800 1000 Time (s)

Figure A1.7.5: Loop 1 Steam Generator Water Level for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens

~0.8 0

0.6 0.4 0

0 200 400 600 800 1000 Time (s)

Figure A1.7.6: Core Power for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens

Attachment 1 to Enclosure I NOC-AE-13002962 Page 35 of 42 30 25 ---------------

UID 20 ---------------

,2 15 - ---------- --

10 --------------

5 --------------

0 *1-0 200 400 600 800 1000 Time (s)

Figure A 1.7.7: Pressurizer Auxiliary Spray Flow Rate for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens 80 70 60 Cf) 50

-5:

40 30 20 0 200 400 600 800 1000 Time (s)

Figure A 1.7.8: Sub-Cooling Margin for the Case of Pressurizer Auxiliary Spray Valve Spuriously Opens

Attachment I to Enclosure 1 NOC-AE-13002962 Page 36 of 42 A1.8 Uncertainty Analysis of Proposed Operator Actions The model to perform the thermal-hydraulic analyses for the proposed operator actions reflected nominal conditions and set points. Based on the results presented in Sections Al .1 through A1.7, pressurizer level is the limiting criterion with regards to compliance with Section III.L of Appendix R. To evaluate the impact of uncertainties on the initial conditions, analysis of the spuriously opened pressurizer PORV event (Section A 1.2) was performed. The analysis made the following assumptions with regard to the initial conditions of the plant:

• Initial reactor power was increased from 3853 MW to 3876 MW assumed for the Updated Final Safety Analysis Report (UFSAR) Chapter 15 events that consider the standard thermal design procedure.

" The initial RCS average temperature was increased from 593°F to 598.1'F assumed for the UFSAR Chapter 15 events that consider the standard thermal design procedure.

• The initial total RCS flow was reduced from 403,000 gpm to 392,000 gpm assumed for the UFSAR Chapter 15 events that consider the standard thermal design procedure.

• The initial pressurizer pressure was reduced from 2250 psia to 2204 psia assumed for the UFSAR Chapter 15 events that consider the standard thermal design procedure.

Other uncertainties included in the analysis are:

• An increase in AFW flow from 640 gpm per steam generator to 675 gpm. The increase in flow accounts for measurement uncertainties associated with the AFW controller. An increase in AFW flow is conservative in that it increases the RCS shrink which results in a lower pressurizer level.

" The initial pressurizer water level was decreased 7.1 % from 56.4% to 49.3% to account for a 7.1% bias indication error. The indicated pressurizer level in the analysis starts at 56.4%; however, the actual pressurizer level is 49.3%. The result is when the pressurizer indicates 7.1% the actual level is below the indication span.

The analysis also assumes off-site power is available as this is the more limiting than assuming off-site power is lost (see assumption #2 in Section Al). The analysis also does not take credit for SI. This is a conservative assumption as the addition of SI would provide additional RCS water inventory thus mitigating the reduction in pressurizer water level.

The sequence of events is presented on Table A1.8. The table shows that the indicated pressurizer water level indicates a water level of 7.1% (actual water level is below the indicating span) for approximately 10 minutes.

Figures A1.8.1 through Figure A1.8.9 provide plots of key parameters versus time. Figure A 1.8.2 shows the indicated level lowers to 7.1% at approximately 367 seconds and increasing above 7.1% again at approximately 975 seconds. This represents the period of time that the actual level when applying instrument bias is actually below span. Figure Al1.8.3 shows that

Attachment I to Enclosure 1 NOC-AE-13002962 Page 37 of 42 actual pressurizer liquid level demonstrating that the pressurizer does not go dry. Figures A1.8.2 and A1.8.6 show that the indicated pressurizer and steam generators levels are restored to a condition where the plant cooldown can commence to achieve a safe shutdown condition. Figure A1.8.9 shows that adequate sub-cooling margin is maintained throughout the event.

The analysis demonstrates that with uncertainties applied to the licensing basis analysis that assumes nominal conditions and set points, plant safe shutdown can be achieved and maintained without adversely impacting fission product boundary integrity.

Table A1.8 Sequence of events Spuriously Open Pressurizer PORV Uncertainty Analysis Actions Time Reactor Trip I second One Pressurizer PORV spuriously opens I second Main Turbine Automatically Trips 4.5 seconds Steam Generator Level Low Low Signal 15.3 seconds AFW Pumps Start (includes 10.1 second delay) 24.6 seconds Main Steamline Isolation 36.0 seconds SUFP Starts 36.0 seconds Operator initiates closure of both pressurizer PORV block 61.0 seconds valves Both pressurizer block valves fully closed 79.0 seconds Secure RCPs 121 seconds Initiate feedwater isolation 121 seconds Place SUFP in PULL-TO-LOCK 121 seconds Letdown Isolation 121 seconds Secure Centrifugal Charging Pump 121 seconds Indicated Pressurizer Water at 7.1% 367 seconds Operators control AFW Flow 601 seconds Indicated Pressurizer water level above 7.1% 975 seconds Note: The following figure plots are shown for RCS Loop #1 as the transient response in all four loops is similar.

Attachment I to Enclosure 1 NOC-AE-13002962 Page 38 of 42 2200 2100 2000

,' 1900 001800 2

C-1700 1600 0.

1500 1400 1 *UU 0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A1.8.1: Pressurizer Pressure for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties 60

&50 fl40- --1 e-30 0

0. 0-0 a0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A1.8.2: Indicated Pressurizer Water Level for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties

Attachment I to Enclosure I NOC-AE-1 3002962 Page 39 of 42 20 18 16 14 0)12

_1 10 8

&6 21 0 ,

0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure AI.8.3: Actual Pressurizer Level for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties 640 620

-- LOOP 1 COLD LEG TEMP -- LOOP 1.HOT LEG TEMP U-. 600 M580 4.

E 4 560 540 520 0 200 400 600 800 1000 1200 1400 1600 Transient Time (sec)

Figure A1.8.4: RCS Hot-Leg and Cold-Leg Temperatures for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties

Attachment I to Enclosure I NOC-AE-13002962 Page 40 of 42 1250 1200

. 1150 a,.

1100 0

U) 0U1050 a.

0

-J 950 1 900 0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A1.8.5: Steam Generator Pressure for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties 60 a50 U) z 4U 0

-J CD U) 30 0

20 0

-j 10 0  : -- I__

0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure AI.8.6: Indicated Steam Generator Water Level for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties

Attachment 1 to Enclosure 1 NOC-AE- 13002962 Page 41 of 42 1.00 4 0.90 S0.80

.E-0 C 0.60 0

0.40 S0.50 U,..

0 040,

.. 0.30 -

• 0.20 Z

0.10 0.00 0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A 1.8.7: Core Power Level for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties 60 50 E40-0S30 30 0~

IX 20 N

1.

10 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A1.8.8: Pressurizer PORV Flow Rate for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties

Attachment I to Enclosure 1 NOC-AE-13002962 Page 42 of 42 60 50 I

• 40 O)30

.S 0

0 20 10 0

0 200 400 600 800 1000 1200 1400 1600 Transient Time(Sec)

Figure A1.8.9: Sub-Cooling Margin for the Case of One Pressurizer PORV Spuriously Opens with Uncertainties

Attactmnent 2 to Enclosure 1 NOC-AE-13002962 Attachment 2 to Enclosure 1 Defense-in-Depth Thermal-Hydraulic Analyses

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 1 of 50 A2.1 Defense-in-Depth Thermal-Hydraulic Analyses Overview Analyses were performed to determine the impact of the limiting spurious actuations on the ability of the plant to achieve safe shutdown conditions if "none" of the proposed operator actions other than the manual reactor trip with automatic turbine trip are performed prior to leaving the control room. These defense-in-depth (DID) analyses assume that automatic actuations within the control room area relay room will function because of the robust control room/relay room separation and safety train separation within these areas as discussed in Section 3.8.3.1 of enclosure 1.

The analyses initially investigated the applicable spurious actuations assuming offsite power is available. With offsite power maintained, reactor coolant pump (RCP) flow is maintained and results in increased heat transfer capability between the primary and secondary systems and a greater cool down effect. These analyses are presented in Section A2.2 of this attachment.

The analyses then investigated the case where offsite power is not available (i.e. LOOP) to determine the impact of a potential loss of sub cooling margin that could challenge fuel integrity. The limiting case analyzed for a LOOP is a spuriously open pressurizer power-operated relief valve (PORV) for ten minutes. This event is limiting because subcooling margin is lost and some voiding occurs in the RCS.

These analyses are presented in Section A2.3 of this attachment.

The analysis for cases with off-site power available described in Section A2.2 used the RETRAN-02 MOD 005.2 computer code and model described in Reference Al1.4 in Attachment 1. The analysis for the spuriously opened pressurizer PORV with loss of off-site power described in Section A.2.3 as Case l a used the RETRAN-02 MOD-005.3 computer code and model also discussed in Section A l. The analysis for the spuriously opened pressurizer PORV without SI coincident with a loss of offsite power described in Section A2.3 as Case lb used the RETRAN-3D computer code. For this case, the RETRAN-3D computer code was used due to the extensive voiding in the RCS. The acceptability of the use of the RETRAN-3D code for this analysis is discussed in Section A2.3.6.

The acceptance criteria used in these analyses for ensuring that safe shutdown can be achieved and maintained are:

• Sufficient core cooling is established and maintained throughout the transient.

• Fuel cladding integrity is not challenged.

" Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

" Charging and letdown are restored and available to borate the RCS to support cool down to cold shutdown conditions.

A2.2 Offsite Power Assumed Available Table A2.1 provides a listing of the applicable spurious actuations considered. For analytical purposes, only the limiting spurious actuations are considered until control of the plant is achieved at the alternative shutdown stations. The spurious actuation is considered to occur at the initiation of a manual reactor trip. The transient effects of the spurious actuation terminates when the control is established at the alternative shutdown station. For the analyses, no credit is taken for performing the proposed operator actions before evacuating the control room other than the manual reactor trip with automatic turbine trip prior to leaving the control room.

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 2 of 50 Table A2.1 Applicable Spurious Actuations Considered Spurious Actuation Plant Response Operator Action Alternate Shutdown Station Response Time (Minutes)

Spurious opening of Rapid cool down of the Main steam line 10 one bank of steam reactor coolant system isolation dump valves (RCS) due to steam generator (SG) depressurization Spurious opening of Rapid depressurization of Closing the 10 one pressurizer the RCS pressurizer PORV PORV or the associated block valve Spurious opening of a Rapid depressurization of Securing all 30' pressurizer spray the RCS RCPs valve Spurious opening of a Rapid cool down of the Feedwater 10 feedwater isolation RCS and overfilling a SG isolation valve with actuation due to excess feedwater of the startup feedwater pump (SUFP)

Spurious opening of a Rapid cool down of the Feedwater 10 feedwater isolation RCS and overfilling a SG isolation valve due to excess feedwater Maintains pressurizer Loss of indicated Letdown isolation 10 water level to ensure pressurizer water level level does not go off-scale low due to other spurious actions.

Spurious opening of Rapid depressurization of Secure 10 the pressurizer the RCS centrifugal auxiliary spray valve charging pumps (CCP)

'The required operator time to secure RCPs at the alternate shutdown station is 20 minutes. The analysis conservatively assumed 30 minutes.

Attachment 2 Enclosure I NOC-AE- 13002962 Page 3 of 50 A review of the spurious actuations presented in Table A2.1 show that the events can be categorized as follows:

1) A rapid cool down of the RCS due to SG depressurization (i.e., spurious opening of one bank of steam dump valves)

2) A rapid depressurization of the RCS due to a fully-open pressurizer PORV (i.e., spurious opening of one pressurizer PORV)

3) A rapid depressurization of the RCS due to a fully-open spray valve (i.e., spurious opening of a pressurizer spray valve or spurious opening of the pressurizer auxiliary spray valve)

4) A rapid cool down of the RCS and overfilling a SG due to excess feedwater (spurious opening of a feedwater isolation valve with the actuation of the SUFP). No credit is given for the feedwater control valves closing.

5) Loss of RCS inventory due to CCP flow and letdown flow mismatch (loss of RCS inventory causing the indicated pressurizer water level off-scale low).

To assess the impact of delaying the proposed operator actions until backed up outside the control room at the alternative shutdown stations, the following cases were performed.

Case 1: Spurious opening of one bank of steam dump valves occurring at the time of reactor trip.

This case bounds the spurious opening of one bank of steam dump valves.

Case 2: Spurious opening of one pressurizer PORV occurring at the time of reactor trip. This case bounds the spurious opening of one pressurizer PORV.

Case 3: Spurious opening of one pressurizer spray valve occurring at the time of reactor trip.

This case bounds the spurious opening of a pressurizer spray valve or the spurious opening of the pressurizer auxiliary spray valve. The spurious opening of a pressurizer spray valve is considered limiting because a spurious opening of the pressurizer auxiliary spray valve can be terminated in 10 minutes by securing the CCPs, whereas the terminating the spurious opening of a pressurizer spray valve takes 30 minutes after the RCPs are secured.

Case 4: Spurious opening of one FWRV (feedwater regulating valve) occurring at the time of reactor trip. This case bounds the spurious opening of a FWRV with the actuation of the SUFP or a spurious opening of a feedwater isolation valve and FWRV because the closure of either valve terminates feedwater flow to the SG.

The four cases above do not take credit for the operator securing letdown prior to exiting the control room. Therefore, the specific case of the loss of RCS inventory due to CCP and letdown flow mismatch is bounded by these cases.

Attachment 2 Enclosure I NOC-AE-13002962 Page 4 of 50 A2.2.1 Assumptions I1. The plant is at full power, steady-state nominal conditions at the time of reactor trip.

2. Offsite power is available. With offsite power maintained, RCP flow is maintained and results in increased heat transfer capability between the primary and secondary systems and a greater cool down effect.

3. All automatic controls in the control room are assumed to function because of the separation scheme in the main control room and relay room.

4. The main turbine governor valves close in 3.5 seconds following reactor trip.

5. Main steam isolation valves close with a five second stroke time on:

(a) Receipt of a compensated low steam line pressure signal of 735 psig, or (b) Manually per procedure at alternate shutdown stations outside the control room by operators 10 minutes following reactor trip.

6. Main feedwater isolation valves close with a 10 second stroke time on:

(a) Receipt of a safety injection (SI) signal, (b) SG narrow range water level reaching greater than 87.5% set point, (c) Receipt of a RCS average coolant temperature (Tavg) low (574°F) coincident signal with reactor trip, or (d) Manually per procedure at alternative shutdown stations outside the control room by operators 10 minutes after reactor trip.

7. Auxiliary feedwater (AFW) flow starts when:

(a) Any SG narrow range water level decreases to 20%, or (b) A SI signal occurs.

Operators throttle back AFW flow in 10 minutes at the alternate shutdown station per procedure after reactor trip. The target for controlling AFW flow is to maintain SG water level between 22% and 50% narrow range.

8. The spuriously opened pressurizer PORV or the pressurizer PORV block valve can be manually closed at the alternate shutdown station within 10 minutes following the reactor trip.

The pressurizer PORV is manually unblocked per procedure 20 minutes after the reactor trip, if required, unless the indicated pressurizer water level is off-scale high. The lift setpoint for the pressurizer PORV is 2335 psig.

Note: The circuit wiring for the PORV block valve is in accordance with the conceptual wiring recommendations as addressed in the NRC Information Notice 92-18, "Potential for Loss of Remote Shutdown Capability During a Control Room Fire". Limit and torque switches are located between the control panel, and between the auxiliary shutdown panel

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 5 of 50 and the valve motor starter (open/close) at the motor control center. After the transfer of the circuits to auxiliary shutdown panel, the block valve can be operated to any position no matter the impact the fire had on the control circuit from within the control room.

9. Charging and Letdown:

(a) Operators secure the CCPs at the alternate shutdown station per procedure within 10 minutes after reactor trip.

(b) Normal letdown is secured per procedure at the alternate shutdown station by the operators in 10 minutes after reactor trip or on an SI signal.

(c) Charging and normal letdown flows are equal (132 gpm) unless either is secured.

(d) Charging and excess letdown are available 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after reactor trip.

10. SI:

(a) SI occurs on compensated low steam line pressure set point of 735 psig, or low pressurizer pressure set point of 1857 psig, (b) An SI signal closes the main feedwater isolation valves, normal letdown valves, and starts the high head and low head SI pumps, and (c) Operators secure SI pumps prior to RCS depressurization for cool down to cold shutdown conditions.

Note: The shutoff head for the high head SI pump is approximately 1700 psia.

11. Pressurizer backup heaters (Groups A&B) are available within 10 minutes following reactor trip. Each group of backup heaters has a capacity of 431 KW (862 KW total).

12. Pressurizer proportional heaters are not available.

13. Reactor Coolant Pump (RCP):

(a) RCP seal leakage out of the RCS is 4.5 gpm/pump (18 gpm total) within 13 minutes after the CCPs are secured. This assumption is based on observed plant data.

(b) Operators secure RCPs within 30 minutes after reactor trip.

(c) Pressurizer normal spray flow stops after all RCPs are tripped.

A2.2.2 Case 1: Spurious Opening of One Bank of Steam Dump Valves The analysis of the spurious opening of one bank of steam dump valves occurring at the time of reactor trip assumes the plant is at steady-state conditions for 10 seconds prior to the event. A sequence of events is provided in Table A2.2 and plots of selected parameters versus time are presented in Figures A2.2.1 through A2.2.6. Only results for RCS Loop #1 are presented due to the symmetrical nature of the event.

The reactor trip, in conjunction with a spuriously opened bank of steam dump valves, results in the depressurization and cool down of the RCS and a feedwater isolation due to a low Tavg signal. AFW

Attachment 2 Enclosure I NOC-AE-13002962 Page 6 of 50 flow is then initiated on a low SG water level signal as a result of the main turbine trip. The depressurization of the RCS continues and results in a SI signal due to low pressurizer pressure. The SI signal results in letdown isolation and starts the SI pumps. The depressurization of the RCS continues until the main steam isolation valves are closed due to a compensated-low steam line pressure signal. Control of AFW flow is taken at the alternate shutdown station within 10 minutes into the event to maintain indicated SG water level. The pressurizer PORVs are unblocked within 20 minutes into the event. RCPs are secured 30 minutes into the event at which time pressurizer spray is no longer available. The pressurizer PORVs are used to limit pressurizer pressure.

Results of the analysis show that the pressurizer pressure and level rapidly drop until the main steam isolation valves are closed and control is taken of AFW flow. Pressurizer pressure and level then increase as the RCS heats up. The indicated pressurizer water level momentarily goes off-scale low, but is restored to greater then 20% at 1780 seconds after the initiation of the event. Figure A2.2.5 demonstrates that the pressurizer does not go dry. Figure A2.2.6 demonstrates that the sub cooling margin is maintained. Sufficient core cooling is maintained and fuel integrity is not challenged. The indicated SG water level is maintained between 22% and 100% after the initiation of AFW flow. Two hours into the event, the CCP and excess letdown are available allowing boration to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shut down conditions.

The acceptance criteria listed in Section A2.1 are met.

Table A2.2 Sequence of Events for Spurious Opening of One Bank of Steam Dump Valves Occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One bank of steam dump valves spuriously open Spurious 10 Turbine Trip On Reactor Trip 13.5 Feedwater Isolation Low Tavg 33.9 AFW flow initiated Low SG level 41.4 SI initiated Low Pressurizer pressure 103 Letdown isolated On SI Signal 103 MSIV closure Low steam line pressure 278 Close Pressurizer PORV Block Valves Manual 610 Operators control AFW flow Manual 610 Secure centrifugal charging pumps Manual 610 Unblock pressurizer PORVs Manual 1210 Pressurizer level >20% 1790 Secure RCPs Manual 1810 Charging and excess letdown available for boration Manual 7210

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 7 of 50 Figure A2.2.1 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 80 70 a.

CL 60 0)

N 40 U) 30 0,.

• 20 r 10 0

0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time (Sec)

Figure A2.2.2 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2400 2300

-.. 2200 (U

0.

2100 2000 a) at.L

,_1900 N

1800 a/)

CL 1700 1600 1500 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time (Sec)

Attachment 2 Enclosure I NOC-AE-13002962 Page 8 of 50 Figure A2.2.3 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 560 t'U I- 550 a.

0 540 0

-J 530 520 510 500 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time (Sec)

Figure A2.2.4 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 80 70

(/0 Z60 60 Z

> 50 4)

-J CO 40 "IM

. 30 V

20 0

0 10 0

0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time (Sec)

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 9 of 50 Figure A2.2.5 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 25 20 15

.7 N 10 1" 5 0 1000 2000 3000 4000 5000 60o0 7000 8000 Transient Time (Sec)

Figure A2.2.6 Fire Hazard - Spurious Open 1 Bank Steam Dump Valves 05/06/13 10:03:04 RETRAN-02-MOD005.2.1 05/05/05 EPRI 110 100 S90 C

"* 80 70 70 0 60 -

I) 50o 40 3U 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 10 of 50 A2.2.3 Case 2: Spurious Opening of One Pressurizer PORV The analysis of a spurious opening of one pressurizer PORV occurring at the time of reactor trip assumes the plant is at steady-state conditions for 10 seconds prior to the event. A sequence of events is provided in Table A2.3 and plots of selected parameters versus time are presented in Figures A2.3.1 through A2.3.6. Only results for RCS loop #1 are presented due to the symmetrical nature of the event.

The reactor trip results in a feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The spurious opening of one pressurizer PORV continues the depressurization of the RCS resulting in a SI signal when the low pressurizer pressure set point is reached. The SI signal results in letdown isolation and starts the SI pumps. The introduction of SI flow into the RCS, in combination with the low RCS pressure, results in a water solid condition in the pressurizer. At this point, RCS depressurization is terminated. A steady-state RCS pressure condition is then achieved based on SI flow into the RCS and RCS flow out the spuriously-opened pressurizer PORV. This condition continues until the spuriously-opened pressurizer PORV or the PORV block valve is secured at the alternative shutdown station. The block valve associated with the pressurizer PORV that has not spuriously-opened will not be closed since the indicated pressurizer water level is off-scale high and this valve provides the means of limiting pressurizer pressure. The capacity of the operable pressurizer PORV is sufficient to control pressure due to the SI flow and thermal expansion of the RCS fluid, ensuring the pressurizer safety valves will not lift. Control of AFW flow is taken at the alternate shutdown station 10 minutes after initiation of the transient to maintain indicated SG water level. The RCPs are secured within 30 minutes into the event. Excess letdown is placed in service two hours into the event to restore indicated pressurizer water level.

Results of the analysis show that the spuriously opened PORV results in a rapid decrease in pressurizer pressure and initiation of SI flow. The SI flow results in a water solid pressurizer and water relief through the pressurizer PORV. The pressurizer block valves and PORVs are qualified to pass water. The pressurizer PORV has sufficient capacity to ensure pressure does not increase to the pressurizer safety set point. Indicated SG water level is maintained between 22% and 100% after the initiation of AFW flow from the alternate shutdown station. Figure A2.3.6 demonstrates that the subcooling margin approaches 0 but then rapidly recovers. Sufficient core cooling is maintained and fuel integrity is not challenged. Stable plant conditions are maintained until excess letdown is placed in service and the indicated pressurizer water level returns to the indicating range. After indicated pressurizer level is restored, charging flow can be used to borate the RCS to cold shutdown conditions.

After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shut down conditions.

The acceptance criteria listed in Section A2.1 are met.

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 11 of 50 Table A2.3 Sequence of Events for a Spurious Opening of One Pressurizer PORV Occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One pressurizer PORV fails open Spurious 10 Turbine Trip On Reactor Trip 13.5 Feedwater Isolation Low Tavg 34.6 AFW flow initiated Low SG Level 36.5 SI initiated Low pressurizer 48.5 Pressure Letdown isolated On SI Signal 48.5 Pressurizer level off-scale high 410 Pressurizer water solid 524 Close block valve to spuriously opened PORV. Second PORV Manual 610 block valve left open.

Secure centrifugal charging pumps Manual 610 Operators control AFW flow Manual 610 MSIV closure Manual 615 Secure RCPs Manual 1810 Initiate excess letdown. Charging available for boration Manual 7210 Pressurizer level < 100% 16928

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 12 of 50 Figure A2.3.1 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 100

. 90 Ca, 0-1 7@ 80

.J 70 670 I.-

50 40 30 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Figure A2.3.2 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 40 35 Tor) of Pressurizer

-30 25 0*

n20

.N15 010 a.

0 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Attachment 2 Enclosure I NOC-AE-1 3002962 Page 13 of 50 Figure A2.3.3 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2500 F 2300 "2100 I.

01900 U)

U)

L 1700 v

• 1500 0,,

11300 1100 900 0 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Figure A2.3.4 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 600 590 580 C570

> 560 I-1 CX550 0

0

-J 540 530 520 510 4-0 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Attachment 2 Enclosure 1 NOC-AE-1 3002962 Page 14 of 50 Figure A2.3.5 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 70 W 60 z

~50 40 V-C,

-030 S

C.)

020 0

1U

• 0 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Figure A2.3.6 Fire Hazard - Spurious Pzr PORV Open 05/06/13 14:41:54 RETRAN-02-MOD005.2.1 05/05/05 EPRI 130 120 110 100 C 90 2'80

• 70

• 60 0

o 50

.1*4040 C,)

30 20 10 0) 0 2000 4000 6000 8000 10000 12000 14000 16000 18000 Transient Time(Sec)

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 15 of 50 A2.2.4 Case 3: Spurious Opening of One Pressurizer Normal Spray Valve The analysis of a spurious opening of one pressurizer spray valve occurring at the time of reactor trip assumes the plant is at steady-state conditions for 10 seconds prior to the event. A sequence of events is provided in Table A2.4 and plots of selected parameters versus time are presented in Figures A2.4.1 through A2.4.6. Only results for RCS loop #1 are presented due to the symmetrical nature of the event.

The reactor trip results in a feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The spurious opening of one pressurizer spray valve results in depressurization of the RCS causing a SI signal when the low pressurizer pressure set point is reached. The SI signal results in letdown isolation and starts the SI pumps. The RCS depressurization continues until control of AFW flow is taken at the alternative shutdown station.

After control of AFW flow is taken, RCS temperature and pressurizer water level start to increase and in combination with the SI flow causes the indicated pressurizer water level to go off-scale high and the pressurizer to go water solid. The pressurizer PORV block valves are reopened 20 minutes into the event for pressure control. (Note that the pressurizer PORV or the PORV block valve is shut within 10 minutes at the alternative shutdown station to mitigate a spurious actuation of a PORV).

RCPs are secured 30 minutes into the event which stops the spray to the pressurizer and results in an increase in pressurizer pressure due to the expansion of RCS fluid in the hot leg. However, the pressurizer pressure never exceeds the pressurizer PORV lift set point.

Results of the analysis show that the spuriously-opened pressurizer spray valve results in a rapid decrease in pressurizer pressure and initiation of SI flow. The SI flow in combination with the heating of the RCS after AFW flow is reduced results in a water solid pressurizer. Pressure increases again when the operators secure the RCPs, but pressure remains below the pressurizer PORV lift set point.

The indicated SG water level remains between 22% and 100% after AFW flow is initiated. The operators are able to maintain plant conditions until excess letdown is placed in service and the indicated pressurizer water level is restored to the indicating range. Pressurizer level does not go below 30% during this transient. Figure A2.4.6 demonstrates that the subcooling margin approaches 0 but then rapidly recovers. Sufficient core cooling is maintained and fuel integrity is not challenged.

After the indicated pressurizer level is restored, charging flow can be used to borate the RCS to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shutdown conditions.

The acceptance criteria listed in Section A2.1 are met.

Attachmnent 2 Enclosure 1 NOC-AE- 13002962 Page 16 of 50 Table A2.4 Sequence of Events for a Spurious Opening of One Pressurizer Normal Spray Valve Occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One pressurizer normal spray Spurious action 10 valve fails open Turbine Trip On reactor Trip 13.5 FW Isolation Low Tavg 34.8 AFW flow initiated Low SG level 36.7 SI initiated Low Pressurizer Pressure 151 Letdown isolated On SI Signal 151 Secure centrifugal charging Manual 610 pumps Operators close pressurizer Manual 610 PORV block valves Operators control AFW flow Manual 610 MSIV closure Manual 615 Pressurizer level off-scale high 992 Pressurizer water solid 1190 Open PORV Block valves Manual 1210 Secure RCPs Manual 1810 Initiate excess letdown. Manual 7210 Charging available for boration Pressurizer level <100% 10216

Attachment 2 Enclosure I NOC-AE-13002962 Page 17 of 50 Figure A2.4.1 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 110

• .100 U)0.

S90 0)80 80

.M 70 U) 060 I.-

C.

0 50 040 30 V' - ....... ...... . ----

0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Figure A2.4.2 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 40 Top of Pressurizer 35 i30 0

.25

20

.15

$A 10 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Attachment 2 Enclosure I NOC-AE-13002962 Page 18 of 50 Figure A2.4.3 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2400 2300 MG2200 U)

C.

• 2100

)2000 a-CL L1900 N

4-S1800 C 1700 1600 1500 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Figure A2.4.4 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 595 590 IFI 585

-580

>575 I--

570 0.

8

-J 565 560 555 - , - ......-.........

550 - - -- - -- ------

- -Tt- - -

0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Attachment 2 Enclosure I NOC-AE-13002962 Page 19 of 50 Figure A2.4.5 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 80 z

R60 050 U) 40

.30

,-20 0

0 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Figure A2.4.6 Fire Hazard - Spurious Pzr Normal Spray Open 06/06/13 06:30:52 RETRAN-02-MOD005.2.1 05/05/05 EPRI 75 70 65 U-E 60

• 55 50 0

0

.045 to 40 35 30 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 Transient Time(Sec)

Attachment 2 Enclosure I NOC-AE-13002962 Page 20 of 50 A2.2.5 Case 4: Spurious Opening of One Feedwater Regulating Valve (FWRV)

The analysis of a spurious opening of the one FWRV occurring at the time of reactor trip assumes the plant is at steady-state conditions for 10 seconds prior to the event. At the time of reactor trip, the FWRV associated with RCS loop #1 spuriously opens fully. A sequence of events is provided in Table A2.5 and plots of selected parameters versus time are presented in Figures A2.5.1 through A2.5.6. Due to the asymmetric nature of the transient, results are plotted for the RCS loop with the spuriously fully opened FWRV (RCS loop #1) and for a RCS loop without a spuriously fully-opened FWRV (RCS loop #2). Results for RCS loops #3 and #4 are the same as for loop #2.

The reactor trip results in feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The feedwater isolation terminates feedwater flow from all SGs and mitigates the effects of the spuriously-opened FWRV. The additional cooling and depressurization of the RCS due to the spuriously-opened FWRV associated with RCS loop #1 in conjunction with the AFW flow results in a SI signal due to low pressurizer pressure. The SI signal results in letdown isolation and starting the SI pumps. The RCS cooling and depressurization continue until control of AFW flow is taken at the alternate shutdown station. The RCS pressure does not decrease below the shutoff head of the high head SI pumps. Therefore, SI flow injection into the RCS does not occur.

RCS temperature and pressure rise after the AFW flow is reduced until the saturation pressure in the SG reaches the SG PORV set point. The RCS temperature and pressure continues to rise due to the thermal expansion of RCS hot leg fluid when the RCPs are secured 30 minutes into the event. The indicated pressurizer water level and SG water level remain on-scale throughout the event.

Results of the analysis show that the indicated SG water level in the RCS loop with the spuriously-opened FWRV will be higher than otherwise expected, but will remain on-scale.

Pressurizer and SG water levels are controlled within the indicating range throughout the event.

Pressurizer level remains within the indicating range during this transient. Figure A2.5.6 demonstrates that the sub cooling margin is maintained throughout the event. Sufficient core cooling is maintained and fuel integrity is not challenged. Figure A2.5.3 shows that the RCS pressure boundary is not challenged. Stable plant conditions are maintained until excess letdown and charging can be placed in service, at which time the RCS can be borated to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shutdown conditions.

The acceptance criteria listed in Section A2.1 are met.

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 21 of 50 Table A2.5 Sequence of Events for a Spurious opening of one Feedwater Regulating Valve occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 Loop I feedwater regulating Spurious action 10 valve fails open Turbine Trip On reactor Trip 13.5 FW Isolation of all four loops Low Tavg 34.0 AFW flow initiated Low SG level 36.1 SI initiated Low Pressurizer Pressure 541 Letdown isolated On SI Signal 541 Secure centrifugal charging Manual 610 pumps Close PORV block valves Manual 610 Operators control AFW flow Manual 610 MSIV closure Manual 615 Main feedwater isolation of Manual 615 spurious open valve Open PORV Block valves Manual 1210 Secure RCPs Manual 1810 Initiate excess letdown. Manual 7210 Charging available for boration

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 22 of 50 Figure A2.5.1 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2500

-*2000

.0E

.1500 0

" 1000 CL 0.

-J O 500 i

0 10 20 30 40 50 60 70 80 90 100 Transient Time(Sec)

Figure A2.5.2 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 60 0.50-U) 40

.L4 30 IL20

.20 0 - .. . . ...

0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 23 of 50 Figure A2.5.3 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2400 2300

• 2200

- 2100 N

=2000 (A

0.

I-1900 1800 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Figure A2.5.4 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 595 590 Loop 1 585 U.580 Loop 2

> 575 I--

C,570 0

0

-- 565 560 555 550 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Attachment 2 Enclosure I NOC-AE-13002962 Page 24 of 50 Figure A2.5.5 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 100 90 U,

Z 80 0-Z 70

.j 060 (n 50 U) o

• 400

.2

- 30

0. 20 0

0

-j 10 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Figure A2.5.6 Fire Hazard - Spurious FW Reg Valve Open 15/02/13 16:57:03 RETRAN-02-MOD005.2.1 05/05/05 EPRI 90 85

-. 80 I.D I0-60 0650 55 50 0 1000 2000 3000 4000 5000 6000 7000 8000 Transient Time(Sec)

Attachiment 2 Enclosure I NOC-AE- 13002962 Page 25 of 50 A2.3 Offsite Power Assumed not Available (LOOP)

The limiting event analyzed for a LOOP is a spuriously open pressurizer PORV for ten minutes until PORV or the associated block valve is shut from the alternate control station. The analysis conservatively assumes the pressurizer PORV or its associated block valve is closed at the alternate shutdown station in ten minutes. Operators have demonstrated that these actions can be performed in approximately five minutes.

Two cases are considered:

• Case la with safety injection (SI) available and

• Case lb with no SI available.

These cases assumed a control room evacuation due to fire with a spuriously opened pressurizer PORV and a LOOP.

The RETRAN-02 MOD 5.3 code was used to perform the analysis of Case l a because RCS voiding did not occur. For Case Ib, the RETRAN-3D code with the Chexal-Lellouche algebraic slip model in the vertical junctions and HEM model (i.e., assumes equal vapor and liquid velocities) in horizontal junctions was used due to occurrence of RCS voiding. The basis for accepting the results of using the RETRAN-3D code is provided in Section A.2.3.6 of this Attachment.

A2.3.1 Assumptions

1. The plant is at full power, steady-state nominal conditions at the time of reactor trip.

2. All automatic controls are assumed operable unless otherwise specified.

3. The fire causes the operators to initiate plant shutdown. The reactor is tripped and a LOOP is assumed.

4. The transient event is one pressurizer PORV spuriously opens.

(a) One pressurizer PORV spuriously opens at the time of reactor trip.

(b) Operator blocks the spuriously opened PORV 10 minutes after reactor trip. The other pressurizer PORV remains available.

Note: The circuit wiring for the PORV block valve is in accordance with the conceptual wiring recommendations as addressed in the NRC Information Notice 92-18. Limit and torque switches are located between the control panel, and between the auxiliary shutdown panel and the valve motor starter (open/close) at the motor control center. After the transfer of the circuits to auxiliary shutdown panel, the block valve can be operated to any position no matter the impact the fire had on the control circuit from within the control room.

5. The main turbine governor valves closes in 3.5 seconds after reactor trip.

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 26 of 50

6. Main steam isolation valves (MSIV):

(a) MSIVs close on compensated low steam line pressure signal (750 psia).

(b) Valve stroke time = 5 seconds.

7. Main feedwater isolation valves (FWIV):

(a) Main feedwater continues until the FWIVs close on any of the following:

(i) SI signal, (ii) SG narrow range water level greater than 87.5%,

(iii) Tavg low (574°F) coincident with reactor trip, or (iv) 10 minutes after the reactor trip due to operator action.

(b) FWIV stroke time = 10 seconds.

(c) Closing the main feedwater isolation valves secures flow from the SUFP.

8. Auxiliary feedwater (AFW):

(a) AFW start signal initiated when the SG narrow range water level decreases to 20%, or on a SI signal.

(b) A 60 second delay for AFW start time is assumed to account for diesel loading of equipment.

(c) AFW flow is 640 gallons per minute per SG.

(d) AFW temperature of 70'F is assumed.

(e) Operators throttle back AFW in 10 minutes after reactor trip to maintain narrow range SG water level between 22% and 50%.

9. Pressurizer Power-Operated Relief Valve (PORV):

(a) Operators close the spuriously opened pressurizer PORV block valves 10 minutes after reactor trip.

(b) Operators will not close the block valve associated with the pressurizer PORV that has not spuriously opened with the indicated pressurizer water level off-scale high because this valve provides the ability to maintain RCS pressure control.

10. Charging and Letdown:

(a) The CCPs are isolated coincident with the reactor trip due to LOOP.

(b) Normal letdown is isolated coincident with the reactor trip due to LOOP.

(c) Operators restore charging pumps in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

(d) Excess letdown is available 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after reactor trip.

(e) Excess letdown design flow is 35 gpm.

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 27 of 50

11. SI:

(a) SI occurs on compensated low steam line pressure of 735 psig, or low pressurizer pressure of 1857 psig (1872 psia).

(b) An SI signal closes the FWIVs, normal letdown valves and initiates SI.

(c) A 30 second delay to allow diesel power to be available (diesels assumed available 30 seconds after the LOOP).

(d) Operators secure SI in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to commence RCS cool down.

(e) For Case lb no SI flow is available.

12. Pressurizer Backup Heaters (Groups A&B):

(a) Available 10 minutes after reactor trip.

(b) The backup heaters will maintain the pressurizer pressure if the indicated pressurizer level is greater than 17%.

(c) Each group of backup heaters has a capacity of 431 KW (862 KW total).

13. Pressurizer Proportional Heaters are not available.

14. RCPs:

(a) RCP seal leakage is 4.5 gpln/pump (18 gpm total) 13 minutes after the CCPs are secured.

The leakage stops after the CCPs are returned to service.

(b) Due to the LOOP, the RCPs trip coincident with the reactor trip.

15. The pressurizer normal spray flow stops after all RCPs are tripped.

A2.3.2 Model Considerations

" Core exit thermocouple temperature was calculated as the maximum of the temperature in the top four nodes of the core.

" Subcooling margin was calculated as the difference between the saturation temperature corresponding to the average of the pressures in hot legs A, B, and C and the hottest core exit thermocouple reading from any one quadrant of the core.

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 28 of 50 A2.3.3 Sequence of Events Table 4.1-1.

STP Fire Hazard Event Sequence of Events Event Setpoint Time (seconds Case la Case lb Reactor Trip Manual 10.0 10.0 Spurious Open Pressurizer PORV #2 On Reactor Trip 10.0 10.0 RCPs trip LOOP 10.0 10.0 Letdown Isolation LOOP 10.0 10.0 Charging Isolated LOOP 10.0 10.0 Turbine Trip On Reactor Trip 13.5 13.5 AFW Signal Low SG Level 27.4 27.4 Main Feedwater Isolation Low Tavg 34.6 34.6 Safety Injection signal Low PZR Pressure 47.1 47.1 AFW Initiated Low SG Level 70.0 70.0 SI Flow begins RCS back pressure 88.0 N/A

< 1715 psia Pressurizer water solid 484.0 N/A Pressurizer PORV #2 Block Valve Closed (PORV #1 Manual 610.0 610.0 available)

Pressurizer Backup Heaters A+B available and on Manual 610.0 610.0 Pressurizer Backup Heaters A+B off High PZR Pressure 722.8 N/A Pressurizer PORV 1 Opens (first time) High PZR Pressure 733.7 N/A SG PORVs Open (first time) High Steam Pressure 2780.0 1626.0 Pressurizer Backup Heaters A+B on Low PZR Pressure 3960.0 N/A (PZR Level > 17%)

Excess Letdown Available Manual 7210.0 Note 1 Charging Restored Manual 7210.0 Note 1 Pressurizer Level < 100% 13774.0 5364.0 End of Analyses 16000.0 6000.0 Note 1: Analyses ends at 6000 seconds. Excess letdown becomes available and charging is restored at 7210 seconds

Attachment 2 Enclosure I NOC-AE-13002962 Page 29 of 50 A2.3.4 Case la results (SI available)

The transient is initiated at 10 seconds with a manual reactor trip. A spurious opening of pressurizer PORV #2 occurs coincident to the reactor trip. The RCPs trip is due to the LOOP. Letdown and charging are isolated by the LOOP. A turbine trip occurs due to reactor trip in 13.5 seconds.

Figure 4.1-1 shows the reactor power response. Immediately the RCS pressure and temperature decrease due to the drop in power. Without RCPs running, the RCS flow decreases immediately.

Figure 4.1-3 shows the cold leg coolant flow rate for RCS loop #1. The RCS flow decreases but natural circulation is established and maintained throughout the transient. Figures 4.1-4 and 4.1-5 show the RCS loop #1 hot leg and cold leg temperatures, respectively. The cold leg temperature decreases sharply when SI flow is initiated.

Figure 4.1-2 shows the flow through the open PORV #2. The spuriously open PORV causes a rapid depressurization of the RCS. The RCS pressure falls below the low pressurizer pressure SI set point causing an SI actuation. The RCS pressure continues to decrease and drops below 1715 psia (i.e. the shutoff head of the high head safety injection pump) at 88 seconds initiating SI flow. SI flow begins to increase the RCS mass and limits the decreases in both RCS pressure and pressurizer level. The spuriously open PORV draws liquid into the pressurizer causing the level to rise and eventually the pressurizer goes water solid causing a rapid increase in PORV flow. The PORV is qualified to pass water.

At 610 seconds, operators can take action to close the pressurizer PORV #2 or its associated block valve, activate the pressurizer backup heaters, and throttle back the AFW. The combination of these actions causes a sharp increase in pressurizer pressure. The pressure raises enough to lift pressurizer PORV #1 at approximately 734 seconds. The PORV #1 cycles until 2950 seconds after which the RCS pressure drops below the PORV set point.

Figure 4.1-6 shows the pressurizer pressure and Figure 4.1-7 shows the indicated pressurizer level.

Figures 4.1-8 and 4.1-9 are collapsed liquid levels in the pressurizer and the surge line. Figure 4.1-8 shows that the pressurizer goes water solid (total height of the pressurizer is 38.503 ft). These figures demonstrate that the pressurizer and surge line do not empty during the transient.

Figure 4.1-10 shows the net charging/letdown flow and Figure 4.1-11 shows the SI flow. The pressurizer level remains off-scale (above 100%) for a lengthy period of time. Gradually the effect of excess letdown decreases RCS inventory enough to bring pressurizer level within scale.

Main feedwater isolation occurs at approximately 35 seconds. AFW flow begins at 70 seconds.

Reduced heat load from the primary plant causes the SG pressure to decrease. Figure 4.1-12 shows SG pressure. The unthrottled AFW flow lowers SG pressure and maintains SG level. At 610 seconds, AFW flow is throttled, as required by procedure, to maintain narrow range SG level within range. The SG pressure begins to rise because of reduced AFW flow. The SG pressure increases to the SG PORV setpoint after 2780 seconds and remains steady for the rest of the transient. Control of AFW flow maintains SG level at approximately 50%. Figure 4.1-13 shows the narrow range SG level. Figure 4.1-14 shows the AFW flow. Figure 4.1-15 shows the SG PORV flow.

Attachment 2 Enclosure I NOC-AE- 13002962 Page 30 of 50 The Case 1a transient is terminated after 16000 seconds. At this time, the indicated pressurizer level is within range of 20% to 100% and the indicated SG narrow range water level is 22% to 100%.

Figure 4.1-16 shows the RCS sub cooling margin. During the Case 1a transient, the sub cooling margin remains above zero. Figure 4.1-17 shows the core peak exit fluid temperature which never approaches 1200'F. Figure 4.1-18 demonstrates that liquid level in the hot leg does not decrease during the transient.

In surmnary,

• Sufficient core cooling is established and maintained throughout the transient.

• Fuel cladding integrity is not challenged.

" Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

• Charging and letdown are restored and available to borate the RCS to support cool down to cold shutdown conditions.

A2.3.5 Case lb results (SI not available)

Case lb is initially the same transient as Case la. Without SI flow, the RCS pressure does not rapidly recover when the spuriously opened pressurizer PORV is closed as occurred when SI flow was available (Figure 4.1-6), which results in a loss of subcooling margin (Figure 4.1-16). Voiding in the RCS results in the indicated pressurizer level going off-scale high after 446 seconds (Figure 4.1-7) but the pressurizer does not go water solid (figure 4.1-8). With the closing of the spuriously opened pressurizer PORV and throttling of AFW flow at 610 seconds, pressurizer pressure increases as a function of the hot leg saturation temperature.

With loss of off-site power, the reactor coolant pumps are lost and natural circulation flow begins in the RCS. As pressurizer pressure decreases due to the spuriously open pressurizer PORV, voiding results in two-phase flow in the RCS. Two-phase natural circulation flow is momentary lost in RCS loops 1 and 4 as shown on Figures 4.1-19 and 4.1-20, but is quickly regained as RCS pressure is restored. Two-phase natural circulation flow is maintained in RCS loops 2 and 3 ensuring flow through the core. These conditions preclude reflux cooling from occurring. Adequate heat transfer to the secondary is maintained such that the RCS pressure stabilizes based on the set point pressure (i.e.

1250 psia) for the SG PORVs after 1626 seconds into the event.

Operators are able to control SG level at approximately 50 percent with AFW flow until voiding in the RCS decreases to such a point that indicated pressurizer water level is restored. Case l b transient is terminated after 6000 seconds at which time the indicated pressurizer level is within range of 20% to

< 100% and the indicated SG narrow range water level is 22% to < 100%. Figure 4.1-17 shows the core peak exit fluid temperature never approaches 1200'F throughout the event, ensuring core damage does not occur.

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 31 of 50 In summary,

• Sufficient core cooling is established and maintained throughout the transient.

" Fuel cladding integrity is not challenged.

• Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

" Charging and letdown are restored and available to borate the RCS to support cool down to cold shutdown conditions.

Figure Plots Note: Figure plots provided are shown for RCS Loop #1 as the transient response in all four loops is similar.

1.20 ...

Cc1.00 _ _! I 0

0.80

.0 0.40 U--

V C- ___

'U 0,.

"= 0 .2 0 ......... ...................... .......... .... .........

0.00 . ....... I -..

• 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-1 Reactor Power

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 32 of 50 140 120 7 100 F C-1. C.s. 1b]

80 o

04 0~

N 40 IL 20 0

0 2000 4000 6000 8000 10N000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-2 Spuriously Opened Pressurizer PORV Flow 12000 10000 E

8000 0 -Case le

• Case1ib L-6000 0

, 4000 0.

0 0

-J 2000 1

0 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-3 Loop 1 Cold Leg Flow

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 33 of 50 640 --

620

,- l

- 600 E 580 I-0

.~560

-- I 0

o 520 500 1 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-4 Hot Leg Temperature 580 560 2540 a520 E

" 500

-J0 r ---

[-'C.sela oCaselb]

480 C 460 0

,-j "0

440 420 l 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-5 Cold Leg Temperature

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 34 of 50 2400 2200

.~2000 S1800

~j1600 N

• 1400 1200 1000 0 2000 4000 6000 8000 100'00 12000 14000 16000 Transient Time (sec)

Figure 4.1-6 Pressurizer Pressure 100

^^ l (U

~80

.7 0

• --Cssola

• Cosoib

-o I -~ ____ ___ ________

"o0 a- 0 20 F-0 2000 4000 6000 8000 100( oo 12000 14000 16000 Transient Time (Sec)

Figure 4.1-7 Indicated Pressurizer Level

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 35 of 50 40 35 30

.5 25 -1 20 to 20 b---- -V 15 10 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-8 Pressurizer Collapsed Liquid Level 14-13 12

>10

• 9 1

[ -ca. . oaselb

• 8 67 5t 44 IT 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-9 Surge Line Collapsed Liquid Level

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 36 of 50 0.00 1 1 0 2000 6*0 8000 14000 4000 6000 10000 12100 16ý00

-0.50 E-1.00 r.0 -1.50

"---Casela I Case lb "o-2.00 . ..

.S-2.50 i-

.C U) -3.00 -

z

-3.50

-4.00 Transient Time (Sec)

Figure 4.1-10 Net Charging and Letdown Flow 120 100

.0 E 80

-Cas is1

• Case 1b 0.

o 60 0

U- 403 20 t

0 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-11 Safety Injection Flow

Attachment 2 Enclosure I NOC-AE- 13002962 Page 37 of 50 1250 1200 1150 8.1100 5 1050

ýCs*C- lb to 21000 C.

0 900 0

8J 850 800 750 .

0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-12 Steam Generator Steam Pressure 70

-60 z

50 0

0-j 40 "o

030 0 Cawe lb]

.20 0

. 0

-"10 0 f 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-13 Steam Generator Indicated Narrow Range Water Level

Attachment 2 Enclosure I NOC-AE-13002962 Page 38 of 50 90 80 E 70 960

-Casela Casoib so ~-

v40o

= 30 K A~&AAA 02 I A a & & & -

0

-J 10 11111AVY1 I 0

0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-14 Steam Generator AFW Flow 30 25

.0 SU-010 0.

0

-J 5

0 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-15 Steam Generator PORV Flow

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 39 of 50 110 90 t C' 70 J

ý-Casela ý Case 1b]

._5 T-- -- T 2 50 0

.0 cn 30 10

-10 - 2000 4000 6000 8000 _1000 12 00 14000 _ 16!00 Transient Time (Sec)

Figure 4.1-16 Subcooling Margin 640 -7 T -7f 620 600 E 580 -

'R 560 _ _

U4) I- Case 1a Case

(. 520 500 .

0 2000 4000 6000 8000 10000 12000 14000 16000 Transinet Time (sec)

Figure 4.1-17 Peak Core Exit Temperature I

Attachment 2 Enclosure 1 NOC-AE- 13002962 Page 40 of 50 2.5 I a 2.0 S1.5 1.0

-- Case la-Csof 6 1.0 0.5 0.0 0 2000 4000 6000 8000 10000 12000 14000 16000 Transient Time (Sec)

Figure 4.1-18 Hot Leg Collapse Liquid Level 1300 1100 900 i ---- -- L--p-j-T

/

r 500 --

LO-p4 m~ 300 0 100

____1 --

-100 -3Gý -6~ 0

-300

-500 Transient Time (Sec)

Figure 4.1-19 Hot Leg Flow Case lb

Attachment 2 Enclosure I NOC-AE-13002962 Page 41 of 50 1300 1100 Loop 1 W Loop 3 900 -fL E 700 o 500 500 _* _..... --

U.

" 300 100

-100 10 -- M20_0---- -3000- 4000- 5000o0

-300 -_ --- -_- -_--------

Transient Time (Sec)

Figure 4.1-20 Cold Leg Flow Case lb

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 42 of 50 A2.3.6 Acceptable Use of RETRAN-3D Code.

The RETRAN-3D computer code was used to perform the Defense-In-Depth (DID) analysis presented in Section A2.3 as Case lb for a spuriously opened pressurizer PORV without safety injection, voiding in the hot leg, and two-phase flow in the RCS. To model the impact of the voiding and two-phase flow, the RETRAN-3D computer code was used with the Chexal-Lellouche drift flux model. The NRC review of the RETRAN-3D computer code, as documented in the Safety Evaluation Report (SER) (Reference A2.3.6.1), placed the following condition and limitation on the use of the code with regards to the use of the Chexal-Lellouche drift flux model as it pertains to the spuriously opened pressurizer PORV analysis in this submittal:

16. No separate effects comparison have been presented.for the algebraicslip option and it would be prudent to request comparisons with the FRIGG tests beibre the approvalof the algebraicslip option.

NRC Staff position: The algebraicslip option has been modified to include the Chexal-Lellouche driftflux model. Use of the Chexal-Lellouche drift.flux model for B WR and PWR applicationswithin the range of conditions covered by the steam-water database used to develop and validate the model is approved. The model has been qualified with datafrom a number of steady-state and two-component tests. While the small dimensions of the fuel assembly are covered, as noted previously in this safet evaluation, the datafor largepipe diameters, such as reactor coolant system pipes, are not extensive and use of the Chexal-Lellouche model will needjustification.Assessment work indicates that the model tends to underpredictthe void profile in the range of 12

[1740 psi] to 17 [2465 psi] MPa. In addition, the accuracy of the model in the range of 7.5 [1087 psi] to 10 [1450 psi] Mpa, which covers B WR A TWS conditions, has not been fully demonstrated. Results of analyses using the model in these ranges must be carefully reviewed.

The Chexal-Lellouche correlationcannot be used in situations where CCFL is important unless validationfor appropriategeometry and expectedflow conditions is provided.

STPNOC evaluation

1. Use of the Chexal-Lellouche driftflux modelfor BWR and PWR applicationswithin the range of conditionscovered by the steam-water databaseused to develop and validate the model is approved.

Attachment 2 Enclosure I NOC-AE-13002962 Page 43 of 50 The Chexal-Lellouche drift flux correlation was developed from a steam-water void fraction data base and an air and refrigerant void fraction data base. In RETRAN-3D, the Chexal-Lellouche drift flux is applied for steam/water mixture.

The Chexal-Lellouche drift flux steam/water void fraction data consists of several experiments measuring void fraction in heated fuel bundle assemblies and tubes and unheated experiments with various geometries. The steam/water data base is summarized Table 2.3.6-1 below.

Table 2.3.6-1. Summary of Chexal-Lellouche (1996) Void Fraction Model Database (Reference A2.3.6.2)

Heated Steam-Water Data Parameter Range Number of 1427 Data Void 0.01 - 0.95 Fraction Mass Flux 0 - 1.59 Mlb/hr-ft2 Pressure 14.5 - 2175 psia Heat Flux 0.0003 - 0.70 MBtu/hr-ft2 Subcooling 0 - 54 0 F Geometry Bundle assemblies and tubes (0.03 < Dh < 0.15 ft)

Unheated Steam-Water Data Parameter Range Number of 521 Data Void 0.01 -0.99 Fraction Mass Flux 0 - 1.92 Mlb/hr-ft2 Pressure 14.5 - 2610 psia Geometry Tube (0.015 < Dh < 2.1 ft)

Note: Dh - hydraulic diameter Void fraction, mass flux, pressure, and hydraulic diameter are key parameters in a drift flux formulation.

The hydraulic diameter is used in the drift flux formulation through the Reynolds number.

Steam generator tubes and bundle region have a hydraulic diameter similar to fuel

Attachment 2 Enclosure I NOC-AE-13002962 Page 44 of 50 assemblies. Specifically, the rod bundle data in the Chexal-Lellouche drift flux data base have hydraulic diameters ranging from 0.03 ft to 0.15 ft.

For the spuriously opened pressurizer PORV analysis, the general range of these key parameters in the steam generator are given in Table 2.3.6-2.

Table 2.3.6-2. Range of Key Parameters During a Spuriously Opened Pressurizer PORV Analysis Hydraulic Pressure Mass Flux Diameter (psia) Mlb/hr-ft 2 Void Fraction Region (ft) High - Low High - Low High - Low SG Tubes 0.0507 2260- 570 2.4- 0.212 1.0-0.0 SG Tube Bundle 0.0863 1088 - 160 0.28-0.26 1.0-0.08 The table shows that the SG parameters are within the Chexal-Lellouche drift flux model data base range.

Therefore, the conditions and limitations stated in the SER are satisfied.

2. While the small dimensions of the fuel assembly are covered, as noted previously in this safety evaluation, tile data for largepipe diameters, such as reactorcoolant system pipes, are not extensive and use of the Chexal-Lellouche model will needjustification.

Assessment work indicates that the model tends to underpredictthe void profile in the range of 12 [1740psi] to 17[2465psi]MPa. In addition, the accuracyof the model in tile range of 7.5 [1087psi] to 10 [1450 psi] Mpa, which covers BWR A TWS conditions, has not been fully demonstrated.Results of analyses using tile model in these ranges must be carefully reviewed.

To address this condition and limitation, sensitivity studies were performed to assess the impact of various slip models on the results of the spuriously opened pressurizer PORV analysis. Results of the sensitivity studies were used to address the following:

1) How much does the use of a slip model modify the conclusions of this analysis?

2) Do slip model options significantly change the results of this transient?

What is the impact on the transient results of modeling two-phase horizontal flow with a different option?

Attachment 2 Enclosure I NOC-AE-1 3002962 Page 45 of 50 Currently in RETRAN-3D a chosen slip model option is applied throughout the model with the exception of being able to deactivating the slip model at any given junction.

RETRAN-3D does not allow the choice of a flow regime slip model in horizontal junctions and drift flux in vertical regions. To determine the effect slip modeling has on the Case l b conclusions, the four following cases are compared:

• HEM, no slip,

• Use of the Chexal-Lellouche drift flux model option throughout the model,

• Use of the dynamic slip throughout the model, and

• Use of the Chexal-Lellouche drift flux model option in vertical regions and HEM in horizontal regions.

The dynamic slip model is based on momentum difference equation that uses flow regime maps to determine the proper interphase and wall phasic contact areas and friction factor models. The model contains both vertical and horizontal flow regime maps. For this analysis, the proper flow regime maps were selected for the vertical and horizontal flow direction The results of the sensitivity study are compared in Figures A2.3.6-1 through 2.3.6-6 2500

-- HEM

- - Chexal-Lellouche 2000 - Dynamic Slip

.. C-L (vertical) HEM (horizontal) 1500 N

1000 500 0 1000 2000 3000 4000 5000 6000 TransientTime (Sec)

Figure A2.3.6-1. Pressurizer Pressure

Attachment 2 Enclosure I NOC-AE- 13002962 Page 46 of 50 120 100 80 CL

'a 40 0-a, 40 20 0 1000 2000 3000 4000 5000 6000 Transient Time (Sec)

Figure A2.3.6-2. Pressurizer Level 12000 10000 8000 6 6000 S4000 2000 O 4000 00 0 1000 2000 3000 4000 5000 6000 Transient Time (Sec)

Figure A2.3.6-3. Hot Leg Flow

Attachment 2 Enclosure I NOC-AE- 13002962 Page 47 of 50 600 590 580 70 o

0

- - Chexal-Lellouche Dynamic Slip

-"- C-L (vertical) HEM (horizontal) 540 0 1000 2000 3000 4000 5000 6000 TransientTime (Sec)

Figure 2.3.6-4. Loop Average Temperature 1400 1200 - /

C3 1000

-~-HEM 0

0,--- ChexaI-Lellouche

• - Dynamic Slip 800

... C-L (vertical) HEM (horizontal) 600 01000 2000 3000 4000 5000 6000 Transientlime (See)

Figure A2.3.6-5. Steam Generator Pressure

Attachment 2 Enclosure I NOC-AE-1 3002962 Page 48 of 50 70 60 50 z

g 40

-J 30 C

o 20 10 0

0 1000 2000 3000 4000 5000 6000 TransientTime (Sec)

Figure A2.3.6-6. Steam Generator Narrow Range Level The RCS pressure behaves in a similar manner for these cases. The pressurizer level response shows that the level drops back within range sooner with Chexal-Lellouche model compared to HEM or dynamic slip. This is consistent with the use of a slip model since the liquid will move to the lower regions of the system. The loop flow drops to a lower value with the use of slip models compared to HEM. HEM will keep the vapor and liquid phases mixed throughout the system adding more buoyancy to the natural circulation flow. The loop average temperature response is similar for all cases as is the steam generator pressure and narrow range level.

These sensitivity studies demonstrate that the acceptable conclusions regarding spuriously opened pressurizer PORV analysis are not changed by differing slip options or by slip options regarding horizontal flow. The various slip options changed the liquid and vapor distribution within the RCS and timing when the pressurizer level dropped back within range, but the overall conclusions are unchanged. For the questions posed earlier:

1) How much does the use of a slip model modify the conclusions of this analysis?

The use of a slip model does change the RCS mass distribution with liquid dropping to lower elevations and vapor rising. This can be observed by the pressurizer level dropping within range earlier and reduced loop flow rates. However, the conclusions drawn from the analysis are the same.

Attachment 2 Enclosure I NOC-AE-13002962 Page 49 of 50

2) Do slip model options significantly change the results of this transient?

The flow regime map dependent dynamic slip option and Chexal-Lellouche drift flux options produce similar transient results. The pressurizer level response displays the most difference with the pressurizer level dropping back into range latter with the dynamic slip model than the Chexal-Lellouche drift flux option. This is an indication of the dynamic slip option keeping the vapor and liquid phases more mixed with less vapor and liquid separation than the Chexal-Lellouche drift flux model. Conclusions drawn regarding this fire protections transient are the same for both slip options.

3) KWhat is the impact on the transient results of modeling two-phase horizontal/flow with a different option?

As can be observed from the above plots, horizontal two-phase flow modeling options have little to no effect on the transient behavior.

Therefore, the sensitivity studies demonstrate compliance with the conditions and limitations stated in the SER.

3. The Chexal-Lellouche correlation cannot be used in situations where CCFL is important unless validationfor appropriategeometly and expected flow conditions is provided.

A Counter Current Flooding Limit (CCFL) condition does not occur for the spuriously opened pressurizer PORV analysis. Therefore, the analysis is in compliance with the conditions and limitations of the SER.

Summary In summary, the Case lb DID analysis was performed using the RETRAN-3D computer code in compliance with the conditions and limitations outlined in the SER for this computer code. The conditions and limitations with regard to the use of the Chexal-Lellouche drift flux model have been satisfied. Therefore, the use of the RETRAN-3D computer code with the Chexal-Lellouche drift flux model is appropriate for the Case l b DID analysis.

Attachment 2 Enclosure 1 NOC-AE-13002962 Page 50 of 50 References A2.3.6. 1: Safety Evaluation Report on EPRI Topical Report NP-7450(P), Revision 4, "RETRAN-3D - A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems" (TAC No. MA431 1)" (ML010470342)

A2.3.6.2: Bindi Chexal, et al., "Void Fraction Technology for Design and Analysis",

TR-106236, EPRI, 1997.

Attachnment 3 Enclosure 1 NOC-AE-13002962 Attachment 3 to Enclosure 1

Main Control Room CFAST Fire Model

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 1 of 20 A3.1 Introduction Fire modeling was performed to determine whether the limiting event described in Section A2.3 of to Enclosure 1 is a credible event. The analysis in this attachment demonstrates that it is reasonable to conclude that a fire in one main control room (MCR) control panel will not affect both pressurizer power-operated relief valve (PORV) controls and the offsite power breaker controls or both the pressurizer PORV controls and the safety injection (SI) system controls.

A spurious opening of a pressurizer PORV, including various combinations of availability of offsite power and SI, were analyzed for Fire Area 1 - the main control room. The controls and associated cabling for the pressurizer PORVs, offsite power breakers, and the SI system controls are physically separated in the main control room. The physical separation in the main control room allows for fire modeling to be used to determine if a credible fire in the main control room could affect both a pressurizer PORV and the offsite power breakers or both a pressurizer PORV and the SI system controls.

A Consolidated Model of Fire Growth and Smoke Transport (CFAST), Version 6.0.10, fire model was used. Specifically, the CFAST model is used to predict the fire conditions that the controls and associated cabling for the pressurizer PORVs, offsite power breakers, and SI system would be subjected to by bounding credible fire events. The fire conditions are compared with documented acceptance criteria for the controls and associated cabling to determine whether or not a credible fire event could cause either a spurious opening of a pressurizer PORV and a loss of offsite power (LOOP), or a spurious opening of a pressurizer PORV and a loss of the SI system.

CFAST Version 6.0.10 is verified and validated in NUREG 1824 Vol. 5, "Verification and Validation of Selected Fire Models for Nuclear Power Plants - Consolidated Fire Growth and Smoke Transport Model (CFAST) Final Report". NUREG 1824 Vol. 5 was reviewed and this application of the fire model was determined to be bounded by the scope of the verification and validation. The CFAST used and installed on the computer hardware was verified through an approved engineering CFAST Version 6 in-use test procedure.

A3.2 Methodology The methodology for this analysis was developed in accordance with NUREG 6850 Vol. 2, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities Volume 2: Detailed Methodology", and NUREG 1934, "Nuclear Power Plant Fire Modeling Analysis Guidelines (NPP FIRE MAG)". Section 11.5.2 of NUREG 6850 Vol. 2 provides a methodology specific to fire modeling analysis of MCRs. NUREG 1934 provides a generalized methodology for application of fire modeling in nuclear power plants. The CFAST fire models were performed with guidance from the CFAST User's Guide (NIST Special Publication 1041: CFAST- Consolidated Model of Fire Growth and Smoke Transport (Version 6) User's Guide) and the CFAST Technical Reference Guide (NIST Special Publication 1026: CFAST- Consolidated Model of Fire Growth and Smoke Transport (Version 6) Technical Reference Guide).

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 2 of 20 Major steps of the methodology include:

• Identify and characterize MCR features

" Identify and characterize fire detection and suppression features and systems

" Identify and characterize target sets

" Identify and characterize ignition so urces

" Define fire scenarios

• Conduct fire growth analysis

• Document analysis results The specific methodologies are described in the following sections.

A3.2.1 Identify and Characterize MCR Features A walkdown was conducted in the MCR to gain an understanding of the specific features and related fire protection systems of the control room. The general characteristics of the MCR such as dimensions, wall construction type/thickness, ventilation flow rates, etc. that are required for the fire model were determined by station drawings and the combustible loading calculation.

A3.2.1.1 Layout The general layout of the MCR annotated with the cabinets that contain the controls and associated cables of concern is shown in Figure A3.1.

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 3 of 20 Figure A3.1 - Main Control Room Layout

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 4 of 20 The cabinet for the offsite power breakers, CPO 10, is connected through cabinets CP005-CP009 to the pressurizer PORV cabinet, CP004. The access doors to these cabinets are normally maintained closed, but there are openings between each cabinet in the series. The cabinet for the SI system controls, CPOOI, is not connected to the series of cabinets that contain the controls and associated cabling for the offsite power breakers and pressurizer PORVs. In addition, a barrier exists between CPOO1 and CP002. The floor elevation of the MCR is elevation 35 foot. The actual ceiling of the MCR is at elevation 60 foot. However, a drop ceiling exists at elevation 45 foot. The Shift Manager's office is in the northeast corner of the MCR. The door to the Shift Manager's office is maintained open.

A3.2.1.2 Materials The floor, ceiling, and walls are constructed of concrete. Parts of the walls are lined with gypsum board and part of the floor is covered with a low pile carpet. The ceiling of the MCR is also concrete, and the drop ceiling is constructed from non-combustible acoustic tile. The cabinets are primarily constructed of steel. The combustible loading for the MCR is documented in STPNOC calculation 7Q270MC5800. The primary combustible material in the MCR is cable insulation. The remainder of the combustible material consists of offices supplies, procedures and drawings, and other miscellaneous material. The combustible material located above the drop ceiling is cable insulation.

A3.2.1.3 Ventilation Ventilation to the MCR cabinet interiors is provided through filters beneath the bench board section of each cabinet. The ventilation flow is exhausted through ducts located at the top of the vertical section of the cabinets. Ventilation through the cabinets is the primary ventilation of the MCR. All doors to the MCR are maintained closed and all penetrations of the MCR are sealed.

A3.2.2 Identify and Characterize Fire Detection and Suppression Features and Systems Smoke detectors are present in each cabinet adjacent to the exhaust ventilation duct. In addition, smoke detectors are placed between each beam on the MCR ceiling. The automatic detection system does not isolate ventilation upon actuation. The MCR is continuously manned so that any significant fire would be reasonably expected to be detected by the operators in the MCR. No automatic suppression exists in the MCR; however, portable fire extinguishers are staged in the MCR and hose reels are available outside of the MCR for deployment into the MCR.

The detection and suppression features of the MCR are not explicitly modeled or credited in the fire model described below, but the continual presence of operators, smoke detectors, and availability of manual suppression add significant defense-in-depth to the results determined by the fire model.

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 5 of 20 A3.2.3 Identify and Characterize Target Sets The objective of the fire model is to determine whether or not a credible fire event in the MCR could cause either a spurious opening of a pressurizer PORV and a LOOP, or a spurious opening of a pressurizer PORV and a loss of the SI system; therefore, the target sets are defined to include the controls and associated cabling that could cause these events. As shown in Figure A3.1, the following cabinets were identified as the targets for the fire model.

• CPOOI - SI system controls

• CP004 - Pressurizer PORV control

• CPO 10 - Offsite power breakers Cabinets in their entirety were considered as targets for the fire model; however, the internal configuration of the cabinets includes robust separation between each safety-related train of controls and cabling and also non-safety related controls and cabling. Each safety-related train and the non-safety related controls and cabling are separated by steel barriers. From each safety-related individual control or instrument, the cabling is routed into conduit or enclosed cable trays that are also separated by train.

The separation between trains is not explicitly modeled or credited in the fire model described below, but it does add defense-in-depth to the results determined by the fire model. Detailed fire modeling of the propagation of a fire within a cabinet is outside of the capability of the fire model described below.

All of the cabling for the offsite power breakers, pressurizer PORV controls, and SI system controls are thennoset. The acceptance criteria defined in Table 8-2 of NUREG 6850 Vol. 2 are shown in Table A3.1. These acceptance criteria values are applied to cabinets CPOO1, CP004, and CPOIO.

Table A3.1: Cable Acceptance Criteria Cable Type Radiant Heating Criteria Temperature Criteria Thermoset 11 kW/mn (1.0 BTU/ft2s) 330'C (625°F)

A3.2.4 Identify and Characterize Ignition Sources A walkdown in the MCR was performed to identify bounding fixed ignition sources and possible limiting transient fire placements. The primary combustible material in the MCR is cable insulation which is contained in cabinets and the area above the drop ceiling. The in situ combustible load due to other materials in the MCR is minor in comparison to the cable insulation, and cables are contained in conduit or cables trays in the area above the drop ceiling. The MCR cabinets contain the largest concentrations of in situ combustible material in the MCR; consequently, the cabinets were identified as the bounding fixed ignition sources.

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 6 of 20 The movement of transient combustibles is strictly managed in the MCR. Transient loads are limited to office supplies and tools. Large combustible transient loads such as flammable liquids are prohibited in the MCR. Due to the limited magnitude of a postulated transient fire in the MCR, all transient fire scenarios were judged to be bounded by the bounding fixed ignition sources.

Table G-1 of NUREG 6850 Vol. 2 provides recommended heat release rate (HRR) values for electrical fires. The cabinets in the MCR are best characterized as vertical cabinets with qualified cables where the fire occurs in more than one cable bundle. The 9 8 th percentile HRR for this type of fire is 702 kW - this is the most conservative HRR for an electrical fire in qualified cable in Table G- 1.

Section 3.1.1 of NUREG 1934 recommends the following HRR profile: a t2 growth to the peak HRR followed by a constant period at the peak HRR followed by a linear decrease to zero.

Appendix G of NUREG 6850 Vol. 2 recommends a growth period of 12 minutes, a steady burning period of 8 minutes, and a time to decay of 19 minutes for electrical fires. The resulting HRR curve is shown in Figure A3.2.

Figure A3.2 Main Control Room Cabinet HRR Curve 800 700 600 500 400 300 200 100 0

0 10 20 30 40 50 Time (min)

Appendix S of NUREG 6850 Vol. 2 provides guidance for characterizing fire propagation between adjacent electrical cabinets. Per this guidance, no fire spread should be assumed if either of the following conditions is met:

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 7 of 20

1. Cabinets are separated by a double wall with an air gap.

2. Either the exposed or exposing cabinet has an open top, and there is an internal wall, possibly with some openings, and there is no diagonal cable run between the exposing and exposed cabinet.

A double wall is present between each cabinet without an air gap. The ventilation exhaust duct at the top of each cabinet functionally serves as an opening. In addition, no cables were observed during the walk down that spanned the intervening cabinets between the target cabinets. Due to this configuration, fire propagation between cabinets was assumed not to occur because the second condition above is met.

A3.2.5 Define Fire Scenarios As discussed in Section A3.2.4, the bounding ignition source was determined to be one of the cabinets. In order to determine which cabinet created the most bounding fire scenario, preliminary fire models were performed using CPOO1, CP004, or CPO10 as the initiating fire. CPOO1 was determined to create the most bounding fire scenario due to the smaller natural ventilation paths present in CPOO1; however, all three cabinets created similar fire scenarios characterized by large temperature and heat fluxes in the fire origination cabinet and marginally small temperatures and heat fluxes in the other two target cabinets.

In addition to the bounding fire scenario created by using CP001 as the fire origination cabinet, the fire scenario results using CP004 as the fire origination cabinet are presented. This fire scenario does not present bounding temperature and heat flux conditions; however, this scenario investigates the possibility of fire propagation between adjacent cabinets. The conditions in CP005 were analyzed to determine whether or not the controls and cabling in CP005 should be expected to ignite as secondary combustibles. Smoke propagation was also addressed in the fire model to determine if soot deposition would be a concern in the other target cabinets, CPOO 1 and CP010.

Both fire scenarios were analyzed over a period of one hour which encompasses the entire duration of the release of heat from the ignition source.

A3.2.6 Conduct Fire Growth Analysis The bounding fire scenario was analyzed using CFAST.

A3.2.6.1 CFAST Model Description The CFAST model is described in the CFAST User's Guide. CFAST is a two-zone fire model used to calculate the evolving distribution of smoke, fire gases and temperature throughout compartments of a building during a fire.

Attachment 3 Enclosure I NOC-AE-1 3002962 Page 8 of 20 The modeling equations used in CFAST take the mathematical form of an initial value problem for a system of ordinary differential equations (ODEs). These equations are derived using the conservation of mass, the conservation of energy (equivalently the first law of thermodynamics), the ideal gas law and relations for density and internal energy. These equations predict as functions of time quantities such as pressure, layer height and temperatures given the accumulation of mass and enthalpy in the two layers. The CFAST model then consists of a set of ODEs to compute the environment in each compartment and a collection of algorithms to compute the mass and enthalpy source terms required by the ODEs.

All of the data to run the model is contained in a primary data file, together with databases for objects, thermo-physical properties of boundaries, and sample prescribed fire descriptions.

These files contain information about the building geometry (compartment sizes, materials of construction, and material properties), connections between compartments (horizontal flow openings such as doors, windows, vertical flow openings in floors and ceilings, and mechanical ventilation connections), fire properties (fire size and species production rates as a function of time), and specifications for detectors, sprinklers, and targets (position, size, heat transfer characteristics, and flow characteristics for sprinklers). Materials are defined by their thermal conductivity, specific heat, density, thickness, and burning behavior.

The outputs of CFAST are the sensible variables that are needed for assessing the environment in a building subjected to a fire. These include temperatures of the upper and lower gas layers within each compartment, the ceiling/wall/floor temperatures within each compartment, the visible smoke and gas species concentrations within each layer, target temperatures and sprinkler activation time.

Many of the outputs from the CFAST model are relatively insensitive to uncertainty in the inputs for a broad range of scenarios. However, the more precisely the scenario is defined, the more accurate the results will be. Not surprisingly, the HRR is the most important variable, because it provides the driving force for fire-driven flows. Other variables related to compartment geometry such as compartment height or vent sizes, while important for the model results, are typically more easily defined for specific design scenarios than fire related inputs.

The model can accommodate 30 compartments with multiple openings between the compartments. A fire plume represents the movement of energy and mass between the lower layer and upper layer. Mass and energy can also be exchanged between the layers at the vents.

Exchange between the layers resulting from wall flows is not modeled in CFAST.

CFAST Version 6.0.10 is verified and validated in NUREG 1824 Vol. 5, "Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications Volume 5:

Consolidated Fire Growth and Smoke Transport Model (CFAST)". Version 6.0.10 was used for this fire model. NUREG 1824 Vol. 5 was reviewed and this application of the fire model was determined to be bounded by the scope of the verification and validation.

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 9 of 20 A3.2.6.2 Fire Model Inputs The target cabinets and adjacent cabinets were modeled as compartments within a larger compartment representing the entire MCR. Each target cabinet was modeled as an individual compartment and the adjacent cabinets were modeled based on a best approximation of the cabinet layouts. Since CFAST can only model rectangular compartments, the angled cabinets, CP005 and CP006, were modeled as a series of staggered rectangular compartments with their inner faces open to each other. While there are numerous other smaller cabinets and furniture in the MCR, they do not significantly change the overall volume of the MCR compartment.

The model maintained the full volume of the room as best as possible given this approximation. The dimensions of each compartment were determined by plant drawings and the combustible loading calculation. The Shift Manager's office and the smaller cabinets around the main area of the MCR were not included as separate compartments in the model.

The drop ceiling was also not included in the model because it is constructed from noncombustible material and is open to the area above, so it provides negligible resistance to the flow of heat and air that pass through it.

The walls of the MCR were modeled as 6-inch concrete and the walls of the cabinets were modeled as 1/8-inch plain carbon steel. Heat conduction between the vertical walls of all connected compartments that represent specific cabinets was included in the model.

The bench board ventilation filters and the openings between cabinets were modeled as natural horizontal vents. The bench board ventilation filters were modeled as a single centered vent at the front of each compartment.

The mechanical venting of the MCR that is driven through the cabinets is identified as 12,120 cubic feet per minute. The supply vent for this flow was modeled as a single 36-inch by 28-inch opening placed at the midpoint of the MCR wall. The vent size is consistent with the MCR supply duct size. The exhaust vents in the cabinets were modeled as the 12-inch diameter ducts typical to the cabinets. The flow through the exhaust vents was proportioned to each compartment based on the number of cabinets the compartment represents. The ventilation flow losses that were not accounted for by modeling a single supply vent are assumed to be bounded by the fact that only the flow through the cabinets was modeled. The default CFAST fan curve properties were used for the mechanical venting. The effect of these properties was judged to be non-impacting because no significant pressure is expected to develop in the cabinets due to the exhaust ducts.

The fire was modeled as a 3-foot cube centered on the floor of CPOO with the HRR properties discussed in Section A3.2.4. A 3-foot cube was used to bound all of the combustible material within a cabinet; however, since the HRR for the fire is specified the fire size has very little impact on the model results. The possible ignition of secondary combustibles around CPOO I (carpet, procedure notebooks, etc.) was assumed not to occur.

The default CFAST properties for ambient conditions were used for the initialization of the model. The model was run with a simulation time of 6,000 seconds so that the results could be

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 10 of 20 overlaid with the relevant events of limiting event discussed in Section A2.3 of Attachment 2 to Enclosure 1.

A3.2.6.3 Model Uncertainty and Sensitivity Due to the idealizations of fire phenomena within fire models like CFAST, the fire models are susceptible to model uncertainty. The quantification of model uncertainty is determined during the process of verification and validation which was performed for CFAST in NUREG 1824 Vol. 5. Section 4 of NUREG 1934 documents the verification and validation results of NUREG 1824 Vol. 5 and provides a methodology for analysis of the model uncertainty.

The methodology for analyzing model uncertainty in NUREG 1934 calculates the probability of a target being subjected to conditions that meet or exceed its acceptance criteria given the inherent uncertainty of the fire model. This process involves assuming that the expected fire scenario conditions are normally distributed about the model predictions with a standard deviation determined during the verification and validation of the fire model. Table 4-1 of NUREG 1934 documents that CFAST over-predicts the hot gas layer temperature rise by 6%

on average and under-predicts the total heat flux by 19% on average with relative standard deviations of 12% and 47% respectively. The following parameters and equations were used.

T - Actual hot gas layer temperature rise Tc - Acceptance criteria for the hot gas layer temperature rise TM - Predicted hot gas layer temperature rise from the CFAST fire model F - Actual total heat flux Fc - Acceptance criteria for the total heat flux FM - Predicted total heat flux from the CFAST fire model erfco - Complimentary error function ei7)-)

P(F>,T) =

2erfc o1(F T ,

AF>,o): errf t .4>< ><-V0-.

The CFAST fire model is sensitive to uncertainty in the inputs described in Section A3.2.6.2.

Uncertainty in the input parameters is propagated through the calculations performed during the fire model. Section 4.0 of NUREG 1934 provides a methodology to calculate the sensitivity of the fire model results to variance in the input parameters. This methodology involves calculation of the required change in an input parameter to cause failure conditions for

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 11 of 20 a target. This calculation is applicable for cases where the model prediction is close to the acceptance criteria and significant variance of input parameters is expected. For this fire model the design inputs were determined through documentation and drawings with the exception of the HRR which used the most conservative applicable HRR value. In addition, the results in Section A3.4 indicate that targets were subjected to conditions either far above or far below their acceptance criteria. For these reasons, a sensitivity calculation for the model results was not determined to be applicable.

A3.3 Assumptions

1. Due to the configuration of the MCR cabinets, fire propagation between cabinets was assumed not to occur.

2. The ventilation flow losses that were not accounted for by modeling a single supply vent are assumed to be bounded by the fact that only the flow through the cabinets was modeled.

3. The possible ignition of secondary combustibles around CP001 (carpet, procedure notebooks, etc.) was assumed not to occur.

A3.4 Results The acceptance criteria for the targets identified in Table A3.1 are given in terms of temperature and heat flux and are repeated below. Therefore, the relevant CFAST outputs are the temperatures of the upper and lower gas layers as well as the ambient heat flux within each compartment.

Table A3.1: Cable Acceptance Criteria I Cable Type Radiant Heating Criteria Temperature Criteria Thermoset 11 kW/m2 (1.0 BTU/ft-s) 330°C (625°F)

A3.4.1 Fire Originating in CP001 Preliminary fire modeling indicated that a fire originating in CP0O0 creates the bounding fire scenario for affecting CPOO1, CP004, and CPO 10. A fire in CPO01 causes greater upper and lower layer temperatures and ambient heat fluxes because CPOOI does not have the inter-compartment openings that provide natural ventilation between compartments. Since the targets are assumed to be present throughout the compartments represented by cabinets CP00 1, CP004, and CPO 10, the interface height between the upper and lower gas layers does not affect the analysis. Despite this, no upper gas layer of significant thickness formed in any compartment except the compartment of fire origin, CPOOI. This suggests that for fires originating in isolated cabinets, the ventilation in

Attachment 3 Enclosure 1 NOC-AE- 13002962 Page 12 of 20 the MCR and the cabinets is sufficient to preclude hot gas layer formation with the exception of the compartment where the fire originates. The results for CP0O1, CP004, and CP0 10 are shown in Figures A3.3 through A3.5.

Figure A3.3 - CP001 Results CPO01 1600 50.00 1400 40.00

? 1200 E 30.00 j 800 a600 20.00 _

E 400 10.00

..y. - ~ -~*

200 2 3 4 1 6 0 I0 20 30 40 60 50 70 80 90 100 Time (min)

- Upper Layer Temperature ....... Lower Layer Temperature

- - " Temperature Acceptance Criteria - - Ambient Heat Flux

- - Heat Flux Acceptance Criteria

Attachment 3 Enclosure I NOC-AE- 13002962 Page 13 of 20 Figure A3.4 - CP004 Results CPO04 700 12.00 700 12.00 600 600 10.00 E 10.00 Soo 500 E 8.00 400 6.00 300 X 3

E 200 4.00 x

'U 300 200 I-- 2.00

-'1--

100 100 2.00 0 50--

---

7 80 0 00.000 0 10 20 30 40 50 60 70 80 90 100 Tlme (min)

Upper Layer Temperature ....... Lower Layer Temperature 1 Temperature Acceptance Criteria - - Ambient Heat Flux

- -Heat Flux Acceptance Criteria Figure A3.5 - CP010 Results CPo1o 700 12.00 600 t:500 I 10.00 8.00 E 400 6.00 300 ILL E 4.00

. 200 100 2.00 0 0.00 0 20 40 60 80 100 Time (min)

Upper Layer Temperature Lower Layer Temperature S. . Temperature Acceptance Criteria - - Ambient Heat Flux

- -Heat Flux Acceptance Criteria

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 14 of 20 As shown in Figure A3.3, the temperature and heat flux within CPOO far exceed the acceptance criteria identified in Table A3.1. This result is expected because the fire originates within CPOO1.

As shown in Figures A3.4 and A3.5, the temperatures and heat fluxes within CP004 and CP010 increase only marginally above the ambient conditions. The distance of CP004 and CPO 10 from CPOO as well as the forced ventilation through the cabinets prevents any significant heat transfer to these cabinets. The results of the calculations of the probability of failure of targets are shown in Table A3.2.

Table A3.2: Model Uncertainty Compartment Quantity Maximum Acceptance Probability of Exceeding Value Criteria Acceptance Criteria Temperature 1,368.9 IF 625 OF 1.000 CP001 Heat Flux 40.15 kW/m 2 11 kW/m 2 1.000 Temperature 93.8 OF 625 OF 0.000 CP004 Heat Flux 0.23 kW/m 2 11 kW/m 2 0.047 CP010 Temperature 80.0 OF 625 IF 0.000 Heat Flux 0.10 kW/m2 11 kW/m2 0.044 As shown in Table A3.2 there is no probability that the acceptance criteria for temperature will be reached in CP004 and CPO10; however, there is a small probability of exceeding the acceptance criteria for heat flux. The non-zero probability for heat flux is a consequence of the fact that the CFAST model generally under-predicts the magnitude of heat flux and that the validation has determined that variance of predicted results about a mean value is very large for heat flux values calculated in CFAST. The implications of the heat flux probabilities are tempered by the fact that even the ambient heat flux of 0 kW/m 2 yields a 0.042 probability of exceeding the acceptance criteria. The model uncertainty calculations above indicate that even under consideration of model uncertainty the results of the fire model may be accepted as conclusive.

Some of the targets of concern have cables that are routed through the tops of cabinets and through the ceiling of the MCR in risers. Since the exhaust ventilation and natural ventilation due to small openings such as the cracks below doors were not modeled for the MCR, the results for the MCR temperatures are very conservative. Even with this conservatism the maximum layer temperature of 172.2 IF and maximum ambient heat flux of 0.37 kW/m 2 are well below the acceptance criteria identified in Table A3. 1. Furthermore, these values represent the hottest location in the MCR which will be directly adjacent to the ignited cabinet, CPOO1. The majority of the MCR is expected to remain near ambient conditions and no hot gas layer is expected to form as predicted in the fire model.

Attaclhnent 3 Enclosure 1 NOC-AE- 13002962 Page 15 of 20 A3.4.2 Fire Originating in CP004 Section A3.4.1 describes the bounding cabinet fire scenario; however, a fire originating in CP004 is instructive for analysis of potential fire and smoke propagation through the series of cabinets that connect CP004 to CPO 10. The results for this fire scenario are shown in Figures A3.6 and A3.7.

Figure A3.6 - CP004 Results CPO04 800 12.00 700 a, 600 10.00 E

" 500 8.00 S400 6.00

• . 300 .2 4.00 200 100 2.00 0 0.00 0 10 20 30 40 50 60 70 80 90 100 Time (min)

-Upper Layer Temperature ....... Lower Layer Temperature

. Temperature Acceptance Criteria - - - - Ambient Heat Flux

- - Heat Flux Acceptance Criteria

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 16 of 20 Figure A3.7 - CP005 Results CPO05 800 12.00 7~ 10.00 ;q o600 E 400 6.00

~4.00 200 I- *..,................- 2.00

• 0 10 20 30 40 50 60 70 80 90 100 Time (min)

Upper Layer Temperature ..... Lower Layer Temperature

• Temperature Acceptance Criteria ---- Ambient Heat Flux

- -Heat Flux Acceptance Criteria As shown in Figure A3.6, the temperature in CP004 exceeds the acceptance criteria identified in Table A3.1 although the heat flux does not exceed the acceptance criteria. Comparison of Figure A3.6 to Figure A3.3 shows how the lack of an opening into another cabinet causes significantly greater temperatures and heat fluxes within the cabinet. Figure A3.7 shows that the conditions in the adjacent cabinet, CP005, do not exceed the acceptance criteria for either temperature or heat flux. Consequently, cabinets adjacent to the fire origination cabinet are not expected to ignite as secondary combustibles that would propagate a fire.

Smoke propagation through the cabinets connecting CP004 to CPO10 is also a concern as smoke, represented by the upper layer of the CFAST model, may cause soot deposition in the controls and associated cabling of concern. Figure A3.8 shows the gas layer interface height in each of the connected series of cabinets as well as in CPOO.

Attachment 3 Enclosure 1 NOC-AE-13002962 Page 17 of 20 Figure A3.8 - Cabinet Gas Layer Interface Height Layer Height 12 10 8

Z' 6

4 2

0 0 10 20 30 40 50 60 70 80 90 100 Time (min)

- CPO04 ....... CPOO5 --. CPO06 - - CPOO7-CP009 -. ' CP010 .... CPO01 As shown in Figure A3.8, the depth of the smoke layer decreases as it progresses from CP004 to CPO0O and no smoke layer forms in CPOIO. In addition, no smoke layer forms in CPOOI; therefore, no soot deposition is expected in CPOO and CP010 due to a fire originating in CP004.

These results are reflective of fire testing documented in NUREG 4527, "An Experimental Investigation of Internally Ignited Fire in Nuclear Power Plant Control Cabinets: Part I Cabinet Effects Test", for similar cabinet configurations.

Due to the similarity of fire scenarios where the fire originates in either CP004 or CPOlO, the same conclusions about fire propagation and smoke propagation may be applied to a fire originating in CP010.

A3.5 Conclusion It is reasonable to conclude that the limiting event described in Section A2.3 of Attachment 2 to will not occur. The results of the CFAST fire model show that a fire initiating in one main control room control panel will not propagate to affect both the pressurizer PORV controls and the offsite power breaker controls or both the pressurizer PORV controls and the SI system controls. The bounding fire scenario was determined to be a fire that originates in the SI system cabinet, CPOO, and does not propagate outward from it. The fire is of sufficient severity to fail the target controls and associated cables within CPOOI, but the conditions that the pressurizer PORV cabinet, CP004, and the

Attachment 3 Enclosure 1 NOC-AE-1 3002962 Page 18 of 20 offsite power breaker cabinet, CPO 10, are subjected to during the fire scenario are only marginally above ambient conditions. Furthermore, analysis of the model uncertainty indicates that the results may be accepted as conclusive. The fire scenario created by a fire originating in CPOOI was determined to bound fire scenarios where the fire originates in CP004 or CPO 10.

Figures A3.9 and A3.10 show the temperatures and heat fluxes in CPOO1, CP004, and CP010 overlaid with the relevant events of limiting event discussed in Section A2.3 of Attaclhnent 2 to Enclosure 1.

Figure A3.9 - CP001, CP004, and CP010 Temperatures 1600 1400 r{"RaorTrip,OOP, PORV pens 1200 Pressurizer Level < 100%

1000 Sl Signal 800

0. - - - - - - - -

E 600 - - -

400 200 _V___ . PORV Bloc___k Valve Closed I -_._,..

0 10 20 30 40 50 60 70 80 90 100 Time (min)

- CP001 -*ee CP004 - --- CP010 - - Acceptance Criteria

Attachment 3 Enclosure I NOC-AE- 13002962 Page 19 of 20 Figure A3.10 - CP001, CP004, and CP010 Heat Fluxes 45.00 ReactorTrip, LOOP, PORV Opens 40.00 35.00 30.00 0 .0 Pressurizer Level < 100% "-

25.00 x 20.00 * * *

• i*_**PORV Block Valve Closed 1 U-15.00 10.00 5.00 0.00 0 10 20 30 40 50 60 70 80 90 100 Time (min)

-CPO01

• CPO04 -- -- CP010 - - Acceptance Criteria Figures A3.9 and A3.10 illustrate that failure of the SI system controls in CPOO1 occurs significantly after the corresponding thermal-hydraulic events discussed in Section A2.3 of Attachment 2 to . In addition Figures A3.9 and A3. 10 show that the LOOP and spurious PORV operation are not expected to occur due to CPO 10 and CP004 reaching their acceptance criteria.

Other insights that were determined from the walk down and fire model include the following.

" The MCR is continously manned and equipped with automatic detection and manual suppression. The development of a fire scenario such as the one that was modeled without operator response was judged to be implausible.

" Robust separation between each safety-related train as well as non-safety related controls and associated cabling exists within the MCR cabinets. Fires that propagate so that they damage all available trains of a system were judged to be unlikely.

• The separation between the safety-related trains of SI system controls and PORV controls is sufficient to prevent a fire that originates in one of the control elements from damaging multiple safety-related trains. This is due to the low energy nature of fires that could originate from control elements and the lack of intervening combustible materials between safety-related trains. This is only applicable to a fire originating at the switch or exposed cable. A fire originating from transient combustibles in the panel walkway could potentially affect the other safety-related trains for SI system controls or PORV controls.

Attachment 3 Enclosure I NOC-AE-13002962 Page 20 of 20 The access to the panel walkways and any introduction of transient materials is carefully controlled by the control room staff.

• For a fire originating in an isolated cabinet, such as CPOOl, the ventilation in the MCR and the cabinets is sufficient to preclude the formation of a hot gas layer in any location other than the cabinet where the fire originates.

• For a fire originating in the series of cabinets from CP004 to CPO 10, the fire will not cause conditions such that the adjacent cabinets are ignited as secondary combustibles. In addition, smoke will not propagate to the opposite end of the series of connected cabinets or into CPOO1. This conclusion is consistent with the fire testing documented in NUREG 4527 for similar cabinet configurations.

• A fire that originates within a cabinet will not cause conditions in the MCR that will damage thermoset cabling that exists outside of the cabinets.

Enclosure 2 NOC-AE-13002962 Enclosure 2 Proposed Change to South Texas Project, Unit 1, Operating License No. NPF-76 (One Page)

SOUTH TEXAS LICENSE (4) The facility has been granted a schedular exemption from Section 50.71(e)(3)(i) of 10 CFR 50 to extend the date for submittal of the updated Final Safety Analysis Report to no later than one year after the date of issuance of a low power license for the South Texas Project, Unit 2. This exemption is effective until August 1990. The staffs environmental assessment was published on December 16, 1987 (52 FR 47805).

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 55 and the Fire Hazards Analysis Report through Amendment No. 4-9xx, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

F. Physical Security STPNOC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans previously approved by the Commission and all amendments and revisions to such plans made pursuant to the authority under 10 CFR 50.90 and 10 CFR 50.54(p).

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "South Texas Project Electric Generating Station Security, Training and Qualification, and Safeguards Contingency Plan, Revision 2" submitted by letters dated May 17 and 18, 2006.

STPNOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). STPNOC CSP was approved by License Amendment 197.

G. Not Used H. Financial Protection The Owners shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

Amendment No. xx

Enclosure 3 NOC-AE-13002962 Enclosure 3 Proposed Change to South Texas Project, Unit 2, Operating License No. NPF-80 (One Page)

(2) The facility was previously granted exemption from the criticality monitoring requirements of 10 CFR 70.24 (See Materials License No. SNM-1983 dated August 30, 1988 and Section III.E. of the SER dated August 30, 1988). The South Texas Project Unit 2 is hereby exempted from the criticality monitoring provisions of 10 CFR 70.24 as applied to fuel assemblies held under this license.

(3) The facility requires a temporary exemption from the scheduler requirements of the decormnissioning planning rule, 10 CFR 50.33(k) and 10 CFR 50.75. The justification for this exemption is contained in Section 22.2 of Supplement 6 to the Safety Evaluation Report. The staffs environmental assessment was published on December 16, 1988 (53 FR 50604). Therefore, pursuant to 10 CFR 50.12(a)(1), 50.12(a)(2)(ii) and 50.12(a)(2)(v), the South Texas Project, Unit 2 is hereby granted a temporary exemption from the schedular requirements of 10 CFR 50.33(k) and 10 CFR 50.75 and is required to submit the decommissioning plan for both South Texas Project, Units 1 and 2 on or before July 26, 1990.

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 62 and the Fire Hazards Analysis Report through Amendment No. 4-9xx, and submittals dated April 29, May 7, 8 and 29, June 11, 25, and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provisions:

STPNOC may make changes to the approved fire protection program without prior approval of the Conmmission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

F. Physical Security The licensee shall fully implement and maintain in effect all provisions of tie Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "South Texas Project Electric Generating Station Security, Training and Qualification, and Safeguards Contingency Plan, Revision 2" submitted by letters dated May 17 and 18, 2006.

STPNOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). STPNOC CSP was approved by License Amendment 185.

Amendment No. xx

Enclosure 4 NOC-AE-13002962 Enclosure 4 Annotated Fire Hazards Analysis Report Pages Page 2-2 (no changes)

Page 2-3 Page 2-10 Page 3.2-6 Page 3.2-7 Page 4-17

Enclosure 4 NOC-AE-13002962 Page 1 of 6 No changes this page STP FHAR o Provide reactor coolant system makeup and letdown capability to maintain reactor coolant inventory o Maintain reactor coolant pressure and temperature control o Provide decay heat removal capability The following systems or portions thereof are required to provide the functional requirements listed above for both hot standby and cold shutdown:

o Reactor coolant system o Auxiliary feedwater system o Main steam system (between steam generators and MSIVs) o Feedwater system (between steam generator and FIVs) o Steam generator blowdown system (Between steam generators and containment isolation valves) o Residual heat removal system o Chemical and volume control system o Various instrumentation and control systems The following support systems are also required to function:

o Component cooling water system o Essential cooling water system o Onsite power systems o Heating, ventilating, and air conditioning systems including essential chilled water 2.3 SAFE-SHUTDOWN ANALYSIS GUIDELINES 2.3.1 General Guidelines The guidelines concerning the nature of the fire and plant conditions prior to and during the fire are as follows:

2-2 Amendment 20

Enclosure 4 NOC-AE-13002962 Page 2 of 6 STP FHAR o All plant operating modes, except refueling, were evaluated. However, post-fire safe shutdown from 100% power is the most limiting case and was used in determining required operator actions.

o Plant accidents unrelated to the fire are not postulated concurrently with the fire and subsequent plant shutdown.

o The fire is assumed concurrent with or without a loss of offsite power. Required operator actions werf*e deter.mn are based on a lcPs of effsite powe the most limitin.

case.

o When a loss of offsite power is assumed concurrent with a fire that results in control room evacuation, the loss of offsite power is assumed to occur coincident with the manual reactor trip.

o When offsite power is available, all equipment NOT affected by the fire remains in its pre-fire condition. If the fire involves the BOP diesel or the instrument air compressor powered from the BOP diesel, and offsite power is lost, then all equipment served by that air compressor goes to its loss of air condition.

o The BOP and TSC diesels and their respective electrical distribution systems are available if not damaged by the fire.

o Credit may be taken for non-safety related components where the fire has not damaged their ability to function.

o Simultaneous fires are not assumed to occur in separate fire areas.

o Single failures are not considered concurrent with a fire.

o Only systems and components which can affect safe shutdown are subject to evaluation.

o Prior to the fire event, all three ESF electrical trains are available except in modes 5 and 6.

o Credit is taken for manual operator action.

o When a reactor trip is a required operator action, the reactor is assumed to be tripped from the control room.

2.3.2 Specific Guidelines for the Appendix R,Section III.G Evaluation All the guidelines of Section 2.3.1 are valid in this analysis in addition to the following:

2-3 Amendment xx

Enclosure 4 NOC-AE-13002962 Page 3 of 6 STP FHAR 2.4.4 Alternate Shutdown Capability Alternate shutdown capability is provided to respond to a large fire occurring within the main control room. Following e from the control room the transfer of control from the control room to the auxiliary shutdown panel and local control stations is accomplished from outside the control room using transfer switches which are predominately located in the three redundant switchgear rooms. The remaining transfer switches are on the auxiliary shutdown panel in the train related diesel generator rooms and at the Essential Cooling Water Intake Structure ventilation fan MCCs. When transferred, these circuits are independent of the control room. Safe shutdown from outside the control room is discussed in FSAR Section 7.4.1.9.

If a loss of offsite power occurs, all three Class I E standby diesel generators receive an automatic start signal. No single control circuit failure due to a control room fire can disable all standby diesel generators. The sequencer circuits for the standby diesel generators are on separate paths outside the control room. The sequencers are located within their own fire area separated from the control room fire area. When control of a standby diesel generator is transferred to the local control station, the diesel will remain operating. Only one standby diesel generator is required to achieve safe shutdown. HI Uredit is givenl to the ollown11 perations in the control roumitTh meet the recluireiiients of AppendLx R' Section'II.L. :OPerators taking action to:

• Trip the reactor 0 Initiate main steam isolation

• lose the pressurizer power-operatedrehlief valves.6POkV) blockwalves" Cl

• Sectirall reactor coolant u1irn ps

. Close feedwater isolation valves A Secure the staitup fecNaterpump-I l solate °reactor coolant ,systemr etdown 1_Secure the eentrifugal charaing pumps Inaddition, redit*is:taken for an, automatic tirbine trip i responsejto the. reactoripe STP Safe Shutdown Compliance Analysis, Calculation 5A11MC6023 2-10 Amendment xx

Enclosure 4 NOC-AE-13002962 Page 4 of 6 STP FHAR (Fire Zone Z032). Alternate shutdown capability is provided by the auxiliary shutdown stations, including the auxiliary shutdown panel, which are located in separate fire areas from the Control Room. Transfer switches are also located in separate fire areas. This precluded the need to provide separation for Trains A, B, C and D in the Control Room and Relay Cabinet Area.

D. Redundant Safe Shutdown Assessment In the event of a Control Room or Relay Room fire, cold shutdown can be achieved and maintained from the auxiliary shutdown panel, transfer switch panels or other local control stations and MCCs.

However, before control room evacuation, operator action should be taken from the control room to trip the reactor, secure the reactor coolant pumps, the startup feedwater pump, and CVCS charging pumps, and close the pressurizer PORV block valves, the reactor coolant system letdown isolation valves, MSIV, and MSX .bypassFWIV valves. With the exception of tripping the reactor and securing the startup feedwater pump , the above actions may be perfor.med from an alterate shutdown lceati.n if they eaff..t be c.mplete.

pri.r. t. .vaeu.atingthe

.. ntr.l roem are backed up outside the control room with alternative circuits by transferring control to local control stations.

E. Conclusions The loss of all circuits and equipment in Fire Area 1 is acceptable as safe shutdown functions can be controlled from the auxiliary shutdown stations which are in separate fire areas.

Circuits necessary to shutdown from the auxiliary shutdown locations would remain free of fire damage.

F. Deviations from BTP APCSB 9.5-1 Appendix A and/or IOCFR50 Appendix R with Respective Justifications

1. Appendix A:F.2 Deviation Cables located above a suspended ceiling.

Justification See FHAR 4.2, Comparison to Appendix A of APCSB 9.5-1, Section F.2

2. Appendix A:F.2 and Appendix R:III.G.3 Deviation No fixed suppression in the control room complex.

3.2-6 Amendment xx

Enclosure 4 NOC-AE-13002962 Page 5 of 6 STP FHAR Justification See FHAR 4.2, Comparison to Appendix A of APCSB 9.5-1, Section F.2, FHAR 4.1, Comparison to IOCFR50 Appendix R,Section III.G, and FHAR pages 3.2-5 and 3.10-1.

3. Appendix A: F.2 Deviation Control room is not separated from the relay room and watch supervisor's office by 3-hour barriers.

Justification See FHAR 4.2, Comparison to Appendix A of APCSB 9.5-1, Section F.2 and Fire Area 1, Section 3.2.

4. Appendix A: D.1.J Deviation Unlabeled doors in Fire Area boundaries.

Justification See FHAR 4.2, Comparison to Appendix A of APCSB 9.5-1, Section D. 1.j.

5. Appendix A: D.l.d Deviation The control room Z034 contains a frame utilized to display current control room staffing which is constructed of untreated wood.

Justification The frame does not significantly add to the combustible loading of the zone.

'6. Appendix A: III.G.3 Deviation In addition to reactor trip, additional operations are performed in the control room prior to transferring control to the auxiliary shutdown panel and other points of control for meeting the alternate shutdown capability. These operations are discussed in Section 2.4.4.

Justification License Amendment No. xx for Unit 1 and License Amendment No. xx for Unit 2.

3.2-7 Amendment xx

4.1 COMPARISON OF STP UNITS WITH REQUIREMENTS OF APPENDIX R APPENDIX R REOUIREMENTS STP POSITION III.G. (Cont'd) III.G. (Cont'd)

3. Alternative or dedicated shutdown capability and its 3. Alternate shutdown capability for all three trains is associated circuits, 2 independent of cables, systems provided outside the control room fire area to or components in the area, room or zone under respond to a large control room fire. Following consideration, shall be provided: operationsf performedm theco-n-trol room describedi Sectinn 2.4.4reac,,,rip idm th,

a. Where the protection of systems whose function Ik e,,m, the transfer of control to the auxiliary is required for hot shutdown does not satisfy the shutdown panel and other points of control is requirement of paragraph G.2 of this section; or accomplished from outside the control room fire area. These circuits when transferred are

b. Where redundant trains of systems required for independent of the control room fire area.

hot shutdown located in the same fire area may Hn be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. A fixed fire suppression system has not been provided throughout the control room. A detailed In addition, fire detection and a fixed fire suppression justification for this deviation is presented in Section system shall be installed in the area, room, or zone under 3.10. The control room is continuously occupied consideration. and is provided with portable fire extinguishers inside the control room and fire hose stations near the entrances. Fire detection is provided in the control room and the relay portion of the control room is provided with an automatic Halon suppression system. z' 2 Alternate shutdown capability is provided by rerouting, relocating or modificating of existing systems; dedicated shutdown capability is provided by installing new structures and systems for the function of post-fire shutdown. IQ

Enclosure 5 NOC-AE-13002962 Enclosure 5 List of Commitments

Enclosure 5 NOC-AE-13002962 Page 1 of 1 List of Commitments The following table identifies those actions committed to by STPNOC in this document. Any statements in this document with the exception of those in the table below are provided for information purposes and are not considered commitments. Please direct questions regarding these commitments to Ken Taplett at (361) 972-8416.

Commitment Scheduled Completion Date The STP FHAR will be revised to include the changes provided Within 45 days of in Enclosure 4 to the License Amendment Request. Reference is Amendment approval.

NOC-AE- 13002962.

I CR 08-1057-39