ML14302A806

Enclosure - Ninety-Day Response to NRC Request for Additional Information - National Fire Protection Association Standard 805

ML14302A806
Person / Time
Site:	Diablo Canyon
Issue date:	10/29/2014
From:	Pacific Gas & Electric Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML14302A804	List: DCL-14-098, Diablo Canyon, Units 1 and 2 - Ninety-Day Response to NRC Request for Additional Information- National Fire Protection Association Standard 805 DCL-14-098, Ninety-Day Response to NRC Request for Additional Information- National Fire Protection Association Standard 805 ML14302A806
References
DCL-14-098
Download: ML14302A806 (34)

Text

Enclosure PG&E Letter DCL-14-098 via the floor drains to the turbine building sump.

c) In the discussion of safety margin, the LAR states, "Due to the presence of redundant and adequately separated EDG systems, the inherent safety margin and conservatisms in these methods remain unchanged." Explain what is meant by the "inherent safety margin and conservatisms in these methods" relative to the lead-in to the statement that redundancy and separation exists in the design of the EDG systems. Discuss the safety margin in the context of the associated criteria described in LAR Section 4.5.2.2.

PG&E Response:

a) The valves described in PG&E NFPA 805 LAR, Attachment L, Approval Request No. 5 are the fuel oil day tank fill valves (fill valves). Each EDG day tank can be supplied with fuel oil via two fill valves, one from each of the two diesel fuel oil transfer pumps DFOTPs.

The fill valves are located in the same fire area as the EDGs themselves, separated by 2 normally open 3-hour fire rated roll-up doors. The doors are equipped with fusible links that will cause the doors to automatically close in the event of a fire in the area or upon actuation of the automatic C0 2 fire suppression system installed throughout the area. The space containing the fill valves is accessible in the event of a fire via another door to an adjacent fire area, and a locally staged wrench is available in each fire area in the event that manual operation is necessary. Finally, the valves' air supplies are equipped with fusible links that cause air to vent off, which will cause the valves to automatically close in the event of a fire, which will isolate the day tank from the DFOTPs.

To clarify, PG&E NFPA 805 LAR, Table 4-3 and Attachment Cis revised to add Fuel Oil Day Tank Fill Valves as fire protection features required to maintain an adequate balance of DID.

Fuel from the EOG day tanks is supplied to the EDG fuel injection system via a booster pump and two filters. This supply line is equipped with a check valve that prevents flow from the fuel injection system back into the EDG day tank, but there are no valves that would prevent flow from the day tank to the EDG fuel injection system.

To clarify, PG&E NFPA 805 LAR, Attachment L, Approval Request No.5, "Basis for Request," bullet No. 1 is revised as follows:

"The EDG day tank openings are provided with normally-closed valves and caps. ThereforeJ. the only open withdrawal connection is the fuel supply lines to the EDG engines. The fuel supply lines to the EDG engines ~

tanks are provided with normally open air-operated valves in this safety-related EDG system. These valves are in the same fire area as their 34

Enclosure PG&E Letter DCL-14-098 respective EDGs and EDG day tanks, but are separated from them by 3-hour fire rated roll-up doors that are equipped with fusible links to cause them to close in the event of a fire. Also. the valves are accessible from an adjacent fire area in the event of a fire and can be shut manually using locally staged wrenches. The addition of heat actuated, automatic closing shut-off valves in the fuel supply lines would introduce additional single failure possibilities that could have an adverse effect on EDG equipment reliability and availability."

b) The floor drains provided in each EDG room will not lead to a spread of fire to other fire areas for the following reasons:

• Each floor drain is covered by a circular grating and a supporting steel catch basin in the throat of the drain. This prevents debris that could lead to or sustain combustion from entering the drain system.

• A common 4-inch header connects the drains from the individual compartments with the turbine building sump. This drain header is a minimum of 3 feet 9 inches below the floor.

• Drainage of an oil spill in a compartment would not result in a flame pathway down the drain line since flame passage would be inhibited by the floor drain covers, oxygen depletion in the drain line, and the distance downward and laterally that the flame would have to traverse to propagate to the turbine building sump.

• Each EDG room is equipped with heat detectors that activate the total flooding C02 system for the fire area in the event of a fire, and close the roll-up doors on the west side of the space.

• In the worst case scenario, the entire supply of fuel oil has spilled from the EDG day tank in one EDG room and transient combustibles are located in the area of the drains. In this scenario, the fire would result in the activation of the C02 fire suppression system, which would prevent the fuel oil trapped in the drains from becoming heated to the auto-ignition temperature, by suppressing the fire in the affected area, thereby preventing propagation of fire through the drain.

Based on this justification, a fire involving fuel oil in the EDG room will not propagate through the drains.

To clarify, PG&E NFPA 805 LAR, Attachment L, Approval Request No. 5, "Basis for Request," bullet No. 3, sub-bullet No. 3 is revised as follows:

"The EDG day tanks are provided with floor drains in each EDG room. A common 4 inch pitched header, which is a minimum of 3'-9" below the 35

Enclosure PG&E Letter DCL-14-098 floor, connects the drains from each room with the TB sump. The drainage system will drain the quantity of an EDG day tank fuel oil spill to the TB sump. Drainage of fuel oil spills reduces the likelihood of a potential fire scenario impacting the EDG day tanks . The drainage system will not lead to a spread of fire to other fire areas for the following reasons:

• Each floor drain is covered by a circular grating and a supporting steel catch basin in the throat of the drain. This prevents debris that could lead to or sustain combustion from entering the drain system.

• Drainage of an oil spilt in a compartment would not result in a flame pathway down the drain line since flame passage would be inhibited by the floor drain covers. oxygen depletion in the drain line. and the distance downward and laterally that the flame would have to traverse to propagate to the turbine building sump.

• Each EDG room is equipped with heat detectors that activate the total flooding C0 2 system for the fire area in the event of a fire. and close the roll-up doors on the west side of the space.

• In the worst case scenario, the entire supply of fuel oil has spilled from the EDG day tank in one EDG room and transient combustibles are located in the area of the drains. In this scenario. the fire would result in the activation of the C02 fire suppression system. which would prevent the fuel oil trapped in the drains from becoming heated to the auto-ignition temperature.

by suppressing the fire in the affected area. thereby preventing propagation of fire through the drain.(

c) For the EDG rooms (Unit 1 Fire Areas TB-1, TB-2, and TB-3; Unit 2 Fire Areas TB-8, TB-9, and TB-17), the fire analysis involved the re-examination of plant system performance given the specific demands associated with postulated fire events. The methods, input parameters, and acceptance criteria used in these analyses have been reviewed against that used for the plant design basis events to establish that the Safety Margin inherent in the analyses for the plant design basis events have been preserved in the analysis for the fire event.

Specifically, the existence of sufficient fire separation between each of the EDG sets and offsite power ensures that a fire-induced failure involving one EDG will not cause a failure of the EDG system to either mitigate the consequences of an accident, or bring the Units to a SSD condition. Therefore, the Safety Margin inherent in the analyses for the plant design basis events has been preserved in the aria lysis for the fire event.

36

Enclosure PG&E Letter DCL-14-098 To clarify, PG&E NFPA 805 LAR, Attachment L, Approval Request No. 5, "Safety Margin and Defense-in-Depth," paragraph No. 1 is revised as follows:

"The use of the existing noncompliant EDG day tank withdrawal connections will not impact the ability of the plant to achieve and maintain fire SSD. Due to the presence of redundant and adequately separated EDG systems, the inherent safety margin and conservatisms in these methods remain unchanged. Specifically, due to the fire separation between each of the EDG sets and offsite power. a fire-induced failure involving one EDG will not cause a failure of the EDG system to either mitigate the consequences of an accident, or bring the Units to a SSD condition. Therefore. the Safety Margin inherent in the analyses for the plant design basis events has been preserved in the analysis for the fire event. "

NRC FPE RAI 8:

LAR Table 4-3 identifies radiant energy shields and electrical raceway fire barrier systems (ERFBS) as required features in several fire areas. LAR Attachment A, Element 3.11.5, states that ERFBS credited for NFPA 805, Chapter 4 complies with Element 3.11.5 through the use of existing engineering equivalency evaluations (EEEEs). The references for this element in LAR Attachment A indicates that Pyrocrete and 3M lnteram wrap are used . There is no specific compliance basis discussion with regard to the requirements of Generic Letter 86-10, Supplement 1, "Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Safe Shutdown Trains within the Same Fire Area," dated March 25, 1994 (ADAMS Accession No. ML031130661).

a) Please provide additional discussion regarding compliance with Element 3.11.5, including the exceptions, if applicable.

b) The reference for 3M lnteram wrap, MIP C-13.0, appears to be an installation procedure. Please describe the basis for compliance (see Item a) above.

c) Please state whether other ERFBS materials, other than Pyrocrete and 3M lnteram wrap, are credited in the NFPA 805 Chapter 4 analyses. If so, describe the location and the associated compliance basis for any such materials.

PG&E Response:

a) ERFBS credited for NFPA 805, Chapter 4 has been evaluated to ensure that installed configurations satisfy NFPA 805, 2001 edition, Element 3.11.5.

Specifically, DCPP uses exclusively 3M lnteram wrap and Pyrocrete as ERFBS in credited applications. These configurations satisfy the requirement as follows:

37

Enclosure PG&E Letter DCL-14-098 3M lnteram Wrap Installed 3M lnteram wrap configurations have been evaluated to satisfy the acceptance criteria ofGeneric Letter 86-10, Supplement 1. Therefore, 3M*

lnteram wrap configurations comply with Element 3.11.5.

Pyrocrete Installed Pyrocrete configurations have been evaluated to satisfy the acceptance criteria of ASTM E-119, "Fire Tests of Building Construction Materials." As stated in NFPA 805, 2001 edition, Element 3.11.5, exception no. 2:

"ERFBS systems employed prior to the issuance of Generic Letter 86-10, Supplement 1, are acceptable providing that the system successfully met the limiting end point temperature requirements as specified by the AHJ at the time of acceptance."

As stated in Appendix A to BTP APCSB 9.5-1, and cited in Enclosure 1 to Generic Letter 86-10, Supplement 1:

"Fire barriers are 'rated' for fire resistance by being exposed to a 'standard test fire.' This standard test fire is defined by the American Society of Testing and Materials in ASTM E-119."

The DCPP fire protection program was evaluated against Appendix A to BTP APCSB 9.5-1, which defined the acceptance criteria of ASTM E-119 as acceptable end point temperature requirements. Therefore, Pyrocrete configurations comply with Element 3.11.5, exception no. 2.

Based on the above, PG&E NFPA 805 LAR, Attachment A, Element 3.11.5, reference document is revised as follows:

• FHARE No. 138, "Drain Holes in Pyrocrete Panels in Fire Areas 10 and 20," Revision 0, dated November 4 1998

• FHARE No. 145, "Pyrocrete Enclosure Thickness," Revision 1, dated May 9,2001

• MIP C 10.0, "Pyrocrete Installation (DCP 207) ," Revision 4

• MIP C 13.0, "3M lnteram Fire Protection System (DCP 212)," Revision 3

• Calculation C-FP-1 04, "Evaluation of 3M Series E-50 Raceway Fire Barrier Wrap Configurations at DCPP", Revision 001/01

• Replacement Part Evaluation C-7222, "Pyrocrete 241 to Replace Pyrocrete 201", Revision 0" b) As discussed in the response to FPE RAI-08.a, installed 3M lnteram wrap configurations have been evaluated to satisfy the acceptance criteria of Generic 38

Enclosure PG&E Letter DCL-14-098 Letter 86-10, Supplement 1. Therefore, 3M lnteram wrap configurations comply with Element 3.11.5.

Based on the above, PG&E NFPA 805 LAR, Attachment A, Element 3.11.5 reference document is revised as described in the response to FPE RAI-08.a.

c) Per PG&E calculation, DCPP uses exclusively 3M lnteram wrap and Pyrocrete as ERFBS in credited applications.

NRC Fire Modeling (FM) RAI 2:

ASME/ANS [American Society of Mechanical Engineers/American Nuclear Society]

Standard RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications," Part 4, requires damage thresholds be established to support the FPRA. Thermal impact(s) must be considered in determining the potential for thermal damage of SSCs and appropriate temperature and critical heat flux criteria must be used in the analysis.

a) Please describe how the installed cabling in the power block was characterized, specifically with regard to the critical damage threshold temperatures and critical heat fluxes for thermoset and thermoplastic cables as described in NUREG/CR-6850. .

b) Please describe how cable tray covers, fire-resistive wraps, and conduits affect the damage thresholds that were characterized, e.g., with regard to damage criteria, fire propagation, etc., in the fire modeling analyses. In addition, explain how holes in cable tray covers were treated in this respect.

c) Please provide the technical justification for the method used to establish the damage thresholds for temperature sensitive equipment and address any limitations of the method that were considered in the determination of damage conditions.

PG&E Response:

a) NUREG/CR-6850, Appendix H, provides damage and ignition criteria for both thermoset and thermoplastic cables that are typically found in nuclear power plants. Specifically, Table H-1 provides both the radiant heat and the temperature damage criteria for both types of cables.

A review of all plant cables was performed and documented at DCPP using cable specifications (i.e., manufacturer, cable insulation/jacket material, etc.) to determine the type (i.e., thermoset or thermoplastic) of cables installed. This analysis was used to determine the appropriate thermal damage threshold for FM purposes. Based on the review of cable types in each compartment, those 39

Enclosure PG&E Letter DCL-14-098 raceways and conduits containing a mix of thermoset and thermoplastic, or unknown cables, have been conservatively damaged as thermoplastic.

Per Appendix H of NUREG/CR-6850, the following thermal damage criteria have been used for thermoplastic targets. These criteria have also been applied to raceways containing mixed or unknown cable types:

Critical Temperature: 205°C (400°F)

Critical Heat Flux: 6 kW/m 2 (0.5 BTU/fFs)

For raceways and conduits known to contain only thermoset cables, the following damage criteria have been used:

Critical Temperature: 330°C (625°F)

Critical Heat Flux: 11 kW/m 2 (1.0 BTU/fFs) b) The damage threshold for FPRA target cables in conduit and cable trays was based on the damage thresholds identified in NUREG/CR-6850, Table H-1.

Cable Tray Covers Some cable trays are provided with bottom covers and/or are fully enclosed, which allows for credit for FPRA risk reduction. Cable tray covers do not impact the cable damage thresholds, but are credited with delaying damage and ignition in accordance with NUREG/CR-0381 and NUREG/CR-6850, Appendix 0.2.2.

The acceptability of these covers/enclosures was determined through walkdowns and review of DCPP cover/enclosure documentation. These cable tray covers have been evaluated and confirmed to be outside the ZOI of any high hazard event (HEAF, hydrogen, or transformer explosion) which may cause mechanical damage to the cover.

Tray covers were also visually inspected for holes or gaps. Any bottom covers with holes or gaps were not credited to delay damage; however, credit may have been given to delay ignition, as long as the holes or gaps were very small (i.e., 1 inch or less) and infrequent (i.e., spaced 3 or more feet apart). Postulating full ignition of the trays with these covers would be overly conservative due to the small size of the gaps. In addition, the small number of gaps ensures that there is a very low probability of a fire location capable of igniting the cables within the tray covers.

Fire compartments crediting bottom tray covers are listed in the following table.

Table 1: Fire Compartments Crediting Bottom Tray Covers 3-CC-100 3-CC-115 5-A-1 5-A-2 5-A-3 5-A-4 5-B-1 5-B-2 5-B-3 5-B-4 6-A-1 6-A-2 40

Enclosure PG&E Letter DCL-14-098 16-A-3 16-B-1 16-B-2 16-B-3 17-A 17-B Fire-Resistive Wraps Some FPRA conduit and cable trays are provided with 1, 2 or 3-hour fire wrap, which allows for credit for FPRA risk reduction. Fire wraps are credited with delaying damage and ignition based on the manufacturer's rating. Existing fire wraps were visually inspected and have been evaluated and confirmed to be outside the ZOI of any high hazard event (HEAF, hydrogen or transformer explosion) which may cause mechanical damage to the wraps; or, if within the ZOI of a high hazard event, wraps are not credited to prevent damage in those scenarios. All fire wraps confirmed to be currently intact, undamaged, and outside the ZOI of high hazard events were credited to prevent damage to the FPRA targets contained within for the duration of the wrap rating. Fire compartments crediting fire wraps are listed in the following table.

Table 2: Fire Compartments Crediting Fire Wraps 1-A 3-BB-115 3-CC-1 00 3-CC-115 5-A-4 5-B-4 9-A 10-76 10-85 20-76 20-85 22-C In Fire Compartment 3-BB-115, 1-hour fire wrap will be installed as part of an NFPA 805 modification per LAR Section 4.8.2.4. The relevant FPRA targets have been evaluated and confirmed to be outside the ZOI of any high hazard event. . Therefore, while this wrap has not yet been installed, credit is given for the wrap in the FPRA calculation.

In Fire Compartments 1-A and 9-A, the Unit 1 and Unit 2 Containment Annulus, respectively, a review of the ignition sources shows that there are no high hazard sources that would mechanically damage the wrap; therefore, credit is given for fire wrap in the FPRA.

Conduit Target damage to cables in conduit was conservatively considered to occur when the exposure environment met or exceeded the damage threshold for the cable.

The conduit was not credited to delay damage to the cable, but is credited to prevent ignition.

c) NUREG/CR-6850, Volume 2, Section H.2 recommends the use of 65°C and 3 kW/m 2 as the critical damage temperature and heat flux for solid state components (e.g ., sensitive electronic equipment).

All analyses that consider damage to sensitive electronics by hot gas layer immersion (i.e., gas layers above 65°C engulfing the cabinet) are consistent with the critical temperature threshold established in the NUREG/CR-6850 guidance.

41

Enclosure PG&E Letter DCL-14-098 This hot gas layer analysis is documented in the DCPP verification and validation docu mentation.

Analyses considering damage by radiant heat are consistent with the guidance provided in FPRA FAQ 13-0004, which relies on the shielding characteristics of cabinet walls to allow the radiant damage to the ZOI for thermoset cables (i.e., 1.1 kW/m 2 ) to be used. The FAQ can be applied to cabinets as long as the component is not mounted on the surface of the cabinet (front or back wall/door) where it would be directly exposed to the convective and/or radiant energy of an exposure fire, and where the presence of louvers or other ventilation means could expose the cabinet to damaging heat fluxes, invalidating the FAQ results.

Field inspections were performed on all cabinets containing sensitive electronics that make use of the heat flux damage threshold of FPRA FAQ 13-0004 to verify that the limitations were not exceeded.

Additional details regarding the treatment of sensitive electronics are provided in the DCPP response to PRA RAI 04.

NRC PRA RAI 2:

Section 2.4.3.3 of NFPA 805 states that the PRA approach, methods, and data shall be acceptable to the NRC. RG 1.205 identifies NUREG/CR-6850 as documenting a methodology for conducting an FPRA and endorses, with exceptions and clarifications, NEI 04-02, Revision 2, as providing methods acceptable to the staff for adopting a fire protection program consistent with NFPA-805. RG 1.200 describes a peer review process utilizing an associated ASME/ANS standard (currently ASME/ANS-RA-Sa-2009) as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established. The primary results of a peer review are the F&Os recorded by the peer review and the subsequent resolution of these F&Os.

Please clarify the following dispositions to Internal Events F&Os and SR assessment identified in LAR Attachment U that have the potential to impact the FPRA results and do not appear to be fully resolved:

a) SC-A5-01: (Modeling actions needed to reach stable plant condition in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

F&O SC-A5-01 observes that for sequences that do not achieve stable plant conditions in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, system recovery or operator actions needed to attain a stable state should be modeled in the PRA. the disposition to this F&O explains that the FPRA was updated to include supplemental water supply to auxiliary feedwater (AFW) for non-loss-of-coolant accident (LOCA) scenarios. Though not explicitly stated, the F&O disposition implies that accident sequences were reviewed to ensure that they reach a stable state in a 24-hour mission time.

Explain whether the FPRA accident sequences were reviewed to ensure that the actions needed to reach a stable state in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> were modeled. If modeling of these actions was not incorporated, then provide justification or incorporate this 42

Enclosure PG&E Letter OCL-14-098 excluded modeling into the integrated analysis performed in response to PRA RAI3.

b) SY-A16-01, SY-B15-01, HR-A1-01, HR-A3-01. HR-C3-01. and 03-01: (Pre-initiators)

Regarding the lack of complete treatment of pre-initiator modeling, the dispositions to F&Os SY-A16-01, SY-B15-01, HR-A1-01, HR-A3-01, HR-C3-01, and 03-01 explain that a sensitivity study was performed for the FPRA indicating that the risk increase associated with complete treatment of pre-initiators is less than 1o/o of the FPRA COF and LERF. Provide a method to ensure that that the excluded pre-initiators will be incorporated into the FPRA model before using the model for self-approval of post-transition changes as requested in PRA RAI 3.b.

c) SY-B1 0-01: (Actuation logic permissives and interlocks)

The disposition to this F&O indicates that actuation logic permissives and interlocks were not directly modeled but were included as part of the FPRA circuit analysis. The NRC staff notes that this seems to indicate that fire-induced failures of permissives and interlocks were modeled but random failures were not modeled and that the impact of this modeling treatment on the risk estimates is not clear. Explain how the actuation logic permissives and interlocks were modeled in the FPRA. Include a discussion of failures (e.g., random failures) that were excluded as a result of not directly modeling actuation logic permissives and interlocks and their impact on the risk estimates. If the current treatment impacts the risk estimates, then incorporate direct modeling of actuation logic permissives and interlocks in the integrated analysis performed in response to PRA RAI3.

d) SY-C2-01 and SY-B8-01: (HVAC dependency)

F&Os SY-C2-01 and SY-B8-01 observe that room heat-up and HVAC dependency discussions are absent from the system notebooks. The analysis does not present room heat-up calculation results or system success depe'ndency on HVAC but does state: "room heat-up calculations are used throughout the OCPP PRA either as a basis for operator timing or to demonstrate that loss of cooling would not impact modelled SSCs." The NRC staff notes that this statement appears to imply that HVAC may not have been modeled in the PRA, and based on the above, the dependency of system success on HVAC is not clear. Clarify whether HVAC is modeled in the lEPRA and FPRA and how system success dependency on HVAC is determined.

e) OA-04-0 1: (Errors in the Bayesian update)

The disposition to this F&O does not confirm that a Bayesian update was performed addressing the specific concerns defined in the F&O. Clarify whether the five specific concerns defined in the F&O were addressed and if not, provide justification.

f) IF SO-A 1-01 through IFPP-A5-01: (Fire-induced flooding or sprays) 43

Enclosure PG&E Letter DCL-14-098 The dispositions to all 14 Internal Flooding F&Os (five Suggestions and nine Findings) include the following statement as part of the rational for why the F&Os could not impact the FPRA: "During the development of the FPRA, no fire-induced flood scenario was identified." Clarify whether any fire event can result in internal flooding or a spray effect that contributes to fire risk. In the response, include discussion of interfacing system LOCA (ISLOCA) sequences and fire suppression actuation. If a fire event can result in internal flooding or a spray effect that contributes to fire risk, include these impacts into the integrated analysis provided in response to PRA RAI 3.

PG&E Response:

a) In response to F&O SC-A5-01, PG&E reviewed the fire and internal events accident sequences, success criteria and associated TH analysis to verify that a stable plant condition could be achieved for a minimum mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The review included verification that individual SSCs could support the minimum mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The review concluded that for scenarios where a stable hot shutdown condition was desired, the CST inventory would be depleted in less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> unless additional secondary inventory was made available. The PRA model at the time of the internal events peer review did not contain the equipment or operator actions necessary to assess whether a stable state was reached using AFW cooling alone. For the Internal Events model, long-term AFW cooling is credited only if the closed loop RHR cooling is not available. In the FPRA, only long-term AFW cooling is credited; closed Loop RHR cooling is not credited.

For SLOCA sequences, RCS leakage and injection by itself is not sufficient to cooldown and bring the RCS pressure to RHR entry conditions. These sequences require AFW cooling to reduce RCS pressure and temperature prior to depletion of the RWST and switch-over to RHR containment sump recirculation. The results of the TH runs for various sizes of SLOCAs show that the existing CST volume is sufficient to support the required secondary cooling function. Therefore supplemental secondary inventory supply within a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is not required to mitigate Internal Events or fire induced SLOCA sequences.

For MLOCA and LLOCA sequences, the TH runs indicate that the RCS is rapidly depressurized and that additional cooling via the AFW is not necessary.

Therefore make-up to the CST within 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is not required to mitigate MLOCA or LLOCA sequences.

As discussed above, supplemental secondary inventory is required for non-LOCA scenarios in order to maintain a stable hot shutdown condition for a minimum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Modeling changes were made to incorporate requirements in F&O SC-A5-01. The FPRA model will be refined, and the 44

Enclosure PG&E Letter DCL-14-098 Internal Events model will be updated as well. The updated model with the additional inventory requirement will be used in the preparation of the response to PRA RAI3.

b) As documented in a PRA calculation, new additional pre-initiator HFEs were identified using a systematic approach and included into the PRA model in various systems. As a result of the new analysis and updated screening criteria performed, all newly identified pre-initiator HFEs are now modeled in the base post-transition PRA. As there are no excluded pre-initiators in the base FPRA model, it is not necessary to establish a method or process of incorporating "excluded" pre-initiators into the FPRA model before using the model for self-approval of post-transition changes as requested in PRA RAI 3.b.

c) In order to develop the responses to this RAI, PG&E performed a systematic evaluation of modeling of permissives and interlocks in the lEPRA and the FPRA.

The evaluation includes identification and modeling of (1) those systems that are required for initiation and actuation of a system, (2) the conditions needed for automatic actuation (e.g., low vessel water level), and (3) control features (e.g.,

protection and control permissive, lock-out signals, and component interlocks) that are required to complete actuation logic, as required in the Supporting Requirement (SR) of Section 2 of AMSE/ANS RA-SA-2009 Standard.

Systems Required for Initiation and Actuation The systems that are modeled in the lEPRA and FPRA include the SSPS and AM SAC.

The SSPS and the AMSAC are modeled in the lEPRA using a detailed fault tree including random failures of all instrument channels, logic cards, and actuation relays.

The FPRA included additional impacts such as direct fire-induced damage to the SSPS cabinets which house the subcomponents modeled in the lEPRA as well as damage to the input signals (e.g., pressure transmitters and associated cables) . The risk importance of the AM SAC is considered low. The FPRA does not credit AMSAC and no fire impact to AMSAC or associated inputs/cables is modeled.

The lEPRA and FPRA used to support the NFPA 805 Transition LAR adequately modeled the impact of random failures and fire damages to systems required for initiation and actuation. No additional model change is required to perform the integrated analysis in response to PRA RAI 3.

45

Enclosure PG&E Letter DCL-14-098 Conditions Needed for Automatic Actuation

• The lEPRA includes conditions that are needed to automatically start the standby trains of risk important systems such as the ASW, CCW, and the EDG systems.

As an example, the pressure switches in both trains of the discharge headers of the ASW system are included in the ASW system fault tree. One of these pressure switches automatically starts the standby ASW pump when the in-service ASW pump trips causing a low pressure condition in the corresponding discharge header.

The FPRA includes fire impacts on the transmitters and cables associated with these automatic actuation signals.

The lEPRA and FPRA used to support the NFPA 805 Transition LAR adequately modeled the impact of random failures and fire damages to automatic actuation of modeled systems. No additional model change is required to perform the integrated analysis in response to PRA RAI 3.

Control Features Required to Complete Actuation Logic The evaluation considers two different types of permissives and interlocks w; (1)

Protection Permissives and Interlocks (i.e., P series) and Control Permissives and Interlocks (i.e., C series), and (2) interlocks among. ECCS SSCs and other risk significant components that could impact proper system function.

A detailed review of the Protection and Control Permissives and lock-out signals shows that their failures have no impact on the lEPRA and FPRA and can be screened out. In the case of both the lEPRA and FPRA the functions of many of the Protection and Control Permissives/lnterlocks are not credited as they have no impact on risk. Failures of the remaining Protection and Control Permissives/lnterlocks in the lEPRA either do not impact a credited function or are of very low likelihood. In the case of the FPRA the remaining Protection and Control Permissives/lnterlocks either do not impact a credited function or the function is already assumed failed in the FPRA. Therefore their failures, either random or fire induced, are not considered in the lEPRA and the FPRA.

A review of all ECCS SSCs and other risk significant components identifies the SSCs, as shown in Table 1 below, as failures of associated interlocks having a potential risk impact. Table 1 provides, for each identified SSC, a description of function that the associated interlock supports, and impacts on the lEPRA and FPRA models.

Based on the results of the evaluation of modeling of permissives and interlocks in the lEPRA and the FPRA as summarized in Table 1, the following changes will be incorporated in the integrated analysis performed in response to PRA RAI-3.

46

Enclosure PG&E Letter DCL-14-098 PRA Function Component Impacted by Recommended Change Permissive/Interlock Model RCS Pressure (PC405AX) &

8701 Open Valve Pressurizer Temperature (TC454) permissives Model RCS Pressure (PC403AX) 8702 Open Valve permissive Model 8700A (Stem travel limit 8982A Open Valve Switch) & 8700A (Motor operator contacts) interlocks Model 87008 (Stem travel limit 89828 Open Valve Switch) & 87008 (Motor operator contacts) interlocks Model 8982A Position, 8701 Position 9003A Open Valve

& 8702 Position Interlocks Model 89828 Position, 8701 Position 90038 Open Valve

& 8702 Position Interlocks Model 8982A Position, 8701 Position, 8804A Open Valve 8702 Position, 897 4A Position &

89748 Position Interlocks Model 89828 Position, 8701 Position, 88048 Open Valve 8702 Position, 897 4A Position &

89748 Position Interlocks 47

Enclosure PG&E Letter DCL-14-098 Table 1 - Review of SSe Interlocks with Risk Impacts sse sse Description Interlock Function Impacts on lEPRA Impacts on FPRA RHR-8701 RHR Suction from RCS 8701: RCS Pressure Failures of either a RCS The FPRA does not credit the Hot-Leg. (PC405AX) and pressure transmitter or a RCS RHR closed loop cooling. The RHR-8702 Pressurizer Temperature, temperature transmitter can fire induced failed-to-open Normal Position: closed TC454. prevent their open function. The function of 8701, 8702, or their with power to the valve Open position is modeled in the interlocks are not needed to be actuator removed. 8702: RCS Pressure, lEPRA. The failure of the modeled in the FPRA.

PC403AX.

Desired Position: interlocks for 8701 and 8702 Fire-induced hot-short spurious Allow opening when RCS should be modeled Internal Events: opening is considered non-Press <390 psig and available for open Given power to the valve credible as the guidance in Temp <474 degrees F actuators is removed, spurious NUREG/CR-7150 recommends Fire: Closed opening of both 8701 and 8702 screening out three-phase due to failure of any associated proper polarity hot shorts.

interlocks is incredible and this failure mode is screened from the lEPRA which could lead to ISLOCA. This failure model is screened based on its low failure probability.

SI-8982A RHR Suction from 8982A(B): 8700A(B) Stem Failure of a single interlock (i.e., In accordance with the Containment Sump mounted limit switch, 8700A(B) valve position switch) guidance provided in Tasks 3 Sl-89828 POS640(POS647), and prevents opening of 8982A(B). and 9 of NUREG/CR-6850, Normal Position: closed motor operator contacts, This failure mode should be FPRA identified and modeled with power to the valve POS641 (POS648). modeled in the lEPRA. the associated circuits of actuator removed via the interlocks, of which fire series contactor Prevent concurrent Spurious failure of two valve damage causes the failure of opening of suctions from position switches is required to Desired Position: the main component.

the RWST via 8700A(B) cause spurious opening of Internal Events: and the Containment 8982A(B), which could lead to Available for open Sump via 8982A(B) inadvertent drain down of the RWST. This failure mode is Fire: Available for open screened based on its low failure probability.

CS-9003A RHR to Containment 9003A(B): 8982A(B) limit Failure of either 8982A(B) valve Containment Spray (CS)

Spray switch, POS626(633) and position switch or both 8701 & including via RHR system is 48

Enclosure PG&E Letter DCL-14-098 Table 1 - Review of SSe Interlocks with Risk Impacts sse SSe Description Interlock Function Impacts on lEPRA Impacts on FPRA CS-90038 Normal Position: Closed 8701/8702 limit switches, 8702 valve position switches not credited in FPRA because POS67 4X/669X. prevent opening of 9003A(8). of its low risk reduction.

Desired Position:

This failure mode should be Opening of 9003A(8) Spurious opening of 9003A(8)

Internal Events: modeled in the IEPRA.

requires opening of with concurrent spurious Available for open 8982A(8) and closure of Spurious failure of this interlock operation of RHR pumps could Fire: Closed either 8701 or 8702. allows 9003A(8) to be manually lead to an inadvertent drain opened when plant conditions down of the RWST. In might not allow it. However, this accordance with the guidance requires an error of commission provided in Tasks 3 and 9 of in conjunction with spurious NUREG/CR-6850, FPRA failure of the interlock. This identified and modeled the failure mode is screened based associated circuits of on its low failure probability. interlocks, of which fire damage causes the spurious failure of 9003A(8).

SI-8804A RHR to Charging or Sl 8804A(8): 8982A(8) limit Failure of either 8982A(8) valve In accordance with the pumps switch, POS626(633), position switch or both 8701 & guidance provided in Tasks 3 Sl-88048 8701/8702 limit switches, 8702 valve position switch or and 9 of NUREG/CR-6850, Normal Position: Closed POS67 4X/669X, and both 897 4A & 897 4B valve FPRA identified and modeled Desired Position: 8984A(8) limit switches, position indication prevents the associated circuits of POS476(469) . opening of 8804A(8). This interlocks, of which fire Internal Events:

failure mode should be modeled damage causes the failure-to-Available for open Opening of 8804A(8) in the lEPRA. open of 8804A(8).

requires opening of Fire: Available for open Spurious failure of this interlock 8982A(8), closure of either Spurious opening of 8804A(8) 8701 or 8702 and closure allows 8804A(8) to be opened during the Containment Sump of either 897 4A or 89748. manually when plant conditions Recirculation Cooling phase might not allow it. However, this could lead to a flow diversion of requires an error of commission the low pressure cold-leg in conjunction with spurious injection flow to the suction failure of the interlock. This side of the ECCS injection failure mode is screened based pumps.

on its low failure probability.

This does not result in a loss of the Containment sump volume 49

Enclosure PG&E Letter DCL-14-098 Table 1 -Review of sse Interlocks with Risk Impacts

_I sse SSe Description Interlock Function Impacts on lEPRA Impacts on FPRA to the outside of the Containment (i.e., RWST) due  :

to reverse check valves I between the ECCS pump I suction and the RWST. Risk contribution from fire scenarios involving spurious opening of 8804A(8) should be low and is not modeled in the FPRA.

eves- Charging Suction from 1128/C: 8805A(8) limit Demand failure of the interlock The logic for screening out fire LCV-1128 VCT switches, POS564/572 would allow these valves to induced spurious and demand remain open during an Sl. failures of this interlock are the eves- Normal Position: Open Closure of either 1128 or However this will not result in same for the FPRA as the LCV-112C 112C requires opening of Desired Position: cavitation of the charging pumps lEPRA. Therefore FPRA does either 8805A or 8805 8 as an Sl should open 8805A(8) not consider the fire-induced Internal Events: Closed aligning the charging water failure of this interlock.

Fire: Closed supply from the RWST and

.. pressure difference between the VCT and the static head of the RWST should keep a check valve in the VCT outlet remain closed. Therefore demand failure of the LCV-1128(C) interlock is screened out.

Spurious failure of the LCV-1128(C) interlock would allow closure of these valves when both 8805A and 88058 are closed. If both 8805A and 88058 fail to open on an Sl, then charging is failed in any case.

Failure of the charging water supply via 8805A(8) is

_conservatively modeled without so

Enclosure PG&E Letter DCL-14-098 Table 1 - Review of SSe Interlocks with Risk Impacts sse SSe Description Interlock Function Impacts on lEPRA Impacts on FPRA considering concurrent spurious failure of the LCV-112B(C) interlock. Therefore a spurious failure of this interlock can be screened out.

SFP-PP-2 Spent Fuel Pump (SFP) SFP 2 cannot be started Demand failure of the SFP 2 The logic for screening out the 2 when a Phase A actuation interlock would allow starting the spurious and demand failures is present. If running pump during a Phase A of this interlock is the same for during a Phase A isolation. The purpose of this the FPRA as the lEPRA.

actuation, the running interlock is to shed the SFP 2 pump will stop. Note that load from the diesel generator.

SFP 1 has no such However, adding the SFP pump permissive/interlock. to the diesel loading will not exceed the diesel rating capacity. Therefore, this failure mode can be screened out of the lEPRA.

The lEPRA credits the SFP pumps for refilling the RWST after certain small LOCAs.

Since a small LOCA will always generate an Sl signal and corresponding Phase A actuation, this interlock will prevent crediting SFP 2 for refilling the RWST. However, based on the availability of unaffected SFP 1 and the significant time available between the Sl and needs for make-up to the RWST during a small LOCA, the risk contribution of the unavailability of SFP 2 due 51

Enclosure PG&E Letter DCL-14-098 Table 1 - Review of SSe Interlocks with Risk Impacts sse SSe Description Interlock Function Impacts on lEPRA Impacts on FPRA to the presence of the Phase A signal should be low and is not modeled.

Spurious failure of the interlock prevents the start/run of SFP Pump 2 with no Phase A signal present. The absence of a Phase A isolation signal implies no small LOCA. However, SFP 2 is only credited in scenarios that generate a Phase A signal. This failure mode can be screened out of the IEPRA.

52

Enclosure PG&E Letter DCL-14-098 d) The lEPRA incorporated the results of room heat-up calculations and system success dependency on HVAC. The FPRA includes fire impacts on credited HVAC SSCs. The results of room heat-up calculations provide a basis for operator action timing or to demonstrate that a loss of cooling would not impact modeled SSCs. A SSC requiring cooling is considered failed if the cooling is not available either due to random failure of the HVAC SSC or fire damage to HVAC and if operators fail to establish alternate ventilation/cooling within the time estimated based on the room heat-up calculations.

e) The Bayesian updating process is done using the built-in RISKMAN Data Module. Throughout the process, RISKMAN shows the analyst a plot of the prior distribution, and a plot of the prior distribution together with the posterior distribution. RISKMAN also shows various statistics for these distributions such as the mean, median, and range factor. This process helps the analyst determine if the update and the distributions are valid and make sense.

Subsequent to the DCPP NFPA 805 LAR submittal, the Bayesian update checks for all failure rates and all initiating events were added as an attachment to the PRA Data Update Calculation that include a picture of an overlay of the prior and posterior distribution graph as well as check boxes for the five supporting requirement concerns. The five specific concerns associated with the ANS/ASME 2009 PRA Standard supporting requirements (SRs) were addressed and are as follows:

SR DA-D4(a) Confirmation that the Bayesian updating does not produce a posterior distribution with a single bin histogram PG&E Response: Confirmed that the RISKMAN Bayesian updating uses multi-bin (i.e., 100 bins) to produce a distribution including a posterior.

SR DA-D4(b) Examination of the cause of any unusual (e.g.,

multimodal) posterior distribution shapes PG&E Response: The examination of the plots of the posterior distribution does not reveal any unusual distribution shapes.

SR DA-D4( c) Examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate PG&E Responses: The examination of the prior and posterior distributions of data variables shows no unusual or significant shift of 53

Enclosure PG&E Letter DCL-14-098 the mean values between the prior and posterior indicating the plant-specific evidence is consistent with the prior distribution.

SR DA-D4(d) Confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered PG&E Response: The examination of the prior and posterior distributions of data variables shows no unusual shift or shapes indicating that the RISKMAN Bayesian updating algorithm provides meaningful results over the range of values being considered.

SR DA-D4(e) Confirmation of the reasonableness of the posterior distribution mean value PG&E Response: The examination of the mean value of the prior and the plant specific evidence of each data variable shows that the posterior distribution mean value is reasonable.

f) Fire Induced Flooding Impacts A review of potential flooding from fire induced rupture of expansion joints was performed and this evaluation determined that the fire induced expansion joint rupture scenario contributing to fire risk includes the ASW unit crosstie expansion joint SW-0-EJ 1 in Fire Area 30-A-5. A fire induced rupture of the ASW unit crosstie expansion joint SW-O-EJ1 has the potential to divert the discharge of the ASW pumps for Unit 2 if the crosstie valves 2-FCV-495 and 2-FCV-496 are not closed from the control room. The loss of both Unit 2 ASW pumps is not bounded by the current Unit 2 damage impacts for Fire Compartment 30-A-5. Accordingly, the FPRA model will be updated such that the operator action to close train crosstie valves 2-FCV-495 and 2-FCV-496 must be performed for any fire event in Fire Compartment 30-A-5 to prevent both Unit 2 ASW pumps failing due to flow diversion through the ruptured expansion joint. This will be included in the integrated analysis provided in response to PRA RAI-03.

Fire Induced Spray Impacts A review of fire compartments was performed to determine the impact of automatic water suppression systems on FPRA credited equipment due to localized actuation from individual fires. Fire compartments were evaluated for impact from automatic fire suppression even if the system was not credited for fire suppression. This evaluation determined that automatic water suppression has a fire risk contribution to the motor driven AFW pumps in fire areas 3-Q-2 and 3-T-2. Detailed FM showed that the automatic suppression 54

Enclosure PG&E Letter DCL-14-098 system does not activate for transient fires and electrical AFW pump motor fire scenarios, but only for the AFW pump oil fire scenarios in fire compartments 3-Q-2 and 3-T-2. Accordingly both motor driven AFW pumps will be failed for all AFW pump oil fire scenarios in Fire Areas 3-Q-2 and 3-T-

2. This will be included in the integrated analysis provided in response to PRA RAI-03.

Fire Induced ISLOCA Sequences The two fire induced ISLOCA scenarios identified for the PRA model include excess letdown line isolation valves and normal letdown line isolation valves.

No recovery is credited for preventing core damage since the ISLOCA event tree requires success of the containment fan cooling system, which is assumed to fail for all fire scenarios. Accordingly the fire induced ISLOCA sequences have a conditional core damage probability of 1.0 and any collateral equipment damaged from flooding would not further increase core damage fire risk. The risk contribution of this conservative modeling of ISLOCA was determined to be insignificant, thus it is considered acceptable.

The fire induced ISLOCA sequences will have a conditional large early release probability of 1.0 as well since these ISLOCA sequences are a large containment bypass created before core damage. Again, any collateral equipment damaged from flooding or spray would not further increase large early release fire risk. This will be included in the integrated analysis provided in response to PRA RAI-03.

NRC PRA RAI 4: (Related to FM RAI-02.c)

In regard to modeling fire damage to sensitive electronics, the analysis states that studies show that using a steel housing for temperature sensitive electronics is effective in reducing damaging heat fluxes and maintaining the internal equipment to below damage thresholds. The analysis also presents fire event trees showing end-states involving damage to temperature limited equipment, but does not specifically discuss modeling related damage to sensitive electronics. Though the treatment of sensitive electronics may be consistent with recent guidance on modeling sensitive electronics, neither Appendix H of the LAR or the licensee's procedures refer to use of Frequently Asked Question (FAQ) 13-0004, "Clarifications on Treatment of Sensitive Electronics," dated December 3, 2013 (ADAMS Accession No. ML13322A085).

Please describe the treatment of sensitive electronics for the FPRA and explain whether it is consistent with the guidance in FAQ 13-0004, including the caveats about configurations that can invalidate the approach (i.e., sensitive electronic mounted on the surface of cabinets and the presence of louver or vents). If the approach is not consistent with FAQ 13-0004, justify the approach or replace the 55

Enclosure PG&E Letter DCL-14-098 current approach with an acceptable approach into the integrated analysis performed in response to PRA RAI 3.

PG&E Response:

PRA credited components in compartments where detailed FM has been performed have been examined to determine if they meet the definition of temperature sensitive equipment as defined in FPRA FAQ 13-0004. The components that meet this definition were analyzed to determine whether they may be exposed to fire conditions exceeding the damage threshold recommended by NUREG/CR-6850.

Regarding hot gas layer exposure, a temperature sensitive equipment hot gas layer study using CFAST has been performed with varying representative geometries and a range of fire sizes for both fixed and transient sources. The CFAST simulations were used to develop generic categories as documented in the DCPP FM verification and validation documentation. For each category, the upper gas layer and the lower gas layer were analyzed to determine if the damaging hot gases could descend to equipment level, resulting in equipment failure.

The conclusions from the temperature sensitive equipment hot gas layer study were applied in the FM analysis by correlating each modeled fire compartment to a generic category. The correlation was made by examining the fire compartment parameters (i.e., compartment volume and ceiling height), with consideration of fire scenario characteristics (i.e., heat release rate and fire growth profile). Fire compartments with parameters within the limits of a generic category were judged to perform similarly with respect to gas layer formation. Details regarding the application of this study can be found on a compartment basis in each detailed FM report.

Damage to temperature sensitive plant equipment caused by radiant heat makes use of a study using FDS referenced in FPRA FAQ 13-0004. The FDS study concludes that the metal housing of temperature sensitive equipment is effective in .

reducing damaging heat fluxes so that the damage threshold for thermoset cable can be used. This treatment is consistent with the guidance in FPRA FAQ 13-0004.

FPRA FAQ 13-0004 includes caveats that can invalidate the use of the thermoset heat flux damage threshold. These caveats include the presence of louvers or vents on the face of a panel, and sensitive electronics that are mounted to the surface of the cabinet. Field inspections were conducted in fire compartments where detailed FM was performed to confirm that sensitive electronic components that make use of the heat flux damage threshold of FPRA FAQ 13-0004 do not violate these caveats.

Although some of the cabinets have exposed electronics on the cabinet face, the exposed electronics are either test devices, electronic readouts of meters, or monitoring devices that are not critical to cabinet functionality. In addition, some 56

Enclosure PG&E Letter DCL-14-098 cabinets contain vents on the face of the cabinet. However, based on the positioning of the vents, and the presence of pointed down louvers, there is no gap in shielding that would allow radiant heat to damage sensitive components. The walkdown results concluded that the treatment of sensitive electronics in the current FM analysis is consistent with FPRA FAQ 13-0004.

NRC PRA RAI 7:

In the analysis, there appears to be no description of how "pinch points" were modeled for transient fires. Per the guidance provided in NUREG/CR-6850, Section 11.5.1.6, transient fires should at a minimum be placed in locations within the plant physical analysis units (PAUs) where CCDPs are highest for that PAU (i.e., at "pinch points"). The NRC staff notes that pinch points include locations of redundant trains or the vicinity of other potentially risk-relevant equipment. The NRC staff notes that hot work should be assumed to occur in locations where hot work is a possibility, even if improbable. Please provide the following:

a) Clarification of how "pinch points" were identified and modeled for transient fires.

b) A description of how transient and hot work fires are distributed within the PAUs. In particular, identify the criteria used to determine where such ignition sources are placed within the PAUs.

PG&E Response:

a) Transient fires have been postulated in each fire compartment in the FPRA.

All available floor area is postulated as a possible transient ignition source location. Each compartment has been subdivided into one or more transient zones (weighted by floor area), to refine the frequency of damage to risk significant targets. The total transient and hot work ignition frequency for each compartment is apportioned throughout the available floor area. A "pinch point" focused approach is not utilized at DCPP.

b) Transient and hot work fires are distributed within the PAUs in accordance with the process described below:

In all compartments where detailed FM has been performed, transient and hot work fires are postulated in all available floor areas (i.e., all accessible floor areas except where precluded by design and/or operation (e.g., plant equipment)). The accessible floor area of each PAU is then subdivided into one or more transient zones. The boundaries of each transient zone are chosen such that the associated fire growth and resulting damage to PRA 57

Enclosure PG&E Letter DCL-14-098 targets (i.e., cables and equipment) can be bounded by a representative fire scenario.

In order to keep the number of locations (and therefore the number of transient scenarios) requiring separate analysis to a minimum, locations with similar FPRA targets may be grouped into larger transient scenarios. The transient ignition frequency is then apportioned to these locations based on a geometrical factor. The remainder of the floor space of the PAU is subdivided as necessary to distinguish between different fire growth potential (e.g.,

locations where secondary combustibles are at a low enough elevation to be ignited by the transient fire) . In some cases this leaves a section of the floor area with no fire growth potential beyond the initial transient source, creating a transient scenario with no target damage. This ensures that all accessible floor area is accounted for in the transient analysis.

NRC PRA RAI 11:

The analysis states "Junction boxes that are robustly secured and well-sealed will be screened as non-damaging ignition sources." The NRC staff notes that unlike electrical cabinets, there is no exclusion of a junction box from the count because it is robustly secured and well-sealed. If the approach to evaluating junction boxes is not consistent with FAQ 13-0006, "Modeling Junction Box Scenarios in a Fire PRA" (ADAMS Accession No. ML133318213), then please explain the method used and justification for using this method instead of FAQ 13-0006. Perform sensitivities as necessary to justify the approach. If unable to justify the method, then include another method as a part of the response to PRA RAI 03.

PG&E Response:

DCPP did not consider junction boxes to be robustly secured and well-sealed for screening as a non-damaging ignition source, as per the analysis. The DCPP FPRA used to support the NFPA 805 Transition LAR did include the fire risk impacts of junction box fires in each PAU.

At the time of the submittal of the DCPP LAR in June 2013, FPRA FAQ 13-0006 was still in the process of being reviewed by the NRC. The approach used at DCPP for the treatment of junction box fires, however, is consistent with the method described in Section 3.2 of FPRA FAQ 13-0006.

DCPP performed an evaluation to demonstrate the following:

(1) The DCPP approach of apportioning the generic junction box fire frequency to each PAU based on the ratio of cable load of a PAU to the total plant cable load is consistent with the method described in Section 58

Enclosure PG&E Letter DCL-14-098 3.2 of FPRA FAQ 13-0006, and (2) The DCPP approach of using surrogate target sets (i.e., either impacts of a fire scenario or a cable tray, which contains significant number of PRA SSCs) is conservative compared to the method described in Section 3.2 of FPRA FAQ 13-0006.

Junction Box Fire Frequency At DCPP, the generic junction box fire frequency (Bin 18) provided in Table 2-2 of EPRI 1016735 and as endorsed by the NRC via FAQ 08-0048 is apportioned to each PAU based on the ratio of cable load in the PAU to the total cable load in the plant, expressed as; A _A X Cable Load In a PAU PAU, JB - JB Cable Load in the Plant (1)

Where APAU, JB is the junction box frequency for a given PAU, and AJs is the generic junction box frequency for the plant.

The equivalency of this equation or quantification approach to the method in FPRA FAQ 13-0006 is demonstrated by showing that the method described in FPRA FAQ 13-0006 can be transformed into Equation (1) through a series of mathematical manipulations as follows:

The description in Section 3.2 of FPRA FAQ 13-0006 states that, "the number of junction boxes in a specific PAU can be assumed to be proportional to the ratio of the number of junction boxes to conduits in a representative, comparable PAU and the cable loading associated with the location. The proportionality constant can be developed by determining the count in a relatively simple PAU (e.g., a PAU where the junction boxes could be counted during a walkdown) and applying the value consistently throughout the plant." This statement can be expressed as:

NPAU, JB ::::: PC x (Cable Load) PAU (2)

Where NPAU, JB is the number of junction boxes in a specific PAU, PC is the proportional constant representing the ratio of the number of junction boxed to conduits in a representative, comparable PAU, and (Cable Load) PAU is the cable loading associated with the location . As implied in the above description regarding the "proportionality constant," it is a constant value applicable to all PAUs.

With that, the proportional constant can be expressed as an equation below; PC = Number ofJunction Boxes in a Representative PAU ( )

3 Number of Conduits in a Representative PAU 59

Enclosure PG&E Letter DCL-14-098 By combining Equations (2) and (3) into Equation (4), an equation similar to Equation (1) can be developed as follows; l _ l 1\PAU JB - /\JB X . .

a Number of Junction Boxes in PAU (4)

' Total Number ofJunctwn Boxes m the Plant PC x (Cable Load)pau

=AJs x - - - - - - -

l:CPC x (Cable Load)pau)

PC x (Cable Load)pau

=AJs x - - - - - - -

PC x l:(Cable Load)pau

=AJs x ___:(Cable Load)pau l:(Cable Load)pau l Cable Load In a P AU

=/\JB X - - - - - - - (5)

Cable Load In the Plant Equation (5), which is derived from FPRA FAQ 13-0006, is the same as Equation (1), which is used at DCPP. Therefore, the DCPP approach of estimating the junction box fire frequency is consistent with the method described in Section 3.2 of FPRA FAQ 13-0006 and there is no need for further justification or sensitivities.

Junction Box Fire Impacts in a PAU Two different approaches of modeling junction box fire impacts are considered depending on the level of FM performed in the associated PAU (i.e., single whole room burnup scenario or detailed FM and scenario development).

Approach 1 (PAUs represented by a single full compartment burnup scenario):

Where no detailed FM is performed for a PAU, fires in the PAU are modeled by a single fire scenario. This type of scenario is where all the PRA targets in the PAU are assumed to be failed by fire at the time of fire ignition. Its CCDP is calculated assuming all the PRA targets mapped to the PAU are failed by fire. Its ignition frequency is the sum of the contribution from each of the ignition sources assigned to the PAU, including junction boxes. The CDF contribution of junction boxes is calculated based on the whole room burn CCDP and the junction box fire frequency of the PAU apportioned based on the discussion above. This method bounds any CDF estimate based on the first screening analysis described in Section 3.2 of FPRA FAQ 13-0006 for any route points in the PAU. Therefore the treatment of junction box fires in PAUs where its fire impacts are represented by a single whole room burnup scenario is conservative and consistent with FPRA FAQ 13-0006.

60

Enclosure PG&E Letter DCL-14-098 Approach 2 (PAUs performing detailed FM and scenario development):

Where detailed FM and scenario development is performed for a PAU, at least one fire scenario representing junction box fires in the PAU is included.

The junction box fire frequency for the PAU is estimated by apportioning the generic frequency to the PAU based on the cable load as discussed above.

At DCPP, the impact of junction box fires (i.e., a set of fire damaged PRA SSCs) for the PAU is conservatively selected by mapping the target set to a surrogate impact such as a cable tray or a fire scenario in the same PAU that contains a significant number of risk PRA SSCs.

A comparison analysis is performed to demonstrate, via a sampling method, that the DCPP approach of using the surrogate impact (i.e., CCDP) for junction box fires bounds the impacts of fire damage to an individual junction box and conduits/cables terminated at the junction box.

The comparison analysis involves:

1. The selection of a sample population of PAUs representing various types of plant configurations (e.g., electrical room, mechanical room, room sizes, buildings, etc.). Fourteen PAUs (7 from Unit 1 and 7 from Unit 2) out of 59 PAUs performed for detailed FM and scenario development are selected for the analysis.

2. A series of walkdowns are performed to identify a set of junction boxes in each PAU for detailed analysis (e.g., identification conduits terminated at the junction box and mapping of conduits to PRA SSCs).

3. For each PAU, the CCDP of individual junction box scenarios is determined and compared to the CCDP of the as-modeled junction box scenarios (e.g., surrogate fire scenario or cable tray).

The results of this comparison analysis show that the CCDP of the surrogate impacts modeled for junction box fires in each sampled PAU bounds the CCDPs of the sampled individual junction boxes in the PAU, confirming that the DCPP approach of modeling the impacts of junction box fires is conservative compared to the method described in FPRA FAQ 13-0006 and is an appropriate level of refinement for the FPRA.

NRC PRA RAI13:

The analysis presents an MCA, but LAR Attachment W does not explain how the MCA results are incorporated into the risk estimates provided in LAR Attachment W.

Please explain whether the CDF, LERF, 8CDF, and 8LERF values reported in LAR Attachment W, Tables W-4 and W-5 include the contribution from MCA or if they are reported separately elsewhere, and whether MCA contribution is considered when 61

Enclosure PG&E Letter DCL-14-098 comparing total and change in risk results to Regulatory Guide (RG) 1.200 risk guidelines.

PG&E Response:

A MCA that evaluates the potential spread of fire to adjacent compartments was performed at Diablo Canyon Power Plant. MCA scenarios were treated the same as any other fire scenarios; the contributions to CDF, LERF, LlCDF and LlLERF were calculated for all applicable fire areas and the results were included in LAR

. Attachment W, Tables W-4 and W-5. The multi-compartment fire scenarios contributions to total plant CDF and LERF were considered when comparing the total and change in risk to the applicable risk guidelines.

62

Enclosure Attachment 1 PG&E Letter DCL-14-098 Acronym List ABS ABS Consulting Inc.

AC Alternating Current AFW Auxiliary Feedwater AOV Air Operated Valve ASDV Atmospheric Steam Dump Valve ASME American Society of Mechanical Engineers AED Automatic External Defibrillator AM SAC ATWS Mitigation System Actuation Circuitry ASW Auxiliary Saltwater APCSB Auxiliary Power Conversion Systems Branch BAST Boric Acid Storage Tank BTP Branch Technical Position CCDP Conditional Core Damage Probability CCF Common Cause Failure CCP Centrifugal Charging Pump ccw Component Cooling Water CR Control Room CDF Core Damage Frequency CP Casualty Procedure CRE Control Room Envelope CRO Control Room Operator CRVS Control Room Ventilation System CSR Cable Spreading Room CST Condensate Storage Tank 1

Enclosure Attachment 1 PG&E Letter DCL-14-098 LlCDF Delta Core Damage Frequency LlLERF Delta Large Early Release Frequency DCM Design Criteria Memorandum DCPP Diablo Canyon Power Plant DFOTP Diesel Fuel Oil Transfer Pump DG Diesel Generator DID Defense-in-Depth ECCS Emergency Core Cooling System ECG Equipment Control Guideline EDG Emergency Diesel Generator EMT Electrical Metallic Tubing EPRI Electric Power Research Institute ERFBS Electrical Raceway Fire Barrier Systems F&Os Facts and Observations FAQ Frequently Asked Question FDS Fire Dynamics Simulator FCV Flow Control Valve FP Fire Protection FPE Fire Protection Engineering FPRA Fire Probabilistic Risk Assessment FM Fire Modeling FRE Fire Risk Evaluation FWST Feedwater Storage Tank FHB Fuel Handling Building HVAC Heating, Ventilation, and Air Conditioning HEAF High Energy Arching Fault 2

Enclosure Attachment 1 PG&E Letter DCL-14-098 HSDP Hot Shutdown Panel HFE Human Factors Engineering HRA Human Reliability Analysis IC Incident Commander lEPRA Internal Events Probabilistic Risk Assessment lA Instrument Air ISLOCA Interfacing System Loss of Coolant Accident KSF Key Safety Function LAR License Amendment Request LERF Large Early Release Frequency LOCA Loss of Coolant Accident LLOCA Large Loss of Coolant Accident LTCW Long Term Cooling Water MLOCA Medium Loss of Coolant Accident MAAP Modular Accident Analysis Program MCA Multi-Compartment Analysis MCC Motor Control Center MCR Main Control Room MDAFW Motor Driven Auxiliary Feedwater MOV Motor Operated Valve MWS Makeup Water System NEC National Electric Code NFPA National Fire Protection Association NPO Non-Power Operation or Non-Power Operational NRC Nuclear Regulatory Commission NSCA Nuclear Safety Capability Assessment 3

Enclosure Attachment 1 PG&E Letter DCL-14-098 NSPC Nuclear Safety Performance Criteria OR Operations Responder PAU Physical Analysis Unit PFP Pre-Fire Plans PG&E Pacific Gas and Electric Company PORV Power-Operated Relief Valve PRA Probabilistic Risk Assessment PVC Polyvinylchloride RCA Radiologically Controlled Area RA Recovery Action RAFA Recovery Action Feasibility Assessment RAI Request for Additional Information RCP Reactor Coolant Pump RCS Reactor Coolant System RG Regulatory Guide RHR Residual Heat Removal RIPB Risk-Informed, Performance-Based RPE Replacement Parts Evaluation RWSR Raw Water Storage Reservoir RWST Refueling Water Storage Tank SLOCA Small Loss of Coolant Accident SAT Systematic Approach to Training SG Steam Generator SR Supporting Requirements SSA Safe Shutdown Analysis sse Systems, Structures, and Components 4

Enclosure Attachment 1 PG&E Letter DCL-14-098 SSD Safe Shutdown SSPS Solid State Protection System SWGR Switchgear TDAFW Turbine Driven Auxiliary Feedwater TH Thermal Hydraulic UFSAR Updated Final Safety Analysis Report VAC Volts Alternating Current VFDR Variance from Deterministic Requirements ZOI Zone of Influence 5