ML17332A584

DC Cook Nuclear Plant IPE for External Events Revised Fire Pra.

ML17332A584
Person / Time
Site:	Cook
Issue date:	02/28/1995
From:	INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG
To:
Shared Package
ML17332A582	List: ML17332A581 ML17332A584 ML17332A585 ML17332A586
References
AEP:NRC:1082K, NUDOCS 9502280020
Download: ML17332A584 (166)

Text

ATTACHMENT 2 TO AEP:NRC:1082K Donald C. Cook Nuclear Plant Individual Plant Examination for External Events Revised Fire Probabilistic Risk Assessment 9502280020 950215 PDR ADOCK 05000315 P PDR

P

~ l - ~W 0

DONALD C. COOK NUCLEAR PLANT UNITS 1 AND 2 FIRE ANALYSIS NOTEBOOK February 1995 REVISION 1 Preparer (Sections 1.0, 2, 3.3-3.6, 4.1, 4.2, 4.6.2, 4.7.3, Date 4.8 (except 4.8,17 & .18), 6.0, 7.0, Appendix B)

Prep rer (Sections 1.1, 3.1, 3.1.1, 3.2, 4.3, 4.5, 4.6, Date 4.6.1, 4.6,3, 4.7 (except 4.7.3), 5, Appendices C-G)

Preparer (Sectio 3.1.2, 4.4, 4.8.17, 4.8.18, 4.9, Date Appendix A)

Rev'ewer Date Reviewer (Sections 3.1.2, 4.4, Appendix A)

R iewer (Sections 4.8.17, 4.8.18, 4.9) Date Appro ed (NS Manager) Date

0 NOTE This notebook has been prepared in accordance with the applicable sections of 10 CFR 50, Appendix B, "Quality Assurance for Nuclear Power Hants and Fuel Reprocessing Hants." The documentation and the analysis reported in this notebook utilize design and plant information contained in reference documents applicable to Donald C. Cook Nuclear Hant. A list of these references is presented in this notebook.

Note that the signatures on the preceding page identify the individuals with primary preparation and review responsibilities.

FIRE ANALYSIS NOTEBOOK FOR THE DONALD C. COOK NUCLEAR PLANT TABLE OF CONTENTS SKT~IH PA E LIST OF TABLES vi LIST OF FIGURES vn

1.0 INTRODUCTION

1.1 ACRONYhfS

2.0 BACKGROUND

3.0 I'.THODOLOGY 3.1 INITIALASSESShKNT 3.1.1 Initial Qualitative Screening 3.1.2 Zone Fire Frequencies 3.2 INITIATINGEVENT SCREENING 3.3 INITIALQUANTITATIVEASSESSAGWiT 5 3.4 DETAILEDREVIEW OF SIGNIFICANT ZONES 3.5 DUAL UNIT CONSIDERATIONS 3.6 STATUS OF APPENDIX R MODIHCATIONS 4.0 ANALYSIS 4.1 ASSUMPI'IONS 4.2 EVALUATIONOF HRE-INDUCED INITIATINGEVENTS 9 4.3 INITIALZONES CONSIDERED-4.4 DETERMINATIONOF ZONE HRE ING'IATIONFREQUENCY '3 4.4.1 Determination of Fire Initiation Frequency for hoor Areas 13 4.4.2 Fire Initiation Frequency Distribution Among Fire Zones 14 4.4.2.1 Diesel Generator Rooms in Switcbgear Basement 14 4.4.2.2 Switcbg ear Rooms - Upper Level 14 Revision 1

TABLE OF CONTENTS (Continued)

ECTION ~PGE 4A.2.3 Auxiliary Building 16 4.4.2.4 Cable Spreading Area 20 4 4.2.5 Turbine Building 21 4.5 ACCIDENiT SEQUENCE INITIATION iFREQUENCIES FOR ZONE 23 SCREEi~G 4.5.1 Accident Sequences Considered for Each Zone.

4.5.Z Frequencies of Sequence Initiation

"'.6 QUANTITATIVESCREENING ASSESSMENT 4.6.1 Events Other than Transients Initiated 4.6.2 Transient Initiated Events 4.6,3 Screening Summary 4.7 OVERVIEW OF THE EVALUATIONOF SIGNIFICANT FIRE ZONES 4.7.1, Walkdown,Findings....

4.7.2 COMPBRN Run 4.7.3 Engineering Judgement 4.7.4 Human Reliability Values 4.8 FINAL QUANTIFICATIONAND SCREENING 4.8.1 Fire Zone 6M - Auxiliary Building - Middle Section of West 26 End - Both Units 4.8.Z Fire Zone 6N - Auxiliary Building - North Section of West 27 End - Unit 1 4.83 Fire Zone 15 - 1CD Diesel Generator Room 4.8.4 Fire Zone 16 - IAB Diesel Generator Room 4.8.5 Fire Zone 17C - Corridor to AFW Pump Rooms - Both Units 28 Revision 1

. TABLE OF CONIENTS (Continued)

Kgr re PA E 4.8.6 Fire Zone 29G - Screenhouse Motor Control Room for ESW 29

- Both Units 4.8.7 Fire Zone 40A - 4kV AB Switchgear Room 4.S.S Fire Zone 40B - 4kV CD Switchgear Room 30 4.8.9 Fire Zone 41 - Engineered Safety System & MCC Room - Unit 1 30 4.8.10 Fire Zone 42A -'lectrical Power System Transformer Room 31

- Unit 1 4.8.11 Fire Zone 42C - Electrical Power System Transformer Room 31

- Unit 1 4.8.12 Fire Zone 43 - Access Control Area - Both Units 32 4.8.13 Fire Zone 44N - Auxiliary Building North - Both Units 32 4.8.14 Fire Zone 44S - Auxiliary Building South - Both Units 33 4.8.15 Fire Zone 51 - Auxiliary Building - East End - Both Units 33 4.8.16 Fire Zone 52 - Auxiliary Building - West End - Both Units 4.8.17 Fire Zones 53 and 144 - Unit 1 Control Room and Hot Panel Enclosure 'hutdown 4.S.1S Fire Zones 55, 56 and 57 - Switchgear, Auxiliary and .37 Control Room Cable Vaults 4.8.19 Fire Zone 79 - Turbine Room - Northeast Portion - Unit 1 38 4.8.20 Fire Zone 112 - ESW Pipe Tunnel - Unit 1 38 4.8.21 Combined Zones 41, 42A, 42B, 42C, 42D for Large Turbine 39 Fire 4.9 CONTAViMENTPERFORMANCE 39 5.0 TREATIMZNTOF FIRE RISK SCOPING SHJDY AND OTHER ISSUES 40 5.1 DEPENDENCIES BETWFKN CONTROL ROOM AND REMOTE 41 SHU'H) OWN PANEL CIRCUI'IRY 5.2 USE OF PLANT-SPECIFIC DATA (MANUALFIRE FIGEHNG 41 EFFECTIVENESS)

Revision 1 iu

TABLE OF CONTENTS (Continued)

@~I~IN 59 SUPPRESSION AGENT-INDUCED DAhfAGE 5.4 FIRE BAIuuER INTEGRITY 41 5.5 VERIFICATION OF AS-BUILT CABLING 41 5.6 TREATMENT OF TRANSIENT COMBUSTIBLES 41 5.7 TREATMEiiT OF UNCERTAINTIES 42

• I ~

5.8 SEISMC-FIRE INTERACTIONS 42 6.0 AREAS OF CONSERVATISM 7.0 SUlCMARY OF KEY FINDINGS

8.0 REFERENCES

A NRC CONCERNS ON FIRE PROBABILISHC RISK A-1 FROM JULY, 1994 AUDIT B SENSITIVlTYANALYSIS TRA RUN SUIHMAIUES

~ .: 1 I ~ 1't * " \

B.i TRA Only Sensitivity Analysis Runs B-1 B.2 TRA Fire Zone Evaluation Using Engineering Judgement B9 Fire Zones RequiYing Detailed Evaluation - Sensitivity Analysis Run B-48 C WALKDOWNHNDINGS C.i Notes from Fire Walkdowns Performed on 9/8/94 & 9/22/94 C-1 C.2 Notes from Fire WaHcdown Performed on 11/10/94. C-20 D HUMANRELIABILITYCALCULATIONS D.1 Loss of Component Cooling Water due to Control Room Fire - Failure D-1 to Cooldown and Depassurize D2 Loss of all Unit 1 Power and Control due to Cable Vault axe - Failure D-10 to Crosstie Unit 2 AFW & CVCS E CALCULATIONOF I%I'IMATEDCORE DAMAGE FREQUENCIES FOR E-1 ZONES WITH INITIATINGEVENTS VIER THAN TRA Revision 1 iv

TABLE OF CONTENTS (Continued)

$ E~T~I PA E ndi n nu F COMPBRN RUN F-1 G CALCULATIONOF INITIATINGEVENT FREQUENCIES G.1 Calculation of Loss of CCW Initiating Event Frequencies Following G-1 a Loss of One Train Due to Fire G.2 Calculation of Loss of ESW Initiating Event Frequencies Following G4 a Loss of Train(s) Due to Fire G.3 Calculation of SBO Inibating Event Frequencies Following a Loss of G-51 a Diesel Generator or Related Components Revision 1

LIST OF TABLES TlTLE Unit 1 Fire Zones 49 Summary Table of D.C. Cook Fire Frequency Evaluation Hoor Area of Fire Zones in the Auxiliary Building (Unit 1) 54 Spreadsheet for Calculation of Turbine Building Fire Zones Fire 55 Initiation Frequencies Fire Frequencies for Fire Zones in Basement of Seitcbgear Building Fire Frequencies for Fire Zones in the Upper Level of the Switchgear Building Fire Frequencies for Fire Zones in the Auxiliary Building Fire Frequencies for Fire Zones in Cable Spreading Rooms Fire Frequencies for Fire Zones in the Turbine BuBding 61 10 Initiating Event Frequencies Summary of Zone Specific Frequencies for Initiating Events Summary of Estimated Core Damage Frequencies for the 65 Zones Fire Zone 51 70 Revision 1

LIST OF FIGURES PA E Event Tree for Zone 6N 71 Event Tree for Zone 15 72 Event Tree for Zone 16 73 Event Tree for Zone 29G Event Tree for Zone 40A 75 Event Tree for Zone 403 76 Event Tree for Zone 42A 77 Event Tree for Zone 42C 78 Event Tree for Zone 42D 79 10 Event Tree for Zone 79 80 Revision 1 Vll

~ + < me ~

c'

1.0 INTRODUCTION

An analysis was performed to determine fire vulnerabilities at the Donald C. Cook Nuclear Plant.

A fire in the plant can potentially damage equipment and cabling which are necessary to provide decay heat removal and safe shutdown of the reactor. Many rooms or zones in the plant contain equipment or cabling required for these functions. Depending on the amount and type of equipment in the zones, these zones may have a high probability of a fire. This analysis provides assumptions, initial zones considered, fire frequency evaluation, screening assessment of zones before the walkdowns, additional screening based on"walkdown findings and further evaluations, and the detailed analysis and quantification of fire-induced core damage from the remaining zones. This analysis was performed to address the requirements of Reference 1.

1.1 ACRONYMS o AEPSC - American Electric Power Service Corporation o AFW - Auxiliary Feedwater o ATWS - Anticipated Transient Without SCRAM o CCP - Centrifugal Charging Pump o CCW - Component Cooling Water o CDF - Core Damage Frequency o COMPBRN - Compartmental fire modelling computer program o ...,.,EDG.- Emergency-Diesel Generator---

o ENG - Engineered o EPRI - Electric Power Research Institute o EPS - Emergency Power Supply o ESW - Essential Service Water o FHA - Fire Hazards Analysis o HVAC - Heating, Ventilation and Air Conditioning o Hx - Heat Exchanger o IEEE - Institute of Electrical and Electronic Engineers o IEF - Initiating Event Frequency o IPE - Individual Plant Exiunination o,IPEEE - Individual Plant Examination of External Events Revision 1

o LER - Licensee Event Report o LOSP - Loss of Offsite Power o LSI - Local Shutdown Indication o MCC - Motor Control Center o MDAFP - Motor Driven Auxiliary Feedwater Pump o . MFW - Main Feedwater o MOV - Motor Operated Valve f ' 1 4,l,yt

~It+

o MSIV - Main Steam Isolation Valve o NESW - Nonessential Service Water o PORV - Power Operated Relief Valve o PRA - Probabilistic Risk Assessment o PRZ - Pressurizer o RCP - Reactor Coolant Pump o RHR - Residual Heat Removal o,,, .. RP..-.Reactor Protection o SCE - System Cutset Editor (Westinghouse software) o SENS - Sensitivity Analysis Code (Westinghouse software) o SI - Safety Injection o SSCA - Safe Shutdown Capability Assessment o SSSA - Safe Shutdown System Analysis o TDAFP - Turbine Driven Auxiliary Feedwater Pump

2.0 BACKGROUND

Fire prevention for nuclear power plants is a major concern. The fire that occurred at the Brown's Ferry Nuclear Plant in 1975 revealed fire vulnerabBities of some plant designs. As a result of this event, the Appendix R section of 10 CFR 50 (Reference 2) was issued and required that all domestic utilities perform a fire hazards analysis, deterinine the consequences of a fire, and establish a comprehensive fire protection program for the phnt.

Revision 1

As a result of the fire protection program, plants provide equipment and methods for detection, suppression, and prevention of fires. Detection can take the form of heat and ionization-type sensors located in various parts of the plant as well as fire watch personnel. Suppression can take the form of automatic water sprinkler systems, COi, or Halon flooding systems located in the area of concern, hose stations located near critical areas, and portable extinguishers. Also, included in the fire suppression plan is the fire brigade which is a vital part of the fire protection plan. Finally, prevention can exist in the form of methods set forth by the plant in controlling the fixed and transient combustible loadings that are located in each area of the plant. Also, the arrangement of safe shutdown equipment and cabling relative to major heat sources can prevent the start or spread of a severe consequence fire.

Initiation of a fire in any type of facility has the potential for severe consequences. The impact of a fire depends on the type and size of the fire, the means of detecting and suppressing a fire once it has started, and the possibility of the fire spreading to cause additional damage. This analysis was limited to the quantification of fire-induced core damage resulting from damage to equipment critical to decay heat removal or safe shutdown foi the Donald C. Cook Nuclear Plant.

The protection of a commercial nuclear power plant from the adverse impact of fires is governed in the United States by the Code of Federal Regulations Section 10.50 (10 CFR 50 Appendix R)

(Reference 2), which defines the set of rules which must be followed in fire protection design measures and the implementation of a fire protection plan. The U.S. NRC has issued Supplement 4 to GL48-20 (Reference 1) and the associated NUREG-1407 (Reference 3), which require utilities to perform an IPEEE for internal fire events. Requirements inciudei o Description of the treatment of dependencies between remote shutdown panels and control room circuitry o Use of plant specific data o Evaluation of suppression. agent-induced damage to equipment o Evaluation of fire barrier integrity o Verification of as-built cable routing

~ ~

o Treatment of transient combustibles o Determination of uncertainty sources in core damage frequency calculations, o Determination of seismicJfire interactions This notebook discusses the above issues which are incorporated in the methodology used. for 88s fire PRA, the prescreening process, the determination of the zonal fire initiation fchpencles, general fire walkdown findings, detailed evaluation of the remaining critical fire zones,'and the quantification to determine fire-induced contribution to core damage.

3.0 M'THODOLOGY This fire analysis employs both qualitative and quantitative assessinents, as described below.

Revision 1

3.1 INITIALASSESSMENT The initial assessment involved determining the zones that had safe shutdown equipment or cabling or components modelled in the IPE, and determining possible ignition sources in each zone.

Information regarding fire prevention equipment, combustible heat loadings, safe shutdown equipment, safe shutdown cabling, and fire barrier construction was reviewed. The documents containing the majority of this information are the "Fire Hazards Analysis" (Reference 4) and the "Safe Shutdown Systems Analysis" (Reference 5).

3.1.1 Initial Qualitative Screening

~

Table l identifies the fire zones that have either safe shutdown equipment and/or cabling, or any zones which have components modelled in the IPE. This table is actually Table 1 from Revision 0 of the Fire PRA (Reference 6). Of the'120 fire'zones listed in Table 1, 47 were eliminated because they had no modelled equipment or safe shutdown equipment or cabling, and 8 more were eliminated because they were inside containment. Containment fire zones were not considered in this analysis because previous fire PRAs did not show that containment fires are risk signiTicant (Reference 7). The remaining 65 zones were evaluated in greater detail.

This qualitative screening is found in Section 4.3.

3.1.2 Zone Fire Frequencies The fire initiation frequencies were then determined for major fire areas (usually major buildings) from the generic FIREDATA data base developed by the Sandia National Laboratories (Reference 8). The plant-specific fire data for the Cook Nuclear Plant was considered but was not used to supplement the generic, data. because. only. one.out of the 40 internal fire reports was issued as a-Licensee Event Report (LER). The m@ority of the additional data was not utilized since it described fires which were self~tinguishing and did not result in damage or hrge monetary losses. For this reason, LERs or insurance reports were not issued. The one LER that was issued was not considered because its addition would not have significantly afFected the frequencies. The additional data was not comparable to the rest of the database entries. The plant-speciYic data is available in Reference 6.

This major area fire initiation frequency was then divided among the fire zones based on similarities between the fire initiators in the database and equipment in the fire zone. Although only 65 zones are reviewed for risk signiYicance, fire initiation frequencies were calculated for 100 fire zones to properly distribute the plant wide fire database information. As described. above, containment fires were not considered.

Since most of the fire zones are eliminated from detailed consideration in a screening process, a minimum fire initiation frequency of .001 was chosen to avoid detailed evaluation of low significance zones. When a zone which has this nunimum fire initiation frequency passes the initial screeiung process, a more detailed evaluation of the fire initiation frequency ln this zone may be performed.

The calculation of the fire initiation frequency for each zone is found in Section 4.4.

Revision 1

3.2 INITIATINGEVENT SCREENING The Cook Nuclear Plant IPE analyzes several separate event trees designed to model the success and failure paths that are potential from a given set of initial equipment unavailabilities. Each of the remaining 65 zones were reviewed to determine which event initiation frequencies could be impacted ifa fire damaged all equipment in a zone. At a minimum, all zones are assumed to initiate a plant trip (typical transient).

A set of conditional initiating event frequencies were calculated due to random failures, assuming important equipment was disabled in a Fire. These calculations are described in Section 4.5, and the results are listed in Table 10. These calculations are based on the IPE initiating event frequency calculations (Reference 9).

If the event initiation frequency for sequences other than a typical transient could be affected, the fire initiation frequency for that zone was divided among the sequences. The event initiation frequency for other sequences was calculated by multiplying the zone's fire initiation frequency by the conditional (random) initiating event frequency determined to be possible for that zone. For example, if a zone contained the cables for both component cooling water (CCW) pumps, the event initiation frequency for a Loss of CCW would be the Fire initiation frequency for that zone (conditional probability of a Loss of CCW with both pumps gone = 1). If only one train of CCW was in the zone, however, the fire frequency would be divided among a Loss of CCW and a typical transient. The value used for the Loss oF CCW would be the Fire initiation frequency multiplied by the conditional initiating event frequency for a Loss of CCW, with one train lost due to Fire (see Table 10). The initiating event frequency for the typical transient would be the difference between the fire initiation frequency and the Loss of CCW initiating event frequency found for this zone.

The review and identification of event sequences to be considered is found in Section 4.2. Twenty one zones, were found.to have an impact on event initiation frequencies other that a typical transient.

3.3 INITIALQUANTITATIVEASSESSMENT Assuming fire induced failure of all equipment and cabling in a fire, zone,, the core damage frequency was calculated for each sequence initiator for the 65 reniaiiiing zones. If the calculated core damage frequency was greater than the FIVE methodology cutoff of 1.FAi/yr,(Reference 7),

the zone was identified for further review. If the calculated core damage frequency was between 1.E-7/yr and 1.E4/yr, it was identiYied for reporting purposes only. If the zone core damage frequency was less than the reporting criteria of 1.E-7/yr (Reference 10), it was screened from any further consideration.

Y For fire zones where the TRA initiating event applied, an estimated CDF was caladated three different ways. First, the transient screening performed in the original analysis is"still valid. 'Xn those screeiiings, the Westinghouse System Cutset Editor (SCE) (Reference 11) was used to calculated estimated CDF by damaging all of the SSSA equipment and cabling as wdl modelled in the PRA in a given fire zone. A review of those earlier results found as>'omponents them to be consistently conservative. The SCE results were a@usted for the new fire initiation frequency used in this analysis.

The original SCE runs used an early version transient quantification that was conservative compared to the final transient quantification. For Fire zones where the SCE analyiis did'hot Revision 1 5

result in screening, a new Westinghouse Windows based software called SENS (Reference 12) was used to calculate the estimated CDF with all the SSSA equipment and cabling, as well as, PRA modelled equipment unavailable in a given fire zone. The final transient quantification was used as input to this code. Like SCE, the SENS code is a cutset editor. In this code, combinations of specific basic events are given a failure value of one to calculate a change in core damage frequency. This sensitivity analysis code handles more cutsets and provides a simpler user interface than the earlier version. To use this software with the TRA initiating event, a speciffc quantification run (Reference 13) was performed by decreasing the cutset cutoff value by two orders of magnitude, which produced a file TRA.OUT with approximately 4000 cutsets to use as input to the SENS code. This special TRA.OUT was developed to prevent truncating important basic events. Using the TRA.OUT with the SENS code, conditional core damage frequencies for a fire zone were determined by setting SSSA components, cable and PRA modelled components associated basic events to 1.0 which fails the basic event. The fire induced core damage frequency is determined by normalizing this results by dividing the TRA initiating event frequency of 3.8 and multiplying by the zone fire initiation frequency.

The last method used in performing the screening assessment on fire zones where TRA initiating events applied was based on engineering judgment. These were zones where no Westinghouse SCE runs from the original analysis had been performed. For each of the fire zones evaluated (Appendix B), all of the SSSA components, cabling and PRA components were identified and reviewed for potential impact on the TRA event based components located in the zone and on previous experience performing quantitative screenings with SENS. Fire zones were then screened out in this portion of the analysis by inspection if the estimated CDF would be well less than cutoff of 1.0E47/yr.

This zone screening assessment is found in Section 4.6.

3A DETAILEDREVIEW OF SIGNIFICANT ZONES

~ ~ I e' 'S Fire zones in the initial quantitative screening that did not meet the FIVE Methodology screening

(

criteria of = 1.0E46 were considered to be high priority and were evaluated in this portion of the analysis. Of the fire zones evaluated in the initial quantitative screening, only 23 fire zones required further detailed evaluation.

As part of the detailed evaluation, walkdowns were performed for each of the fire zones to determine locations of transient combustibles, important SSSA cables and components, and the potential of fire propagation from zone to zone.

The detailed evaluation of these zones consists primarily of more accurate assessments of the probable extent of fire damage and the hnpact of the fire damage on the power and control cables (i.e., evaluation of the failure mode, such as fail to open or loss of control). When critical equipment is found not to be damaged by a fire, or could not be damaged by the same fire that damages a second important piece of equipment in a given zone, the core damage frequency is reassessed. This process is continued until the core damage frequency is sufficiently low to remove the zone from further consideration, or further reduction is not obtainable.

Assumptions commonly used for this stage of the evaluation are sunimarized in Section 4.1, and the techniques used are summarized in Section 4.7. The actual evaluation of each zone is found m Section 4.8.

Revision 1

3.5 DUAL UNIT, CONSIDERATIONS Dual unit items and actions which were credited in the internal events analysis were considered in the fire analysis. These are described in the individual notebooks comprising the internal events analysis. It was found that there were no additional considerations beyond those described in the internal events analysis'."

3.6 STATUS OF APPENDS R MODIFICATIONS Cook Nuclear Hant had an Appendix R audit in 1990. All pertinent documentation was updated to support this audit. All modifications made as a result of and exemptions to the Appendix R ruling are included in this updated documentation, which was used in this analysis.

4.0 ANALYSIS 4.1 ASSUMPI'IONS The following assumptions were used in this analysis:

It was conservatively assumed that a fire in any zone would cause a reactor trip.

2. Fire zones were considered for investigation in this analysis only if they contained safe shutdown equipment and/or cabling, components necessary for decay heat removal, or other components modeled in the IPE. Zones containing neither of these were not considered critical to core integrity.

3. The safe shutdown equipment and cable routing information was taken from the Safe Shutdown Systems Analysis, SSSA (Reference 5). The SSSA was revised in late 1990 in preparation-for the 1990 Appendix R audit. AEPSC reviewed a sample of the cables, and found the cable routings to be acceptable. The results of this verification are documented in Reference 14.

4. A 24-hour period was assumed as the base mission time for this analysis. Ths time is consistent with the timeassumed in the,internal;events.analysis, per. NUREG>>1335 (Reference 10).

5. The fire frequencies used in this analysis were determined using the ggaeric FIREDATA data base developed by the Sandia Nabonal Laboratories (Reference'8).

Fire-induced disabling of the control room HVAC was not assumed to result in control room inhabitabiTity because the control room is constantly manned and a coohng failure would be noticed and corrective action initiated in a timely manner.

Likewise, component failures arising from failure of the control rooniHVAC was not considered credible. This assumption. is supported by infonaation in Reference 15 which states that, with a complete failure of control room HVAC, operator actions such as opening doors and configuring portable fans would dehy control room temperature increase sufficiently to allow safely taking the plant to Mode 5 before the control room becomes uninhabitable.

7. 1E-6/yr was selected as a screening value to identify conservatively calculated sequence frequencies which could lead to core damage. (Reference 7)

Revision 1 ~

7

8. Propagation via items which were granted exemptions to the Appendix R ruling (Reference 16) (i.e., unrated ceiling and fioor hatches) was qualitatively examined.

After careful review of these exemptions, it was concluded that they would have no significant impact on the Fire PRA.

9. It was assumed that fire barriers will remain intact for fires of less than rated duration. (e.g., a 3-hour fire wall will withstand a one hour fire.)

10. The delineations and boundaries employed in the Appendix R analysis (fire areas and zones) were used in this analysis.

Fire-induced opening of the Pressurizer PORVs was not assumed to result in a non-recoverable small LOCA because, the failure of the PORV's control cable due to fire

~ 4 ~ I ~

can be recovered in a relatively short period of time. This assumption is supported by information in Reference 17, which states that, with a failure of the PORV due to "hot shorts" and a resultant "open circuit" which'wo'uld dose the air operated PORVs, termination of the small LOCA would occur within 30 minutes of its occurrence. The "open circuit" is the dominant failure mode because all conductors will eventually contact the grounded cable tray. The "hot short" cannot exist with grounded wires. Therefore, it will eventually lead to "open circuit" as more insulation decomposes or melts away.

The small LOCA 'event was analyzed as part of the IPE PRA Level 11 containment analysis (Reference 18). The results of the analysis showed that, for a small break LOCA with nothing available, the core uncovered at about 1'our.

In addition, procedures are in place that would direct operators to the take the required actions necessary to dose the PORVs (Reference 19).

• 0 ~ '"

The COMPBRN IIIe code (Reference 20) was used in this analysis to verify engineering judgement of extent and timing of damage. This computer code addresses NRC concerns identified in the Fire Risk Scoping Study (Reference 21).

Fires originating in electrical cabinets, including switchgear, transformers, inverters, distribution panels, fire protection panels, I&C panels, etc. are assumed to stay in the cabinet of origin. This is consistent with the EPRI Fire Events DataBase, and Sandia National Lab tests (Reference 7). Thus, cabinet fires do not propagate and the loss of equipment function due to a cabinet fire is thnited to the loss of the equipment supported by the cabinet. SimBarly, ifa cabinet contains internal partitions which completely separate cabinet sections without through-wall penetrations, a fire originating in one section is assumed not to disable equipment located in adjacent sections. This approach is used in NUREG-1150 (Reference 22).

14. Given that the industxy fire experience shows real transients (i.e. combustibles not permanently or semi-permanently stored in an area) are insignificant as fire sources (mops, notebooks, single cardboard boxes) and the Cook Nuclear Hant has a very strong housekeeping/combustible material control process, true transient combustibles are judged to be insignificant for fire risk. This is consistent with NRC observations in SECY-93-143, May 21, 1993. Cook Nuclear Hant fire zones are inspected on a weekly basis with only 5 to 6 condition reports issued per year as result of transient combustibles being in inappropriate locations.

Revision 1

It is assumed that the only sources with risk signiYicance are those which are semi-permanently stored in fixed locations, and whose presence is evaluated and tracked by permits issued by the fire protection engineer.

15. For cable in conduit and trays that meet IEEE 383 standards, cable function is lost if the cable temperature reaches 700'F (Reference 7).

'6.

Cables that meet IEEE 383 standards are assumed to ignite at 931'F (Reference 22).

17. No fire propagation for cable in'conduit is considered reasonable.

18. Cables in cabinets and control panels are assumed to ignite and fail. This assumption is considered to be very conservative based on industry experience with cabinet fires.

~ '4& I

19. "Hot Shorts" are not considered in power cables. Three phase hot shorts across the proper phases must occur for inappropriate motor operation.

20. Hot Shorts are considered significant for control cables both in cable trays and control cabinets, unless the cable tray/cabinet wiring layout make shorts unlikely.

For Cook Nuclear Plant, hot shorts were considered on a case by case basis, depending on the fire scenario. For example, the double break circuitry design philosophy was used to take credit for valves that would not spuriously operate due to fire damage of control cables (Reference 23). This is consistently used in the Appendix R analysis for motor operated valves (MOVs) and air operated valves with the double break control circuitry design.

21. In the normal transient event, both main feedwater and the cross-tie to Unit 2 auxiliary feedwater 'are'ssumed as potentially available should the Unit 1 auxiliary feedwater should faiL Primary feed and bleed actions also constitute a success path.

Since the cable routing for main feedwater is not explicitly determined, credit for main feedwater should not generally be given for this system. Quantifications were initially performed assuming the availabiTity of main feedwater. These results were

. subsequently reviewed for the impact of this assumption. Given'the availability of Unit 2 auxiliary feedwater, the lack of main feedwater has little nume'rical impact-on the screening evaluation, and this issue is only addressed for zones where this may be of particular concern.

4.2 EVALUATIONOF FIRE-INDUCED INITIATINGEVENTS Initiating events which theoretically may.be induced by a.fire include losswf~ffsite po~er, MSIV ciosures, opening of steam relief valves, loss of component cooling water (and subsequent RCP seal LOCA), madvertent opening of pressurizer PORVs leading to a small LOCA, off-normal premrizer pressure, loss of feedwater, loss of condensate pumps, loss of circulating water, turbine trip, loss of control air,'loss of essential service water, anticipated transient without SCRAM (ATWS), or loss of 250 V DC power. Each of these was examined to determine if a fire could induce the event at Cook Nuclear Plant or if components could be damaged that would impact the initiating event frequency in the Cook PRA.

Revision 1

o Losswfwffsite power From the original analysis, it was determined that a fire-induced loss of offsite power at the Cook Nuclear Plant is not a credible event. Per the walkdown notebooks (References 24 and 25), it was determined that outside the auxiliary building, there is adequate spatial separation to preclude the possibility of a fire causing the loss of more than one source of offsite power. It was also found that inside the auxiliary building, there is adequate spatial separation of cabling and components to avoid fire-induced loss of offsite power.

MSIV closure, Opening of steam relief valves MSIV closures or steam relief valve openings would initiate a plant trip.< The responses required to mitigate these events are identical to those required to-mitigate a transient (with power conversion). This event was adequately analyzed in the internal events portion of the Cook Nuclear Plant PRA, therefore, no further analysis is performed in the fire analysis.

Loss of component cooling water A loss of component cooling water could possibly be induced by a fire disabling the CCW pumps or their cabling. This statement was based on an initial review of the SSSA cabling and components for each of the significant fire zones. This could cause a loss of CCW or substantially impact the initiating event frequency for this event. Thus, it was determined that the potential exists for a fire to cause a loss of CCW and, therefore, would require further detailed evaluation.

Inadvertent opening of pressurizer PORVs leading to a small LOCA Prolonged opening of the pressurizer PORVs could lead to a small LOCA. The pressurizer PORVs are located inside containment. It was determined that the potential does exist for a PORV spuriously failing open due to fire damage to control cable (Hot Shorts) which in turn would initiate a small break LOCA.

However, it is likely to be terminated with 30 minutes because the Hot Shorts will become open circuits. When this happens, the airwperated PORVs would dose, thus terminating the LOCA (Reference 17). The small LOCA event was analyzed as part of the IPE PRA Level II containment analysis (Reference 18). The results of the analysis showed that, for a small break LOCA with nothing available, the core uncovered at about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

In addition, procedures are in place that would direct operators to take the required actions necessary to dose the PORVs (Reference 19).

Based on the above review, it is concluded that failing open a PORV due to a "hot short" to the control cable would not uncover the core and result in a non-recoverable small break LOCA.

Off-normal pressurizer pressure Pressurizer pressure signal cables were not traced as part of the Appendix R effort.

It was conservatively assumed that a fire will damage these cables. The Revision 1 10

consequence of more than two pressurizer pressure signal cables being damaged is a reactor trip, since a trip is generated on 2/3 logic (Reference 26). The ensuing event would proceed as a transient (Reference 9). The transients accident sequence (with power conversion) can be used to model this fire-induced event.

o Loss of feedwater, loss of condensate pumps, loss of circulating water Cables for these systems were not traced as part of the Appendix R effort.

Fire-induced damage to the components (or their cables) could initiate a reactor trip. The ensuing responses required for safe shutdown are identical to those modelled in the transients (without power conversion) accident sequence.

o Turbine trip A fire could initiate a turbine. trip, and.the ensuing. responses required for mitigation are identical to those modelled in the transients accident sequence (with power conversion).

o Loss of control air Loss of control air would result in the feedwater regulating valves dosing, thus causing a reactor trip. Thus, a loss of control air is actually a transient with steam conversion unavailable (the feedwater system is considered unrecoverable). Either auxiliary feedwater or primary bleed and feed is required to prevent core damage.

Although control air is lost, the pressurizer PORVs are supplied by air bottles to perform their required function. Therefore, unique consideration was not given to the loss of control air.

o Loss of essential service water A loss of essential service water could possibly be induced by a fire disabling the SSSA ESW cables and components. This statement was based on an initial review of the SSSA cabling and components for each of the significant fire zones. Zones were identified where fire could cause a loss of ESW or substantially impact the initiating event frequency. It was concluded that the potential exists for a fire to cause a loss of ESW and, therefore, would require further detailed evaluation.

o ATWS ATWS is not considered credible as occurring concurrent with a fire, or being induced by a fire. This can be justified with the following arguments:

Assume that a fire occurs. The question may be posed, "What is the probability of a concurrent ATWS?" Since a fire and an ATWS are independent events, f(ATWS) = 3.86'/year (Reference 9) p(ATWS) in 24-hour time period = f(ATWS) x 24/8760hr/yr ~ 1.06E4 conservatively estimate p(core melt) to be 1.0 conservatively estimate f(fire) to be 1.0 Revision 1

Therefore, f(fire) x p(ATWS) x p(core melt) = 1.06E48/year This conservative value is very low, and well below the screening value of 1E-7/year.

Consider the case where a fire induces an ATWS. This would be possible if a fire disabled reactor. trip cabling or logic. Trip cabling is segregated and two concurrent and independent fires which would disable all trains of reactor trip cabling is not considered credible. In addition, a simple loss of power to the breakers will cause a reactor trip.

o Loss of 250 V DC Power This event could occur if a fire were to disable 250 V DC components in the switchgear room (zone 41), a battery room, or a cable vault. This event was modelled as part of this analysis.

o Station Blackout Based on an initial review of the SSSA cables and components, the potential for impacting the initiating event frequency of an SBO exists due to a loss of one train of emergency diesel generator. As a result, the SBO initiating event requires further detailed evaluation.

Conclusions:

Within a reasonable probability; the potential exists that a fire could possibility initiating events or substantially impact the initiating event frequency'of induce'the'ollowing these events at Cook Nuclear Hant:

- Transient (with power conversion) - TRA

- Transient (without power conversion) - TRS

- Loss of 250 V DC Power - VDC

- Loss of Component Cooling Water - CCW

- Loss of Essential Service Water - SWS

- Station Blackout - SBO 4.3 INITIALZONES CONSIDERED - PRESCRIKNING Table 1 identifies the fire zones that have either safe shutdown equipment and/or cabling, or any zones which have components modelled in the IPE. This table is the same as Table 1 from Revision 0 of the Fire PRA (Reference 6). This deterniiiuition was made based on the Safe Shutdown Systems Analysis document (Reference 5) and discussions with the systems analysts (Reference 6). Of the 120 fire zones listed in Table 1, 47 were eliminated because they had no modelled equipment or safe shutdown equipment or cabling, and 8 more were eliminated because they were inside containment. Containment fire zones were not considered in this analysis because previous Fire PRAs did not show that containment fires are risk significant (Reference 7).

The remaining 65 zones were evaluated further, as described in Sections 4.5 and 4.6, for an impact on initiating events and to determine their core damage frequency contribution.

Revision 1

4.4 DETERMINATIONOF ZONE FIRE INITIATIONFREQUENCY 4.4.1 Determination of Fire Initiation Frequency for Major Areas The major area fire frequency was determined by using the FIREDATA data base (Reference 8) developed by Sandia National Laboratories. This data base contains 354 fires from pressurized water reactor, boiling water reactor, and high temperature gas reactor nuclear plants which occurred from 1965 to May 1985. This data base separates the events by fire location into the following five general locations (The value after each area represents the total number of industry years for which data exists for that area.):

o Reactor Building 902.2 years o Auxiliary Building 717.1 years o Turbine Building 689.4 years o Cable Spreading Room ., 799.6 years o Control Room 721.0 years The Cook Nuclear Plant was divided into 6 areas for evaluation. The areas are:

Containment Electrical Switchgear - Basement Electrical Switchgear - Upper Level Auxiliary Building (Induding Control Room)

Cable Spreading Areas Turbine Building The HREDATA data hase was accessed to determine fires that would fit into these 6 locations. Power operation as well as some hot and cold shutdown fires were considered.

The shutdown fires were considered if they were judged to be possible during power operation.

The fire frequency was determined by tahng the number of fires found for each area and dividing them by the years of operating experience. Since only 5 general locations were given in the data base, they had to be 'fitted'nto the six Cook.Nuclear Hant zones.

In general, the operational experience for the reactor building was used for the Cook containment location, the experience for the auxiTi(ary building was used for the Cook electrical switchgear locations and the Cook auxiliary building, the experience for the turbine building was used for the Cook turbine building, and the experience'or the cable spreading room was used for the Cook cable spreading room. Some fire experience was reallocated to other locations based on the type of equipment involved.

From the data base findings, the fire initiation frequencies for each area were determined and are suinmarized in Table 2. They range from 2.50FAOlyr for the cable spreading room to 5.37E42/yr for the basement of the electrical switchgear building. As @scribe in (Reference 6), plant-specific data was not used. The detailed calculation is found in Reference 27.

Revision 1

4.4.2 Fire Initiation Frequency Distribution Among Fire Zones The fire initiation frequency for each location is distribute to the various zones in that location by the type of fire initiator. All fires that were assumed to be possible in the fire location are examined and placed into an appropriate category, such as electrically initiated, welding initiated, pump initiated, etc. The equipment in each zone is then reviewed, and the fire initiation frequency for each category of database fires is distributed to the zones based on the relative amount of that equipment type in each zone.

Since the first use of the fire initiation frequency by zone is for screening of the fire zones for core damage risk significance, a minimum fire initiation frequency of l.e-3/year is chosen. This value is consistent with the cutoff range of the fire database (between 689 and 90? years of fire experience was assumed in the original analysis (Reference 27)). If the screening indicates that any zone that uses this minimum initiation frequency is risk significant, this assumption can then be refined when the zone is evaluated in more detail.

Note that the minimum value is in the accuracy range of the database for the entire location, not a specific zone.

4.4.2.1 i el Generator Room in wite ear B emen 38.5 fires were allocated to this fire location. Note that some fires are applicable to more than one location, resulting in fractional fires being allocation to some locations. By examining diesel building fires on Table 5 (of Reference 27), 31 of the 32 fires in this table are related directly to the diesel equipment. Most of these are oil fires ignited by the hot diesels. In addition, one fire from Other Buildings (Table 7 of Reference 27) is appropriate for the diesel generator rooms. Therefore, these 32 fires will be allocated to the two diesel rooms. Other fires induded in this location are 4.5 fires from transformer yard fires (Table 6 of Reference 27) and 2 additional transformer fire from Other Buildings (Table.7 of Reference 27)';" These will be allocated to the diesel transformer room. No diesel oil pump fires are evident in the database, so a minimum initiation frequency is used for this zone.

ZONE IDENTIHCATION Calculation FIRE FREQUENCY (m yea )

13 DIESEL OIL PUMP ROOM minimum 1.0e-3 14 TRANSFORMER ROOM 6.5/717 9.1e-3 15 1CD DIESEL GENERATOR ROOM 32/2/717 2.2e-2 16 1AB DIESEL GENERATOR ROOM 32/2/717 2.20-2 TOTAL 38.5/717 5.4e-2 The results for the diesel generator room are summarized on Table 5.

4.4.2.2 wite ear R om - er Lev 19.17 fires were allocated to these zones. These are categorized as follows (Tables refer to Reference 27):

Revision 1 14

Switchgear Room - Table 8 - 11 fires.

6 due to welding 2 due to switchgear 3 due to buses Transformers - Table 4 '- 4.5 fires (all transformers)

Battery Room - Table 9 - 4 fires, I of 2 battery rooms in this location (xl/2)

Note - the battery room in zone 55 was neglected in the original split. For this evaluation, it will be counted in that area, even though this will be double counting.

Other Buildings - Table 7 - 1 2/3 fires 1 due to transformers 2/3 due to welding/grinding Location totals 2 - switchgear 3 - buses 6.67 - welding/grinding 5.5 - transformers 2 - battery rooms total 19.17 Zone aHocation assumptions (by reviewing Reference 4)

Switchgear is in zones 41, 42A, 42C - split by approximate floor area of gear, say 3/2/1, respectively.

Buses - Significant Buses are in 40A, 40B and to a lesser extent 41 and 42A. Split 2/2/I/1, respectively.

Welding could occur anywhere in this location, split by approximate floor area Split (40A/40B/41/42A/42B/42C/42D) (III/2/I/.5/25/.25) respectively.

Transformers are in 41 and 42A - split evenly =

Battery room - all to 42D e 40A 4KV AB SWITCHGEAR ROOM Buses 3 x 2/6= I.

Welding 6.67 x I/6~ 1.1 Total 2.1 IEF = 2.1/717 = 2.9e-3 40B 4KV CD SWITCHGEAR ROOM saine as 40A Revision 1 15

41 ENG SAFETY SYSTEM IS AND MCC ROOM Switchgear Z x 3/6 = 1 Buses 3 x 1/6 = .5 welding 6.67 x 2/6 = 2.2 transformers 5.5 x 1/2 = 2.8 Total 6.5 IEF = 6.5/717 = 9.le-3 42A E.P.S. TRANSFORMER ROOM Switchgear 2 x 2/6 = .7 Buses 3 x1/6 = .5 welding 6.67 x 1/6 = 1.1 transformers 5.5 x 1/2 = 2.8 Total 5.1 IEF = 5.1/717 = 7.1e-3 42B E.P.S. CONTROL AND DRIVE ROOM welding 6.67 x.5/6 = .55 Total .55 IEF = .55/717 = 7.7M use minimum 1.e-3 4ZC E.P.S. MOTOR ROOM Switchgear 2 x 1/6 welding 6.67 x 2$ /6 = 9 Total .6 IEF = .6/717 = 8Ae4 use minimum l.e-3...,...

42D E.P.S. (AB) BATTERY ROOM welding 6.67 x.25/6 ~ 2 battery 2 x I/1 ~ 2.

Total 2.3 IEF = 2.3/717 = 3.2e-3 The results for the switcbgear room - upper level are summarized on Table 6.

29.67 fires were allocated to these zones. These are categorized as follows (Tables refer to Reference 27):

Revision 1 16

Auxiliary Building - Table 10 - 20 fires.

1 due to w'elding or other work 12 due to electrical equipment 6 due to pumps 1 due to radwaste gas Battery Room - Table 9 - 4 fires, 1 of 2 battery rooms in this location (xl/2)

Control Room - Table 11 . fires Other Buildings - Table 7-2 2/3 fires 2 due to electrical equipment 2/3'due to welding or other work Reactor Building - Table 2 - 2 fires - . -, ". "-

1 due to welding or other work 1 due to pumps Location totals 2 2/3 due to welding or other work 14 due to electrical equipment 7 due to pumps 1 due to radwaste gas 2 battery rooms 3 control rooms total 29.67 Zone allocation assumptions (by reviewing Reference 4).

Welding or other work - Since equipment is relatively uniformly distributed through the area, and work is potentially to be performed on any equipment, distribution by area is a good approximation. Since a minimum IEF of l.e-3 will be used at least for the screeung, calculation of small numbers is not needed. 'The total frequency'due to this contributor is 2.67/717=3.7e-3. This contributor can be neglected for any zone not comprising $ 0% or greater of the auxiliary building area. The only zone with greater than 10% of the total analyzed area of 150,000 ft's zone 69. See Table 3.

Electrical equipment - in the auxiliary building, the electrical equipment is found in hallways or vestibule areas. Again, it is relatively evenly distributed in these areas. The frequency can be approximately split by the area of these zones. Zones marked with an E on Table 3 are included in this split.

Pumps - a count of the pumps is the auxiliary building can be made, and the IEF split by this count. 55 pumps were counted in the auxiliary building zones. Since a minimum screening IEF of 1.e-3 is used, zones with fewer than 3 pumps can neglect this initiator (7 x 3/55/717= 5e-4).

Zone 1 /5/6M/36/44S/69/

pumps 15/5/4/3/3 /6/

Revision 1

The remaining three items (radwaste gas, battery, and control rooms) can be allocated to the appropriate zones (5/106/53).

1 AUX BLDG Pumps 7 x 15/55 = 1.9 Electrical 14 x 4.5/98 = .6 Total 2.5 IEF = 2.5/717 = 3.5e-3 5 AUX BLDG (EAST END)

Pumps 7 x 5/55 = .6 Electrical 14 x 8.6/98 = 1.2.

Radwaste gas 1 x 1/1 = 1 Total 2.8 IEF = 2.8/717 = 3.9e-3 6M AUX BLDG (AQDDLE SECTION OF WEST END)

Pumps 7 x 4/55 = .5 Electrical 14 x 6.1/98 = .9 Total 1.4 IEF = 1.4/717 = 2.0e-3 6N AUXBLDG (NORTH'SECTION OF WEST END)

Electrical 14 x 4.2/98 = .6 Total .6 IEF = .6/717 = 0.8e-3 use minimum 1.e-3 12 QUADRANT 2 PIPING TUNNEL Electrical 14 x 7.8/98 = 1.1 Total 1.1 IEF = 1.1/717 = 1.5e-3 33A MAINSTEAM LINE AREA, EAST Electrical 14 x 39/98 = .5 Total .5 IEF = .5/717 = .7e-3 use minimum l.e-3 Revision 1 18

36 SPENT FUEL PIT HEAT EXCHANGER PUMP ROOM Pumps 7 x 3/55 = .4 Electrical 14 x 1.6/98 = .2 Total .6 IEF = .6/717 = .Se-3 use minimum l.e-3 38 QUADRANT 2 PENETRATION CABLE TUNNEL Electrical 14 x 2.6/98 = .4 Total .4 IEF = .4/717 = .6e-3 use minimum 1.e-3 43 ACCESS CONTROL AREA Electrical 14 x 4.6/98 = .4 Total .4 IEF = .4/717 = .6e-3 use minimum 1.e-3 44N AUX BLDG NORTH Electrical 14 x 7.4/98 = 1.0 Total 1.

IEF = 1./717 = 1.4e-3,.

44S AUX BLDG SOUTH Pumps 7 x 3/55 = .4 Electrical 14 x 9.4/98 = 12 Total 1.7 IEF = 1.7/717 = 2.4e-3 49 HVAC VESTIBULE Electrical 14 x 3.2/98 = .6 Total .6 IEF = .6/717 = 0.8e-3 use minimum 1.e-3 51 AUX BLDG (EAST END)

Electrical 14 x 5.4/98 = .8 Total .8 IEF ~ .8/717 = 1.1e-3 Revision 1

52 AUX BLDG (WEST END)

Eledrical 14 x 11./98 = 1.6 Total 1.6 IEF = 1.6/717 = 2.2e-3 53 UNlT 1 CONTROL ROOM Control Room 3 x 1/1 = 3 Total 3 IEF = 3/717 = 4.2e-3 69 AUX BLDG Pumps 7 x 6/55 = .8 Electrical 14 x 17.9/98 = 2.6 Welding 2.67 x 17.9/150= 2 Total 3.7 IEF = 3.7/717 = 5.le-3 106 AUX IZED.WATER BATTERY ROOM //1 Battery Room 2 x 1/1 =2 Total 2.

IEF = 2./717 = 2.8e-3 144 UNlT 1 HOT SHUTDOWN PANEL ENCLOSURE Eledrical 14 x .9/98 ~ .13 Total .13 IEF = .13/717 = .2e-3 use minimum l.e-3 Remaining Auxiliary Building Zones use minimum 1.E-3 fire frequency. The Auxiliary building results are summarized on Table 7.

, 2 fires were originally allocated to these mnes. One was due to a transient source (candle) and the other was due to a breaker. A room oC 250 VDC batteries is located in the switchgear cable spreading area (Zone 55) (by reviewing (Reference 4)). This should have been included in this area, for an additional two fires.

Zones 56 and 57 have no electrical equipment, just cabling. The transient source will be evenly split to the three maes. The breaker and battery fires to mne 55 (see 4.429).

Revision 1

The original analysis used 799 experience years for cable spreading. The auxiTiary building experience years of 717 will be conservatively used here since fires were added from auxiliary building battery rooms.

55 SWITCHGEAR ROOM CABLE VAULT Total 3.33 IEF 3.33 /717 = 4.6e-3 56 AUXILIARYCABLE VAULT Total .33 IEF M /717 = .5e-3 use minimum value of 1.e-3 57 CONTROL ROOM CABLE-VAULT"--

same as 56 The results for the cable spreading rooms are summarized on Table 8.

Note that potential ignition sources such as candles are carefully controlled at the Cook Nuclear Hant. There is no significant, credible ignition source for zones 56 and 57, or for the region of Zone 55 outside of the battery area Since significant important cabling is in these zones, the fire initiabon frequency is refmed here for these areas for use after the screening. The screening will use the screening minimum value above for consistency.

The transient source (candle) assumed in the original analysis is not plausible at the Cook Nuclear Plant. By reviewing the FIVE fire initiation frequency methodology, only two potential fire initiators were identified, general transient (which would include candles),

and unqualified cabling.

Most cabling in the plant is qualified to either IEEE-383 or IPCEA standards (Reference 60). The fire ignition frequency due to the remaining small amount of,unqualiGed cabling would provide a negligible fire initiation fr'equency'.'

Access to the cable spreading zones is strictly controlled, and none of. the transient ignition sources ( cigarettes, heaters, etc.,) are allowed in the zones during power operation.

However, clearly some fire'initiation is phusible in any area Therefore, to establ@ a plausible fire initiation frequency, one weighing factor of the transient initiator is assumed for each zone. Thus, the fire initiation frequency is the phut wide frequency times the weighing factor divided by the number of evaluated zones, or 12F 3el/100=19E-5/yr for each of the three cable spreading areas. This evaluation is sufficiently conservative to cover any additional contribution from" the unqualified cabling discussed above.

28.67 fires were allocated to these zones. These are categorized as follows (Tables refer to Reference 27) i This calculation uses 689 experience years for these zones consistent with the original calculation.

Revision 1 21

Turbine Building - Table 13 - 21 fires.

3 due to welding or other work 3 due to electrical equipment 7 due to hydrogen or gas systems 8 due to oil leaks/ pumps Other Buildings - Table 7 - 3 20 fires 1 due to oil on hot piping 1 due to hydrogen 1 20 due to welding or other work In addition, 1 fire was included from a security building fire, and 1 from a pump room f

II 'h A P ~ " ~ 4 Reactor Building - Table 2 -2 fires 2 due to oil leaks/hot equipment Location totals 4 2/3 due to welding or other work 3 due to electrical equipment 12 due to oil/ pumps 8 due to hydrogen or gas systems 1 due to security equipment total 28.67 Zone allocation assumptions (by reviewing Reference 4).

Generally, welding/work is assumed to be distributed by fioor area. The water intake area (zone 143) was ignored since it is a large open area. Also, the hirge turbine building fioor (Zone 129) was scaled down by 1/5 to adust for less equipment. With these a4lustments, equipment and therefore work is assumed to be weB distributed in these areas. Zone 77, the welding shop, is assumed to have 1 20 of the 4 2/3 fires.

Electrical equipment fires are assumed to be distributed in areas judged to have siginficant eqmpment of that type, by fioor area since the equipment is generally evenly distributed hi those areas.

fires are distributed by'fioor area in areas containing significant oBed

'il/pump equipment, including turbine/generator beiring and the auxiliary boBer.

'ydrogen fires dominate the hydrogen or gas systens fire inithtor. Areas with hydrogen or waste gas equipment are selected.

The 1 security equipment fire is assumed to occur in zone 91, which has a small security room which may have similar equipment.

The spreadsheet used to calculate the fire frequencies by zone is found on Table 3. The results for the turbine building are suimnarized on Table 9.

Revision 1

4.5 ACCIDENT SEQUENCE INITIATIONFREQUENCY FOR ZONE SCREENING Each of the 65 zones that had safe shutdown equipment or cabling, or equipment modeled in the IPE was reviewed to identify any zones that could induce or substantially impact the initiating event frequency for any of the following events: normal transients, transients without power conversion systems, loss of 250VDC power, loss of component cooling water, loss of essential service water or station bhckout (see Section 4.2).

4.5.1 Accident Sequences Considered for Each Zone The lists of safe shutdown components and cables from the SSSA (Reference 5) were reviewed, as well as system cutset editor runs performed for Revision 0 of the Fire PRA, to determine if a fire in any of the 65 fire zones could adversely affect the component cooling water, essential service water, 250VDC, or emergency diesel generator systems. Of the 65 fire zones reviewed, 21 zones were identified that have components or cables critical to the operation of at least one of the above systems. The components or trains that could be affected by fires in the 21 zones are summarized in Table 11, with more detail given in Appendix E. The applicable initiating event frequencies for these 21 zones was determined next.

4.5.2 Frequencies of Sequence Initiation The values used for the initiating event frequency calculations can be found in Table 10. These values are calculated in Appendix G, except for the SBO initiating event frequency for Zone 13, which is calculated in Appendix E. These were calculated based on the IPE initiating event frequency calculations (Reference 9).

For zones where more than one non-TRA initiating event was considered, event trees were used to determine the initiating event frequencies. Event trees were used for zones 6N, 15, 16, 29G, 40A, 40B, 42A, 42C, 42D, and 79. These event trees are included as Figures 1 through 10. The frequencies determined in these event trees are zone specific, as they include the probability, of a fire in that zone.

For the 11 zones that did not require an event tree, the initiating event frequencies, were found based on the critical components in the zone; For example,'f a fire in the zone could disable one train of component cooling water, the initiating event frequency is 1.0E42 (from Table 10). The zone specific frequency would be (1.0E-02) (zone specific fire initiation frequency).

Table 11 is a summary of the zone specific frequencies for initiating events for all 21 zones. The fire frequencies for the zones were taken from Tables 4 through 9. See Appendix E for more information. For the 44 zones not listed in Table 11 (i.e., zones with only TRA initiating event),

their zone specific TRA initiating event frequencies are equal to the fire initiation frequencies.

4.6 QUANTITATIVESCREENING ASSIMMENT Following the initial screening (Table 1), which left 65 zones, and the identification of zones that could affect non-TRA IEFs, the core damage frequency was estimated for each of the zones.

These core damage frequencies were used for the next screening, as described in Section 4.7..,The estimated core damage frequencies and the corresponding methods used are included in Table 12.

Initiating event hand calculations (Appendix E), computer runs (SCE or SENS), and engineering judgement were used to detemiine core damage frequency. These methods are described below'.

Revision 1

4.6.1 Events Other than Transients Initiated Following the calculation of the zone specific frequencies of initiating events for the 21 zones impacting component cooling water, essential service water, 250VDC or the emergency diesel generators (as shown in Table 11), the core damage frequency for each zone was estimated.

These calculations of core damage frequency can be found in Appendix E, and the results of these calculations are in Table 12. IVhen TRA was also a credible initiating event (see Table 11), its corresponding core damage frequency was estimated as described in Section 4.6.2.

, 4.6.2 Transient Initiated Events The assessment of transient events conservatively considered the fire initiation frequency (without consideration of fire detection or suppression) and assumed the failure of all components located in the fire zone under investigation. After quantification those zones having a core melt contribution lower than 1.0E46/year, were eliminated from a.thorough inspection.

For instance, fire zone 1C, which contains the East RHR train, was eliminated from a thorough inspection because the low fire initiating frequency in corjunction with the one RER train being disabled resulted in a core damage frequency considerably smaller than the screening value of 1E-06/year.

In performing the initial quantitative screening, a large number. of zones were looked at for their impact on CDF. Many of the fire zones that were analyzed in Revision 0 of the Fire PRA using the TRA event have not changed as a result of this revision. To identify the necessary changes for this revision, each of the SCE runs from the original analysis was reviewed and baseline runs were performed using the SENS code (Reference 12) to verify the accuracy of the runs. The original SCE runs used an earlier version of the transient quantification that was conservative to the final transient quantification. This comparison showed a 1.0E42 decrease in the TRA.OUT conditional probability for'the'c'uirent analysis compared to the original analysis. Therefore, the SCE runs (based on the early version of TRA.OUT) were considered to be very conservative and no new SENS runs (based on the current version of TRA.OUT) were needed for these fire zones.

The final transient quantification for Revision 0 of the D. C. Cook Nuclear Hant PRA was used as input to this code.

In situations during this revision where no SCE run was found from the original analysis, a couple of different methods were used to address that speciYic fire zone. Inithlly, reviewing the fire zones, all SSSA cable and components were identified and matched with an associated modelled PEA component so that a SENS run could be performed. The initial review focused on fire zones that were felt to be dominate contributors to CDF. The results of the SENS nms on TRA events are presented in Table 12; "With the first round of the SENS runs completed, the remauiing TRA fire zones were identified along with the zone's associated SSSA cables and components. From the components identiYied, engineering judgement was used on these fire zones. Based on the similarity between fire zones from the earlier SENS nms, it could be judged that the estimated CDF would be much smaller than the 1.0E47 reporting criteria. Appendix B provides a list of the zones that were evaluated using engineering judgement along with justification for screening out the zones. Table 12 also lists the fire zones that used these assumptions.

Of the 53 fire zones that were evaluated using the TRA event,.all but two zones were found to have an estimated core damage frequency lower than 1.0E46. These remaining zones (Zone 6M and 17C) contained the cables and components associated with the Auxiliary.Feedwater System, Revision 1

requiring a walkdown and further detailed evaluation. Documentation of all the estimated core melt frequency estimations for,this screening exercise are located in Appendix B. Table 12 lists the TRA zones that were eliminated from a thorough inspection.

4.6.3 Screening Summary r ~

Table 12 lists the estimated core damage frequency for each of the 65 zones and the corresponding method used to determine this value. Some zones had more than one relevant initiating event sequence (CCW, ESW, SBO or TRA). The most significant non-TRA initiating event was considered, as well as TRA. As a result, some zones have two values listed in Table 12.

The more accurate value of CDF was used for the priority determination (i.e., the values in bold print in Table 12). As described in Section 4 6.2.1, the SCE runs are not believed to be as accurate as other methods.

The following guidelines were used for this priority determination:- --

Kgh priority zones CDF R 1E46 Low priority zones 1E-07 6 CDF < 1E46 No priority zones CDF < 1E47 Table 12 also lists the priority determination for the 65 zones. The 23 high priority zones were evaluated further in the analysis, as described in Section 5.0. The 38 no priority zones were screened out and not considered further. The remaining four low priority zones were not evaluated any further, and they were not added into the final core damage frequency due to fire.

The low priority zones will be reported to the NRC in our Fire PRA submittal, however, consistent with the reporting criteria of Reference 10.

4.7, OVERVIEW OF THE EVALUATIONOF SIGNIFICANT FIRE ZONES The 23 high priority zones were evaluated further using engineering judgement, walkdowns and COMPBRN runs. In addition, the evaluation of some fire zones (e.g., control room) required the calculation of human reliability values.

4.7.1 Walkdown Findings Walkdowns were performed at the Cook Nuclear Plant on September 8 and September 22, 1994.

The walkdown participants were J. M McNanie and M. A. Wilken from AEPSC. Thirteen of the 23 high priority zones were walked down. The walkdown findings for these thirteen zones can'be found in Appendix C.1. These walkdown findings were used for the final screening and quantification, as described in Section 52. Zone 6M was walked down at a later date, as described below. The nine zones that were not walked down were zones 15, 16, 17C, 29G, 55, 56, 57, 112 and 144. For zones 15, 16, 17C, 29G and 112, it was not necessiiry to have detailed walkdowns for these zones. The existing walkdown information, analyst familiarity and drawmgs were used to substitute the fire analysis methods used. When needed, discussions with plant personnel or fire protection engineers supplemented this information. Zones 55, 56, 57 and 144 include the control room, the auxiliary cable vault, the control room cable vault and the.hot shutdown panel enclosure. They were not walked down because no helpful information would have resulted.

A walkdown was also performed of fire zone 6M, on Novembex 10, 1994, by R. B. Bennett from AEPSC. This walkdown was done to address a concern regarding taking credit for Unit 2 AFW.

Revision 1 "

25

Cabling for all trains of AFW for both'units pass through this zone. However, it was found that the Unit 1 cabling is well separated from the Unit 2 cabling, with no significant combustible source present. These walkdown findings are included as Appendix C.2.

4.7.2 COMPBRN Run A COMPBRN run was performed to support the analysis assumption that the oil stored in the fire storage cabinet (in Zone 52) would not get to a high enough temperature to spontaneously ignite, even with a 1 gallon spill of oil burning adjacent to the cabinet. Appendix F contains additional information on this COMPBRN run, including the input and output files.

4.7.3 Engineering Judgement 3

~"

In performing the detailed review of the remaining fire'zones, engineering judgement was used to determine what the worst case fire would*be and what components would fail. In most cases, a speciTic methodology was used such as FIVE or COMPBRN to provide verification of the components or cables that would be damaged in a given fire scenario. Section 4.1 lists the assumptions that were used in performing the detailed evaluation. Some assumptions used in this analysis were: only fire sources of risk significance are those which are semi-permanently stored in fixed locations, fires originating in electrical cabinets are assumed to stay in the cabinet of origin, and MOVs that have double break control circuitry will not spuriously operate a motor operated valve. The combination of the above techniques was used in evaluating fire zones presented in Section 5.3.

4.7.4 Human Reliability Values Human reliability values were necessary for the evaluation of zones 53 (Unit 1 control room) and 55, 56 and 57 (cable vaults). -These calculations can be found in Appendix D. Appendix D.1 contains the human reliability calculation of the operators failing to cooldown and depressurize following a loss of CCW, due to a control room fire in the service water panel. This human error probability was determined to be .025. Appendix D.2 contains the human reliabBity calculation of the operators failing to crosstie Unit 2 AFW and CVCS using the emergency remote shutdown procedure series (Reference 28), foBowing a loss of all Unit 1 power and control and evacuation of the control room, due to a cable vault fire. This human error probabBity was determined to be 0.11.

4.8 FINAL QUANTIFICATIONAND SCREENING The following sections provide a detailed evaluation of the fire zones that did not meet the FIVE Methodology screening criteiia of.1.0E46 during the initial scrimiing assessment. Each fire zone along with the postulated fire scen'ario is described m detail. The walkdown notes as well as fire zone layout drawing for each of the fire zones below are located m Appendix C. The assumptions made in the detailed evaluation are described more thoroughly in Section 4.1.

4.8.1 i Z n - uxilia B 'ldi - iddl 'n W n Fire zone 6M contains the Boric Acid Storage tank room as weH as the corridor surrounding the room. This fire zone required additional evaluation since Unit 2 auxiTiary feedwater cabling passes through the zone and main feedwater cabling is not explicitly traced (see Assumption 21).

Thus, all secondary cooling could fail as a result of a zone wide fire. Walkdowns performed in this zone determined that the conduit containing AFW cables eaters the BAST room at Revision 1

approximately 10 feet elevation, lowers to about 8 feet, and turns immediately to exit the room.

The wall penetrations where each unit's conduit enters the room are about 20 feet apart, with a concrete cable tunnel separating them. The pipe tunnel extends about 6 feet into the room. This is the closest the two sets of cables get, since the cables turn toward their respective units. No combustion sources were noted in the room and, by discussion with the CVCS system engineer, no combustibles are typically ever stored in the tank room. No transient combustibles sani-permanent or permanent were found to exist in this fire zone and, based on the walkdowns, there are no significant fire ignition sources located in the vicinity of the AFW SSSA cables. The Boric Acid Transfer pumps located in this room are small enough not to be considered a signiTicant fire risk. A review of the both unit's AFW cable conduit during the walkdown of fire zone 6M showed good separation between Unit 1 and Unit 2 auxiliary feedwater cable conduit.

Based on the above detailed evaluation, it is conduded that fire zone 6M is not a fire risk due to the limited amount of combustibles located in the fire zone (see Assumption 14). Therefore, this zone can be screened out from further. analysis..- ---

4.8,2 i Z n -Auxilia Bl -N h 'n W n - ni Fire zone 6N contains several MCCs that supply components that were modelled in the Cook Nuclear Plant PRA. The systems that were affected were CCW, CVCS (Charging), and ECCS (High Pressure Recirculation). In reviewing the SSSA cables and components for this fire zone, it was determined through an event tree analysis that loss of CCW was the critical initiating event for fire zone 6N (see Figure 1).

Based on walkdowns in fire zone 6N, it was concluded that a transient combustible fire in the area of MCC 1-AB-A was not a credible scenario. The transient combustibles found in this zone consisted of binders with paper around the RP desk and a covered garbage can a substantial distance from the MCC in question. No other permitted transient combustibles, such as, oils, aerosol, and cleaning fluids were found in this zone. The nearest cribcal component to MCC 1-AB-A would be 1-AB-D which contains the 600VAC starter for the east CCP lube oil puinp which is approximately 18 feet away. Thus, it was concluded that fire damage would be confined to. the critical MCC.

A fire in MCC 1-AB-A results in a loss of power to 1-"AZV-A,'failingWMO-737, a valve that provides ESW flow to West CCW Hx. This valve would fail as is, so the normally operating train would not be impacted. Another critical component affected in MCC 1-AB-A would be the west CCP lube oil pump. Loss of this component would result in loss of one traui of high pres.nire recirculabon. Thus, the worst case fire in this zone would result in a loss of one train of component cooling water in standby and the west train of charging for high pressure recirculation. Based on this evaluation, an analysis was performed faYiing the west (standby) train of CCW (WMO-737TM) and the west train of ECCS high pressure recircuhbon (PP-50WPS). The variables needed to calculate an estimated core damage frequency consist of fire initiation frequency (1.0E43), initiating event frequency of loss of one train of CCW ln standby (2.34E44) and the conditional probability for a loss of CCW analysis failing the charging pump (4.54E42). Using the above values, the results of the analysis showed that failure of these component provide a estimated CDF of 1.06FA8, which is less than the EPRI Five methodology cutoff of 1.0E46. Therefore, this zone is not risk significan.

I Revision 1 27

4.8.3 Fir Z n 15-1 D Dimel Generator Ro m

. Fire zone 15 contains the Unit 1 CD emergency diesel generator (EDG), as well as the SSSA cabling traveling through the zone. The cabling located in the zone that is not directly associated with the EDG consisted of the both RHR and charging pumps, West ESW, East AFW and several MCCs of both safety trains. Discussion with Appendix R personnel and a review of each of the cables in the fire zone determined that the majority of the west train safety-related cables were embedded in concrete pilaster and surrounded by a layer of Thenaolag. By way of engineering judgement, it was assumed that for any given fire scenario the cables embedded in concrete would aot be damaged in a fire. Exduding these cables, a worst case fire in this zone would result in a loss of a standby train of CCW due to loss of control to pump 1-PP-10E. This is considered to be the dominate initiating event for this analysis.

~ * ~ ~ ~ t4 ~ ~ tf Based on this review, a sensitivity analysis run was performed to deteraiine the failure probability of loss of a standby train of CCW along with the failure other critical cables located in zone that are not in the concrete pilaster. Using the event tree analysis for loss of CCW, a seasitivity analysis was performed, failing the east train of CCW (I-PP-10E), to determine the estimated CDF. The loss of Uiut 1 AB EDG was not induded in this analysis since it would have little impact on the CCW event tree. The variables needed to calculate the estimated core damage frequency consist of fire initiation frequency (2.2E42), initiating event frequency of loss of one train of CCW in standby (2,34E44) and the output of the sensitivity analysis run failing components (5.9E42). Using the above values, the estimated CDF was calculated to be 3.04E47.

The results of this calculation show that the estimated CDF is less than the FIVE methodology cutoff of 1.0E-06. Therefore, this zone is of low fire risk significance, but will be reported.

4.8.4 ir Z ne 6-1 B Di el nerat rR Fire zone 16 contains the Unit 1 AB emergency diesel generator (EDG), as well as the SSSA cabling traveling through the zone. The cabling located in the zone that is not directly associated with the EDG consisted of the control cabling for West RHR pump, West charging pump, West ESW, and West AFW pump. A review of each of the cables detenniaed that the worst case fire for this zone (assuming damage to all the cables) would be a loss of a standby train of CCW, as weH as the EDG. This is due to loss of control to pump 1-PP-10W. This is considered to be the dominate initiating event for this analysis.

Based on this review, a sensitivity analysis run was performed to determine the Maze probabBity of loss of a standby train of CCW along with the Mure of other critical cables located ia zone that are not in the concrete pilaster. Using the event tree analysis for loss of CCW, a sensitivity analysis was performed, failing the east train of CCW'(1-PP-10%), to deteraiine the esthaated CDF. The loss of Unit 1 AB EDG was'not induded in this analysis since it vtould have Httle impact on the CCW event tree. The variables aeeded to calcuhte the estimated core damage frequency consist of fire initiation frequency (2.2E42), initiating event frequency of loss of one train of CCW ia standby (2.34E44) and the output of the seasitivity analysis nm Ming components (6.8E42). Using the above values, the estimated CDF was calculated to be 3.50E47.

The results of this calculation shows that the estimated CDF is less than the FIVE methodology of 1.0E46. Therefore, this zone is of low fire risk significance, but will be reported. 'utoff 4.8.5 i Z n 17 - rrid t h ni Fire zone 17C is the corridor to the AFW pump rooms and contains SSSA cablirig associated with the AFW pumps and valves for both Unit 1 aad 2. Review of the SSSA cable failure modes for Revision 1

this fire zone detemiined that for both Units 1 and 2 all trains of AFW would be lost in a worst case fire assuming all cables are damaged in the fire zone. Assuming an additional failure of the Main Feedwater System, since this cabling is not explicitly traced, results in an estimated CDF greater than the 1.0E46 cutoff.

n No permanent or semi-permanent transient combustibles are located in the fire zone. Therefore, the assumption that the only sources with risk signiflcance are those which are semi-permanently stored in fixed locations, and whose presence is evaluated and tracked by permits issued by the fire protection engineer, can be used for this fire zone. It was also noted that the door to fire zone 17E is open to 17C due to steamline break concerns for the turbine-driven AFW pump room. There is a fusible link located on the door which doses at approximately 375'F (Tech Evaluation 11AO, Reference 29) which would be well below the cable damage temperatures of 700'F. Also, there are no permanent or semi-permanent combustibles stored in fire zone 17E.

Based on the above detailed evaluation,,it, is, concluded. that fire zone.17C is not a fire nsk due to the limited amount of combustibles located in the fire zone. Therefore, this zone can be screened out from further analysis.

4.S.6 Fir Z n 29 - creenhoue M tor ntr I R m fr -B th Uni Fire Zone 296 contains SSSA cabling for both units ESW systems which traverse through protected and unprotected pull boxes and conduit in this zone. For this detailed evaluation, the fire zone documentation was reviewed, as well as walkdowns performed by plant personnel to determine the approximate location of the components in the fire zone. Two non~ety related MCCs are also located in the center of this fire zone. The pull boxes are located approximately 10 feet from the floor.

Since no transient semi-permanent or permanent combustibles were found in this fire zone, it is assumed that a fire in this zone would start in one of the non~ety related MCCs. Based on the fact that fire propagation outside of a cabinet is not credible as indicated earlier, this fire would not cause damage to the ESW SSSA cabling within the zone. Therefore, based on this detailed evaluation, this fire zone is screened out from further review.

4.8.7 Fi Z ne A-4kVAB wi c ear Fire zone 40A contains the electrical safety buses that provide 4KV power to west train-components modelled in the Cook Nuclear Hant PRA. Of significance, fire zone 40A contains electrical safety bus T11A which provides power to the ESW, CCW, SI, CCP, RHR pumps,'s well as, other components important to safety. In evaluating this fire zone, an event tree analysis (Figure 5) was performed to detexniine what the critical initiating event would be. The analysis showed that the dominant contributor would be a loss of CCW initiating event. Since no.

,transient combustibles were found to exist in this fire zone, it is assumed that a fire in this zone starts in one of the 4KV buses. For this evaluation, it was assumed that the worst case'scenario is ignition and destruction of the west CCW pump 4KV bus. In the eledrical safety bus T11A, each of the individual safety buses is in a cabinet separated by metal partitions to prevent fire from spreading from one safety bus to another (Reference 30). Therefore, it is assumed fire within a cabinet will not create enough heat outside of the cabinet to damage cables h the

+t a adjacent safety buses (Reference 59).

Based on these assumptions, this fire scenario would result in only failing the west CCW pump bus on T11A; Based on this evaluation and, using the event tree analysis for loss of CCW, an Revision 1 29

analysis was performed failing the west traia of CCW (PP-10WPS) to obtain an estimated CDF.

The variables needed to calculate the estimated core damage frequency consist of fire initiation frequency (3.2FA3), initiating event frequency of loss of one train of CCW (1.0FA2) and the output of the sensitivity analysis run failing the above components (1.65E42). Using the above values, the estimated CDF was calculated to be 5.28E47. Since the fire is equally likely to occur in any of the four cabinets located in this fire zone, this fire initiation frequency can further be divided since only the TllA cabinet is critical, for an estimated CDF of 1.32E47.

4.8.8 ir Zon 40B - 4kV D witch ear R m Fire zone 40B contains the electrical safety buses that provide 4KV power to east train components modelled in the Cook Nuclear Hant PRA. Of significance, fire zone 40A contains electrical safety bus T11D which provides power to the,ESW, CCW, SI, CCP,.and RHR pum~,

as well as other components important to safety. In evaluating this fire zone, it was'determined, based on walkdowns, that the assumptions performed for fire mne 40A hold true for fire mne 40B.

Based on this evaluation and using the event tree aaalysis for loss of CCW, an analysis was performed failing the west train of CCW to deterniine the estimated CDF. The variables needed to calculate the estimated core damage frequency consist of fire initiation frequency (33E43),

initiating eveat frequency of loss of one train of CCW (1.0E42) and the output of the analysis run failing the above components (2.33E42). Using the above values, the estimated CDF was calculated to be 7.45E47. Since the fire is equally likely to occur in any of the four cabinets located in this fire zone, this fire initiation frequency can further be divided since only the T11D cabinet is critical, for an estimated CDF of 1.86E47.

4.8.9 i Z ne 41 - En ineered afet tern & m- ni Fire mne'41'contains'he 600VA'C'bMs, traasfoimea, MCCs and AB battexy chargers used to support safety and non-safety related electrical equipment to support the Cook Nuclear Hant.

Many of these components were modelled in the PRA. During the walkdowa of this fire mne, no transient combustibles, permitted or otherwise, were found in the area. Based on these findings, it was assumed that, if a fire would occur in this zone, it would be located in one of the dectrical cabinets and would not propagate outside of the cabinet.

Based on reviewing the Cook Nuclear Hant PRA, it was deterauaed that the worst case fire ia this zone would take out one the 600VAC safety buses or its associated transformer. The 600VAC bus 11D was found to be the critical component in modeling a fire in this mne siace it supports CCW components. Since these components are typically motor operated valves, tbe failure of power to these valves would result in a "fail as is" faBure mode. Loss of power to a normally running train of CCW would not affect the systeia. Tbe train of CCW in standby would be affected by this failure mode. As a result, this analysis will assume that bus 11D b supportiag the CCW train that is in standby., The CCW initiating event is considered to be tbe dominant coatributor to CDF in this scenario. Bus 11D, as modelled in the Cook PRA, provides 600VAC power to west traia motor operated valves. The worst case fire scenario in this bus would be a fire that damages the whole bus 11D, resulting in a loss ot 600VAC (1 tniin) and loss of one train of CCW. This failure would only hapact the train that is in standby. The CCW initiating event, frequency for a loss of one train of CCW in staadby was calculated to be 2.34lM4 (Table 10).

Revision 1 30

Using the above information, an analysis can be performed to determine the impact that a loss of bus 11D would have on the core damage frequency. The fire initiation frequency was calculated to be 9.1E43. The conditional probability for a loss of CCW analysis failing bus 11D is 5.27E-

02. The estimated CDF for fire zone 41 is as follows.

Est. CDF = 2.34E44*9. 1E43*5.27E42

= 1.L)E47 4.8.10 Fi Zone 42A - Electrical Power vstem Tram f rmer R om - nit 1 Fire zone 42A is very similar to fire zone 41 in that 42A contains the opposite train 600VAC buses, 11A and 11C, and transformers. lI fost of the components that these electrical buses support were modelled in the Cook Nuclear Plant PRA. During the walkdown of this fire zone, no transient combustibles, permitted or otherwise,.were found in the area., Based on these findings, it was assumed that. if a fire would occur in this zone, it would be located in one of the electrical cabinets and woulo not propagate out of the cabinet.

As with fire zone 41, the worst case fire in this zone would in the 600VAC electricai bus 11A which supports CCW components. The same assumptions will be used in the analysis that were used in fire zone 41. The CCW initiating event is considered to be the dominant contributor to CDF in this scenario. Bus 11A, as modelled in the Cook PRA, provides 600VAC power to east train motor operated valves. The worst case fire scenario in this bus would be a fire that damages the whole bus 11A, resulting in a loss of 600VAC (1 train) and the loss of one train of CCW. This failure would only impact the train that is in standby. The CCW initiating event frequency for a loss of one train of CCW in standby was calculated to be 2.34E44 P'able 10).

Using the above information, an analysis was performed to determine the impact that a loss of bus 11A would have on the core damage frequency. The fire initiation frequency was calcuhted to be 7.1E43. The conditional probability for a loss of CCW analysis failing bus 11D is 5.02E-

02. The estimated CDF for fire zone 42A is as follows.

Est. CDF = 224E44~7.1E-035.02E42

= 8.34E48 The results of this calculation show that the estimated CDF is less than the reporting cutoff of I.OE47. Therefore, fire zone 42A will be screened out.

4.8.11 F 42 - El ri P w T rm R m- ni Fire zone 42C contains the 250VDC distribution panel 1-MCAB which provides a switch and fuse between the battery loads and the 250VDC AB battery, as modelled in the Cook Nuclear Phnt PRA. With no transient combustible typically found in this fire zone, it can be assumed that the worst case fire in this zone would start in the distribution cabinet and damage all of the critical cables. Based on reviewing the one-line electrical drawing (Reference 31), the worst case fire would result in a loss of one train of 250VDC. The event tree analysis for initiating events for this fire zone also showed that a loss of CCW was the dominant contributor to CDF in the erat of a fire. This was due to the fact that loss of the 250VDC distribution panel will result in a'loss of control power for valves on the CCW train in standby. Using the event tree analysis results, the estimated CDF can be further reduced from the value calculated in the first screening. The Revision 1 31

initiating event frequency for a CCW train in standby was calculated to be 224E44, the fire initiating frequency (1.0E43), and the conditional probability for a loss of a standby train of CCW analysis failing a train of 250VDC is 5.06K@2. Multiplying these three numbers together results in an estimated CDF for fire zone 42C of 1.18E-08. Since the estimated CDF in less than the reporting criteria of 1.0E-07, this fire zone screens out.

4.8.12 Fir Z ne 43 - Acct ontrol Ar - Both ni Fire zone 43, located in the auxiliary building, only contains two SSSA cables which provide power (I-AM-A)to CMOA20, the west CCW heat exchanger outlet shutoff valve. The cables in this fire zone are not directly visible since this fire zone contains office and laboratory areas which have ceiling tiles. These cables are located in conduit above the ceiling tiles. There is another. cable in the SSSA listing associated. with the east train of, CCW, but it was discovered

'hat'this cable is a spare and would not impact the CCW system.

In analyzing this fire zone, failure of the cables discussed above would only impact one train of CCW. Failure of the two power cables would result in a "fail as is" for the CCW Hx discharge valve CMO-420. Therefore, failure of the CCW train in standby would be the worst case scenario. The CCW initiating event for this fire scenario is 2.34K@4. The fire initiation frequency for this zone is 1.0E-03 and the conditional probability for a loss of a standby train of CCW with a failure of 1-AMA-Ais 439FA2. Based on multiplying these three values together the estimated CDF was calculated to 1.02E48. This value is less than the reporting criteria of 1.0E47. Therefore, this fire zone can be screened out.

4.8.13 i Z n 44 - Auxilia Biiildi rth - th ni

, Fire zone 44N contains valves, heat exchangers and SSSA cables associated with the Component Cooling Water system, as well as other SSSA cabling associated with various safe shutdown systems. Many of the components and'cables'were modelled in the Cook Nuclear Hant PRA;" In reviewing the other SSSA cabling located in this zone, it was Identified that both Unit 1 and 2 AFW cabling resided in fire zone 44N. For Unit 2 AFW, cabling for only one train of the AFW system resides in this zone. Since cabling for the Main Feehvater System was not traced, the Main Feedwater System was not credited in this analysis. In evaluating this fire zone, each of the SSSA cables and components were reviewed to determine what impact failure of the cable or component would have on the CCW system. Based on the review of the cables and components, the failure of CCW system would be the dominate contributor to CDF.

The waikdowns conducted on this zone identified several transient combustibles. A RP desk with paper and plastics was in the vicinity, a dress out area was off to the side of the corridor with a substantial amount of antiw's, boots, gloves located in metal caged b~ and in the corridor was a covered garbage can.

Based on the amount of transient combustibles and the number of cables in this fire zone, it h assumed that a worst case fire would damage all of the cables. Evaluation of the SSSA cables and components concluded that damaging these cables would only result in a loss of one train of CCW in standby. The explanation holds true for this zone as with several other zones ln ths analysis in that the MOVs would fail "as is", resulting in a failure of the CCW train in standby.

The normally running train would be affected by the loss of power or control of the valves m this zone. As with the other zones, hot shorts are not assumed to cause the CCW MOVs to spuriously

'perate. This assumption is based on the double break control circuitry design and the Appendix R analysis.....

Revision 1 32

Based on this evaluation and using the event tree analysis for loss of CCW, an analysis was performed failing the west train of CCW (CMO420), all three trains of Unit 1 AFW, and the MFW system to determine the estimated CDF. The Unit 2 AFW system still has two trains available to provide decay heat removal if a fire would occur. The other train of the Unit 2 AFW did not make cutoff foi CCW.OUT. The variables needed to calculate the estimated core damage frequency consist of fire initiation frequency (1.4E43), initiating event frequency of loss of one train of CCW in standby (2.34E44) and the output of the analysis run failing the above components (4.4E42). Using the above values, the estimated CDF was calculated to be 1 44E-08, which is lower than the reporting criteria of 1.0E-07, therefore, this zone screens out.

Since the loss of Unit 1 AFW system could signiTicantly impact the TRA event tree, an analysis was performed failing the Unit 1 AFlV system, 1 train of Unit 2 AFW, Unit 1 MFW system and a standby train of CCW. The variables needed to calculate the estimated core damage frequency consist of fire initiation frequency (1 4E43), the normalized TRA initiating event frequency (I/3.8) and the output of the analysis failing the. above components (2.70E45). Using the above values, the estimated CDF was calculated to be 9.95E49, which is lower than the reporting criteria of 1.0E-07. Therefore, this zone screeiis out.

4.8.14 i Z ne - uxilia Buildi h- h ni Fire zone 44S contains the CCW pumps and associated SSSA cables for both units. Only the Unit 1 CCW system was modelled for the Cook Nuclear PRA. As part of the original Fire PRA developed during revision 0 of the IPEEE, COMPBRN runs were performed simulating a lube oil spill around one of the CCW pumps. Each of the CCW pumps has a concrete lip built around the pumps to prevent an oil spill from spreading out to the opposite train pump. As part ofPis fire scenario it was assumed that the pump with the oil spill has failed. The COMPBRN run.was used to confirm that no damage would occur to the opposite train pump, as a result of this fire.

The results of the COMPBRN run confirmed that the opposite train pump would not be damage (Reference 32).

Based on this evaluation and, using the event tree analysis for loss of CCW, an analysis was performed failing the normally running train to obtain an estimated CDF. The variables needed to calculate the estimated core damage frequency are the fire initiation frequency (2AE43),

initiating event frequency of-loss of the ruimiiig train of CCW (1.0E42) and the 'output of the run failing the above components (1.6E42). Using the above values, the estimated CDF was calcufated to be 3.SEE.

4.8.15 i Z n 1- Auxilia B i i - En Fire zone 51 contains the control cables associated with the west CCW Hx disdiarge valve C 420 and the east CCW Hx inlet and outlet ESW supply valves. These components were mode'ed in the Cook Nuclear Hant PRA. The cables run through covered cable trays which travel directly through the fire zone on the mall next to the passenger elevator. During the malkdowns, the only transient combustible identiYied in this zone was a 55 gallon drum of used oil which is approximately 30 feet away from the cable trays. In a discussion with a fire protedion engineer at the plant, it was explained that the 55 gallon drum was used as a temporary collection site for used oil. This allowed for the oil to be disposed in hrge quantities rather than a gallon at a tIme (Reference 33). The oil drum resides in a spill proof container which goes up to about half the height of the barrel and is chained to the floor. The cap on the oil drum is also locked in phce.

There is an automatic sprinkler system in this zone that would prevent the pres.nire inside the barrel to increase to a point which would cause it to implode (Reference 33). Based on PMF2270, Revision 1 33

Fire Protection, no more than a gallon can of oil should be transferred through the zone at any one time. Therefore,' fire in the vicinity of the barrel would consist of no more than one gallon of spilled oil.

The FIVE methodology quantitative screening analysis can be used to determine if damage would occur to the cable trays if one gallon of oil by the barrel of oil would ignite and start on fire.

Table 13 shows the work sheet used to perform this calculation. Based on the results of the FIVE methodology screening analysis, which showed no damage to the critical cables located in this zone. Therefore, fire zone 51 can be screened out from further analysis.

4.8.16 Fire Zone 52 - Auxiliarv Buildin - rV t End - Both ni Fire zone 52 contains the same SSSA control cables that go through fire zone 51. This includes the west CCW Hx discharge valve CMO420 and the east CCW Hx inlet and outlet ESW supply valves. These components were modelled in the. Cook Nudear Hant PRA. As identiTied during the walkdowns, the critical cables carrying the SSSA cables important to the Fire PRA come into fire zone 52 at approximately 13 feet above the fioor until they get dose to the MCCs and then they drop to about 7.5 feet. There is a flammable storage cabinet about 21'rom the MCCs.

The cabinet is designated as a 10 ft'abinet with oils and solvents, and is tied down with a thick metal strap. There is nothing directly above the cabinet, but cable tray 1AU-C4 comes within approximately 12 feet of the cabinet. The MCCs 1-AM-A and 1-AM-D are about 21 feet apart with 1-AN-A being little more than 40 feet away from the flammable storage cabinet. MCCs 1-AM-A and I-AN-D provide 600VAC power to motor operated valves associated with both trains of CCW, as well as other components not as critical to Cook Nuclear Hant PRA.

Based on the above information and assuming that no one fire could take out both trains of MCCs (1-AM-A and AM-D), this analysis will assume that a spiH of one gallon of lube oil in the vicinity of the flammable storage would cause a fire and take out the nearest MCC, 1-AM-D.

COMPBRN runs showed that the remaining oil inside the cabinet would not ignite and burn if the doors are dosed (Appendix $ ). This would result in a loss of one train of CCW in standby due to loss of power to motor operated valves in the CCW system. The MOVs would "fail as is" and would not affect the train that is normally running.

Using the above information and the event tree analysis for loss of CCW, an analysis was performed failing the standby train of CCW to determine an estimated CDF. The variables needed to calculate the estimated core damage frequency are the fire initiation frequency (22E-03), initiating event frequency of loss of one train of CCW in standby (294FA4) and the output of the sensitivity analysis run failing the above components (4.82E42). Using the above values, the estimated CDF was calculated to be 2.48FA8, which is lower than the reporting criteria of 1.0E47. Therefore, this zone was screened out.

4.8.17 and 44- ni n IR m an n f

Since the control room has cabling for all the important equipment in the phnt, a re in the control room has special significance to a fire PRA. To establish a core damage frequency for a fire in this room, the comparative study found in "Fire PRA Requantification Studies" (Reference

34) was followed. Previous control room studies have found that control room fires are typically electrical fires in cabinets. For typical cabinets, these are smail, localized fires with no spreading potential. The concerns arise from the potential destruction of the controls for multiple trains of important equipment that share a cabinet, and the potential that the control room must be evacuated if the fire is not quickly suppressed.

Revision 1

Although in a separate fire zone, the Unit 1 hot shutdown pand enclosure has essential indication and controls for shutting down the plant from the Unit 2 control room. This cabling is not electrically isolated from the control room cabling, meaning a fault in the Unit 1 control room could disable the instrumentation and controls on the Unit 1 hot shutdown panel. Therefore, this evaluation considers both zones as one, and used the fire initiation frequency of the control room.

Seabrook is a Westinghouse four loop pressurized water reactor, similar to the Cook Nuclear Hant. In the Seabrook portion of the study, three critical fires were identified, resulting in (in Cook Nuclear Hant terminology) loss of CCW, loss of ESW, and a station blackout. By reviewing the Cook Nuclear Plant control room layout, these initiating events were considered to be appropriate for review.

For the probability of fire suppression and control room evacuation, the probability cited in the requantification study (Reference 34) was used (.0034). This'is the probability that the fire will not be manually suppressed before the smoke, from, an, electrically-initiated cabinet fire obscures the control board. This value was based on detailed human reliability studies and timing from cabinet fire tests. The configuration for the Cook Nuclear Hant control room is similar to that of the study, so the result is deemed applicable here.

The initiating event frequency for critical cabinet fires is typically determined by some ratio of the amount of critical cabinetry to the total amount of cabinetry in the control room. This has been by floor area around the cabinets, area of the cabinets, or number of cabinets. All give somewhat similar results. For this study, the length of cabinets is taken as an approximate measure of the cabinet area. This is reasonably accurate since the depths of the various cabinets are similar, and none of the measures take into account the amount or type of equipment within a cabinet, which is more likely an appropriate ratio method.

A detailed review of the back of the service water panel reveals that it is separated into five sections by interior partitions. These partitions are constructed of 10 gauge steel and 1Q" Marinite boards with no penetrations (Reference 35). Therefore, these partitioned areas can be treated as separate fire initiator areas. The CCW partitioned area is approximately half the length of the full service water paneL Based on a panel, length scaling (using drawing no. 12-59764 of Reference 4), the probability of a fire in the CCW portion of this panel is .015.

Hant specific human reliability studies were performed for the recovery actions needed to respond to the loss of CCW. Due to the initial confusion caused by the fire, the operators are assumed to not trip the reactor coolant pumps quickly. The reactor coolant pump seals are assumed to catastrophically fail, and recovery requires depressurization of the reactor and low pressure iqjection within about 100 minutes.

If the control room need not be evacuated, the recovery can be accomplished from the control room. This human action evaluation is found in Section 4.7.4, giving a failure value of .02$ .

Revision 1 35

Loss of CCW quantification, control room recovery Fire initiation frequency = 4.2E-3/year Fire in CCW panel = .015 Control room not evacuated = .997 Recovery action = .025

=

Total 4.2E-3~.015*.997*.025 = 1.6E4 Loss of CCW quantiTication, control room evacuation required J

Fire, initiation frequency = 4.2E-3/year Fire in critical cabinet = .015

. Control room evacuated = .0034.

Recovery action (assumed failed for convenience)

Total = 4.2E-3~.015~.0034 = 2.1E-7 The control room loss of CCW failure frequency is equal to 1.8FA6/yr (1.6E-6 + 2.1E47).

A single panel fire could remove both Unit 1 trains from service. The ESW has automatic alignment to the alternate unit's ESW pump (which would not fail due to the tire), and the crosstie valve to Unit 2 is normally open. The control for this crosstie valve is on the ESW pand, but the double break wiring leads only to a loss of valve control, which will not interrupt Unit 2 ESW flow. A complete loss of ESW is only possible with the random faBure of the Unit? ESW system to provide flow (6.6E-3) (Table 10).

The loss of ESW event is virtually identical to the loss of CCW event. IfESW is lost, the CCW system would continue to operate for' period'of time, slowing the heatup of critical equipment and leading to more time for recovery. Thus, the human action evaluation is conservatively applicable to this scenario. The ESW panel is half the length of the CCW pand, leading to half the probability of a fire in this portion of the service water panel (.008).

Loss of ESW quantification, control room recovery Fire initiation frequency = 4.2F 3/year Failure of Unit 2 ESW to start = 6.6E-3 Fire in critical cabinet = .008 Control room not evacuated ~ .997 Recovery action ~ .025 Total ~ 4.2E-3.M66~.008~.997~.025 = 5.5E-9 Loss of ESW quantification, control room evacuated Fire initiation frequency = 4.2E-3/year Failure of Unit 2 ESW to start = 6.6E-3 Fire in critical cabinet = .008 Control room evacuated = .0034 Recovery action (assumed failed for convenience)

Total = 4.2E-3~.0066*.008~.0034 = 7.5E-10 Revision 1 36

The control room loss of EAU failure frequency is suHiciently small that it can be ignored.

The electric power panel is partitioned into three sections by hfarinite and steel, separating the normal power controls from each diesel generator's controls. Therefore, a station blackout would result if a panel fire would fail the normal power supply and both diesel generators would fail to start (3.5EP, Reference 9). The probability, given a fire, that the fire would be in this critical portion of the panel is .025 based on scaling the total length of panels (using drawing no. 12-5976-6 of Reference 4). For the station blackout scenario, restoration requires RCP seal cooling and continuation of auxiliary feedwater after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, when the control batteries are assumed to be discharged. In addition to recovery of the affected unit's equipment, equipment and operators from the unaffected unit (which has normal power) are available to support equipment cross-ties.

Station Blackout Fire initiation frequency = 4.2E-3/year Failure of both diesel generators = 3.5EQ Fire in critical cabinet = .025 Recovery action (not considered)

Total = 4.2E-3~3.5EA~.025 = 3.7E4 The control room station blackout frequency is sufficiently small that it can be ignored.

For the control room fires evaluated, only the loss of CCN was determined to result in a significant core damage frequency of 1.8FA6/yr.

4.S.1S i n nd 7 - wi A 'li n R Due to the similarities, the three cable spreading zones are evaluated together. Other than a limited amount of lighting and similar cable, there is no signiYicant fire ignition source in these zones. In the fire initiation frequency calculation (Section 4.4.2.4), a fire initiation frequency'of 1.3E-5/yr was estimated for each of these zones.

The only significant source of combustibles in these zones (excluding the battery area, which is physically separated from the cable spreading area) is cable insulation (Reference 4). Qualified cabling will not propagate a fire (Reference 7), so any fire in these zones must be lociiiized, minimizing damage.

Ifa fire was to damage all (or a significant portion) of the cabling in a spreading area, phmt procedures call for evacuation of the control room and for shutdown of the reactor using local shutdown indication panels and Unit 2 equipment. Since Unit 2 equipment will not be impacted by a fire in these zones, the only significant failure potential is the rehtively complex, high stress human actions to follow the remote shutdown procedure. This human action is descrBied in detail and modeled in Section 4.7.4. The failure probability is calculated to be 0.11.

Since the only significant combustion source is cable insulation, which will not support propagation, fire suppression would be very effective in miriimizing damage. Automatic fire suppression for these zones is COi (Zones 55 and 56) or Halon (Zone 57), using ionization detectors which respond rapidly (Reference 7). Based on these factors, it is judged that the if fire protection system actuates, damage will be limited and successful shutdown from the control Revision 1 37

'oom is possible. It is judged that the limiting local fire would be in the area underneath the CCW panel, since the loss of CCW is generally the limiting event. The loss of CCW recovery value of 0.025 is valid for this scenario (see previous section). The location scaling of the control room panel evaluation (.015) above should also be a reasonable estimate, as well as the value for the control room recovery action. Thus, the core damage frequency is (fire suppression successful) for each zone, 1.3E-5/yr ~ .015 ~ .025 = 5.E-9/yr.

(

If the automatic fire suppression fails, the control room must be evacuated and the remote shutdown procedure used. The failure rate of a typical ha!on system (.05) (Reference 7) will be used, which bounds the failure rate of a CO, system (.04) (Reference 7). The human failure value for evacuation of the control room and establishing crossties to the other unit is .11 (Section:-

4.7.4). The core damage frequency for each cable spreading zone is thea * ~

1.3E-5/yr ~ (.05) ~ (.11 ) = 7.2E-8/yr.

Thus, none of the cable spreading zones are considered risk significant from a fire perspective.

4.8.19Fire Z n 7 - Tur inc R m- rth t rti n- nit Fire zone 79 contains some the SSSA control cables to the EDGs and ESW valves. These components were modelled in the Cook Nuclear Hant PRA. As identified during the walkdowns, the cable tray containing these cables is located in the hallway bebveen the two Unit 1 EDG rooms 15 feet from the floor and running horizontally bebveea the EDG rooms. The cable tray is fire wrapped with Thennolag material. No semi-permanent or permanent combustibles (other than the cable insulation itself) were identified during the walkdown of this fire zone. Therefore, the assumption that the only fire sources with risk sigaiTicance are those which are semi-peraumently stored in fixed locations, and whose preseace is evaluated and tracked by permits issued by the fire protection engineer can be applied to this fire zone. Based on this assumption, no fire sources are available in this fire zoae that could cause damage to cables in the hallway. As a result, fire zone 79 was screened out from further review.

4.8.20 i Z n 12- ' - ni Fire zone 112 contains two SSSA control cables and the ESW header cross-tie valves WMO-705 and WMO-707. The two control cables are for the ESW prm>aires switches WPS-701 and WPS-705. These pressure switches will automatically start a standby ESW pump should the header pressure drops below 40psig (Reference 36). Walkdowns by plant personnel and review of the Fire Hazard Analysis (References 25 and 4) determined that there are no semi-pernument or permanent transient combustibles located in this fire zone. As well, no sigaiTicant fire ignition sources are available in this zone to cause damage to the ESW SSSA cabiiag. Based oa this the assumption that the only fire sources with risk significance are those which are semi-

'eview, peanaaeatly stored in fixed locations, aad whose preseace is evaluated and tracked'by permits issued by the fire protection engineer can be applied to this fire zone. Based on this assumption, no fire sources are available in this fire zone that could cause damage to cables in the raceway.

As a result, fire zone 112 was screened out from further review.

Revision 1 38

4.8.21 m in Z n 41 42A 42B 42 42D fr T ine Fi In response to an NRC request for additional infoimation regarding a turbine building fire, this analysis was performed to determine the potential for a turbine building fire which could damage cabinets in fire zones 41 and 42A, simultaneously. Further, review of this fire area concluded that fire zones 42B, 42C, and "AD would also need to be included in this evaluation since the fire barriers between these zones would not provide adequate protection in the fire scenario described below. This concern is a result of the fact that the open roll-up door separating zone 42A from the turbine building is normally open. The NRC requested that an analysis be provided of the plant response given simultaneous damage to all cables and equipment in these fire zones.

Following a review of the potential fires that could occur in the Turbine Building, it was concluded, that the only potentially credible fire scenario" that could cause this type of damage would be a turbine missile creating a massive turbine lube oil spill. The oil would ignite and be driven by steam or explosions into the 4kV Switchgear rooms;- Identification of the SSSA cabling and components within these fire zones indicates a substantial potential impact on components modelled in the PRA. Such a large number of components would be affeded, given an assumption of widespread damage, that it was concluded that the use of Unit 2 equipment would be required to successfully shutdown the unit. This is incorporated in the analysis using remote shutdown procedures and their associated human failure rates.

Based on these assumptions, the likelihood of a turbine missile at the Cook Nuclear Hant was first determined. A review of the PRA external events notebook (Reference 37) provided the details of the failure probability of Unit 1 General Electric turbine (Unit 1 turbine had the greater failure probability compared to Unit 2). During the Unit 1 outage in November 1990, an inspection was performed on the shrunken wheels of the Low Pressure Turbine rotor for the Unit 1 turbine. Based on this inspection, it was determined that the annual probability of turbine failure resulting in the gection of turbine disc fragments through the turbine casing was 1.6E-06 (Reference 38). The human failure value for evacuation of the control room and establishing crossties to the other unit is .11 (Appendix D). The core damage frequency for this type of fire scenario is then 1.6FA6/yr ~ (.11) = 1.76E47/yr.

g $4 This core damage frequency is quite conservative since the probability that a turbine missile couM cause a large oil spill and a fire that would enter the combined fire zones was not evaluated.

Thus, the Turbine Building fire scenario damaging the 4kV Switcbgear area is not considered 'to be risk significant from a fire perspective. This core damage frequency is not included in the total for fire damage.

4.9 CONTAINMENT PERFORMANCE Hant responses arising from a fire are identical to those initiated by other internal performance is also identical to that modelled in the Level 2 analysis. Refer to the events.'ontainment Level 2 analysis for more detail (Reference 18). Based on the Level 2 analysis, this secbon provides a qualitative evaluation of the potential for containment damage after a fire induced core damage event.

Revision 1 39

To prevent containment failure after core damage, both hydrogen igniters and containment spray capability are potentially required (Reference 18). These requirements will be evaluated separately.

In evaluating the potential for hydrogen damage as a result of a station blackout (Reference 18),

it was determined that hydrogen induced containment failure was possible, but a hydrogen ignition only for specific containment conditions was required. In the evaluation, these conditions were reached in the'SBO-50 (which assumes six hours of auxiliary feedwater) at about 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> into the accident. If ignition had occurred signiTicantly before those conditions were reached, insufficient hydrogen would be present to damage the containment. This station blackout accident sequence is very similar in timing and containment impact to a loss of CCW accident sequence, although electric power for fans, hydrogen igniters, containment spray pumps and other electrical equipment. is available during a loss of CCW. The fire damage scenarios:are

'dominated by the loss of component cooling water accident sequence.

The control cables for hydrogen igniters are not traced in the SSCA (Reference 5), so they cannot be credited for most fire damage scenarios. In the control room fire cases, the critical panels that contribute to the core damage frequency do not have the hydrogen igniter controls. Thus, for the core damage frequency that results from control room fires (about half of the total), hydrogen igniters are available and hydrogen is not a containment damage concern. For the remainder of the fire zones that contribute to the core damage frequency, the igniters may not be avaBable.

However, other electric equipment could (unintentionally) ignite the hydrogen before the critical conditions are reached, or alternately the hydrogen may not ignite when the conditions are critical. Considering the low core damage frequency contribution that could be impacted by the lack of hydrogen igniters, the significant chance that hydrogen igniter controls would not be impacted in many of the fire scenarios, the large amount of time available to recover hydrogen igniters (8 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />), and the relatively low probability (Reference 18) that containment would fail if the ignitexs do not function, hydrogen is not considered to be a significant concern for fire risk scenarios.

capability is required to protect the containment from damage after any type of loss of

'pray coolant sequence, including those initiated by a loss of CCW induced reactor coohnt pump seal failure. In the Level II analysis (Reference 18), contauunent failure was predicted in 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> due to overpressuriziition for the similar station blackout sequence (SBO-50). Since the containment pressure rise is driven almost solely by decay heat, and containment sprays (or RHR sprays) are capable of removing decay heat a few hours after reactor trip, recovery of either spray system will prevent containment failure if started at any time before containment failure. Since over a day is available for these actions, it is estimated that a human action failure rate in the 0.1 range could be calculated for this high stress scenario. Therefore, fire induced containment failure frequency for fire scenarios is estimated to be a factor of 10 lower than the c'ore damage frequency, or about 4E-7 (see Section 7.0).

I 5.0 TREATMENT OF FIRE RISK SCOPING STUDY AND OX%99L ISSUES These issues were addressed in the original analysis (Reference 6). Following is a summary of the findings, and their treatment in the original analysis.

Revision 1 40

5.1 DEPENDENCIES BETWEEN CONTROL ROOM AND REMOTE SHUTDOWN PANEL CIRCUITRY The functions of the control room and associated remote shutdown panel both rely on the same cable spreading room, making interactions between the two possible. This issue was raised by the NRC and AEPSC responded to this in page 10 of AEP:NRC:0692BT. This is documented in Appendix E of the original analysis (Reference 6) and in Reference 39. The LSI (Local Shutdown Indication) panels can be used to achieve safe shutdown following a fire, in the event of a fire disabling both the control room and its associated remote shutdown panel.

5.2 USE OF PLANTCPECIFIC DATA (%MANUALFIRE FIGHTING EFFECTIVENESS)

The plantwpecific fire brigade training and response times are documented in Appendix E of the original analysis (Reference 6) and in Reference 40. A conservative time for fully turnedwut fire brigade response anywhere in the plant is 10 minutes.-

5.3 SUPPRESSION AGENT-INDUCED DAMAGE The fire brigade is trained to avoid "pushing" the fire or flame plume into areas containing safety-related equipment. Due to the use of an E-type nozzle, which has a 30 degree spray pattern, the fire brigade is instructed to keep away from any energized electrical equipment. In the case of an electrical (class C) fire, the fire brigade is trained to first d~ergize the panel to enable the class C fire to be treated as a class A or B fire. When experiencing a "fullblown" fire (i.e., a room completely filled with flames), instead of using the method of "surround and drown" or "flood and find out", the fire brigade is trained to use short'bursts to knock the fire down, thus allowing the fire brigade the ability to observe the fire and locate its base with a minimal amount of water damage. See Appendix E of the original analysis (Reference 6) and Reference 41 for more details.

5.4 FIRE BARRIIMINTEGRITY AEPSC has programs in place to maintain fire barrier integrity, as described in the procedures listed in Appendix E of the original analysis (Reference 6) and Reference 42.

5.5 VERIFICATION OF AS-BUILT CABLING Of the 2675 cables deemed necessary to achieve an Appendix R safe shutdown, 60 cables were randomly selected in the original analysis (Reference 6) to verify cable routing against what was described in the SSSA. Once selected, the AEPSC Nuclear Design Department reviewed the appropriate drawings and identified the actual cable routing. This was compared against the SSSA to determine the impact on AEPSC Appendix R compliance. Based on the 60 cable random sample, at a 95% confidence level, the as-built safe shutdown cable routing did not adversely affect Appendix R compliance. Based on these results, the SSSA cable routing, for all practical purposes, was judged to represent the as-built condition. This is described more fully in Appendix E of the original analysis (Reference 6) and in Reference 14.

5.6 TREATMENT OF TRANSIENT COMBUSTIBLES Procedure 12 SHP 2270 FIRE.012 describes the AEPSC treatment of transient combustibles.

They are monitored by two methods:

Revision 1 41

Tours which estimate transient combustibles in a fire zoae Scaffolding log A computer program updates the fire zone fire loading to ensure that FHA fire loading estimates arenot exceeded. If they are, then anhourlyroving firewatchisposted. AppeadixE of the original analysis (Reference 6) and Reference 43 describe the procedure.

57 TREATMENT OF br 'CERTAINTIES GL-88-20, Supplement 4 (Reference 1), requires an identificatioa of all sources of uncertainties.

They are listed below:

o Determination of fire-initiation frequencies o ~ . Fire propagation probabilities o Fire suppression probabilities, automatic and manual o Human error estimations o Random failure probabilities o Barrier failure probabilities These are described in Appendix E of the original analysis (Reference 6) and in Reference 44.

5.8 SEISMIC-FIRE INTERACTIONS It was determined following onwite discussions with EQE after the original seismic waikdowns (Reference 45) that the 17-ton CQ tank is vulnerable to a seismic event. A seismic event could move the tank, severing pipe connections and expel all CO If the seismic eveat also induced a fire, fire suppression in those zones with automatic CQ suppression could be limited to manual suppressioa. Further seismic analysis concluded that these tanks willsurvive a design basis earthquake. Problems will'not arise unless a much larger earthquake occurs (Reference 45).

Thus, it was concluded that these tanks do not pose a significaat seismicjfire interaction concern.

Manual suppression efforts may also be hampered by other seismic effects. Reference 25 (original walkdown notebook) describes this. Other seismidfire interactions of a lesser degree, which also do not pose a significant threat to safe shutdown of the plant, are discussed in Reference 45 which provided input to the seismic fragility analysis for the Cook Nuclear Hant Seismic FRA (Reference 46).

6.0 AREAS OF CONSERVATISM The following lists areas of conservatism are present in this analysis:

It was assumed that components would fail in the worst posable way. It may be possible to assign a statistical distribution to the failure rate of a componeat due to fire (fire fragilities).

Heroic actions and recovery actions beyond those considered in the original IPE were not credited in this analysis other than those actions specifically modeled for unique control room and cable spreading area fires ~os.

Revision 1

o Human actions specifically modeled for the fire PRA used primarily the simpliiflied ASEP methodology (Reference 49). The use of the more detailed THERP methodology (Reference 50) would remove conservatism from the human action failure rates.

o The core damage frequency is dominated by the control room fires. It was assumed that all controls in an entire cabinet would fail due to the fire. However, given the flame retardancy of the cables, the low electrical power in the cables, and the effectiveness of quick fire detection and suppression, actual damage would be expected to be far less severe.

o In general, fire detection and suppression is not credited in the analysis.

o In general, cables protection by fire barrier material was not credited.

4 7.0

SUMMARY

OF KEY FINDINGS The following lists those zones for which the core damage frequency was calculated to be greater than 1.0E47. The CDF values for these fire zones include low priority zones in the initial screening analysis, as well as the fire zone in the detailed evaluation whose CDF is greater than 1.0E47.

~Zn Q}ntril~uti n 15 3.04E47 16 3.50E47 29B 1.07K@7 29E 1.07E47 40A 1.32E47 40B 1.86E47 41 1.12E47 42D 1.68E47 44S 3.80E47 1.81E46 91 ~1.02E 7 Total 3.76E46 The dominant accident sequence that resulted in core damage for these cases was a loss of component cooling water.

8.0 REFERENCES

1. Generic Letter No. 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", June 1991 2; 10 CFR 50, Appendix R, Code of Federal Reguhtions, U.S. Government Printing Office, Washington, D.C.

Revision 1 43

3. NUREG-1407, "Procedural and Submittal Guidance for the Individual Hant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", June 1991 4, "Fire Hazards Analysis," Donald C. Cook Nuclear Hant Units No. 1 and 2, American Electric Power, Rev. 6, January 31, 1992.

4

5. "Safe Shutdown Systems Analysis," AEP D.C. Cook Power Hant Units 1 and 2, American Electric Power, Calculation 0121490-CALM5 Rev. 3, Odober 3, 1990, and subsequent references and drawings.

6. Fire Analysis Notebook, Donald C. Cook Nudear Hant PRA, American Electric

,Power Service Corporation, Revision 0.

t

7. Vulnerability Evaluation (FIVE), EPRI TR-IM370, Apnl 1992.

k4ire-Induced

8. NUREG/CR4586, "Users Guide for a Personal Computer-Based Nudear Power Hant Fire Data Base", Sandia National Laboratories, Albuquerque, New Mexico, August 1986.

9. D.C. Cook Nuclear Hant Units 1 and 2 Internal Initiating Events Notebook, Revision 0, July 1991.

10. NUREG-1335, "Individual Hant Examination: Submittal Guidance," U.S. Nudear Regulatory Commission, August 1989.

System Cutset Editor (SCE), Westinghouse Computer Code, Version 221A November 20, 1990.

SENS Code, Westinghouse Cutset Sensitivity Analysis Code, dated October 5, 1994.

WLINKCode, Westinghouse Cutset Linking Computer Code, Version 291A, November 20, 1990.

14. "Appendix R Cable Routing Verification Info@nation", Attachment 2 of letter from J.B. Kingseed to S. Maher, dated May 21, 1991.

15. AEP:NRC:9810N, Non~bmittal Packet Concerning Inspection Report 90418, June 4, 1991.

16. "Safe shutdown Capability Assessment, Proposed Modifications and Evaluations, Revision 1, December 1986.

17. NUREG/CR-2258, "Fire Risk Analysis for Nudear Power Hants", M. Kmeians, G.

Apostolakis, 1981.

18. Source Term Notebook, Donald C. Cook Nuclear Plant PRA, American Electric Power Service Corporation, Revision 0.

J

19. Donald C. Cook Nuclear Hant, Emergency Operating Procedures 1P OHP 4023 sees+

Revision 1 44

20. NUREG/CR-4566, "COMPBRN III - A Computer Code for Modelling Compartment Fires", V. Ho et. al., November 1985.

21. NUREG/CR-5088, "Fire Risk Scoping Study", Sandia National Laboratory, January 1989.

22. NUREG-1150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants", 1989.

23. Memo from B. Lee to T. E. King, Spurious Operation of Motor and Air Operated Valves, dated April 5, 1983.

24. "Fire Analysis Containment Walkdown Notebook," Donald C. Cook Nuclear Plant Units 1 and, Westinghouse Electric Company, Revision 0.

"Fire Analysis Outside Containment Walkdown Notebook," Donald C. Cook Nuclear Plant Units 1 and 2, Westinghouse Electric Company, June 1991, Rev. 0.

26. "D.C. Cook Nuclear Plant Units 1 and 2 Notebook for the Reactor Protection and Engineered Safeguards Actuation Systems", Rev. 1, February, 1992.

27. CN-PRRA-90-285-R1, "Fire Frequency Evaluation for Donald C. Cook Nuclear Power Plant", February 1991.

28. Emergency Remote Shutdown Procedures a) 01-OHP 4025.001.001, Rev. 0, "Emergency Remote Shutdown."

b) 01-OHP 4025.LS-1, Rev. 0, "Process Monitoring from LSI Panels", Section LS-l-l.

c) 01-OHP 4025.LS-2, Rev. 0, "Start-Up AFW", Section LS-2-1.

d) 01-OHP 4025.LS-2, Rev. 0, "Start-Up AFW", Section LS-2-2.

e) 01-OHP 4025.LSA, Rev. 0, "RCS Make-Up, Seal Iqjection, and Boration with CVCS Cross-tie", Section LQi-1.

f) 01-OHP 4025.LS6, Rev. 0, "RCS Make-Up, Seal Iqjection, and Boration with CVCS Cross-tie", Section I&6-2.

29. Fire Protection Program Manual, Revision 0, December 15, 1993.

4

30. Telecon between J. R. Anderson and M. A. Wilken, "Separation of Electrical Cabinets in the Event of a Fire," dated 9/12/94.

I

31. Drawing No. 1-12003-17, 250VDC Main One-Line Diagram Engineered Safety System, dated August 8, 1992.

32. "Documentation of COMPBRN Runs for Fire PRA," letter from J. M. McNanie to DC-N4280.4, dated February 28, 1992.

Revision 1 45

33. Telecon between Pat Russell and Mark Wilken, "Fire Zone 51: 55 gallon Drum of Oil," dated 10/7/94.

34. NSAC-181, "Fire PRA Requantification Studies, Science Applications International Corporation, March, 1993.

35. Cook Nuclear Plant drawings, Main Control Boards: Hoor plan and Details, 1-5544-0, 1-55454) and 1-5551-15.

36. ESW System Notebook, Donald C. Cook Nuclear Hant PRA, American Electric Power Service Corporation, Revision 0.

37. "Other External Events Notebook," Donald C. Cook Nuclear Hant Units 1 and 2, American Electric gower Service Corporation, April 1992, Rev. 0.

38. General Electric Power Generation Report to Indiana 4 Michigan Electric (AEP);

dated December 3, 1990.

39. "Separation between HSD Panels and Control Room", Attachment 1 of letter from J.B. Kingsecd to S. Maher, dated November 7, 1990.

40.. "Fire Brigade and Cook Plant Fire History", Attachment 2 of letter from J.B.

Kingseed to S. Maher, dated November 7, 1990.

41. "Fire Brigade (Component damage due to water)", Attachment 3 of letter from J.B.

Kingseed to S. Maher, dated November 7, 1990.

42. "Fire Barrier Integrity", Attachment 2 of letter from J.B. Kingseed to S. Maher, dated December.13;"1990;-' '-

"Treatment of Transient Combustibles in Zonal Fire Loading", Item 6 of "ICE Fire Special Issues and IPEEE Seismic Special Issues", AEP-90-338 (NS-RMOI-PRRA-90-340), Letter from J.C. Hoebel to J.B. Kingseed dated December 14, 1990.

44. NUREG/CRM40, "Procedures for the Exteriial Event Core Damage Frequency Analyses for NUREG-1150," Sandia National Laboratories,,November 1990.

45. "Walkdown of Auxiliary Building in Support of Cook Nuclear Hant IPEEE, Units 1 and 2", Volume 1, EQE Engineering, January 1992, Revision 0.

Seismic Probabilistic Risk Assessment, Donald C. Cook Nuclear Hant PRA, American Electric Power Service Corporation, Revision 0.

47. "Documentation of Cook Nuclear Hant PRA Fire Analysis SCE Runs," letter from J. R. Sharpe to DC-N4280.4, April 26, 1992.

NRC Letter "Request for Additional Information Regarding the IPEEE for Donald C. Cook Nuclear Power Hant, Unit Nos. 1 and 2," November 14, 1994.

Revision 1

49. NUREG/CR4772, "Accident Sequence Evaluation Program Human Reliability Analysis Procedure", Sandia National Laboratories, February, 1987.

50. NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications Final Report", Swain, A.D. and Guttman, H.E.,

August 1983.

51. Handouts and Instruction from Human Reliability Analysis training, Process Safety Institute, November, 1994. Lecturers: Alan D. Swain, PhD. and Donald K Lorenzo, P.E.

52. Specific Emergency Operating Procedures:

a) 01-OEP 4023.ES-1.2, Rev. 4, "Post LOCA Cooldown and Depressurization."

b) 01-OHP 4023.FR-C.1, Rev. 4, "Response to Inadequate Core Cooling."

c) 01-OHP 4023.FR-C.2, Rev. 3, "Response to Degraded Core Cooling."

d) 01-OHP 4023.E-1, Rev. 5, "Loss of Reactor or Secondary Coolant."

53. HRA related Personal Communication:

a) J. M. McNanie (AEPSC) and Paul Leonard (Cook Hant), January 6, 1995.

b) J. M. McNanie (AEPSC) and Mike Thornburg (Cook Hant), January 6, 1995.

c) J. M. McNanie (AEPSC) and Gordon Arent (AEPSC), January 9, 1995.

d) J. M. McNanie (AEPSC) and Jim Dickson (Cook Hant), January 10, 1995.

e) J. M. McNanie (AEPSC) and Russ Stephens (Cook Hant), January 11, 1995.

f) Electronic Mail, J. M. McNanie (AEPSC) and Leah Smart (Cook Plant),

January 30 and 31, 1995.

54. MAAP 3.0B Users Manual, Revision 1.0, February 9, 1991, Fauske and Associates, Incorporated o

55. Critical Safety Function Status Tree, 1HP 4023.F4.2, "Core Cooling."

56. Event Tree Notebook, Donald C. Cook Nuclear Hant PRA, American Electric Power Service Corporation, Revision 0.

57. Donald C. Cook Nuclear Hant Units 1 and 2 Individual Hant Examination Summary Report, April, 1992.

58. 4160 and 600 VAC Electric Power System Notebook, Donald C. Cook Nuclear Hant, American Electric Power Service Corporation, Revision 0, 1991.

Revision 1 47

59. NUREG/CRA550, "Analysis oE Core Damage Frequency: Surry Power Station, Unit 1 External Events", December 1990.

60. Letter from John Tillinghast (AEP) to Edson G. Case (Acting Director, NRC),

September 30, 1977, regarding responses to fire protection questions.

Revision 1

Table 1 Unit '1 Fire Zones Fire Area Zone Descriptfon Safe Shutdorar Safe Shutdorrn Zone Equf pment Cab L ing 1 A Auxiliary Building - both mits No Yes 1A A Contafrment Spray Purp East-Auxiliary Building - Unit 1 No No 18 A Contairvrrent Spray Purp 'Mest-Auxiliary Building - Unit 1 1C A Residual Heat Removal Purp East-Auxf liary Building - Unit 1 Yes 1D A Residual Heat Removal Purp West-Auxiliary Buftdfng - Unit I Yes 2 B Pump Bay - Turbine Building-both units No* No~

3 C Orurrrrfng / Drurr Storage - both mits No No 4 D Sanplfng Room - Auxiliary Building-boch mics No- Yes 5 E Auxilfary Building - both mits Yes Yes 6A E Auxilfary Buf.=ing Pipe TunneL .

both units Ko No 6M E Auxiliary Building (K. section of Mast end) . Unit 1 6H E Auxiliary Building (Hiddle section of West end) - both units No Yes 7 F Quadrant 1 Cable Tmnef - Unit 1 No Yes B G Quadrant 4 Cable Tmnel - Unit 1 No Yes 9 H Quadrant 3M Cable Tmnel - Unit 1 No Yes 10 H Quadrant 3H cable Tunnel - Unit 1 Mo Yes 11 .i Quadrant 3S Cable Tunnel - Unit 1 No Yes 12 J Quadrant 2 Piping Tmnel - Unit 1 Yes Yes 13 f( Diesel Oil Purp Room . Unit 1 Yes Yes 14 L Transformer Room - Unit 1 ko Yes 15 H 1CO Diesel Generator Room - Unit 1 Yes Yes 16 N 1AB Diesel Generator Roan - Unit 1 Tes Yes 17A 0 West Auxiliary Feed Purp Roaa'-

Unit 1 17C Q Corridor to Auxf lfary Feed Pump Roces - both mits 17D R East Auxiliary Feed Purp Roaa-Unit 1 17E S Turbine Auxiliary Feed Purp Rocm-Unit 1 'Yes Yes 28 B Diesel Fire Purp Roaa - Unit 1 Ko No 29A EE Essentfal Servfce Mater Purp PP.1E - Unft 1 Yes 29B EE Essential Service Mater Purp PP-1M - Unit 1 Tes 29E EE Hotor Control Center for ESM Purps - Unit 1 Yes 29G EE Screen House Hotor Control Room for ESM - both mits No 31 C Concrete Hixing Buildfng /

Orurrrrfng Area - both units No No 32 Cask Handling Area - both mits No Yes 33 FF Hain Steam Valve Enclosure, East-Unit 1 Yes Yes 33A FF Hain Steam Line Area - Unit 1 No No 338 FF Mon Essential Service Mater Valve Area, Vest - Unit 1 No 35 C fnstrurrent Cal fbration Room-both mits No 36 C Spent Fuel Pit Heat Exchanger Purp Rocm . boch mfts No Ko 37 HH Valve Gallery - both mits ko No Revision 1 49

Table 1 (continued)

Fire Area Zone Description Safe Shutdmrn Safe Shutdom Zone Equi pnent CabL ing 38 1 I Quadrant 2 Penetration Cable Tunnel - Unit 1 Yes Yes 40A KK 4kV AB Switchgear Room Yes Yes 40B KK 4kV CD Swftchgear Rocm Yes Yes 41 LL Eng Safety System B HCC Room (8 Underfloor) - Unit 1 Tes Yes 42A IOI E.P.S. Transformer Roan - Unit 1 Tes Tes 42B Hrf E.P.S. 'Control Rod Drive Roan-Unit 1 No 42C HN E.P.S. Motor Control Roan-42D 43 lOt HH unit 1 E.P.S. (AB) Battery Roan-Access Control Area - both mits Tes Yes No F'es Yes Yes 44H HH Auxflfary Building North-both mits 44S HH Auxiliary Buildfng South-both units 44A HH ContafrInent Spray Heat Exchanger Room ¹1BE, Auxiliary Building-Unit 1 No No 44$ HH Contafreent Spray Heat Exchanger Room ¹18M, Auxiliary Building-unft 1 No No 44C HH Residual Heat Removal Heat Exchanger Room ¹17E, Auxilfary Building - Unit 1 No 44D HH ResiduaL Heat Removal Heat Exchanger Room ¹17M, Auxiliary Buildfng - Unit 1 Yes No 48 HeM Fuel Storage Tank - both mits 49 51 C C C

HVAC Vestibule - Unft 1 Auxf lfary Buildfng,(East.End)...-....

No No No Yes both mfts No 52 C Auxfliary Building (Meat End)-

both mits Yes Tes 53 QQ Unft 1 Control Roan - Unit 1 Yes Tes 55 SS Srrftchgear Room Cable Vault-unft 1 Yes Yes 56 TT Auxfliary Cabte Vault . Unft 1 No Yes 57 Uu Control Room Cable Vault - Unit 1 No Yes 61 E Spray Addftive Tank Room-both m)ts No No 62A YY Reciprocating Chargfng Pump

-'nit 1

62B YY Centrifugal Charging Purp-Unft 1 62C YY Centrifugal Charging Purp-unlt 1 64A E Safety injection Purp North-unft 1 Non Non 64B E Safety injection Pwp North-unft 1 Non Non 66 AAA Contafrnnent Piping Arbutus Yes Yes 67 AAA Contafrrrent LoMer Votune Yes Yes 68 AAA Contafrnrent Upper Volune Tes Tes 69 C Auxiliary Building - both mits Tes Tes 70 8 BB Control Room HVAC Equipnent-Unit 1 No No 71 BBB Unit 1 Carputer Room - Unit 1 No No 77 B Melding Shop - Turbine Building-Unlt 1 Xo Revision 1

Table 1 (cont inued)

Fire Area Zone Oescription Safe Shutdown Safe Shutdown Zone Equipnent Cabling 78 8 Heating Boiler Rocm - Turbine Building - Unit" 1 No No 79 8 Turbine Room Unit 1 (N.E. Portion) .

Unit 1 Ho Tes 80 8 Turbfne Room Unit 1 (S.E. Portion)-

Unit 1 No Yes 81 8 Turbfne Room Unit 1 (S.Q. Portion)-

Unft 1 Ho No 82 8 Turbine Room Unit 1 (H.M. Portion)-

Unit 1 No No 83 8 Turbine Room Unit 1 lube Oil Room-Unit 1 No No 90 8 Turbine Room Unit 1 (H.E. Portion)-

Unit 1 No 91 8 Turbine Roan Unit 1 (S.E. Portion)-

Unit 1 Ho* Yes 92 8 Turbine Room Unit 1 (S.'ll. Portion)-

Unit 1 Ho* No*

93 8 Turbine Rocm Unit 1 (H.M. Portion)-

Unit 1 Ho 94 8 Turbine Rocm Unit 1 Office Space-Unit 1 No No 95 8 Turbfne Rooa Unit 1 Turbine Oil Tank Room . Unit 1 No No 101 AAA Contafraent Accumulator Enclosure liest Yes Yes 103 AAA Reactor Head Enclosure Yes Zes 105 FF Contractor Access Control Bufldfng .

both mits No No 106 C Auxfliary Feed 'Mater Battery Room ¹1 Auxflfary Building - Unit 1 Zes Yes 108 8 liest Steam Valve Enclosure - Unit 1 No No 110 8 Nafn Steam'Accessway - Unit 1 No Yes 112 8 Essential Service Hater Pipe Tmnel Unit 1 Yes Yes 114 8 Essential Service lister Pfpe Tunnel Unft 1 Yes 116 OOO Rll, CS, Pw Tank Area Pipe Tmnel-Unit 1 Ko No 118 AAA Contafanent Regen Heat Exchanger Room Ho Tes 120 AAA Contafrmcnt Accumulator Enclosure East Yes Yes 122 AAA Contafreent fnstrunentation Room Yes Yes 124 8 UPS Invertor Room Security-both mits No Ko 125 8 CAS Security - both mits No No 126 8 Tech Support Center - both mits No No 127 8 TSC, UPS fnvertor and Battery Rooms . both units No No 128 8 UPS Battery Room Security - both mits No No 129 8 Turbine Oeck - Unit 1 Ko Yes 131 8 Service ond Office Bldgs - both mits No No 132 AAA Unit 1 fce Condenser No No 134 AAA Unit 1 Reactor Vessel No No 136 A Unit 1 Pipe Tunnel - Unit 1 No Ho 13BA A CVCS Hold-up Tank Area N. - both mits No Ko 1388 A CVCS Hold-up Tonk Area Nid. both wits No Ko 138C A CVCS Hold-up Tank Area S. - both wits No No 139 8 Turbfne Room Swp - both mits No No 140 8 Turbine Caustic and Acid Storage Tonk Area - both mits No 141 8 Turbine Pmp Pft . both mits No 142 8 Screenhouse - both mits No Revision 1 51

Table 1 (continued)

Fire Area Zone DescriPtion Safe Shutdown Safe Shutdown Zone Equi pnent Cabling 143 B Mater intake and Discharge Systefa both units Xo Xo 144 UU Unit 1 Hot Shutdown Panel Enclosure Unit 1 No 146 C Auxiliary Building Unloading Platform both units No Xo 147 FFF Contaiment Access Building - both units No The caaponents located in these fire zones were not considered to be safe shutdown cceponents in the SSSA but were used in the Level 1 PRA. These coeponents are affiliated with nonessential service water, safety injection, control air,'and feedwater systens.

Revision 1

Table 2 Suanary Table of D.C. Cook Fire Frequency Evaluation PLANT LOCATION F IRE FREOUENCT r ear CONTAINNENT 3.33E.02 ELECTRICAL SMITCHGEAR 5.37E.02 BASENENT ELECTRICAL SWITCHGEAR 2.67E-02 UPPER LEVEL AUXILIARY BUILDING 4.14E-02 CABLE SPREADING AREA 2.50E.03 TURB INE BUILDIXG 4.16E-02 Revision i

Table 3 Hoor Area of Fire Zones in the Auxiliary Building (Unit 1)

Zone Electrical Zone Electrical 1 4500 E 44B 220 1A 324 44C 270 1B 324 44D 270 1C 284 44N 7580 E 1D 284 44$ 9360 E 3 2657 48 1650 4 1025 49 3200 E 5 8635 E 51 5386 E 6A 10890 , 52 11085 E 6M 6095 E 53 4410 Note 1 6N 4212 E 61 1000 7 960 62A 405 8 2050 62B 416 9 539 62C 416 10 800 64A 288 11 840 64B 288 12 7812 E 69 17914 E 31 986 70 1715 32 4240 71 430 33 1040 105 2380 33A 3316 E 106 180 35 323 108 897 36 1624 E 110 1776 37 2730 .

112'14 1229 38 2650 E 539 43 4630 E 116 1724 44A 220 136 300 144 89 E Total Area = 149,407 ft'rea designated as signiTicant electrical equipment = 98,088 fl'ote 1 - Specific initiating event frequency for this xone, n/a for electricaL Revision 1

Table 4 Spreadsheet for Calculation of Turbine Building Fire Zones Fire Initiation Frequencies Column 1 2 3 4 5 6 7 8 9 10 Zone Area pp/oil Area elect Area Gas Area adds IEF 2 9342 1 9342 0 0 1.9E-03 17A 252 1 252 0 0 5.2E45 17C 328 0 1 328 0 3.6E45 17D 219 1 219 0 0 4.5E45 17E Z19 1 219 0 0 4.5E45 28 400 1 400 0 0 S.ZE45 29A 332 1 332 0.. ,. 0- 6.8E45 29B 402 1 40Z 0 0 8.3E45 29E 92 0 1 92 0 1.0E45 29G 1554 0 1 1554 0 1.7E-04 77 1740 0 0 0 1.67 2.5E43 78 2160 1 2160 0 0 4.5E44 79 11140 1 11140 1 11140 1 11140 6.0E43 80 14418 1 14418 1 14418 0 4.2E43 81 12812 1 12812 1 12812 0 3.7E43 82 11212 1 11212 1 11212 1 11212 6.0E43 83 S97 1 897 0 0 1.SEE 90 1099S 0 0 1 10998 3.0E43 91 15400 0 0 0 1 1.9E43 92 13S25 1 13825 0 0 Z.SE43 93 12705 0 0 1 12705 3.5E43 94 890 0 0 0 2.5E45 95 590 1 590 0 0 1.2E44 127 1035 0 1 1035 0 1.2E-04 129 10000 0 0 0 2.8E44 139 139 0 0 0 3.9E46 140 880 0 0 1 880 2.4E44 141 1161 1 1161 0 0 2.4E44 142 18608 1 18608 0 0 3.8E43 143 0 0 0 0 0.0E-00 Totals 153750 97989 52591 46935 0.042 Column 2 lists the zone area (see text for Zones 129 and 143)

Columns 3, 5, 7 has a one if significant equipment of this type is in the Zone Columns 4, 6, 8 copies the area of the zone if it is identified in the prior column Totals for the area columns 2, 4, 6, 8 are on the bottom line Column 9 has specific fires from the database allocated- to the zone Column 10 shows the result of the fire initiation frequency by zone, and the total at the bottom.

The calculation sums the fires allocated to each ignition source, ratio by the zone to total area, and divided the total by the experience years (689). See text for further details.

Revision 1 55

Table 5 Fire Frequencies for Fire Zones in Basement of Switchgear Building (based on .0537 fires/year for switchgear building basement)

ZONE IDENTIFICATION FIRE INITIATIONFREQUENCY (u y~)

13 DIESEL OIL PUNG'OOM 1.0E-3 14 TRANSFORMER ROOM 9.1E-3 15 1CD DIESEL GENERATOR ROOM 2.2E-2 16 1AB DIESEL GENERATOR ROOM '.=

2.2E-2.

1 H

TOTAL 5AE-2 Note: The total exceeds the location frequency since minimum values were used.

Revision 1

Table 6 Fire Frequencies for Fire Zones in the Upper Level of the Switchgear Building (based on .0267 fires/year for upper level of switcbgear building)

ZONE IDENTIHCATION FIRE INITIATIONFREQUENCY (per year) 40A 4KV AB SWITCHGEAR ROOM 2.9E-3 40B 4KV CD SWITCHGEAR ROOM 2.9E-3 41 ENG SAFETY SYSTEMS 8c MCC ROOM 9.1E 3 42A E.P.S. TRANSFORMER ROOM 7.1E-3 42B E.P.S. CONTROL AND DRIVE ROOM . 1.0E-3.

42C E.P.S. MOTOR ROOM 1.0E-3 42D E.P.S. (AB) BATTERY ROOM 32E-3 2.7E 3 Note- Total inched slightly for new values due to use of a minimum value.

Revision 1

Table 7 Fire Frequencies for Fire Zones in the Auxiliary Building (based on .0414 fires/year for the auxiliary building)

ZONE IDENTIFICATION FIRE INTTIATIONFREQUENCY (per year) 1 AUX BLDG 3~3 1A CONTAINMENT SPRAY PUMP EAST 1B CONTAINMENT SPRAY PUMP WEST 1C RESIDUAL HEAT REMOVAL HSIP EAST 1D RESIDUAL HEAT REMOVAL PUMP WEST 3 DRUMMING/DRUMSTORAGE 4 SAMPLING ROOM, AUX BLDG 5 AUX BLDG (EAST END) 3.9F 3 6A AUX BLDG PIPE TUNNIK /

6M AUX BLDG (5GD SEC. OF WEST END) 2.0F 3 6N AUX BLDG (N. SEC. OF WEST END) 1.0E-3 7 QUADRANT 1 CABLE TUNNEL 8 QUADRANT 4 CABLE TUNNEL 9 QUADRANT 3N CABLE TUNNEL 10 QUADRANT 3M CABLE TUNNEL 11 QUADRANT 3S CABLE TUNNEL 12 QUADRANT 2 PIPING TUNNEL 1.5E-3 31 CONCtu. TE MDQNG /DRUMMING AREA 32 CASK HANDLINGAREA 33 MAIN STEAM.VALVEENCLOSURE, E.

33A MAINSTEAM LINE AREA, EAST 1.0E-3 33B NON-ESS. SERV. WTR VALVEAREA,W 35 INSTRUMENT CALIBRATIONROOM 36 SPENT FUEL PIT HT EXCH. PUMP ROOM 1.0E-3 37 VALVE GALLERY 38 QUADRANT 2 PENE. CABLE TUNNEL 1.0E-3 43 ACCESS CONTROL 1.0E-3 44A CONTAINMENT SPRAY HX ROOM ¹18E 44B CONTAINMENTSPRAY HX ROOM ¹18W 44C RHR HX ROOM ¹17E, AUX BLDG 44D RHR HX ROOM ¹17W, AUX BLDG 44N AUX BLDG NORTH 1AE3 44S AUX BLDG SOUTH 2AE-3 48 NEW FUEL STORAGE AREA 49 HVAC VESTIBULE 1.0E-3 51 AUX BLDG (EAST END) 1.1F 3 52 AUX BLDG (WIST END) 22E-3 53 UNIT 1 CONTROL ROOM 42E-3 61 SPRAY ADDITIVETANKROOM 62A RECIPROCATING CHARGING PUMP 62B CENTRIFUGAL CHARGING PUMP 62C CENTRIFUGAL CHARGING PUMP Revision 1

Table 7 (continued)

Fire Frequencies for Fire Zones in the Auxiliary Building (based on .0414 fires/year for the auxiliary building)

ZONE IDENTIFICATION HRE INITIATIONFREQUENCY (m y~)

64A SAFETY INJECTION ~i'ORTH 64B SAFETY INJECTION PUMP SOUTH 69 AUX BLDG 5.1E-3 70 CONTROL ROOM HVAC EQUIPMENT 71 UNlT 1 COMPUTER ROOM 105 FORMER CONTR ACCESS CONTROL 106 AUX FEED WATER BATTERY ROOM P1 2.8E-3 108 WESI'TEAM VALVEENCLOSURE 110 MAINSIZAM ACCESSWAY 112 ESS. SERVICE WATER PIPE TUNNEL 114 ESS. SERVICE WATER PIPE TUNNEL 116 RW, CS, PW TANK AREA PIPE TNL 136 UNlT 1 PIPE TUNiEL 144 UNlT 1 HOT SHUTDOWN PANEL ENCL 1.0E-3 TOTAL OO

~ New values not listed are assumed to be a minimum value of 1.0E-3.

~~ 3.8E-2 using calculated values only, 7.5E-2 including non-calculated minimums.

Revision 1 59

Table 8 Fire Frequencies for Fire Zones in Cable Spreading Rooms ZONE IDENTIFICATION FIRE INDI'IATIONFREQUENCY (per year) 55 SWITCHGEAR ROOM CABLE VAULT 6.0E-3 56 AUXILIARYCABLE VAULT 1.0E-3 57 CONTROL ROOM CABLE VAULT 1.0E-3

~ ~ l ~

TOTAL 8.0E-3'ote

- Total frequency increased due to the inclusion of battery room fires in Zone 55 and minimum fire frequencies.

Revision 1

Table 9 Fire Frequencies for Fire Zones in the Turbine Building (based on .0416 fires/year for the turbine building)

ZONE IDENTIFICATION FIRE INITIATIONFREQUENCY (m y~)

2 PUMP BAY, TURBINE BLDG 1.9E-3 17A WESI'UX FEED PUMP ROOM 17C CORRIDOR TO AUX FEED PUMP 17D EAST AUX FEED PUMP ROOM 17E TURBINE AUX FEED PUMP ROOM 28 DIESEL FIRE PUMP ROOM 29A ESW PUMP PP-1E 29B ESW PUMP PP-1W 29E MOTOR CONTROL CNTR, ESW PUMPS 29G MOTOR CONTROL ROOM, ESW 77 WELDING SHOP, TURBINE BLDG 0.5E-3 78 HEATING BOILER ROOM, TURBINE 79 TURBINE ROOM (N.E. PORTION) 6.0E-3 80 TURBINE ROOM (S.E. PORTION) 4.2E-3 81 TURBINE ROOM (S.W. PORTION) 3t7E 3 S2 TURBINE ROOM (N.W. PORTION) 6.0E-3 83 TURBINE ROOM LUBE OIL ROOM 90 TURBINE ROOM (N.E. PORTION). 3.0E-3 91 TURBINE ROOM (S.E. PORTION) 1.9F 3 92 TURBINE ROOM (S.W. PORTION) 2.8E-3 93 TURBINE ROOM (¹W. PORTION) 3.5E-3 94 TURBINE ROOM OFFICE SPACE 95 TURBINE ROOM TURBINE OIL TANK 127 TSC, UPS INVERTOR AND'BATTERY'"

129 UNlT 1 TURBINE DECK 139 TURBINE ROOM SUMP 140 TURBINE CAUSTIC/ACID STORAGE TANK 141 TURBINE PUMP PlT 142 S CREE NHOUSE 3.SF 3 143 WATER INTAKE/DISCHARGE SYSIXM TOTAL

~ New values not listed are assumed to be a minimum value of 1.0E-3.

~~ 3.8E-2 using calculated values only, 5.7E-2 including non~cuIated minimums.

Revision 1 61

Table 10 Initiating Event Frequencies System Components/Trains Lost Due to Fire Initiating Event Frequency CCW A) 1 operating train A) 1.0E42 B) 1 standby train')

B) 29E44 1 operating train A) 4$ E45 B) 1 standby train B) 12E45

'C) Both operating trains C) 6.6E-03 D) Both standby trains D) 3.4E44 E) Both Ul trains E) 6.6E43 Both U2 trains F) 3.4FA4 G) Both trains/header aligned to U1 loads G) 68E43 H) Both trains/header aligned to U2 loads H) . 2AE45 250VDC 1 train 1.0 SBO A) 1 diesel generator A) 22E46 B) 2 of 4 ESW supply valves to diesel B) 52 MS generators

'hese values are calculated in Appendix G.

Revision 1

Table 11 Summary of Zone Specific Frequencies for Initiating Events Zone Zone Description Trains of CCW, ESW, D/G's or IE's to Consider and their 250VDC in zone frequencies (frequencies are product of zone fire frequency and zone IEF)

Aux bldg - N section of W end- - I train of CCW (IW) CCW: 1.0E-05 UI - both trains of-ESW (UI) TRA: 9.9Li44

- I D/G (IAB) '.

13 Diesel oil pump rm - Ul - I D/G (ICD) SBO: 2.8E49 TRA: 1.0E43 15 I CD diesel generator room - Ul - I train CCW (IE) CCW: 2.2E42

- total loss of ESW (Ul)

(lose UI pumps 8c crosstie WMO-707)

- I D/6 (ICD) '

16 IAB diesel generator room - Ul I train CCW (IW) CCW: 22&44

- 2 trains/1 header ESW (IW header) TRA: 22E42

- I D/G (IAB) 29A ESW pump PP-IE - Ul - I train of ESW (IE) ESW: 4.5E48 TRA: 1.0E43 29B ESW pump PP-IW - Ul- - both trains of ESW (Ul) ESW: 6.6E46 TRA: I.OE43 29E MCC for ESW pumps - VI - both trains of ESW (Ul) . ESW: 6.6E'A6 TRA: 1.0E43 Revision I

Table 11 Summary of Zone Specific Frequencies for Initiating Events Zone Zone Description Trains of CCW, ESW, D/G's or IE's to Consider and their 250VDC in zone frequencies (frequencies are product of zone fire frequency and zone IES) 296 Screen house motor control rm - all 4 trains of ESW CCW: 1.0E43 for ESW - both units - both D/G's (Ul) SBO w/ CCW: 1.1E47 40A 4kV AB switchgear room -1 train CCW (1W) 250VDC: 2.9EW3

- 1 train ESW (1W) CCW w/.250VDC: 2.9E45

-1 D/G (IAB) '

1 train 250VDC (CD) 40B 4kV CD switchgear room -1 train CCW (1E) CCW: 2.9FA5

-1 train ESW (1E) TRA: 2.9E03

-1 D/G (1CD) 42A EPS transformer rm - U1 "- 1 train CCW (1W) CCW: 7.1PA5

- 2 trains/1 header ESW (1W header) TRA: 7.0E43

- 1 D/G (1AB) 42C EPS motor control rm - Ul -1 train CCW (1W) 250VDC: 9.9E44

- 1 train ESW (1W) CCW w/250VDC: 1.0AM

- 1 D/G (1AB)

<<1 train 250VDC (AB) 42D KPS AB battery rm - 1 D/G (1AB) 250VDC: 3.2~3

- 1 train 250VDC (AB)

Revision 1

Table 11 frequencies Summary of Zone Specific for Initiating Events Zone Zone Description Trains of CCW, ESW, D/G's or IE's to Consider and their 250VDC in zone frequencies (frequencies are product of zone fire frequency and zone IES) 43 Access control area - both units - I train of CCW (IW) CCW: I.OH-05 TRA: 1.0K<A3 Aux bldg N - both units - total loss of CCW (Ul) CCW: 1.4E43

- 1 train of ESW (IE)

Aux bldg S - both units - total loss of CCW (Ul) CCW: 2.4E43 Aux bldg - E end - both units - total loss of CCW (Ul) CCW: I.IE43 (lose W train & ESW cooling to E train) 52 Aux bldg - W end - both units - total loss of CCW (Ul) CCW: '2.2E43 (lose W train L ESW cooling to E train) 79 Turbine rm - Ul - NE portion - both trains of CCW (total loss of CCW) CCW: 6.0E43

- all 4 trains of ESW (lose Ul pumps plus SBO w/ CCW: 6.6E47 crossties)

- both D/G's (Ul) 112 ESW pipe tunnel - Ul - all 4 trains of ESW (lose Ul pumps plus CCW: 1.0~3 amsties) 114 ESW pipe tunnel - Ui - 2 of 4 ESW supply valves to D/G's SBO: 52EII TRA: I.OE43 Revision 1 65

Table 12 Summary of Estimated Core Damage Frequencies for the 65 Zones Zone Prior Zone Description Init. Fire Method Estimated

-ity7 Event Freq, Used to CDF Calculate CDF no Aux bldg both units 3.5E43 SCE 5.64E-09 1C no RHR pump E - aux bldg 1.0E43 SCE 1.61E-09 1D no RHR pump W - aux bldg 1.0E43 . SCE 1.61E49 2 no Pump bay - turb bldg -"

b'oth units 1.9E43 SENS 9.00E49 no Sampling room - aux bldg - both units 1.0E-03 SCE 1.61E-09 no Aux bldg - both units 3.9E-03 SCE 1.85E48 6N Hi Aux,bldg - N section of W end - Ul 1.0E43 SCE 1.50E43 IE ) 1.58E47 6M Hi Aux bldg - middle section of W end- 2.0E43 SENS 2.82E46 both units no Quadrant 1 cable tunnel - U1 1.0E43 < 1.0E47 no Quadrant 4 cable tunnel -.,Ul 1.0E43 < 1.0E47 no Quadrant 3N cable tunnel - Ul 1.0E43 < 1.0E47 10 no Quadrant 3M cable tunnel - Ul 1.0E43 < 1.0E47 11 no Quadrant 3S cable tunnel - U1 1.0E43 < 1.0E47 12 no Quadrant 2 piping tunnel - Ul 1.5E43 SENS 1.83E-10 13 no Diesel oil pump rm - Ul TRA 1.0E43 < 1.0E47 SBO 2.22E-10 14 no Transformer rm - Ul 9.1E43 SCE 1 47E48 15 Hi 1 CD diesel generator room - U1 2.2E42 3.49E-04 16 Hi 1AB diesel generator room - U1 2.2E42,- SCE 4.73E47 IE 3.49E46 17A no W AFW pump rm - U1 1.0E43 SCE 4.73E49 17C Hi Corridor to AFW pump rms - both 1.0E43 SENS 1.41E46 units Revision 1

Table 12 Summary of Estimated Core Damage Frequencies for the 65 Zones Zone Prior Zone Description Init. Fire Method Estimated

-tty? Event Freq. Used to CDF Calculate CDF" 17D no E AFW pump rm - Ul TRA 1.0E-03 SENS 8.82E-11 17E no Turbine AFW pump rm - Ul TRA 1.0E43 SCE 8.59E-09 29A no ESW pump PP-1E - Ul TRA l.'OE-03 SCE 1.60E-09 ESW IE 7.29E-10 29B Low ESW pump PP-lW - Ul TRA 1.0E-03 SCE 1.60E49 ESW IE 1.07E-07 29E Low MCC for ESW pumps - Ul TRA 1.0E-03 SENS 7.76E-11 ESW IE 1.07E-07 29G Hi Screen house motor control rm for CCW 1.0EN3 IE 1.58E-05 ESW - both units 32 no Cask handling area - both units TRA 1.0E-03 SCE 1.61E-09 33 no E main steam valve enclosure - Ul TRA 1.0E-03 SENS 6.53E-10 33B no W NESW valve'area - Ul" TRA 1.0E-03 < 1.0E-07 38 no Quadrant 2 penetration cable tunnel- TRA 1.0E-03 SCE 9.61E49 Ul 40A Hi 4kV AB switchgear room CCW 2.9E-03 > 4.59E-07 40B Hi 4kV CD switchgear room TRA 2.9E43 SCE 2.32E-08 CCW IE > 4.59E47 41 Hi Eng safety system & MCC room (& n/a 9.1E43 9.10E-03 under floor) - Ul 42A Hi EPS transformer rm - Ul TRA 7.1E-03 SENS 4.63E-09 CCW IE 1.12E-06 42B no EPS control rod drive rm - Ul TRA 1.0E-03 SCE 4.73E49 42C Hi EPS motor control rm - Ul CCW 1.0E43 IE > 1.58E-07 42D EPS AB battery rm 250V 3.2E43 IE 1.68E-07 43 Hi Access control area - both units TRA 1.0E43 SENS 8.91E-11 CCW IE > 1.58E-07 Revhlon 1 67

Table 12 Summary of Estimated Core Damage Frequencies for the 65 Zones Zone Prior Zone Description Init. Fire Method Estimated

-ity? Event Freq. Used to CDF Calculate CDF" 44N Hi Aux bldg N - both units CCW 1.4E-03 IE > 2.22E-05 44S Hi Aux bldg S - both units CCW 2.4E-03 IE 3.80E-05 44C no'HR Hx rm ¹17E - aux bldg - Ul TRA 1.0E-03 SCE 1.61E-09 44D no RHR Hx rm ¹17W - aux bldg - Ul,, TRA. 1.0E-03 SCE 1.61E-09 49 no HVAC vestibule - Ul TRA 1.0E=03 SCE 1.75E-09 51 Hi Aux bldg - E end - both units CCW 1.1E-03 IE > 1.58E-05 52 Hi Aux bldg - W end - both units CCW 2.2E-03 IE > 3.49E-05 53 Hi Ul control rm .

4.2E-03 4.20E-03 55 Hi Switchgear rm cable vault - Ul 6.0E-03 6.00E-03 56 Hi Auxiliary cable vault - Ul 1.0E3 1.00E-03 57 Hi Control rm cable vault - Ul 1.0E-03 1.00E-03 62A no Reciprocating charging pump - Ul TRA 1.0E-03 EJ < 1.0E-07 62B no CCP- Ul TRA 1.0E-03 SCE 1.65E49 62C no CCP - Ul TRA 1.0E-03 < 1.0E-07 64A no SI pump N - Ul TRA f.OE-03 SCE 1.75E49 64B'o SI pump N - Ul TRA 1.0E-03 SCE 1.75E-09 69 no Aux bldg - both units TRA 5.1E-03 < 1.0E-07 79 Hi Turbine rm - Ul - NE portion 6.0E-03 IE > 9.48E-05 80 no Turbine rm SE portion - Ul TRA 4.2E3 SCE 1.99E48 91 Low TurbinermSEportion-Ul TRA 1.9E-03 SENS 1.02E-07 92 no Turbine rm SW portion - Ul TRA 2.8E-03 SCE 4.62E49 106 no AFW battery rm ¹1 - aux bldg - Ul TRA 2.8E-03 SENS 2.25E-10 110 no Main steam accessway - Ul TRA 1.0E-03 EJ < 1.0E-07 Revtslon 1 68

Table 12 Summary of Estimated Core Damage Frequencies for the 65 Zones Zone Prior ;Zone Description Init. Fire Method Estimated

-ity? Event Freq. Used to CDF Calculate CDF 112 Hi ESW pipe tunnel - Ul 1.0E43 IE 1.'58E45 11'4 no ESW pipe tunnel - Ul TRA 1.0E43 SCE 1.60E-09 SBO 4.20E-12 129 no Turbine deck - Ul TRA 1.0E43 SENS 8.16E-11 Hi Ul hot shutdown panel enclosure '.0E43 1.0E43 Per Table 1,'he components located in these fire zones were not considered to be safe shutdown components in the SSSA, but were modelled in the Level 1 PRA.

Methods used to calculate CDF:

IE - initiating event hand calculation (see Appendix E)

SCE - System Cutset Editor computer run (see Reference 47)

SENS - SENS computer code run (see Appendix B)

EJ - engineering judgement (see Section 4.6.2.2)

I

~TI~

23 high priority zones (estimated CDF"2 1E-06) 4 low priority zones (estimated CDF between 1E46 and 1E47) 38 zones screened out (estimated CDF ( 1E47)

Revision I 69

Table 13 Fire Zone 51 (Reference 7)

WORIKHEET 3: RADIANTEXPOSURE SCENARIOS ENGLISH UNITS VERSION 1 CRITICAL RADIANTFLUX TO TARGET 1.00 (LOOK UP VALUE FROM TABLE IE)

. PEAK FIRE INTENSITY Btu/s (USE TABLE 2E FOR GUIDANCE)

RADIANTFRACTION OF HEAT RELEASE 0.4 (REPRESENTATIVE VALUE = 0.4) 4 RADIANTHEAT RELEASE RATE 2970 Btu/s (PROX 2]X+OX 3])

5 CRITICAL RADIANTFLUX DISTANCE (LOOK UP VALUE FROM TABLE 10E)

IF THE EXPOSURE FIRE IS LOCATED WITHINTHIS DISTANCE (INDICATED IN BOX 5) OF THE TARGET, CRITICAL CONDITIONS CAN OCCUR. OUTSIDE THIS RANGE, CRITICAL CONDITIONS ARE NOT INDICATED FOR THE SCENARIO UNDER CONSIDERATION.

Assume transformer oil with unit heat release rate = 135 Btu/+48 and spill specific area = SS ft'/gal (PennmB 30-HD)

Peak Fire intensity ~ 13S Btu/s-ft* X 55 ft'/gal ~ 7425 Btu/s Estimated by folhwlng the graph hi Table 10E of Reference 7.

Revision 1 70

Fire in Zone 6N LOSP SBO Loss of CCW Zone 6N: Aux Bldg - N section of W end - U'i 0.99 Lose: AB DIG, W train CCW 9.9E-04 TRA 0.98 0.01 I.OE-05 CCW 1.0 0.99 1.1E-07 CCW 0+2 I.OE-03 0.01 E-09 0.99 E-08 I.IE-04 Q.QI E-10 Figure I - Event Tree for Zone 6N Revision 1 71

Fire in Zone 16 LOSP SBO Loss of CCW Zone 15: 1 CD Diesel Generator Room 0 Lose: AIIU1 ESW, CD D/G, E train CCW 0.98 1.0 2.2E-02 CCW 1.0 0

02 2.2E-02 1.0 2AE-06 CCW 0

1.1E-04 1.0 E-08 Figure 2 - Event Tree for Zone '16 vlslon 1

Fire in Zone 16 LOSP SBO Loss of CCW Zone '16: 1 AB Diesel Generator Room 0.99 Lose: AB DIG, W train CCW, 2.2E-02 TRA U1 W ESW header 0.98 0.01 2.2E-04 CCW 1.0 0.99 2.3E-06 CCW 0+2 2.2E-02 0.01 E-08 0.99 E-08 1.1E-04 0.01 E-10 Figure 3 - Event Tree for Zone 16 Revision I 73

Fire in Zone 29 LOSP SBO Loss of CCW Zone 29: Scrn House Motor Cntrl Rm for ESW 0 Lose: All 4 trains ESW, Both U1 D/G's .

0 1.0 1.0E-03 CCW 1.0 1.0E-03 0

1.1E-04 1.0 1.1E-07 SBO 8c CCW Figure 4 - Event Tree for Zone 29 vision I

Fire in Zone 40A LOSP SBO Loss of CCW Zone 40A: 4 kV AB Switchgear Room 0.99 Lose: AB D/G, W train CCW, W train ESW, 250VDC train A 2.9E-03 250VDC 0.98 0.01 2.9E-05 CCW 5 250VDC 1.0 0.99 3.1E-07 250VDC 0@2 2.9E-03 0.01 E-09 0.99 E-09 1.1E-04

,0.01 E-11 Figure 5 - Event Tree for Zone 40A Revision I 75

Fire in Zone 40B LOSP SBO Loss of CCW.

Zone 40B: 4 kV CD Switchoear Room 0.99 Lose: CD D/6, E train CCW, 2.9E-03 TRA E train ESW 0.98 0.01 2.9E-05 CCW 1.0 0.99 3.1E-07 CCW Ot02 2.9E-03 0.01 E-09 0.99 E-09 1.1E-04 0.01 E-11 Figure 6 - Event Tree for Zone 40B vision I

Fire in Zone 42A LOSP SBO Loss of CCW Zone 42A: EPS Transformer Room - U1 0.99 Lose: AB DlG, W train CCW, 7.0E-03 TRA U1 W ESW header.

0.98 0.01 7.1E-OS CCW 1.0 0.99 E-08 0.02 7.1E-03 0.01 E-.09 Q.99 E-09 1.1E-Q4 0.01 E-11 Figure 7 - Event Tree for Zone 42A Revision 1 77

Fire in Zone 42C LOSP SBO Loss of CCN Zone 42C: EPS Motor Control Room - U1 0.99 Lose: AB D/G, W train CCW, W train 9.9E-04 250VDC ESW, 250VDC train B 0.98 0.01 1.0E-06 CCW 8r.

250VDC 1.0 0.99 E-08 0.02 1.0E-03 0.01 E-10 0.99 E-10 1.1E-04 0.01 E-12 Figure 8 - Event Tree for Zone 42C ion 1

Fire in Zone 42D LOSP SBO Loss of 250VDC Zone 42D: EPS AB Battery Room 0 Lose: AB D/G, 250VDC train B 0.98 1.0 3.2E-03 250VDC 1.0 0

0.02 3.2E-03 1.0 3.5E-07 250VDC 0

1.1M)4 1.0 E-09 Figure 9 - Event Tree for Zone 42D Revision 1 79

Fire In Zone 79 LOSP SBO Loss of CCW Zone 79: Turbine Room - U1 - NE Portion 0

Lose: Both 0/G's. all CCW, all ESW 0

1.0 6.0E-03 CCW 1.0 0

1.0 6.0E-03 1.0 0

1.1E-04 1.0 6.6E-07 SBO 8a CCW FigUre 10 - Event Tres for Zone 79

~ ~

ision 1

APPENDIX A NRC CONCERNS ON HRE PROBABILISTIC RISK ASSESSMENT FROM JULY, 1994 AUDIT Revision 1

On July 27-29, 1994, a team from the NRC reviewed the Revision 0 of the IPEEE at the Cook Nuclear Plant site. At the exit, several concerns on the fire PRA were expressed in the exit. This appendix summarizes and explains those concerns. Exit notes can be found in AEP:NRC:1082K.

1) Fire initiation fr'equency should address ignition sources. Revision 0 appropriately calculated the fire initiation frequency for large areas based on the fire database. However, revision 0 distributed this initiation frequency to the various fire zones by combustible loading. The more appropriate method would be to distribute this by the type of equipment, i.e. the equipment that caused the fires described in the database. The FIVE (Reference 7) methodology uses this approach.

2) Premature Screening (use of normal transient for all screens). Revision 0 incorrectly assumed that all equipment initiated accident sequences were responded to in the transient event tree. This is incorrect. For example, a LOCA can be initiated from a loss of component cooling water because of reactor coolant pump seal failure, which is not addressed in the transient event tree. Therefore, fire induced failure of one train of component cooling water combined with the random failure of the second train would show significantly higher failure frequencies than the transient event tree would indicate.

3) Potential premature screening of control room and cable vault. Revision 0 assumes that evacuation of the control room and use of the auxiliary feedwater crosstie to unit 2 alone is sufficient to avoid core damage. The requirement for continued reactor coolant pump seal cooling and the high failure rate of outside of control room human actions was not considered.

4) Possible concern with our taking credit for auxiliary feedwater crosstie. See 3).

5) Fire Propagation between zones not adequately addressed. Revision 0 only looked at the adequacy of fire barriers. Consideration was not given to fire sources which could be in two zones at once.

6) Fire suppression was credited with eliminating all damage. However, limited damage will occur before fire protection system actuates. The extent of fire damage before the fire can be suppressed should be calculated.

7) It was observed in the walkdowns that a couple of sprinkler heads were upside down, calling into question the fire protection system. This was addressed outside of the scope of the PRA, and was found to be a limited problem.

In October, 1994, a draft revision to the fire PRA addressing these major concerns was presented to the NRC at their offices in Washington. The following is a list of additional concerns identified at that meeting. The gcncral consensus was that the major concerns at the audit were being appropriately addressed. These concerns are summarized in the attached letter from the NRC dated November 14, 1994 (Reference 48).

Revision 1 A-1

'+~

~~ ~COOg"o.

C

~

Cl O

+OV 2 g~NUCLEAR REGULATORY UNlTED STATES COMMISSION l4 NASHINGTOM, O.C. 20555400!

gO November..14; '1994, . -':

cc: P. A. Barrett S. J. Brewer Mr. E. E. Fitzpatrick, Vice President E. E. Fitzpatrick Indiana Michigan Power Company J. A. Kobyra c/o American Electric Power ~$ fygy;>"',Maf't:n ~.:"-

Service Corporation B. R. Signet 1 Riverside Plaza M. G. Smith, Jr.

Columbus,'OH 43215

SUBJECT:

RE(VEST FOR ADDITIONAL INFORMATION REGARDING THE IPEEE FOR

'ONALD~C';-"COOK NUCLEAR POWER PLANT, UNIT NOS. 1'ND 2 (TAC NOS. M83609 AND M83610)

Dear Mr. Fitzpatrick:

A meeting was held at our offices on October 25, 1994, between members of your staff, NRC and contractor reviewers to discuss the D. C. Cook IPEEE. Based on that meeting, you have made significant improvements in the IPEEE since our initial audit of the IPEEE at the Cook site in July. A few questions came up at the October meeting for which your staff did not have immediate answers.

Therefore, enclosed is a list of additional requests for information based .on the discussion at that meeting. Plea'se advise me if you anticipate it will take more than 90 days to respond to these questions. Please call me at Ce. (301) 504-3017, ff you have any coepents or questions.

Sincerely, John B. Hickman, Project Manager Project Directorate III-1 Division of Reactor Prdjects III/IV Office of Nuclear Reactor Regulation Docket Nos. 50-315 and 50-316

Enclosure:

RAI cc w/encl: See next page

~ ~

C Mr. E. E. Fitzpatrick. Oonald C; Cook Nuclear Plant Indiana Michigan Power Company CC:

Regional Administrator, Region III Mr. S. Brewer U.S. Nuclear Regulatory Commission American Electric Power Service 801 Marrenville Road Corporation Lisle, Illinois 60532-,4351 1 Riverside Plaza Columbus, Ohio 43215 Attorney General Department of Attorney General 525 Mest Ottawa Street Lansing, Michigan 48913 "L~ ~

Township Supervisor Lake Township Hall Post Office Box 818 .

Bridgman, Michigan 49106 Al Blind, Plant Manager Donald C. Cook Nuclear Plant .

Post Office Box 458 Bridgman, Michigan 49106 U.S. Nuclear Regulatory Commission Resident Inspector Office 7700 Red Arrow Highway Stevensville, Michigan 49127 Gerald Charnoff, Esquire Shaw, Pittman', Pott's and Trowbridge 2300 N Street, N. M.

Washington, DC 20037 Mayor, City of Bridgman .

Post Office Box 366 Bridgman; Michigan 49106 Special Assistant to the Governor Room 1 - State Capitol

~ '/

Lansing, Michigan 48909 Nuclear Facilities and Environmental Monitoring Section Office Division of Radiological Health Department of Public Health 3423 N. Logan Street P. 0. Box 30195 Lansing, Michigan 48909.

Additional e uests for nfo ation Re ardin the ndividual ant amina on of ternall Initiated Events IP Based on eetin with icensee on October 5 1994 Fire:

Assuming a zero frequency of fire for a compartment (as was done fot the three cable vaults) is not acceptable practice. The conditional core damage frequency from loss of all cables in any of the three cable vaults is equal to 1.0, without any recovery actions.:.Please>provide an analysis of the recovery actions assuming complete loss of all cables in each of the three cable vaults (individually).

2. There is a potential for turbine building fire to damage cabinets in fire zones 41 and 42A, simultaneously. This is due to the normally open roll-up door separating zone 42A from the turbine building. Please provide an analysis of the plant response given simultaneous damage to all cables and equipment in these two rooms.

3. Human error analysis from Seabrook was used for the control room fire analysis in the IPEEE fire addendum. Since it is important for understanding the ability of the plant operating staff to deal with fire events in areas where a large number of safety-related systems may be affected, please provide the basis for using the Seabrook human error analysis fot 0. C. Cook-scenarios.

The main feedwater cables have not been traced at 0. C. Cook. The assumption that for some zones/areas, the Power Conversion System (PCS) may survive is not well founded. Please provide clarification as to the contribution of the main feedwater to the screened out fire zones/areas and the significant core damage scenarios.

Seismic:

Please describe the rationale for selection of the )2 components for seismic fragility re-evaluation. Justify how this rationale insures that all components likely to control plant seismic capability and severe accident risk (both for core damage and for radioactive release) have been considered in the re-evaluation.

2. Please provide the data, 'calculations, and results for the seismic fragility re-evaluations that components.

were performed for the ll selected

3. Please provide a description of the development of soil-structure interaction (SSI) margin factors used in the fragility re-evaluations.

Justify the basis for not generating new in-structure spectra for development of the SSI margin factors. Explain how these SSI margin factors have been applied.

~ 4

/

E. Fitzpatrick * ~

4. Please provide an explanation as to why the 600 VAC transformers, RPS freactor protection system] panels, turbine building pedestal and 250 VOC system have dropped out of the dominant contributor list, whereas cable trays have been introduced to this list.

5. Please provide a discussion of how the IPEEE seismic addendum addresses/impacts the containment performance assessment. Other than:..

the list of dominant contributors identified for core damage frequency, what are the dominant contributors to containment failure (i.e., early release or large late release) and failure of accident mitigation systems2 Oo the new .fragilities alter the containment performance insights presented in .the .original IPEEE submitta12

6. provide a discussion of'the-peer review process 'lease and its results as applied to the seismic .addendum/re-evaluation.

7. For all recommended actions/Axes identified in the seismic IPEEE walkdowns (including all items documented by the licensee's walkdown contractor), please provide a table delineating the recommended action/item, its analysis and/or treatment in the seismic IPEEE process, and its disposition status.

APPENDIX 8 SENSITIVITY ANALYSIS TRA RUN Section 8.1 of this appendix contains the cable listings, sensitivity analysis run outputs and estimated core damage frequency calculation for the initial screening assessment on the TRA only fire zones. Section 8.2 contains TRA fire zones that were evaluated using engineering judgement. Section 8.3 contains the sensitivity analysis run inputs and outputs for some of the fire zones which required detailed evaluations. Section 8.4 contains the quantification outputs for CCW and TRA events which were used In the fire screening evaluations and also the Risk Achievement rankings for these events.

Revision 1

APPENDIX B SENSITIVITY ANALYSIS RUN

SUMMARY

(Note: This appendix contains computer output.

It was not included to reduce the volume of the submittal.)

APPENDIX C WALKDOWNFINDINGS Section C.l of this appendix contains the notes from the walkdowns performed on September 8 and September 22, 1994. Section C.2 contains the notes from the walkdown of Zone 6M, performed on November 10, 1994.

Revision 1

Appendix C.1 Notes from Hre Walkdowns Performed on 9/8/94 & 9/22/94 Zones 6N, 40A, 40B, 41, 42A, 42C, 43, 44N, 44S, 51, 52, 55 and 79 were walked down on September 8 and September 22, 1994. The notes from these walkdowns are included below:

~Enate Critical cable trays in zone: 1AZ-C21, 23, 25, 27, 64, 70, 7?

1-ABV-A and 1-ABV-D are far from each other (>> 60-70').

The lowest elevation, and most conservative location, of critical cables is above the busses (at >>

7'). The critical cable trays travelled (at most) <<.3'ast the busses at this elevation, then they ran vertical against the wall until they reached an elevation of >> 15-20', where the trays ran horizontal away from the wall.

The critical cable trays seemed to be all dosed.

Transient combustibles in this zone include an RP desk with bookshelves next to it and a garbage" can. P'here is also an RP monitor cabinet and a frisking station in this zone that are fairly dose 'o MCCs.)

1AZ-C64 runs vertical at wall for about 6'ith open (grated) cable tray 1AZ-P11 right next to it, and 1AZ-C62 on the left side (about 1.5'way).

1AZ-C27 and 1AZ-C30 run next.to,each other vertical against the wall for about 6', and then go up and up+

There is metal conduit below many of the cable trays, however, this is not considered to be an intervening combustible.

The layout of C70 (red) is similar to that of C27 (green):

The sketched walkdown notes for this zone are included as Figures C.1-1 and C.1-2.

~Zn ~4A Critical cable trays in zone: 1EI-C23, 24, 25, 26, 27, 28, 29, 30 1EI-C30 comes into zone about 2'bove fire door (>>10'p), and <<3'rom edge of wall Bus T11A has dimensions: 26'0" (i) x 4'10" (w) x 6'8" (h). (It has 12 compartments, that are 2'2" wide, which gives a total bus length of 26'.)

The critical cable trays are mostly dosed (i.e., small sections, about 17" long, are grated) The lowest elevation, and the worst location of the trays, is above the busses (at >> 6'").

The sketched walkdown notes for this zone are included as Figure C.1-3.

Revision 1 C-1

ggne 40B Critical cable trays in zone: lEI&1, 2, 3, 4, 5 The critical cable trays are mostly dosed (i.e., smail sections, about 17" long, are grated). The lowest elevation, and the worst location of the trays is above the busses (at ~ 6'0").

Bus T11D has dimensions: 26'0" (i) x 4'10" (w) x 6'8" (h). (It has 12 compartments, that are 2'2" wide, which gives a total bus length of 26'.)

1EI-C1 and 1EI-C54 run right next to each other for the last several feet before the ceiTing (~5').

Several open (i.e., grated) non~tical cable trays run through upper portion of zone.

The only fire protection headers are located <<7'bove bus T11D. There are other red supply lines.

1EI-C4 is only about 2'rom the edge of the wall where it enters the ceiling. 1EI-C5 comes into room from about 9'p and ~ 2'rom edge of wall.

The sketched walkdown notes for this zone are included as Figure C.14.

Z n 41and42 Critical cable trays in zone: 1EM-C6, 1EI-C5, 6, 7, 13, 15, 30, 33, 34, 35, 36, 37, 40 and 1CT-P22 and P31 (in cable spreading area underneath 613'levation).

N Busses 11A, 11B, 11C and 11D are all 4'10" deep and 7'6" tall. Busses 11A and 11B are 7'ong (two 2'ompartments and two 1.5'ompartments). Bus 11C is 8'ong (four 1.5'ompartments and one 2'ompartment). Bus 11D is 6'6" long (three 1.5'ompartments and one 2'ompartment.)

Busses 11A, 11B, 11C and 11D are 2'ack from the end of the fire walL Critical cables in conduit that were found: 14356G, 14789G, 14862G.

1-8356G is in conduit, with its lowest and most vulnerable position being above 1-EZC-D (at 7'0").

t Many of the AB battery charger control cables are in cable trays 1CT-P22 and 1CT-P31, which are located in the cable spreading area underneath the floor.

The sketched walkdown notes for this zone are included as Figures C.1-5 and C.14.

Revision 1 C-2

~Zne 42C Critical cable trays in zone: 1EI-C93.

1EI-C93 exits 1-MCAB (at >> 8'), runs horizontal to opposite wall (about 2'bove fire door), and then vertical up wall, next to 1EI-D1.

The sketched walkdown notes for this zone is Figure C.1-7.

Zone 43 The critical cables that are supposed to be in this zone could not be found (14501R and 14502R).

They might run above tiled ceiling.

The sketched walkdown notes for this zone are induded as Figure C.14.

Z ne44 The critical cable trays in this zone were not identified due to their large number and due to the large size of the zone.

There is a large dress out area in the zone, with a large volume of PC clothing. There is safety related conduit (green and red)>> 3'bove this area (elevation>> 7').

2 There is a garbage can with a lid in this zone. Cable tray 1AZ-C20 runs vertical along wall, only 2" from garbage can, and it looks like it is wrapped in Thennolag. Green safety related conduit runs about 3'6" above the top of the can (elevation>> 7').

Cable trays 1AI-P2 and 1AI-C5 run>> 5'bove the RP desk (>> 10'levation). Cable trays 1AI-,

P1 and 1AI-C1, which run above VCC 1-AZV-A, are about 5'rom the edge of the RP desk at an elevation of >> 8', and are right over the edge of the desk at an elevation of >> 10'>> 5'rom.

top of desk).

The sketched walkdown notes for this zone are included as Figures C.1-9.

Zone 4 No transient combustibles were identified in this zone, therefore, the information from Revision 0 of the Fire PRA is sufficient. g'his zone was analyzed in detail in Revision 0 of the Fire PRA.)

The sketched walkdown notes for this zone are included as Figure C.1-10.

'Revision 1 C-3

ggne~5 Critical cable trays in zone: 1AU-C4, C13 The only transient combustibles located was a 55 gallon barrel of used oil. The barrel was locked and chained to the floor, and the opening to the barrel was locked. The lower half of the barrel was surrounded by some type of fire proof oB retainer.

Cable trays 1AU-C4 and C13 run along wail from floor to ceiling (elevation>> 15'), and then run horizontally along ceiling. They are mostly closed, except for sedions where they are cross-tied to another cable tray.

There is>> 40'etween the critical cable trays and the MCCs.

The sketched walkdown notes for this zone are included as Figure C.1-11.

f011~2 Critical cable trays in zone: 1AU-C3, 4, 7, S, 10, 11.

Critical cable trays are metal, about 7.5'p, with good separation between them. There was no noticeable combustibles around critical cable trays.

There is a flammable storage cabinet about 21'rom the MCCs. The cabinet is designated as a 10ft'abinet with oils and solvents, and is tied down with a thick metal strap. There is nothing directly above the cabinet, but cable trays 1AU-C4 comes within>> 12'f the cabinet (>>

distance from cabinet, at an elevation of 13 ). Other critical cable trays come within 9'orizontal l2'horizontal) of the cabinet, at an elevation of 7.5'.

1-AM-A and 1-AM-D are about 21'part. The N-train battery charger is within 12'f 1-AM-D.

The sketched walkdown notes for this zone are included as Figure C.1-12.

ggne~5 This zone was walked down to examine the walls that separate the charger and battery rooms from the rest of Zone SS. Thick concrete walls and an asbestos wall are used to separate the batteries and chargers from the critical cable trays and conduit in the zone.

The sketched waikdown notes for this zone are included as Hgure C.1-13.

Revision 1

~Zn~l Critical cable trays in "zone: 1AZ C34 (and conduit).

There were a lot of non~ety related cable trays (i.e., not green or red) in the main portion of zone. They started with "1TZ".

Cable tray 1AZ-C34 runs horizontally across the ceiling (elevation ~ 15') in the diesel There is nothing below it and it is fire wrapped.

generator.,'orridor.

The red critical cables are also in this corridor, wrapped in conduit. Conduit (safety rela M and,.

non~ety related) ran horizontal and vertical in the corridor. ¹ne of the safety related vertical.

conduit was identified to be critical, so it is assumed that the red critical conduit ran alorig the ceiling of the corridor.

The sketched walkdown notes for this zone are included as Figure C.1-14.

Revision 1 C-5

~

gI "C4 Cd

'aga A

Z3

~ ~ 1

I-lpga.~e L. I-W:

Mre.b

&C:

C-7

Q/c,Q ~g TilR +L I

Vo< A po.nA

, g,~V

'R5 call~ CS 3 P l~ >@ Qcscl 0

~ i -~~

F~

~ acj hP

l 5'5

'les Bus ~ D B~s Tl'iC.

litho.

Mbg W4g

<bl

~

Q g<<~ hu.z T~~>

f

HCC 1-EZC<

HCC 1-EZC-D Q= n&e&4q ATT t:PH-1 &- i~48, (

AB1

'HC-2 PHC 3 ATT EZC"C EZC-D

~aO V BUS 613'LEVATKN llPHC HCC 480 V PHA-.1 BUS 1lPHA EZC-Bl PHA-2 EZC-Al PHA 3 HCC 1-EZC-CH c9 600 V 600 V~

USSES BUSSES C'7 HCC 1"EZC"B llD lib 11C llh 3 2 1 HTBR RECOH. CRlD XFHR I GX-C 37 HESH POVER ROLHP SUPPLY DOOR TR11D TRllB TR11C TRHA CQMPBRN BRA WING FIRE ZQNES 41 0 Lj 0 9

MOLE 3'

3'Cd Qgc+ '~cg

~ ~Q.

MOLE 30' 30 AT CElLlk6 CQMPBRN DRAWING FIRE ZONE 41 CAB E SPREADING AREA

. UNDERNEATH 613'LEVATI N

~ -C./TED"t-XtW l-c~ l-Z. r4

(- Q.QP3-. <-cc.N

-cd g~p 'gr4)

I 0

0 I

0 I

) d'or)e. 92.C

l Fichu.r~ Q )

Zone. Qg CQ.D Mes>,T

.so.T.~PR~7~.

Ov&

r CH ~~L

~uPGtv 5

~av.

(.'i Svtt~1 l. tM 43 fK57iklk4'T.

5~8' KW AwbtaW'x Cmv'aa.

gayeao 7 14 ~4

~CCt C-15

o i+)

$ 1 lg

~ ~ ~ ~

~

~

~

~

~

~

4 B.Q+6134 ITl

~

~

~

~

~

g g)<cia-t ill

~

lA& 0 IIIII ~

~

~

~

~

~

~

~

~

lb;AC, Ioo ~ ~ ~ eachoWr INN9"i IIIII ~

~

~

~

~

~

~ i'a-p ~ Ill I I I IIIII ~

~

~ ~

5'igh IIIII III

~ ~

~ ~ ~

~ ~ ~

IIIII ~

~

~

~

~

~

~  : LOTS OF III

~. ~

~

~  : CONDUIT IIIII ~ ~ ~ ~

ABOUT QO'I

~ ~ ~

IIIII

~

~

~

~

~

~

~

. ~

8'IGH

~ AND UP

))j c.t4

~ ~

IIIII ~ ~ ~

i~ W+>abc.>LB

~

~

4

~

~

~'

~ ~

~

~

~

~

~

~

~

~

~

~

~ IIIII

~

~

~

~

~

~

~

~

~

~ie.

Y~g ia<is

~

~

~

~

~

~

~

~

~

~

~

4

~

~

~

~

~

~

~

~

~

~

~

4

~

~

~

~

~

~ LLIJJ

~

~

~

~

~

~

~

~

~

~

~

~

~A<'I K

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~

II ~

~,

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~ ~ ~ ~ ~

r~

~

~

~

~

~

~

~

~

~

~

~

~ ~ ~ ~ ~ ~

~ r HCC ,Qv"Gee Sa~

VCC

'-BHT-A v e la.~~~

1-A/V-A 8x3'xg ~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~ ~

~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

'~ ~ ~

~ ~ ~ ~ ~

5'xg'gg'wc8,

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ' ~ ~ ~ ~ ~ ~ ~

SS ~ ~ ~ ~ ~ ~ ~ ~ ~ 0 ~ ~ ~ ~ ~ ~ ~ ~

Qu+ ~

~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

ia>e5 ~

~

~

~

~

~

~

~

~

1 J

~

~

~ ~

~

~

~

~

~

~

~

r

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

tTITI1 p,iC. q ~ ~

~

~

~

~ ~ ~ ~

~ ~

~

~

~

~ ~ ~

~

~ ~ ~ ~ ~ 4 ~

~

~ ~ t~ ~ ~ ~ ~

IIIII LOTS OF LOV COND UIT ~;g'QQH

~

HCC 1-BHT-D '

CC 1-AZ-BC 8'x(

'Xa'O'KLUM~

1.

2.'

~ ~ = CABLE TRAY

= CONDUIT CClMPBRN DRAWING

~ ~ ~

FIRE ZONE 44N

Ko'7 IW F ~ (.<ed~

Fire.4a.l\ ')

to.g'igh >qSC9 <gree 0" %'ick +.

E PP-10M 1

i~119 (g~~ )

.]0'-PP-10W 7.$

'oal E C Ik (Q<~~)

7.o-PP-10K

~, ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

vi 4 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~

~ ~ ~ ~ ~ s ~ ~ ~ ~ ~ ~ ~ ~ ~ * ~ ~ ~ ~ ~ ~

~ ~ ~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~,

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~ ~ ~

~

~ t ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 4

~ ~ 4 4 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ 0 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 0 ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 0 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

t'avit

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

)'-0,"

2-PP-10E SPARE lo-)5'g.bog< )~~9~

'l5'e.Air g

(~ F7~

) ~

bKl3ZZ'.

2.

t: ' ~ = CABLE TRAY

= CCINDUIT COMPHRN DRAWING FIRE ZONE 44S Kyiww

~)

0 eP

~l

3. p'~pe yg~cc'Lo& K+f']we@

~

/L~Wi i >i~CRl~fn p 0

>P" 4 l1 0 0W~

I

~I@

(i~

~ "V us4k oi l t~

de,so~<

7'a Q

~ Ci3 c.ig C9 'PS.

pl Picture, C. I-t C-fk Hone ~

XXXXX I.TG.

IO MCC I,O CLb &

I5 t'i~a cHh5K I,.CI33'0'CC FL.O PASS NE'ER KLE FRKI HTKLKV.

. 498.

IS NA N

Q9 g

gOg N.

'N WAS'

1-0@PI 00@ . STAIR QHO

~

=s GIB.0 Wl R5

+r PANEL P-RE&~

oC3 Qhin Aa~u&

Can~ cQ Ho.g 55 HATCH GN TO t.l MS'0 '. t

-Q-Fl ECTRIt P SVJ ITCHGEAP CABLE EHl LQSURF E,l PV. 625'-IO" .

I ILM mKss OOOO .

t'lS

Fiat.P< C.. [

Zone. "1'l-Xie,se.( Cqwzam~&r Co~ v-td o<'ec+t a~

e lc CSawu coOfq

~

30~

Appendix C.2 Notes from Fire Walkdown Performed on 11/10/94 This walkdown was performed for Zone 6M only, on November 10, 1994. The notes from this walkdown are included below:

Zone 6M Cabling for all three trains of auxiliary feedwater for both units pass through this zone according to the SCC. The primary interest in this walkdown is the location of those cables, and potential fire sources and combustibles in the zone.

The zone is comprised of the boric acid tank room, the section of. hallway east of that room including the elevator shafts, and the seal water filter rooms. The cabling of interest was located at the west wall of the boric acid tank room. The cables entered in conduit at about 10 feet elevation, lower to about 8 feet, and turn immediately to exit the room. One conduit, 80180G-2, was onlyat 6 elevation. For the auxiliary feedwater cabling for the two units, the wall penetrations are about 20 feet apart, with a concrete cable tunnel separating them. The pipe tunnel extends about 6 feet into the room. This is the closest the two sets of cables get, since the cables turn toward their respective units.

There is miscellaneous electrical equipment about four feet in front of the cable penetrations. All the equipment is in typical electrical cabinets, and a small (3 high) enclosed transformer is on the Unit 1 side.

No combustion sources were noted in this room, and by discussion with R. Leonard, the CVCS system engineer, no combustibles are ever stored in the tank room. Four small boric acid transfer pumps are in the room, separated from the cables by the tanks.

Small transient sources (anti-Cs in 3'all wire mesh bins) were found in the halhvay area near the elevator shafts.

The sketched walkdown notes for this zone are included as Figure C.2-1.

C-20

t

, q, ~ ~/alar ~ si~ilci pir

~A&Q g Reactoc O.. C FfJM Aslg Unit 8

x. 8(

~iddlc ~ ~g) r~~

rr u 4- riage

~

Acta E.

Voce!ee o

3 ~

J g(,.l.v p.tr

~ ~

o ~OOO iP

~(ala'f (C gvS~J A.~F <~

c (As c~~S <3' o~

"~P c.ai

APPENDIX D HUMANMHZG)ILITYCALCULATIONS This appendix contains the human reliability calculations of the operators failing to cooldown and depressurize following a loss of component cooling water, due to a control room fire (Appendix D.1), and the operators failing to crosstie Unit 2 auxiliary feedwater and chemical and volume control systems following a loss of all Unit 1 power and control, due to a cable vault fire (Appendix D.2).

Appendix D.1 Loss of Component Cooling Vfater due to Control Room Fire Failure to Cooldown and Depressurize This analysis calculates the human error probabBity that the operators will not successfully cooldown and depressurize the reactor coohnt system, following a loss of component cooling water and, subsequently, loss of the reactor coolant pump seals.

a und and ti This analysis addresses the critical human actions access:iry to prevent core damage, following a total loss of the component cooling water system for Unit 1. This loss is caused by a fire in the control room service water panel. It is assumed that the operators will fail to identify the loss of CCW early enough tn trip the reactor coolant pumps. As a result of this assumption, a LOCA equivalent to 480 gpm throu of the reactor coolant pump seals is postulated. Eventual recovery of CCW is not evaluated for t.. j'ach Fire PRA, as the scope only extends to the initiation of RHR.

This analysis is based on the ASEP Nominal HRA for Post-Accident Tasks (Chapter 8 of Reference 49),

and Reference 50 was used to model recovery actions and dependence. Insights and class handouts from the Process Safety Institute's Human Reliability Analysis class were also used for this analysis (Reference 51).

The basic assumptions used in this analysis are listed below:

There is very little time for the operators to trip the reactor coolant pumps before seal failure occurs, therefore, it was conservatively-assumed that the operators would not trip them in time to prevent seal failure (Reference 34).

2) The reactor coolant pumps'eal failures result in the maximum postulated leak rate (480 gpm/pump).

3) It is assumed that the fire is suppressed within 15 minutes, and the operators are able to remain in the control room (Reference 34).

4) The loss of CCW is conservatively considered a second event occurring closely in time with the control room fire (Table 8-2, Reference 49).

5) High head emergency core cooling is not available, as ctuirging and safety iqjection pumps require CCW for cooling.

6) Low dependence was assumed between operator errors and the shift technical advisor (SPA) correctly monitoring the status trees and identifying when a red path has been reached. The function of the STAs is to monitor the critical plant parameters using the status trees, and not to concentrate on the specific actions performed by the operators (Table 2Ah4 and Table 21-1 (Eg of Reference 50).

7) All other systems are assumed to work properly (i.e., auxiliary feedwater works as designed).

8) An extremely high stress level is assumed for recovery actions when a red path has been reached, as the red paths indicate very serious conditions that must be addre~i immediately.

D-1

9) Based on THERP. (Reference 50, Items 9d and 10b of Table 8-1), the critical actions were considered dynamic because the diagnosis HEP was not a@usted downwards, as the EOPs do not specifically address this scenario of a control room fire causing a loss of component cooling water.

This rule (from 10b of Table 8-1, Reference 49) is very conservative, however, because once'the operators are past the diagnosis stage and into the appropriate procedure (ES-12, Reference 52),

the EOPs are very good.

10) As there is 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> available for diagnosis, a moderately high level of stress is assumed for the critical actions following this time. The operators had plenty of time to extinguish the fire, to distinguish that a loss of CCW was the problem, and to start stepping through the procedures.

All systems that are not dependent on CCW are assumed to function properly.

Xhe A~nal ~

This analysis was performed by reviewing the event, success criteria and corresponding procedures, talking with training and operations personnel (see References 53a-f), performing a task analysis, performing a timing analysis, and then developing and quantifying an HRA event tree. The task analysis identified the critical actions and the recovery actions, as described below. The timing analysis identified the amount of time available to diagnose and perform the actions, such that core melt will be prevented.

The HRA event tree is included as Figure D-1. Tables D-1 and D-2 contain timing information. Table D-3 includes the following information for each failure limb: person performing action, estimated HEP and source, corresponding procedure step (from task analysis) and an explanation of the action. Table D4 is the quantification of the event tree, which resulted in a failure probability of .025.

T k nal i The three critical actions to be performed by the operators are steps 5, 7 and 32, listed below, from "POST LOCA COOLDOWN AND DEPRESSURIZATION" (Reference 52a). The critical actions include ensuring that the RHR pumps are not running (when RCS pressure is greater than 300 psig), initiating RCS cooldown and starting RHR pumps when the appropriate RCS conditions are met. Step 34 is also listed below, as it directs the operators to return to step 5 if the RCS temperature is M 200'F.

PON N BTAINED

5. Check ifRHR Pumps Should Be Stopped:

a. Check RHR pumps - ANY RUNNING a. Go to Step 6.

b. Check ECCS - ALIGNED FOR b. Go to Step 6.

INJECTION MODE

c. Check RCS pressure: c. Go to Step 6.

~ Pressure - GREATER THAN 300 PSIG (590 PSIG FOR ADVERSE CONTAINMENT)

~ Pressure - SI'ABLE OR INCREASING D-2

d. Stop RHR pumps and place in NEUTRAL

7. Initiate RCS Cooldown To Cold Shutdown

a. Maintain cooldown rate in RCS cold legs - LESS THAN 100'F/HR

c. Transfer condenser steam dump to steam pressure mode

d. Using steam pressure d. Dump steam using intact SG(s) controller, dump steam to steam relief valve.

condenser from intact SG(s)

32. Check ifRHR System Can Be Placed In Service:

a. Check the following: a. Go to Step 33.

~ RCS temperature - LESS THAN 350'F

~ RCS pressure - LESS THAN 363 PSIG (SEE SUPPLEMENT FOR ADVERSE CONTAINMENT)

b. Consult Plant Evaluation Team to determine ifRER'System should be place in Service

34. Check RCS Temperature - LESS Return to step 5.

THAN 200'F Ifthe operators fail at the above actions, a critical red or orange path will be reached on the STA status trees. The SI'A would then inform the operators that they are on a critical path, and they would switch to procedure FR-C.1 (Reference 52b) or FR-C.2 (Reference 52c), depending on the reactor vessel water level. These procedures will guide them to cooldown the reactor coolant system by dumping steam to the condenser, either at a maximum rate (Step 13 of Reference 52b) or at a limit of 100'F/hr (Step 11 of Reference 52c). They will continue the cooldown until at least two RCS hot leg temperatures are < 350"F and the reactor vessel level narrow range indication is > 60% (Step 18 of Reference 52b or Step 16 of Reference 52c). Then, ifRCS pressure is not < 300 psig, or ifRHR flow is not sufficient (Step 14 of Reference 52d), they will return to Step 1 of the "POST LOCA COOLDOWN AND DEPRESKQUZATION" procedure (Reference 52a). As these recovery actions are equivalent to those listed above, they were not included in the above listing.

Timin Anal Due to the modelling of possible recovery once a STA red path is reached, the time relationships from Figure 6-3 of Reference 49 (i.e., To, Tm, Td and Ta) have been modified, as defined in Table D-I. A MAAP 3.0b (Reference 54) run was performed to determine some of these critical times. The output from this MAAP run is included as Table D-2.

D-3

Table D-1 Timing Analysis Table Time f mT TQ Hre in control room, annunciation of CCW and reactor trip.

Tm'.65 hours Time ~hen enter red path on STA status tree, had ifsteam dump (99 minutes) not been initiated. See Table D-2.

F 1 Ta 7 minutes Time to initiate steam dump. See ¹5a and ¹5b of Table 8-1 of Reference 49: 5 minute delay assumed, and 2 one minute actions (stop RER and initiate steam dump, performed on primary operating panels in control room)

Td 90 minutes Time available for diagnosis of loss of CCW. Td = Tm'-Ta.

See (conservative) Figure 6-3 of Reference 49.

1.85 hours9.837963e-4 days <br />0.0236 hours <br />1.405423e-4 weeks <br />3.23425e-5 months <br /> Must have initiated steam dump by now to save core. See Table (111 minutes) D-2.

0.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Time available to perform recovery actions (i.e., to (12 minutes) initiate steam dump). There is ample time, as only one action is required in this time. Tr = Tm - Tm'

Table D-2 Results of MAAP Run 5

cc8 - depressurfze sg porvs only - et 1000 F tgup OC. COOK Loss of ccM:

TLHE ZLN TGUP PPS TCRHOT HR FT *** PSI F O.OOOE+00 2.620E+01 5.593E+02 2.112E+03 1.224E+03 1.667E-02 2.620E+01 5.523E+02 1.790E+03 5.659E+02 1.045E-01 2.620E+01 5.643E+02 1.100E+03 6. 130E+02 2.057E-01 2.620E+01 5.680E+02 1.158E+03 6.123E+02 3-063E-01 2.620E+01 5.677E+02 1.153E+03 6.071E+02 4.053E-O'1 2.620E+01 5.673E+02 1. 147E+03 6.033E+02 5.097E-O'1 2.620E+01 5.671E+02 1. 143E+03 6.002E+02 6.052E-01 .620E+01 5.669E+02 1.140Et03 5.978E+02 7.110E.01 2.620E+01 5.667E+02 1.137E+03 5.959E+02 8.000E-01 . 2.620E+01 5.665E+02 1.134E+03 5.941E+02 9 130E-01 2.620E+01 5.662E+02 1.129E+03 '.925E+02 1.101E+00 2.620E+01 5.660E+02 1.126Ei03 5.903E+02 1.205E+00 2.620E+01 5.644Ei02 1.090E+03 5.855E+02 1.303E+00 " 2.620E+01 5.624E+02 1.073E+03 5.844E+02 1.407E+00 2.360E+01 5.635E+02 1.084E+03 5.850E+02 1.507E+00 2.016E+01 5.687E+02 1.076E+03 6.935E+02 1.605E+00 1.672E+01 6.082E+02 1.063E+03 1.198E+03

1. 708E+00 1.408E+01 6.929E+02 1.069E+03 1.466E+03 1 725E+00 1.372E+01 7.063E+02 1.063E+03 1.477E+03 1.743E+00 1.337E+01 7.202E+02 1.050E+03 1.493E+03 1.759E+00 1.303E+01 7.315E+02 1.041E+03 1.540E+03 1.776E+00 1. 272E+01 7.444E+02 1.030E+03 1.607E+03 1.793E+00 1.243E+01 7.571E+02 1.019E+03 1.676E+03, 1.809E+00 1.215E+01 7.694E+02 1.006E+03 1.751E+03 1.827E+00 1.187E+01 7.789E+02 9.895E+02 1.825E+03 1.844E+00 1.164E+01, 7.979E+02 9.735E+02 1.892E+03 1.860E+00 1.142E+01 8.120E+02 9.562E+02 1.97ZE+03 1.869E+00 1.135E+01 8.100E+02 9.312E+02 2.015E+03 1.872E+00 1.139E+01 8.561E+02 9.061E+02 2.018E+03 1.877E+00 1.140E+01 8.635E+02 8.561E+02 2.008E+03 1.880E+00 1.134E+01 8.934E+02 8.376E+02 2.010E+03 1.M4E+00 1.120E+01 8.627E+02 7.799E+02 2.021E+03 1.901E+00 1.106E+01 8.755E+02 6.476E+02 2.079E+03 1.909E+00 1.106E+01 8.579E+02 5.966E+02 2.113E+03 1.920E+00 1.219E+O1 8.986E+02 5.427E+02 2.177E+03 1.932E+00 1.355 E+01 9.284E+02 5.020E+02 2.142E+03 1.945E+00 1.526E+O1 9.843E+02 4.758E+02 1.982E+03 1.956E+00 1.649E+01 9.623E+02 4.537E+02 1.809E+03 1.968E+00 1.787E+01 9.565E+02 4.397E+02 1.678E+03 1.978E+00 1 911E+01 8.644E+02 4.219E+02 1.587E+03 1.987E+00 2.029E+Ol 7.709E+02 4.104E+02 1.407E+03 2.000E+00 2.218E+01 6.100E+02 4.019E+02 7.749Ei02 2.'lolE+00 2.620E+01 5.624E+02 2.567E+02 4.279E+02 2.201E+00 2.620E+01 5.168E+02 1.979E+02 4.035E+02 2.302E+00 2.620E+01 5 '43E+02 1.811E+02 3.942E+02 2.400E+00 2.620E+01 5.167E+02 1.842E+02 3.935E+02 2.514E+00 2.620E+01 5.243E+02 1.894E+02 3.926E+02 2.860E+00 2.402E+01 5.259E+02 1.860Ei02 3.846E+02 3.210E+00 2.392E+01 5.259Ei02 1.858E+02 3.806E+02 3.562E+00 2.378E+01 5.256E+02 1.858E+02 3.727E+02 3.912E+00 2.355E+01 5.250E+02 1.859E+02 3.635E+02 3.995E+00 2.355E+01 5.248E+02 1.859E+02 3.625E+02 4.000E+00 2.356E+01 5.249E+02 1.859E+02 3.624E+02 D-5

Table D-3 Explanation of Terms and Values in Figure 1 Failure Rsbmated limb & HEP'nd (Person') Source

{Refexence}

A, .003 Fail to diagnose the second abnormal event, total loss of (crew) TS-2 (between Unit 1 CCW. The fire was considered the first

¹12 & ¹13) abnormal event. The upper bound was also used due and UB to the added confusion and stress of the fire.

TS-3 ¹I {49}

B, .001 5 {52a} Fails to stop RHR pumps. The operators are very well (LO) e {51} trained o'n the conditions when RHR (i.e., low pressure iqjection) can be used, and every time the operators reach step 5 of ES-1.2 (Reference 52a), they re-examine ifRHR pumps should be stopped (see the Task Analysis Section).

C, .05 7 {52a} Fail to dump steam using steam pressure controller.

(LO) T8-5 ¹4 {49} (See Assumptions 9 and 10.)

.5 Unit Supervisor fails to correct the LO's error.

TS-5 ¹7 {49}

C, .05 7 {52a} Same as C1.

(LO) T8-5 ¹4 {49}

C, .05 32 {52a} Fails to place RHR in service when conditions are right:

(LO) T8-5 ¹4 {49}

Cs .05 Red Path STA fails to notice red path conditions. (See (STA) e with LD {55} Assumption 6)

T20-21 ¹Za

{50}

Cc .25 13 {52b} Fail to dump steam using steam pressure controller.

(LO) TS-5 ¹5 {49} or 11 {52c} (See Assumptions S and 9.)

.25 32 {52a} Fails to place RHR in service when conditions are right.

(LO) TS-5 ¹5 {49} (See Assumptions 8 and 9.)

D, .05 32 {52a} Same as C4.

(LO) TS-5 ¹4 {49}

Ds .5 Unit Supervisor fails to correct the LO's error.

(US) TS-5 ¹7 {49}

Ds .05 32 {52a} Same as C4.

(LO) TS-5 ¹4 {49}

D~ .05 Red Path STA fails to notice red path conditions. (See (STA) c with LD {55} Assumption 6)

T20-21 ¹Za

{50}

Estimated HEP'nd Soane

{Refenace}

D5 .25 32 {52a} Same as C7.

0-0) T8-5 N {49}

~ Key crew - eatiro coatrol room crew LO - Hceased operator SM - shift techucai advisor US - uult supervisor UB - upper bound of probabQity LD - Iow depeadeoce D-7

Table D4 Event Tree QuantiYication F, = Ai =.003 F~ = a,Bi = .001 Fa = aibiCqC~C~ = .001 F~ = aibiC,pe = .001 Fg = aibiCigc3C~ = .001 Fp = a,biCtC~c~C~ = .006 Fv = aibiCiCqc~,C7 = .004 Fa = albiciDiD~D4 = .001 F~ = a,bic,Did' .001 Fip aibic,D,D~d,D~ = .006 FT = Fi + F~ + Fq +-F~.+ Fq-+ Fq + Fv-+ Fs + Fs + Fip FT = .003 + 6(.001) + 2(.006) + .004 FT = .025

Figure D-1 Loss of CCW Due to Fire Event Tree s Q P~

S ~

7~ +8 Note: STA recovery could have been added at the end of branches: ACC, and Das failure of these actions would result in reaching the STA red path. This was not credited, however, for simpliTication of the tree.

Appendix D.2 Loss of all Unit j. Power and Control due to Cable Vault Fire Failure to Crosstie Unit 2 AFW & CVCS This analysis calculates the human error probability that the operators will not successfully crosstie the Unit 1 auxiliary feedwater (AFW) system and chemical and volume control system (CVCS) to Unit 2 following a loss of all Unit 1 power and control.

Bac un and tio i This analysis addresses the critical human actions of Unit safety systems. This 1 loss is caused necessary to prevent core damage, following a total loss by fire in a one of th'" cable vaults, where the automatic suppression systems fail. This fire causes evacuation of the control room, and therefore, use of the emergency remote shutdown (ERS) procedure series, 1-OHP 4025. Upon evacuation of the control room, the ERS crew would gather at the hot shutdown panel in the Unit 2 control room, even when the hot shutdown panel was not operational. This location is the command post for the ERS actions. The shift supervisor or assistant shift supervisor would follow through the main ERS shutdown procedure (1-OHP,,

4025.001.001, Reference 28a), and instruct operators to go out into the plant and complete certain tasks,"

when dictated by the main ERS procedure. The actions necessary to complete these tasks are often contained in other sections of the ERS series. The command post will instruct operators to complete a step or task, and report back via radio. There will not be anyone checking these remote operator actions.

The actions found to be critical to prevent core melt are listed in the Task Analysis section. Although the STA is still expected to maintain an overview of events in this ERS scenario, this is conservatively not credited.

This analysis is based on the ASEP Nominal HRA for Post-Accident Tasks (Chapter 8 of Reference 49),

and Reference 50 was used to model recovery actions and dependence. Insights and class handouts from the Process Safety Institute's Human Reliability Analysis chss were also used for this analysis (Reference 51).

The basic assumptions used in this analysis are listed below:

The cable vault fire forces evacuation of the control room, as it is assumed to result in a loss of indication and control in the control room, as well as a significant amount of smoke.

2) Both motor driven trains of Unit 2 AFW are assumed to be available.

~The Anal l This analysis was performed by reviewing the event, success criteria and corresponding procedures, talking with training and operations personnel (see References 53a-f), performing a task analysis, performing a timing analysis, and then developing and quantifying an HRA event tree. The task analysis identified the critical actions and the recovery actions, as described below. The HRA event tree is included as Figure D-2. Table D-5 includes the following information for each failure limb: person performing action, estimated HEP and source, corresponding procedure step (from task analysis) and an explanation of the action. Table D-6 is the quantification of the event tree, which resulted in a failure 0-probability of .11.

D-10

As soon as the operators are forced from the control room, they will enter the main Emergency Remote Shutdown (ERS) procedure (01-OHP 4025.001.001, Reference 28a). The shift supervisor will go through this procedure, and send the operators out into the plant to perform the required tasks. The operator actions considered critical to prevent core melt, as well as recovery actions, are listed below. Many of these tasks require the use of other sections of the 4025 ERS series, as dictated by the main ERS procedure (References 28a - 28f).

Critical actions indude aligning the backup power to the six local shutdown indication (LSI) panels, and establishing the crosstie to Unit 2 AFW and CVCS. The critical actions and recovery actions are listed below, and the corresponding sections of the 4025 ERS series are included. The critical actions are steps:

14(LS-1-1), 3(LS4-1), 4 (LS-2-2), 29e(001.001) and 1c(LSA-2). The recovery actions are steps: 4(LS 1), and 29i and 36a(001.001).

I N XPE D N N BTAINED From LS-1-1 (Reference 28a):

Align 1-LSI-1 For Operation:

a Place the following 1-LSI-1 LOCAL/REMOTE switches in LOCAL:

~ 1-BLI-110, f11 SG Wide Range Level

~ '-BLI-140; 114'SG Wide Range

'evel

2. Align 1-LSI-5 For Operation:

b. Align the following power supply switches:

1) U-1 (Normal Power) - OFF

2) U-2 (Backup Power) - UNIT 2

3. Align 1-LSI-2 For Operation:

a. Place the following 1-LSI-2 LOCAL/REMOTE switches in LOCAL:

~ 1-BLI-120, 012 SG Wide Range Level

~ 1-BLI-130, f13 SG Wide Range Level

4. Align 1-LSD For Operation:

b. Align the following power supply switches:

1) U-1 (Normal Power) - OFF

2) U-2 (Backup Power) - UNIT 2 5 Align 1-LSI-3 For Operation:

a. Place the following 1-LSI-3 LOCAL/REMOTE switches in LOCAL:

o 1-QFI-200, Charging Pumps Discharge How 1-QFI-301, Letdown Hx Outlet Flow 4 1-NLI-151, PRZ Cold Cal Level e 1-NPS-122, RCS Wide Range Pressure 6 Align 1-LSD For Operation:

b. Align the following power supply switches:

1) U-1 (Normal Power) - OFF

2) U-2 (Backup Power) - UNIT 2 Xhxn LS-6-1 (Reference 28e):

3. /LOWLY OPEN 2-CS-536, CVCS Charging Pumps Discharge Crosstie Header Unit 2 Shutoff Valve Erom IS-2-2 (Reference 28d):

4. Open 2-8V-129, 2E Motor Driven Auxiliary Feedwater Pump Discharge to Unit 1 Crosstie Shutoff Valve Proud 001.001 (Reference 28a):

29. Align U2 MDAFPs For Cross-Tie Operation:

e. Start 2E MDAFP D-12

hm LS-2-1 (Reference 28c):

4 Open 1-FW-129, 1E Motor Driven Auxiliary Feedwater Pump Discharge to Unit 2 Crosstie Shutoff Valve From 001.001 (Reference 28a):

29. Align U2 MDAFPs For Cross-Tie Operation:

i. Start 2W MDAFP

36. Initiate CVCS Cross-tie Operations:

a. Verify complete 01-OHP 4025.LS-6, RCS MAKE-UP, SEAL INJECTION, AND BORATION WITH CVCS CROSS-TIE, LS4-1, SEAL INJECTION FROM CVCS CROSS-TIE From LS-6-2 (Reference 28Q:

Initiate CVCS Crosstie Operation: .-

c. ~WLY OPEN 1-CS-535, CVCS, Charging Pumps Discharge Crosstie Header to Unit 1 RCP Seal Iqjection Emergency How Control Valve, to obtain 25 gpm flow indication on 12-QFI-201 Diagnosis error is considered negligible for this scenario, as the smoke and loss of control in the control room will cause definite evacuation from the control room and entry into the Emergency Remote Shutdown Procedure (Reference 28a). An explicit timing analysis, therefore, is not warranted. A brief timing study is included.

From reactor trip, it takes the operators about 30 minutes to isolate the RCS and steam generators and crosstie AFW and CVCS (Table 12.3-1 of Reference 29). Following a station blackout with no AFW, core uncovery is expected to begin at about two hours (Reference 56). There is plenty of time, therefore, for the operators to perform the critical actions, and for recovery of errors.

Table D4 Explanation of Terms and Values in Figure D-2 Failure Estanated Explanation Limb & HEP'nd (Person' Source (Reference)

Al .001 Operators fail to diagnose need to evacuate control (crew) e {51} room and use Emergency Remote Shutdown procedure, even though smoke is fillingcontrol room and all control room indication and control is gone.

BI 6 a .001 14 {28b} Operator fails to align backup power to each of the 6 (OP) 6e {51} LSI panels." These are needed for indication for emergency remote shutdown. If a needed panel is dead, they will try to connect power to it.

Cl .05 3 {28e} Operator fails to open the first Unit 2 CVCS cross-tie (OP) TS-5 ¹4 {49} valve, 2-CS-536.

.53 36a {28a} Operator fails to verify complete LS+I (opened 2-CS-(OP) TS-5 ¹4 {49} 536).

with HD T20-21 ¹4b

{50}

Dl .05 4 {28d} Operator fails to open the IW/2E AFW cross-tie valve (OP) TS-5 ¹4 {49}, (? FW-129)

D2 .53 4 {28c} Operator fails to open the IE/2W AFW cross-tie valve (OP) TS-5 ¹4 {49} (I-FW-129) with HD T20-21 ¹4b

{50}

D3 .05 29i {28a} Operator fails to start the 2W MDAFP.

(OP) TS-5 ¹4 {49}

El .05 29e {28a} Operator fails to start the 2E MDAFP.

(OP) T8-5 ¹4 {49}

Gl .05 Ic {28f} Operator fails to open the second Unit 2 CVCS cross-tie (OP) TS-5 ¹4 {49} valve, I-CS-535.

G2 .53 {28a} Operator fails to later throttle open I-CS-535. (There (OP) T8-5 ¹4 {49} many steps in the procedure that. would lead the

're with HD operator to open valve I-CS-535, if they had failed to in T20-21 ¹4b Gl.)

{50}

crew - eatire control room crew OP - operator, liceased or aoa-bceased HD - high depeadeace D-14

Table D-5 Calculation of Total Failure Probability F, = A, =.001 Fi = a,B, = .006 F3 = a,b,C,Ci = .026 F4 = alblclDlDi + aib,C,gD,D~ '+ 'a,b,cidlEjtD~ = a,b,Dz [c,D, + C,gDl + cid,EJ =

.049 Fs = a,b,d,D~ [c,D, + C,cd, + c,d,E,l = .002 F, = a,b,c,d,e,G,G, + a,b,d,d,G,G, [c,D, + C,gD, + c,d,Eg = .024 FT = F, + F~ + Fa + Fi + F~ + Fq FT = .001 + .006 + .026 + .049 + .002 + .024 FT = 0.11 D-15

Hgure D-2 Loss of Unit 1 Popover and Control Due to Fire Event Tree

APPENDIX E CALCULATIONOF ESTIICA.TED CORE DAMAGEFREQUENCIES FOR ZONES %XIH INITIATINGEVENTS OTHER THAN TRA In this appendix, the core damage frequency is estimated for each zone with an initiating event concern (other than TRA). When more than one initiating event was credible for a zone, the most limiting event was used for the calculation. The core damage frequency values were estimated using the following equation:

CDF = tlEF~F+~[CDF~]~PIREF~

where:

CDF, = estimated core damage frequency, to be determined CDF~ = initiating event's original contribution to core damage frequency, Revision 0 of IPE (from Table 3.4-1, "Accident Event Summary", Reference 57)

IEF = initiating event frequency, based on equipment in zone (from Table 10)

IEF, = old initiating event frequency, Revision 0 of IPE (from Table 3 4-1, "Accident Event Summary", Reference 57)

FIREF = Fire initiation frequency for each zone (from Tables 4 through 9)

Core damage frequencies are estimated in this appendix for 21 zones: 6N, 13, 15, 16, 29A, 29B, 29E, 29G, 40A, 40B, 42A, 42C, 42D, 43, 44N, 44S, 51, 52, 79, 112 and 114.

~Zne 6N LOSE:

- W train of CCW (lose MCC 1-AZV-A)

- D/G 1AB (lose both of its fuel oil transfer pumps)

- MCC's for both ESW strainers NOTES:

Also lose all AFW (lose pumps and other equipment), E CCP lube oil pump & other various components. MCC 1-AZV-A is found in the following fault trees: CCWW, CCWWL, HPI, CSR, HP5, CF and HPR.

SCREEN: not screened out Can show that this will not be screened out by just considering the loss of 1 train of CCW:

IEF(CCW) = 0.01 (Table 10, CCW(A))

FIREF(Zone 6N) = 1.0E43 CDF = [IEF,~Fg J~[CDFgJ~[FIREF~

CDF = [0.01/8.71E44]~[1.38E45]~[1.0E43]

CDF = 1.58E47 Actual value would be even greater than this.

~Zon 13 LOSE:

- D/G 1CD (lose both fuel oil transfer pumps)

NOTES:

Lose both fuel oil transfer pumps for D/G 2CD, but this is not relevant.

Cable 1-9655R for D/G 1AB that runs through this zone is for testing only. Its loss only matters if the diesel is in testing at the time of the fire, as it may be incapable of transferring its supply to its required loads. The probability of this diesel being in testing (STP.027) will be added to its failure probability below. Nothing else is in zone.

SCREEN: screened out IEF(SBO) = [Chance of one D/G failing to start & run + Probability it is in Testing (SI'P.027, from line 485 of SIMON.DAT, Rev. 0 of PRA)] ~ [Probability of a LOSP (0.04/365)]

IEF(SBO) = [1.9E-02 + 6.0FA3] ~ [1.1E44] = 2.75E46 FIREF(Zone 13) = 1.0E43 CDF= [2.75E-06/1.40E-05] ~ [1.13E46] ~ [1.0E-03]

CDF, = 2.22E-10

'one 15 LOSE:

- All ESW for Unit 1 (PP-7E, PP-7W & WMO-707)

- E CCW train (PP-10E)

- D/G 1CD (D/G, both fuel oil transfer. pumps, WMO-725)

NOTES:

Also lose both RHR pumps, E CCP and EMDAFP.

SCREEN: not screened out When all ESW for Unit 1 is lost, all CCW is also lost. A total loss of CCW is used as the initiating event example.

IEF(CCW) = 1.0 FIREF(Zones 15) = 2.2E42 CDF, = [0.01/8.71E-04]~[128E05]~[2.2E42]

CDF= 3.49E-04 c E-3

~Zn~

LOSE:

- Entire W ESW Header (PP-7W & WMO-705)

- W CCW train (PP-10W)

- D/G 1AB (D/G, fuel oil transfer pumps & WMO-721)

NOTES:

Also lose W RHR Pump, W MDAFP and W CCP.

SCREEN: not screened out Can show that this will not be screened out by just considering the loss of 1 train of CCW (this gives a higher result than the loss of one header of ESW):

IEF(CCW) = 0.01 (Table 10, CCW(A))

FIREF(Zone 16) = 2.2E-02 CDF = [0.01/8.71FA4]~[1.38E45]*[2.2E42]

CDF, = 3.49E-06 Actual value would be even greater than this.

~Zne~2 LOSE:

- 1E ESW train (PP-7E, WMO-701 & OME-34E)

NOTES:

Nothing else is in zone.

SCREEN: screened out IEF(ESW) = 4.5E45 (Table 10, ESW(A))

FIREF(Zone 29A) = 1.0E43 CDF = [4.5E-05/3.7E45] ~ [6.04E47] ~ [1.0E43]

CDF = 7.29E-10

~Zone 2 B LOSE' Both Ul trains of ESW (lose PP-7W, WMO-701, WMO-702, OME-34E & OME-34W)

NOTES:

Nothing else is in zone.

SCREEN: not screened out IEF(ESW) = 6.6E43 gable 10, ESW(E))

FIREF(Zone 29B) = 1.0E43 CDF, = [6.6E43/3.73E45] ~ [6.04E47] ~ [1.0E43]

CDF= 1.07E47

~Zon 29K LOSE:

- both VI trains of ESW (lose MCC PS-D, MCC PS-A, ESWSE, ESWSW, WMO-701, WMO-702)

NOTES:

Nothing else is in zone SCREEN: not screened out IEF(ESW) = 6.6E43 (Table 10, ESW(E))-

FIREF(Zone 29E) = 1.0E43 CDF = [6.6E43/3.73E45] ~ [6.04E47] ~ [1.0E43]

CDF = 1.07E47

~Zone 2 LOSE:

- all 4 trains of ESW (1-PP-7E, 2-PP-7E, 1-PP-7W, 2-PP-7W, 1-ESWSE,? ESWSE, 1-ESWSW, 2-ESWSW, 1-WMO-701, 2-WMO-703, 1-WMO-702,? WMO-704)

- both D/G's (1AB & 1CD)

NOTES:

Nothing else is in zone.

SCREEN: not screened out When all ESW is lost, all CCW is aho lost. A total loss of CCW is used as the initiating event example.

IEF(CCW) = 1.0 HREF(Zone 29G) = 1.0E43 CDF = [1;0/8.71E44] ~ [1.38E45] ~ [1.0E43]

CDF = 1.58E-05

~Zne 40K LOSE:

- W CCW train (PP-10W)

- W ESW train (PP-7W)

- D/G 1AB

- Train A 250VDC (both battery chargers and transfer cabinet).

NOTES:

ALso lose 600V bu'sses 11A and 11B, WMDAFP, W RHR pump & W CCP.

SCREEN: not screened out'an show this will not be screened out by just considering the 1 train of CCW:

IEF(CCW) = 1.0E-02 (Table 10, CCW(A))

FIREF(Zone 40A) = 2.9E43 CDF, = [1.0E-02/8.71E-04] ~ [198E45] ~ [2.9E43]

CDF = 4.59E-07 Actual value would be even greater than this.

Zone 40B LOSE:

- E CCW train (PP-10E)

- E ESW train (PP-7E)

- D/G 1CD NOTES:

Also lose 600V busses 11C and 11D, EMDAFP, E RHR pump & E CCP.

SCREEN: not screened out Can show this will not be screened out by just considering the loss of 1 train of CCW:

IEF(CCW) = 1.0E42 (Table 10, CCW(A))

FIREF(Zone 40B) = 2.9E-03 CDF, = [1.0E42/8.71E44] ~ [1.38E-05] ~ [2.9E43]

CDF, = 4.59PA7 Actual value would be even greater than this.

~Zne 42K LOSE:

- Entire W ESW Header (PP-7W & WMO-705)

- W CCW train (PP-10W)

- D/G IAB (D/G, fuel oil transfer pumps & WMO-721)

NOTES:

Also lose W RHR Pump, 600V busses 11A & 11C, W MDAFP, W CCP, and several MCC's which affect various fault trees.

SCREEN: not screened out Y Can show that this will not be screened out by just considering the loss of 1 train of CCW (this gives a higher result than the loss of one header of ESW):

IEF(CCW) = 0.01 (Table 10, CCW(A))

FIREF(Zone 42A) = 7.1E43 CDF = [0.01/8.71FA4]~[1.38K@5]~[7.1E43]

CDF= 1.12E46 Actual value would be even greater than this.

boyne 42(",

LOSE:

- W CCW train (PP-10W)

- W ESW train (PP-7W)

- D/G 1AB (D/G)

- Train B 250VDC (transfer cabinet)

NOTES:

Also lose W RHR Pump, W MDAFP, W CCP, 600V busses 11A & 11C and 120VAC distribution panels.

SCREEN: not screened out Can show that this will not be screened out by just considering the loss of 1 train of CCW:

IEF(CCW) = 0.01 (Table 10, CCW(A))

FIREF(Zone 42C) = 1.0E43 CDF = [0.01/8.71E44]~[1.38E45]~[1.0E43]

CDF, = 1.58E47 Actual value would be even greater than this.

~Zn 42D LOSE:

- D/G 1AB (D/G)

- Train B 250VDC (battery, transfer cabinet, distribution cabinet)

NOTES:

Nothing else is in zone.

SCREEN: not screened out IEF(250VDC) = 1.0 (Table 10, 250VDC)

FIREF(Zone 42D) = 3.2E43 CDF = [1.0/1.16E-02] [6.04E47] ~ P.2E43]

CDF = 1.68E47

Zone 43 LOSE:

- W CCW train (MCC AM-A, provides power to CMO-420)

NOTES:

The only thing in this zone is MCC 1-AM-A. MCC 1-AM-A is found in the following fault trees:

CCWW, CCWWL, LPR, HPR, CCWL and AFS. Although a cable for MCC 1-AM-D runs through this zone, MCC 1-AM-D is not lost because this cable (14546G) is a spare abandoned cable.

SCREEN: not screened out Can show this zone will not be screened out by just considering the one train of CCW:

IEF(CCW) = 1.0E42 (Table 10, CCW(A))

FIREF(Zone 43) = 1.0E43 CDF = [1.0E42/8.71E44] ~ [1.38E45] ~ [1.0E43]

CDF, = 1.58E47 Actual value would be even greater than this.

E9

~Zne 44N LOSE:

- All Ul CCW (PP-IOE, PP-IOW, CMO410, CMO420, CMO419, CMO429, HE-15E, HE-15W, WMO-731, WMO-733, WMO-735, WMO-737, MCC I-AM-Aand MCC I-AZV-A)

- E ESW train (PP-7E)

- One D/G fuel oil transfer pump (I-IABI)

NOTES:

Also lose: all UI AFW (lose all three pumps, I-ABN and various valves), all UI CVCS (both lube oil pumps and various valves) and various MS and RHR valves. MCC I-AM-Ais found in the following fault trees: CCWW, CCWWL,-LPR, HPR,- CCWL and AFS. MCC I-AZV-Ais found in the following fault trees: CCWW, CCWWL, HPI, HP5, HPR, CSR and CF. Many U2 valves and pumps are in zone, however, the only Unit 2 ESW components that are affected are the ESW supply and discharge valves to a Unit 2 CCW heat exchanger.

SCREEN: not screened out Can show this zone will not be screened out by just considering the loss of CCW:

IEF(CCW) = 1.0 FIREF(Zone 44N) = 1.4E43 CDF = [1.0/8.71E-04] ~ [1.38E45] ~ [1.4E-03]

CDF, = 2.22E-05 Actual value would be even greater than this.

E-10

one 44$

LOSE:

- AllU1 CCW (PP-IOE, PP-10W, CMO-420, WMO-737)

NOTES:

Also in zone: CMO411 and CMOQ13 (modelled in CF only) and IMO-255 (modelled in HPI, HP5 and HPR). Many U2 CCW cables and components are in this zone, as well as many other U2 cables (MS, CVCS, AFW, RHR, D/G's and electric power). The only Unit 2 ESW components affected, however, are the ESW supply and discharge valves to the U2 CCW heat exchangers.

I SCREEN: not screened out Can show this zone will not be screened out by just considering the loss of CCW:

IEF(CCW) = 1.0 FIREF(Zone 44S) = 2.4E43 CDF, = [1.0/8.71E44] ~ [1.38E45] ~ [2.4E43]

CDF, = 3.80E-05 Zone 5 LOSE:

- AllU1 CCW (CM0420 (W train discharge valve), WMO-731 and WMO-733 (ESW cooling to E CCW train))

NOTES:

Various CVCS valves are also in zone (ICM-250, IMO-910, QM0-200, QMO-201, QMO451).

Nothing else is in zone.

SCREEN: not screened out Can show this zone will not be screened out by just considering the loss of CCW:

IEF(CCW) = 1.0 FIREF(Zone 51) = 1.1E43 CDF, = [1.0/8.71E44] ~ [1.38E45] ~ [1.1E43]

CDF, = 1.74E45 Actual value would be even greater than this.

~Zn~2 LOSE:

- All U1 CCW (CMO420 (W train discharge valve), WMO-731 and WMO-733 (ESW cooling to E CCW train))

NOTES:

Also lose various MS valves (Ul & U2), AFW valves (U1 & U2), TDAFP and CVCS valves (U1 &

U2). There are no Unit 2 ESW components in this zone. 250VCD distribution cabinets 1-ABN and 1-DCN are also in zone. 1-DCN only takes out the N-train, and 1-ABN affects AFW, as it is the control power to the TDAFP (found in: AF1, AFT & AFS). MCC 1-AM-A and MCC 1-AM-D are in this zone. MCC 1-AM-A is found in the following fault trees: CCWW, CCWWL, LPR, HPR, CCWL and AFS, and MCC 1-AM-D is found in HPI, CSR, LPR, DCN, HP5, CF and HPR. MCC 2-AM-A and? AM-D are also in this zone.

SCREEN: not screened out Can show this zone will not be screened out by just considering the loss of CCW:

IEF(CCW) = 1.0 FIREF(Zone 52) = 2.2E43 CDF, = [1.0/8.71E44] ~ [1.38E45] ~ [2.2E43]

CDF = 3.49E45 Actual value would be even greater than this.

Zon 7 LOSE:

- All U1 CCW (PP-10E, PP-10W)

- Both ESW Headers (PP-7E, PP-7W and cross-tie valves WMO-705 and WMO-707)

- Both D/G's (DGAB, DGCD, all 4 fuel oil transfer pumps, 2 of 4 ESW supply valves (WMO-721 and WMO-725))

NOTES:

Also lose: all CVCS (PP-50E & PP-50W), all RHR (PP-35E & PP-35W) and W MDAFP.

Although no Unit 2 ESW cables or components are in this zone, Unit 2 ESW is unavailable since cables for crosstie valves 1-WMO-705 and 1-WMO-707 are in zone.

SCREEN: not screened out Can show this zone will not be screened out by just considering the total loss of CCW:

IEF(CCW) = 1.0 FIREF(Zone 79) = 6.0E43 CDF = [1.0/8.71K@4] ~ [198E45] ~ [6.0E43]

CDF = 9.48E45 Actual value would be even greater than this.

~Zne 112 LOSE:

- Both ESW headers (PP-7E, PP-7W and cross-tie valves WMO-705 and WMO-707)

NOTES:

There is nothing else in this zone. Although no Unit 2 ESW cables or components are in this zone, Unit 2 ESW is unavailable since cables for crosstie valves 1-WMO-705 and 1-WMO-707 are in zone.

SCREEN: not screened out When all ESW is lost, all CCW is also lost. A total loss of CCW is used as the initiating event example.

IEF(CCW) = 1.0 FIREF(Zone 112) = 1.0E-03 CDF = [1.0/8.71FA4] ~ [1.38FA5] ~ [1.0FA3]

CDF = 1.58FA5

~Zn 1 4 LOSE:

- 2 of 4 ESW supply valves to EDG's (WMO-721 & WMO-725) and a fuel oil transfer pump (1AB1)

NOTES:

The only other components in this zone are LSI components, which are not relevant.

SCREEN: screened out IEF(SBO) = 5.2E48 (Table 10, SBO(B))

FIREF(Zone 114) = 1.0FA3 CDF, = [5.2E48/1 40E45] ~ [1.13FA6] ~ [1.0FA3]

CDF = 4.20E-12 E-14

APPENDIX F COMPBRN RUN (Note: This appendix contains computer output.

It was not included to reduce the volume of the submittal.)

APPENDIX G CALCULATIONOF INITIATINGEVENT FREQUENCIES (Note: This appendix contains computer output.

It was not included to reduce the volume of the submittal.)

APPENDIX G CALCULATIONOF INITIATINGEVENT FREQUENCIES This appendix documents the calculation of initiating event frequencies upon the loss of components or trains of component cooling water (CCW), essential service water (ESW) and diesel generators. The initiating event frequencies impacted by such a loss are loss of CCW, loss of ESW and station blackout (SB0).

The initiabng event frequencies were found by making the necessary changes to the .SM files, and then quantifying the fault trees. This method is consistent with that used in the IPE. The .SM files and a summary of the output files are included in this appendix, as listed below:

Initiating Event Components/Trains Lost Inibating Table ¹i Table ¹t Event .SM .OUT Frequency File File Loss of CCW 1 CCW operating train 1.0FA2 G.1.1 G.1.2 1 CCW standby train 2.3E44 6.19 6.1.4 Loss of ESW 1 ESW operating train 4.5E45 G.2.1 G.2.2 1 ESW standby train 1.2E-05 6.29 G.2.4 Both ESW operating trains 6.6E-03 G.2.5 G.2.6 Both ESW standby trains 3.4E-04 G.2.7 G.2.8 Both U1 ESW trains 6.6FA3 G.2.9 G.2.10 Both U2 ESW trains 3.4E-04 G.2.11 G.2.12 Both ESW trains/header aligned to U1 6.9E43 G.2.13 6.2.14 loads Both ESW trains/header aligned to U2 2.4E45 G.2.15 G.2.16 loads Loss of 250 VDC 1 250 VDC train 1.0 Power SBO 1 diesel generator 2.2FA6 G.3.1A G.3.2 G.3.1B 2 of 4 ESW supply valves to diesel 5.2E48 G.3.3A G.3.4 generators 6.39B Note: These results are conservative. Some double counting was left in the quantification. For example, for the CCW standby train case, the standby pump was failed. Even so, a dominant cutset remained where that same pump is in test and maintenance.