ML14339A170

Issuance of Amendment Nos. 203 and 191, Revise Fire Hazards Analysis Report and Fire Protection Program License Conditions Related to Alternate Shutdown Capability

ML14339A170
Person / Time
Site:	South Texas
Issue date:	02/13/2015
From:	Lisa Regner Plant Licensing Branch IV
To:	Koehl D South Texas
Regner L
References
TAC MF2477, TAC MF2478
Download: ML14339A170 (35)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 February 13, 2015 Mr. Dennis L. Koehl President and CEO/CNO STP Nuclear Operating Company South Texas Project P.O. Box 289 Wadsworth, TX 77483

SUBJECT:

SOUTH TEXAS PROJECT, UNITS 1 AND 2 - ISSUANCE OF AMENDMENTS RE: APPROVAL OF REVISED FIRE PROTECTION PROGRAM RELATED TO ALTERNATIVE SHUTDOWN CAPABILITY (TAC NOS. MF2477 AND MF2478)

Dear Mr. Koehl:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 203 to Facility Operating License No. NPF-76 and Amendment No. 191 to Facility Operating License No. NPF-80 for the South Texas Project (STP), Units 1 and 2, respectively. The amendments consist of changes to the Fire Hazard Analysis Report (FHAR) incorporated in the STP, Units 1 and 2, Updated Final Safety Analysis Report by reference in response to your application dated July 23, 2013, as supplemented by letters dated May 12 (two letters), May 19, and December 17, 2014.

The amendments revise the STP, Units 1 and 2, Fire Protection Program (FPP) described in the FHAR related to the alternate shutdown capability in accordance with license condition 2.E of the facility operating licenses. Specifically, the amendments approve crediting additional operator actions in the main control room prior to evacuation due to a fire for meeting the alternate shutdown capability, in addition to manually tripping the reactor presently credited in the FPP.

D. Koehl A copy of our related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, odur-"

Lisa M. Regner, Senior Project Manager Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-498 and 50-499

Enclosures:

1. Amendment No. 203 to NPF-76

2. Amendment No. 191 to NPF-80

3. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 STP NUCLEAR OPERATING COMPANY DOCKET NO. 50-498 SOUTH TEXAS PROJECT, UNIT 1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 203 License No. NPF-76

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by STP Nuclear Operating Company (STPNOC)*

acting on behalf of itself and for NRG South Texas LP, the City Public Service Board of San Antonio (CPS), and the City of Austin, Texas (COA) (the licensees}, dated July 23, 2013, as supplemented by letters dated May 12 (two letters), May 19, and December 17, 2014, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this license amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• STPNOC is authorized to act for NRG South Texas LP, the City Public Service Board of San Antonio, and the City of Austin, Texas, and has exclusive responsibility and control over the physical construction, operation, and maintenance of the facility.

Enclosure 1

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and Paragraph 2.E of the Facility Operating License No. NPF-76 is hereby amended to read as follows:

STPNOC shall implement and maintain in effect all provisions of the approved fire protection program in the Final Safety Analysis Report through Amendment No. 55 and the Fire Hazard Analysis Report through Amendment No. 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; July 23, 2013; May 12 (two letters), May 19, and December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

3. The license amendment is effective as of its date of issuance and shall be implemented within 45 days from the date of issuance. In addition, the license shall include the revised information in the Fire Hazard Analysis Report submitted to the NRC, pursuant to 10 CFR 50.71(e), as described in the licensee's application dated July 27, 2013, as supplemented by letters dated May 12 (two letters), May 19, and December 17, 2014, and evaluated in the staff's safety evaluation for this amendment.

FOR THE NUCLEAR REGULATORY COMMISSION Eric R. Oesterle, Acting Chief Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Facility Operating License No. NPF-76 and the Technical Specifications Date of Issuance: February 13, 2015

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 STP NUCLEAR OPERATING COMPANY DOCKET NO. 50-499 SOUTH TEXAS PROJECT. UNIT 2 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 191 License No. NPF-80

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by STP Nuclear Operating Company (STPNOC)*

acting on behalf of itself and for NRG South Texas LP, the City Public Service Board of San Antonio (CPS}, and the City of Austin. Texas (COA) (the licensees), dated July 23, 2013, as supplemented by letters dated May 12 (two letters), May 19, and December 17, 2014, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act}, and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this license amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• STPNOC is authorized to act for NRG South Texas LP, the City Public Service Board of San Antonio, and the City of Austin, Texas, and has exclusive responsibility and control over the physical construction, operation, and maintenance of the facility.

Enclosure 2

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and Paragraph 2.E of the Facility Operating License No. NPF-80 is hereby amended to read as follows:

STPNOC shall implement and maintain in effect all provisions of the approved fire protection program in the Final Safety Analysis Report through Amendment No. 62 and the Fire Hazard Analysis Report through Amendment No. 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25, and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; July 23, 2013; May 12 (two letters), May 19, and December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

3. The license amendment is effective as of its date of issuance and shall be implemented within 45 days from the date of issuance. In addition, the license shall include the revised information in the Fire Hazard Analysis Report submitted to the NRC, pursuant to 10 CFR 50.71(e), as described in the licensee's application dated July 27, 2013, as supplemented by letters dated May 12 (two letters), May 19, and December 17, 2014, and evaluated in the staff's safety evaluation for this amendment.

FOR THE NUCLEAR REGULA TORY COMMISSION Eric R. Oesterle, Acting Chief Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Facility Operating License No. NPF-80 and the Technical Specifications Date of Issuance: February 13, 2015

ATTACHMENT TO LICENSE AMENDMENT NOS. 203 AND 191 FACILITY OPERATING LICENSE NOS. NPF-76 AND NPF-80 DOCKET NOS. 50-498 AND 50-499 Replace the following pages of the Facility Operating Licenses, Nos. NPF-76 and NPF-80, and Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Facility Operating License NPF-76 REMOVE INSERT 9 9 Facility Operating License NPF-80 REMOVE INSERT 8 8

SOUTH TEXAS LICENSE (4) The facility has been granted a schedular exemption from Section 50. 71 (e)(3)(i) of 10 CFR 50 to extend the date for submittal of the updated Final Safety Analysis Report to no later than one year after the date of issuance of a low power license for the South Texas Project, Unit 2.

This exemption is effective until August 1990. The staffs environmental assessment was published on December 16, 1987 (52 FR 47805).

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 55 and the Fire Hazards Analysis Report through Amendment No. 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 201 O; July 23, 2013; May 12 (two letters), May 19, and December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

F. Physical Security STPNOC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans previously approved by the Commission and all amendments and revisions to such plans made pursuant to the authority under 10 CFR 50.90 and 10 CFR 50.54(p).

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "South Texas Project Electric Generating Station Security, Training and Qualification, and Safeguards Contingency Plan, Revision 2" submitted by letters dated May 17 and 18, 2006.

STPNOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). STPNOC CSP was approved by License Amendment No. 197 and supplemented by License Amendment No. 202.

G. Not Used H. Financial Protection The Owners shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

Amendment No. 203

(2) The facility was previously granted exemption from the criticality monitoring requirements of 10 CFR 70.24 (See Materials License No.

SNM-1983 dated August 30, 1988 and Section 111.E. of the SER dated August 30, 1988). The South Texas Project Unit 2 is hereby exempted from the criticality monitoring provisions of 10 CFR 70.24 as applied to fuel assemblies held under this license.

(3) The facility requires a temporary exemption from the scheduler requirements of the decommissioning planning rule, 10 CFR 50.33(k) and 10 CFR 50. 75. The justification for this exemption is contained in Section 22.2 of Supplement 6 to the Safety Evaluation Report. The staffs environmental assessment was published on December 16, 1988 (53 FR 50604). Therefore, pursuant to 10 CFR 50.12(a)(1 ), 50.12(a)(2)(ii) and 50.12(a)(2)(v), the South Texas Project, Unit 2 is hereby granted a temporary exemption from the schedular requirements of 10 CFR 50.33(k) and 10 CFR 50.75 and is required to submit the decommissioning plan for both South Texas Project, Units 1 and 2 on or before July 26, 1990.

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 62 and the Fire Hazards Analysis Report through Amendment No. 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25, and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 201 O; July 23, 2013; May 12 (two letters), May 19, December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provisions:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

F. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "South Texas Project Electric Generating Station Security, Training and Qualification, and Safeguards Contingency Plan, Revision 2" submitted by letters dated May 17 and 18, 2006.

STPNOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). STPNOC CSP was approved by License Amendment No. 185 and supplemented by License Amendment No. 190.

Amendment No. 191

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 203 AND 191 TO FACILITY OPERATING LICENSE NOS. NPF-76 AND NPF-80 STP NUCLEAR OPERATING COMPANY, ET AL.

SOUTH TEXAS PROJECT, UNITS 1 AND 2 DOCKET NOS. 50-498 AND 50-499

1.0 INTRODUCTION

By letter dated July 23, 2013 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML13212A243), as supplemented by letters dated May 12 (two letters),

May 19, and December 17, 2014 (ADAMS Accession Nos. ML14142A015, ML14142A016, ML14149A251, and ML15008A031, respectively), STP Nuclear Operating Company (STPNOC, the licensee) requested a license amendment for the South Texas Project (STP) Units 1 and 2, to revise the Fire Protection Program (FPP) described in the Fire Hazards Analysis Report (FHAR) related to the alternate shutdown capability. Specifically, the licensee requested to credit additional operator actions in the main control room (MCR) prior to evacuation due to a fire for meeting the alternate shutdown capability, in addition to manually tripping the reactor presently credited in the FPP. The FHAR is incorporated in the STP Updated Final Safety Analysis Report (UFSAR) by reference. The amendments are supported, in part, by RETRAN and defense-in-depth (DID) analyses performed to demonstrate the efficacy of the proposed control room actions in maintaining the reactor coolant system (RCS) in a condition conforming to the requirements set forth in Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix R, "Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979," Section 111.L, "Alternative and dedicated shutdown capability" (Section 111.L).

The supplemental letters dated May 12 (two letters), May 19, and December 17, 2014, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC) staffs original proposed no significant hazards consideration determination as published in the Federal Register on October 29, 2013 (78 FR 64546).

The NRC staff determined that the licensee's amendment request demonstrated reasonable assurance of safe shutdown capability in the event of a control room fire through a combination of actions and features. The current safe shutdown compliance strategy for STP, which is documented in Section 2.4.4 of the FHAR, only credits a manual reactor trip from the MCR prior to evacuation. No automatic operations are assumed in the current STP fire safe shutdown Enclosure 3

analysis, within the fire area, unless the automatic actions adversely affect the response to the fire.

In addition to the manual reactor trip, the proposed LAR will credit the following MCR operator actions:

• Initiate main steam line isolation

• Close the pressurizer power-operated relief valves (PORV) block valves

• Secure all reactor coolant pumps (RCPs)

• Close feedwater isolation valves (FWIVs)

• Secure the startup feedwater pump (SUFP)

• Isolate RCS letdown

• Secure the centrifugal charging pumps (CCPs)

In addition, the licensee proposes to take credit for an automatic main turbine trip upon the initiation of the manual reactor trip.

Also, the licensee has stated that if the requested control room actions are not effective, the plant can be safely shutdown based on operator manual actions (OMAs) performed outside of the MCR. The OMAs were reviewed during a previous submittal (available at ADAMS Accession No. ML100780075) and were not reviewed in detail as part of this review. However, the amendments establish that the combination of all of the requested control room actions and features, provide reasonable assurance that the reactor will not reach an unrecoverable condition in the event of a control room fire and subsequent MCR evacuation.

2.0 REGULATORY EVALUATION

Pursuant to 10 CFR 50.48(a)(1 ), each holder of an operating license must have a fire protection plan that satisfies Criterion 3 of Appendix A to 10 CFR Part 50. Among other things, this fire protection plan must outline the plans for fire protection, fire detection and suppression capability, and limitation of fire damage. Also, the plan must describe specific features necessary to implement the program such as administrative controls and personnel requirements for fire prevention and manual fire suppression activities, automatic and manually operated fire detection and suppression systems; and the means to limit fire damage to structures, systems, or components important to safety so that the capability to shut down the plant safely is ensured.

The licenses for the STP units each contain a Fire Protection license condition -- License Condition 2.E. The license condition lists the documents that comprise the approved fire protection program. The licensee stated in the STP Fire Hazards Analysis Report (ADAMS package Accession No. ML123190423), that it meets 10 CFR Part 50, Appendix R, "Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979."

Section 111.L, "Alternative and dedicated shutdown capability" of Appendix R states, in part:

Alternative or dedicated shutdown capability provided for a specific fire area shall be able to (a) achieve and maintain subcritical reactivity conditions in the reactor; (b) maintain reactor coolant inventory; (c) achieve and maintain hot standby

conditions for a PWR [pressurized-water reactor] [ ]; (d) achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; and (e) maintain cold shutdown conditions thereafter.

During the postfire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal a.c. [alternating current]

power, and the fission product boundary integrity shall not be affected; i.e., there shall be no clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary.

Based upon updated thermal-hydraulic analyses, the licensee determined that certain actions within the MCR were necessary to assure that RCS process variables do not exceed the limits predicted for a loss of normal alternating current (AC) power until control is successfully transferred.

The loss of normal AC power, an anticipated operational occurrence (AOO), is described in STP UFSAR Section 15.2.6. The loss of normal AC power is deemed to be more limiting than the turbine trip event, but bounded by the loss of normal feedwater event with subsequent loss of AC power with respect to pressurizer overfill. The event description neither discusses nor addresses the acceptance criteria for an AOO (i.e., that fuel cladding damage should be precluded, that reactor coolant and main steam system pressures should remain within 110 percent of system design values, and that the AOO should not proceed to a more severe event without the occurrence of an independent fault).

The UFSAR does not include the results of a loss of AC power analysis. Consequently, the NRC staff requested and received the results of a loss of AC power analysis in a request for additional information (RAI) discussed in Section 3.3.3.4.

Unlike the UFSAR AOOs, the postfire analyses add a spurious actuation or signal, to the initiating fault, 1 prior to achieving control through the alternative or dedicated shutdown system.

This is consistent with Regulatory Position 5.4, "Alternative and Dedicated Shutdown Capability," of Regulatory Guide (RG) 1.189, Revision 2, "Fire Protection for Nuclear Power Plants," October 2009 (ADAMS Accession No. ML092580550), which states, in part:

The licensee should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system for fires in areas that require alternate or dedicated shutdown.

For each analysis, the licensee identified specific acceptance criteria relative to the event. The NRC staff explains in Section 3.0 of this safety evaluation (SE) how the licensee's specific acceptance criteria relate to the general acceptance criteria stated in Appendix R to provide adequate DID and safety margin such that the plant remains in a safe or recoverable condition at all times during and following credible fire scenarios.

1 AOOs are started by an initiating event (the so-called initiating fault), which then results in a reactor trip.

In the case of the fire analyses, the initiating event is the fire-induced manual reactor trip. There is no AOO that precedes reactor shutdown.

The following additional regulatory requirements and guidance documents were also considered to review the impact of the proposed additional operator actions:

• 10 CFR 50.120, "Training and qualification of nuclear power plant personnel."

• SRP Chapter 18, "Hum.an Factors Engineering," Revision 2, March 2007 (ADAMS Accession No. ML070670253)

• NUREG-0711, "Human Factors Engineering Program Review Model,"

Revision 3, September 2012 (ADAMS Accession No. ML12324A013).

• NUREG-1764, "Guidance for Review of Changes to Hu111an Factors," February 2004 (ADAMS Accession No. ML040770551 ).

3.0 TECHNICAL EVALUATION

Under the current licensing basis for STP, MCR evacuation relies upon alternate shutdown capability, which involves transferring control from the MCR to alternative shutdown stations and performing OMAs.

The NRC staff performed its review of the fire protection DID and safety margins using the guidance contained in SRP Section 9.5.1.1, "Fire Protection Program," February 2009 (ADAMS Accession No. ML090510170), as described in Section 3.3.1 of this SE. The SRP acceptance criteria for operating nuclear power plants, such as DID, is in RG 1.189 and reviewed in the context of the licensee's regulatory requirements.

To evaluate the human performance aspects of the requested control room actions, the NRC staff considered requirements contained in 10 CFR 50.120 and guidance contained in NUREG-0711 and NUREG-1764, as described in Section 3.3.2 of this SE. Based on the information in the LAR, this submittal was determined to be a non-risk-informed submittal. In accordance with the generic risk categories established in Appendix A to NUREG-1764, using Table A.2, Generic PWR Human Actions That Are Risk-Important, the appropriate level of human factors review was determined to require a Level II review.

The NRC staff performed its review that pertains to accident and transient analysis following, generally, the guidance contained in the sections within SRP Chapter 15, as described in Section 3.3.3 of this SE. Since the analytic methods used to perform licensing basis AOO analysis are very similar to those employed by STPNOC for the present LAR, SRP Chapter 15 was used. However, the regulatory basis for the review approach differs in that accident and transient analyses are performed to ensure that the plant conforms to the General Design Criteria contained in 10 CFR 50 Appendix A. The present review standard is based on the licensee continuing to meet License Condition 2.E, through which the licensee is required to meet certain portions of 10 CFR 50 Appendix R, as discussed in Section 2.0 of this SE.

The NRC technical evaluation examines the case where a large fire in the MCR necessitates an evacuation of the MCR. Therefore, the staff has reviewed the licensee's evaluation of performing control room actions prior to leaving the MCR to support safe shutdown. The

licensee has addressed two cases, one where actions are completed in the control room before evacuation, and another where operators are unable to complete control room actions and perform the actions outside of the control room. If the control room actions are able to be performed prior to evacuation and before important equipment is damaged, the plant parameters will meet the performance criteria contained in Appendix R, Section 111.L. If the actions are not performed, or if equipment is damaged that defeats the actions, the operators can shut the plant down from outside the control room using OMAs. If actions are performed outside of the MCR, the plant parameters are calculated to exceed the Appendix R, Section 111.L performance criteria, but the licensee has submitted an analysis that shows that the reactor will not reach an unrecoverable condition.

In order to determine the acceptability of STPNOC's LAR, the NRC staff evaluated the licensee's analyses of the following for sufficient quality, detail, and margin:

• Defense-in-depth (DID)

• Human performance reliability analysis of the proposed control room actions

• Automatic features

• Thermal-hydraulic analysis of core cooling capability, fuel cladding integrity, pressurizer and steam generator conditions, and cold shutdown capability.

The NRC staff considered the credible fire scenarios that could occur in the MCR and cause specific damage to the required safe shutdown equipment and then compared the time necessary for the limiting case to occur to the thermal-hydraulic plant response timelines following such a postulated event. In its review of the licensee's anticipated thermal-hydraulic plant response, the NRC staff considered (1) the analytical methods and computer codes used; (2) the licensee's acceptance criteria; (3) the initial conditions and values of reactor parameters used in the analyses; and (4) the analyzed spurious failures and the results of the analyses.

3.1 Proposed Changes STPNOC requested to change its analysis to perform the following actions in the MCR prior to evacuation to ensure safe shutdown capability during and following a fire in the MCR.

• Trip the reactor

• Initiate main steam isolation (single switch)

• Close both pressurizer PORV block valves (two switches)

• Trip all reactor coolant pumps (four switches)

• Initiate feedwater isolation by closing feedwater isolation valves (four switches)

• Place the startup feedwater pump switch in PULL TO LOCK (i.e., secure feedwater) (one switch)

• Isolate RCS letdown (two switches)

• Place centrifugal charging pumps switch in PULL TO LOCK (i.e., secure charging) (two switches)

The actions noted above would be performed in the MCR prior to evacuating the MCR and in addition to crediting an automatic turbine trip in response to the reactor trip. No other automatic functions are credited for this analysis. In addition, the control room actions noted above are backed up outside the MCR by transferring control to local control stations outside of the MCR.

The transfer electrically isolates the circuits in the MCR from the alternative shutdown circuits so that any circuit failures in the MCR following transfer will not impact any safe shutdown functions or result in spurious actuation of safe shutdown components. The proposed change assumes one spurious actuation occurs before control of the plant is achieved through the alternative shutdown system.

The STP FHAR will be revised to incorporate the approved changes to the FPP. License Condition 2.E of Facility Operating Licenses NPF-76 and NPF-80, as described in Section 3.5 of this SE, are also being revised to reflect the change.

3.2 Licensee's Evaluation In its LAR dated July 23, 2013, the licensee described the actions performed by the operators before evacuating the MCR, in addition to manually tripping the reactor, and provided reasons for performing the actions. Based on its analysis, the licensee concluded that:

• Sufficient fire protection DID is provided by fire protection features so that it is highly unlikely that a fire in the MCR would result in evacuation.

• The proposed control room actions performed inside the MCR prior to evacuation have been validated and demonstrated such that it is reasonable to conclude that they can be successfully performed within the time required by the thermal-hydraulic analysis.

• Thermal-hydraulic analyses demonstrate that the successful performance of the proposed control room actions in the MCR will assure that the requirements of Appendix R, Section 111.L are met.

• The proposed control room actions will not be negated by any one subsequent fire-induced spurious actuation resulting from the postulated fire that occurs after the proposed actions in the MCR are completed.

• Analyses demonstrate that the fire safe shutdown capability is maintained in the event that none of the proposed actions in the control room are successful prior to evacuation other than the manual reactor trip and automatic turbine trip.

• Based on the design of the reactor and turbine trip functions and the electrical separation between redundant features, an automatic turbine trip will be initiated

as the result of a manual reactor trip and will not subsequently be negated by a fire-induced circuit failure.

• Applying uncertainties to the nominal conditions and set points within the thermal-hydraulic analyses does not jeopardize the ability to achieve and maintain safe shutdown.

3.3 NRC Staff Evaluation The NRC staff evaluated the information provided by the licensee with regard to a scenario where a fire occurs in the MCR and causes operators to evacuate the MCR. In its review, the staff considered two cases presented by the licensee where, in one case, actions are completed in the control room before evacuation, and the other, where operators are unable to complete the control room actions and must perform the actions outside of the control room. To determine the acceptability of the licensee's request, the staff considered the likelihood of the underlying fire scenario, the DID present, and the thermal-hydraulic consequences for the two cases.

The licensee stated that the MCR is contained within Fire Area 1 located on the 35-foot elevation of the Mechanical/Electrical Auxiliary Building. In addition to Fire Zone Z034 (MCR),

Fire Area 1 also contains Fire Zones Z032 (relay cabinet area) and Z083 (watch supervisor's office). The licensee stated that the Fire Area 1 boundary is constructed of 3-hour rated fire barriers with only a few exceptions, which are 90-minute rated or better, and has its own ventilation system with smoke purge and clean-up modes.

3.3.1 Consideration of Fire Protection Defense-in-Depth The regulations in 10 CFR Part 50, Appendix R, Section II, "General Requirements," defines, in part, the concept of DID as the ability:

• To prevent fires from starting;

• To detect rapidly, control, and extinguish promptly those fires that do occur;

• To provide protection for structures, systems, and components important to safety so that a fire that is not promptly extinguished by the fire suppression activities will not prevent the safe shutdown of the plant.

In order to address these elements of DID, the licensee described the design features present in the MCR at STP that contribute to each of the DID elements noted above.

3.3.1.1 Fire Prevention The licensee addressed the element of fire prevention through the use of limited or noncombustible materials and physical separation of cabling and other ignition sources. In addition, the licensee stated that fire propagation between cabinets would be limited because

the safety-related actuation cabinets are of metal construction and separated by 2-inch air gaps to provide assurance that a fire would not affect adjacent cabinets. The licensee stated that the MCR's seismically-designed suspended ceiling and architectural barriers has a flame spread rating of 50 or less, to limit fire spread.

The licensee stated that there are limitations on combustible loading and hot work. For instance, the licensee stated that flammable liquids are not stored within the MCR boundary and in situ combustible loading is comprised primarily of thermoset instrument and control cable, located in cable trays above the suspended ceiling, that meets the Institute of Electrical and Electronic Engineers (IEEE) 383, "IEEE Standard for Qualifying Class 1E Electrical Cables and Field Splices for Nuclear Power Generation Stations," 2003, and limited, ordinary Class A combustibles. Specifically, the licensee stated that there are 38 cable trays (of which approximately 20 percent are covered) that are 40 percent filled with cables located above the suspended ceiling. The licensee also stated that there are no ignition sources above the suspended ceiling. Power cables for lighting are encased in steel conduit. Self-ignited cable fires above the suspended ceiling are not postulated due to the fire retardant and thermoset properties of the cables. In addition, the MCR is a permanently occupied area where operators are expected to monitor or prevent conditions that might result in a fire event in the MCR and intervene before such an event occurs.

Based on the above, the NRC staff concludes that STPNOC has adequately addressed the DID element of fire prevention through the use of limited combustible materials, physical separation of equipment, and operator intervention. Therefore, the staff concludes that the licensee's approach to fire prevention is acceptable.

3.3.1.2 Detection, Control, and Extinguishment The licensee addressed the element of detection, control, and extinguishment by providing ionization smoke detectors throughout the MCR, above and below the suspended ceiling, as well as in the safe shutdown control cabinets, including each main control panel. In addition, the licensee stated that the spacing of the smoke detectors is more dense than prescribed by the National Fire Protection Association (NFPA) Standard 72E-1978, "Standard for Automatic Fire Detectors," thereby providing increased detection capability. The MCR is also continuously occupied by operators that will likely detect the presence of fire in the event that the smoke detectors fail to do so. In addition, the licensee stated that the fire brigade is trained to respond to fire events located in the MCR, and that the detectors described above are located in panels or cabinets to alert operators and fire brigade members to the fire zone or location so it can be promptly extinguished. The NRC staff concludes that the combination of detection capability and continuous presence of operators will provide early indication of a fire event to operators and fire brigade members.

The licensee stated that fire extinguishment and control is accomplished via portable water and carbon dioxide agent extinguishers and hose streams from fixed standpipes located near the MCR entrances. In addition, the licensee stated that cable trays located above the ceiling are separated into clusters to allow manual firefighting access. Therefore, the majority of combustibles can be effectively reached by portable extinguishers or hose streams. The licensee also stated that the relay room (Fire Zone Z032), located adjacent to the MCR, is

provided with an automatic Halon fire extinguishing system and ventilation dampers that close upon actuation of the Halon system thereby limiting the exposure from a fire in the relay room to the MCR. Similarly, the shift supervisor's office (Fire Zone Z083) was not considered to represent a significant hazard to the MCR for the postulated bounding case since it is separated by partitions and a door from the MCR and typically occupied.

As documented in NUREG-0781, "Safety Evaluation Report related to the operation of South Texas Project, Units 1 and 2," April 1986 (not publicly available), Section 9.5.1 "Fire Protection,"

the MCR is not provided with a fixed fire suppression system. There are no changes within this request that would challenge the previous approval of no fixed fire suppression system.

Based on the above, the NRC staff concludes that STPNOC has adequately addressed the DID element of detection, control, and extinguishment by utilizing fire detectors, continuous staffing of the MCR, strategic placement of manual extinguishment devices, and a fire brigade.

Therefore, the staff concludes that the licensee's approach to fire detection, control, and extinguishment is acceptable.

3.3.1.3 Preservation of Safe Shutdown Capability In order to ensure the ability to safely shutdown the reactor in the event of a fire in the MCR that causes operators to evacuate, the licensee relies on operator control room actions prior to evacuating the control room, one automatic action, and actions performed outside of the MCR.

The performance of the control room actions is discussed in SE Section 3.3.2.

The relay room (Fire Zone Z032) is separated from the MCR (Fire Zone 034) by a 12-inch concrete wall with 3-hour fire rated dampers to isolate the MCR from the relay room, and provides protection for the automatic shutdown function that is credited. This physical separation ensures that the credited automatic action (i.e., automatic turbine trip following reactor trip) will not be impacted by a fire in the MCR and will occur as designed following the postulated fire scenario. It also provides a high degree of confidence that the performance of the requested actions in the MCR will be successful should a fire initiate in the relay room, and that the automatic functions in the relay room will be successful if a fire initiates in the MCR.

The licensee determined that the bounding, or limiting, fire scenario was a fire that originates in the safety injection system controls cabinet, CP001, located in the MCR. The discussion in this section addresses the fire protection response, whereas SE Section 3.3.3 discusses the thermal-hydraulic plan response. In order for the requested actions to be necessary, the fire would also have to damage the pressurizer PORV cabinet, CP004, and the offsite power breaker cabinet, CP010, which are physically separated by several feet. Given that the MCR is a continuously occupied area with the elements of DID discussed in this section and the two preceding sections, it is highly unlikely that a fire would occur, go undetected, and damage the specific equipment needed to ensure safe shutdown capability.

The licensee also stated that the redundant solid state protection system logic train actuation cabinets, located in the relay room, are separated by approximately 36 feet and that the engineered safety features actuation train cabinets are located between the solid state protection system logic train cabinets, which are constructed of heavy gauge steel and

separated from each other by a 2-inch air gap with no intervening combustibles. The licensee also stated that the "A" train circuits in the relay room enter the room from below the room while the "B" and "C" circuits are routed from the top and rear of the room, providing additional separation.

It is considered unlikely that a fire in the MCR would occur, go undetected, and progress to a point where it begins to adversely impact safe shutdown capability by causing spurious actuations of safe shutdown equipment. The licensee stated that the impact of such an event would be greatly limited because the physical and spatial separation layout for the control panel circuits in the MCR are in accordance with Section 5.6 of the IEEE 384 - "IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits," 2008, and NRC Regulatory Guide (RG) 1.75, Revision 3, "Criteria for Independence of Electrical Safety Systems,"

February 2005 (ADAMS Accession No. ML043630448). This separation combined with the spatial separation of the cabinets described above and the requested control room actions further ensure that safe shutdown capability is maintained.

In addition, the licensee evaluated whether a single spurious actuation could negate any of the control room actions before they are backed up from outside the MCR. For instance, the licensee stated that the control room action to initiate main steam isolation would not be negated by a single subsequent spurious actuation because both a main steam isolation valve and a downstream secondary steam-side valve would have to open due to fire-induced spurious actuations for an uncontrolled cool down of the RCS to occur. This is consistent with the guidance contained in Section 5.4.4 of NRC RG 1.189, Revision 2.

Since the MCR is a permanently occupied area and equipped with the fire detection system described in SE Section 3.3.1.2, it is likely that any fires would be detected and suppressed promptly by operators or the fire brigade and, therefore, an evacuation due to a loss of habitability is unlikely. However, the licensee evaluated the limiting case, as described in SE Section 3.3.3, which assumed that none of the requested control room actions are performed prior to evacuating the MCR, other than the manual reactor trip and the resulting automatic turbine trip.

The licensee further stated that the requested control room actions are also backed up with OMAs performed at the auxiliary shutdown panel thereby minimizing exposure to the limiting fire scenario. In the event that none of the requested control room actions are performed in the MCR, the licensee stated that they can maintain or restore the plant to a safe condition within the thermal-hydraulic limits and without sustaining damage to the fuel cladding. Specifically, the licensee stated that all of the control room actions are backed up by OMAs performed outside the MCR within 10 minutes, except the Reactor Coolant Pump 13.8 kilo Volt (kV) breakers, which would be opened within 20 minutes per the original Westinghouse Safe Shutdown calculations. The 10-minute time was also verified by walkdowns and shown to be feasible.

The objective of the DID analyses in Attachment 2 to Enclosure 1 of LAR dated July 23, 2013, was to demonstrate that, even when failing to perform the control room actions credited in the FPP, the reactor system would not tend to an irrecoverable state, following a post-trip and a fire-induced, spurious actuation.

The analyses were performed using similar methods to those described and evaluated in SE Section 3.3.3.3; however, the prompt control room actions were not included in the analysis.

Therefore, the events were permitted to continue unmitigated for 10 minutes. The same set of spurious actuations was included as those analyzed previously, and the licensee analyzed cases both with and without offsite power.

Based on the above, the NRC staff concludes that the licensee has adequately addressed the DID element of preservation of safe shutdown capability by establishing and maintaining adequate physical and spatial separation of required safe shutdown equipment, a series of preemptive control room actions performed in the MCR prior to evacuation, and a series of previously-reviewed OMAs performed outside the MCR subsequent to evacuation. Therefore, the staff concludes that the licensee's approach for preservation of safe shutdown capability is acceptable.

3.3.2 Human Performance Reliability of Requested Control Room Actions In Section 3.4 of Enclosure 1 of the LAR dated July 23, 2013, the licensee provided Table 1, Proposed Operator Actions, which details the specific action, the credited time, recent demonstrated time, reason for the action, and the licensing basis requirement. The NRC staff completed its Level II review as described in this section.

3.3.2.1 Operating Experience Review The licensee provided a list of facilities (e.g., Susquehanna Steam Electric Station, Watts Bar Nuclear Plant, Callaway Plant, and San Onofre Nuclear Generating Station) for which the NRC has accepted additional control room actions, in addition to tripping the reactor, before evacuating the MCR that meet regulatory requirements. Each facility has actions similar to the proposed STP control room actions that the NRC has credited as being acceptable. The staff notes that although the STP LAR has several additional control room actions compared to the example plants, the licensee has provided justification based on adequate operational experience in support of the request.

3.3.2.2 Task Analysis The proposed control room actions are performed in aggregate and timed in a sequence such that the action time is dependent on the success of the previous item. The aspect requiring reanalysis was the time constraint for the action sequence. The NRC staff review did not identify any issues that would add to the workload or the need for additional support to complete the proposed actions before exiting the MCR in the event of a fire. The licensee's DID analysis shows that safe shutdown capability is maintained even if none of the proposed control room actions, other than the manual reactor trip, are successful prior to evacuation. The NRC staff concludes that a full revision of the licensee's task analysis is not necessary.

3.3.2.3 Staffing The proposed control room actions are performed by a single operator on shift assigned to the MCR. The licensee has stated that the operator has no other responsibilities during the

performance of these actions. Therefore, the staff concludes that no additional staffing or qualifications or changes thereto, are required, and the proposed staffing level is acceptable.

3.3.2.4 Human Reliability Analysis A qualitative human-system interface time-motion study analysis was performed by the licensee to demonstrate that it is reasonable to conclude that the proposed operator actions can be reliably performed within the time required by the thermal-hydraulic analyses. These time validation exercises were observed by an STP qualified Human Factors Engineer and a Senior Reactor Operator and included items such as environmental aspects, equipment, and personnel. Therefore, the NRC staff concludes that there is reasonable assurance that the proposed control room actions can be successfully performed within the required time.

3.3.2.5 Training Program Design The licensee stated that the plant operations shift is properly staffed and trained. Specifically, the licensee identified procedure OPOP04-Z0-0001, "Control Room Evacuation," as the procedure that addresses evacuation of the MCR due to a fire. In addition, the licensee stated that this procedure is covered at the initial licensed operator training and periodically through the licensed operator requalification program. Training and practice is done at a frequency consistent with that established in 10 CFR 50.120, Training and qualification of nuclear power plant personnel. Additionally, as stated in the LAR dated July 23, 2013, the licensee has demonstrated that the proposed control room actions can be performed successfully within the required times stated in the thermal-hydraulic analysis by a randomly selected crew. The NRC staff considers the training to be adequate and appropriate to ensure the operator can complete the actions within the required time.

3.3.2.6 Human Factors Verification and Validation The licensee stated that the proposed control room actions and completion times have been validated in a simulator scenario and do not provide any human engineering discrepancies.

Furthermore, during the 2011 Triennial Fire Protection Inspection, the inspection team performed timed operator walk-downs of the control room evacuation and concluded that the proposed control room actions were within the time required by the thermal-hydraulic analysis.

The NRC staff considers the performance data to be reasonable and concludes that the proposed control room actions are acceptable.

The NRC staff concludes that the proposed additional operator control room actions are acceptable because the licensee has demonstrated that the actions can be completed within a reasonable time based on walk-downs and simulator training, and the proposed actions are not expected to create excessive additional burden. The review also concludes that the proposed operator actions meet the requirements of 10 CFR 50.120 and are consistent with the guidance provided by NUREG-0800, Chapter 18, NUREG-0711, and NUREG-1764.

3.3.3 Detailed Thermal-Hydraulic Evaluation of Limiting Case The licensee submitted a thermal-hydraulic analysis that indicated that the limiting, or bounding, scenario was a spurious opening of a pressurizer PORV immediately following the reactor trip that remains open for 10 minutes until control of the PORV and PORV block valve is transferred to the auxiliary shutdown panel to close either valve, with a concurrent loss-of-offsite power at the initiation of the transient. In addition, the licensee assumed that none of the proposed control room actions are performed prior to evacuating the MCR, other than the manual reactor trip and the resulting automatic turbine trip. For this scenario, the licensee instituted the following acceptance criteria, which address the intent of those contained in 111.L:

• Sufficient core cooling is established and maintained throughout the transient.

• Fuel cladding integrity is not challenged.

• Pressurizer and steam generator levels return to the indicating band after the plant reaches stable conditions.

• Charging and letdown are restored to support cooldown to cold shutdown conditions.

The licensee determined that the reactor remains subcritical, sufficient core cooling is present throughout the transient, fuel cladding integrity is not challenged, pressurizer and steam generator levels return to within indicating range, and charging and letdown are restored to support cooldown to cold shutdown conditions with or without safety injection. In addition, the licensee assumed that automatic actuations within the relay room function for at least one safety train because of the physical separation between the control room and the relay room.

The NRC staff notes that these analyses indicate that the primary coolant system will encounter challenges. The analyses of the spurious PORV opening and the spurious pressurizer spray valve opening indicate that, for both the cases, the pressurizer will fill with water. In the case of the spurious PORV opening, this occurs within 9 minutes. For the spurious PORV opening with loss-of-offsite power, RCS voiding is also predicted to occur.

Typically, these results are beyond the NRC staff acceptance criteria for transient analyses.

However, the analyses assume a more challenging set of conditions than are typically required, especially for a UFSAR Chapter 15-type safety analyses. Therefore, the NRC staff notes that the results of the DID analyses indicate acceptable system restoration, assuming operator intervention after 10 minutes is successful at restoring the plant state. For example, the analyses assume that operator intervention successfully terminates water flow through the pressurizer PORV.

Because these analyses do not validate the prompt control room actions proposed for incorporation into the STP FPP, the NRC staff determined that a detailed review was unnecessary insofar as it would support the proposed license amendment. However, the results of these analyses provide supporting evidence that would suggest a reasonable level of

DID, in the unlikely event that operators are unable to perform the prompt control room actions proposed for addition to the FPP.

The DID results presented in SE Section 3.3.3 are considered acceptable only insofar as they show general indications of possible system behavior; this finding is reasonable because the analyses assume that the credited operator actions do not occur.

3.3.3.1 Analytical Methods The licensee used the RETRAN-02 computer code in the fire hazard analysis to perform the thermal-hydraulic analyses to support the proposed operator actions. The licensee's analytic approach was to evaluate the efficacy of the credited control room actions then to evaluate the RCS behavior assuming those actions are not taken (DID analyses). The licensee also evaluated the effect of reactor state uncertainties.

3.3.3.2 RETRAN RETRAN is a commercially available systems analysis computer code. In licensing analyses, RETRAN is used as part of an NRC-approved methodology that ensures the code consistently delivers repeatable, conservative results. STPNOC's analyses were not performed in accordance with NRC-approved methodology; therefore, the NRC staff assessed the licensee's application of the RETRAN code for its acceptability in modeling the effectiveness of above actions.

According to the code developer, CSA, RETRAN-02 is a versatile and reliable computer program for use in best-estimate transient thermal-hydraulic analysis of light water reactor systems. It is based on a one-dimensional homogeneous equilibrium mixture model with an optional phasic slip formulation based on either a drift flux model or a phasic velocity difference differential equation. RETRAN-02 contains both point reactor and one-dimensional kinetics models and component models for reactor control systems, pressurizers, and separators.

RETRAN is widely used within the nuclear industry and has numerous NRC approvals for licensing applications. The code itself is approved for use as documented in, among others, the following licensing topical reports and acceptance letters:

• "Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5,

'RETRAN-A Program for One Dimensional Transient Thermal Hydraulic Analysis of Complex Fluid Flow Systems,' and Electric Power Research Institute (EPRI)

NP-1850-CCM, 'RETRAN-02-A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems,"' September 4, 1984

• "Acceptance for Referencing Topical Report EPRl-NP-1850-CCM-A Revisions 2 and 3 Regarding RETRAN-02/MOD003 and MOD004," October 19, 1998

• "Acceptance for Use of RETRAN02 MOD005.0," November 1, 1991

The NRC approves of the use of RETRAN as an element of licensing basis safety analysis methodology as described in the following licensing topical reports:

• Virginia Electric and Power Company (VEPCO), VEP-FRD-41, Revision 0.1-A, "VEPCO Reactor System Transient Analyses Using the RETRAN Computer Code," June 2004 (ADAMS Accession No. ML042590169)

• Duke Power Company (Duke), DPC-3000-A, Revision 3, "Thermal-Hydraulic Transient Analysis Methodology," September, 2004 (ADAMS Accession No. ML050680309)

• Westinghouse Electric Company LLC (Westinghouse), WCAP-14882-P-A, "RETRAN-02 Modeling & Qualification for Westin~house Pressurized Water Reactor Non-LOCA Safety Analyses, "April 1999.

It is noteworthy that in each of the three methodologies cited above, a key element to RETRAN's approval basis is its qualification via comparison to plant transients, documented accidents, and code-to-code comparisons. The code has generally been found acceptable because it produces reasonable agreement with observed plant transient behavior. In the VEPCO and Duke cases, comparison was made to actual plant transient data. In Westinghouse's case, comparison was made between RETRAN and the Westinghouse Proprietary LOFTRAN code. The licensee stated that its use of RETRAN most closely aligns with WCAP-14882-P-A (Enclosure 1, Section 3.4.2 of the LAR dated July 23, 2013).

The NRC staff performed a limited review of the licensee's application of the RETRAN-02 computer code and determined that it was acceptable, because extensive benchmarking has shown that the code produces acceptable predictions of PWR reactor system behavior when analyzing anticipated operational occurrences. The NRC staff did not review the code in further detail, for two reasons. First, various RETRAN versions have already been reviewed by the NRC staff, and the licensee stated that its use of the code was largely consistent with WCAP-14882-P-A. Second, the licensee is analyzing events beyond the facility licensing basis to demonstrate acceptable equipment performance, such that the use of NRG-approved codes and methods is not necessary. This conclusion applies only to the licensee's use of the computer code, and not the modeling methods, which are addressed in other sections of this SE input.

3.3.3.3 Analytic Approach The licensee evaluated the efficacy of the proposed control room actions with regard to ensuring that the plant remains in an acceptable state, in accordance with the acceptance criteria set forth in Section 111.L. These analyses evaluated the plant in a nominal condition without consideration for initial condition or instrument response uncertainties. A second analysis evaluated the sensitivity of the nominal results to plant uncertainties. Finally, another set of analyses evaluated reactor performance in the event the credited operator actions were not performed, as a means to express available DID.

2 A publicly-available version of this topical report was not located within ADAMS.

In its analysis, the licensee included assumptions that one spurious equipment actuation would occur at the time of reactor trip, consistent with the guidance contained in RG 1.189. In the licensee's response (letter dated May 12, 2014) to the NRC staff's RAI (letter dated April 2, 2014; ADAMS Accession No. ML14092A348), the licensee stated that the analyses showed that the spurious actuation was assumed to "occur at time zero 'Reactor trip' because the spurious actuation would be the longest duration that a component could be in an undesirable position."

The NRC staff determined that the licensee's explanation was acceptable, only in the case of the fire protection analyses, 3 because the specific failures that were determined to be limiting would be most limiting if they occurred at the time of reactor trip. For example, a spurious PORV opening is most limiting if it inadvertently releases the most reactor coolant. At a given relief capacity, this occurs when the valve is open the longest.

Note that one of the analyses assumes a spurious action coincident with the auto-start of the SUFP, rather than at the time of reactor trip. This assumption is addressed in further detail in SE Section 3.3.3.6.

3.3.3.4 Analytic Acceptance Criteria The licensee applied the following acceptance criteria to its analyses, as discussed in to Enclosure 1 of the LAR dated July 23, 2013:

• The RCS process variables are maintained within those predicted for a loss of normal AC power.

• The integrity of the fission product barriers remains intact, i.e., there is no fuel cladding damage, no challenge to the reactor coolant pressure boundary, and no rupture of the containment boundary.

• The plant stabilizes with pressure and steam generator levels in the indicating band and are maintained until charging and letdown is available to borate the RCS, at which time the plant can proceed to cold shutdown conditions.

• The performance goals specified in 10 CFR 50 Appendix R, Section 111.L.2 are met, which are:

The reactivity control function shall be capable of achieving and maintaining cold shutdown reactivity conditions.

The reactor coolant makeup function shall be capable of maintaining the reactor coolant level above the top of the core for BWRs [Boiling Water Reactors] and within the level indication in the pressurizer for PWRs.

3 The statement made by the licensee is not true in all cases, but as described in this paragraph, it applies to the fire protection analyses.

The reactor heat removal function shall be capable of achieving and maintaining decay heat removal.

The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.

The supporting functions shall be capable of providing the process cooling, lubrication, etc., necessary to permit the operation of the equipment used for safe shutdown functions.

Most of the acceptance criteria above tie directly to requirements contained in Section 111.L, are explicit with regard to acceptable performance and are, therefore, acceptable. Although the requirement to show plant stabilization is not established in Section 111.L, the requirement is consistent with the guidance contained in RG 1.70, Revision 3, "Standard Format and Content for Final Safety Analysis Reports for Nuclear Power Plants, LWR Edition," November 1978 (ADAMS Accession No. ML011340122), which recommends that transient analyses provide a description of a sequence of events from event initialization to the final, stabilized condition.

The NRC reviewed how the licensee ensured RCS process variables are maintained during a loss of normal AC power, and addressed three conditions. First, the NRC staff reviewed the distinction between the loss of normal AC power as a licensing basis AOO and as a License Condition 2.E/Appendix R acceptance criterion. Second, the NRC staff observed that the loss of normal AC power analysis is not discussed in the UFSAR, and, therefore, the NRC staff requested this analysis. Finally, the UFSAR concludes that the loss of normal AC power is bounded by a loss of normal feedwater event, which is analyzed to demonstrate that the pressurizer does not overfill. Thus, the NRC staff also evaluated the application of a pressurizer overfill criterion to the operator action analyses.

Among the STP UFSAR Chapter 15 accident analyses, loss of normal AC power is classified as an AOO. Acceptable analysis results for this event resemble the acceptance criteria of Section 111.L. For example, AOO analysis results must show that there is no fuel clad damage, and that the RCS pressure boundary remains intact.

Since Section 111.L, requires that RCS process variables be maintained within those predicted for a loss of normal AC power, 4 and the loss of normal AC power is an AOO described in the STP UFSAR, the NRC staff requested that the licensee compare the acceptance criteria in Section 111.L, to the UFSAR acceptance criteria for AOOs, and explain any differences identified.

In particular, the NRC staff requested that the licensee address the non-escalation criterion for AOOs, which prohibits an AOO, without the occurrence of a separate fault, from escalating into a more serious event.

4 Recall that Appendix R, Section 111.L uses the loss of AC power because, when the rule was promulgated, it was believed that a loss of AC power could reasonably be anticipated to occur in a fire scenario. This concept is discussed in Section 2.0 of this SE.

By letter dated May 12, 2014, in response to RAI 2, the licensee clarified that the Appendix R requirements relate to the ability of equipment impacted by a fire to perform its intended function, which includes both (1) achieving and maintaining cold shutdown conditions, and (2) ensuring the fission product barriers remain intact, among other things. The acceptance criteria for AOOs, while somewhat similar, also require that an AOO not generate a postulated accident without other faults occurring independently. This acceptance criterion is not applied within Appendix R. Since the licensee provided additional information that clarified the role of the loss of AC power analysis as an acceptance criterion, the NRC staff determined that the licensee need not address the non-escalation criterion when considering the RCS process variables in evaluating whether the fire analyses remain within the bounds of the loss of AC power analysis.

The NRC staff reviewed the STP UFSAR to evaluate the results of the loss of normal AC power event. According to the UFSAR, however, the loss of normal AC power is bounded by another, more severe event, and is not analyzed. Therefore, the NRC staff requested that the licensee provide the results of a loss of normal AC power analysis and demonstrate that the analyses provided in Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, remain within the values of the loss of normal AC power analysis. The loss of all AC power analysis reflected the same modeling techniques as those employed in the operator action analyses, to provide a suitable comparison. The licensee also provided a direct comparison of the loss of AC power analyses to the limiting operator action analysis, which was the spurious opening of one bank of steam dump valves. The NRC staff determined that the licensee's response to the RAI was acceptable, because the results of the loss of normal AC power were provided. These results, and their comparison to the other events, are discussed in SE Section 3.3.3.6.

In its review of the loss of AC power event in the STP UFSAR, the NRC staff observed that the more limiting AOO, the loss of feedwater without offsite power event, had been chosen because it comes closer to challenging the pressurizer overfill criterion. However, the pressurizer overfill criterion is not among the criteria described in Section 111.L. In Attachment 1 to its letter dated May 12, 2014, in response to RAI 4, the licensee stated that the fire protection analyses demonstrate that the pressurizer does not overfill, and that pressurizer overfill would be an unacceptable result. The licensee's explanation is consistent with the performance requirements contained in Section 111.L, in that the pressurizer level is required to remain within the indicating range. 5 Based on the review described in the preceding paragraphs, the NRC staff determined the following regarding the licensee's application of the loss of AC power acceptance criterion set forth in Section 111.L:

• The licensee's analyses of the efficacy of the operator actions should show that the process variables determined by the analyses remain bounded by the loss of AC power analysis.

5 The licensee also stated that the DID analyses, which assume unsuccessful operator intervention, do not conform to this requirement. These DID analyses, however, are beyond the scope of the guidance contained in RG 1.189, the NRC staff concluded that the DID analyses (a separate analyses from those discussed above) need not assure that a steam bubble constantly remains in the pressurizer. Additional detail concerning the review of the DID analyses is provided in Section 3.3.1.3 of this SE.

• The licensee provided a loss of AC power analysis, performed using similar analytic methods, so that the NRC staff could verify that the operator action analyses conform to this acceptance criterion.

• The control room action analyses need not consider the non-escalation requirement imposed for AOO analyses, since the AC power requirement contained in Section 111.L relates to equipment performance capabilities and explicitly identifies performance requirements that do not include non-escalation.

• The licensee also demonstrated that, for the control room action analyses, the pressurizer does not overfill, and considers this also to be an acceptance criterion. This is consistent with the Section 111.L requirements to maintain pressurizer level within indicating range.

Based on the considerations discussed above, the NRC staff determined that the licensee has acceptably applied the requirement, pursuant to License Condition 2.E (Section 111.L), to ensure that RCS process variables in a post-fire scenario remain within those predicted by the loss of all AC power. The requirement to demonstrate trending toward stable performance is acceptable because it is consistent with NRC review guidance related to transient analysis.

3.3.3.5 Initial Conditions and Plant Parameters The licensee assumed that the reactor state and equipment response times were at nominal conditions. For UFSAR Chapter 15 safety analyses, this approach is considered acceptable only if the reactor state and response uncertainties are quantified by some means. Typically, a detailed uncertainty evaluation is required.

In the case of the control room action analyses, however, the uncertainty was considered by selecting a limiting transient with respect to pressurizer level, and re-evaluating it using assumptions consistent with Westinghouse Electric Company's Standard Thermal Design Procedure. 6 This uncertainty evaluation was performed by re-analyzing the spurious pressurizer PORV opening event discussed in Section A 1.2 of Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013. This event, along with the spurious opening of the single bank of steam dump valves, resulted in the pressurizer water level falling below indicating span before being restored. The difference in minimum actual level reached in the pressurizer was about three feet: the nominal analysis indicated a minimum level slightly less than 5 feet, whereas the analysis with biased inputs indicated a minimum level slightly less than 2 feet (these results were inferred from inspection of the figures contained in Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, and further precision cannot be obtained from such visual inspection).

The reanalysis confirmed that, when considering initial condition and plant response uncertainties, the results still conformed to the Section 111.L acceptance criteria. Because the 6

The Standard Thermal Design Procedure is an NRG-approved methodology that deterministically treats reactor state and instrument uncertainties in safety analyses by biasing their initial values in the direction that produces the most pessimistic result. Among other things, the methodology establishes which biasing direction is conservative for a given parameter value and a given event.

licensee's uncertainty analysis demonstrated acceptable results for the limiting event, when considering these uncertainties, the NRC staff determined that the licensee's treatment of initial conditions and plant parameters was acceptable.

It should be noted that, while the spurious PORV analysis was a challenging event, the results of the spurious steam dump valve bank opening were slightly more challenging in terms of both the minimum pressurizer level reached and the length of time that the pressurizer level remained off-scale. One could reasonably infer that, had such initial condition biasing been applied to the analysis of the spurious steam dump valve bank opening, the results would have indicated the pressurizer emptied. On the other hand, all analyses conservatively neglect the initiation of safety injection flow. With an indicated minimum pressure of 1300 - 1450 pounds per square inch absolute (psia), consistent among the steam dump and PORV analyses, safety injection flow would initiate and high head safety injection would aid in keeping the RCS pressurized, and the pressurizer partially filled with liquid water. 7 Since the licensee conservatively did not credit the safety injection flow in all analyses, the NRC staff accepts the licensee's use of the spurious PORV analysis to assess the effects of initial condition uncertainties, despite that it is not the most limiting event among those analyzed.

3.3.3.6 Thermal-Hydraulic Analyses and Results The licensee performed thermal-hydraulic analyses using the RETRAN-02 computer code to demonstrate the efficacy of the control room actions. These analyses, which are discussed in to Enclosure 1 of the LAR dated July 23, 2013, modeled the proposed control room actions, assuming they were performed within the required time. The objective of this modeling effort was to demonstrate that, provided the operator performs the actions within the required time, the RCS performance adheres to the acceptance criteria. Each analysis performed included a spurious, fire-induced actuation, consistent with RG 1.189 guidance.

Since the analyses are discussed in detail in Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, a detailed discussion is omitted from this SE input. Rather, key results provided in Table 1 below that demonstrate adherence to the Section 111.L acceptance criteria are summarized for each event, and a reference is provided to the section within Attachment 1 where the relevant analyses are discussed. The table is categorized by the various, spurious actuations assumed by the licensee.

7 Per STP's Technical Specification, the allowable value for the low pressurizer pressure safety injection permissive is 1851 pounds per square inch gauge (psig). UFSAR Chapter 6.3 indicates that the design pressure for the high-head safety injection pumps is 1750 psig.

Table 1. Summary of Spurious Actions and Analytic Results Spurious Actuation Mitigating Operator Action(s) Supportinp Results Analysis

• Pressurizer water level goes off scale (pressurizer Close main steamline isolation does not empty), then recovers One bank of steam dump valves valves A1.1

• Sub-cooling margin is maintained open

• Sub-criticality is maintained

• Steam generator level remains within indicating range

• Pressurizer water level goes off scale (pressurizer does not empty), then recovers One pressurizer power operated Close both PORV block valves A1.2

• Sub-cooling margin is maintained relief valve (PORV) opens

• Sub-criticality is maintained

• Steam generator level remains within indicating range (1) Secure all four reactor coolant

• Pressurizer water level remains within indicating range pumps (RCPs) A1.3

• Sub-cooling margin is maintained Pressurizer spray valve opens (2) Secure centrifugal charging A1.7

• Sub-criticality is maintained pumps (CCPs)

• Steam generator level remains within indicating range Startup feed pump (SUFP)

Close feedwater isolation valves

• Pressurizer water level remains within indicating range actuates

• Sub-cooling margin is maintained A1 .4

• Sub-criticality is maintained Feedwater isolation valve opens Secure SUFP

• Steam generator level remains within indicating range 8

Supporting analysis refers to the section within Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, within which the analyses are discussed.

The analyses supporting the first three assumed spurious actuations - the steam dump valves opening, the PORV opening, and the pressurizer safety valve opening - were all clear that the spurious actuation was assumed to occur at the time of reactor trip, consistent with the licensee's response to RAI 1 (see SE Section 3.3.3.3). However, the actuation of the SUFP and the opening of the feedwater isolation valve are slightly different. Section A 1.5 of Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, confirms that the SUFP actuation is a result of the main steamline isolation. The main steam isolation valve closure causes an automatic trip of the main feedwater turbines, which in turn causes a start signal for the SUFP. A spurious opening of a feedwater isolation valve at this point could expose the RCS to overcooling, and the remedial control room action is to secure the SUFP. Thus, the appropriate time to assume the spurious opening of a feedwater isolation valve is at the time the SUFP starts, rather than at the time of reactor trip. Although the analysis depicted in Section A 1.4 of Attachment 1 to of the LAR is not wholly consistent with the licensee's response to RAI 1 regarding the assumed spurious actuation at time of reactor trip, it is acceptable nonetheless because the spurious actuation is most relevant at the time of SUFP start.

As summarized in Table 1, the analyses each show that the results are within the acceptance criteria regarding stabilizing the plant in a subcritical condition, with adequate sub-cooling margin (an indication of no challenge to fuel cladding integrity), and steam generator and pressurizer level within indicating range. Based on this consideration, the NRC staff determined that the results are acceptable. to Enclosure 1 of the LAR dated July 23, 2013, did not provide information to confirm whether the plant parameters remained within the values established by the loss of AC power analysis. In response to RAI 3, the licensee provided a baseline loss of AC power analysis in order to compare to the remaining results and establish that this acceptance criterion is satisfied. Since the licensee determined that the most limiting event was the spurious opening of a bank of steam dump valves, this event was compared to the loss of AC power analysis. The comparison showed that the plant experienced a slightly faster RCS cooling associated with the spurious steam dump valve bank opening than with the loss of AC power; however, the plots indicated that results in both cases trended to stable recovery, and that adequate subcooling margin was maintained at all times in both cases. In terms of system effects during an off-normal transient, the NRC staff considers the results to be reasonably consistent, i.e., "within those predicted for the loss of normal AC power," because in neither case does the system enter an unacceptable state (indicative of fuel damage or RCS pressure boundary failure, for example), and in both cases the system trends to a stable, recovered position. Based on this consideration, the NRC staff concluded that the licensee also demonstrated that the analyzed events discussed in Attachment 1 to Enclosure 1 of the LAR dated July 23, 2013, satisfied the loss of AC power acceptance criterion.

Since the licensee's analytic results, as discussed and evaluated above, showed that the plant met the acceptance criteria in a post-fire shutdown with assumed, spurious equipment actuations, the NRC staff concluded that the licensee's results were acceptable.

3.4 Conclusion of NRC Staff Evaluation The NRC staff has reviewed the licensee's analyses with regard to the most limiting case, the DID provided, the computer code used to perform the analyses, the analytic methods employed by the licensee, the initial conditions, the acceptance criteria, the licensee's intended use of the requested control room actions, and the human performance reliability aspects. As described in the preceding sections, the licensee's analyses demonstrate the efficacy of prompt control room actions, insofar as they demonstrate conformance to the acceptance criteria set forth in 10 CFR Part 50, Appendix R, Section 111.L, to mitigate spurious equipment actuations occurring during a reactor shutdown required by a fire that prompts MCR evacuation. Based on the analyses and features discussed above and in the licensee's submittal, the staff concludes that it is unlikely that a fire would occur in the MCR, and go undetected and unsuppressed such that it jeopardizes safe shutdown capability and, the DID and margin provided at STP for the limiting case is acceptable.

3.4.1 Review Limitations 3.4.1.1 Use of RETRAN to Analyze Appendix R Events Due to the limited scope of the NRC staff review, conclusions regarding the acceptability of the fire protection plan revisions cannot be construed as finding RETRAN-02, applied in the fashion described in this SE, acceptable as a method of evaluation as defined in 10 CFR 50.59, "Changes, tests, and experiments."

3.4.1.2 Use of RETRAN for Long-Term System Analysis The NRC staff does not consider the application of a system code like RETRAN to be acceptable to analyze long-term, post-accident performance of a RCS, and provide a detailed, reliable and accurate prediction of that performance. Based on this consideration, the NRC staff did not perform a detailed review of the licensee's DID analyses. Such a review was unnecessary, as discussed in SE Section 3.3.3.

3.5 Changes to License Condition 2.E In its letter dated December 17, 2014, the licensee proposed to revise License Condition 2.E for STP (both units). The revised license condition for STP, Unit 1, Facility Operating License No. NPF-76, which also referenced the letters associated with the review, will read as follows:

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program in the Final Safety Analysis Report through Amendment No. 55 and the Fire Hazard Analysis Report through Amendment No. 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25 and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 201 O; July 23, 2013; May 12 (two letters), May 19, and

December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

The revised license condition for STP, Unit 2, Facility Operating License No. NPF-80, which also referenced the letters associated with the review, will read as follows:

E. Fire Protection STPNOC shall implement and maintain in effect all provisions of the approved fire protection program in the Final Safety Analysis Report through Amendment No. 62 and the Fire Hazard Analysis Report through Amendment 23, and submittals dated April 29, May 7, 8 and 29, June 11, 25, and 26, 1987; February 3, March 3, and November 20, 2009; January 20, 2010; July 23, 2013; May 12 (two letters), May 19, and December 17, 2014; and as approved in the SER (NUREG-0781) dated April 1986 and its Supplements, subject to the following provision:

STPNOC may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the State of Texas' official was notified of the proposed issuance of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRG staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register dated October 29, 2013 (78 FR 64546). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: Brian Metzger, NRR/DRA/AFPB Benjamin Parks, NRR/DSS/SRXB Kamishan Martin, NRR/DRA/AHPB Date: February 13, 2015

ML14339A170 *SE memo dated 11/14/14 OFFICE NRR/DORL/LPL4-1/PM NRR/DORL/LPL4-1/LA NRR/DRA/AHPB/BC(A) NRR/DRA/AFPB/BC NAME LRegner JBurkhardt SWeerakkodyDChung AKlein*

DATE 1/06/2015 12/19/2014 11/15/2014 11/14/2014 OFFICE NRR/DSS/SRXB/BC OGG (NLO) NRR/DORL/LPL4-1 /BC(A) NRR/DORL/LPL4-1/PM NAME CJackson DRoth EOesterle LRegner DATE 1/16/2015 2/06/2015 2/11/2015 2/13/2015