ML102990030

Plant, Unit 2 - Request for Additional Information Regarding Individual Plant Examination of External Events Design Report

ML102990030
Person / Time
Site:	Watts Bar
Issue date:	11/12/2010
From:	Joel Wiebe Watts Bar Special Projects Branch
To:	Bhatnagar A Tennessee Valley Authority
Wiebe, Joel NRR/DORL/WBSP, 415-6606
References
Download: ML102990030 (3)

Text

November 12, 2010 Mr. Ashok S. Bhatnagar Senior Vice President Nuclear Generation Development and Construction Tennessee Valley Authority 6A Lookout Place 1101 Market Street Chattanooga, TN 37402-2801

SUBJECT:

WATTS BAR NUCLEAR PLANT, UNIT 2 - REQUEST FOR ADDITIONAL INFORMATION REGARDING INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS DESIGN REPORT (TAC NO. ME3334)

Dear Mr. Bhatnagar:

By letter dated April 30, 2010, Tennessee Valley Authority submitted the Watts Bar Nuclear Plant, Unit 2, Individual Plant Examination of External Events Design Report. The Nuclear Regulatory Commission (NRC) staff has determined that additional information is needed to complete its review.

To support NRC staff review schedules, a response is required within 30 days of receipt of this letter.

If you should have any questions, please contact me at 301-415-6606.

Sincerely,

/RA PMilano for/

Joel S. Wiebe, Senior Project Manager Watts Bar Special Projects Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-391

Enclosure:

RAI cc w/encl: Distribution via Listserv

Mr. Ashok S. Bhatnagar Senior Vice President Nuclear Generation Development and Construction Tennessee Valley Authority 6A Lookout Place 1101 Market Street Chattanooga, TN 37402-2801

SUBJECT:

WATTS BAR NUCLEAR PLANT, UNIT 2 - REQUEST FOR ADDITIONAL INFORMATION REGARDING INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS DESIGN REPORT (TAC NO. 3334)

Dear Mr. Bhatnagar:

By letter dated April 30, 2010, Tennessee Valley Authority submitted the Watts Bar Nuclear Plant, Unit 2, Individual Plant Examination of External Events Design Report. The Nuclear Regulatory Commission (NRC) staff has determined that additional information is needed to complete its review.

To support NRC staff review schedules, a response is required within 30 days of receipt of this letter.

If you should have any questions, please contact me at 301-415-6606.

Sincerely,

/RA PMilano for /

Joel S. Wiebe, Senior Project Manager Watts Bar Special Projects Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-391

Enclosure:

RAI cc w/encl: Distribution via Listserv DISTRIBUTION: RidsOgcRp Resource RidsRgn2MailCenter Resource PUBLIC RidsNrrDorlLpwb Resource RidsNrrDeEeeb Resource LPWB Reading File RidsNrrLABClayton Resource RidsNrrPMWattsBar2 Resource RidsAcrsAcnw_MailCTR Resource RidsNrrDorlDpr ADAMS Accession No. ML102990030 OFFICE LPWB/PM LPWB/LA OGC LPWB/BC NAME JWiebe/JPoole for BClayton-SRohrer /for/ AJones SCampbell/PMilano for DATE 10 / 28 /10 10/ 28 /10 11 / 8 /10 11 / 12 /10 OFFICIAL AGENCY RECORD

REQUEST FOR ADDITIONAL INFORMATION WATTS BAR NUCLEAR PLANT, UNIT 2 INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS DESIGN REPORT TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-391 By letter dated April 30, 2010, (Agencywide Document and Management System (ADAMS)

Accession No. ML101240992) Tennessee Valley Authority submitted the Watts Bar Nuclear Plant (WBN),Unit 2, Individual Plant Examination of External Events Design (IPEEE) Report.

The following request for additional information (RAI) related to the report is required to complete our review.

FIRE EVENTS

1. The Phase III analysis of fire scenarios is based on an event tree fire modeling approach. The submittal gives one example (which begins on page 232 of the submittal) which defines four fire damage cases; minor self-extinguishing fires, severe fires suppressed by automatic suppression, severe fires suppressed with hose streams, and severe fires that are not suppressed. It is not clear from the submittal how this approach was implemented across individual fire scenarios and plant locations. Please answer the following questions regarding this approach:

a. How was the fire-induced equipment and cable damage target set (i.e., the equipment and cables damaged by the fire) defined for each of the fire damage cases in the event tree and for each individual fire ignition source and plant location analyzed using the event tree approach?

b. How was the event tree branch point probability split fractions determined for each fire scenario analyzed and for each branch point in the applicable event tree?

2. Section 4 of the fire analysis (beginning on page 228 of the submittal) provides a nominal discussion of how conditional core damage probability (or conditional core damage frequency) as cited in the submittal) values were quantified. Please provide further discussion on this subject that addresses the following points:

a. Modern fire probabilistic risk analyses (PRA) consider fire-induced cable failure modes and effects that generally extend beyond the scope of traditional deterministic post-fire safe shutdown success path analyses. The submittal (page 229) states that failures involving transfer of valves to the undesired position are considered as a result of the fire (i.e., motive power is conservatively available for such cases). Has the IPEEE fire analysis limited the scope of the cable failure modes and effects to that defined by the deterministic post-fire safe shutdown success path analysis (e.g., per the fire protection licensing basis) or has the treatment been broadened to include more generalized fire risk Enclosure

considerations? If the analysis has been expanded, please describe the nature and scope of that expansion.

b. Has WBN, Unit 2, utilized operator manual actions as a part of its post-fire safe shutdown compliance strategy and, if so, how were these operator manual actions incorporated into and quantified in the IPEEE fire analysis?

3. Section 5.5 in the main body of the licensee submittal (entitled FIVE Validation and beginning on page 33) cites several tasks that will be performed to validate the WBN, Unit 2, IPEEE fire analysis. Please answer the following questions relative to the cited tasks:

a. Which of these validation tasks have been completed?

b. For any uncompleted task, provide a completion schedule.

c. The identified validation tasks typically state that A representative population of rooms will be reviewed On what basis is a representative population of rooms selected and how did/does the selection process ensure that potentially risk significant plant features were properly characterized in the WBN, Unit 2, IPEEE fire analysis?

It appears that the IPEEE analysis for internal fires used the same process/approach/

methodology for WBN, Unit 1. In reviewing the RAIs that were asked for WBN, Unit 1, it is not clear how the information in the response to the WBN, Unit 1, RAIs was incorporated into the fire analysis for WBN, Unit 2. In responding to the RAIs 4 through 10, below, please provide the information in that context.

4. It is important that the human error probabilities (HEPs) used in the analysis properly reflect the potential effects of fire (e.g., smoke, heat, loss of lighting), even if these effects do not directly cause equipment damage in the scenarios being analyzed. If these effects are not treated, the HEPs may be optimistic and result in the improper screening of scenarios. Note that HEPs which are conservative with respect to an internal events analysis could be non-conservative with respect to a fire risk analysis.

The Watts Bar submittal indicates the only recovery actions modeled in the fire assessment were in the evaluation of the control room. The submittal does not discuss if and how fire impacts on post-initiator human errors that are in the individual plant examination models (e.g., initiation of feed and bleed) were addressed. Please identify:

a. The scenarios screened out from further analysis whose quantification involved one or more HEPs;

b. The HEPs (descriptions and numerical values) for each of these scenarios; and

c. How the effects of the postulated fires were treated.

5. Fires in the main control room (MCR) are potentially risk-significant because they can cause instrumentation and control failures (e.g., loss of signals or spurious signals) for multiple redundant divisions, and because they can force control room abandonment.

The Watts Bar submittal indicates that some, but not all, cabinets in the main control room have detectors inside. The Watts Bar main control room was evaluated using the guidance provided in the Electric Power Research Institute Fire PRA Implementation Guide [1]. A review of this methodology [2] has identified problems particularly with regard to the probability of control room abandonment. Although data from two experiments concerning the timing of smoke-induced, forced control room abandonment

[3] were used to obtain the probability reported in Reference 1, the data must be carefully interpreted, and use of the data must properly consider the differences in configuration between the experiments and the actual control room being evaluated for fire risk. In particular, the experimental configuration included placement of smoke detectors inside the cabinet in which the fire originated, as well as an open cabinet door.

In one case, failure to account for these configuration differences led to more than an order of magnitude underestimate in the conditional probability of forced control room fire abandonment [4]. In addition, another study raises questions about control room habitability due to room air temperature concerns [5].

a. Please provide a more detailed discussion on the evaluation of the main control room including the identified fire sources, the assumed fire frequency, and any frequency reduction factor. Identify which fire sources were modeled and discuss the fire damage that can be caused by each fire source including the potential for fire propagation and assigned probabilities.

b. Also discuss how fire detection and suppression were modeled, provide any suppression failure probabilities used in the analysis, provide the probability of abandonment used in the evaluation and its basis, and describe what recovery actions were credited and their probabilities. In particular, if the probability of abandonment is based on a probability distribution for the time required to suppress the fire, please justify the parametric form of the distribution and specify the data used t o quantify the distribution parameters.

6. NUREG-1407 [6], Section 4.2 and Appendix C, and GL 88-20, Supplement-l [7], request that documentation be submitted with the IPEEE submittal with regard to the Fire Risk Scoping Study (FRSS) issues [8], including the basis and assumptions used to address these issues, and a discussion of the findings and conclusions. NUREG-1407 also requests that evaluation results and potential improvements be specifically highlighted.

Control system interactions involving a combination of fire-induced failures and high probability random equipment failures were identified in the FRSS as potential contributors to fire risk. The issue of control systems interactions is associated primarily with the potential that a fire in the plant (e.g., the MCR) might lead to potential control systems vulnerabilities. Given a fire in the plant, the likely sources of control systems interactions could happen between the control room, the remote shutdown panel, and shutdown systems. Specific areas that have been identified as requiring attention in the resolution of this issue include:

a. Electrical independence of the remote shutdown control systems: The primary concern of control systems interactions occurs at plants that do not provide independent remote shutdown control systems. The electrical independence of the remote shutdown panel and the evaluation of the level of indication and control of remote shutdown control and monitoring circuits need to be assessed.

b. Loss of control equipment or power before transfer: The potential for loss of control power for certain control circuits as a result of hot-shorts and/or blown fuses before transferring control from the MCR to remote shutdown locations needs to be assessed.

c. Spurious actuation of components leading to component damage, loss-of-coolant accident (LOCA), or interfacing systems LOCA: The spurious actuation of one or more safety-related to safe-shutdown-related components as a result of fire-induced cable faults, hot-shorts, or component failures leading to component damage, LOCA, or interfacing systems LOCA, prior to taking control from the remote shutdown panel, needs to be assessed. This assessment also needs to include the spurious starting and running of pumps as well as the spurious repositioning of valves.

d. Total loss of system function: The potential for total loss of system function as a result of fire-induced redundant component failures or electrical distribution system (power source) failure needs to be addressed.

Provide an evaluation of whether loss of control power due to hot-shorts and/or blown fuses could occur prior to transferring control to the remote shutdown location and identify the risk contribution of these types of failures (if these failures are screened, please provide the basis for the screening). Provide an evaluation of whether spurious actuation of components as a result of fire-induced cable faults, hot-shorts, or component failures could lead to component damage, a LOCA, or interfacing systems LOCA prior to taking control from the remote shutdown panel (considering both spurious starting and running of pumps as well as the spurious repositioning of valves).

7. The Watts Bar submittal indicates that hot-shorts were conservatively assumed whenever necessary to fail a system function. However, only the potential for LOCA due to a hot-short opening the pressurizer power-operated relief valve was explicitly discussed in the submittal. Hot-shorts considerations should include the treatment of conductor-to-conductor shorts within a given cable. Hot-shorts in control cables can simulate the closing of control switches leading, for example, to the repositioning of valves, spurious operation of motors and pumps, or the shutdown of operating equipment. These types of faults might, for example, lead to a LOCA, a diversion of flow within various plant systems, dead heading and failure of important pumps, premature or undesirable switching of pump suction sources, or undesirable equipment operations.

For MCR abandonment scenarios, such spurious operations and actions may not be indicated at the remote shutdown panel(s), may not be directly recoverable from remote shutdown locations, or may lead to the loss of remote shutdown capability (e.g. through loss of remote shutdown panel power sources). In instrumentation circuits hot-shorts may cause misleading plant readings potentially leading to inappropriate control actions or generation of actuation signals for emergency safeguard features.

Discuss to what extent these issues have been considered in the IPEEE. If they have not been considered, please provide an assessment of how inclusion of potential hot-shorts would impact the quantification of fire risk scenarios in the IPEEE.

8. The submittal indicates that a probabilistic approach was used to model fire propagation and suppression in 45 fire compartments. This was accomplished by partitioning the fire frequency for a fire compartment into one or more cases (i.e., scenarios) for evaluation.

The partitioning was accomplished using a fire event tree that incorporates a fire severity factor and, in some compartments, both automatic and manual suppression. A specific level of fire damage to equipment that can mitigate an accident was assigned to each of the event tree sequences. Fire event tree sequences resulting in similar size fires were combined into one case. An example of a fire event tree is provided in the submittal for the auxiliary building corridor. The submittal also indicates that the fire damage potential for fire sources in unscreened compartments was examined by reviewing the individual fire sources in the fire compartments and the zone of influence of the fire source, and by determining the equipment located within that zone of influence. The submittal indicates that the FIVE fire modeling techniques were used to determine the damage potential of each fire source. Details about the fire modeling including equipment damage thresholds, heat release rates, and heat loss factors were not provided in the submittal.

Based on the description of the fire propagation and suppression analysis, it is not clear that the results of the FIVE fire modeling effort described above were used to determine the actual damage for each sequence of the fire event tree. The wording in the example provided in the submittal states that a specific level of damage was "assumed" for each case. Thus, from the language in the submittal, it is not clear that the probabilistic approach used in the Watts Bar fire assessment included a plant-specific evaluation of fire source and target combinations and that the competing impacts of fire growth and suppression were modeled.

a. Please provide a more detailed description of the probabilistic propagation and suppression method used in the fire assessment and include the following: (a) a more detailed description of how the fire modeling was incorporated into the analysis, and (b) a description of important fire modeling parameters including equipment damage thresholds, heat release rate from each source, and heat loss factors. Please provide the documentation of the analysis for the following three fire compartments: the auxiliary building corridor (713.0-A1), the cable spreading room (729.0-C1), and 250V battery room 2(692.0-C2). Include a description of the possible fire scenarios including the equipment damage related to each fire source taking into account the competing effects of propagation and suppression.

b. If damage levels were assumed for each case evaluated in the probabilistic model, indicate whether the damage levels are considered to be bounding estimates. If so, provide a discussion supporting the assumption of these estimates as bounding. Alternatively, reevaluate the 45 fire compartments using the FIVE methods for fire modeling that take into account the actual equipment layout and potential for propagation and suppression.

9. As mentioned above, the probabilistic approach used to partition the fire frequency in each compartment included the use of a fire severity factor. The submittal indicates that the ignition source/zone of influence evaluation described above was incorporated in some fashion in the severity factor determination. The severity factors and the partitioning event trees for each fire compartment are not presented in the submittal, and

thus it is not clear if each fire source in each compartment was evaluated separately or if the fire compartment was modeled at a simpler level (i.e., all fire sources assigned the same severity factor and damage potential).

The submittal indicates that fire suppression is not credited in the quantitative screening assessment. However, fire suppression was credited in the detailed analysis of some unscreened compartments in the auxiliary and control buildings. Based on the auxiliary building corridor example provided in the submittal, both automatic and manual fire suppression appear to have been credited in some compartments. The probabilities for automatic and manual fire suppression failure are not provided in the submittal. Allowing for suppression of severe fires can potentially lead to double counting of suppression since the severity factor evaluation could have counted fires that were not suppressed as severe fires. It could not be determined from the information provided in the submittal if double counting of fire suppression and fire severity factors was used in the WNS analysis.

Provide the following additional information concerning fire severity factors and suppression failure probabilities: (a) indicate if fire severity factors were evaluated for each fire source or if a single value was assigned to each fire compartment,(b) provide the fire severity factors used in the analysis of the auxiliary building corridor (713.0-AI),

the cable spreading room (729.0-CI), and 250V battery room 2 (692.0-C6) and include a description of their bases such that it can be determined if fire events that involved suppression were categorized as non-severe-fires, and (c) provide a table of the manual suppression failure probabilities used in the analysis including the bases for selecting the manual suppression failure probabilities.

10. The FIVE methodology [9] suggests values for automatic suppression failure probabilities for use in a FIVE assessment. This data is acceptable for systems that have been designed, installed, and maintained in accordance with appropriate industry standards, such as those published by National Fire Protection Agency (NFPA).

Provide a list of the automatic fire suppression systems failure probabilities used in the Watts Bar fire assessment. Indicate if the automatic fire suppression systems at Watts Bar are designed and maintained according to NFPA standards.

References

1. EPRI, "Fire PRA Implementation Guide," EPRI TR-105928, December 1995.

2. J. Lambright and M. Kazarians, "Review of the EPRI Fire PRA Implementation Guide,"

ERI/NRC 97-501, Energy Research, Inc., August 1997.

3. J. Chavez, et al., "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Cabinets, Part II-Room Effects Tests," NUREG /CR-4527/V2, October 1988.

4. J. Lambright, et aI., "A Review of Fire PRA Requantification Studies Reported in NSAC/181," prepared for the United States Nuclear Regulatory Commission, April 1994.

5. J. Usher and J. Boccio, Fire Environment Determination in the LaSalle Nuclear Power Plant Control Room, NUREG/CR-5037, prepared for the United States Nuclear Regulatory Commission, October 1987.

6. J. Chen, et al., "Procedural and Submittal Guidance for the Individual Plant Examination

of External Events (IPEEE) for Severe Accident Vulnerabilities," NUREG-1407, United States Nuclear Regulatory Commission, June 1991.

7. "Independent Plant Examination for External Events (IPEEE) for Severe Accident Vulnerabilities -10CFR 50.54(f), Generic Letter 88-20, Supplement No.4, United States Nuclear Regulatory Commission, June 1991.

8. J. Lambright, et a1., "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," NUREG/CR-5508, prepared for the United States Nuclear Regulatory Commission, January 1989.

9. EPRI, "Fire-Induced Vulnerability Evaluation (FIVE), EPRI TR-100370, April 1992.

SEISMIC EVENTS

1. The staff reviewed TVAs evaluation of seismic vulnerabilities for WBN 2, documented in its IPEEE submittal to the staff, dated April 30, 2010. As stated in the submittal, the WBN 2 seismic evaluation will follow the WBN 1 seismic evaluation very closely, and is expected to conclude that the WBN 2 plant HCLPF is at least 0.36g, the same value as reported for WBN 1.

TVA states in the

Introduction:

A final report will be submitted following certain validation activities, described herein, as WBN2 draws closer to operation. In Section 5.3, TVA identifies nine (9) validation activities in order to complete the SEISMIC MARGIN ASSESSMENT (SMA) for WBN 2. Consequently, the staff cannot complete its review of the WBN 2 seismic evaluation at this time.

The staff previously reviewed and accepted TVAs evaluation of seismic vulnerabilities for WBN 1, as documented in a report dated April 1999. Since WBN 1 and WBN 2 are identical in design, and have the same design-basis seismic ground motion, the staff fully expects the outcome of the WBN 2 SMA to be very similar to WBN 1. However, that determination must be based on the staffs review of the final report for WBN 2, following the validation activities.

To facilitate the staffs review of the final WBN 2 report, the staff requests TVA to submit the same scope of information for WBN 2, as it previously submitted for WBN 1. Special attention should be given in the final WBN 2 report to any differences in the SMA process and/or results, between WBN 1 and WBN 2. In addition please address the following:

a) discuss important non-seismic failures and human actions in your success paths, including a rationale for the assumed failure rate given a seismic event, as well as the extent to which a single failure may invalidate a success path.

b) Are any operator actions to reset bad-actor relays credited in the success paths? If so, describe these actions. Are these actions proceduralized? If not, justify taking credit for them.

c) Part of your analysis (e.g. - walkdowns, validation, etc.) will be done in the future when the plant is substantially completed. For example, validation activities, the peer review and its results, the final seismic results and important HCLPF values

(including the plant HCLPF and important components HCLPFs), and evaluation of containment functions will all be expected in the future. How and when do you plan on performing these and other finalized analyses and results?

d) Generic Issue 131 deals with the possibility of the movable in-core flux detector cart moving off the rails in a seismic event and interacting with the instrumentation tubes, causing a LOCA. In WBN1, this issue was addressed by restraining the cart. How will this issue be addressed in WBN2 and when do you plan on reporting on the final disposition of this issue?

e) Currently the WBN2 IPEEE submittal does not discuss your treatment of some aspects of GSI-172: seismically induced floods and fires, hydrogen line ruptures, seismic actuation of the fire protection system and its effect on the safety-related equipment, and seismic degradation of the fire protection system. How and when do you plan to treat these issues, and when will you report on your treatment?

f) For the WBN1 Individual Plant Examination (IPE) your definition of vulnerability was in terms of contribution to core damage frequency. What is your definition of vulnerability for the Seismic Margin Analysis you carried out for the WNB2 IPEEE, and have you found any seismic vulnerabilities?

OTHER EXTERNAL EVENTS

1. How and when do you intend to report the final analysis of the Other External Events, including the disposition of the tornado missile issue, which considers missiles from the plants surroundings and from the new boric acid mixing building?

2. What is your definition of vulnerability for the Other External Events analysis of WBN2, and have you found any vulnerabilities from the Other External Events analysis?