ML010110252

Review of Oyster Creek Nuclear Generating Station (Oyster Creek) Individual Plant Examination of External Events (IPEEE) Submittal (Tac No. M83652)

ML010110252
Person / Time
Site:	Oyster Creek
Issue date:	02/08/2001
From:	Pastis H NRC/NRR/DLPM
To:	Degregorio R AmerGen Energy Co
Pastis H, NRR/DLPM, 415-1261
References
+kBR1SISP20060222, -nr, TAC M83652
Download: ML010110252 (62)

Text

February 8, 2001 Mr. Ronald DeGregorio Vice President Oyster Creek AmerGen Energy Company, LLC P.O. Box 388 Forked River, NJ 08731

SUBJECT:

REVIEW OF OYSTER CREEK NUCLEAR GENERATING STATION (OYSTER CREEK) INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE)

SUBMITTAL (TAC NO. M83652)

Dear Mr. DeGregorio:

On June 28, 1991, the NRC issued Generic Letter (GL) 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - Title 10 CFR 50.54(f) along with NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, requesting that licensees perform individual plant examinations of external events to identify plant-specific vulnerabilities to severe accidents and report the results to the Commission together with any licensee-determined improvements and corrective actions. You responded to GL 88-20, Supplement 4 by letter dated December 29, 1995. On December 10, 1997, the staff issued a request for additional information related to your GL response, to which you responded by letters dated May 21, 1998, June 29, 2000, and August 17, 2000. Enclosed is the NRC Staff Evaluation Report (SER) of its review of your submittals. Also included with the SER are the contractors Technical Evaluation Reports (TERs) in the seismic and fire areas and the staffs TER in the high winds, floods, transportation, and other external events (HFO) area.

On correspondence dated earlier than August 8, 2000, GPU Nuclear, Inc. (GPUN) was the licensed operator for Oyster Creek. On August 8, 2000, GPUNs ownership interest in Oyster Creek was transferred to AmerGen Energy Company, LLC (AmerGen). By letter dated August 10, 2000, AmerGen requested that the Nuclear Regulatory Commission continue to review and act upon all requests before the Commission which had been submitted by GPUN.

Accordingly, the staff has continued its review of this action.

On the basis of these reviews, the staff concluded that the aspects of seismic; fires; high winds, floods, transportation, and other external events were adequately addressed. The staffs review findings are summarized in the enclosed SER, and the details of the contractors and staffs findings in their TERs appear in attachments to the SER.

For the seismic analysis, your staff used a seismic probabilistic risk analysis (PRA) methodology to assess the capacity of plant structures and equipment to withstand beyond design basis earthquakes and to estimate the frequency of seismic sequences. Your staff estimated the total seismic core damage frequency (CDF) to be 3.6E-6 per year using the revised Electric Power Research Institute (EPRI) seismic hazard curves; this estimate was modified to 4.7E-6 per year in response to a request for additional information. The fire CDF was originally estimated at about 1E-5 per year; this estimate was modified to 1.9E-5 per year

in response to a request for additional information. The high winds, floods, transportation, and other external events were screened out using criteria consistent with NUREG-1407.

The licensees IPEEE submittal defined the term vulnerability as any core damage sequence whose frequency exceeds 1E-4 per year, or any large early containment failure sequence or bypass sequence whose frequency exceeds 1E-6 per year. Some potential plant improvements were identified, as described in the enclosed SER. A seismic improvement that has already been implemented consisted of ensuring that all bolts on the Forked River Combustion Turbine fin-fan coolers are installed and torqued properly. Improvements for the fire initiator which were under consideration at the time of the IPEEE submittal included upgrading the anchorage of the high pressure CO2 system in the turbine building. No improvements were identified for HFO events.

As a part of the IPEEE, unresolved safety issue (USI) USI A-45, Shutdown Decay Heat Removal Requirements, and generic safety issues (GSIs) GSI-57, Effects of Fire Protection System Actuation on Safety-Related Equipment, GSI-103, Design for Probable Maximum Precipitation, GSI-131, Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants, and the Sandia Fire Risk Scoping Study (FRSS) issues were specifically identified during the initial planning of the IPEEE program and explicitly discussed in Supplement 4 to GL 88-20 and its associated guidance in NUREG-1407 as needing to be addressed in the IPEEE. The specific information associated with each issue is identified and discussed in the attached SER. Based on the review of the information contained in the submittal, the staff believes that the licensees process is capable of identifying potential vulnerabilities associated with USI A-45, GSI-57, and GSI-103. (GSI-131 is not applicable to Oyster Creek). As far as the FRSS issues are concerned, the staff believes that the licensees process is capable of identifying potential vulnerabilities, except for the issue of equipment damage caused by operators misdirecting manual fire suppression actions because of smoke; this issue is not addressed in the IPEEE submittal. Misdirection of manual suppression efforts is also part of GSI-148, Smoke Control and Manual Fire-Fighting Effectiveness. Except for the FRSS issue of misdirected manual fire suppression, all of these issues called out directly in Supplement 4 to GL 88-20 and its associated guidance document are considered resolved, on the basis that the process used by the licensee to identify vulnerabilities associated with these issues is judged to be capable of identifying any potential vulnerabilities, and the licensee found no vulnerabilities.

On the basis of the screening review, the staff concludes that the licensees IPEEE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities and, therefore, that the Oyster Creek IPEEE has met the intent of Supplement 4 to GL 88-20.

In addition, the licensees IPEEE submittal contains some specific information that addresses the external event aspects of certain generic issues: GSI-147, Fire-Induced Alternate Shutdown/Control Room Panel Interactions; GSI-148, Smoke Control and Manual Fire-Fighting Effectiveness (also an FRSS issue, mentioned above); GSI-156, Systematic Evaluation Program (SEP); and GSI-172, Multiple System Responses Program (MSRP). The specific information associated with each issue is identified and discussed in the attached SER.

Apart from the GSI-148 issue of misdirection of manual fire suppression, the staff considers that the licensees process for the analysis of these issues is capable of identifying potential vulnerabilities associated with these issues. Since no vulnerabilities associated with the

external events aspects of these issues were found, the staff considers these issues resolved for Oyster Creek, except for the GSI-148 issue of misdirection of manual fire suppression. The need for any additional assessment or actions related to the resolution of this issue will be addressed by the NRC staff separately from the IPEEE program.

This completes the staffs review of IPEEE for Oyster Creek Nuclear Generating Station and TAC No. M83652. If you have any questions, please call me at (301) 415-1261.

Sincerely,

/RA/

Helen N. Pastis, Senior Project Manager, Section 1 Project Directorate I Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-219

Enclosure:

Staff Evaluation Report w/attachments cc w/encl: See next page

February 8, 2001 external events aspects of these issues were found, the staff considers these issues resolved for Oyster Creek, except for the GSI-148 issue of misdirection of manual fire suppression. The need for any additional assessment or actions related to the resolution of this issue will be addressed by the NRC staff separately from the IPEEE program.

This completes the staffs review of IPEEE for Oyster Creek Nuclear Generating Station and TAC No. M83652. If you have any questions, please call me at (301) 415-1261.

Sincerely,

/RA/

Helen N. Pastis, Senior Project Manager, Section 1 Project Directorate I Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-219

Enclosure:

Staff Evaluation Report w/attachments cc w/encl: See next page DISTRIBUTION:

PUBLIC PDI-1 R/F ABuslik, RES ARubin, RES CDoutt, NRR DCoe, NRR MGamberoni SLittle HPastis OGC BPlatchek, RGN I ACRS Accession Number: ML010110252 OFFICE PDI-1/PM PDI-1\LA PDI-1\SC NAME HPastis SLittle MGamberoni DATE 1/23/01 1/23/01 2/7/01 OFFICIAL RECORD COPY

AmerGen Energy Company, LLC Oyster Creek Nuclear Generating Station cc:

Kevin P. Gallen, Esquire Mr. Jeffrey A. Benjamin Morgan, Lewis & Bockius LLP Licensing - Vice President 1800 M Street, NW. Exelon Corporation Washington, DC 20036-5869 1400 Opus Place, Suite 900 Downers Grove, IL 60521 Manager Nuclear Safety & Licensing Oyster Creek Nuclear Generating Station Mail Stop OCAB2 P. O. Box 388 Forked River, NJ 08731 Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406-1415 Mayor Lacey Township 818 West Lacey Road Forked River, NJ 08731 Resident Inspector c/o U.S. Nuclear Regulatory Commission P.O. Box 445 Forked River, NJ 08731 Kent Tosch, Chief New Jersey Department of Environmental Protection Bureau of Nuclear Engineering CN 415 Trenton, NJ 08625 PECO Energy Company Nuclear Group Headquarters Correspondence Control P.O. Box 160 Kennett Square, PA 19348

STAFF EVALUATION REPORT (SER)

ON THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE) SUBMITTAL FOR THE OYSTER CREEK NUCLEAR GENERATING STATION Enclosure

STAFF EVALUATION REPORT ON THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE) SUBMITTAL FOR THE OYSTER CREEK NUCLEAR GENERATING STATION

1.0 INTRODUCTION

On June 28, 1991, the NRC issued Generic Letter GL 88-20, Supplement 4 (with NUREG-1407, Procedural and Submittal Guidance) requesting all licensees to perform individual plant examinations of external events (IPEEE) to identify plant-specific vulnerabilities to severe accidents and to report the results to the Commission together with any licensee-determined improvements and corrective actions. In a letter dated December 29, 1995, the licensee, GPU Nuclear Corporation, submitted its response to NRC. (The licensee is currently AmerGen.)

The NRC staff contracted with Brookhaven National Laboratory to conduct a screening review (a review for completeness and reasonableness) of the seismic portion of the licensee's IPEEE submittal and contracted with Sandia National Laboratories to conduct a screening review of the fire portion of the IPEEE submittal. The high winds, floods, transportation, and other external events (HFO) portion of the IPEEE submittal was reviewed by the staff. On the basis of the initial review of the IPEEE submittal, the staff sent requests for additional information (RAIs) to the licensee. The licensee responded to these RAIs in letters dated May 21, 1998, June 29, 2000, and August 17, 2000. Based on the results of the review of the original submittal and the responses to the RAIs, the staff concluded that the aspects of seismic; fires; and HFOs were adequately addressed. The review findings are summarized in the evaluation section below. Details of the contractors' and staff's findings are in the technical evaluation reports (TERs) attached to this staff evaluation report.

In accordance with Supplement 4 to GL 88-20, the licensee has provided information on the Fire Risk Scoping Study (FRSS) issues, generic safety issue (GSI)-57, "Effects of Fire Protection System Actuation on Safety-Related Equipment, GSI-103, "Design for Probable Maximum Precipitation, and Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal Requirements. This information was explicitly requested in Supplement 4 to GL 88--

20 and its associated guidance in NUREG-1407.

An IPEEE Senior Review Board (SRB) was established and meets on a regular basis. The purposes of the SRB are (1) for the contractor (or the staff, if the staff has performed the review) to present the findings and conclusions of its review and the bases for its conclusions, and (2) for the SRB members to provide their perspectives on the contractor's (or staff's) finding and conclusions and to make recommendations based on their technical expertise. In this manner, the SRB provides additional assurance that (1) the scope of the review meets the objectives of the program, and (2) critical issues that have the potential to mask vulnerabilities are not overlooked.

2.0 EVALUATION The Oyster Creek Nuclear Generating Station (OCNGS) is a General Electric boiling-water reactor BWR 2 with a Mark I containment. The electrical output of the plant is 640 Mwe. It is located near the Atlantic Ocean about 9 miles south of Tom's River, New Jersey. The plant began commercial operation on December 23, 1969.

Core Damage Evaluation Seismic OCNGS is classified as a 0.3g focused-scope plant in NUREG-1407. The plant safe shutdown earthquake (SSE) has a peak ground acceleration (pga) of 0.18g. A significant site-specific feature is a relatively high potential for soil liquefaction; the median fragility value for this failure mode is 0.4g. The licensee performed a new seismic probabilistic risk assessment (PRA) for its IPEEE. In the original IPEEE submittal, the licensee estimated the seismic core damage frequency as 3.6E-6 per year using the Electric Power Research Institute (EPRI) hazard curves, and as 6.4E-6 per year using the Lawrence Livermore National Laboratory (LLNL) hazard curves. The licensee revised its analysis in response to an RAI. In the response dated June 29, 2000, to an RAI, the licensee estimated the seismic core damage frequency as 4.7E-6 per year using the EPRI hazard curves.

Fire The OCNGS fire assessment consists of a fire probabilistic risk assessment (PRA) based on EPRIs Fire-Induced Vulnerability Evaluation (FIVE) methodology supplemented by an existing fire hazards analysis (FHA) and the internal events PRA models. The licensee estimated the fire core damage frequency to be about 1E-5 per year, in the original IPEEE submittal. This value of the fire core damage frequency was modified to 1.9E-5 per year in their August 17, 2000, response to the RAI.

High Winds, Floods, Transportation, and Other (HFO) External Events The licensee's analysis for high winds and tornadoes was revised in response to an RAI. The revised analysis estimates the fragility of the weakest structure, the diesel generator vaults, and shows that the median wind speed capacity associated with the mean fragility curve for this structure is 266 mph. Using the tornado wind hazard function given in the Figure III-1 of PLG-0276, rev. 1 (Oyster Creek Tornado Missile Analysis), the staff estimates the core damage frequency from high winds and tornadoes to be less than the screening criterion of 1E-6 per year. The issues that arose as a consequence of the Systematic Evaluation Program for the plant have been considered resolved by the NRC, as noted in the IPEEE submittal on p. 5.2-11.

The plant therefore meets the intent of the 1975 Standard Review Plan criteria for the external flooding issue and no further analysis is required. In the response dated August 17, 2000, to an RAI the licensee adequately treated site flooding from the probable maximum precipitation event, as is discussed below under the GSI-103 heading. Transportation and nearby facility accidents were screened out in a manner consistent with the guidelines in NUREG-1407. See the attached TER on the HFO portion of the analysis for more details.

Dominant Contributors Seismic The licensee revised the seismic analysis in response to RAIs. In the revised analysis, the dominant sequences involved either turbine building failure or reactor building failure. In the original IPEEE submittal, failures of the turbine building and reactor building were not considered, and the dominant sequences involved a loss of offsite power, with failures of the diesel generators due to either soil liquefaction or direct seismic failure of the diesel generators, combined with failure of the combustion turbine and the isolation condenser.

Fire In the revised fire analysis, submitted in response to an RAI, the dominant fire areas, and their contribution to the fire core damage frequency, are:

ÿ Cable Spreading Room, 8.6E-6/yr

ÿ 480 VAC Switchgear Room, 5.1E-6/yr

ÿ Turbine Building Basement, 1.9E-6/yr These three dominant fire areas sum to 1.6E-5, while the total fire CDF was estimated at 1.9E-5/yr.

HFO The licensee primarily used a screening approach consistent with NUREG-1407 for the HFO analysis, and dominant contributors were not obtained.

Assessment of Licensee's Determination of Dominant Contributors The licensee appears to have correctly identified the dominant contributors to the core damage frequency, for seismic and fire events.

Containment Performance Seismic The IPEEE submittal states, in Section 3.1.6.1, that all building structure fragilities exceeded 1.0g peak ground acceleration capacity, and were screened from further considerations.

Consequently, there are no vulnerabilities with respect to structural containment failure, according to the licensee's analysis.

The licensee notes, in Section 3.1.6.2 of the IPEEE submittal, that all primary containment isolation valves screen with estimated capacities greater than 1.0g. All primary containment isolation signals were screened out for potential relay chatter. Consequently, there are no

vulnerabilities with respect to containment isolation, according to the licensee's analysis. The licensee evaluated containment bypass sequences and found them to be of no concern.

Fire The licensee did not find any potential containment performance issues associated with the fire initiator. More information is given in the attached TER on the fire portion of the IPEEE submittal.

HFO NUREG-1407 does not require a containment performance analysis for HFO events if the screening criteria given in Chapter 5 of NUREG-1407 are met, so that the event core damage frequency can be considered to be less than 1E-6 per year.

Assessment of Licensee's Containment Performance Analysis The licensees containment performance analyses appear to have considered the important containment performance issues and are consistent with the intent of Supplement 4 to GL 88-20.

Generic Safety Issues As a part of the IPEEE, a set of generic and USI A-45, GSI-131, GSI-103, GSI-57, and the Sandia FRSS issues were identified in Supplement 4 to GL 88-20 and its associated guidance in NUREG-1407 as needing to be addressed in the IPEEE. The staffs evaluation of these issues is provided below.

1. USI A-45, "Shutdown Decay Heat Removal Requirements" The licensee performed an acceptable seismic PRA, which would have found any vulnerabilities associated with seismically-induced loss of decay heat removal. The fire PRA performed by the licensee would find any vulnerabilities associated with loss of decay heat removal as a result of fires. Similarly, the licensees HFO analysis would identify any vulnerabilities associated with loss of decay heat removal initiated by HFO events.

Since the staff judges that the process used by the licensee is capable of finding decay heat removal vulnerabilities, and no vulnerabilities were found, the staff considers that the external events aspects of USI A-45 are resolved for OCNGS.

2. GSI-131, "Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants" OCNGS is a General Electric BWR, and, therefore, this issue is not applicable.

3. GSI-103, "Design for Probable Maximum Precipitation" This issue concerns itself with the fact that the National Weather Service has developed new Probable Maximum Precipitation (PMP) criteria, which give higher rainfall intensities over shorter time intervals and smaller areas than had previously been considered.

Section 2.4 of NUREG-1407 requests that licensees assess the effects of these new PMP criteria in terms of onsite flooding from flood runoff and site ponding, and in terms of greater roof ponding. More information on this issue is given in GL 89-22.

The licensee evaluated the effects of the new PMP criteria in a response (dated August 17, 2000) to an RAI. The staff judges the licensees analysis as adequate.

Details concerning the staff review of the PMP event are given in the attached TER on the HFO portion of the IPEEE submittal.

On the basis that the licensee's procedure for identifying severe accident sequences associated with the PMP is consistent with the guidance provided in Section 6.2.2.3 of NUREG-1407, and on the basis that no vulnerabilities were found, the staff considers that GSI-103 is resolved for OCNGS.

4. GSI-57, "Effects of Fire Protection System Actuation on Safety-Related Equipment" Inadvertent actuation of fire suppression equipment could be initiated as a result of a seismic event. NUREG-1472 ("Regulatory Analysis for the Resolution of Generic Issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment")

concludes that the dominant risk contributor associated with inadvertent fire protection system actuation is seismic actuation of the fire protection system.

In the IPEEE submittal (Section 4.8.1.4), the licensee notes that in areas where safety-related equipment is located, the fire protection systems are either manual or are automatic deluge systems which require redundant sensor/relay circuit closure for actuation of control valves and local head actuation. Sensitive electrical equipment is sealed and/or equipped with sheet metal or plastic spray shields to protect them from the effects of water intrusion. More information on this issue is given in Section 2.11 of the attached TER on the seismic portion of the IPEEE, and in Section 2.2.2 of the attached TER on the fire portion of the IPEEE.

The staff finds that the licensees GSI-57 evaluation is adequate and would likely have found any vulnerabilities if they existed. No vulnerabilities were found. Therefore, the staff considers this issue resolved for OCNGS.

5. Fire Risk Scoping Study (FRSS) Issues Several of these issues are also generic safety issues which are discussed separately.

These generic issues include GSI-57, discussed above, and GSI-148, "Smoke Control and Manual Fire Fighting Effectiveness," and GSI-147, "Fire-Induced Alternate Shutdown/Control Room Panel Interactions." The FRSS issues are discussed in Section 4.8 of the IPEEE submittal. A part of GSI-148 concerns misdirected manual fire

suppression activities caused by smoke. The smoke can cause obscuration of vision to the point where the fire source cannot be located. As a result, misdirected manual fire suppression could damage equipment not damaged by the fire. As noted in Section 2.2.4 of the attached TER on the fire portion of the IPEEE submittal, this part of GSI-148 is not addressed by the licensee in their IPEEE submittal. As for the other FRSS issues, the staff considers these issues to be resolved for OCNGS on the basis that the licensees process for evaluating these issues would have likely found vulnerabilities associated with the issues, and the licensee found no plant vulnerabilities in their evaluation.

Other Generic Safety Issues In addition to those safety issues discussed above that were explicitly requested in Supplement 4 to GL 88-20, four generic safety issues were not specifically identified as issues to be resolved under the IPEEE program; thus, they were not explicitly discussed in Supplement 4 to GL 88-20 or NUREG-1407. However, subsequent to the issuance of the GL, the NRC evaluated the scope and the specific information requested in the GL and the associated IPEEE guidance, and concluded that the plant-specific analyses being requested in the IPEEE program could also be used, through a satisfactory IPEEE submittal review, to resolve the external event aspects of these four safety issues. The initial evaluation of these GSIs is given in the attached TERs. In two cases, where the evaluation in the attached TER on the fire portions of the analysis was inadequate to resolve the external aspects of these issues, the NRC staff performed additional reviews to arrive at a satisfactory conclusion. The following discussions summarize the staffs evaluation of these safety issues at OCNGS.

1. GSI-147, "Fire-Induced Alternate Shutdown/Control Room Panel Interactions" This issue includes the following:

• Electrical independence of remote shutdown control circuits

• Loss of control power before transfer from the main control room to the alternate shutdown panel

• Total loss of system function

• Spurious actuation of components leading to component damage, Loss of Coolant Accident (LOCA), or interfacing LOCA The discussion in the IPEEE submittal (see Section 4.8.5 of the submittal) is very brief, and is insufficient to know, for example, the likelihood of multiple hot shorts resulting in spurious actuation of components and their failure, before control can be transferred to the remote shutdown panel in a control room fire. The licensee did not take credit for the alternate shutdown panel in its analysis of a control room fire, and hence these interactions were not analyzed as part of the licensee's IPEEE analysis. Even without taking credit for the remote shutdown panel, the contribution of control room fires to the CDF was conservatively estimated as 3.3E-7 per year in the IPEEE submittal. The primary reason for the low contribution of control room fires to the CDF is that the critical

control room panels are protected by Halon systems (see p. 4.6-20 of the IPEEE submittal). Because of the low contribution of control room fires to the CDF without taking credit for the remote shutdown panel, control-room/remote-shutdown-panel interactions are not risk significant. In addition, control-room/remote-shutdown-panel interactions are analyzed to a certain extent in the plant Fire Hazards Analysis Report.

Accordingly, the staff judges that OCNGS has no vulnerability with respect to this issue, and the staff considers this issue resolved for OCNGS.

2. GSI-148, "Smoke Control and Manual Fire-Fighting Effectiveness" As already noted above under the discussion of the FRSS issues, the issue of smoke-induced misdirected fire suppression activities, which is part of GSI-148, was not considered by the licensee. Other aspects of manual fire-fighting effectiveness are generally not relevant to the licensee's analysis, since manual fire fighting is not explicitly credited in the fire scenarios. However, the licensee does address the steps taken at the plant to improve effectiveness of manual fire fighting. Section 2.2.4 of the TER on the fire portion of the IPEEE submittal further evaluates the licensees treatment of this issue.

On the basis of the information presented by the licensee, the staff considers GSI-148 resolved for OCNGS, except for the part of the issue dealing with misdirected manual fire suppression activities that could potentially fail equipment that is not failed by the fire.

3. GSI-156, "Systematic Evaluation Program (SEP)"

The SEP issues are a set of issues associated with plants that were licensed prior to the time the 1975 Standard Review Plan was issued. OCNGS was one of ten plants selected for detailed review in Phase II of the SEP. The SEP issues have already been resolved for OCNGS. (See NUREG-0822, January 1983, and NUREG-0822, supplement 1, July 1988.)

4. GSI-172, "Multiple System Responses Program (MSRP)"

ÿ Effects of fire protection system actuation on non-safety-related and safety-related equipment This is issue GSI-57, and is discussed under that heading. See also Section 2.2.2 of the attached TER on the fire portion of the IPEEE.

ÿ Seismically-induced fire suppression system actuation This is also part of GSI-57, and is discussed under that heading.

ÿ Seismically-induced fires This is an FRSS issue. Seismically-induced fires were addressed in the seismic capability walkdowns performed as part of the seismic IPEEE (see Sections 3.1.2.3.2 and 4.8.1.1 of the IPEEE submittal). The attached TER on the fire portion of the IPEEE submittal discusses seismically-induced fires in Section 2.2.5, and the attached TER on the seismic portion of the IPEEE discusses seismically-induced fires in Section 2.11.

ÿ Effects of hydrogen line rupture Section 4.8.1.1 of the IPEEE submittal notes that hydrogen piping in the turbine building was considered as part of the seismic/fire walkdowns.

ÿ The IPEEE-related aspects of common cause failures associated with human errors This issue, as far as external events are concerned, refers to whether the treatment of human errors in an external-event-initiated accident sequence properly takes into account the impact of the external event on human actions.

Human error probabilities in seismic events are discussed in the attached TER on the seismic portion of the IPEEE submittal. Although there may be some optimistic assumptions in the treatment of human error in the seismic analysis, sensitivity analyses performed by the licensee indicate that results are not sensitive to the values of the human error probabilities assumed.

As noted in Section 2.1.5 of the attached TER on the fire portion of the IPEEE submittal, the licensee credited only two recovery actions in the fire analysis. The TER notes that although a detailed analysis of fire-specific human errors was not performed by the licensee, it does not appear that a special treatment of human errors was necessary.

The screening analyses used for the HFO analysis do not require an explicit human error analysis.

ÿ Non-safety-related control system/safety-related system dependencies As far as the IPEEE is concerned, this issue reduces to that of seismically induced spatial and functional interactions, an MSRP issue discussed below, and GSI-147, on fire-induced alternate shutdown and control room panel interactions, which has also already been discussed.

ÿ Effects of flooding and/or moisture intrusion on non-safety-related and safety-related equipment Flooding from external floods is discussed in the HFO portion of the IPEEE (see Section 5.2); the staff evaluation is given in attached TER on the HFO portion of the IPEEE. Flooding from the actuations of fire protection systems is a GSI-57 issue, and is discussed under that heading. Seismically-induced flooding is discussed below, under "Seismically-induced flooding."

ÿ Seismically-induced spatial and functional interactions Seismically-induced spatial interactions were addressed by the licensee in the seismic walkdowns, as is noted on p. 3-145 of the IPEEE submittal, in the paragraph on USI A-17, "Systems Interactions in Nuclear Power Plants." Functional interactions are incorporated in the seismic PRA logic models.

ÿ Seismically-induced flooding As noted in Section 2.11 of the attached TER on the seismic portion of the IPEEE submittal, the licensee states that the breaching of two small dams on Oyster Creek from any unspecified cause would not result in flooding of any safety-related structure.

Seismic-induced actuation of the fire protection system is part of GSI-57, and is discussed under that heading.

There is no explicit mention of seismically-induced tank failures. However, the paragraph on USI A-17 in the IPEEE submittal (see p. 3-145 of the IPEEE submittal) indicates that seismic spatial interactions were considered in the walkdowns. One expects that these walkdowns would consider seismically-induced tank failures.

ÿ Seismically-induced relay chatter The attached TER on the seismic portion of the IPEEE notes that the detailed evaluation of seismic-induced relay chatter is one of the strengths of the IPEEE submittal.

ÿ Evaluation of earthquake magnitudes greater than the safe shutdown earthquake (SSE)

The licensee used a seismic PRA for the seismic analysis. This automatically includes the effects of earthquake magnitudes greater than the SSE.

Based on the overall results of the IPEEE submittal review, the staff considers that the licensees process is capable of identifying potential vulnerabilities associated with GSI-172.

Since no potential vulnerability associated with these issues was identified in the IPEEE submittal, the staff considers the IPEEE-related aspects of these issues resolved for OCNGS.

Unique Plant Features, Potential Vulnerabilities, and Improvements The OCNGS IPEEE submittal defines a vulnerability as any core damage sequence whose frequency exceeds 1E-4 per year or any large early containment failure sequence whose frequency exceeds 1E-6 per year (see Section 1.5.3 of the IPEEE submittal). No vulnerabilities were identified in the IPEEE study.

The IPEEE submittal notes (see Section 7.2) that the OCNGS has two redundant isolation condensers (ICs) which operate independently of AC power. Multiple makeup sources to the IC are available, including fire protection water supplied by diesel-driven fire pumps. Decay heat removal is also possible through DC powered Electro-Matic relief valves rejecting heat to the torus. If an injection source for the reactor pressure vessel is available, this decay heat path

can be maintained indefinitely even without torus cooling, since a hardened pipe vent can be used to protect the containment from overpressure.

With respect to plant improvements for the seismic initiator, the IPEEE submittal recommended ensuring all bolts on the Forked River Combustion Turbine fin-fan coolers are installed and torqued properly. This improvement has already been implemented; additional bolts were installed in some cases. An additional improvement under consideration, the addition of battery spacers in the Combustion Turbine battery compartments, was not carried out, after further review. With respect to the fire initiator, the improvements being evaluated by the licensee, at the time of the IPEEE submittal, included:

• Upgrades of the anchorage of the high pressure CO2 system in the turbine building and CO2 rack located outside the turbine building, and additional support for the turbine generator hydrogen seal oil unit.

• Replacement of drop-weight actuated deluge valves in fire suppression systems which potentially can be seismically actuated.

• Modification of the anchorage of the Arrowhead Demineralizer trailer that, during a seismic event, could inadvertently initiate the station blackout transformers fire suppression system.

3.0 CONCLUSION

S On the basis of the above findings, the staff notes that the IPEEE results are reasonable given the OCNGS design, operation, and history. Therefore, the staff concludes that the licensees IPEEE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities, and therefore, that the OCNGS IPEEE has met the intent of Supplement 4 to GL 88-20. The specific generic safety issues discussed in this SER are considered resolved by the staff, except for the portion of GSI-148 (and the associated FRSS issue) related to misdirected manual fire suppression. The need for any additional assessment or actions related to the resolution of this issue for OCNGS will be addressed by the NRC staff separately from the IPEEE program.

It should be noted that the staff focused its review primarily on the licensees ability to examine OCNGS for severe accident vulnerabilities. Although certain aspects of the IPEEE were explored in more detail than others, the review was not intended to validate the accuracy of the licensees detailed findings (or quantification estimates) that underlie or stemmed from the examination. Therefore, this SER does not constitute NRC approval or endorsement of any IPEEE material for purposes other than those associated with meeting the intent of Supplement 4 to GL 88-20 and the resolution of specific generic safety issues discussed in this SER.

Attachment 1 TECHNICAL EVALUATION REPORT ON THE SEISMIC PORTION OF THE OYSTER CREEK NUCLEAR GENERATING STATION INDIVIDUAL PLANT EXAMINATION FOR EXTERNAL EVENTS

SUBMITTAL-ONLY SCREENING REVIEW OF THE OYSTER CREEK NUCLEAR STATION INDIVIDUAL PLANT EXAMINATION FOR EXTERNAL EVENTS (Seismic Portion)

(Initial Draft, February 1997)

(Revision 1, August 1998)

(Revision 2, July 2000)

(Finalized December 2000)

Brookhaven National Laboratory

ACRONYMS BNL Brookhaven National Laboratory BWR Boiling Water Reactor CDF Core Damage Frequency CRD Control Rod Drive EDG Emergency Diesel Generator EDGB Emergency Diesel Generator Building EPRI Electric Power Research Institute FV Fussell-Vesely GL Generic Letter GPU General Public Utilities Corporation GSI Generic Safety Issue HCLPF High Confidence of Low Probability of Failure HEP Human Error Probability HRA Human Error Analysis IC Isolation Condenser IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events LLNL Lawrence Livermore National Laboratory LOCA Loss-of-Coolant Accident LOOP Loss of Offsite Power MSIV Main Steam Isolation Valve NRC Nuclear Regulatory Commission OBE Operating Basis Earthquake PLG Pickard, Lowe and Garrick PRA Probabilistic Risk Assessment RAI Request for Additional Information RWCU Reactor Water Cleanup

ÿÿ

SDV Scram Discharge Volume SRT Seismic Review Team SSE Safe-Shutdown Earthquake SSI Soil Structure Interaction SSMRP Seismic Safety Margin Review Program TBCCW Turbine Building Closed Cooling Water UHS Uniform Hazard Spectrum USI Unresolved Safety Issue VDC Volts direct current

ÿ ÿ

1. INTRODUCTION 1.1 Purpose In response to the NRC issued Supplement 4 to Generic Letter (GL) 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f)., the General Public Utilities (GPU) Nuclear Corporation performed an IPEEE for the Oyster Creek Nuclear Station, and submitted the IPEEE results to NRC (Reference 1). Brookhaven National Laboratory (BNL), as requested by NRC, performed the submittal-only screening review to verify the technical adequacy of the seismic portion of GPUs IPEEE submittal. As a result of this review NRC sent a Requests for Additional Information (RAI) and subsequently a supplemental RAI (Reference 2) to GPU. GPU responded to the RAIs in the attachments to the May 21, 1998 (Reference 3) and the June 29, 2000 letter (Reference 4),

respectively, to NRC. This Screening Review presents the results and conclusions of the BNL review and evaluation of both the original submittal and the subsequent licensees responses to the RAIs.

BNLs methodology utilized for the review followed the guidelines provided in the document titled Guidance for the Performance of Screening Reviews of Submittals in response to USNRC Generic Letter 88-20, Supplement 4" (Draft, Oct. 24, 1996).

1.2 Background The Oyster Creek Nuclear Generation Station is a single unit General Electric boiling water reactor (BWR-2) with rated power of 1935 MWt housed in a Mark-I containment. Initial criticality was achieved on May 3, 1969 and the plant was placed in commercial operation on December 23, 1969. The site is located near the Atlantic Ocean about 9 miles south of Toms River, New Jersey. The cooling water is drawn from Barnegat Bay through a canal following the south branch of Forked River and discharged through another canal following Oyster Creek back to the Bay.

The Safe Shutdown Earthquake (SSE) for the site is 0.18 g, and the plant is binned in the 0.3 g focused-scope review category. A significant site-specific feature is a relatively high potential of soil liquefaction, which is estimated to have a median fragility value of 0.4 g.

GPU Nuclear performed a newly developed PRA for seismic as well as other external events. The system analysis was performed using a PC software package, RISKMAN, with the primary contractor PLG, Incorporated providing technical assistance. The development of the site specific response spectra and fragility analysis were performed by EQE International.

1.3 Licensees IPEEE Process and Licensees Insights The overall PRA process is considered to be consistent with the PRA methodology described in NUREG-1407. The original seismic hazard analysis was performed using both the EPRI and the revised LLNL approaches, and the quantification was conducted for both the hazard curves. The evaluation of the soil liquefaction was performed by Geomatrix Consultants. A median fragility value of 0.4 g was estimated for the initiation of liquefaction. The submittal concluded that the reactor building itself is not affected by soil liquefaction, but two essential facilities, i.e., Emergency Diesel Generation Building (EDGB) and Fire Protection piping, are estimated to fail due to liquefaction. In preparation of the fragility analysis, a list of 3

safety-related components (a total of 1086 components) was prepared based on the IPE study and the USI A-46 study. The number of components was reduced to 230 after the initial screening. New soil structure interaction (SSI) analyses were performed for the Reactor Building, Turbine Building, Intake Structure, and EDGB, based on the seismic safety margin review program (SSMRP) approach to account for the variabilities both in the ground motions and structural properties. The walkdowns were performed to further screen the components and to evaluate relays. A substantial change was made to the component list. The remaining component results are given in Table 3-6 of the submittal. A detailed relay evaluation was performed based on the guidelines for EPRI NP-7148-SL, which consists of circuit evaluation, seismic adequacy evaluation and relay walkdowns. All the essential relays were identified and fragility parameters were calculated as listed in Table 3-7 of the submittal. No recovery was modeled in the logic models. The structural failure of electric panels was also considered for those with an estimated seismic capacity less than 1.0 g.

In the system analysis, fifteen seismic top events were developed, which are complements of the internal event top events. In addition, the independent offsite power recovery was added as part of the long term general transient top events.

The results of the original IPEEE study identify no vulnerability due to seismic events. The calculated CDF using the EPRI hazard curve was 3.6E-6/ry, which is 29% of the total external event CDF of 1.23E-5/ry.

However, using the revised LLNL hazard curves, a higher value of 6.36E-6/ry was obtained, which is 42%

of the total external event CDF. According to the quantification scheme, with the EPRI approach four (4) discrete earthquake events (or acceleration bins) at 0.13 g, 0.36 g, 0.54 g, and 0.72 g were considered for a point estimate. The seismic event with ground acceleration of 0.54 g dominated the core damage frequency (CDF) accounting for 44% of the total seismic CDF. The dominant seismic sequences involved failure of offsite power, diesel generators, isolation condenser and the nearby combustion turbines. It should be noted that only transient initiators were considered in the seismic event IPEEE. All the potential LOCA initiators were screened out following walkdowns.

According to sensitivity studies of the original submittal, the removal of relay chatter results in a 65.3 %

decrease in the CDF value. Also, the removal of failure of an unreinforced concrete block wall, which would cause a failure of 125 VDC distribution center B, results in a 63.6 % decrease. If ventilation failure is assumed not to occur a decrease of over 70 % in the CDF value is achieved. Other factors, including human errors and offsite recovery, were determined to be minor.

As noted in Section 1.1, after the completion of NRCs screening review of the original submittal, an RAI and an SRAI were sent to GPU. They covered the following areas:

(i) More detailed descriptions on the human actions; (ii) Modeling of off-site recovery via combustion turbines, including operator actions and component fragilities; (iii) Reason for Screening out all LOCA events; (iv) Rationale for the screening criteria of a HCLPF capacity of 0.3 g; (v) Request for fragility report by EQE International; and (vi) Concerns regarding the use of non-safety systems in the PRA model.

GPU provided responses to the RAI and SRAI (References 3 and 4), which were reviewed and the evaluations are presented in the relevant sections of this report. According to the GPUs responses, the Oyster Creek seismic PRA was modified to address the concerns raised by NRC in the RAI and SRAI. The 4

seismic model was revised to incorporate the following changes:

• Correction of fire protection split fraction.

• Extrapolation of the hazard curve from 0.82g to 1.5g.

• Addition of the turbine and reactor buildings fragility.

• Revision of HEP value for makeup to isolation condenser.

• Incorporation of the failure of recirculation pumps supports.

The total seismic CDF computed from the revised seismic model is 4.74E-06/ry, representing an increase of approximately 33% over the seismic CDF reported in the original IPEEE submital. In the revised analysis turbine building and reactor building failure are dominant since their failure leads directly to core damage.

In the licensees revised model the contributions from the four acceleration bins are 7.2%, 35%, 29.5%, and 28.3%. The center points of the lowest three ranges are unchanged, but the highest bin is now centered at 1.06g.

According to the licensees SRAI response, the generic screening threshold fragility was not incorporated in the revised seismic model. However, the effect of the generic screening threshold fragility on the seismic CDF was estimated, which resulted in an increase in the seismic CDF of about 22% over the seismic CDF reported in the original IPEEE submittal. The revised seismic PRA analysis again identifies no vulnerability due to seismic events.

2. REVIEW FINDINGS 2.1 IPEEE Format and Methodology Documentation The submittal appears to be consistent with the guidelines of NUREG-1407. The study addressed all the issues that are emphasized in NUREG-1407, including plant walkdowns, relay chatter, soil liquefaction, nonseismic failure, human actions and containment performance. The submittal and the subsequent RAI and SRAI responses together provided sufficient information for the review and evaluation of the licensees implementation of the IPEEE program. Generic issues specified in NUREG-1407 were also addressed.

2.2 Seismic Review Team Selection The seismic review team (SRT) consisted of personnel from GPU Nuclear Corporation, who are familiar with the systems and operation procedures, and various consultants, including EQE International and Geomatrix Consultants. Although the selection procedure for the SRT is not addressed in detail as a separate subject, it is concluded that the SRT selection meets the NUREG-1407 objectives.

2.3 Hazard Analysis The study used both the EPRI and the revised LLNL approaches to obtain the seismic hazard curves.

According to the quantification scheme, four (4) discrete earthquake events at 0.13 g, 0.36 g, 0.54 g, and 0.72 g were considered (for the case where the EPRI approach was used). It is stated in the original IPEEE submittal that the upper bound of the hazard curves is 1.0 g. According to the response to the SRAI, the licensee revised the seismic model to extend the upper bound of the hazard curve to 1.5g, which meets the requirement of the NUREG/CR-1407. This revision resulted in an increase in the seismic CDF of about 14

% over the original computation in the submittal. For fragility estimates, a site-specific Uniform Hazard 5

Spectrum (UHS) was obtained from the median hazard curve (EPRI approach) at a return period of 10,000 years. The method seems to be appropriate, and the UHS, which was provided in the RAI response, (Figure 3-1), appears reasonable.

2.4 Components Selection The safety-related components were identified based on the recent IPE study and the A-46 component list, and a component list is provided in Table 3-3 of the submittal. The list does not include some components such as battery racks, cable trays, ducts, electric penetrations and bellows. Also, the recirculation pumps, whose support failure may lead to a large LOCA, were not included in the original seismic model, but were included in the revised seismic model using the generic threshold fragility as reported in the licensees response to an SRAI (Reference 4). In addition, the failures of reactor and turbine buildings were also included in the revised seismic model. A total of thirteen (13) criteria were used for the initial screening.

Among 1086 components originally identified, a total of 230 components were screened-in. An initial walkdown was conducted to verify screening criteria and generic high capacity components, plant unique features, as well as potential system interactions. This procedure seems to be appropriate.

2.5 Plant Walkdown Approach The submittal states that a series of walkdowns were performed including the initial site walkdown, structural and component fragility walkdowns, and relay walkdowns. Walkdowns are not described as a separate subject, and it is not clear whether the walkdown procedures are consistent with the guidelines of the EPRI NP-6041 document. A significant change in the component list was made after the walkdowns, and the findings of the walkdowns seems to be reflected in the component fragility estimates.

2.6 Fragility Analysis 2.6.1 Structural Response Analysis The submittal states that a new set of soil-structure interaction analyses were performed for the Reactor Building, Turbine Building, Intake Structure, and Emergency Diesel Generation Building. The analyses are based on the SSMRP-type approach, and the variabilities in both the ground motions and structural properties are considered in multiple time history analyses. Although the details of the structural analyses are not provided in the submittal, the procedure as well as the evaluated variabilities in fragility values listed in Table 3-2 seem to be appropriate.

2.6.2 Structural Fragility Analysis The structural fragility analysis was performed by EQE International, and described in a separate report which was not originally available to the reviewers. Due to the high likelihood of soil liquefaction, the fragilities of many structures are determined by soil related failure modes. The soil related structural failures are based on a series of assumptions, which seem to be somewhat questionable. For example, the failure of the fire water piping is estimated to be caused by the sliding of the fire pump house. Although the sliding is estimated to start at 0.36 g, the median fragility of the fire water piping is estimated to be 1.21 g. Also, the estimated median capacity of 0.66 g for the Combustion Turbine Fuel Oil Tank appears to be too high 6

for this type of unanchored flat bottom tank. The listed variabilities (ÿ-values) for structures seem to be in-line with those in past seismic PRAs. One exception may be the randomness (ÿR) of the EDGB of 0.14 due to soil liquefaction. Considering a highly probabilistic nature of soil liquefaction, this ÿ-valve seems to be too low. This issue was raised during a conference call with the licensee prior to the licensees response to the SRAIs, and the licensee agreed to address this concern in the response. However, the licenseeresponse to the SRAIs, as reported in Reference 4, does not address this issue.

In the submittal, it is stated that the lower tail of the fragility curves was cutoff. However, no specific descriptions, such as the threshold of cutoff and the effects of cutoff on the calculated frequency values, were provided.

As part of the response to the RAIs new floor spectra (EPRIs UHS) and A-46 spectra were provided by GPU, which indicate that the IPEEE spectral values are about 1/3 of the A-46 site specific analysis results.

Therefore, the screening criterion of 0.3 g HCLPF is approximately equal to the OBE level (screening = 1/3 x 0.3 g = 0.1 g, SSE = 0.184 g).

According to the GPU response to an SRAI, the annual failure probability of 8.8E-6for an individual component when using the threshold fragility of 0.3 g HCLPF convolving with the mean hazard curve was a mistake as reported in both the original submittal and the RAI response. The correct annual failure probability should be 1.1E-06. In addition, according to the response to an SRAI, a sensitivity study was performed to assign the threshold fragility to those top events whose components were screened out at 0.3g HCLPF. The effect of this on CDF was estimated, and was found to produce a 22% increase in the seismic CDF value.

The structural failure of the reactor and turbine building was not considered in the original seismic model.

However, the revised seismic model, as reported in the licensees response to the SRAIs, included the reactor and turbine building failure mode, which resulted in an increase of 50% in the seismic CDF value.

2.6.3 Component Fragility Analysis After additional detailed screening of the 230 initially screened-in components, fragility parameters (median g-value, ÿu, ÿr and HCLPF) were evaluated for a total of 27 components. Many non-safety systems such as feedwater, instrument air, TBCCW etc. were removed from the list based on low capacity. These items were guaranteed failed in the model. The overall impression of the evaluated fragility parameters is favorable and they seem to be in line with existing fragility data. However, the evaluation methodology, e.g., either generic or plant-specific, is not described in the submittal.

As part of their response to the RAIs, GPU provided the equipment fragility analysis report by EQE International. The UHS was used to obtain the new floor spectra, which were then compared and enveloped by the Safe Shutdown Earthquake (SSE) spectra as illustrated in Attachment B to the licensees SRAI. The screening criteria as discussed in section 2.6.2 of this report and the methodologies for the component fragility evaluations appear appropriate.

The use of non-safety systems in the seismic model was also addressed by the licensee in their response to an SRAI. The evaluation procedure appears reasonable. The results, however, could not be verified by this review.

7

Finally, the recirculation pumps, whose support failures have been found important in other BWR analyses, were screened out in the original seismic model. However, according the licensees SRAI response, these pumps were incorporated in the revised seismic model: using the threshold fragility and the revised seismic CDF represents an increase of 3% over the original calculated seismic CDF value.

2.7 Soil Evaluation The potential for earthquake induced soil liquefaction and ground failures were evaluated for the site by Geomatrix Consultants. The likelihood of soil liquefaction for varying water table conditions was evaluated and expressed in terms of probabilities of occurrence conditional on the occurrence of a given ground acceleration. It is estimated that soil liquefaction is expected to occur at a peak ground acceleration of 0.40 g at the locations of the EDGB and the fire protection piping. The evaluation procedure of soil liquefaction seems to be appropriate, and the evaluated results seem to be reasonable. As part of the responses to the RAIs, GPU provided both the liquefaction analysis report by Geomatrix and the structural analysis report by EQE International. Based on the review of the provided documents, the procedure to account for the soil liquefaction in structural fragility analysis also seems appropriate.

2.8 Relay Chatter Evaluation The detailed evaluation of relay chatter is one of the strengths of this submittal. The relay evaluation was performed in accordance with the guidelines of EPRI NP-7148-SL, which consists of circuit evaluation, seismic adequacy evaluation, and relay walkdowns. All the essential relays were identified and fragility parameters were tabulated in Table 3-7. No recovery was modeled in the logic model. The structural failure of electric panels was also considered for those with an estimated seismic capacity less than 1.0g. Both the evaluation procedure and documentation are considered to be consistent with the guidelines of NUREG-1407.

In the submittal, it is stated that relays which do not meet the A-46 requirements will be replaced. Since the IPEEE analysis is based on the assumption that these low-capacity relays are replaced, the implementation of the relay replacements should be confirmed.

2.9 Containment Performance The effect of seismic events on the containment performance has been evaluated from two perspectives: First is the seismic structural capacity of the drywell, and the second is the performance of the containment isolation function following a seismic event. Wetwell capacity is not mentioned. The drywell structural capacity is estimated to be higher than 1.0g. Also, the isolation adequacy was evaluated by checking both isolation valves and potential relay chatter in the isolation signals. All the items were estimated to be higher than 1.0g. Containment bypass was considered based on the important bypass sequences from the internal events IPE. Only those important fragilities were evaluated which related to such sequences (Reactor water cleanup (RWCU) relays, scram relays, and LOCAs outside containment). They were found to be of no concern.

2.10 Nonseismic Failures and Human Actions Non-seismic failures and human error probabilities were included in the model. The internal events model 8

was used, with seismic failures of components added. Additionally, certain passive components failures were added (building failures, block wall failures, pipe ruptures, heat exchanger failures, tank failures, etc.). The only piping ruptures considered were in the fire protection system. Seismic interaction of various components was considered.

In the area of the human reliability analysis, no recovery actions were credited (a pessimistic feature of the model), except for the near offsite power recovery via the combustion turbines (this is an outside-of-control room action). The combustion turbines can be powered by either fuel oil or natural gas. The latter method is not credited (assumed rupture of the gas pipe). There is discussion in the submittal of this recovery action however, such as timing, any consideration of detrimental effects such as from the postulated breach of the natural gas piping leading to the combustion turbines, instrumentation required, etc. In response to an RAI, it appears the licensee credits this recovery in relatively short time periods after the seismic event (30 minutes and 60 minutes). This may be questionable, especially since outside-of-control room actions are required (control and instrumentation for the turbine is located on the emergency switchgear room, and local startup of this offsite turbine is required if the remote offsite operator is unavailable). However, these actions have a relatively low risk achievement worth (up to 1.11) which means the potential impact on the CDF is not great. There are concerns remaining about modeling of other failures associated with this recovery action (see section 2.12), again however the impact of these concerns on the CDF is not large as explained above.

Similarly, there is no discussion in the submittal of any other operator actions which are included in the model, their timing and the effect of the seismic event on the performance of the actions. The same human error probability (HEP) values as in the IPE were apparently kept here, even though there would be additional stress, obstructions, etc., in a large earthquake. The RAI responses indicate that seismic considerations affected HEPs, but it is not clear how, other than disallowing some recovery actions. Out of control room actions were predicted, and, again, apparently the same HEPs as in the IPE were used. The licensee states, (without elaboration), that their analysis indicates there would be no access problems due to earthquakes for such actions. It is stated that symptom-based EOPs would be used in a seismic event, and therefore their IPE analysis and HEP values apply there as well. The HRA seems to be optimistic since the operating environment after a large earthquake would likely be more complicated compared to that of an internal initiating event. A list of the 15 most important HEPs is shown in the RAI responses (sorted by risk achievement worth).

A sensitivity analysis was performed for the out-of-control-room actions, which found that increasing those HEPs by an order of magnitude, only resulted in a 4.2% increase in the CDF. This would indicate that such HEPs are not important.

In response to an SRAI the licensee did perform a study related to the HEP for firewater makeup to the isolation condenser. The concern is that spurious actuation of firewater elsewhere in the system will divert sufficient flow such that an operator action could be necessary to find and isolate the diversion. Increasing the firewater makeup HEP from the IPEEE value of 4E-4 to a screening value of 0.1, resulted in a 5.6%

increase in the seismic CDF (from 3.6E-6/yr to 3.8E-6/yr).

2.11 Seismic Induced Fires/Floods No discussion in the submittal is provided regarding any seismic/flood interactions, whether internal or external. The IPEEE submittal contains a section on external flooding, with no specific reference to seismic concerns. It is stated that breaching of two small dams on Oyster Creek from any unspecified cause would 9

not result in flooding of a safety related structure.

The fire analysis section of the IPEEE provides a discussion of the seismic/fire walkdown and interaction analysis. It seems the walkdown was comprehensive and noted any potential fire sources. The potential for inadvertent operation of the fire suppression system was evaluated and a sensitivity study on its effect on firewater makeup to the isolation condenser was performed (see Section 2.10).

The conclusion is that no sources of seismic induced fire initiation at reasonable levels of earthquake beyond the design basis were identified. Words such as nominal earthquake appear elsewhere in this section. It is not clear whether the licensee considered the same ground acceleration levels as in the seismic study for this evaluation. It appears that this was mostly a qualitative evaluation.

In the area of inadvertent fire suppression actuation, it is noted that electrical equipment is usually well protected by shields or is sealed. Usually, manual actuation of fire suppression is required, or several sensors/relays have to actuate in order to initiate fire suppression in a given area. However, in the latter case, a seismic event may include common mode failures of several sensors or relays (e.g., a high correlation factor). Several instances were noted where dropweight actuation is used, and where fire panels are mounted on block walls. The proximity of an unanchored trailer next to fire suppression piping in the vicinity of the SBO transformer was also noted. The failure of this transformer due to spray from ruptured fire suppression piping impacted by the trailer was apparently not considered, or was screened out.

In conclusion, the seismic/fire/flood interactions were not directly considered in the seismic PRA, but were qualitatively screened in the fire analysis section, with some ambiguity as to which earthquake levels were included in the walkdown and the evaluation.

2.12 Logic Models The submittal states that the general transient logic model is used for quantifying the seismic core damage frequencies. There is only a passing reference that LOCAs were not found to be a concern at this plant.

There is no other mention in the submittal of consideration of LOCAs inside or outside the containment. It seems that seismic failure of the recirculation pumps was considered, but no fragility data or explanation of failure modes is given in the submittal. The seismic failure of recirculation pump supports is a concern in BWRs for inducement of large LOCAs. In response to an RAI, the licensee states that the EPRI margins method was used to screen out LOCAs at a HCLPF of 0.5 g. This is somewhat inconsistent with the PRA method used and masks LOCA contributions. In response to an SRAI the licensee performed a sensitivity analysis, including the recirculation pump support failure at the generic screening median capacity of 1.0g and HCLPF of 0.3g, and also provided an explanation of why such a fragility was appropriate. This resulted in a 3% increase in CDF, and adequately disposed of this issue.

Same type components always were assumed to fail together, i.e., with a correlation of one (e.g., core spray pumps fail together; the emergency diesel generators fail together, etc.). This is a pessimistic assumption of the model.

It is noted that, for the relay chatter evaluation, only relays with seismic capacities smaller than 1.0 g were included in the model. This will have some effect on the results. The relays so included are relatively few:

the diesel generator control cabinets, the containment spray logic panel and the core spray logic panel. In addition, for the containment isolation function relay chatter is assumed for the RWCU, MSIV and SDV 10

(scram discharge volume) isolation valves.

The RAI responses did not adequately address the concern about inclusion in the model of certain hardware failures associated with combustion turbine recovery: Seismic failures of 4 kV switchgear, blackout transformer and the underground cable from the turbine to the blackout transformer. However, the SRAI response did discuss such concerns in detail, along with the associated fragilities.

It seems that the analysis was thorough and all appropriate failure modes and components were included.

The same is true of firewater recovery to the isolation condenser, which is another non-safety system credited in the analysis. The original IPEEE analysis used erroneous (conservative) split fractions for the fire protection makeup to the isolation condenser. This was corrected in the SRAI responses, resulting in a substantial CDF decrease from 3.6E-6/yr to 1.3E-6/yr, but other adjustments to the model modified the seismic CDF further, with a final value of 4.7E-6/yr. The licensee correctly credited only the diesel driven fire pumps, and not the electrical pumps.

The following systems were assumed failed in any earthquake, due to low fragilities: circulating water, service water, TBCCW, instrument air, main condensate, main feedwater, standby gas treatment and the redundant fire pump. No further discussion was provided in the submittal.

In response to an SRAI regarding the use of the screening fragility (median capacity of 1.0g and HCLPF of 0.3g) which is non-conservative, the licensee performed a sensitivity study in which they assigned this fragility to components which were originally screened out, and requantified the model with such components included (for example, this included the AC and DC buses, containment vents, MSIVs, etc.).

This resulted in a 22% CDF increase from the base case of 3.6E-6/yr.

The licensee also included the reactor building and turbine building failures in the revised model. Such failures were assumed to lead directly to core damage and resulted in a 50% increase in seismic CDF.

The new CDF with all the model modifications is 4.7E-6/yr.

No dependency matrix was given in the submittal.

2.13 Accident Frequency Estimate Accident sequence frequencies were computed for the 4 acceleration ranges. Dominant sequences were described, along with Fussell-Vesely (FV) importance of the 10 dominant top events, seismic failures and independent top events.

The total CDF in the original IPEEE submittal is 3.63-6/yr, with 0.8% unaccounted for due to truncation.

Of the total, 3.5% is contributed by the lowest acceleration range (centered around 0.13g), 26.6%

contribution by the 0.36g level, 43.9% by the 0.54 g level and 26.0% by the 0.72 g level.

In response to an SRAI the licensee performed several model adjustments (see Section 2.12), and also extrapolated the seismic hazard curve to 1.5g. All these changes resulted in a new CDF of 4.7x10-6/yr, a 33%

increase. In the licensees revised model the contributions from the four acceleration bins are 7.2%, 35%,

29.5%, and 28.3%. The center points of the lowest three ranges are unchanged, but the highest bin is now centered at 1.06g.

11

In the original IPEEE submittal results were also calculated for the LLNL hazard curves (with an acceleration level up to 1.01 g). In that case, the total CDF was 6.4x10-6/yr, with the following contributions (of the representative acceleration levels): 0.4% (0.18g), 9.8% (0.38 g), 60% (0.62 g) and 30% (0.89 g). A peculiar result is that the highest acceleration range for the LLNL hazard curves (0.77 g-1.01 g) produced a lower conditional core damage probability (0.671) than the highest acceleration range for the EPRI hazard curves (0.62g-0.82 g) (conditional core damage probability of 0.96), even though the LLNL acceleration levels are higher.

It should be noted that in the range of the ground acceleration levels equal to twice the safe shutdown earthquake, the conditional core damage probability was only 0.04 with the original analysis, and is only 0.06 with the revised analysis (range centered at 0.36g).

The submittal defines a vulnerability as a core damage frequency greater than 1E-6/yr and therefore no vulnerabilities were identified. However, two seismic modifications were proposed as discussed in Section 2.16 of this report.

2.14 Dominant Contributors The dominant sequences of the original analysis involved mostly a loss of offsite power, with failure of diesel generators (due to soil liquefaction, or EDG seismic failures), failures of the combustion turbines and the isolation condenser. In the revised analysis turbine building and reactor building failure are dominant since their failure leads directly to core damage. The dominant sequences identified appear reasonable.

While some insights are described with respect to the important system contributors in the submittal, there is no discussion of timing, operator actions and underlying uncertainties for the dominant sequences.

In the original study a sensitivity study was done, with respect to operator actions, to increase out-of-control room HEPs by a factor of 10. The actions affected are opening of the CRD bypass line, alignment of fire protection to isolation condenser (IC) makeup, offsite power recovery via combustion turbines, and transfer of the core spray suction to condensate storage tank. The IC makeup and combustion turbine power recovery would be expected to be important actions, as failures of the IC and combustion turbine recovery appear in many dominant sequences. However, the sensitivity study result was only a 4% increase in the CDF, indicating that these systems are still dominated by hardware failures. No similar sensitivity analysis was performed as part of the revised analysis.

The system importance ranking seems reasonable for the most part. In the revised study the Fussell-Vesely (FV) importance of seismic failure for the turbine building is 0.35, for the reactor building 0.097, for the emergency 4.2 kv switchgear failure 0.086, and for condensate tank failure 0.055. The independent (random) failure of IC makeup has an FV of 0.66. While the importance of the seismic failure of the offsite power (FV of 0.058) and combustion turbines (0.058) appears low at first glance, the licensee did substantially change the results and the dominant sequences from the original analysis version. Looking at the new dominant sequences one can see that the loss of offsite power is no longer a dominant player. A remaining apparent anomaly is that loss-of-offsite-power (LOOP) recovery importance is somewhat higher than LOOP importance. The FV importance of LOOP should be at least as high as that of the LOOP recovery, as one would expect that the failure of offsite power recovery would appear in the same sequences as the seismic failure of offsite power, therefore, their FV importance measures should be equal.

12

2.15 Unresolved Safety Issues and Generic Issues USI A-45 The potential component failures in the decay heat removal systems are incorporated in the logic models.

GSI-131 The Oyster Creek Nuclear Generation Station does not utilize a movable in-core flux mapping system; therefore, this issue is not applicable.

GSI-156 Liquefaction analysis was performed as part of the seismic PRA and the liquefaction related failure modes were addressed in the seismic model. Seismic design of structures, systems, and components was addressed in the submittal with respect to ground response spectra and in-structure response spectra.

GSI-172 GSI-172 issues were addressed in the submittal as follows:

The effects of fire protection system actuation was addressed in section 4.8.1.2 of the submittal. The evaluation seems to be in detail, and no unique vulnerabilities were observed except a concern regarding a potential ejection of halon stirring up dust and debris.

Seismic/fire interactions were addressed in section 4.8.1.1 of the submittal as discussed in section 2.11 of this report.

There is a qualitative discussion in section 4.8.1.1 of the submitted regarding hydrogen line ruptures.

Seismic-induced flooding is not discussed, except for the statement that the breaching of two small dams on Oyster Creek would not cause any problem.

Seismic-induced spatial and functional interactions were addressed as part of the walkdown procedures.

Seismic-induced relay chatter is discussed in section 2.8 of this review report.

Failures related to human errors were considered in the seismic analysis.

2.16 Vulnerabilities/Plant Improvements The submittal defines a vulnerability as any core damage sequence that exceeds 1E-4/yr, or any containment bypass sequence or large early containment failure sequence that exceeds 1E-6/yr. The seismic IPEEE did not identify any plant vulnerabilities. However, liquefaction induced failures were identified to be the most risk significant contributors. In addition, two potential plant modifications were identified for the combustion turbines.

Ensure all bolts on the Forked River Combustion Turbine fin-fan coolers are installed and torqued properly. (The SRAI responses indicate the licensee carried this improvement out and installed additional bolts in some cases.)

Consider the addition of battery spacers in the Combustion Turbine battery compartments. (The SRAI responses indicated that upon further review, subsequent to another walkdown, spacers were not added.)

13

3.0 OVERALL EVALUATION AND CONCLUSIONS The study addressed all the major issues that are emphasized in NUREG-1407, including plant walkdowns, relay chatter, liquefaction, nonseismic failure, human actions, recent developments in seismic hazard evaluations, and containment performance. The study is consistent with the guidelines of NUREG-1407.

The uniqueness of earthquake-induced failure sequences were accounted for and reflected in logic models.

A correlation factor of one (1.0) was included for like components in a given system, and the dominant sequences and contributing failures seem reasonable. The PRA study also performed sensitivity studies using both the EPRI and the revised LLNL hazard curves. Containment performance was evaluated.

A number of weaknesses were identified as a result of the review of the submittal:

There is a weakness in documentation in that some useful information is not included in the submittal including a frontline system-support systems dependence matrix and the response spectra used in the fragility evaluation. In general, the submittal depends heavily on Tier 2 documents.

The fragilities of some components, including battery racks, cable trays, ducts and bellows and the wetwell torus, are not described in the submittal,

It seems the licensee used the IPE HEP values.

In the results section, relative magnitude of conditional core damage probabilities for different acceleration ranges do not always make sense: the highest acceleration range for the LLNL hazard curves (0.77g-1.01g) produced a lower conditional core damage probability (0.671) than the highest acceleration range for the EPRI hazard curves (0.62g-0.82g) (conditional core damage probability of 0.96), even through the LLNL acceleration levels are higher.

Importance measures for offsite power related events do not seem reasonable.

There is no discussion of important operator actions, timing and underlying uncertainties within the dominant sequences.

The discussions on seismic/flood/fire interactions are weak.

An important insight from the submittal and RAI responses is that in a seismic event, because of the high likelihood of soil liquefaction which in turn causes diesel generator failure, the Oyster Creek plant relies heavily on non-safety systems such as the combustion turbines and the fire water makeup to the condenser.

The sequences involving soil liquefaction and diesel generator failure dominate the seismic risk a this plant.

The licensee did perform some analysis to strengthen the arguments made with respect to the availability of these non-safety systems.

It should also be noted that the submittal states that relays which do not meet the A-46 requirements will be replaced. Since the IPEEE analysis is based on the assumption that these low-capacity relays are replaced, the implementation of the relay replacements should be confirmed.

Based on review of GPUs original submittal and responses to the RAIs and SRAIs, it appears that the licensee has satisfied the objectives outlined in the Generic Letter.

14

4.0 REFERENCES

[1] Oyster Creek Individual Plant Examination for External Events, Attachment to Letter dated December 29, 1995 from R. W. Keaten, Vice President and Director, Technical Functions, GPU Nuclear Corporation, to USNRC.

[2] Letter dated March 3, 2000, NRC to Oyster Creek Nuclear Generating Station, Supplemental Request for Additional Information Regarding Generic Letter 88-20, Individual Plant Examination for External Events

[3] GPU Nuclear Response to the Request for Additional Information Regarding Oyster Creek Nuclear Generating Station IPEEE Submittal (TAC No. M83652), Attachment to Letter dated May 21, 1998 from Michael B. Roche, Vice President and Director Oyster Creek, to USNRC.

[4] Letter dated June 29, 2000, Oyster Creek Nuclear Generating Station to NRC, Response to Supplement RAI Regarding Oyster Creek Nuclear Generating Station Seismic Portion of the Oyster Creek Individual Plant Examination for External Events 15

Attachment 2 TECHNICAL EVALUATION REPORT ON THE FIRE PORTION OF THE OYSTER CREEK NUCLEAR GENERATING STATION INDIVIDUAL PLANT EXAMINATION FOR EXTERNAL EVENTS

Review of the Submittal in Response to U.S. NRC Generic Letter 88-20, Supplement 4:

Individual Plant Examination-External Events Fire Submittal Screening Review Technical Evaluation Report: Oyster Creek Revision 6: November 16, 2000 Prepared by:

Donald B. Mitchell Richard E. Pepping Julie J. Gregory Risk and Reliability Analysis Department Sandia National Laboratories Albuquerque, New Mexico 87185-0748 Jeffrey L. LaChance Risk, Reliability, and Modeling Department Sandia National Laboratories Albuquerque, New Mexico 87185-0747 Prepared for:

Probabilistic Risk Assessment Branch Division of Systems Technology Office of Nuclear Regulatory Research U. S. Nuclear Regulatory Commission Washington, D.C. 20555 USNRC JCN W6733 1

1.0 INTRODUCTION

This Technical Evaluation Report (TER) presents the results of the Step 0 review of the Oyster Creek fire assessment reported in the Oyster Creek Individual Plant Examination for External Events [1], requests for additional information (RAI) based on questions raised during the initial review [2], and the licensee responses to those questions [3,4].

1.1 Plant Description The Oyster Creek plant has a General Electric (GE) boiling water reactor (BWR/2) nuclear steam supply system (NSSS). The plant is similar to other BWR/2 and BWR/3 plants with isolation condensers in that it contains an emergency core spray system, separate containment spray and shutdown cooling systems, and a BWR Mark I containment. Critical support systems include two trains of emergency power each connected to a diesel generator, three trains of emergency 125 V DC power, and an emergency service water system. The plant began commercial operation in December 1969.

1.2 Review Objectives The performance of an IPEEE was requested of all commercial U.S. nuclear power plants by the U.S.

Nuclear Regulatory Commission (USNRC) in Supplement 4 of Generic Letter 88-20 [5]. Additional guidance on the intent and scope of the IPEEE process was provided in NUREG-1407 [6]. The objective of this Step 0 screening review is to help the USNRC determine if the Oyster Creek submittal has met the intent of the generic letter and to determine the extent to which the fire assessment addresses certain other specific issues and ongoing programs.

1.3 Scope and Limitations The Step 0 review was limited to the material presented in the Oyster Creek IPEEE submittal and responses to requests for additional information (RAIs). RAIs were submitted to the licensee based on an initial review of the submittal alone. The scope of the review was limited to verifying that the critical elements of an acceptable fire analysis have been presented. An in-depth evaluation of the various inputs, assumptions, and calculations was not performed. The review was performed according to the guidance presented in Reference 7. The results of the review against the guidance in the reference document are presented in Section 2.0. Conclusions and recommendations as to the adequacy of the Oyster Creek IPEEE submittal with regard to the fire assessment and its use in supporting the resolution of other issues are presented in Section 3.0.

2

2.0 FIRE ASSESSMENT EVALUATION The following subsections provide the results of the review of the Oyster Creek fire assessment. The review compares the fire assessment against the requirements for performing the IPEEE and its use in addressing other issues. Both areas of weakness and strengths of the fire assessment are highlighted.

2.1 Compliance with NRC IPEEE Guidelines The USNRC guidelines for performance of the IPEEE fire analysis derive from two major documents. The first is NUREG-1407 [6], and the second is Supplement 4 to USNRC Generic Letter 88-20 [5]. In the current screening assessments, the adequacy of the utility treatment in comparison to these guidelines has been made as outlined in Guidance for the Performance of Screening Review of Submittals in Response to U. S. NRC Generic Letter 88-20, Supplement 4:

Individual Plant Examinations - External Events, Draft Revision 3, March 21, 1997 [7]. The following sections discuss the utility document in the context of the specific review objectives set forth in this Screening Review Guidance Document and assess the extent to which the utility submittal has achieved the stated objectives.

2.1.1 Methodology Documentation The Oyster Creek fire assessment submittal is based on the Fire-Induced Vulnerability Evaluation (FIVE) methodology supplemented by an existing fire hazards analysis (FHA) and the internal events probabilistic risk assessment (PRA) models. The assessment includes the major steps of a FIVE assessment including fire area/compartment identification, safe shutdown equipment location, qualitative screening using spatial failure analysis, a Fire Compartment Interaction Analysis (FCIA),

quantitative screening including determining the safe shutdown failure probability for unscreened fire initiators, a fire propagation analysis, and a confirmatory walkdown. Some variations or enhancements of the FIVE methodology and some key assumptions beyond those explicit in the FIVE methodology that were utilized in the fire assessment and their validity are addressed below.

ÿ The Oyster Creek fire assessment credits alternate safe shutdown equipment not included in the Appendix R evaluation. In fact, the submittal broadens the scope beyond safe shutdown equipment to include risk significant components which were obtained directly from the Oyster Creek internal events PRA as well as the existing plant FHA. The submittal indicates that the locations of these components, including associated cables, were identified and included in the evaluation. It is expected that at a minimum, safe shutdown equipment will be a subset of the risk significant components defined in the submittal.

ÿ The qualitative screening of a fire area was based on either the lack of risk significant components or the non-demand of reactor trip. This is inconsistent with the FIVE methodology which allows screening if the area does not contain safe shutdown equipment 3

and a fire in the area does not demand a reactor trip. Although FIVE defines acceptable exemptions to the screening criterion, the submittal does not appear to satisfy these exemptions. However, the areas that were qualitatively screened in the submittal are not typically important fire areas, and the screened areas were subsequently included in the FCIA portion of the analysis to investigate their potential to cause inter-area fire propagation.

ÿ The quantitative screening of fire areas, based on core damage frequency (CDF) < 1E-6, was implemented in a three-step approach: 1) conservative estimate of upper bound CDF, 2) reevaluation of upper bound CDF by relaxation of conservative assumptions, and 3) a detailed evaluation of CDF that addresses the fire propagation and suppression components of a fire assessment analysis. The first two steps were derived directly from a combination of the FIVE and prescribed PRA approaches. The third step, however, was a new methodology developed specifically for this submittal and does not correspond directly to an approach deriving from either the FIVE or prescribed PRA methods.

+ The first two steps of the quantitative CDF estimate did not credit automatic fire suppression systems or fire brigades. The detailed evaluation credited automatic fire suppression systems (but not fire brigades) and introduced a fire severity factor approach that was data based (on event occurrences) rather than analytically based (on accepted fire modeling techniques).

All quantitative estimates of CDF included the potential for component failure due to electrical hot shorts induced by the fire.

The documentation in the Oyster Creek submittal was comprehensive in its detail of the methods used to conduct its IPEEE fire assessment. In particular, the descriptions of the FCIA assessment and fire occurrence frequency were very well done, with specific assumptions and screening criteria noted throughout. The methods used, the steps taken, and the data used to perform the analysis were delineated in the submittal in a scrutable and traceable manner.

2.1.2 Plant Walkdown The Oyster Creek submittal indicates that several walkdowns were performed in support of the fire assessment. A brief description of the walkdown teams was provided indicating that both plant personnel (PRA and fire protection engineers) and a fire PRA contractor made up the walkdown teams. The credentials of the walkdown team were not provided. In addition, the procedures for performing the walkdown were not presented in the submittal, nor were walkdown checklists provided. However, the submittal indicates that checklists were used in the walkdowns and identifies specific items addressed during the walkdown activities. These items include reviewing areas screened during the evaluation because they either did not contain safe shutdown equipment or would not result in a plant trip, reviewing fire boundaries that were screened according to the FIVE criteria, reviewing areas with high combustible material loadings, and reviewing assumptions made during the detailed evaluation of fire scenarios. Additional items were reviewed in each walkdown as outlined below.

4

The first group of walkdowns was performed to familiarize the fire analysts with the general plant layout and various plant features. Another group of walkdowns was performed to support the identification of component and cable locations. A third group of walkdowns was performed to gather information necessary to evaluate fire growth and propagation. Fire area boundaries, mitigative features (including spatial separation of equipment), and combustible material loads were evaluated in this group of walkdowns and used to support the determination of fire areas. A final group of walkdowns was performed for unscreened areas for which further analysis was required.

These walkdowns were used to confirm information used in the analysis of these areas.

The IPEEE submittal indicates that an interactive laserdisk walkdown system was used to supplement the physical walkdowns. This system contains digitized pictures of plant areas that can be viewed on a computer screen for familiarization and reviewing the physical layout of each area.

It is the evaluation of this review team that the walkdowns as described in the submittal were performed in a thorough and acceptable manner.

2.1.3 Fire Area Screening Although it is not explicitly stated in the submittal that all areas of the plant were reviewed in the fire assessment, a list of the 48 fire zones provided in the submittal appears to cover all areas of the plant. The fire area and zone designations used in the Oyster Creek FHA report were selected for use in the IPEEE evaluation. Fire areas are defined in the submittal as being bounded by construction that will contain the fire without reliance on fire suppression activities. A fire zone is defined as being a subdivision of a fire area in which the fire suppression systems are designed to combat a particular type of fire.

A list of potentially risk significant components was developed based on the Oyster Creek PRA models. Additional components that may have been excluded from the PRA, based on reasons such as low probability of failure, were added to the list as appropriate based on a review of the PRA and the FHA. These candidate components were screened for their susceptibility to fire. Passive components such as heat exchangers, check valves, mechanical relief valves, and manual valves were deemed not susceptible to fires. In addition, non-critical reactor protection system components (i.e., components that are redundant to other components located outside the area and to components that will not prevent the reactor trip function) were also eliminated. Active components such as pumps and fans, electrical and actuation components, valves with operators, fuses, circuit breakers, relays, and components requiring manual operator action for accident mitigation were deemed susceptible to fires. These general designations are reasonable and agree with other fire susceptibility classifications. A list of all components considered in this evaluation was included in the submittal, complete with the identified susceptibility or lack of susceptibility to fire. The scope of this review and lack of information concerning the PRA model prevented a review of this list.

5

The locations of the risk significant components (and their required cables) that were deemed susceptible to fire were identified using the FHA, a plant fire mitigation procedure, site layout drawings, other sources of plant information, and plant walkdowns. The supporting cables that were located included those cables that could result in a hot short that causes a component to go to an active failed position. Based on this evaluation, seven areas were identified which do not contain risk significant components. These areas include the three radwaste buildings, the auxiliary boiler building, the refueling floor, the off-gas building, and the 74' elevation of the mechanical equipment room. These areas were eliminated from further analysis. A table containing the locations of all risk significant components susceptible to fire and their cables, was provided in the submittal. In addition, a fire initiating event impact table that shows which safety functions could be impacted by fires in each retained area was also provided.

Six additional fire areas were qualitatively screened from further analysis based on the fact that no plant trip would be required. Areas screened in this step include the inerted containment, a warehouse, the maintenance building, the site emergency building, and fire pump areas. Elimination of these areas seems reasonable, with the fire pump areas being the only areas in doubt. Fires in the fire pump areas would likely result in a controlled shutdown that can present some risk.

Note that the above qualitative screening process did not follow the FIVE methodology steps. The FIVE method initially screens fire areas only if a fire in the area cannot cause a reactor trip and does not contain safe shutdown equipment. Although FIVE defines acceptable exemptions to the screening criterion, the submittal does not appear to satisfy these exemptions. However, the areas that were qualitatively screened in the submittal are not typically important fire areas, and the screened areas were subsequently included in the FCIA portion of the analysis to investigate their potential to cause inter-area fire propagation. Areas not screened in this step and retained for further analysis include the typically important fire areas of the reactor, control, and turbine buildings. It should also be noted that the Oyster Creek screening process did not rely on the Appendix R submittal information.

The Oyster Creek fire assessment included a FCIA assessment (although the submittal does not refer to it as an FCIA) utilizing the FIVE methodology criteria for screening fire barriers. The assessment is well documented, listing the fire barrier ratings, the combustible material loading, and the presence of automatic fire detection and suppression systems. All fire areas (including those previously screened) and their subordinate fire zones were reviewed against the FIVE criteria to determine if propagation across the fire area/zone boundaries would be likely. Fire propagation from all fire areas and zones was screened from further consideration. A review of this assessment indicates that with one exception and some minor deviations, the boundary screening was performed according to the FIVE criteria. Fire zone OB-FZ-10A does not contain a rated fire barrier on its boundary with fire zone OB-FZ-10B, has a combustible material loading of 28,764 BTU/ft2, but has fire detectors (no fire suppression system is identified in this zone). This fire barrier is incorrectly screened based on the presence of a suppression system. Thus fire propagation from OB-FZ-10A to OB-FZ-10B should have been considered in the assessment (i.e., area OB-FA-10, which contains these two fire zones, should apparently have been considered as a single fire zone). Other minor deviations from the 6

FIVE boundary screening criteria include screening areas with slightly higher combustible material loadings than prescribed in the cited screening criteria and incorrectly screening a fire area with

>80,000 BTU/ft2 based on a 1.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> rating (the area should have been screened based on the presence of a fire suppression system).

In terms of potential fire interactions, review of the submittal indicates an unusual configuration between the lower cable spreading room (OB-FZ-4), the main control room (OB-FZ-5), and the upper cable spreading room (OB-FZ-22A). There is a hollow block ventilation shaft between the upper and lower cable spreading rooms that is isolated from the main control room by fire dampers (the reliability of which were not considered). Because of the sensitive nature of the areas involved, it seems that more discussion on the communication between these areas is warranted. (Note, however, that the main control room does employ in-cabinet detectors in critical panels).

In summary, the fire area screening that was performed on a qualitative basis did not follow the exact specifications of the FIVE methodology. However, it appears that no typically important areas were screened except for the fire pump areas (a fire would likely result in a controlled shutdown that can present some risk). On the other hand, fires in the screened areas were appropriately considered in the submittal to have the potential to spread to other fire areas or zones. The fire compartment interaction analysis appears adequate except that it appears that two fire zones in the office building should have been considered as a single fire zone, and that interaction between the lower and upper cable spreading rooms and the main control room, by virtue of potential communication through a ventilation shaft, lends itself to further investigation. Overall, this portion of the analysis is deemed reasonable.

2.1.4 Fire Occurrence Frequency Generic fire frequency data from FIVE was used to calculate each unscreened fire zone fire frequency. Updating the generic data with plant-specific fire frequency data was not performed. The individual fire frequencies were calculated using generic area and component-related fire frequencies generally partitioned according to the FIVE methodology guidelines. The fire initiating event frequency evaluation is well documented and provides tables showing the partitioning process.

Several deviations from the FIVE partitioning guidelines were identified. The generic diesel generator room fire frequency was divided in two to get an individual diesel generator room frequency. However, the FIVE methodology documentation suggests that the generic frequency already represents an individual room frequency. The partitioning of the transient fire frequency was based upon estimates of the transient combustible loading in each location compared with the total in all areas. The FIVE methodology partitions the transient fire frequency by the number of transient ignition sources. Neither one of these deviations from the FIVE methodology would be expected to affect the fire frequencies used in the fire assessment substantially. Also, minor discrepancies were noted between cable ignition frequencies in Table 4.1-6 and 4.1-10. These are also perceived to have a minor impact on the analysis.

7

A comparison of the calculated fire frequencies with NUREG/CR-4840 and the FIVE Plant Screening Guide indicates that the calculated fire frequencies are in general agreement with these references. None of the fire zones were screened out based fire frequency.

2.1.5 Fire Scenario Frequency Evaluation For each of the 35 unscreened fire areas and zones remaining at this point in the fire assessment, the Oyster Creek fire analysis calculated what the IPEEE submittal referred to as an upper bound core damage frequency using the Oyster Creek PRA event trees and fault trees adjusted to include fire-induced failures and the calculated fire frequencies. The term upper bound is applied because all fire events were assumed to fail all components in the area including cables and their associated equipment. Hot shorts that can cause an active failure of equipment were also included as mentioned earlier. All fire scenarios were treated as general transients unless a particular fire-induced impact such as a turbine trip was identified (the potential for a fire-induced LOCA is not addressed in the submittal). Fire detection and suppression were not modeled in this portion of the evaluation. The submittal also indicates that recovery actions associated with equipment assumed damaged by the fire were not included in this evaluation. Upper bound core damage frequencies less than 1E-6/yr were calculated for 17 of the 35 remaining fire areas and zones. Using a screening value of 1E-6/yr, these 17 fire areas and zones were screened (eliminated) from further analysis. The total core damage frequency (a screening value) for these screened areas is 2.7E-6/yr. Remaining areas include the cable spreading rooms, the control room, the switchgear rooms, the battery rooms, the main transformer area, several areas in the turbine building, and two areas of the reactor building including the main floor and the torus area that consists of the corner rooms containing ECCS pumps. This screening process is acceptable with the results appearing to be appropriate.

Each of the remaining 18 unscreened fire areas and zones were reviewed to determine if relaxation of one or more of the conservative assumptions used in the upper bound core damage frequency evaluation would be appropriate. These assumptions involved the failure of an entire system (such as electrical power division when only a power supply to one component would be affected), reduced potential for fire spread (from one corner room to another across the torus area and from the turbine building basement area to cables within a conduit in a protected pit), or the treatment of fire as a general transient when the fire would more likely resemble a loss of offsite power (for the main transformer area and a switchgear room). In addition, other proceduralized recovery actions such as allowing for a recovery of switchgear room ventilation failure and manually closing circuit breakers were also considered.

The general transient used the restrictive Electro-Matic relief valve (EMRV) post trip pressure relief requirement (4 of 5 EMRVs open) for all fire initiators to simplify the fire risk model. In the case of the switchgear room, the upper bound CDF evaluation modeling assumed the isolation condenser B failed. Treating this zone on the basis of a LOSP does not result in loss of the isolation condenser until the batteries discharge. The less conservative modeling of the main transformer area based on a LOSP resulted in a less stringent requirement for RPV pressure relief following plant trip.

8

The PRA models were re-quantified with appropriate assumptions relaxed, but with the assumption that all equipment is damaged (except for those identified above), the treatment of hot shorts unchanged, and fire detection and suppression not credited. A review of these modifications concluded that all were appropriate except for one. A recovery of an emergency service water pump was allowed for a fire in the circulating water/intake area based on the argument that the cables for different pumps are in different trays and all pumps would not be damaged by the fire. This area should have been subjected to a fire propagation analysis to establish that this assumption was reasonable.

Of the 18 areas remaining, ten were screened by this evaluation with relaxed assumptions. The total core damage frequency ( a screening value) from these ten screened areas is 5.6E-6/yr. Remaining areas include a cable spreading room, the control room, a switchgear room, and battery rooms.

These areas were subjected to a more detailed evaluation involving a fire growth and propagation assessment, discussed in the next section of this report.

As indicated previously, recovery actions were modeled in this step of the fire analysis. Although the failure probabilities applied for the operator actions were higher than values used for normal operating conditions, how or where in the analysis these adjustments were made was not clear from the submittal alone. As a result, RAI #3 was submitted to the licensee. It requested that the details of the methodology used to estimate the human error probabilities used in the recovery analysis be provided.

In response to RAI #3, the licensee stated that only two actions were credited, and that both were proceduralized. The two actions, credited in three of the areas that were quantitatively screened, are discussed below.

• One procedure addressed recovery of ventilation for cooling 460 V switchgear rooms, failure of which eventually leads to loss of the 4160 VAC bus. This procedure was in existence prior to the fire study. Two hours were available before room temperatures were of concern.

Furthermore, while not performing a detailed analysis of the accident sequence, it was observed that the conditional failure probability of the bus, which was expected to be 0.05, could be raised to 0.066 without changing the screening result.

• The second procedure addressed restoring an emergency service water pump to prevent containment over-pressurization. Again, a long period was expected to be available to accomplish the action (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), which was essentially a repair procedure. The response noted that specialty parts (cables and terminators) were installed especially for this procedure.

Based on the above, it appears that a detailed treatment of fire-specific human errors was not performed in the analysis of the unscreened compartments; however, it does not appear that a special treatment was necessary. The response to RAI #3 is considered satisfactory.

9

The potential for fire growth to another fire zone is not considered since it was previously addressed in the FCIA portion of the analysis. This portion of the analysis seems appropriate with respect to FIVE screening criteria; however, the total of the screened CDFs is considered to be relatively high (5.6E-6) compared with the total CDF (1E-5) for the unscreened zones documented in the submittal.

2.1.6 Fire Propagation and Suppression Analysis A detailed evaluation of core damage frequency due to fire was performed as a surrogate for the fire propagation and suppression analysis required for the fire assessment portion of the IPEEE. The detailed evaluation was performed for each of the eight fire zones that remained after the qualitative and initial quantitative screening. This evaluation resulted in reduction of the CDF by application of a fire severity factor to the fire frequency, by crediting mitigation by automatic fire detection and suppression systems, or by using both methods.

The fire severity factor was developed by reviewing event data in the EPRI Fire Events Database (NSAC-178L) as to the severity of damage (either by number and type of items damaged, economic impact, or both). Based on the 753 events reviewed, a severity factor of 0.01/fire event was assigned to the engulfing fire Case 1 scenario. This fire severity factor was applied directly to three of the remaining eight fire zones (the turbine building basement, and the 23' and 51' elevations of the reactor building), and multiplied by a factor of 10 to yield 0.10/event for two of the remaining eight fire zones (the cable spreading room and the A/B battery room). The use of this factor does not appear to conform to either method prescribed for the IPEEE process (i.e., FIVE or PRA quantification). The development of the severity factor was not well described in the submittal. Its use in conjunction with explicit credit for fire suppression efforts and systems raises the question of the possibility of redundant credit for fire suppression.

As a result of the above, RAI #1 was submitted to the licensee. For the five zones in which a severity factor was used in the analysis, the RAI requested that fire suppression and propagation be modeled to determine the probability that the fire will damage critical targets before it is suppressed and that the results of the analysis be provided.

In the initial response to RAI #1 [3], the licensee noted that the fire suppression information fields of the fire events database were not examined in selecting fire events used to determine the severity factor. Nevertheless, the licensee stood by the validity of the factor that was used in the submittal.

On this basis, redundant credit for fire suppression appeared likely. Another point made in the RAI

1. 1 response was that the fire frequency is preserved by the frequency partitioning employed. It should be noted that the frequency was preserved, apart from the small fraction allotted to severe fires, among successfully suppressed fires with limited consequences. The unsuppressed fires, those potentially occurring when suppression fails, are not included in the results presented. A cursory review of the numerical results indicated that these scenarios may dominate the CDF from these compartments. Thus, additional information was needed to complete the evaluation of the five compartments where severity factors were used. The licensee stated in the initial RAI #1 response that the compartments in question would be reevaluated and the results provided by October 1998.

10

The results of the review of this additional response [4] (dated August 17, 2000) are discussed below.

The additional response to RAI #1 provided the results of the revised analysis of the five compartments that were questioned in the RAI. The analysis used a three step process. First, severity factors were revised to consider the extent to which manual or automatic suppression would mitigate the events on which the severity factors were based. Next, fire propagation and suppression were modeled to determine if the fires considered would damage targets before being suppressed.

Finally, CDFs were revised based on the results of the first two steps.

Instead of using the severity factors in the submittal, the reanalysis used those provided in the EPRI Fire PRA Implementation Guide (FPRAIG) [8]. For fixed ignition sources, the values used and the components to which they were applied were provided in the response. For transient fires, severity factors were approximated based on Appendix K of the FPRAIG for fires (including cables) due to welding and fires caused by other transient sources. The probability of non-suppression in five minutes of a fire due to welding was determined to be 0.12. The corresponding probability for other fires due to transients was estimated to be 0.65.

Fire modeling based on FIVE was used to determine if a fire could be suppressed before damage to cables could occur. In this analysis the room volume was ignored and it was assumed that all fires reach peak heat release rates upon ignition. The effects of room ventilation were also ignored. It was assumed that all cable was unqualified. Partitioning factors were used in the fire modeling to adjust the ignition frequency of similar sources when it was found that some of them could not cause the severe damage represented by the associated Case 1 scenario defined for each zone in the submittal. For example, only seven of 16 pumps in the turbine building zone were found to be capable of producing fires that would cause critical room heating conditions or propagate to damage cables in the zone. In this case the ignition frequency was multiplied by 7/16. Ignition frequency contributions removed from Case 1 scenarios due to severity factors or automatic suppression system reliability were accounted for in the Case 2 and 3 scenarios specified in the submittal so the total zone frequency remained the same.

The ignition frequencies for the applicable transient and fixed ignition sources in the five zones were revised using severity and partitioning factors determined as discussed above. In all cases, the zone automatic fire suppression system (AFSS) reliability was included in the revised Case 1 ignition frequency based on the values provided in FIVE. This was based on the fire modeling which determined that the AFSS could affect the fire if it actuated even though some component damage might occur. No credit was taken for manual suppression. The revised ignition frequencies were used to calculate new CDFs for each of the cases considered for the five zones in the submittal, using the same CCDPs. The submittal results and those from the reanalysis are shown in the table below.

11

Fire Zone Description Submittal CDF Revised CDF OB-FZ-4 Lower Cable Spreading Room 2.60E-06/yr 8.60E-06/yr OB-FZ-8C A & B Battery Room, 5.10E-07/yr 4.58E-07/yr Tunnel and Tray Room TB-FZ-11D Turbine Building Basement 2.10E-07/yr 1.91E-06/yr RB-FZ-1D Reactor Bldg 51' Elevation 2.70E-07/yr 2.43E-07/yr RB-FZ-1E Reactor Bldg 23' Elevation 1.30E-07/yr 1.16E-07/yr Total CDF 3.70E-06/yr 1.13E-05/yr As indicated in the table, the total CDF for the five zones increased by about a factor of three as a result of the reanalysis. However, in three of the zones the CDFs were slightly smaller. The CDF for the Cable Spreading Room (OB-FZ-4) increased primarily because the adjusted fire frequency for the Case 1 scenario increased from 2.25E-5/yr (submittal) to 1.23E-4/yr (revised), based on the revised analysis severity and partitioning factors and including the AFSS availability. The submittal value was based on a severity factor (SF) of 0.1. The equivalent severity factor based on the revised analysis was a less optimistic 0.2. In addition, an AFSS reliability of 0.05 was used in the reanalysis.

Based on FIVE, this is the correct value for the deluge system in the cable spreading room. A value of 0.02 was used in the submittal.

The CDF for the A and B Battery Room (OB-FZ-8C) was slightly smaller because of offsetting changes in the revised analysis. The adjusted fire frequency for the Case 1 scenario increased by a factor of four, primarily because the fire SF increased from 0.1 to 0.5. This was offset by decreases in the ignition frequencies for the batteries and the Case 2 scenario. These changes were not explained in detail in the RAI response.

The Turbine Building Basement (TB-FZ-11D) was the other zone which showed an increase in CDF.

This was primarily because the adjusted fire frequency for the Case 1 scenario increased due to a change in the fire SF from 0.01 (submittal) to 0.16 (revised). The reactor building zones (RB-FZ-1D and RB-FZ-1E) showed small decreases because the 0.01 SF used in the submittal was replaced in the revised analysis by the product of a severity factor (~ 0.15) and AFSS failure probability of 0.05.

From the description provided in the submittal, it appears that there are instances of redundant safety trains in close proximity and separated by water curtains in fire zones RB-FZ-1D and RB-FZ-1E.

Scenarios involving both redundant trains would be among those included in the all-engulfing fire Case 1 scenarios.

The licensee response to RAI #1 is considered adequate. The licensee modeled the five fire zones as requested and provided the results which show all of the factors used in the analysis of each compartment. Both fire severity factors and automatic fire suppression were credited in these analyses. This is considered acceptable since actuation of an automatic suppression system or use 12

of manual suppression devices were taken as evidence of a severe fire in developing the severity factors.

As indicated in the above discussion of the response to RAI #1, in assessing the fire mitigation by automatic suppression systems, unavailability factors from FIVE were applied to the five reanalyzed zones. This assumption was also applied in two other fire zones, including the main control room.

However, according to the FIVE methodology, if automatic suppression systems are available, in order to credit these systems it must be determined that these systems can operate prior to the target reaching its damage temperature when exposed to a fixed or transient combustible fire source. This was not done in the submittal detailed evaluation. However, it was considered in the reanalysis of the five zones in response to RAI #1, as discussed earlier.

The assumption of the low suppression system unavailability values of FIVE presumes a system designed, installed, and maintained in accordance with standards, such as those recommended by NFPA. The submittal does not substantiate that the Oyster Creek suppression systems are maintained in accordance with such standards and RAI #2 was submitted to the licensee requesting clarification. The licensee response provided a table which listed, for each of the above seven fire areas/zones which have automatic suppression systems, the type of system and the applicable NFPA code. For two of the zones containing three custom suppression systems it was noted that they use NFPA codes for guidance. The custom systems are noted as needed in order to comply with Appendix R commitments to prevent spread of fires across fire zone boundaries. Each is noted as an extension of an NFPA compliant cable tray deluge system.

The response to RAI #2 is considered satisfactory.

2.1.7 Quantification and Uncertainty In the original submittal scenarios were defined for the unscreened fire areas and zones, as described above, and the compartment fire frequency partitioned among them. Frequency partitioning typically appeared to be by simple fractionation of the frequency (one half, one third, etc.), rather than using the ignition source frequencies that were combined to determine the compartment frequency. The results of the final quantitative analysis resulted in core damage frequencies less than 1E-6/yr and elimination of all but two fire areas. The remaining unscreened areas (and their CDFs) were the A 480 VAC Switchgear Room (5.1E-6/yr) and the Cable Spreading Room at the 36 elevation of the office building (2.6E-6/yr). The fire scenarios in both locations are dominated by failure of a safety relief valve to re-close and a loss of containment heat removal.

The total estimated core damage frequency for the six areas screened in the original submittal analysis was 2.2E-6/yr. The total core damage frequency from fires was thus approximately 1E-5/yr.

Based on the reanalysis submitted in response to RAI #1, the remaining unscreened areas are the A 480 VAC Switchgear Room (5.1E-6/yr), the Cable Spreading Room at the 36 elevation (8.6E-6/yr),

13

and the Turbine Building Basement (1.9E-6/yr). The CDF for the five screened areas is 1.9E-6/yr.

Thus, based on the reanalysis, the total CDF increased to about 1.9E-5/yr.

No uncertainty analysis was performed in the fire assessment.

2.1.8 Sensitivity and Importance Analysis No core damage frequency sensitivity or importance studies were described in the submittal.

14

2.2 Special Issues As a part of the IPEEE fire submittal, the utilities were asked to address a number of fire-related issues identified in the Fire Risk Scoping Study (FRSS) and USNRC Generic Safety Issues (GSI).

Specific review guidance on these issues is taken from Reference 7.

2.2.1 Decay Heat Removal (USI A-45)

As discussed in Generic Letter 88-20 [5] and NUREG 1407 [6], USI A-45, which is associated with the adequacy of decay heat removal at nuclear power plants, is subsumed into the IPE submittals.

A submittal meeting the intent of Generic Letter 88-20, Supplement 4 is assumed to satisfy the requirements of USI A-45. Specifically, the fire assessment presented in the IPEEE submittal should address the adequacy of long-term decay heat removal in the event of fires.

The Oyster Creek submittal provides a discussion on the USI A-45 issue. It is noted that the two unscreened fire areas involve fires that result in loss of DHR sequences. The combined frequency of these fire scenarios is approximately 1E-5/yr which is less than the USNRC guideline value of 3E-5/yr in NUREG-1289 for which failures of the DHR function have been designated as acceptable without any need for plant modifications.

2.2.2 Effects of Fire Protection System Actuation on Safety-related Equipment (FRSS, GSI-57, MSRP)

This issue is associated with the concern that traditional fire PRA methods have generally considered only direct thermal damage effects. Other potential damage mechanisms have not been addressed, such as smoke and the potential that the activation of fire suppression systems, either as part of actual fire fighting or spuriously, might result in damage to plant systems and components. In general, this is an area where the database on equipment vulnerability is rather sparse. The analytical results obtained for resolution of the issue, subsumed by GSI-57, identified the dominant risk contributors as: (1) Seismic-induced fire plus seismic-induced suppressant diversion and (2) Seismic-induced actuation of the fire protection system (FPS). The NRC anticipated that the licensee would conduct seismic/fire walkdowns to assess (1) whether an actuated FPS would spray safety-related equipment, and (2) whether some protective measures to prevent the same could be instituted. The results could be documented in the IPEEE submittal.

In following the FIVE guidance, this issue is included in the FRSS issue of Total Environment Equipment Survival. The Oyster Creek assessment noted the following three subareas of interest:

• potential for inadvertent fire suppression actuation,

• operator action effectiveness,

• the potential for adverse effects on plant equipment by combustion products.

15

The submittal indicates that spray shields have been installed on important plant equipment to protect against the effects of inadvertent suppression system actuation. The concerns in NRC Information Notice 83-41 were reviewed by the plant fire protection engineer and found to be satisfactorily addressed by existing programs to verify that water spray does not damage safe shutdown equipment.

The operator action effectiveness is addressed by noting that operators receive training on the use of the abnormal operating procedure in place for fire situations.

The Oyster Creek fire assessment follows the FIVE methodology approach in not evaluating the impacts of combustion products on equipment operability due to the paucity of information on these effects. However, the submittal indicates that impacts on equipment would be assessed following a fire. In addition, plant staff is trained on the use of SCBA as part of fire brigade training.

2.2.3 Fire-induced Alternate Shutdown/Control Room Panel Interactions (FRSS, GSI 147)

The issue of control systems interactions is associated primarily with the potential that a fire in the plant, i.e., main control room (MCR), might lead to potential control systems vulnerabilities. Given a fire in the plant, the likely sources of control systems interactions are between the control room, remote shutdown panel, and shutdown systems. Specific areas that should be addressed in the IPEEE fire analysis include 1) electrical independence of the remote shutdown control systems;

2) loss of control equipment or power before transfer; 3) spurious actuation of components leading to component damage, LOCA, or interfacing LOCA; and 4) total loss of system function. It is anticipated that the licensees submittal will describe its remote shutdown capability including the nature and location of the shutdown station(s) and the types of control actions that can be taken from the remote panel(s).

Oyster Creek has remote alternate shutdown capability for several functions identified in the submittal. The Oyster Creek IPEEE submittal states that the remote shutdown system provides for monitoring and control stations to perform a safe shutdown of the plant from outside the control room in the event of circuit destruction caused by a fire in the control room or in the cable spreading room. The plant FHA report is referenced as providing more discussion on the capabilities of the system. In addition, it is noted that abnormal operating procedures are in place for evacuating the control room and for operating the system.

2.2.4 Smoke Control and Manual Fire Fighting Effectiveness (FRSS, GSI-148)

The smoke control and manual fire fighting effectiveness issue is associated with the concern that nuclear power plant ventilation systems are known to be poorly configured for smoke removal in the event of a fire. A significant potential exists for the buildup of smoke to hamper the efforts of the manual fire brigade to suppress fires promptly and effectively. Sensitivity studies have shown that prolonged fire fighting times can lead to a noticeable increase in fire risk. Smoke, identified as a major contributor to prolonged response times, can also cause misdirected suppression efforts and hamper the operators ability to shut down the plant safely.

16

In the Oyster Creek IPEEE fire analysis, manual fire fighting is not credited for any of the fire scenarios considered in the assessments. The utility analysis has uniformly assumed no credit for manual fire intervention, and hence, the issue of manual fire fighting effectiveness is not relevant to the utility analysis. This also implies that the utility has not considered the potential that manual fire fighting activities might lead to damage to equipment not directly impacted by the fire itself (collateral damage). The submittal indicates that the minimum attributes for manual fire fighting effectiveness specified in NUREG/CR-5088 and the FIVE methodology are met at Oyster Creek.

However, since the Oyster Creek fire assessment does not credit manual fire suppression efforts, it is concluded that the submittal does not fully address the issue of manual fire fighting effectiveness.

2.2.5 Seismic/Fire Interactions (FRSS, MSRP)

The issue of Seismic/Fire Interactions primarily involves three concerns. First is the potential that seismic events might result in fires internal to the plant. Such threats might be realized from inadequately secured liquid fuel or oil tanks, through breakage of fuel lines, or through the rocking of unanchored electrical panels (either safety or non-safety grade). The second concern is the potential that seismic events might render fixed fire suppression systems inoperable. This could include detection systems, fixed suppression systems, and fixed manual fire fighting support elements such as the plant fire water distribution system. The third concern is that a seismic event might spuriously actuate fixed fire detection and suppression systems. The spurious operation of detectors might both complicate operator response to the seismic event and/or cause the actuation of automatic fire suppression systems. Actuation of a suppression system may lead to flooding problems, habitability concerns (for CO2 systems), the diversion of suppressants to non-fire areas rendering them unavailable in the event of a fire elsewhere, the potential over-dumping of gaseous suppressants resulting in an overpressure of a compartment, and spraying of important plant components. It had been anticipated that a typical fire IPEEE submittal would provide for some treatment of these issues through a focused seismic/fire interaction walkdown.

The Oyster Creek submittal addresses the potential for seismically-induced fires, seismic actuation of fire suppression systems, and seismic degradation of fire suppression systems. Dedicated plant walkdowns by fire protection, seismic, and PRA personnel were performed to address these issues.

Visual inspections of potential fire ignition sources were performed. The submittal indicates that although all observed conditions are not ideal, they were judged to be unable to contribute significantly to a seismically-induced fire scenario.

During the seismic/fire interaction walkdowns, the anchorages of fire suppression systems were reviewed. Some weak anchorages were identified for CO2 tanks. No mercury switches were identified that would result in inadvertent fire suppression system actuations. It is noted in the submittal that in areas containing safety-related equipment, the fire protection systems are either manual or automatic deluge systems requiring redundant sensor/relay circuit closure to result in control valve actuation and local head actuation for water release. Sensitive electrical equipment is sealed and/or equipped with sheet metal or plastic shields to protect them from water intrusion.

17

Potential inadvertent actuations related to deluge valve dropweight actuation mechanisms that are sensitive to shaking, fire control panels mounted on non-seismic block walls, and the proximity of an unanchored industrial water van to distribution system piping were identified. These items were identified as areas for implementation of plant improvements.

Some potential fire suppression flow diversion paths (e.g., rupture of water lines in non-safety structures or a non-safety component failure rupturing CO2 piping) following a seismic event were identified. The IPEEE submittal indicates that because of the low frequency of seismic events, the possibility of isolating these flow diversions, and the fact that manual fire fighting can also be performed in the case of a flow diversion, this issue was considered closed.

2.2.6 Adequacy of Fire Barriers (FRSS)

The common reliance on fire barriers to separate redundant components needed to achieve a safe shutdown has elevated the risk sensitivity of fire barrier performance. Degraded fire barrier penetration seals and unsealed penetrations in some barriers can contribute to this source of fire risk, since fires in one area might impact other adjacent or connected area through the spread of heat and smoke. In general, it is expected that a utility analysis would provide for some treatment of this by considering that (1) manual fire fighting activities might allow for the spread of heat and smoke through the opening of access doors, and (2) that the failure of active fire barrier elements such as normally open doors, water curtains, and ventilation dampers might compromise barrier integrity.

Under the FIVE analysis, both of the above concerns are normally addressed through FCIA process.

The utility IPEEE submittal included an FCIA that consolidated fire zones where barrier performance was in doubt. The submittal also indicates that all fire barriers and components are included in surveillance, testing, and maintenance programs.

2.2.7 Effects of Hydrogen Line Ruptures (MSRP)

The use of flammable gases in the plant, including hydrogen, introduces the potential that a rupture of the gas flow lines might lead to the introduction of a serious fire hazard into plant safety areas.

It had been anticipated that a typical fire IPEEE analysis would include the consideration of such sources in the analysis.

The Oyster Creek submittal addresses seismic-initiated fires involving flammable gases. As indicated in Section 2.2.6 of this report, observed conditions for some potential fire sources (including a hydrogen manifold located on the turbine deck) are not ideal, but were judged in the submittal to be unable to contribute significantly to a seismically-induced fire.

18

2.2.8 Common Cause Failures Related to Human Errors (MSRP)

Common cause failures resulting from human errors include operator acts of omission or commission that could be initiating events or could affect redundant safety-related trains needed to mitigate other initiating events. It had been anticipated that a typical fire IPEEE analysis would include the consideration of such failures in the submittal.

As noted in Section 2.1.5 of this report, based on the response to RAI #3, two proceduralized recovery actions were credited in the quantitative screening. A detailed treatment of fire-specific human errors was apparently not performed in the analysis of the unscreened compartments; however, it does not appear that a special treatment was necessary.

2.2.9 Non-safety Related Control System/Safety Related Protection System Dependencies (MSRP)

Multiple failures in non-safety-related control systems may have an adverse impact on safety-related protection systems as a result of potential unrecognized dependencies between control and protection systems. The licensees IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety related systems and identify potential sources of vulnerabilities. It had been anticipated that the fire IPEEE analysis would include the consideration of such dependencies in the submittal.

This issue was not explicitly discussed. To the extent that the plant model includes non-safety systems, and properly models dependencies, some dependencies may be implicitly included.

2.2.10 Effects of Flooding and/or Moisture Intrusion on Non-Safety- and Safety-Related Equipment (MSRP)

Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment. This type of event can result from external flooding events, tank and pipe ruptures, actuations of the fire suppression system, or backflow through part of the plant drainage system. It had been anticipated that the fire IPEEE analysis would include the consideration of such events in the submittal.

The potential for spurious fire suppression actuation was discussed in the context of GSI-57 as described in Section 2.2.2 of this report. The other aspects of this issue noted above were not addressed in the submittal.

2.2.11 Shutdown Systems and Electrical Instrumentation and Control Features (MSRP)

The issue of shutdown systems addresses the capacity of plants to ensure reliable shutdown using safety-grade equipment. The issue of electrical instrumentation and control addresses the functional 19

capabilities of electrical instrumentation and control features of systems required for a safe shutdown, including support systems. These systems should be designed, fabricated, installed, and tested to quality standards and remain functional following external events. It had been anticipated that the fire IPEEE analysis would include the consideration of this issue in the submittal.

The submittal contained no explicit discussion of this issue and no pertinent information beyond that cited in Section 2.2.3 of this report.

2.3 Containment Performance Issues Unique to Fire Scenarios NUREG-1407 indicates that a containment analysis should be performed as part of the fire assessment if containment failure modes differ significantly from those found in the internal events Individual Plant Examination (IPE). The Oyster Creek fire assessment examined the potential for fire-induced failure of containment isolation for all fire areas and zones that had a total core damage frequency greater than 1E-8/yr. Failures of containment cooling functions were not required as part of this assessment since they were included in the core damage evaluation. Both partial and total failures of primary and secondary containment isolation were examined. Primary containment isolation failure involving either the containment vent valves remaining open or a hot short in the control circuits for two isolation valves in series were considered. The potential for hot shorts in two valves was assigned a probability of 1.5E-2 that is viewed as being very conservative.

For the two fire areas that survived the screening process, the IPE model was exercised to confirm that fires in these areas do not result in plant damage state results significantly different from the IPE results. The results were in general agreement except that late containment failures are more significant for the unscreened fires since the containment spray function cannot be recovered for several of these fires. Overall, no potential containment performance issues during a fire were identified.

2.4 Plant Vulnerabilities and Improvements The Oyster Creek IPEEE concludes that there are no vulnerabilities from any external event including fire. The term vulnerability is defined as any core damage sequence that exceeds 1E-4/yr or any containment bypass sequence or large early containment failure sequence that exceeds 1E-6/yr. However, several plant modifications that could result in increased safety margins were identified as a result of the analysis. These improvements, which the submittal stated were being evaluated and pursued as part of the ongoing risk management program, are mostly seismic/fire interaction concerns and include:

+ Upgrades of the anchorage of the high pressure CO2 system in the turbine building and CO2 rack located outside the turbine building to prevent the loss of these suppression systems as the result of a seismic event. Also, upgraded anchorage would prevent the 20

high pressure cylinders from being damaged in a seismic event and becoming missiles that could cause collateral damage.

+ Provide additional support for the turbine generator hydrogen seal oil unit to prevent a seismic-induced filter line break that could result in oil leakage and a fire.

+ Replacement of drop-weight actuated deluge valves in fire suppression systems which potentially can be seismically actuated.

+ Modification of the anchorage of the Arrowhead Demineralizer trailer that, during a seismic event, could inadvertently initiate the station blackout transformers fire suppression system.

21

3.0 CONCLUSION

S AND RECOMMENDATIONS The Oyster Creek IPEEE fire assessment was performed by application of FIVE methodology with PRA estimates of core damage frequency. The submittal introduced a modified approach to the fire propagation and suppression analysis portion of the assessment, whereby an event-based approach, including a fire severity factor, was defined and employed rather than performing a detailed analysis of fire events. In response to an RAI, the licensee reevaluated the unscreened fire zones in which both fire severity factors and automatic fire suppression were credited. The portions of the analysis prior to the fire propagation and suppression analysis were noted to be in general compliance with the FIVE and PRA methods. Some areas of strengths and weaknesses were identified in the analysis. They include:

Strengths:

+ The methods used, steps taken, and data implemented to perform the analysis were documented in the submittal in a scrutable and traceable manner.

+ The analysis includes non-Appendix R equipment.

+ The analysis conservatively did not credit manual fire suppression.

+ Available and accepted PRA models and evaluation tools were used to evaluate the core damage frequency estimates.

+ Rigorous walkdowns of the site were conducted resulting in detailed cable routing information and a detailed review of fire area boundaries.

+ A credible review and consideration of the FRSS issues were included in the submittal.

+ The qualitative and initial quantitative screening of areas based on core damage frequency was performed in a prudent manner.

+ The evaluation of fire-induced and fire event-related containment failures was well-formulated.

Significant weaknesses in the submittal that were expected to impact results were addressed through the RAI process. The Oyster Creek is considered to contain no remaining weaknesses.

The reviewer recommends that a sufficient level of documentation and appropriate bases for analysis have been established to conclude that the Oyster Creek IPEEE fire submittal has substantially met the intent of the IPEEE process.

22

4.0 References (1) Oyster Creek Nuclear Generating Station, Oyster Creek Individual Plant Examination for External Events (IPEEE) for Severe Accident Vulnerabilities, GPU Nuclear Corporation, 29 December 1995.

(2) Letter from Mark Cunningham to Ronald Eaton, Request for Additional Information on Oyster Creek IPEEE Submittal, 24 October 1997.

(3) Letter from Michael B. Roche to U. S. Nuclear Regulatory Commission, Oyster Creek Nuclear Generating Station (OCNGS), Docket No. 50-219, Facility Operating License No. DPR-16, Individual Plant Examination of External Events- Response to Request for Additional Information, 21 May 1998.

(4) Letter from Ron J. DeGregorio to U. S. Nuclear Regulatory Commission, Oyster Creek Nuclear Generating Station (OCNGS), Docket No. 50-219, Reply to RAI on IPEEE, 17 August 2000.

(5) USNRC, Individual Plant Examination of External Events for Severe Accident Vulnerabilities -10 CFR §50.54(f), Generic Letter 88-20, Supplement 4, April 1991.

(6) USNRC, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, NUREG-1407, May 1991.

(7) S. Nowlen, M. Bohn, J. Chen, Guidance for the Performance of Screening Reviews of Submittals in Response to U.S. NRC Generic Letter 88-20, Supplement 4:

Individual Plant Examination - External Events, Rev. 3, 21 Mar 1997.

(8) W. J. Parkinson, EPRI Fire PRA Implementation Guide, EPRI TR-105928, Science Applications International, December 1995.

23

Attachment 3 TECHNICAL EVALUATION REPORT ON THE HIGH WINDS, FLOODS, TRANSPORTATION, AND OTHER EXTERNAL EVENTS PORTION OF THE OYSTER CREEK NUCLEAR GENERATING STATION INDIVIDUAL PLANT EXAMINATION FOR EXTERNAL EVENTS

TECHNICAL EVALUATION REPORT ON THE HIGH WINDS, FLOODS, TRANSPORTATION, AND OTHER EXTERNAL EVENTS (HFO) PORTION OF THE OYSTER CREEK NUCLEAR GENERATING STATION INDIVIDUAL PLANT EXAMINATION FOR EXTERNAL EVENTS Arthur Buslik

1.0 INTRODUCTION

The Oyster Creek Nuclear Generating Station (OCNGS) is a GE BWR 2 plant, with a Mark I containment and isolation condensers to remove decay heat. OCNGS is currently owned and operated by AmerGen Energy, and was formerly owned by General Public Utilities Nuclear Corporation. It is situated 9 miles south of Toms River, New Jersey, near the Forked River.

The provisional operating license was issued in 1969, and the plant was not built to the 1975 Standard Review Plan criteria.

2.0 HIGH WINDS Tornadoes were not considered in the design basis for OCNGS. Therefore, the licensee cannot screen out high winds and tornadoes based on an acceptably low frequency of exceeding the original design basis. The licensee estimated, in its original IPEEE submittal, that the frequency of exceeding a wind speed of 168 mph was 5E-7 per year, and that no safety-related structure had a "vulnerability threshold" less than 168 mph, so that the core damage frequency from high winds and tornadoes was less than 5E-7 per year. However, the staff had concluded that the frequency of tornado wind speeds exceeding 168 mph was on about 7E-6 per year (see letter dated February 26, 1990, from A.W. Dromerick, Office of Nuclear Regulation, to F.E. Fitzpatrick, Oyster Creek Nuclear Generating Station). Moreover, the staff, in its review of the licensee's HFO submittal concluded that straight winds and hurricanes could contribute about 1E-5 per year to the exceedance frequency for wind speeds of 168 mph. Therefore, the licensee cannot screen out high winds on the basis of the frequency of high winds exceeding 168 mph being less than 1E-6 per year. A request for additional information (RAI) was sent to the licensee. The licensee modified its original analysis in a response (dated May 21, 1998) to the RAI. The licensee agreed that the frequency of exceeding wind speeds greater than 168 mph is in the 1E-5 per year range. The weakest structures are the diesel generator vaults and oil tank compartment. In the modified analysis, the licensee gave wind-generated missile fragility curves for the emergency diesel generator building vaults. From the mean fragility curve, the median wind speed capacity for the diesel generator building is about 266 mph. A reasonable estimate of the tornado wind hazard is given in Figure III-1 of PLG-0276, rev. 1, "Oyster Creek Tornado Missile Risk Analysis." From this curve, the frequency of exceeding wind speeds of 266 mph is approximately 5E-7 per year.

A simple approximation for the convolution of the fragility curve and the hazard curve can be obtained by assuming the fragility is zero for wind speeds less than median wind speed capacity and is unity for wind speeds greater than the median wind speed capacity. Then the frequency of failure of the structure is estimated to be about 5E-7 per year. As noted in Section 5.1.5 of the IPEEE submittal, a conservative estimate for the failure of outdoor tanks leading to core damage is 4.9E-7 per year. Consequently, Oyster Creek meets the screening criterion of 1E-6 per year for core damage frequency from high winds.

1

3.0 FLOODS The issues that arose as a consequence of the Systematic Evaluation Program for the plant have been considered resolved by the NRC, as noted in the IPEEE submittal on p. 5.2-11. The plant therefore meets the intent of the 1975 SRP review criteria for the external flooding issue at Oyster Creek and no further analysis is required.

Site flooding from a probable maximum precipitation (PMP) event is discussed below, in the discussion of GSI-103.

4.0 TRANSPORTATION AND NEARBY FACILITY ACCIDENTS 4.1 Nearby Natural Gas Pipeline Hazard Function The analysis performed was by analogy to a similar analysis performed for the TVA Hartsville Plants. The analysis includes consideration of two natural gas pipelines that were installed in 1990, and concludes that the probability of a pipeline accident affecting the plant is less than 1E7 per year. The analysis seems reasonable.

4.2 Hydrogen Water Chemistry System Hydrogen Storage Facility Hazard Evaluation References to studies performed for the plant are included; it was found that the location of the hydrogen storage facility is sufficiently far from the nearest safety related structure (Ventilation Stack, about 620 feet away), to avoid damage. The analysis is included by reference, and shows that the licensee has addressed the issue. In addition, the explosion of the total hydrogen supply of one delivery truck at its closest distance to a safety-related structure was evaluated and found acceptable, in a document referenced in the report. These analyses were not reviewed as part of this screening review but, from the description given, appear to take into account the current state of the plant.

4.3 Aircraft Hazards The licensee references an NRC document, Integrated Plant Safety Assessment Report, Supplement 1, Sec. 2.7.1 (January 1991), which states that the aircraft strike probabilities are extremely low, and that aircraft traffic does not pose a significant threat to the Oyster Creek plant.

4.4 Nearby Transportation Hazard Analysis In January 1991 the NRC staff identified the fact that current estimates of truck traffic on the nearby U.S. Route 9 were significantly greater than what was estimated previously, at the time of application of the provisional operating license. The staff later indicated that in the absence of supporting data the potential for frequent shipment of hazardous material cannot be dismissed. As part of the resolution of this issue, General Public Utilities Nuclear Corporation requested and obtained from the New Jersey State police a commitment regarding hazardous material accident notification. Early notification gives the control room operators sufficient time to implement emergency procedures relating to the potential effects of the hazardous material.

The staff found this approach acceptable.

2

The TMI Action Plan item regarding Control Room Habitability has been addressed, and the NRC staff has found the resolution acceptable.

4.5 Conclusions regarding Transportation and Nearby Facility Accidents The licensee has addressed these accidents, mostly by referencing other documents. In the case of aircraft hazards and nearby transportation accidents, the NRC staff has already evaluated the issues and concluded that the risk was small and acceptable. The issue which seems to have received the least previous staff review is that of an explosion at the Hydrogen Storage Facility. The analysis of this hazard is incorporated by reference in the IPEEE, and has not been reviewed. However, the approach seems reasonable.

4.6 Other Events NUREG1407, in sec 2.12, notes that all licensees should confirm that no plant-unique external events known to the licensee with potential severe accident vulnerability are being excluded from the IPEEE. Such a statement has not been made. However, experience with other plants has indicated that it is unlikely that there is a vulnerability here.

5.0 Generic Safety Issues GSI-103, "Design for Probable Maximum Precipitation" This issue concerns itself with the fact that the National Weather Service has developed new PMP criteria, which give higher rainfall intensities over shorter time intervals and smaller areas than had previously been considered. Section 2.4 of NUREG-1407 requests that licensees assess the effects of these new PMP criteria in terms of onsite flooding from flood runoff and site ponding, and in terms of greater roof ponding. More information on this issue is given in Generic Letter 89-22.

The licensee, in a response (August 17, 2000) to a request for additional information, evaluated the effects of the new PMP criteria. The licensee concluded that local flooding due to PMP overland runoff will not intrude into buildings housing equipment or systems whose failure could lead to core damage. The only safety-related building where the PMP water level was high enough to enter was the reactor building. However, this building has airlock doors which are kept closed during normal operation. The water pressure on the doors would not fail the doors.

An analysis of roof ponding loads showed that the roofs would not fail as a result of a PMP event.

The licensee's analysis of the PMP event is satisfactory.

GSI-156, "Systematic Evaluation Program (SEP)"

The SEP issues are a set of issues associated with plants that were licensed prior to the time the 1975 Standard Review Plan was issued. Oyster Creek was one of ten nuclear power plants which were selected for detailed review in Phase II of the SEP program (see SECY-84-133).

The SEP issues have therefore already been reviewed for Oyster Creek, and are considered resolved by the staff, as noted in Section 5.2.4 of the Oyster Creek IPEEE submittal.

3

Therefore, there is no additional evaluation of these issues here.

GSI 172, "Multiple System Response Program (MSRP)"

One of the MSRP issues, "Effects of Flooding and/or Moisture Intrusion on Non-Safety-Related and Safety-Related Equipment," is related to the HFO analysis. Since the licensee satisfactorily addressed the external flooding issue, including consideration of the PMP event, the licensee has adequately addressed the aspect of this issue related to external flooding.

6.0 OVERALL CONCLUSIONS The process the licensee has used for the analysis of HFO events is judged adequate to identify risk-significant accident sequences and plant vulnerabilities, and the licensee found no vulnerabilities. In our judgement, the licensee has met the intent of Supplement 4 to Generic Letter 88-20, with respect to HFO events. We judge that the generic issues identified in the body of this report were addressed satisfactorily, and may be considered resolved for the Oyster Creek Nuclear Generating Station.

4