ML18064A832

IPE of External Events (Ipeee).

ML18064A832
Person / Time
Site:	Palisades
Issue date:	06/30/1995
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML18064A831	List: ML18064A830 ML18064A832
References
NUDOCS 9507060372
Download: ML18064A832 (232)

Text

• • • ,*::

(. .

INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE)

JUNE 1995 9507060372 950630 I PDR ADDCK 050002~5

:. p PDR

TABLE,OF CONTENTS SECTION 1.0 EXECUTIVE

SUMMARY

1.1 Background and Objectives 1-1 1.2 Plant Familiarization 1-2 1.3 Overall Methodology 1-3 1.4 Summary of Major Findings 1-4 1.4.1 Seismic Summary 1-4 1.4.2 Fire Summary 1-4 1.4.3 Other External Events Summary 1-5 1.5 References 1-6

• 1.0 1.1 EXECUTIVE

SUMMARY

Background and Objectives The NRC issued its policy on Severe Reactor Accidents Regarding Future Designs and Existing Plants in 1985, which concluded that existing nuclear power plants pose no undue risk to the public health and safety and that there is no present basis for immediate action on any regulatory requirements for these plants. However, the Commission recognized, based on NRC and industry experience with plant specific probabilistic risk assessments (PRAs), that systematic examinations are beneficial in identifying plant specific vulnerabilities to severe accidents.

As part of the closure process for the Severe Accident Progqun, the NRC issued Generic Letter 88-:20, "Individual Plant Examination for Severe Accident Vulnerabilities -

10CFR50.54(f)," (Ref. 1-1) on November 23, 1988, formally requesting that eacb licensee conduct an Individual Plant Examination (IPE) for internally initiated events, including internal flooding. Then on June*28,1991, the NRC issued Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR50.54(f)" ER.ef. 1-2). The objectives of the IPE and the IPEEE are

" similar:

1) to develop.an appreciation of severe accident b~havior;

2) to understand the most likely severe accident sequences that could occur under full power operations;

3) to gain a qualitative understanding of the overall likelihood of core damage and fission product releases; and

4) if necessary, reduce the overall likelihood of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.

Consumers Power has completed and documented the IPEEE for Palisades. which meets the objectives and requirements of Generic Letter 88-20, Supplement 4 (Ref. 1-2). This report provides a summary of the methodologies, results and conclusions of the IPEEE .

• • 1-1

... 1.2 Plant Familiarization The Palisades IPEEE utilized, wherever possible, information from the Palisades IPE effort (REF.1-3). This included information on the as-built, as-operated plant. Further walkdowns were performed and documented to provide additional information required to complete the seismic, fire and other external events analyses.

The Palisades Plant is located on the eastern shores of Lake Michigan, six miles south of South Haven, Michigan. Construction started on August 25, 1966, and commercial operation began on December 31, 1971.

Palisades has a two-loop Combustion Engineering nuclear steam supply system (NSSS) licensed for 2530MWth. The NSSS contains the reactor vessel, pressurizer with two power operated relief valves (PORVs) and three safety relief valves, two steam generators, and four primary coolant pumps. The NSSS is contained within a large, dry, pre-stressed concrete containment building with a 1/4" carbon steel liner designed by Bechtel Power Corporation.

The containment concrete walls are reinforced and post-tensioned. The plant secondary system has a turbine and generator manufactured by the Westinghouse Electric Corporation and has a maximum electrical output of 845 MWe. A more detailed discussion of plant systems is presented in Section 3.4 .

1-2

• 1.3 Overall Methodology Palisades followed the guidance for performing the IPEEE provided in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Ref. 1-4).

The seismic IPEEE is a Level 1 PRA with a containment performance analysis. The appropriate system fault trees and accident event trees from the IPE were used and modified, as necessary, for the seismic probabilistic risk assessment (SPRA).

The EPRI Fire-Induced Vulnerability Examination (FIVE) methodology (Ref. *1-5) was used for the fire IPEEE analysis.

• ,

• The methodology for identifying other external events is consistent with the approach described in NUREG-1407 (Ref. 1-4). The methodology for analyzing other external events used a progressive screening approach.

• Each of the analyses (seismic, fire and other external events) received detailed reviews by plant staff and consultants. Detailed reviews were performed on the PRA modeling techniques, assumptions and data. These reviews identified areas where the models or data were very conservative and could be revised to provide a more realistic representation of the plant. In addition, detailed reviews were performed on the quantification results (cutset reviews) to identify and correct probleins associated with illogical and invalid cutsets.

Detailed reviews were also performed on the overall methodologies for each of the IPEEE analysis to identify consistency among them and verify that acceptable practices were used throughout the IPEEE.

• Details of the specific methodologies are contained in Section 2.3 and the seismic, fire and other external events sections of this report. *

• 1-3

• 1.4 Summary of Major Findings This section summarizes the results and conclusions of the Palisades IPEEE. Details of the results and conclusions are presented in Section 8.

1.4.1 Seismic Summary There were no significant seismic concerns identified as a result of the seismic PRA (SPRA).

The new Lawrence Livermore National Laboratory (LLNL) hazard curves, as contained in NUREG-1488 (Ref. 1-6), were used to evaluate the SPRA. The SPRA mean core damage frequency is 8.88E-06/yr, which is considerably less than the IPE (internal events) core damage frequency of 5.15E-05/yr. The median fragility (capacity) of the plant is .488g peak ground acceleration (PGA) and the high confidence of a low probability of failure (HCLPF) is

.217g PGA. Both of these results are higher than the Palisades safe shutdown earthquake design basis of .20g PGA.

A review of the results of the SPRA conclude that:

1) there are no dominant seismic failure modes contributing to the core damage frequency;

2) no Accident Classes (functional failures) met the screening requirements for reportability;

3) non-seismic failures and operator errors are an important part of the SPRA core

• damage freqµency; and

4) the engineered safeguards equipment are inherently rugged with no seismic vulnerabilities.

1.4.2 Fire Summary The Palisades core damage frequency due to fires was calculated to be less than 2.00E-04/yr.

Eighty-five percent of the plant core damage. frequency associated with internal fires can be traced to fj.ve rooms/bum areas; 1) turbine building, 2) main control room, 3) cable spreading room, 4) spent fuel pool equipment room, and 5) auxiliary building 590 corridor.

The results of the Fire IPEEE accident sequence quantification were der:ived from a methodology that includes a number of conservative assumptions. Fires.were assumed to increase until they completely engulfed the area where they were located. In addition, with the exception of the main control room, cable spreading room and the 2.4kV switchgear rooms, the effects of suppression were not credited. Therefore, while the core damage frequency due to internal fires is high, the methodology as applied has resulted in conservative core damage frequencies. These conservatisms will be evaluated prior to considering any plant modifications or* improvements based on these results.

1-4

1.4.3 Other External Events Summary There were no other external events identified that have an impact on the core damage frequency al Palisades. All of the screening criteria used from NUREG-1407 (Ref. 1-4) and Generic Letter 88-20, Supplement 4 (Ref. 1-2) were satisfied. Results of the Palisades Systematic Evaluation Program (SEP) (Ref. 1-7) were used, whenever possible, to complete the evaluation of other external events .

• 1-5

• 1.5 1-1 References NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(t), November 1988 1-2 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(t), April 1991.

1-J Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 1-4 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 1-5 EPRI Report, Fire-Induced Vulnerability Evaluation (FIVE), April 1992 1-6 NUREG/CR-1488, Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains 1-7 NUREG-0820, Integrated P-lant Safety Assessment - Systematic Evaluation Program, Palisades Plant, Final Report, October 1982 *

• 1-6

• TABLE OF CONTENTS SECTION 2.0 EXAMINATION DESCRIPTION 2.1 Introduction 2-1 2.2 Conformance with Generic Letter and Supporting Material 2-2 2.3 General Methodology 2-3 2.3.1 Seismic Methodology 2-3 2.3.2 Fire Methodology 2-3 2.3.3 Other External Events 2-3 2.4 Information Assembly 2-4 2.5 References 2-5

• 2.0 2.1 EXAMINATION DESCRIPTION Introduction The NRC issued its policy on Severe Reactor Accidents Regarding Future Designs and Existing Plants in 1985, which concluded that existing nuclear power plants pose no undue risk to the public health and safety and that there is no present basis for immediate action on any regulatory requirements for these plants. However, the Commission recognized, based on NRC and industry experience with plant specific probabilistic risk assessments (PRAs),

that systematic examinations are beneficial in identifying plant specific vulnerabilities to severe accidents. On fylay 25, 1985, the NRC issued SECY 88-147, "Integration Plan for Closure of Severe Accident Issues," (Ref. 2-1) which identified the following four areas that require licensee action:

1) Individual Plant Examination (IPE);

2) Containment Performance Improvements;

3) IPE of External Events (IPEEE);

4) Severe Accident Management.

To address the first licensee action, the NRC issued Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10CFR50;54(f), II (Ref. 2-2) on November 23, 1988., formally requesting that each liceosee _conduct an Individual Plant. Examination (IPE) for internally initiated events, including internal flooding.

. ::~ I The containment performance improvements were included in the IPE process by Generic I Letter 88-20, Supplements 1 (Ref. 2-3) and 3 (Ref. 2-4).

On June 28,1991, the NRC issued Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe _Accident Vulnerabilities -

10CFR50.54(f)," (Ref. 2-5) to address the third licensee action. The objectives of the IPEEE ate similar fo the objectives of the IPE:

1) to develop an appreciation of severe accident behavior;

2) to understand the most likely severe accident sequences that could occur under full power operations; *

3) to gain a qualitativ:e understanding of the overall likelihqod of core damage and fission product releases; and

4) if necessary, reduce the overall likelihood of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents .

• .2-1

• 2.2 Conformance with Generic Letter and Supporting Material The Palisades PRA group was responsible for performing the IPEEE. This group directed all aspects of the IPEEE including coordination and discussions with other plant departments and outside contractors. Technology transfer from the contractors and all IPEEE related documentation is the responsibility of the PRA group. This allows future revisions or applications of the IPEEE to be performed by plant personnel. Further detail.s of the plant organization can be found in Section 6 of this report.

Consumers Power has completed .and documented the IPEEE for Palisades which meets the objectives and requirements of Generic Letter 88-20, Supplement 4 (Ref. 2-5). This report provides a summary of the methodologies, results and conclusions of the IPEEE.

The Palisades IPEEE l,ltilized, wherever possible, info.rmation from the Palisades IPE effort.

This included information on the as-built, as-operated plant. Further walkdowns were performed and documented to provide additional information required to complete the seismic, fire and .other external events analyses. In addition, independent, technical reviews were performed by outside contractors as well as other plant department personnel.

Sensitivity analyses were performed to identify operator actions or plant equipment that have a significant impact on the core damage analysis. These sensitivity analyses and results are presented in the discussion sections for seismic, fire or other external events .

• 2-2

• 2.3 General Methodology Palisades followed the guidance for performing the IPEEE that is provided in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Ref. 2-6). The specific. methodologies used for each analyses vary and are c\iscussed in this section.

2.3.1 Seismic Methodology Palisades performed a Level 1 PRA with a containment performance analysis to compete.the seismic IPEEE. The appropriate system fault trees and accident event trees from the IPE were used and modified, as necessary, for the SPRA. One additional seismic event tree was created to complete the SPRA model. The fault and event trees were quantified using Logic Analysts SETS computer code (Ref. 2-7), Core damage quantification was performed using the J. R.

Benjamin SHIP computer code (Ref. 2-8). Palisades used the seismic hazard ~urves developed by the Lawrence Livermore National Laboratory (LLNL) in NUREG/CR-:1488 (Ref. 2-9) to calculate the seismic results.

2.3.2 Fire Methodology The EPRI Fire-Induced Vulnerability Exammation (FIVE) methodology (Ref. 2-10) was used

• for the fire IPEEE analysis. An abbreviated, Level 1 fire PRA model was developed and_ used to provide the core damage frequencies for the FIVE methodology.

2.3.3 Other External Events High winds, floods, transportation and nearby facility accidents, and external fires were included in the external event analysis. The methodology for identifying external events is

• consistent with the approach described in NUREG-1407 (Ref. 2-:6). The methodology for analyzing these external events used a progressive screening approach consistent with that described in NUREG-1407.

I

• 2-3

• • 2A Information Assembly System requirements and containment building information used in the IPEEE was taken from the IPE analysis (Ref. 2-11). In general, the IPE used the FSAR or identified alternate analyses, and utilized the plant procedures and drawings. Plant walkdowns were performed in the IPE to obtain the as-built configuration. Plant walkdowns were performed to obtain plant information relating to the IPEEE analyses. Differences between the IPE and the IPEEE are discussed in the seismic, fire and other external events sections .

• 2-4

• 2.5 References 2-1 SECY 88-147, .Integration Plans for Closure of Severe Accident Issues, May 25, 1988 2-2 NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CPR 50.54(t), November 1988 2-3 NRC Generic Letter 88-20, Supplement 1, Initiation of the Individual Plant

• Examination for Severe Accidents Vulnerabilities - 10 CPR 50.54 (t), August 1989 2-4 NRC Generic Letter 88-20, Supplement 3, Completion of Containment Performance Improvement Programs and Forwarding of Insights for use in the Individual Plant Examination for Severe Accident Vulnerabilities, June 1990 2-5 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(t), April 1991 2-6 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities

- *. 2-7 2-8

• Set Equation Transformation System (SETS) Program, Developed by Logic Analysts,

_Inc.

Seismic Hazard Integration Package (SHIP) Program, Developed by Jack R. Benjamin and Associates, Inc.

2-9 NUREG/CR-1488, Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains 2-10 EPRI Report, Fire-Induced Vulnerability Evaluation (FIVE), April 1992 2-11 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992

• 2-5

• 3.1 Summary TABLE OF CONTENTS SECTION 3.0 SEISMIC ANALYSIS 3-2 3.2 Seismic Hazard Analysis 3-4 3.3 Review of Plant Information and Walkdown 3-6 3.4 Plant Systems and Structures 3-9 3.5 Evaluation of Component Fragilities and Failure Modes _ 3-23 3.6 SPRA Modelling and Results 3-44 3.7 Containment Performance 3-67 3.8 Conclusions 3-78 3.9 Other Seismic Safety Issues 3-80 3.10 References 3-83

Table of Contents Section 3.1 Summary 3.1.1 Background 3-2 3.1.2 Plant Familiarization 3-2 3.1.3 Methodology Description 3-2 3.1.4 Summary of Major Findings 3-3

• 3-1

3.1 Summary

• 3.1.1 Background The Palisades IPE (Ref. 3-10) evaluated the effects of core damage frequency and plant response following internally initiated events. The NRC has recognized that externally initiated events may contribute as much or more to the core damage frequency as the internally

. initiated events. One of the major external events is earthquakes. Even though Palisades is designed to withstand a credible earthquake, the impact on the overall plant response and risk profile of beyond design basis earthquakes may differ. The seismic IPEEE helps to understand the plant response and risk associated with all magnitudes of earthquakes, including those beyond the design basis.

• 3.1.2 Plant Familiarization Palisades Nuclear Power Plant is designed to withstand the effects of unusual natural phenomena including earthquakes. The plant was designed to withstand a design basis event (DBE) earthquake (also known as a safe shutdown earthquake [SSE]) with a peak ground acceleration (PGA) of 0.20 g (20% of gravity)(Ref. 3-11). The operating basis earthquake (QBE) is one-half of the DBE event.

3.1.3 Methodology Description

• The methodology used in the Palisades SPRA is consistent with NUREG-1407 (Ref. 3-14)

. guidance for a new SPRA analysis. The SPRA used and modified the existing level 1 PRA developed for the IPE. A seismic event tree (Fig. 3.6-1) was developed that provided a transition to the existing PRA fault and event trees. The SPRA modified the PRA in such a way that the independent subtrees of the internal events PRA were maintained so that the results of each are compatible and directly comparable. Also, a containment performance analysis was performed that used the containment performance data from the IPE and modified it; as appropriate, to include the seismic level 1 PRA results.

The seismic analysis was performed in two parts: 1) quantification of the seismic fault trees and event trees using point estimates for the fragility values; and 2) integration of the plant cutsets with the mean seismic hazard curve and component fragilities to obtain an estimate of the seismic core damage frequency and plant level fragility.

The logic models for the SPRA included seismic failures, random failures and operator actions. To produce an initial cutset equation for integration with the hazard curves and component fragilities, seismic failure rates were estimated using the component fragility for a

.6g earthquake level. This earthquake level was chosen because it is higher than the expected plant median fragility and provides a high failure rate for seismic components so that important seismic components are not screened out.(truncated). The random failure rates were the same

• 3-2

as the random failure rates for the IPE since an earthquake does not affect the random failure rates of a component, and seismic basic events were used to represent earthquake failures. To produce the cutset equation, all post-accident human error probabilities (HEPs) were set to 1. 0 so that important operator actions were not screened out (truncated).

The cutsets from the seismic event tree were used as input into the seismic integration program. This integration used the seismic hazard curve to assess the core damage frequency at various seismic ground accelerations. The failure rates of the seismic components and the HEPs were changed to reflect the various ground accelerations. This was accomplished by replacing the point value probability with a fragility. The seismic structures and components used the fragility value assigned them in the fragility analysis. The HEPs were assigned a -*

non-lognormal fragility as discussed in Section 3.6.5.2.2.

3.1.4 S~ary of Major Findings The results of the SPRA confirm the seismic ruggedness of Palisades. The high confidence of a low probability of failure (HCLPF) for Palisades is .217g. HCLPF is defined as less than a 5 3 failure probability on the 95 3 confidence curve. The plant HCLPF is higher than the plant design basis of .20g. No significant seismic concerns were identified as a result of the seismic PRA .

• 3-3

3.2 Seismic Hazard Analysis The Palisades Seismic PRA implements the mean seismic hazard estimate published by the Lawrence Livermore National Laboratory (LLNL) in NUREG/CR-1488 (Ref. 3-1). This NUREG has been reviewed and accepted by the NRC as the best available information on seismic hazard estimates as discussed in NRC Iiiformation Notice 94-32 (Ref. 3-2). Fragilities were based on the median spectral shape for a 10,000 year return period provided in NUREG/CR-1488. Since the Palisades SPRA relied on a published hazard curve, the details of the development of the hazard curve are not presented in this report. This hazard curve provides probabilities for ground motion levels from 0.05lg through l.02g.

- I

• 3-4

• Table of Contents Section 3.3 Review of Plant Information and W alkdown 3.3.1 Plant Information 3-6 3.3.2 Information Sources 3-6 3.3.3 Plant Walk.down 3-7

• 3-5

3.3 Review of Plant Information and Walkdowns 3.3.1 Plant Information The Palisades site is a soil site with the safety-related power block structures founded on dense sands and stiff to very stiff silty clay to an approximate depth of 150 feet. The original dynamic building analyses considered the effects of the soil by use of so-called elastic half space soil springs coupled to the fixed base structural models. As part of the SPRA investigation, the original dynamic building models were used in a modem soil-structure interaction analysis. This analysis obtained amplified floor response spectra (FRS) for the Lawrence Livermore National Laboratory (LLNL) (Ref. 3-1) median ground spectral shape corresponding to the 10,000 year return period for the containment and auxiliary buildings.

The remaining site buildings included in the SPRA and housing vital equipment - the Intake Structure, Auxiliary Feedwater Pump Room, and some portions of the Turbine Building - are mostly below grade or at grade. For these buildings, the ground spectrum was used.

The structures and components that were used in the IPE were used in the SPRA. The SPRA model was created by modifying the IPE to remove dependence on the instrument air system (non-safety related in the turbine building), which was conservatively assumed to fail in all seismic events. The use of nitrogen as a backup to instrument a:ir was included in the SPRA model. The structures and components remaining were included in the SPRA analysis.

• 3.3.2 . Information Sources The Palisades Final Safety Analysis Report (FSAR) was used to obtain seismic design criteria for the DBE earthquake and identify those structures and components that are seismically designed. The safety-related power block structures were originally evaluated by Bechtel Corporation, the Architect-Engineering firm responsible for the Palisades design.

The existing seismic evaluations of the safety-related piping and mechanical and electrical equipment were primarily found in the Palisades project engineering files originally developed by the Architect-Engineering firm. Safety related piping was re-evaluated in accordance with requirements set forth in NRC Information Notice 79-14 (Ref. 3-3) piping seismic analysis program. This effort evaluated piping in the as-built configuration in accordance with then-current seismic-dynamic analysis procedures. Piping stress summaries and* equipment stress analyses were obtained from these files. As-built and original installation drawings were used to obtain routing, equipment weights, and anchorage details.

Original site soil properties, which formed the basis for the study, were obtained from a geological study using soil borings of the Palisades plant site from studies performed by Bechtel Corporation (Ref. 3-4) .

• 3-6

• • Much of the methodology of the seismic fragility program was based on the procedures described in EPRI Report NP-6041 (Ref. 3-5) which establishes bases for seismic binning and screening of nuclear power plant equipment, mechanical and electrical distribution systems, and power block structures. A great deal of the basis for the procedures in NP-6041 rests on the Generic Implementation Procedures (GIP) (Ref. 3-6) developed for resolution of the USI A-46 issue. Other supporting documentation for the GIP and NP-6041 that is used for Palisades include EPRI Reports NP-5228 (Ref. 3-7) for anchorage issues, NP-7146 (Ref. 3-8) for electrical cabinet amplification characteristics, and NP-7147 (Ref. 3-9) for relay generic seismic ruggedness levels.

3.3.3 Plant Walk.downs .*..-.

The Palisades SPRA took advantage of the overlapping requirements between the IPEEE and USI A-46 programs. Seismic Review Teams (SRT) conducted the Palisades SPRA walkdowns following the walkdown procedures detailed in EPRI NP-6041 (Ref. 3-5). Each team consisted of two Seismic Review Engineers trained by EPRI both in the A-46 walkdown requirements and also in the IPEEE add-on requirements.

Consumers Power (CPCO) and Stevenson & Associates (S&A) supplied the Seismic Review Engineers for the walkdown teams. The majority of the walkdowns were conducted in July 1993 and August 1993. Subsequent walkdowns took place in April 1994, May 1994, July 1994, and March 1995, to complete all of the walkdown assessments .

Specific walkdowns were conducted to evaluate components. For the sake of documentation, all components were treated as if they were A-46 items, even if they were designated as SPRA items only. As such, each component item has a Screening Evaluation Worksheet (SEWS) completed for it in accordance with GIP requirements as well as a fragility value assigned to it.

Safety-related piping, electrical raceways and ductwork were walked down separately to assess fragility capabilities. Essential relays were evaluated based on the relay review and circuit analyses performed by the Palisades USI A-46 program (Ref. 3-25). For relays that were not part of the USI A-46 safe shutdown equipment list (SSEL) but in the SPRA, the USI A-46 screening criteria were used. This consisted of identifying low ruggedness relays in systems that were not chatter acceptable (as identified by USI A-46). In accordance with GIP rules, spot checks were made throughout performance of the walkdowns to confirm type (model number and manufacturer), location and installation adequacy. Structural screening walkdowns were conducted. to assess the primary site structures and determine buildfug fragilities.

An independent peer review was conducted by Drs. R. P. Kennedy (RPK) and J. D. Stevenson (S&A) to review the seismic screening and assessment performed by the walkdown teams.

The peer review concluded that the effort is being accomplished in a professional and highly competent manner .

• 3-7

• Table of Contents Section 3.4 Plant Systems and Structures 3.4.1 Front Line Systems Included in the SPRA 3-9 3.4.1.1 Reactivity Control 3-9 3.4.1.2 Primary System/Core Heat Removal 3-10 3.4.1.3 Primary System Inventory Control 3-12 3.4.1.4 Containment Heat Removal 3-12 3.4.2 Support Systems Included in the SPRA 3-13 3.4.3 Supporting Components Included in the SPRA 3-16 3.4.4 Site Buildings Included in the SPRA 3-17 3.4.5 Structural Response 3-18 3.4.6 Soil Properties and Soil Failure Analysis 3-19

• 3.4.7 Tables for Plant Systems and Structures 3-20

• 3-8

• 3.4 Plant Systems and Structures This section discusses the development of the plant systems, structures and components considered in the SPRA. The systems used in the SPRA along with the components supporting them are presented. Structures containing these systems are identified and their seismic response characteristics are also discussed. Finally; site soil conditions and soil stability are presented in this section.

3.4.1 Front Line Systems Included in the SPRA The front line systems required for mitigating the consequences of a seismic event are a subset of the front line systems that were used in the IPE (Ref. 3-10). The IPE contains the front line -**

system descriptions and fault tree development. Success or failure of the front line systems directly impacts the accident progression. The front line syste,ms are usually event tree headings or referenced as part of an event tree heading definition. The front line systems directly support one of the general functional areas: 1) reactivity control; 2) primary system/core heat removal; 3) primary system inventory control; or 4) containment heat removal.

Each of the front line systems has a fault tree. Multiple top events (success criteria) may be present if the front line system provides multiple functions. Fault trees from*the internal events PRA were reviewed and modified, as necessary, for use in the SPRA. Changes to the IPE fault trees include recent plantmodifications and insertion of seismic events. Table 3.4-1 contains a list of the front line systems used in the SPRA.

3.4.1.1 Reactivity Control An important safety function in response to any plant transient is reactivity control. The systems required for successful reactivity control are control rod drives (CRDs), reactor protection system (RPS), and the charging system.

Control Rod Drives (CRDs)

The primary method for bringing the reactor to a subcritical state is through automatic or manual control rod insertion. Automatic rod insertion occurs as a result of a trip signal generated from the RPS, which disrupts power to the CRDs. Successful control rod insertion rapidly reduces reactor power to decay heat levels.

Reactor Protection System (RPS)

The RPS consists of four independently powered trains of logic circuitry that monitor key plant parameters to detect an off-normal condition. An automatic trip signal is generated if two of

• 3-9

• four values of a monitored parameter reach a specified setpoint. There are nine plant parameters monitored by the RPS.

Charging System If control rod insertion is not successful, then long term reactivity control is accomplished by injecting concentrated boric acid into the primary system via the charging system. The system is designed such that any one of the three charging pumps can provide sufficient boron to reduce the reactor power to decay heat levels. The boric acid storage tanks are used as the suction source for the ch,arging system for reactivity control.

• 3.4.1.2 PCS/Core Heat Removal Primary Coolant System (PCS)/Core Heat Removal is a critical safety function that provides a means for removing the core decay heat following a reactor trip. Decay heat absorbed by the PCS must be removed to effectively co11trol PCS temperature and pressure. There are two primary methods for removing PCS decay removal: secondary cooling and core once through cooling (OTC).

Secondary cooling in the SPRA is accomplished by removing PCS decay via the steam generators and the Auxiliary Feedwater (AFW) System. Successful secondary cooling requires

• a pathway for steam release. The preferred method for steam release is the Turbine Bypass Valve (TBV) or the Atmospheric Dump Valves (ADVs). The SPRA does not consider the use of the alternate secondary cooling method of low pressure feed using the condensate pumps as in the IPE. Most of the low pressure feed equipment is located in the turbine buildingt which is a non-seismic structure. Also, this equipment is powered from non-lE buses. With a relatively high potential for loss of off-site power, the equipment is assumed to be unavailable following a seismic event.

Emergency procedures specify that OTC be initiated whenever secondary cooling is not successful at core decay heat removal. OTC requires the operator to: 1) depressurize the PCS using the Power Operated Relief Valves (PORVs); 2) initiate and verify adequate High Pressure Safety Injection (HPSI) flow to replenish coolant losses out the PORVs; and 3) verify successful recirculation from the containment sump upon depletion of the Safety Injection and Refueling Water Tank (SIRWT).

The following front line systems support PCS/core heat removal.

Auxiliary Feedwater (AFW)

The emergency design function of the AFW system is to provide heat removal for the PCS when the main feedwater system is unavailable. The AFW system provides feedwater to the secondary side of the steam generators. Water from any of the three AFW pumps can feed 3-10

either steam generator. Successful secondary cooling via AFW is flow from at least one pump to at least one steam generator. The AFW system consists of two motor-driven and one steam-driven pumps. Each of the two vital AC busses supplies power to one of the motor-driven AFW pumps. Steam for the steam-driven AFW pump is automatically supplied from the B steam gep.erator and can be manually supplied from the A steam generator.

Turbine Bypass Valve (TBV)/Atmospheric Dump Valves (ADVs)

The TBV exhausts directly to the main condenser. The TBV will not be available in cases where the Main Steam Isolation Valves (MSIVs) are closed or loss of off-site power occurs.

The capacity of the TBV is 5% of full power steam flow. There are four ADVs that automatically exhaust to the outside atmosphere, two ADVs on each steam generator. The total capacity of the ADVs is 30% of full power steam flow. All five valves are normally in the automatic mode with the capability of manual control from the control room. The four*

ADVs also have the capability to be manually controlled from the engineered safeguards control panel. Besides opening to relive decay heat, the ADVs are required to close to maintain steam pressure to supply the turbine driven AFW pump. The SPRA assumes that if an ADV fails to close, steam generator depressurization occurs and that the operator will respond to this excessive demand event by isolating AFW flow to the affected steam generator.

Power Operated Relief Valves (PORVs)

• The PORVs provide the PCS heat removal path when OTC is initiated. Without a heat removal path, OTC would not be successful. There are two PORVs designed to relieve sufficient PCS inventory to protect the PCS from overpressurization during abnormal transients. The PORVs are solenoid operated power relief valves located in parallel lines off_

the top of the pressurizer. These lines exhaust to a relief line that discharges to the quench tank. A motor operated isolation valve (block valve) is located in each PORV line. Both the power operated solenoid valves and the motor operated block valves are powered from safety busses. The plant operates with the PORVs and the block valves normally closed. Operation of the PORVs for OTC requires opening the block valves and the PORVs. Operation of the block valves requires the operator to supply power to the block valves by closing breakers in the cable spreading room and operating a control switch in the control room. Operation of the PORVs requires the operators to turn a control switch in the control room. Successful operation of the PORVs is opening at least one train (one PORV and its block valve).

High Pressure Safety Injection (HPSI)

Initiation of OTC requires PCS inventory control beyond the capability of the charging system.

The HPSI system provides this inventory control dllrlng OTC. The HPSI system provides borated water from the SIRWT. Upon depletion of the water in the SIRWT, suction is automatically switched over to the containment sump. Manual alignment of the containment sump is available from the control room upon failure of the automatic switchover function .

• 3-11

There are two motor-driven HPSI pumps. Each pump is powered from a different safety bus.

• Successful HPSI is operation of at least one pump during injection from the SIRWT and the operation of at least one pump, the engineered safeguards room coolers, HPSI pump cooling and successful transfer of pump suction to the containment sump during the recirculation phase.

3.4.1.3 PCS Inventory Control The principle medium used for core decay heat removal is the PCS liquid inventory.

Therefore, it is important to maintain adequate PCS inventory for successful core decay heat removal. During normal reactor shutdowns, the charging system is used to maintain the PCS inventory due to cooldown and shrinkage. The charging system cannot maintain sufficient PCS inventory during OTC. Therefore, the SPRA relies on the HPSI system to maintain sufficient PCS inventory for successful core decay heat removal. There are two modes of operation for successful PCS inventory control using HPSI: 1) injection from the SIRWT; and

2) recirculation from the containment sump. The HPSI system, both injection and recirculation, are discussed in Section 3 .4 .1. 2.

. 3.4.1.4 Containment Heat Removal OTC results in energy release into the containment, which leads to higher containment temperature and pressure. To maintain containment pressure below design limits and guard against excessive temperatures, adequate heat removal must be provided. Containment heat removal is accomplished by using the Containment Air Coolers (CACs) or the Containment Spray (CS) System. Successful containment heat removal is operation of one CAC train or one CS pump.

Containment Air Cooler (CAC) System The CAC system is designed to limit the containment building pressure rise and reduce the leakage of airborne radioactivity by providing a means of cooling the containment atmosphere.

Success of the CAC system is operation of one train. There are four trains or cooling units located in the containment building. Only three of them are safety related and used during accident scenarios. Successful operation of a cooling units is: 1) having at least the accident rated fan remain on; and 2) have the high capacity discharge service water valve open.

Success also requires that the Service Water System is operational.

Containment Spray (CS) System The CS system is designed to remove heat and condense vapor from the containment atmosphere during accident conditions. The CS system pumps borated SIRWT water or cooled containment sump recirculated water into the containment atmosphere as a spray. The sump. water is pumped through the shutdown cooling heat exchangers, which is cooled by the

• . 3-12

Component Cooling Water (CCW) System, to remove the heat from the containment. The CS water is discharged into the containment through spray headers and nozzles. The spray headers are supported from the roof trusses and the nozzles are arranged to provide complete spray coverage of the containment cross-section. There are three CS pumps. Two are powered from the same safety bus and the third is powered from the other safety bus. Success of the CS system requires operation of one pump and its associated header and nozzles along with one shutdown cooling heat exchanger.

3.4.2 Support Systems Included in the SPRA The support systems required for the SPRA are a subset of the support systems that were used in the IPE (Ref. 3-10). The IPE contains the support system descriptions and fault tree development. Support systems are required for the proper operation of the front line systems.

The support systems are used as inputs into the front line systems.

Each of the support systems has a fault tree. Multiple top events (success criteria) may be present if the support system provides multiple functions. The IPE fault trees were reviewed and modified, as necessary, for use in the SPRA. Table 3.4-2 contains a list of the support systems used in the SPRA.

Actuating Relays

• The actuating relays are comprised of four groups that initiate various safety functions. The actuating relays have two separate trains that initiate their respective safety train. The four relay groups are:

1) containment high pressure (CHP) relays which trip the reactor, actuate the SIS relays, initiate containment spray and initiate containment isolation;

2) safety injection system initiation (SIS) relays which provide a signal to valves and actuate either the SIS-X or the DBA relays;

3) safety injection system actuation (SIS-X) relays which provide an initiation signal to all safety injection equipment if off-site power is available; and

4) design basis accident (DBA) or shutdown sequencers which provide a timed, sequenced initiation signal to all safety injection equipment when off-site power is lost and emergency power is available.

Component Cooling Water (CCW)

The CCW system is designed to cool components carrying radioactive and potentially radioactive fluids. It provides a monitored intermediate barrier between these fluids and the

• 3-13

• service water system which uses Lake Michigan water as its cooling medium. The CCW system is closed loop consisting of three half-capacity motor-driven pumps and two half-capacity heat exchangers. The CCW system is continuously monitored to detect radioactivity that may leak into the system.

Condensate Storage Tank (CST)

The CST (T-2) provides two services: 1) makeup to and surge capacity for the main condenser; and 2) AFW pump suction. The CST is an outdoor tank with an approximate capacity of 126,000 gallons. Technical Specifications require 100,000 gallons between the CST and the primary system makeup tank (PSMT). The low level setpoint for the CST is around 60,000 gallons, which is sufficient to accommodate approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of decay heat removal. Manual makeup to the CST is supplied by the PSMT (T-81, 75,000 gallons) or the demineralized water storage tank (T-939, 300,000 gallons). Makeup to the CST from these tanks requires operation of transfer pumps that rely on off-site power. If off-site power is lost, the operators can cool the primary system by initiating shutdown cooling prior to CST depletion or provide alternate suction for tije AFW pumps. Alternate suction for the AFW pumps can be provided by the fire protection system (FPS). Additionally, alternate suction for P-8C can be provided by the SWS.

Electrical Distribution System

• The electrical distribution system is designed to supply and power plant components during start-up, power operations, shutdown and emergency operations. The electrical distribution system uses two emergency diesel generators to provide a dependable on-site power source capable of starting and supplying essential loads to safely shutdown and maintain shutdown of the plant. Reliability of the emergency power is assured by the two-channel concept where independent electrical controls and sources of power supply redundant AC and DC engineered safeguards loads.

Fire Protection System (FPS)

The FPS is included in the SPRA for two of its capabilities: 1) backup AFW pump suction supply; and 2) backup/cross-tie to the critical service water system. The FPS consists of two diesel-driven pumps and one motor-driven pump. Each of the diesel motors has its own diesel .

tank and starting circuits.

The backup supply to the AFW system provides direct suction water to the AFW pumps P-8 A&B, and indirect suction (via the CST) to P-8C. The FPS line is connected to the P-8 A&B suction header through two, hand-operated valves in series and underground piping. This cross-tie line is connected to the fire protection ring header .

• 3-14

• The FPS backup to service water is via separate, tornado protected lines, with a manual valve to each of the critical service water headers. These cross-tie lines are connected to the fire protection ring header.

HV AC to the Engineered Safeguards Systems (ESS) Rooms This system provides cooling for the protection of the engineered safeguards (ES) equipment.

Each ES room has redundant fans to maintain suitable service conditions for the equipment inside the rooms. Each room consists of one cooling train. Each cooling train has a cooling unit, two fans (each with its own damper), and a connection to the service water system. Each train of fans is powered from a different emergency power bus. Room cooling is automatically actuated via temperature detectors in the room.

High Pressure Air (HPA)

The HPA system provides high pressure air for cylinder-operated valves in the ES rooms, principally, the suction valves for the ESS pumps. There are three trains of HP A that are normally separated. These three trains can be cross-tied in an emergency. The HP A system air receivers are designed with enough capacity to allow each valve to stroke in one direction with the air compressors unavailable.

Main Conde~er ..

The main condenser is used to condense the steam from the steam generators flowing through the turbine bypass valve (TBV). Without the main condenser, the TBV could not be used as a steam release path from the steam generators. The circulating water system is the closed cooling system for the mairi condenser that is required to maintain condenser vacuum and transfer heat to the cooling towers. The main condenser is not available following loss of off-site power.

Service Water System (SWS)

The SWS is designed to supply Lake Michigan water (ultimate heat sink) for removal of waste heat from the plant during start-up, power operation, shutdown and emergency conditions.

The SWS is divided into two critical and one non-critical headers. The SPRA models isolation of the non-critical header and operation of the two critical headers. The SWS consists of three motor-driven pumps: two powered from the same safeguards bus and one from the other safeguards bus. Each pump discharges into a header where each of the critical headers can be fed from. Therefore, any pump can supply water to either critical header.

The SWS can also be used to provide suction water to the AFW pump P-8C following depletion of the CST.

• 3-15

Safety Injection and Refueling Water (SIR~) Tank and Containment Sump

• The SIRW tank contains a minimum of 250,000 gallons of borated water. This is sufficient to provide a shutdown margin of 5 % with all control rods withdrawn and a new core. The tank has two full-capacity discharge lines that feed the two trains of engineered safeguards equipment. Upon reaching a low SIRW tank level, a recirculation actuation signal is generated which switches the engineered safeguards equipment suction from the SIRW tank to the containment sump.

The containment sump is located directly below the reactor cavity at the lowest elevation of the containment building. This allows any water in the containment to be collected in the sump for recirculation. Upon recirculation, the engineered safeguards equipment uses the sump as the source of water for injection. There are two full-capacity lines that feed the two trains of engineered safeguards equipment. Sump water is cooled by the engineered safeguards system by the shutdown cooling heat exchangers.

Containment Isolation System (CIS)

The CIS is designed to minimize the release of radioactivity from the containment to the atmosphere following an accident. Isolation valves are provided in all process systems that penetrate the containment. Electrical penetration also provide containment building isolation while allowing electrical power to be fed*inside the containment. The CIS valves are repositioned upon a CIS actuation signal which is initiated by a containment high pressure or high radiation. -

Reactor Cavity Flooding (RCF) System The reactor vessel is located within a concrete cavity which has a network of floor drain piping feeding into it. This piping is designed to collect and transport a portion of the containment spray water into the reactor cavity. This water floods the reactor cavity and cools the outside of the reactor vessel. This system is not modelled in core damage sequences, but is used in the conta.inment performance and consequence analyses.

3.4.3 Supporting Components Included in the SPRA Several components were included in the SPRA for their seismic capacity and impact on the plant following a seismic event. Palisades specific components include: piping; electrical raceways and HVAC ducting.

Piping Numerous systems were identified as being considered in the SPRA. These systems were reviewed to determine if the mechanical piping is seismically designed. Seismically designed

• 3-16

piping at Palisades can be screened out at a relatively high value of acceleration as discussed in

• Section 3.5.2.3.1. As part of the IPEEE walkdown, a candidate piping system was walked down from end-to-end to verify design adequacy. Piping inertial failure is generally not the issue, rather inadequate piping system flexibility and excessive relative support deflections are more likely contributors to seismically induced failures. Specific items which could diminish seismic capacity include:

threaded or Victualic connections cast iron pipe inflexibly attached branch lines excessive nozzle loads proximity of valve operators to structures, components and other systems poor supports lack of flexibility across seismic gaps The service water and main steam lines were walked down in detail. Also, in general, other piping systems were observed during the course of the walkdowns for these concerns.

Electrical Raceways The electrical raceways at Palisades were inspected in detail. All areas were walked down in accordance with the guidance of Section 8 of the GIP (Ref. 3-6). All walkdowns were documented in Plant Area Summary Sheets (PASS) and representative, bounding support hangers were selected for ductility and load capacity evaluations referred to as limited analytical reviews.

HVAC Ducting Ductwork was inspected, in general, throughout the site buildings. The major concern in these inspections is anchorage adequacy and support details, such as no missing bolts or connections.

As noted, all areas were generally inspected. Particular attention was given to ducting in two areas: 1) inside containment; and 2) inside the battery rooms where collapse could short circuit the emergency station batteries.

3.4.4 Site Buildings Included in the SPRA All buildings which contain either SPRA front line systems, support systems or supporting components are also included in the SPRA. A site walkdown of the structures was performed by Stevenson & Associates (S&A). The buildings included in the assessment walkdown were:

Containment Structure and its Internals Auxiliary Building Auxiliary Feedwater Pump Room

• 3-17

-* Turbine Building Intake Structure The evaluations were made in accordance with NP-6041, Table 2-3 (Ref. 3-5). Field walkdowns supported by a thorough review of the Palisades FSAR (Ref. 3-11), seismic stress evaluations by Blume (Ref. 3-12), and design calculationS generated by the Palisades Architect-Engineer, Bechtel (Ref. 3-4).

3.4.5 Structural Response The original design basis earthquake (DBE) or safe shutdown earthquake (SSE) seismic analysis floor response spectra (FRS) at the Palisades site is based on simple dynamic models and soil springs, with peak input ground acceleration of 0.20g. The IPEEE seismic motion of interest for the SPRA would necessarily be well in excess of the design basis PGA. Given the availability of advanced Soil-Structural-Interaction (SSI) analysis techniques, and that the analysis for IPEEE should be as realistic as possible, the FRS were developed using three-dimensional SSI analysis instead of scaling from the design basis response spectra.

The FRS generation and the soil structure interaction analysis were performed according to the requirements of the NRC Standard Review Plan (SRP) except:

(1) For the IPEEE input time history generation from the response spectrum, the time history does not envelope the prescribed response as required in the SRP. Instead, the time history matches the response spectra on average.

(2) The variation of soil shear modulus uses the recommendations provided by GEI Consultants for this project instead of the requirement in the SRP.

(3) The spectral amplitude of the horizontal acceleration response spectra in the free field at the foundation depth is not limited by the required 60% of the corresponding-design response spectra at the finished grade in the far field.

In cases where the SRP does not specify guidance, the performance of the SSI analysis relied on ASCE Standard 4-86 (Ref. 3-13).

Uniform hazard spectra were us~d for the seismic input. In accordance with the provisions of NUREG-1407 (Ref. 3-14), the median shape for the 10,000 year return period as provided by the Lawrence Livermore National Laboratory Revised Eastern Seismicity Report (Ref. 3-1) was used for this study. Structural damping for all modes was set to 7 % in accordance with the recommendation of NP-6041 (Ref. 3-5). The FRS for the 10,000 year median shape are provided in Appendix Sl of NP-6041.

Selection of Peak Ground Acceleration for SSI Analysis 3-18

• The exact PGA value used in the SSI analysis to generate the FRS required consideration of the likely range for the plant median fragility. The FRS generated by the SSI analysis is used to scale the component seismic capacity to the ground level PGA thereby establishing the median fragility level: If the SSI analysis were linear, the selection of the PGA would not matter because the ratio between the zero period acceleration (ZP A) of the FRS and the PGA would be constant. However, the SSI analysis process is non-linear due to the dependency of soil properties on shear strains. Scaling up inserts additional conservatism into a process seeking to realistically portray the seismic ruggedness of the plant. Thus, the selection of a single PGA for development of in-structure response spectra was an important decision. The input PGA level should be selected to match the range of acceleration levels that contribute most to the core melt frequency. However, this acceleration level is not known until the SPRA analysis is done. Therefore, it must be selected based on best judgment and expert opinion. After consultation with Dr. John W. Reed, the value selected was 0.4g. Results of the SPRA indicate that the highest contribution to core damage frequency occurs in the range of .35g to .45g PGA (Section 3.6.5.3.5).

3.4.6 Soil Properties and Soil Failure Analysis NUREG 1407 (Ref. 3-14) specifically requires the consideration of soil failure effects in the seismic IPEEE. Soil failure effects were considered from two perspectives: 1) soil liquefaction potential; and, 2) differential soil displacements under seismic conditions as an input to buried component fragilities .

The stratigraphy of the Palisades site consists of the following strata starting from the existing site grade of El. 589 feet: about 25 feet of dense, brown fine sand with a trace of medium sand and gravel (dune sand); about 20 feet of dense to very dense, gray fme sand that grades with depth to silt (fine sand/silt); about 15 feet of stiff, gray silty clay;90-100 feet of very stiff to hard silty clay and/or clayey silt with sand and gravel (glacial till); and 10-15 feet of weathered shale followed by unweathered shale. The surface of the weathered shale is at about El. 440 feet.

GEi (Ref. 3-16) estimated the shear wave velocities and reported best estimate shear wave velocities of the dune sand and gray fme sand/silt as 750 fps and 900 fps, respectively. The clay stratum shear wave velocity was estimated at 1000 fps. The lower till strata estimated shear wave velocities range from 1400 to 1800 fps from the upper to lower (deeper) part of the overall till stratum. The shale's shear wave velocity was estimated to be 9500 fps .

• 3-19

3.4.7 Tables for Plant Systems and Structures Table 3.4-1 List of Front Line Systems Used in the SPRA I ACRONYM I FRONT LlNE SYSTEM I

ADV/TBV Atmospheric Dump Valves/Turbine Bypass Valve AFW Auxiliary Feedwater System CAC Containment Air Coolers CHRG Charging System

• CRD cs Control Rod Drives Containment Spray System HPSI High Pressure Safety Injection PORV Power Operated Relief Valves RPS Reactor Protection System

• 3-20

• Table 3.4-2 List of Support Systems Used in the SPRA IACRONYM I SUPPORT SYSTEM I

ARS Actuating Relay System ccw Component Cooling Water System CIS Containment Isolation System CST Condensate Storage Tanlc EDS Electrical Distribution System

• FPS HPA Fire Protection System High Pressure Air HVAC-ESS HVAC - Engineered Safeguards System MC Main Condenser RCF Reactor Cavity Flood System SIRWT Safety Injection and Refueling Water Tanlc sws Service Water System

• 3-21

• Table of Contents Section 3.5 Evaluation of Component Fragilities and Failure Modes 3.5.1 Screening Criteria 3-23 3.5.1.1 Component Screening 3-23 3.5.1.2 Relay Screening 3-24 3.5.1.3 Structural Screening 3-24 3.5.1.4 Potential Seismic Interaction Screening 3-24 3.5.2 Fragility Analysis Results 3-25 3.5.2.1 Simplified Fragility Analysis Methodology 3-25 3.5.2.2 Detailed Fragility Analysis Methodology 3-26 3.5.2.3 Fragility Evaluation Results 3-26 3.5.2.3.1 Screened Components 3-26 3.5.2.3.2 Detailed Fragilities 3-31 3.5.2.3.3 Seismically Induced Initiators 3-32

• 3.5.3 Surrogate Fragility 3.5.4 Tables for Component Fragilities and Failure Modes 3-35 3-36

• 3-22

• 3.5 Evaluation of Component Fragilities and Failure Modes The development of fragility values for components and structures in the Palisades SPRA proceeded through a three phase process: 1) component screening; 2) simplified fragility analysis; and, 3) detailed fragility analysis. This three phase consideration of the seismic ruggedness of plant components and structures efficiently ~oncentrated attention on those items most significant to the overall assessment of seismic risk.

All equipment was screened using the first and second columns in Table 2-3 in EPRI Report NP-6041 (Ref. 3-5). The screening approach utilizes the experience gained in performing seismic margin assessments (SMAs) to screen components out of a SPRA. Meeting the caveats for these components ensures that they may be assigned a fragility with a median peak 5-percent damped spectral acceleration capacity of l.8g or l.2g - which are equivalent to l .08g (.5g HCLPF) or 0. 7g (.3g HCLPF) PGA, respectively - with a combined logarithmic standard deviation, be, value of 0.30. Equipment not screened in one of these two screening lanes was assigned a fragility with a median peak spectral acceleration capacity of 0.4g, equivalent to 0.22g (.lg HCLPF) PGA, with a combined logarithmic standard deviation, be, value of 0.30.

The potential for seismic interaction hazards resulted in specific seismic failure events modelled in the SPRA. Thus, the individual component fragilities represented the inherent seismic ruggedness of the components, independent of any seismic interaction hazards. The fragility of the interaction hazard, such as a masonry block wall, applied to the hazard as an independent component. This interaction component was associated with the failure of the affected components. Section 3. 5 .1. 4 discusses the screening of the potential seismic interaction hazards.

3.5.1 Screening Criteria All components, structures and potential interaction hazards received a walkdown to provide a screening value. This screening value was used to identify how to incorporate the various items into the SPRA.

3.5.1.1 Component Screening During the de~ed plant walkdowns, the SRT engineers assigned a screening value to every component in the SPRA. EPRI NP-6041 (Ref. 3-5) supplied the framework for the screening decision making. Although the seismic margins procedure characterizes seismic ruggedness as high confidence of a low probability of failure (HCLPF), the direct relationship between HCLPF and median fragility supports the use of tllls reference in performing SPRA component fragility screening .

• 3-23

• Application of the screening* guidelines to SPRA items resulted in the following categories:

1) screened out at the l.2g screening level;

2) screened out at the 0.8g screening level, but does not meet the l .2g criteria;

3) does not meet the 0.8g screening criteria, but the item is also in the A-46 program and meets design basis;

4) does not meet the 0.8g screening criteria, and the item is not in the A-46 program.

Follow up anchorage analysis verified inclusion at either screening level, or produced a fragility value for individual components.

~**

Based on the results of the walkdowns, all components meeting the first screening level were screened out, and the balance were explicitly considered within the SPRA. All screened out components were represented by a single surrogate element in the SPRA.

The Surrogate Element The SPRA included a single surrogate element representing the aggregate effect of all screened out components. The surrogate element appears as a top heading in the seismic event tree with failure leading directly to core damage.

3.5.1.2 Relay Screening The USI A-46 program at Palisades (Ref. 3-25) performed a relay chatter evaluation. The relay. evaluation was performed in accordance with Section of the GIP (Ref. 3-6). Since bad actor relays were identified as a result of the USI A-46 relay review, a relay review was performed for those systems/relays that are in the SPRA but not in the USI A-46 scope. The SPRA. included specific seismic modelling for each bad actor relay identified as a result of either review. Those relays that were not identified as bad actors were screened out and were explicitly modelled in the SPRA.

3.5.1.3 Structure Screening There are five structures included in the SPRA: .1) reactor building (containment building); 2) auxiliary building (AB); 3) turbine building (TB); 4) AFW pump room; and 5) intake structure (screenhouse). The containment building, AB and AFW pump room are seismically designed structures and screen out for inclusion in the surrogate element. However, the Palisades SPRA models the containment building and the AB as top headings in the seismic event tree. The TB and screenhouse did not meet the screening criteria for inclusion in the surrogate event and had simplified fragility analyses performed .

• 3-24

• 3.5.1.4 Potential Seismic Interaction Screening The only credible potential seismic interactions identified at Palisades were masonry block walls. The masonry block walls did not meet the screening criteria for inclusion in the surrogate event and had simplified fragility analyses performed.

3.5.2 Fragility Analysis Results The Palisades SPRA implemented the concept of simplified fragility analysis as a means to bridge the gap between the summary level of the screening methodology and detailed fragility analysis. This approach improves on the use of industry generic fragilities by including plant specific analysis in the determination of median seismic capacity.

3.5.2.1 Simplified Fragility Analysis Methodology Simplified fragility analysis concentrated on determining the median seismic capacity taking actual plant specific conditions into consideration. All simplified fragilities used the same value for an estimated combined uncertainty (bJ = 0.40. Techniques used in simplified fragility analysis included:

1) Detailed anchorage analysis;

2) Factoring analysis;

3) USI A-46 equivalency analysis; and,

4) Detailed stress analysis.

Anchorage considerations relied heavily on the availability of detailed and bounding analyses performed for components also within the USI A-46 examination program. For cases where the USI A-46 results were not available, the SPRA capacity assumed that components minimally met the USI A-46 requirements using equivalency analysis The SPRA treated the USI A-46 values as equivalent to a HCLPF for purposes of establishing median capacity

. fragilities.

Factoring analysis converted available design analysis results to median capacity fragilities substituting the IPEEE in-structure floor spectra for the existing design spectra as applicable.

Factoring separates out the seismic component from other design loads, such as dead load and live load, following the methodology outlined in EPRI NP-6041 (Ref. 3-5).

The availability of IPEEE in-structure floor spectra reflecting the favorable impact of soil structure interaction analysis made the simplified fragility aruuysis concept a productive intermediate step for this SPRA. In general, conservative assumptions of seismic capacity.

yielded attractive seismic fragility values. Component capacity values came from one of the following sources:

• 3-25

1) Available calculations, or reports of previous seismic analysis and tests;

• 2) 3)

4) 5)

Detailed anchorage analysis performed for the SPRA floor spectra; Generic Equipment Ruggedness Spectra (GERS);

Application of the lower EPRI NP-6041 screening lane (0.8g); or Equivalency to the minimum GIP demand (A-46 components only).

The estimated fragilities coupled an estiinated median capacity (An) with an estimated logarithmic standard deviation (bJ accounting for both randomness (br) and uncertainty (bu).

Examination of east coast earthquake records suggested that an adjustment to the commonly selected value for be would be appropriate to account for a higher degree of variability in the peaks and valleys. This examination suggested that a more appropriate value for the br associated with the randomness of the peaks and valleys of seismic records would be 0.29.

Because this site is a mid-western, low seismicity site and a soil site like many western US sites, br was set to 0.18. This consideration resulted in the selection of be = 0.40 for use with all but the detailed fragilities.

3.5.2.2 Detailed Fragility Analysis Methodology Items which could not be screened out or could not have a simplified fragility analysis performed, required a detailed fragility analysis. The detailed fragility analysis consisted of performing calculations to determine their seismic capacity. Fragilities were calculated based on the results of the seismic capacity calculations.

• Detailed fragility analysis also calculated the uncertainty to be included in the SPRA. The uncertainty is expressed as a logarithmic standard deviation (bJ accounting for both randomness (br) and uncertainty (b0 ).

3.5.2.3 Fragility Evaluation Results Table 3.5-1 presents all of the components in SPRA that were not screened out (included in the surrogate event). The table also presents the fragility value used in the SPRA quantification and whether it was a screening value or a detailed fragility.

3.5.2.3.1 Screened Components This section presents the general categories of compone~ts that were screened out at a 1. 08g PGA median fragility and represented by the surrogate event. Supporting justification for this screening level is also provided. General categories that use a generic type of fragility value (such as small break LOCA) are also presented in this section .

• 3-26

• Relays A detailed relay review was performed for the USI A-46 program (Ref. 3-25). The results of that review identified bad actor relays (outliers) at Palisades. Since bad actors were found in the USI A-46 scope, the scope of review was expanded to include the additional systems (and associated relays) in the SPRA. After functionally screening out relays (circuits) for which relay chatter is not an issue, no additional bad actor relays were found. All of the bad actor relays will be dispositioned through the USI A-46 program. Following the disposition, the SPRA assumes that all of the relays will be screened out and no relay-specific modelling is required. Therefore, no bad actor relays were modelled in the SPRA.

Masonry Block Walls The availability of recent detailed calculations for masonry block walls developed under the IEB 80-11 program (Ref. 3-17) at Palisades provided a ready reference for the determination of estimated fragilities. Conservatively, the block walls were assigned a HCLPF capacity equal to the design basis peak ground acceleration. This value was then factored in accordance with the gtiidance in EPRI documents (Ref. 3-18) to obtain a median capacity with an associated be = 0.40. All such block walls were found to have HCLPF capacities well in excess of the surrogate element capacity. Therefore, no block walls were explicitly modelled in the SPRA, but were all represented by the surrogate element.

• Building Structures The structures for the Palisades site considered in the SPRA are the containment building, auxiliary building (AB), intake structure (screenhouse), turbine building (TB), and the *AFW pump room. The AB is founded on a single shallow mat foundation at approximately El. 587' (plant grade elevation is El. 589'). The containment building, TB and AFW pump room are embedded approximately 21' to 23'. The screenhouse is fairly deeply embedded at approximately 40' below grade. These buildings are Category I structures except for portions of the TB and screenhouse, which are designated as Category m structures. Category III indicates that the structure is not related to reactor operation or containment; however, it is designed for seismic loads corresponding to SSE ground response spectra (0.20g PGA). It was determined that this results in meeting the condition cited in Note (k) of Table 2-3 of NP-6041 (Ref. 3-5) and, thus, the Category III structures were initially screened out using the first column in Table 2-3.

Subsequently, using the building story shears and moments based on the soil-structure interaction analysis, the IPEEE demand moments and shears (Ref. 3-19) were scaled based on the design basis moments and shears as given in Figure 5.7-6 of the FSAR (Ref. 3-11) and the SEP Seismic Review (Ref. 3-20). In the case of the TB, this scaling was *accomplished based on design accelerations as no story shears or moments were documented. The scaling using the excess margin for these structures e~res that the structures may be represented by a 3-27

• surrogate element with a median peak ground acceleration capacity of l .08g with a combined logarithmic standard deviation, be, value of 0.30.

The AFW pump room, TB and screenhouse are represented by the surrogate element in the SPRA with a median peak ground acceleration capacity of 1.08g, with a composite logarithmic standard deviation of 0.30.

The AB and containment are specifically modelled in the seismic event tree as top headings.

Failure of either of these buildings leads directly to core damage. These were explicitly modelled in the seismic event tree because they impact the containment isolation system and, therefore, affect the containment performance analysis. _..

Building Separation Although the design philosophy for the critical structures was separation by providing a gap between buildings, some interconnection still resulted. This was recognized in the original design and three analysis cases were investigated as described in the FSAR (Ref. 3-11) for the possible interaction between the TB and AB. The first case was to consider the buildings tied together at the operating floor by encasement of the secondary columns of the TB frame. It was determined that if the TB transfers its loads to the AB, that both buildings would survive (not collapse). The second case investigated the situation where both buildings are free-standing, and considered the effects of interaction due to closing the gap between them. This gap was predicted to close due to design basis seismic loads, so a third case was investigated in.

which the turbine pedestal acts as a restraint to the TB at the operating floor level which is elevation 625' .

Based on the third case investigation, it was concluded that the buildings will not interact (close the gaps); however, on the operating floor elevation outside of the control room where the TB moment resisting frames butt up against the control room wall (which is part of the AB), there is no gap. This is not considered a structural concern given the aforementioned analyses, but it is an impact concern which leads to a concern over the essential relays contained in the cabinets in the main control room. Given that relay functionality is a major issue, this structural impact potential cannot be ignored in the main control room. This is not judged as an issue elsewhere (in other rooms) at the Palisades plant - it is only an identified as an issue in the main control room area.

A similar, but more severe building interaction exists at another power plant (Ref. 3-21). In that case, the columns of the TB are in contact with the floor of the AB along an entire elevation. On that elevation, the switchgear room (with numerous relays) is immediately adjacent to this building interface column line. The referenced calculation showed that the effects of the impact do not appreciably increase the floor response spectrum in the switchgear room area and the peak spectral accelerations associated with the impacts, although in a different frequency range from the seismic spectral peaks, do not exceed (remain below) the

• 3-28

• seismic peak spectral accelerations. Based on that detailed evaluation, this interaction was judged less severe than the interaction at the other plant by the SRT. The peer reviewers, also familiar with the other plant's evaluation, agree with the SRT on this issue.

Reactor Vessel Internals and Control Rod Drive Housing and Mechanisms The reactor vessel internals and control rod drive housings were scaled based on design acceleration capacities given in NUREG/CR-1833 (Ref. 3-20). Using the demand spectral accelerations calculated (Ref. 3-19) resulted in excess margin for these components ensuring that they may be represented by a surrogate element with a median peak ground acceleration capacity of l.08g with a combined logarithmic standard deviation, be, value of 0.30. -*

Soil Failure Analysis and Buried Piping Soil stability and seismic displacements, both transient and permanent, along with permanent settlements were investigated for the Palisades site. Because of the high factor of safety, the evaluations were conducted at 0.56g, 0.4g and 0.2g PGA using the SHAKE (Ref. 3-22) computer program.

Liquefaction The results of the liquefaction stability analyses conducted for the site structures showed that regardless of the magnitude of the earthquake, there is a low likelihood of liquefaction instability. A minimum factor of safety of over 3 was obtained for the critical surface. This surface was one that contained within it all of the critical structures, and passed along the bottom of the clay layer. Using lower bound (soft) soil properties, it was found that 100%

pore pressure would develop in the very dense dune sand with a PGA of 0.56g. For these dense soils the consequences of 100% pore pressure are minimal; however, no analysis was performed for PGA values in excess of 0.56g since for strains in excess of about 0.3 % there is no unique shear modulus that can be used in an equivalent linear analysis.

Transient and Permanent Horizontal Displacements and Settlements The maximum transient horizontal displacements calculated at the ground surface for a peak ground acceleration of 0.56g are 1.9 inches to 0.4 inches for the 0.2g PGA ground motion.

No (negligible) permanent horizontal displacements are predicted for a peak ground acceleration up to 0.56g.

The maximum calculated settlements at the ground surface range from O.~ inch at 0.56g peak ground acceleration to less than 0.1 inch for a PGA of 0.2g PGA.

3-29

Differential settlements can be expected within the foundation imprint of any one building and within the areas between buildings due to natural variability of the compressibility of the soil deposits. These can be taken equal to the total settlements and can be taken to occur over a distance of about 25 feet for structures on individual spread footings and for the areas between buildings.

Differential settlements can also be expected between any one building and the ground and between adjacent buildings, such as those within the Power Block, due to the different thicknesses of the soil strata beneath the various structures and beneath the ground surface.

Those between a building and the surrounding ground will occur over a distance of only a few feet. The distance over which the differential settlements between adjacent buildings will occur is dependent on the interaction of the foundation mat with the foundation soil and can occur abruptly at construction or expansion joints between or within the buildings.

Buried Piping From Diesel Storage Tank Through Transfer Pump to Diesel Generator The SPRA considered the influence of the displacements and settlements for the fragility analysis of fuel oil piping from the main diesel fuel oil tank (T-10) to the transfer pump in the Intake Structure then on to the emergency diesel generator. There is sufficient margin (Ref. 3-23), even for displacements corresponding to the 0.56 g PGA; thus, the buried piping is screened out of the SPRA and conservatively represented by the surrogate element.

• Piping Piping was reviewed throughout the plant as part of the SPRA walkdown. Piping was observed throughout all safety-related buildings and the Turbine building. The SPRA mainly relies on seismically designed piping. Some non-seismically designed piping is included in the SPRA model. All safety related piping was re-evaluated using modem dynamic analysis procedures as part of the IEB 79-14 program (Ref. 3-3). All non-safety related piping was walked down to estimate its capacity.

The non-seismic piping was determined to not be the weak link of the system modelled.

Therefore, the non-seismic piping was not specifically modeled. The systems that include non-seismic piping are: fire protection and circulating water system. The FPS system has many low fragilities components and is not affected by piping fragilities. The circulating water system is limited by other non-seismic components in the turbine building and the availability of off-site power. Piping fragilities will not affect the availability of the circulating water system.

The service water system was walked down from "end-to-end" to identify any anomalies during the April walkdown in 1994. This system was found to be completely in order with no design anomalies. *

• 3-30

Small bore piping was also reviewed during the walkdowns to consider any interaction effects that could result from such piping, for example, falling (collapsing) on equipment modeled in tlie SPRA. It was observed that piping supports would support more than 3 times an estimated deadweight and that support spacing was within 2 times that recommended by the ASME B.31.1 Code for piping. Therefore, this issue is considered resolved and small bore piping may be considered to have the same capacity as the seismically designed large bore piping.

The non-critical portions of the main steam and service water piping are welded steel piping that are gravity, rod-hung. They were walked down in the Turbine building and found to be flexible and capable. No hard points were found and both of these non-critical segments of piping are assigned a HCLPF of 0.2g (median fragility=0.45g) PGA. The critical, thus -**

seismically designed portions, of the main steam and service water piping are judged rugged and may be screened at 0.5g HCLPF (median fragility=l.08g) PGA. The service water piping system was used as a prototype for all seismically designed piping at Palisades and was walked down in its entirety. It exhibited no anomalous design features with respect to good seismic design. Adequate flexibility was found at building interfaces to preclude overstress concerns.

Some drain lines were observed to have Victualic couplings, but these lines are normally not over safety-related equipment, nor are they normally full of water.

In conclusion, the piping is represented by the surrogate element in the SPRA with a median

• peak capacity of l .08g, peak ground acceleration with a composite logarithmic standard deviation of 0.30.

HVAC Ducting was reviewed in all areas of the plant. Particular attention was given to containment systems, and those in the control room and battery rooms. In general, the smaller size ducting is supported by sheet metal straps secured to the ceiling by expansion anchors. Larger duct cross-sections are supported by rod trapeze hangers anchored by Phillips shells.

The duct is supported in accordance with SMACNA (Ref. 3-24) spacing rules and anchorage vertical capacities exceed 3 times dead weight. The ducting are represented by the surrogate element in the SPRA with a median peak capacity of l .08g, peak ground acceleration with a composite logarithmic standard deviation of 0.30.

Electrical Raceways The electrical raceways were walked down as part of the USI A-46 effort (Ref. 3-25). All areas of the plant were surveyed and inspected against inclusion rules and caveats for raceways such as maximum spans, missing or broken hardware, and good design practices as presented in the GIP, Section 8. The results were documented in Plant Area Summary Sheets and are

• 3-31

included in the USI A-46 report for Palisades. In addition, bounding and representative supports were selected for structural and seismic evaluations called Limited Analytical Reviews (LAR). The LAR evaluations checked dead load stresses, ductility, and vertical capacity.

The Palisades raceways passed all of the USI A-46 evaluations and can be represented by the surrogate element in the SPRA with a median peak capacity of l .08g, peak ground acceleration with a composite logarithmic standard deviation of 0.30.

3.5.2.3.2 Detailed Fragilities All components were initially screened into three bins: 1) l.08g PGA median (.5g HCLPF); -**

2) 0.65g PGA median (.3g HCLPF); or 3) 0.22g PGA median(. lg HCLPF). Most of the components modelled in the SPRA were screened at .5g HCLPF and represented by the surrogate event (l .08g PGA median, beta of 0.30). Some of the components were screened at

.3g HCLPF and modelled with a 0.65g PGA median and a beta of 0.46. The remaining components were screened at a . lg HCLPF (essentially a very low ruggedness category) and modelled with a .22g PGA median and a beta of 0.46.

An initial quantification was performed to assess the seismic events that were important contributors to core damage frequency. The results of the initial quantification identified components for detailed fragility analysis .

• Detailed fragility analysis was also performed for components where the anchorage was limiting and the component could no longer meet the caveats of the screening bins.

All components that had a detailed fragility less than a l .Og HCLPF (2.16g PGA median) were explicitly modelled in the SPRA. Components with a detailed fragility of l.Og HCLPF or higher were not modelled explicitly, but were represented by the surrogate event (.5g HCLPF, l.08g PGA median).

3.5.2.3.3 Seismically Induced Initiators Palisades considered the possibility of an earthquake inducing another type of initiator. These other initiators at Palisades were evaluated for their likelihood of occurrence. All events screened out with a low probability of occurrence except for small break loss of coolant accident (SBLOCA), loss of off-site power (LOOP), turbine building fire and turbine building flood.

Seismically Induced Small Break Loss of Coolant Accident Figure s-1 of NUREG/CR-4840 (Ref. 3-26) presents the relationship between increasing seismic levels, and the conditional probability of a small break loss of coolant accident. This curve was used in the SPRA .

• 3-32

• Medium and large break LOCA have remote probabilities and will not contribute to core damage frequencies and, thus, were not included explicitly in the SPRA model. The initiating event frequency for medium and large break LOCAs is less than that for a small break LOCA.

The small break LOCA initiator did not contribute to the core damage frequency and, therefore, the medium and large break LOCA would be expected to also not contribute to core damage frequency.

Seismically Induced Flooding A walkdown was conducted on October 5, 1994, by the SRT to address the seismic vulnerability of potential internal flooding sources. Initially, an inventory of flooding sources was compiled. This included non-seismically designed piping (seismically designed piping was screened out at the high median fragility of l .08g PGA) and large tanks greater than 1000 gallons. In particular, non-critical - thus, non-seismically designed - piping such as fire protection, non-critical main steam and non-critical service water piping were studied.

All areas of the auxiliary building, turbine building, and screenhouse were walked down. The containment building was reviewed from drawings because the plant was operating. As a corollary to the inspection of flooding sources, areas (rooms) vulnerable to flooding were also reviewed such as the auxiliary feedwater pump room which is located at the lowest elevation of the turbine building, below elevation 590' .

• The greatest concern identified was the circulating water line in the screenhouse. It does not

• appear to be seismically designed. If it were to rupture, it would probably flood the screenhouse, and particularly the service water pumps, rendering the service water system inoperable. Upon review of the drawings and seismic analysis of the circulating water line, it was concluded that although the line was not seismically restrained in some areas, that it would not break between the screenhouse's operating floor (El. 590') and the roof. As such, it was judged not to pose a flooding risk inside the screenhouse.

The fire piping headers run throughout the plant; and, although they are not seismically designed, they are gravity rod-hung, welded steel piping that frame through concrete walls (which act as lateral guides) and are not seen as plausible failure sources below a 0.2g HCLPF (median fragility = 0.43g PGA). The fire piping spray lines (with sprinkler heads) are threaded end steel piping that are charged (filled with water). They are predominantly 2 piping that is gravity rod-hung. They are not constrained with respect to the fire water headers and are not seen as potentially rupturing below a 0.2g HCLPF (median fragility =0.43g PGA) since they are small bore and not capable of large force reactions. The main steam and non-critical service water piping is welded steel piping that is gravity, rod-hung. It was walked down in the turbine building and found to be flexible and capable. No hard points were found and both of these piping segments are assigned a HCLPF of 0.2g (median fragility=0.43g PGA). Therefore, seismically induced flooding on the 590' elevation in the turbine building is evaluated with a median fragility of 0.'43g PGA with a beta of 0.30 .

• 3-33

The following tanks were reviewed as potential flooding sources:

T-1 Domestic Water Tanlc; T-53A,B Boric Acid Storage Tanks; T-54 Volume Control Tanlc; T-58 Safety Injection and Refueliilg Water Tank T-7 Demin Water Tank; T-81 Primary System Makeup Storage Tank T-85 Clean Waste Holdup Tank T-86 Clean Waste Distillate Tank T-90 Primary System Makeup Storage Tank T-92A,B,C Miscellaneous Waste Holdup Tank In all cases, the tanks are well anchored and judged to have a HCLPF in excess of 0.3g (median fragility = 0. 7 g PGA) with the exception of T-81.

• This tank may buckle at a value below design basis. Its location adjacent to T-2, the Condensate Storage Tank, makes it a potential hazard; however, loss of inventory poses neither a flooding hazard nor a realistic collapse hazard. It is not a flooding hazard because it is located outdoors. In the judgment of the SRTs, the tank may buckle and rupture, but it will not catastrophically collapse.

The auxiliary feed water pump room is protected from flooding sources by a water tight door.

Moreover, a ventilation opening at the top of the room is located on a 4-5' high standpipe at

• elevation 590' making it improbable that a flood will result in water flowing into the ptimp room itself.

The seismically induced flooding review resulted in the_following flood modelling: 1) none for the containment building; 2) none for the auxiliary feedwater pump room; 3) none for the auxiliary building; 4) the 590' elevation in the turbine building is evaluated with a median fragility of 0.43g PGA with a beta of 0.30; and 5) the screenhouse is evaluated with a median fragility of l .08g PGA and a beta of 0.30.

Seismically Induced Fire All potential fire sources were walked down in the turbine building, auxiliary building and screenhouse. The containment building was reviewed from drawings because the plant was in full operation. Combustible sources such as fuel oil tanks, waste gas tanks, hydrogen gas bottles, flammable liquid storage cabinets, and hydrogen piping were assessed.

The containment building, auxiliary building and screenhouse have few sources of flammable liquids. The diesel generator fuel oil day tanks have high seismic capacities. The diesel fire pumps day tanks are located in an appendage to the turbine building and, although they are unanchored, there are no ignition sources in the appendage. Moreover, the turbine building is protected from the day tanks by a reinforced concrete wall. The hydrogen piping that is routed

• 3-34

through the turbine building is not seismically designed. It passes along non-seismically designed block walls and cable trays which pose a puncture or rupture hazard to the hydrogen piping at relatively low seismicity levels. The turbine building also contains flammable liquid storage cabinets in numerous locations and these storage cabinets are unanchored and at risk of spilling their inventory if they were to fall over. Based on simple observation, a multitude of ignition sources exist in the turbine building to ignite such flammable sources. Therefore, the turbine building is at high risk for a fire initiated by a seismic event. The auxiliary building contains hydrogen piping that is judged to be seismically designed and, thus, does not pose a fire issue.

The seismically induce fire review resulted in the following fire modelling: 1) none for the containment building, auxiliary building, auxiliary feedwater pump room and screenhouse; and

2) the turbine building (all elevations) is evaluated with a median fragility of 0.22g PGA and a beta of 0.30.

• 3.5.3 Surrogate Fragility The SPRA included a single surrogate element representing the aggregate effect of all screened out components. The surrogate element appears as a top event in the model with failure .

leading directly to core damage. The median capacity of the surrogate element computes as a direct function of the site ground spectral shape, which for the IPEEE was the median spectral

.. shape with a 10,000 year return period provided in NUREG/CR-5250 (Ref. 3-27). Using the

• Palisades IPEEE ground spectral shape resulted in a median capacity of l.08g PGA for the surrogate element. Following the recommendations of Drs. Kennedy and Reed (Ref. 3-18),

the surrogate element has an associated combined uncertainty (bJ of 0.3 .

• 3-35

3.5.4 Tables for Component Fragilities and Failure Modes TABLE 3.5-1 SPRA COMPONENT FRAGILITIES EQUIPMENT ID EQUIPMENT DESCRIPTION HCLPF TYPE 42-771 C-6A STARTER .1 Screening

.42-811 C-6B STARTER .1 Screening 52-1306CS P-5 CS .1 Screening 52-347 P-79B BREAKER .1 Screening 52-7701 LOAD CENTER EB-77 INCOMING BKR .1 Screening 52-7702 MOTOR CNTRL CENTER EB-79 FEEDER .1 Screening 52-771 C-6A BREAKER .1 Screening 52-811 C-6B BREAKER .1 Screening

• C-50A C-50B CV-0501 WASTE GAS COMPRESSOR WASTE GAS COMPRESSOR MAIN STEAM ISOLATION E-50B

.. l

.1

.1 Screening Screening Screening CV-0510 MAIN STEAM ISOLATION E-50A .1 . Screening CV-0511 TURBINE BYPASS CONTROL .1 Screening CV-0944A SPENT FUEL POOL CLG ISOL. .1 Screening CV-1037 CLEAN WASTE RECEIVER TK RECIRC .1 Screening CV-1045 P-69A/B SUCTION .1 Screening CV-1101 T-67 INLET VENT HEADER .1 Screening CV-3001 CS HEADER ISOLATION .1 Screening E-1/2/3/4/5/6A/B FEEDWATER HEATERS .1 Screening E-19 TURBINE GLAND SEAL CONDENSER .1 Screening.

• 3-36

• EQUIPMENT ID E/P-0511 EQUIPMENT DESCRIPTION TURBINE BYPASS VALVE CONTROL HCLPF

.1 TYPE Screening EB-07 MCC7 .1 Screening EB-08 MCC8 .1 Screening EB-14 LOAD CENTER 14 .1 Screening EB-77 LOAD CENTER 77 .1 Screening EB-79 MCC79 .1 Screening EC-137 P-41 ACTUATING PANEL .1 Screening ED-16 CHARGER2 .1 Screening ED-36A P-9B BATTERY BANK 1 .1 Screening ED-36B P-9B BATTERY BANK 1 .1 Screening ED-36C P-9B BATTERY BANK 2 .1 Screening ED-36D P-9B BATTERY BANK 2 .1 Screening ED-38A P-41 BATTERY BANK 1 .1 Screening ED-38B P-41 BATTERY BANK 1 .1 Screening ED-38C P-41 BATTERY BANK 2 .1 Screening ED-38D P-41 BATTERY BANK 2 .1 Screening EX-13 STATION POWER TRANSFORMER 13 * .1 Screening EX-77 STATION POWER TRANSFORMER #77 .1 Screening FUZ/B771-1 SCHEMEB771 .1 Screening FUZ/B811-1 SCHEME B811 .1 Screening HIC-0823 CCW HX SW OUTLET .1 Screening HIC-0826 CCW HX SW OUTLET .1 Screening IDC-0881 CCW HX SW OUTLET .1 Screening

• 3-37

• EQUIPMENT ID HIC-0882 HS-771 EQUIPMENT DESCRIPTION CCW HX SW OUTLET C-6A CS HCLPF

.1

.1 TYPE Screening Screening HS-811 C-6B CS .1 Screening LS-0204 VCT OR RWS VALVE LEVEL SWITCH .1 Screening LS-2019 T-81 LEVEL SWITCH .1 Screening M-59A A EV APO RATOR .1 Screening M-59B

• B EVAPO RATOR .1 Screening P-5 WARM WATER RECIRC .1 Screening P-9A MOTOR DRIVE FIRE PUMP .1 Screening PCV-2274 NITROGEN FOR C-150 .1 Screening PS-5350 P-41 DISCHARGE PS .1 Screening

• PT-0510 RV-2274 T-13A TBV CONTROLLER PRESSURE NITROGEN SYSTEM RELIEF VALVE DG 1-1 JACKET WATER SURGE TANK

.1

.1

.1 Screening Screening Screening T-13B DG 1-2 JACKET WATER SURGE TANK .1 Screening T-24 P-9B DIESEL DAY TANK .1 Screening T-3 CCW SURGE TANK ;1 Screening T-40 P-41 DIESEL DAY TANK .1 Screening T-54 VCT .1 Screening T-77 BORIC ACID BATCH TANK .1 Screening T-81 PRIMARY SYSTEM MAKEUP TANK .1 Screening T-82A SIT .1 Screening T-82B SIT .1 Screening

• 3-38

• EQUIPMENT ID M0-3052 EQUIPMENT DESCRIPTION SAFETY INJECT TK T-82D OUTLET ISOL HCLPF

.3 TYPE Screening M0-3082 HPSI HOT LEG INJECTION .3 Screening M0-3083 HPSI HOT LEG INJECTION .3 Screening P-50A PRIMARY COOLANT PUMP A .3 Screening P-50B PRIMARYCOOLANTPUMPB .3 Screening P-50C PRIMARY COOLANT PUMP C .3 Screening P-50D PRIMARYCOOLANTPUMPD .3 Screening RV-3057A CV-3057 CLOSING AIR .3 Screening RV:-3057B CV-3057 OPENING AIR .3 Screening SV-1037 P-70 DISCHARGE ISOLATION .3 Screening SV-1064 CLEAN WASTE RECEIVER TANK .3 Screening

• SV-1065 SV-1101 SV-1102 CLEAN WASTE RECEIVER TANK T-67 INLET T-67 INLET

.3

.3

.3 Screening Screening Screening SV-1103 CONTAINMENT SUMP DRAIN .3 Screening SV-1104 CONTAINMENT SUMP DRAIN .3 Screening SV-1813 V-46 DISCHARGE .3 Screening SV-1814 V-46 DISCHARGE .3 Screening SV-2113 E-56 TO CHARGING LINE LOOP lA .3 Screening SV-2115 E-56 TO CHARGING LINE LOOP lB .3 Screening T-10 DG FUEL OIL STORAGE TANK .3 Screening T-2 CST .3 Screening T-926 FUEL OIL STORAGE TANK .3 Screening

• 3-41

• EQUIPMENT ID T-82C T-82D SIT SIT*

EQUIPMENT DESCRIPTION HCLPF - TYPE

.1 Screening

.1 Screening T-9C HIGH PRESSURE AIR RECEIVER .1 Screening TC-0216 CHARGING PP P-55A TEMP CNTRL .1 Screening 42-2111 V-15A STARTER .3 Screening 42-2113 HPSI VALVE M0-3081 .3 Screening 42-2139 M0-2139 .3 Screening 42-2213 HPSI VALVE M0-3082 .3 Screening 42-2239 M0-3198 .3 Screening 42-2313 HPSI VALVE M0-3083 .3 Screening 42-2625 O/C RELAY FOR M0-1043A .3 Screening

• 52-2111 52-2111/CS 52-2113 V-15A BREAKER V-15A CONTROL SWITCH HPSI VALVE M0-3081

.3

.3

.3 Screening Screening Screening 52-2213 HPSI VALVE M0-3082 .3 Screening 52-2313 HPSI VALVE M0-3083 .3 Screening 52-2625 M0-1043A BREAKER .3 Screening 52-427 P-79A BREAKER .3 Screening CV-1064 T-64A/B/C/D VENT VALVE .3 Screening CV-1102 T-67 INLET VENT HEADER .3 Screening CV-1211 lA CONTAINMENT ISOLATION .3 Screening CV-1814 V-46 DISCHARGE .3 Screening E-50A 'A' STEAM GENERATOR .3 Screening

• 3-39

• EQUIPMENT ID E-50B EQUIPMENT DESCRIPTION

'B' STEAM GENERATOR HCLPF

.3 TYPE Screening E-54A CCW HEAT EXCHANGER  :

.3 Screening E-54B CCW HEAT EXCHANGER .3 Screening E-60A SHUTDOWN COOLING HX .3 Screening E-60B SHUTDOWN *COOLING HX .3 Screening EB-21 MCC21 .3 Screening EB-22 MCC22 .3 Screening EB-23 MCC23 .3 Screening EB-26 MCC26 .3 Screening EY-50 INSTR AC BUS TRANSFER SWITCH .3 Screening

• • FUZ/B2111-1 FUZ/B2111-2 FUZ/B2625-1 V-15A CIRCUIT FUSE V-15A BACKUP PROTECTION FUSE SCHEME B2625

.3

.3

.. 3 Screening Screening Screening M0-3007 HPSI TO LOOP lA .3 Screening M0-3009 HPSI TO LOOP lB .3 Screening M0-3010 LPSI TO RX COOLANT LOOP lB .3 Screening M0-3011 HPSI TO LOOP 2A .3 Screening M0-3012 LPSI TO RX COOLANT LOOP 2A .3 Screening M0-3013 HPSI TO LOOP 2B .3 Screening

. M0-3014 LPSI TO RX COOLANT LOOP 2B .3 Screening

. M0-3041 SAFETY INJECT TK T-82A OUTLET ISOL .3 Screening M0-3045 SAFETY INJECT TK T-82B OUTLET ISOL .3 Screening M0-3049 SAFETY INJECT TK T-82C OUTLET ISOL .3 Screening

• 3-40

• EQUIPMENT ID T-9A T-9B EQUIPMENT DESCRIPTION HIGH PRESSURE CONTROL AIR HIGH PRESSURE CONTROL AIR HCLPF

.3

.3 TYPE Screening Screening P-67A LPSIPUMP .33 Detailed P-67B LPSI PUMP .33 Detailed P-52B COMP. COOLING PUMP .4 Detailed VHX-1 CONTAINMENT AIR COOLER 1 .47 Detailed VHX-2 CONTAINMENT AIR COOLER 2 .47 Detailed VHX-3 CONTAINMENT AIR COOLER 3 .47 Detailed VHX-4 CONTAINMENT AIR COOLER 4 .47 Detailed E-58 LETDOWN HEAT EXCHANGER .5 Detailed T-73 QUENCH TANK .51 Detailed

• P-7A P-7B P-7C SERVICE WATER PUMP SERVICE WATER PUMP SERVICE WATER PUMP

.52

.52

.52 Detailed Detailed Detailed P-8C MOTOR DRIVEN AUX FEED PUMP .55 Detailed T-58 SAFETY INJECT REFUELING WTR TK .57 Detailed E-53A SPENT FUEL POOL HX A .58 Detailed E-53B SPENT FUEL POOL HX B .58 Detailed P-54C CONTAINMENT SPRAY PUMP .60 Detailed 127D-2 DIESEL GEN 1-2 UNDERVOLTAGE .66 Detailed P-8A MOTOR DRIVE AUX FEED PUMP .72 Detailed P-54A CONTAINMENT SPRAY PUMP .77 Detailed 127D-1 DIESEL GEN 1-1 UNDERVOLTAGE .87 Detailed

• 3-42

• 3.6.1 Seismic Event Tree Table of Contents Section 3.6 SPRA Modelling and Results 3-44 3.6.2 Seismic Event Tree Heading Fragilities 3-45 3.6.3 Seismic Fault Trees 3-46 3.6.4 Accident Classes 3-46 3.6.4.1 Accident Class IA 3-47 3.6.4.2 Accident Class IB 3-47 3.6.4.3 Accident Class II 3-47 3.6.4.4 Accident Class IIIA 3-47 3.6.4.5 Accident Class IIIB 3-48 3.6.4.6 Accident Class IV 3-48 3.6.5 Seismic Risk Quantification and Results 3-48

• 3.6.5.1 3.6.5.2 Seismic Event Tree Sequences Seismic Event Tree Quantification 3.6.5.2.1 3.6.5.2.2 3.6.5.2.3 Component Failure Probabilities Human Error Fragilities Seismic Event Tree Headings 3-48 3-49 3-49 3-49 3-50 3.6.5.2.4 Quantification 3-50 3.6.5.3 Quantification Results 3-50 3.6.5.3.1 Accident Class Results 3-51 3.6.5.3.2 Important Seismic Events 3-53 3.6.5.3.3 Important Random Failures 3-54 3.6.5.3.4 Important Human Actions 3-55 3.6.5.3.5 Contribution by Ground Motion 3-56 3.6.5.4 Sensitivity Analyses 3-57 3.6.5.4.1 Fire Protection System Sensitivity 3-57 3.6.5.4.2 Turbine Building Fire Sensitivity 3-57 3.6.5.4.3 Random Events Sensitivity 3-58 3.6.6 Tables and Figures for SPRA Modelling and Results 3-59

• 3-43

3.6 SPRA Modelling and Results

• The SPRA used the event and fault trees developed for the IPE whenever possible. One event tree was developed to tie the seismic initiating event to the IPE event trees. The quantification of the SPRA was similar to the IPE except that the plant level fragility and core damage frequency were calculated by integrating the fault and event tree results over the range of earthquake levels and probabilities in the hazard curve.

3.6.1 Seismic Event Tree Figure 3.6-1 contains the seismic event tree (SET) used for the Palisades SPRA. This event tree includes seven headings: SURR, RB, AB, TBFR, TBFL, LOOP and SBL. These headings were chosen based on the discussion in Section 3.5.2.3.3. The SET was developed to transfer into the transient or small break LOCA event trees used in the IPE. The transient and small break LOCA event trees both had a transfer into the ATWS event tree. Therefore, a total of three IPE event trees were used in the SPRA.

Heading SURR is the surrogate event. Failure of this heading conservatively bounds the failure of all equipment represented by the surrogate event. Since the vast majority of the equipment is represented by the surrogate event, Palisades assumes that failure of the surrogate event leads to failure of all plant equipment and, therefore, core damage.

Heading RB is the reactor building (containment building). Failure of this heading represents structural failure of the containment building. The Palisades SPRA conservatively assumed that structural failure of the containment building leads directly to core damage rather than analyzing the specific failure mod~s and probabilities of the various -structural failures. For this failure mode, it was assumed that all piping connections between the containment building auxiliary building fail, including containment isolation functions.

Heading AB is the auxiliary building (AB). Failure of this heading represents structural failure of i:he AB. The Palisades SPRA conservatively assumes that structural failure of the AB leads directly to core damage. Structural failure of the AB assumes that all of the piping connections between the containment building and the AB fail. This would lead to failure of all engineered safeguards equipment, containment cooling and containment isolation. ,

Heading TBFR is a turbine building (TB) fire. Failure of this heading represents a seismically induced fire in the TB. This fire is conservatively assumed to disable all of the equipment and cables routed through the TB. This is consistent with the fire analysis for the TB (Section 4.0). Engineered safeguards equipment and diesel generator power to both ClasslE buses are not affected by the TB fire because these are located in the AB.

Heading TBFL is a TB flood. Failure of this heading represents a seismically induced flood on the 590' elevation of the TB. The floOd is caused by the catastrophic failure of non-seismic

• 3-44

piping and tanks located in the TB (i.e., non-critical service water, fire protection, main steam, etc.). This flood is assumed to disable all equipment located on the 590' or below in the TB. Even though higher elevations of the TB contain piping or tanks that may rupture in a seismic event, these elevations have floor grating. Palisades assumes that any water from a rupture would drain to the 590' elevation and accumulate there versus on the elevation of the rupture.

Heading LOOP is off-site power. Failure of this heading means that off-site power is lost due to a seismic event.

Heading SBL is small break loss of coolant accident (SBLOCA). Failure of this heading means that a small break LOCA has occurred as a result of a seismic event.

The SET is used to determine which IPE event tree to use for quantification. The SET has fifteen sequences as indicated in Table 3.6-1. Six sequences transfer to the transient event tree (1, 3, 5, 7, 9, 11), six sequences transfer to the SBLOCA event tree (2, 4, 6, 8, 10, 12), and three sequences are not developed further, but are quantified as leading directly to core damage (13, 14, 15). The transient and SBLOCA event trees used in the SPRA are the same as those used in the internal events PRA. The ATWS event tree was considered in the SPRA as a transfer from the transient and SBLOCA event trees.

The success criteria for the transient and SBLOCA event trees is the same as for the IPE. The

• fault trees used to support the transient and SBLOCA event trees are also the same as the IPE fault tree except that seismic basic event were added to the fault trees as discussed in Section 3.6.3. Also, the conditions represented by the SET sequences modify the fault tree structure for that sequence. For example, all fault trees used in the transient event tree for SET sequence 3 have loss of off-site power set to true (failure rate = 1.0) before quantification.

3.6.2 Seismic Event Tree Heading Fragilities Each of the seven SET headings has a fragility. These event tree headings are not represented by fault trees, rather, their fragility is used as the branch point probability ..

The fragility for SURR (surrogate event) is discussed in Section 3.5.3 and is l.08g PGA median with a beta of 0. 30.

The fragility for RB and AB is discussed in Section 3. 5. 2. 3 .1. The fragility for each is the same and is l.08g PGA median with a beta of 0.30.

The fragility for TBFR (TB fire), TBFL (TB flood) and SBL (small break LOCA) are discussed in Section 3.5.2.3.3. These fragilities are: 1) TBFR is a 0.22g PGA median and a beta = 0.30; 2) TBFL is a 0.43g PGA median and a beta = 0.30; and 3) SBL is represented by Figure s-1 of NUREG/CR-4840 (Ref. 3-26) .

• 3-45

The fragility for LOOP (off-site power) was calculated based on the most limiting component that causes this event. The most limiting component is the ceramic insulators. The fragility for off-site power also incorporates the possible affects of the fire protection system on the main transformers, should it be actuated. The main transformers deluge system contains a low seismic capacity check valve that may cause a loss of off-site power by actuating the deluge system during a seismic event. The fragility for off-site power is 0.35g PGA median with a beta of 0.55.

3.6.3 Seismic Fault Trees The IPE fault trees that were used to support the three IPE event trees (transient, SBLOCA, ATWS) used in the SPRA were modified to create the seismic fault trees. These fault trees were modified to include seismic basic events.

To create seismic basic events, the components in the IPE fault trees that may be seismically affected were identified. All of the components in the IPE fault trees that were used i.ri. the SPRA received a walkdown to assess their seismic capacity. As discussed in Section 3.5 and presented in Table 3.5-1, all of these components were assigned a fragility or were screened out and represented by the surrogate event. For those components that were not screened out, a seismic basic event was created with a fragility assigned to it. All of the seismic basic events were added to the fault trees to create the seismic fault trees. The seismic fault trees include both seismic and non-seismic basic events. Therefore, the SPRA considers seismic and random failures, human error probabilities, out of service and test unavailabilities .

• In addition to the seismic basic events, the seismic fault trees were modified to include seismically induced initiating events. The four seismic event tree headings that are seismically induced initiating events are: TBFR; TBFL; LOOP; and SBL. All events that are affected by a TB fire have an associated basic event of TBFR. All basic events that are affected by a TB flood have an associated basic event of TBFL. The affected off-site power related equipment received an associated basic event of LOOP. The initiating event SBLOCA was given to all sequences that were quantified by the SBLOCA event tree and was not included in the fault tree as a basic event.

The fault tree logic structure was modified to add the seismic basic events and conditional sequence events. The logic changes were such that the affected random event was renamed to an OR gate and the OR gate input was defined as: 1) the random basic event; 2) the seismic basic event; and 3) any seismic event tree heading events.

3.6.4 Accident Class Definitions The core damage sequences were grouped into accident classes based on the critical safety function failure which resulted in core damage. The accident classes are defined to provide an easy method of identifying the primary functional failures most likely to lead to core damage

• 3-46

and to provide a method of comparing the likelihood of various functional failures leading to

• core damage. The accident classes used in the SPRA are the same as those defined in the IPE Report Section 2.4.23 (Ref. 3-10) and are consistent with those used in other PRAs and the NUMARC Severe Accident Closure Guidelines (Ref. 3-28). This method of grouping the core damage sequences provides initial insight into the reliability of critical accident mitigating functions. Six accident classes are defined and used in the SPRA.

3.6.4.1 Accident Class IA Accident Class IA contain sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the injection phase (water from the safety injection and refueling water tank - SIRWT). This class includes sequences from the transient event tree.

3.6.4.2 Accident Class IB Accident Class IB contain sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase (water from the containment sump). This class includes sequences from the transient event tree.

3.6.4.3 Accident Class II Accident Class II contains sequences that progress to core damage due to failure of containment heat removal which leads to containment failure and the subsequent loss of coolant inventory makeup. This class includes sequences from both the transient and SBLOCA event trees.

3.6.4.4 Accident Class IIIA Accident Class IHA contains sequences that are initiated by a small break LOCA and progress to core damage due to failure of primary coolant makeup during the injection phase. This class includes sequences from the SBLOCA event tree.

3.6.4.5 Accident Class IIIB Accident Class IIIA contains sequences that are initiated by a small break LOCA and progress to core damage due to failure of primary coolant makeup during the recirculation phase. This class includes sequences from the SBLOCA event tree.

3.6.4.6 Accident Class IV Accident Class IV contains sequences that progress to core damage due to the failure of reactivity control. This class includes sequences from the ATWS event tree. No results were

• 3-47

• obtained for this accident class due to the low probability of an ATWS initiator coupled with the low probability of the seismic initiator.

3.6.5 Seismic Risk Quantification and Results The seismic quantification was performed in two parts: 1) quantification of and fragility development for the 12 seismic event tree transfer sequences; and 2) quantification of the seismic event tree.

3.6.5.1 Seismic Event Tree Sequences Figure 3.6-1 shows the seismic event tree. As discussed in Section 3.6.1, there are 12 sequences that transfer to other event trees: odd sequences from 1 through 12 transfer to the transient event tree; and even sequences from 1 through 12 transfer to the SBLOCA event tree.

The initial conditions for each of these 12 sequences is different, as defined by the success/failure of the seismic event tree top headings. Table 3.6-1 shows the sequence definitions. These sequence definitions are used to set seismically induced initiating event probabilities to 1. 0 or 0. 0 during the sequence quantification.

There are three top headings that are seismically induced initiating events for which the probability in the fault trees was set to 1.0 or 0.0: TBFR (TB fire), TBFL (TB flood) and LOOP (off-site power). The SBLOCA initiating ev_ent was attached to all sequences resulting from the SBLOCA event tree. As discussed in Section 3.6.3, TBFR, TBFL and LOOP were included in the seismic fault trees. For sequences where there is a TB fire (failure of heading TBFR), the basiC event TBFR probability in the fault tree was set to 1.0. For sequences where there is no TB fire, the basic event TBFR probability in the fault tree was set to 0.0. A similar procedure was used for the top heading TBFL and LOOP. This procedure was used to quantify the fault trees and produce the cutset equation for each of the 12 sequences.

Quantification of these sequences is performed by the SETS Code (Ref. 3-29) to provide a cutset equation. This quantification is performed using point estimates only, not fragilities.

To ensure that all important cutsets are maintained and not truncated out, two adjustments .

were performed: 1) assigning high probabilities for seismic basic events; and 2) increasing human error probabilities.

The seismic basic events were assigned a probability of failure from their fragility curve corresponding to a 0.6g earthquake. A 0.6g earthquake was chosen since this is a large earthquake and the plant level median fragility was expected to be less than 0.6g (Section*

3.6.5.3 confirms this assumption).

Post-accident human error probabilities were set to 1.0 to obtain the cutset equation using the SETS code. Fragilities were developed for human error probabilities (Section 3.6.5.2.2) and used in the seismic event tree quantification .

• 3-48

• 3.6.5.2 Seismic Event Tree Quantification The seismic event tree quantification involved defining the component random probabilities and fragilities, the human error fragilities and the seismic event tree heading fragilities in the SHIP code for final integration.

3.6.5.2.1 Component Failure Probabilities The component random failures rates that were used in the IPE were also used in the SPRA.

No adjustments to these probabilities were made. The seismic impact on these components was assessed by including seismic basic. events and fragilities.

The component fragilities that were identified in Section 3.5.2 were used in the SPRA. 'fh:e fragilities were input as a median capacity with a lognorrilal standard deviation (beta), which defined a lognormal fragility curve.

3.6.5.2.2 Human Error Fragilities Only the post-accident human error probabilities (HEPs) were changed from the IPE. All pre-accident HEPs were the same as in the IPE. Post-accident HEPs were assigned based on the time required to perform the function. Post-accident human actions were divided into three groups: 1) pe_rformed in the control room and required within one hour of the seismic event; 2) performed outside the control room- and required within one hour of the seismic event; and 3) not required within one hour of the seismic event.

Post-accident human actions that can be performed from the control and that are required within one hour were assigned a non-lognormal fragility. The IPE HEP was used up to a 0.2g earthquake (design basis). From 0.2g to 0.4g, the HEP linearly increased from the IPE HEP

. to a value of 0.5. From 0.4g to 0.6g, the HEP linearly increased from the 0.4g value to 1.0.

Above 0.6g, the HEP was set to 1.0. Figure 3.6-2 shows a generic representation of this type of non-lognormal fragility.

Post-accident human actions that are performed outside the control room and required within one hour were also assigned a non-lognormal fragility. The IPE HEP was used up to a 0.2g earthquake. From 0.2g to 0.4g, the HEP linearly increased from the IPE HEP to a value of 1.0. Above 0.4g, the HEP was set to 1.0. Figure 3.6-3 shows a generic representation of this type of non-lognormal fragility.

Post-accident human actions that were not required within one hour of the seismic event were not changed from the IPE HEP. These were assumed to be required well beyond the time of the seismic initiator and, with exception of structural and component failures, not expected to be affected by the initial ground motion. These HEPs did not 113.ve a fragility associated with them .

3-49

3.6.5.2.3 Seismic Event Tree Headings The seismic event tree heading fragilities were developed and discussed in Section 3 .6.2. The fragilities were input as a median capacity with a lognormal standard deviation (beta), which defined a lognormal fragility curve.

3.6.5.2.4 Quantification The SHIP Code (Ref. 3-30) was used to perform the seismic event tree quantification. Fifteen sequences were identified. Figure 3.6-1 shows the seismic event tree and Table 3.6-1 contains the fifteen sequence definitions. The sequence cutsets discussed in Section 3 .6. 5 . 1 were used along with the seismic event tree heading fragilities and site hazard curve.

SHIP evaluated the site hazard curve at discrete ground motion levels and quantified each sequence cutset at each ground motion level. This resulted in a fragility for each sequence.

The sequence fragilities were combined in the seismic event tree according to the event tree sequence definitions (Table 3.6-1). The core damage frequency and plant level fragility was calculated by integrating the event tree sequence definitions with the mean site hazard curve.

3.6.5.3 Quantification Results

• • The results of the seismic event tree quantification provided a mean core damage frequency, plant median fragility and plant HCLPF. These results are presented in Table-3.6-2.

Sensitivity analyses were performed to identify important random failures as well as important seismic events and human actions.

The following screening criteria were used to identify sequences to discuss in this section.

This criteria is identical to the functional reporting requirements presented in Generic Letter 88-20 (Ref. 3-31) and presented in NUREG-1407 (Ref. 3-14):

1) Functional sequences with a CDF greater than lE-06/yr. Functional sequences for the Palisades SPRA are the five accident classes defined in Section 3.6.4.

2) Functional sequences that contribute 5% or more to total CDF.

3) Sequences determined by Palisades to be important contributors to CD F or containment performance.

3.6.5.3.1 Accident Class Results The results of the seismic event tree quantification was evaluated with respect to accident classes. The accident classes are defined in Section 3. 6 .4. The results of the accident class

• 3-50

evaluation are presented in Table 3.6-3 and Figure 3.6-4. Accident Classes IHA, IIIB and IV

• had no contribution to core damage frequency.

Only two functional accident classes meet the reporting criteria defined in NUREG-1407:

Class IA and Class IB. Discussion of the other accident classes is provided to complete the presentation of the SPRA results.

Accident Class IA Accident Class IA (loss of secondary heat removal and failure of once through cooling during the injection phase) contributes to approximately 373 of the total core damage frequency.

This accident class has a mean core damage frequency of 3.85E-6/yr and a HCLPF of .229g.

The principal contributors to Class IA following a seismic event are associated with makeup to the condensate storage tank (CST). The CST nominally has capacity to provide makeup of the steam generators to account for approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of decay heat removal. Notmal on-site makeup supplies (such as from demin water storage) rely on offsite power for transfer to the CST. Alternate sources of makeup include fire protection system (FPS) makeup to the suction of AFW pumps P-8A&B or the CST itself (which can then supply suction to AFW pump P-8C). Additionally, AFW pump P-8C suction can be aligned from the service water system (SWS).

• Dominant seismic contributors to these sources of makeup include the day tanks for the diesel fire pumps, FPS control cabinet (EC-137) and transformer EX-13 (power for electric fire pump P-9A). Loss of this equipment is assumed to lead to failure of the FPS leaving only P-8C with SWS as the principle long term suction source. There are no significant vulnerabilities of the SWS to a seismic event. However, the SWS feeds only the suction of the AFW pump P-8C. No credit is taken for the SWS cross-tie to the FPS to allow the SWS to supply suction water to AFW pumps P-8A&B. The seismically induced failures of the FPS effectively leaves one train of AFW (pump P-8C) for long term makeup to the steam generators. Loss of this train due to random failure leads to initiation of once through cooling with either train of HPSI pumps and at least one PORV. There are no seismic failures that significantly impact the operation of equipment required for once through cooling during the injection phase.

Accident Class IB Accident Class IB (loss of secondary heat removal with failure of once through cooling during the recirculation phase) contributes to approximately 35 3 of the core damage frequency. This accident class has a mean frequency of 3.65E-6/yr and a HCLPF of .236 g.

Similar to Class IA, the dominant failures leading to damage in this accident class are a result of loss of equipment used for CST makeup. This equipment includes the day tanks for the

• 3-51

diesel fire pumps, FPS control panel (EC-137) and transformer EX-13. Also, like Class IA,

• there are no seismic failures that significantly impact the operation of equipment required for once through cooling during the recirculation phase should random failures for AFW pump P-

. 8C suction result in failure to provide long term makeup to the steam generators.

Accident Class II Accident Class II (failure of containment heat removal) contributes to only 4% of the core damage frequency. This accident class has a HCLPF of .416g.

Following a small break LOCA or successful initiation of recirculation following initiation of once through cooling, long term containment heat removal is required. Systems supporting containment heat removal include containment spray, containment air coolers, component cooling water.and service water. All of these systems have relatively high seismic fragilities.

Accident Classes IIIA and IIIB Accident Classes IIIA (primary coolant system makeup failure during the injection phase for SBLOCAs) and IIIB (primary coolant system makeup failure during the recirculation phase for SBLOCAs) did not contribute to core damage frequency or plant level fragility. The seismically induced LOCA requires HPSI injection and recirculation, which have limited vulnerability to seismic failures as discussed for Accident Classes IA and IB.

• Accident Class IV Accident Class IV (core damage due to failure of reactivity) contains sequences from the ATWS event tree and did not contribute to core damage frequency or plant level fragility.

• Non-Accident Class Core Damage Frequency Contributors Single seismic fragilities were developed for the reactor building (containment building),

auxiliary building, and the surrogate event. Each of these failure modes conservatively is assumed to lead to core damage. The results for these events are included in Table 3.6-3.

3.6.5.3.2 Important Seismic Events There was no seismic event or group of similar seismic events that domirui.ted the SPRA results. There were four groups of events that contribute the most to the SPRA results: fire protection system (FPS).; main steam isolation valves (MSIVs); diesel generator fuel oil supply; and bus undervoltage relay for safety bus lD .

• 3-52

Fire Protection System The dominant seismic events in the FPS are: 1) the seismic capacity of the diesel day tanks (T-24 and T-40) for the two diesel driven fire protection pumps (P-9B and P-41); 2) the control panel for one of the diesel driven fire protection pumps (EC-137); and 3) station transformer

13. All of these components were given a low fragility, 0.22g PGA median.

The walkdown for these components identified issues that result in low seismic fragilities. The diesel day tanks are unanchored and located on unanalyzed (assumed unqualified) block walls.

The control panel is considered unanchored due to severe corrosion of the base steel. The transformer is unanchored.

The FPS is important in a seismic event because it provides an alternate suction source for AFW pumps P-8A and B and makeup to the CST (for AFW pump P-8C). This failure mode contributes to Accident Classes IA and IB because the AFW pumps a,re the primary long term system for cooling the PCS, via the steam generators. 'Loss of FPS makeup to the suction of AFW leaves the SWS as the principal long term makeup source to AFW through the suction P8C. No credit is taken for the cross-tie ofthe SWS to the FPS for AFW pumps P-8A&B suction.

Main Steam Isolation Valves

• The MSIVs are assumed to interact with components located near the valves during significant .

ground motion. The SPRA models the result of this interaction as failure of the MSIVs to close and isolate the steam generators. Closure of the MSIVs is important only if an ADV

. randomly fails closed. ADVs are assumed to open on a plant trip. If the MSIV on the unaffected steam generator remains open, then both steam generators depressurize as there is a cross-connect between the steam lines downstream of the MSIVs. The blowdown of both

• steam generators is modeled in the SPRA as an excessive steam demand requiring termination of AFW flow to the steam generators. This is very conservative modeling as, in fact, the operators would continue to supply AFW makeup to the least affected steam generator rather than isolate both of them. Realistic development of two steam generator blowdown sequences would likely eliminate seismic interactions with the MSIVs as having any risk significance.

No credit is taken for operators to continue to feed at least one steam generator.

Diesel Generator Fuel Oil Supply The diesel generator fuel oil tank (T-10) provides a fuel supply for both diesel generators.

While having a relatively high fragility, the diesel generators are important following a seismic event in that a loss of off-site power is relatively likely. The DG day tanks have a high fragility and can supply approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> of fuel oil for each DG. Following that, T-10 is relied upon for diesel oil replenishment of the day tanks. Operation of the turbine driven AFW pump.can provide for adequate heat removal even if loss of the diesel generators occurs.

3-53

It is assumed in the SPRA, however, that this independent means of makeup is no longer available once station battery depletion occurs (approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />).*

Undervoltage Relay for Bus ID Should a seismic event lead to a loss. of off-site power, diesel generator operation becomes important. DG 1-2 has higher importance relative to DG 1-1 as it supplies power to AFW pump P-8C. This AFW pump is important to long term makeup to the steam generators should the fire system become unavailable following a seismic event (as discussed in the results for Accident Classes IA & IB, Section 3.6.5.3.1). While it has a relatively high fragility, the undervoltage relay for Bus lD provides a signal to start DG 1-2 resulting in its importance. As operation of P-8C by itself is not likely to be required until CST depletion, credit for local operator action to start and load the diesel after the earthquake reduces the importance of this seismic failure.

3.6.5.3.3 Important Random Failures The Palisades SPRA has few low fragility seismic failure modes that by themselves lead to core damage following an earthquake. There are several random failures which are necessary in addition to any seismically induced failures before core damage would occur. The following are several of the more important random failures to the SPRA: 1) diesel generator 1-2 (DGl-2); 2) auxiliary feedwater (AFW) pump P-8C; and 3) atmospheric dump valves

• (ADVs).

Diesel Generator 1-2 There are two dominant random event groups contributing to the failure of DG 1-2: failures associated with the DG; and failure associated with the feeder breaker to the bus. The failure rate for these two groups is 5.56E-02/yr and 2.13E-02/yr, respectively, for a total of 7.69E-02/yr. DG 1-2 is the more risk significant of the two diesel generators following a seismic event as it powers AFW Pump P-8C as well as two of the three SWS pumps. AFW pump P-8C and service water makeup to AFW become important should seismically induced failures of.

the FPS occur preventing this means of makeup* for a long term AFW operation.

Auxiliary Feedwater Pump P-8C There are two dominant random event groups contributing to the failure of AFW pump P-8C:

failures associated with the pump and power supply; and failures associated with the manual supply valves to align service water as an alternate suction source. The failure rate for these two groups is 2.36E-02/yr and 3.65E-02/yr, respectively, for a total of 6.0lE-02/yr. Again P-8C operation becomes important for long term makeup to the steam generators should other means of supplying water to the CST or AFW pumps P-8A and B become unavailable following a seismic event .

• 3-54

Atmospheric Dump Valves

., The random events associated with the ADVs are the valves fail to close or remain closed .

Failure of the ADVs to close or {'emain closed leads to an excessive steam demand and, if MSIV failure also occurs, results in blowdown of both steam generators. The failure rate associated with one ADV is 3.26E-02/yr. As noted in the discussion above for the MSIVs, realistic modeling of AFW operation following the depressurization of both steam generators would credit continued makeup to the least affected steam generator. This would limit the importance of failed open ADVs to the SPRA results. No credit is taken for the operators to continue to feed at least one. steam generator.

3.6.5.3.4 Important Human Actions A sensitivity analysis was performed to identify those operator actions that are most important to the results of the SPRA. No operator .actions were added to the logic models that were unique to the SPRA. However, a number of the operator actions already included in the IPE are also important following a seismic event. As discussed in Section 3.6.5.2.2, post-accident human error probabilities were assigned a fragility based on the location of the human action (control room or local) and the timing of the human action (early or late).

Initiation of Once Through Cooling Once through cooling is initiated if makeup to the steam generators is lost. In the SPRA, it is credited after random failure of the AFW system or in sequences in which CST depletion occurs and alignment of the SWS or the FPS to AFW suction is not successful. This operator action plays a significant role in limiting the magnitude of accident class IA (loss of secondary heat removal and failure of once through cooling during the injection phase).

Initiation of Makeup to the Suction of AFW A number of operator actions are modeled in the SPRA that are directed at continued makeup to AFW following CST depletion. These actions include alignment of the FPS to the suction of AFW pumps P-8A and P-8B or the SWS to the suction of P-8C. Successful alignment of these sources of water to AFW can be performed if normal CST makeup is unavailable (as a result of loss of off-site power). Alternatively, the operator can elect to cooldown the plant and establish operation of shutdown cooling prior to CST depletion. Makeup to AFW plays a role in limiting the potential for both Accident Class IA (loss of secondary heat removal and failure of once through cooling during the injection phase) and Class IB (loss of secondary heat removal and failure of once through cooling during the recirculation phase) .

• • 3-55

AFW Flow Control

• Upon initiation of AFW, control valves regulate flow at 150 gpm to each steam generator. If one steam generator failed to receive the required flow (via failure of the AFW header or control valves), operator action is required to increase the flow to the good header to remove the decay heat. This operator action is important to both Accident Class IA and IB if one of the two AFW headers to a steam generator is unavailable due to random failures following an earthquake.

3.6.5.3.5 Contribution by Ground Motion The seismic event tree integration was evaluated at discrete ground motions. The contribution to core damage frequency by ground motion is shown in Figure 3.6-5. The highest core damage contribution occurs from the range of 3 .5g to .45g PGA. Approximately 80% of the core damage frequency occurs between .25g and .75g.

The hazard curve only provides data through a ground motion of l.02g. No analysis beyond

1. 02g is performed. Beyond this ground motion, the surrogate event, for which failure leads directly to core damage, is dominant. The surrogate ev~nt has a fragility of l.08g median and beta of 0.30. Thus, it is not expected to lower the plant HCLPF or median fragility value, as calculated. In addition, the overall contribution of the surrogate event is less than 6 %. The worst case scenario would be for the surrogate event to fail at the maximum evaluated ground motion level of l.02g versus the 50% failure rate provided. This would increase the core

• damage frequency to l.03E-05 versus the calculated core damage frequency of 8.88E-06.

Based on this evaluation, contribution from seismic events above 1. 02g is not expected to impact the results of the SPRA.

3.6.5.4 Sensitivity Analyses Several sensitivity analyses were, performed to obtain a better understanding of the SPRA results. The sensitivity analyses assisted in identifying the dominant contributors to core damage frequency. There were three sensitivity* analyses perfomied: upgrading of the FPS equipment; eliminating the TB fire initiating event; and modifying the random events probabilities.

3.6.5.4.1 Fire .Protection System Sensitivity The fire protection system (FPS) is a low fragility system that appears in many cutsets. This identified the FPS as a c~didate for a sensitivity analysis. The sensitivity analysis requantified the seismic event tree with the fragility for several FPS components modified.

The following fragilities were increased to .3g HCLPF (.65g median, beta of .46) from. lg HCLPF (.22g median, beta of .46): diesel day tanks (T-24 and T-40); station transformer 13 (EX-13); and FPS control panel (EC-137).

• 3-56

• The results of this sensitivity analysis decreased the core damage frequency to 7.16E-06 and increased the HCLPF and median fragility to .229g and .534g, respectively.

3.6.5.4.2 Turbine Building Fire Sensitivity The seismically induced TB fire conservatively assumes that all equipment located in the TB fails. A sensitivity analysis was performed to assess the impact of this conservative assumption. The sensitivity analysis requantified the seismic event tree with no TBFR heading.

The results of this sensitivity analysis had very little impact on the core damage frequency or fragility. The core damage frequency decreased to 8.64E-06 and the HCLPF and median fragility increased to .221g and .490g, respectively.

3.6.5.4.3 Random Events Sensitivity To assess the impact of random events on the SPRA, a sensitivity analysis was performed on the random event probabilities. Two sensitivity analyses were performed with the random event probabilities: resetting all to 0.0; and resetting all to 0.0 except for the high failure rate and important random events.

The results of resetting all random event probabilities to 0.0 reduced the core damage frequency to 5.83E-06 and increased the HCLPF and median fragility to .266g and .562g, respectively. This indicates that random events are important to the SPRA.

The high probability and important random events were determined to be those with a failure rate greater than 2. OE-02 and those in cutsets with low fragility seismic events. These were anticipated to be the events that contribute the most. There were a total of eight random events divided into three groups as identified and discussed in Section 3.6.5.3.3. The results of resetting all random probabilities to 0. 0 except for the eight events in these groups reduced core damage frequency to 7.93E-06 and increased the HCLPF to .222g.

3-57

3.6.6 Tables and Figures for SPRA Modelling and Results

. Table 3.6-1 Seismic Event Tree Sequence Definitions SEQUENCE SEQUENCE DEFINITION 1 /SURR*/RB*/AB*/TBFR*/TBFL*/LOOP*/SBL*TRANS 2 /SURR*/RB*/AB*/TBFR*/TBFL*/LOOP* SBL*SBLOCA 3 /SURR*/RB*/ AB*/TBFR*/TBFL

• LOOP*/SBL *TRANS 4 /SURR*/RB*/AB*/TBFR*/TBFL* LOOP* SBL*SBLOCA 5 /SURR */RB*/ AB*/TBFR

• TBFL */LOOP*/SBL*TRANS 6 /SURR*/RB*/AB*/TBFR* TBFL*/LOOP* SBL*SBLOCA 7 /SURR*/RB*/AB*/TBFR* TBFL* LOOP*/SBL*TRANS 8 /SURR*/RB*/AB*/TBFR* TBFL* LOOP* SBL*SBLOCA 9 /SURR*/RB*/AB* TBFR*/LOOP*/SBL* TRANS 10 /SURR*/RB*/AB* TBFR*/LOOP* SBL* SBLOCA 11 /SURR*/RB*/AB* TBFR* LOOP*/SBL* TRANS 12 /SURR*/RB*/AB* TBFR* LOOP* SBL* SBLOCA 13 /SURR*/RB* AB 14 /SURR* RB

• 15 SURR I = success of the heading (i.e., /LOOP means off-site power available)

SURR = surrogate event RB = reactor building AB = auxiliary building TBFR = turbine building fire TBFL = turbine building flood LOOP = off-site power SBL = small break LOCA TRANS = transfer to the Transient Event Tree SBLOCA = transfer to the SBLOCA Event Tree

• 3-58

• Table 3.6-2 Seismic Results INDEX RESULT Mean CDP 8.88E-06 Median Fragility 0.488g HCLPF 0.217g

• 3-59

Table. 3.6-3 Seismic Results by Accident Class MEDIAN ACCIDENT CLASS MEAN CDF FRAGILITY HCLPF IA 3.16E-06 .522 .229 IB 3.00E-06 .598 .195 II 3. llE-07 1.23 .416 IIIA 3.34E-11 NIA NIA IIIB 2.57E-10 NIA NIA IV NIA NIA NIA SURROGATE 5.24E-07 1.08 .500

• RB AB 9.41E-07 9.41E-07 1.08 1.08

.500

.500 NI A = Not available - could not be calculated

• 3-60

..J

• FIGURE 3.6-1 SEISMIC EVENT TREE INIT SURR RB AB TBFR TBFL LOOP SBL RESULTS TRANSIENT ET I

I SBLOCAET TRANSIENT ET I

I SBLOCAET TRANSIENT ET I

I SBLOCAET TRANSIENT ET

-*- I I SBLOCAET

• I I

I TRANSIENT ET SBLOCAET TRANSIENT ET I SBLOCAET COREMELT

• CORE MELT CORE MELT INIT- SEISMIC INITIATING EVENT SURR - SURROGATE EVENT INTACT RB - REACTOR BUILDING INTACT AB - AUX BUILDING INTACT TBFR - NO TB BLDG SEISMIC-FIRE TBFL - NO TB BLDG SEISMIC-FLOOD LOOP - OFF-SITE POWER AVAILABLE SBL - NO SEISMIC-SBLOCA

• 3-61

EARLY CONTROL ROOM OPERATOR ACTIONS GENERIC HEP FRAGILITY 0.8 Ci 0

z

~~

0.6 ~~

-~ ~~ ~

~

~~

~

0 Vl I

~

.g.... Ci 0

°'

~~

N 11.

0.4 ~~

~

E~

C"I I

N

~~

~ g;j 0.2 ~

Cll IPE HEP 0

0 0.2 0.4 0.6 I 0.8 Ground Motion

• FIGURE 3.6-3 LOCAL\EARLY HEPS GENERIC FRAGILITY

• • • ~-----------~-------r 00 0

N d

0 0.. 0

'<t" ~

00

'°d d "1J 0

d :I:

Al!l!GEGOJd "1J e:

3-63

SEISMIC RESULTS BY ACCIDENT CLASS IB (33.8%)

wI

~

• 0 FIGURE 3.6-5 SEISMIC RESULTS BY GROUND MOTION 0 0 0 00 N 0 I

I\ -r-:.

\Ci 0

I\ -

~

0

~

\Ci M

"' 0

"' '\.

'\

\

_J -

.. ~

\Ci 0

8 0

M N 0 UO!lnQ!JlUO:) lU:l;)l:ld 3-65

Table of Contents

• Section 3.7 Containment Performance

3. 7.1 Containment Structures and Systems 3-68

3. 7.2 Analysis of. Containment Performance Following a Severe Accident 3-69 3.7.2.1 Plant Damage States Dominant in the SPRA 3-69 3.7.2.2 Containment Event Tree Evaluation 3-72

3. 7.3

• Comparison of Containment Response to the IPE 3-75

3. 7.4 Tables for Containment Performance 3-76

• 3-66

• 3. 7 Containment Performance As stated in NUREG-1407 (Ref. 3-14), the purpose of the IPEEE containment performance evaluation is to identify vulnerabilities that involve early failure of containment functions that differ significantly from those identified in the internal events IPE. NUREG-1407 guidance for the seismic IPEEE requires an evaluation of any seismjcally induced containment failures and other containment performance insights. Particularly, the evaluation should consider vulnerabilities found in the systems/functions which could lead to early containment failure or which may result in high consequences. This includes: isolation, bypass, integrity, and systems required to prevent early failure.

The scope of this analysis is based upon a review of the Level 2 analysis that was performed for the IPE (Ref. 3-10) as well as the specific issues presented in Section 3.2.6 of

• NUREG-1407.

3.7.1 Containment Structures and Systems A seismic assessment was performed to identify potential vulnerabilities that could lead to early failure of containment functions. Structures, systems, and components needed to ensure containment integrity, containment isolation, and prevention of bypass were reviewed.

Containment Integrity A specific walkdown for containment integrity was conducted to identify, if they exist, any vulnerabilities associated with early containment failures. This review included the integrity of the containment itself, isolation systems such as valves, mechanical and electrical penetrations, bypass systems and plant-unique containment systems such as igniters or active seals.

Virtually all power-actuated valves from the containment air coolers were reviewed as either part of the USI A-46 (Ref. 3-25) or IPEEE program efforts. In addition, service water isolation valves along with their associated solenoid valves were reviewed and no concerns were found (these valves receive a signal to open on SIS). Typical mechanical penetrations with their associated valves were assessed from both the inside and outside of the containment wall (shell). No piping supports were closer than 3' to the containment shell so all systems have sufficient flexibility to withstand differential displacement between the internal structure and the shell of containment.

Electrical penetration areas were reviewed at Elevations 609', 613', 617', 621', 627', and 630'. Ceramic insulators were found, but there is no potential to stress them due to differential movement, so they were judged not to be susceptible to damage during an

• earthquake.

3-67

The emergency hatch was walked down. It is welded to the liner, is about 4' in diameter and cantilevers about 4' from the liner. It was judged to be rugged with no seismic vulnerabilities.

The personnel air lock and equipment access hatch are rugged with no credible seismic vulnerabilities.

Containment Systems Many of the essential components needed to maintain containment functionality were seismically evaluated as part of the Level I portion of the SPRA, including components of the following systems: AC power, DC power, ECCS, service water, and component cooling.

In addition, examination of important components associated with containment systems was performed: containment spray and containment coolers. Screening and fragility evaluation results for these components are discussed in Section 2. 5. .

The purpose of this evaluation is to determine the functionality of systems which impact containment response to important accident sequences identified during the Level I seismic analysis. Table 3.7-1 provides a summary of the systems available following seismically induced core damage to provide functions such as debris cooling and containment heat removal. Of the six accident classes analyzed in the Level I part of the SPRA, only two (Accident Classes IA and IB) meet the screening criteria of NUREG-1407 (Ref. 3-14). The challenge to containment for these accident sequence types is discussed below. The review of both accident classes supports the conclusion that containment response to core damage

• following a seismic event is similar to.that anaiyzed in the internal events PRA .

3. 7 .2 Analysis of Containment Performance Following a Severe Accident In the internal events PRA, an evaluation of the containment response to any given severe accident used a two phase approach involving:

1) a Plant Damage State event tree (evaluation of the status of containment systems); and

2) a Conta~ent event tree (evaluation of phenomenological response to each Plant Damage State).

In this section, an evaluation is made of the Plant Damage States which would be expected to dominate the Palisades SPRA results. It is followed by a quantitative estimate of accident sequence frequencies rom the containment event tree to determine the distribution of containment challenges.

3.7.2.1 Plant Damage States Dominant in the SPRA In the first phase of the containment analysis, distribution of the Level I core damage sequences among eighteen possible Plant Damage States was performed. Table 3. 7-2 identifies aspects of the accident sequences which define each of these eighteen Plant Damage

States. The plant damage states were developed around four distinct parameters which establish the characteristics of the accident sequence and plant systems important to quantification of phenomenological challenges evaluated in the CET:

1) Accident sequence initiator type (e.g., Transient, LOCA, SGTR, ATWS, etc.);

2) Timing of core damage with respect to initiation of offsite protective actions (early or late);

3) Status of secondary cooling; and

4) Status of plant systems important to containment functions (e.g., containment spray, coolers, location of SIRWT inventory, etc.).

The discussion which follows identifies Plant Damage States TEJP and TEJR as dominant, requiring evaluation for containment response in the Palisades SPRA. The characteristics of both of these plant damage states are that they are transient initiated ev_ents with no secondary cooling leading to relatively "early" core damage. The SIRWT contents are successfully injected to containment. For the first plant damage state (TEJP) long term recirculation is available whereas for the second plant damage state (TEJR) it is not.

SPRA Initiator Types As noted in Section 3.6, the Palisades SPRA is dominated by two specific Accident Classes; Class IA (loss of secondary heat removal with failure of once through cooling in the injection

• phase) and Class IB (loss of secondary heat removal with failure of once through cooling in the recirculation phase). Both of these accident classes represent transient initiators in which both the reactor coolant system and containment are intact up to the time at which core damage is assumed to occur. Other initiators such as LOCA, ATWS or SGTR are substantially less likely to be caused by a seismic event and do not dominate the SPRA results.

SPRA Core Damage Timing In Section 3.6, it was noted that the principle failures leading to core damage following a seismic event are associated with CST makeup. In the majority of accident sequences, makeup to the steam generators and removal of decay heat is adequate using the inventory normally available in the CST. It is not until CST depletion occurs (nominally 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> .after the initiating event) that other means of providing makeup for AFW operation or initiation of once through cooling is required.

In Accident Class IA, initiation of once through cooling is assumed to be unsuccessful resulting in the slow depletion of reactor inventory through pressurizer.PORVS or safety relief valves. Approximately 7 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event, primary system depletion would be sufficient for fuel damage to be initiated. Another hour would be required before fuel melting*

and slump to the bottom of the vessel. *

• 3-69

• In Accident Class IB, once through cooling is initiated successfully and core cooling is adequate as the contents of the SIRWT are injected to the vessel. Core cooling can be maintained in the once through cooling mode for several hours in this manner. *At the time of SIRWT depletion, switch to recirculation is required piggy-backing a HPSI pump to the discharge of a containment spray pump. In this accident class, recirculation is assumed to be unsuccessful. Depletion of reactor inventory is assumed to occur such that core damage would be expected approximately 9 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> into the event. Another one to two hours would be required for fuel melt progression to the lower portions of the vessel.

For either of these accident classes, .core damage and core melt progression to lower head penetration would not be expected before 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the initiating event. It was assumed in the internal events PRA that implementation of protective actions in accordance with the Emergency Plan would not occur until core damage was anticipated. As such, Accident Classes IA and IB would be considered to be early core damage scenarios. This classification will be retained in the SPRA to be consistent with the definitions in the internal events PRA even though core damage would not be expected for a substantial period of time.

SPRA Secondary Heat Removal Status Accident sequences classified in both Classes IA and IB are defined as having no secondary heat removal.

• SPRA Containment Systems Status Table 3. 7-2 lists each of the systems evaluated in the Plant Damage State event tree in the IPE, *

. Section 3.3 (Ref. 3-10). The availability of each system is noted for the two dominant accident classes of the SPRA, classes IA and IB. Also noted are any potential vulnerabilities of the systems to seismic failure modes as identified in Section 2.5. In Class IB, once through cooling has been successful initially, allowing the SIRWT inventory to be pumped into the reactor and ultimately containment. It is noted for Class IA, on the other hand, that initial iajection of the SIRWT would not have occurred at the point that core damage is assumed.

However, other systems are available to assure SIRWT contents are provided to containment in the form of containment spray or LPSI once vessel penetration occurs. With the exception of one containment spray valve, these systems are not susceptible to seismic failure modes that would preclude their operation post core damage. For these reasons, it can be concluded that the predominant plant damage states expected in the SPRA .are those in which the SIRWT contents are located in containment.

In Accident Class IA, low head injection and containment spray should be available for recirculation as well as injection of the SIRWT as there are no significant vulnerabilities of components important to recirculation to seismic failure. In Class IB scenarios, recirculation in the once through cooling mode is not assumed to be successful.

• 3-70

Having assessed the status of injection systems, containment sprays and the location of SIRWT

• inventory, the remaining containment system in Table 3.7-2 is Containment Coolers. As neither the containment coolers or service water system were identified as being susceptible to any significant seismic failure modes, it can be concluded that containment coolers are likely to remain available following a seismic event.

Selection of SPRA Plant Damage States From the preceding discussion, the characteristics of the Accident Classes which dominate the Palisades SPRA are as follows:

1) Transient initiated (non-LOCA, ATWS, etc.);

2) "Early" core damage (even though not expected for 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following a seismic event);

3) No secondary cooling;

4) SIRWT contents in containment with containment coolers available;

5) For Accident Class IA, recirculation with containment spray or LPSI is available; and

6) For Accident Class IB, recirculation is assumed.

These accident sequence characteristics match those of two Plant Damage States as defined in the internal events PRA. Accident Class IA is expected to be predominantly assigned to Plant Damage State TEJP due to the availability of long term recirculation. Under the assumption that recirculation is not available, Acddent Class IB can be largely represented by Plant Damage St;ate TEJR.

3.7.2.2 Containment Event Tree Evaluation Figure 3. 7-1 is the containment event tree developed for the internal events PRA. Heading definitions for the Palisades CET are as follows.

BYE Early Containment Bypass. This CET heading principally identifies the potential for interfacing system LOCA. This containment failure mode is not likely to result from a seismic event and, therefore, is not applicable to the SPRA.

CIS Containment Isolation. This mode of containment failure was evaluated as a part of the seismic walkdowns discussed in Section 3.7.2.

BYL Late Containment Bypass. This mode of containment bypass is considered as a part of core melt progression. In the Palisades internal events PRA it was driven by creep rupture of the steam generator tubes. This containment failure mode did not dominate the containment results for the internal events PRA and would not be expected to become any more likely as a result of a seismic initiator. *

-* 3-71

,. RIV Recovery in Vessel. The principal means of terminating core melt progression prior to vessel penetration credited in the internal events PRA is to submerge the lower vessel head. To accomplish this at Palisades, Containment Sprays are assumed to be required to recirculate water through the RHR heat exchangers and maintain water level up around the reactor vessel by means of the reactor cavity flooding system piping.

UDD Upward Debris Dispersal at reactor vessel failure: This CET heading defines the potential for core debris exiting the lower vessel head and being entrained by steam and gases from the vessel blowdown to areas in the upper part of containment. For this relocating of debris out of the reactor cavity to occur, the reactor must be at high pressure and a significant portion of debris must be entrained. ,-

CAE Early Relocation of the Core to the Auxiliary Building. The containment sump for Palisades is located beneath the reactor cavity as shown in Figure 3.7-2. If debris were to exit the lower head and remain in the reactor cavity in an uncooled state, flow through the reactor cavity floor drains and erosion of the floor of the reactor cavity could lead to relocation of the debris to the sump. From there, the debris is assumed to flow through the suction piping of ESF pumps into the engineered safeguards rooms in the Auxiliary Building.

CIE Containment Intact Early. This CET heading identifies potential challenges to containment from phenomena that might occur at or near the time of vessel failure.

• LVE These phenomena include hydrogen burning, steam explosion, vessel blowdown forces, and direct containment heating.

Early Large Volatile Fission Product Release. Sequences in which sprays are available or releases are through pools of water result in limited volatile releases.

CAL Late Relocation of the Core to the Auxiliary Building. This CET heading is similar to CAE except that relocation to the Auxiliary Building is substantially delayed due to significant debris being retained in the reactor cavity and only a limited amount flowing through drains to the sump until long term erosion of the cavity floor occurs.

CIL Containment Intact Late. This heading defines potential challenges to containment that might occur substantially later than core damage or vessel penetration. Such challenges would include long term over-pressurization by steam, noncondensible gas generation and combustion of hydrogen evolved from core concrete interaction.

CCI Core Concrete Interaction resulting in a large fission product release. This type of release requires oxidation of zirconium to be in progress at the time of containment failure.

• 3~

• LVL Late Large Volatile Release. This type of release requires revaporization of fission products at the time of containment failure or long term dryout of pools performing debris cooling.

The Palisades containment event tree was quantified as a part of the internal events PRA for each Plant Damage State. As containment systems are not a part of the CET, but are quantified in the Plant Damage State analysis, the CET quantification is based strictly on phenomenological challenges important for each plant damage state and is independent of what initiates the accident sequence. The CET quantification performed in the internal eyents PRA is therefore applicable to the SPRA.

As discussed in Section 3.7.2.1, Plant Damage States TEJP and TEJR are expected to dominate the Palisades SPRA results. The distribution of these plant damage states through the CET from the internal events PRA is shown in Figure 3.7-1. For both of these plant damage states, early challenges to containment are no different than expected in the internal events PRA. They do not dominate risk because of the large volume of containment and its strength (ultimate capacity in excess of 140 psig).

For State TEJP (Accident Class IB), one CET sequence dominates the results

1. 13 Successful recovery in-vessel Long term containment integrity successful with lesser contribution from two other sequences

1. 19 No recovery in-vessel Significant upward debris dispersal Long term containment integrity successful

1. 32 No recovery in-vessel No significant upward debris dispersal Early core relocation to the Auxiliary Building No early large volatile release or long term core concrete interaction.

For State TEJR, only sequences 19 and 32 dominate.

The difference between the two plant damage states lies in the capability of recovering the event within the vessel. To terminate core melt progression in-vessel, the reactor cavity must be flooded above the lower head. This requires operation of containment spray and the reactor cavity flooding system. For both plant damage states, containment spray is available in the injection mode. Once the SIRWT is depleted, containment spray must continue in the recirculation mode to maintain reactor cavity inventory from falls due to boiling heat removal or draining to the sump .

• 3-73 I~

For State TEJP, containment spray in the recirculation mode is available supporting long term reactor cavity flooding .. Review of systems required to support long term spray operation reveal no significant susceptibility to seismic failures with the exception of one spray valve.

The remaining spray valve would need to fail due to random causes before cavity flooding would be lost. Recovery in vessel is successful for an estimated 54 % of TEJP sequences (2. lE-6/yr).

For State TEJR, loss of recirculation is assumed to contribute to core damage. As a result, it is assumed that it is also not available for long term operation of containment spray. For this reason, sequence 13, in which recovery in-vessel occurs, is not successful for plant damage

• state TEJR.

In the remaining two sequences, 19 and 32, the core debris is assumed to penetrate the lower vessel head and enter containment. These sequences determine the distribution between long term containment integrity and the potential for relocation of the core debris to the Auxiliary Building. The differences between these two sequences is that in the first one, significant carry over of debris to the upper part of containment occurs such that the remaining debris remains cooled in the reactor cavity or sump as opposed to the flowing to the Auxiliary Building. The roughly even split between these two sequences reflects the uncertainty whether the reactor is at pressure or has blown down as a result of creep rupture failure in the primary coolant loops as well as in how much debris will actually be entrained and removed from the cavity if blowdown from high pressure occurs .

CET Sequence #19 ultimately results in a long term intact containment with heat being removed by containment air coolers. For the TFJP plant damage state, this sequence makes up roughly 163 of the core damage frequency (6E-7/yr). In TEJR sequences, when recovery in-vessel did not occur, it is nearly 403 (1.5E-6/yr).

• CET Sequence #32 leads to release of the core to the Auxiliary Building. However, there are only low volatile releases expected as a result of the SIRWT inventory submerging the debris providing a means of debris cooling and flssion product scrubbing. Sequence 32 makes up approximately 203 (7E-7/yr) of the TFJP core damage frequency and 453 of TEJR (l.6E-6/yr).

3.7.3 Comparison of Containment Response to the IPE The dominant containment failure mode for core damage sequences in Accident Classes IA and IB quantified in the SPRA is relocation of core debris to the Auxiliary Building. The total frequency of this failure mode is on the order of 2.3E-6/yr. or less than 20% of the frequency of this failure mode in the IPE (Ref. 3-10). Even if uncertainties associated with upward debris dispersal after vessel penetration are considered and all SPRA core damage sequences assumed to lead to this failure .mode, this containment challenge would be estimated to be between half to two-thirds that reported for the IPE. The timing of this failure mode is

• 3-74

expected no sooner than 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following the seismic event as it is dominated by depletion of the CSTs before failure of secondary cooling occurs. Because of the availability of SIRWT inventory, there is little or no potential for early large volatile releases from seismic events .

• 3-75

3. 7 .4 Tables for Containment Performance Table 3.7-1 Level I to Level II Dependencies HPSI LPSI css CONT.

AFW HPSI LPSI css RECIRC RECIRC RECIRC COOLERS Class IA .I .I .I .I ,/

Class m .I NIA NIA ,/

Systems/ FPS Components w/ Low makeup CV3001 Seismic Capacity to CST Failed as a part of Level I Core Damage Sequence

.I Available Post Core Damage NIA Not applicable to outcome of Level II results 3-76

• A1 Initiators Large LOCA (d > 18 in)

Table 3.7-2 Palisades Plant Damage State Designators Ai Medium LOCA (2 in < d < 18 in)

B Small LOCA (1/2 in < d < 2 in) c Interfacing System LOCA D Steam Generator Tube Rupture T Transients Secondary Cooling G Secondary Cooling Available J No Secondary Cooling Available Core Damage Timing E Early Damage

• L p

Q Late Damage Containment Safeguards Containment Sprays and Air Coolers Available Containment Sprays Available. and Containment Air Coolers Unavailable R Only Containment Air Coolers Available with SIRWT in Containment s Only Containment Air Coolers Available without SIRWT in Containment v Containment Safeguards with SIRWT in Containment w No Containment Safeguards without SIRWT in Containment x Only HPSl/LPSI Available after Vessel Failure

• 3-77

• 3.8 Conclusions The results of the Level 1 seismic PRA did not identify any significant seismic concerns. The seismic core damage frequency is 8.88E-06, with a high confidence *of a low probability of failure (HCLPF) of .217g PGA. The median fragility is .488g PGA. Approximately 80% of the core damage frequency occurs between .25g and .75g.

There are no seismic events that are dominant contributors to the core damage frequency.

Random failures or human errors are required, along with seismic events, to produce the .

highest contributing cutsets to core damage in the SPRA. This is expected since Palisades has a relatively high design basis* earthquake for its geographic region. None of the engineered -**

safeguards equipment has significant seismic failure modes .

• 3-78

• 3.9.1 GI-131 Flux Mapping Cart Table of Contents Section 3.9 Other Seismic Safety Issues 3-80 3.9.2 Charleston Earthquake Issue (GL 88-20) 3-80 3.9.3 USI A-45 Shutdown Decay Heat Removal Requirements 3-80 3.9.3.1 Secondary Cooling 3-80 3.9.3.2 Once Through Cooling 3-81 3.9.3.3 Decay Heat Removal Conclusions 3-81 3.9.4 USI A-17 Systems Interactions 3-82 3.9.5 USI A-40 Seismic Design Criteria 3-82 3.9.6 USI A-46 Verification of Seismic Adequacy 3-82

• 3-79

3.9 Other Seismic Safety Issues

• The performance of the IPEEE at Palisades was closely related to several other seismic safety issues. The link between the IPEEE and these other issues is presented in this section.

3.9.1 GI-131 Flux Mapping Cart This generic issue pertains to Westinghouse plants only. The Nuclear Steam Supplier for Palisades is Combustion Engineering.*

3.9.2 .Charleston Earthquake Issue (GL 88-20)

The NRC states in response to industry question 7.13 on page D-13 of NUREG 1407 (Ref. 3-14):

"The issue of the 1886 Charleston earthquake has been resolved. The issue of eight outlier plants identified through the Eastern U.S. Seismicity program has been

• subsumed in the IPEEE and no specific reporting is required to close this issue. "

Palisades uses the current LLNL seismic hazard curves (Ref. 3-1) to fulfill the requirements for this issue.

• 3.9.3 USI A~45 Shutdown Decay Heat Removal Requirements USI A-45, "Shutdown Decay Heat Removal RequirementS" is intended to be resolved in the submittal of the IPE and IPEEE, as stated in Generic letter 88-20. This section highlights the conclusions found in the IPEEE with regard to decay heat removal (DHR) systems availability and capabilities. For the purpose of this discussion, DHR is defined as "decay heat removal from the core and primary coolant system (PCS) at conditions beyond the capabilities of the shutdown cooling system. "

The two principle mechanisms used for PCS/core heat removal at Palisades are: 1) secondary cooling, which utilizes the steam generators as a heat sink for the primary coolant system; and

2) once through cooling (OTC).

3.9.3.1 Secondary Cooling Heat removal via the steam generators is the primary and preferred method of removing decay heat until shutdown cooling entry conditions are reached and the shutdown cooling system is placed in-service. Effective heat removal using the steam generators requires circulation of primary coolant through the core with energy removal in the steam generators by use of steam release and makeup. Although it is preferred to utilize the main condenser as the heat sink (to minimize the risk of radioactive releases and to conserve secondary inventory), DHR using the

• 3-80

S/Gs is not dependant upon the main condenser since Palisades has the capability to directly release steam to the atmosphere via steam dump valves and other manually aligned pathways.

There are two mechanisms available for SIG makeup, which are auxiliary feedwater (AFW) and low pressure feed (LPF) using the condensate pumps. LPF is not considered in the SPRA due to the location (in the turbine building) and the reliance on off-site power.* The normal method is using AFW, which has two independent, redundant trains. The primary train has a motor driven pump and a steam driven pump, with nitrogen backup supplies to critical control valves. The secondary train has a motor operated pump and control valves, all located separate from the primary train.

3.9.3.2 Once Through Cooling Trans_ients resulting in a reactor trip employ secondary cooling as the primary mechanism for PCS/core heat removal. For accident scenarios in which secondary cooling cannot be established or maintained, decay heat is absorbed by the primary coolant system causing PCS pressure and temperature to rise. In these accidents, the emergency procedures dictate the use of once-through-cooling (OTC). The operator is directed to start both HPSI pumps, open the PORV block valves and place both PORVs in the open position inducing a medium-break LOCA. In this cooling mode, primary inventory is released through the PORVs into containment resulting in PCS pressure reduction and decay heat removal. HPSI .injection in this mode maintains adequate PCS inventory as well as additional core cooling. It is important

• to note that for transitions from the steam generator heat sink to OTC, only one PORV and orie HPSI pump are required for sufficient DHR removal.

OTC will continue until either shutdown cooling system conditions are met or some form of

. secondary cooling is recovered. Failure of the PORVs to remain open will result in PCS pressure rising to the safety relief valve setpoints, disabling injection flow from the HPSI pumps due to the high pressure. Failure of the PORVs to close subsequent to recovery of secondary cooling results in the continued need for PCS inventory control.

3.9.3.3 Decay Heat Removal Conclusions Accident Classes IA and IB represent sequences that result from the failure of DHR. The results for these classes is presented in Section 3. 6. 5. 3 .1. The core damage frequency for these classes is 3.85E-06 and 3.65E-06, respectively. The fragility for these classes is .522g PGA median with a HCLPF of .229g PGA and .645g PGA median with a HCLPF of .236g PGA, respectively.

The DHR issue was examined as part of the IPE (Ref. 3-10) with details presented in Appendix A of that submittal. Those results indicated that the probability of core damage due to DHR failure is low. The IPEEE evaluated the impact of seismic hazards on the DHR capability and did not yield results that were significantly different from the IPE. Therefore, .

• 3-81

the results show the methods used for decay heat removal at Palisades are adequate and the USI A-45 has been addressed by the Palisades IPE.

3.9.4 USI A-17 Systems Interactions

.The walkdowns explicitly considered USI A-17 interactions and is subsumed in the USI A-46 program. The seismic, fire, and flooding examinations for this IPEEE report incorporate the walkdown findings for USI A-17 related items.

3.9~5 USI A-40 Seismic Design Criteria The one remaining element of USI A-40 concerns the evaluation of tanks. The SPRA added tank to the PRA models to evaluate their seismic affects. The SPRA used the results of the A-46 assessments, which evaluated tanks for the concerns raised in USI A-40. Evaluation techniques incorporated the considerations established for the Seismic Margins Program (Ref.

3-5) thereby resolving the analytical concerns raised in A-40.

3.9.6 USI A-46 Verification of Seismic Adequacy The IPEEE project team performed the SPRA jointly with the A-46 evaluations. The selection of SPRA systems and components sought to retain commonalty with the A-46 SSEL to the extent practical. Seismic walkdown teams gathered data for both evaluations simultaneously .

• 3-82

3.10 References 3-1 NUREG/CR-1488, Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains 3-2 NRC Information Notice 94-32, Revised Seismic Hazard Estimates, April 29, 1994, Review of Revised Livermore Seismic Hazard Estimates for 69 Sites East of the Rocky Mountains 3-3 IE Bulletin 79-14, Seismic Analysis for As-Built Safety-Related Piping Systems, July 2, 1979 3-4 Bechtel Reports: Foundation Investigation for Palisades Nuclear Plant, South Haven, Michigan, 1965; Foundation Investigation for Design of Palisades Nuclear Plant, South Haven, Michigan, 1966; and Soils and Foundation Investigation, Proposed Nuclear Power Plant, Palisades Unit 2, South Haven, Michigan, 1972 3-5 EPRI Report NP-6041-SL, Nuclear Power Plant Seismic Margin, Revision 1 3-6 Generic Implementing Procedure (GIP) for Seismic Qualification of Nuclear Power Plant Equipment, Revision 2

• 3-7 3-8 EPRI Report NP-5228-SL, Seismic Verification of Nuclear Plant Equipment Anchorage, Revision 1 EPRI Report NP-7146, Development of In-Cabinet Amplified Response Spectra for Electrical Panels and Benchboards, Revision 0 3-9 EPRI Report NP-7147-SL, Seismic Ruggedness of Relays Projects 1707-15 and 2925-2, Final Report, August 1991 3-10 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 3-11 Palisades Final Safety Analysis Report (FSAR) 3-12 John A. Blume and Associates Engineers, Calculations of Anchorage and Support of Safety Related Electrical* Equipment 3-13 Seismic Analysis of Safety Related Nuclear Structures, ASCE Standard 4-86, September 1986 3-14 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities

• 3-83

3-15 Deleted

• 3-16 3-17 Palisades Soil Evaluation Report prepared by GEi Consultants, Inc., Revision 1 Inspection and Enforcement Bulletin IEB 80-11, Evaluation of Masonry Wall Design 3-18 EPRI Report TR-103959, Methodology for Developing Seismic Fragilities, by JWReed and RPKennedy, EPRI, June 1994 3-19 Palisades Calculation EA-POC007899-BLDGS, Calculation of Power Block Building Shears and Moments Due to UHS Ground Motion, June 1995 3-20 NUREG-0820, Integrated Plant Safety Assessment - Systematic Evaluation Program, Palisades Plant, Final Report, October 1982 3-21 Palisades Calculation EA-91C2846-C007, Palisades SSI and IPEEE Floor Response Spectra, March 1994 3-22 SHAKE, Computer Program for Earthquake Response Analysis of Horizontal Layered Sites, JLysmer, Report No._EERC 72-12, University of California, Berkeley 3-23 Stevenson and Associates Calculation 91C2850-c013, Seismic Evaluation of Buried

• 3-24 Piping Associated with the Diesel Oil Tank T-10, March 1994 Sheet Metal and Air Conditioning Contractors National Association, Inc, 1985, 1st Edition 3-25 Report of SQUG Assessment at Palisades Nuclear Plant for the Resolution of USIA-46, May 19.95 3~26 NUREG/CR-4840, Recommended Procedures for the Simplified External Event Risk Analysis for NUREG-1150, September 1989 3-27 NUREG/CR-5250, Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky Mountains, Volumes 1-8, January 1989 3-28 Severe Accident Issue Closure Guidelines, Nuclear Energy Institute (NEI) 91-04, Rev 1, December 1994 3-29 Set Equation Transformation System (SETS) Program, Developed by Logic Analysts, Inc. '

• 3-84 .

3-30 Seismic Hazard Integration Package (SHIP) Program, Developed by Jack R. Benjamin and Associates, Inc.

3-31 NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(t), November 1988

• 3-85

• PALISADES INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS TABLE OF CONTENTS

4.0 INTRODUCTION

................... *.................................. 4-2 4.0.1 Background ..................................................... 4-2 4.0.2 Plant Familiarization ......... *.................................... 4-2 4.0.3 Overall Methodology ............................................. 4-3 4.0.4 Summary of Major Findings ....................................... 4-3 4.1 INTERNAL FIRE ANALYSIS ........................................... 4-8 4.1.1 Fire Analysis Methodology ........................................ 4-8 4.1.2 Modeling Assumptions .......................................... 4-15 4.1.3 Review of Plant Information and Sources ............................ 4-16 4.1.4 Plant Walkdown ................................................. 4-17 4.1.4.1 Objectives of Plant Walkdowns .............................. 4-17 4 .1.4 .2 WalkdoWn Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17 4.1.4.3 Findings from Plant Walkdown ......................... ~ .... 4-18 4.1. 5 Identification oflmportant Fire Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18

• 4.1.6 Fire Area Initial Screening ........................................ 4-26 4.1.7 Fire Ignition Data ............................................... 4-30 4.1.8 Fire Detection and Suppression .................................... 4-39 4.1.8.1 Detection ........................... ' .................... 4-39 4.1.8.2 Automatic Suppression .................................... 4-39 4.1.8.3 Manual Suppression ....................................... 4-43 4.1.9 Fire Growth and Propagation ...................................... 4-44 4.1.10 Fire Event Trees ................................................ 4-45 4.1.10.l FireEventTreeTopEventDefinitions .................. 4-45 4.1.10.2 Event Tree For Fire in Main Control Room* .............. 4-46 4.1.10.3

• Event Tree For Fire in Cable Spreading and Switchgear Rooms:t.-47 4.1.10.4 Accident Sequence Classification ...................... 4-48 4.1.11 Analysis of Fire Sequences and Plant Response ....................... 4-52 4.1.11.1 Important Accident Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-52 4.1.11.2 Important Fire Areas/Rooms .......................... 4-55 4.1.12 Containment Performance ........................................ 4-60 4.1.12.1 Containment Structures and Systems .................... 4-60 4.1.12.2 Analysis of Containment Performance Following a Severe Accident ..................... *. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-62 4.1.12.2.1 Plant Damage States Dominant in the Fire PRA . . . . . . . . . . . 4-62 4.1.12.2.2 Containment Event Tree Evaluation .................... 4-65 4.1.12.3 Comparison of Containment Response to the Internal Events PRA

. ............................................................. 4-69 4.1.13 Treatment of Fire Risk Scoping Study Issues . . . . . . . . . . . . . . . . . . . . . . . . . 4-78

PALISADES INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS TABLE OF CONTENTS 4.1.13 .1 Seismic/Fire Interactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-78 4.1.13.2 Fire Barrier Effectiveness ............................ 4-79 4.1.13.3 Effectiveness of Manual Fire Fighting .................. 4:..79 4.1.13.4 Total Environment Equipment Survival ................. 4-80 4.1.13 .5 Control Systems fo.teractions .......................... 4-81 4.1.14 USI A-45 and Other Safety Issues .................................. 4-81 4.1.15 Results and Conclusions ......................................... 4-82 4.1.15 .1 Summary *of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-82 4.1.15.2 Conclusions and Recommendations .................... 4-82 4.1.16 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-84

• 4.0 4.

0.1 INTRODUCTION

Background

The assessment that is described in this section addresses the requirements of Supplement 4 to Generic Letter (GL) 88-20, "Individucµ Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", (Ref 4-1) for internal fires at the Palisades Nuclear Plant. The fire analysis performed for the IPEEE began in 1994 and reflects plant changes made since the IPE (Ref.

4-2). This internal fire assessment combines the PRA approach used in the IPE with the deterministic evaluation techniques of the Fire Induced Vulnerabilities Evaluation (FIVE)

Methodology (Ref. 4-4).

4.0.2 Plant Familiarization The Palisades Nuclear Power Plant is a Combustion Engineering two-loop pressurized water reactor.

The reactor core produces 2560 MWth with an electrical output of 845 MWe. The plant is located on Lake Michigan six miles south of South Haven, Michigan. The primary containment is comprised of a large dry pre-stressed concrete building designed by the Bechtel Corporation.

Construction started on August 25, 1966 and commercial operation began on December 31, 1971.

The core damage frequency in several fire areas has been reduced due in large part to Palisades plant specific implementation of the requirements of 10 CFR 50, Appendix R. Implementation of the plant Fire Protection Program addressed issues such as fire barriers/penetration seals, administrative control of combustibles, fire brigade training and equipment, protection of safe shutdown equipment, etc. The administrative control of transient combustibles is also a contributing factor to the low fire risk-in certain key areas. Fulfillment of these requirements resulted in physical modifications to the plant including installation of an alternate shutdown panel (ASDP), re-routing of safe shutdown cables, and upgrading of fire barriers. Additionally, the Fire Protection organization is in the process of upgrading the existing Fire Protection Program at Palisades. The upgrade includes enhancements to the cable/raceway schedule, completion of circuit analyses to verify operability of key equipment and incorporation of this information into a controlled database. The database will integrate the results of the circuit analyses with other i.Ilformation such as fire area/zone designations, cable designations, raceway locations, etc., into a product that can provide the status of the equipment evaluated in each fire area. This effort is expected to be completed by the end of 1995. The new information will be evaluated for input into the fire risk analysis. Once the fire PRA models have been updated with the revised Appendix R information, the fire risk will be requantified.

4.0.3 Overall Methodology The Palisades Fire Study uses an approach that combined the deterministic evaluation techniques from the FIVE methodology with classical PRA techniques. The FIVE methodology provides a means of establishing fire boundaries as ~ell as methods to evaluate the probability and the timing 4-1

of damage to components located in a compartment involved in a fire. PRA techniques allow determination of compartment-specific core damage frequencies associated with fires within Fire Areas of the plant. Compartments were identified and evaluated, then quantified using the fault trees and event trees from the internal events PRA.

The transient event tree from the internal events PRA and related fault trees were used to perform the quantification. The resulting accident sequences were binned into three accident classes and subclasses; a subset of those used in the internal events PRA. These accident classes and their relative contributions are shown in Figure 4A. l. Contribution to the frequency of core damage by location within the plant is shown in Figure 4.1.2.

4.0.4 Summary of Major Findings The principle finding of this analysis is that there is no area in the plant in which a fire would lead directly to the inability to cool the core. Without additional random equipment failures unrelated to damage caused by the fire, core damage will not occur. As a result, this study concludes that there are no major vulnerabilities due to fire events at the Palisades Nuclear Power Station.

The core damage frequency resulting from fires is estimated to be less than 2E-04/year As a result of this analysis fire induced core damage sequences are the single largest contributor to the total plant core damage frequency. The fire sequences represent slightly more than twice the frequency of the internal events PRA. It should be noted that these results include a number of conservative

• assumptions. For example, automatic or manual fire suppression were not credited except in the control room, cable spreading room and class IE switchgear rooms. Fires were also assumed to completely engulf an area once ignited. No credit was given for continued operation of the main feedwater system for auxiliary building fires. Additional effort to make these and other conservative assumptions more realistic could result in a fire initiated core damage frequency even lower than that presented in this report.

From

. Figure 4.0-1, the majority of the core damage frequency is related principally to two accident classes; Accident class IA represents sequences in which core damage results from failure of secondary heat removal and once through cooling In the injection phase. This accident class represents 46.8% of the total core damage frequency. The majority of the contribution (-91 %) from accident class IA is due to fires in the control room, cable spreading room, spent fuel pool equipment room, turbine building, electrical equipment room, and engineered safeguards panel room. For this accident class approximately 60% (CDF - 3 .3E-05/yr) is the result of assumptions regarding propagation of fires in the control room and cable spreading room as discussed below.

Accident class IB represents sequences in which core damage due to failure of secondary heat removal and once through cooling in the recirculation phase. Accident class IB is 48.9% of the total core damage frequency. This accident c.lass includes fires in the turbine building and the 590 .

• 4-2

• corridor of the auxiliary building. These two areas represent approximately 91% of the core damage from this accident class.

Eighty-five percent of the core damage frequency resulting from internal fires can be traced to five bum areas. These include the turbine building (41 %), main control room ( 19%), cable spreading room (12%), the spent fuel pool (SFP) equipment room (7%) and the auxiliary building 590 corridor (6%). A brief discussion of each of these areas follows; including a description of the means by which adequate core cooling can be assured even if a fire were to cause significant damage.

Turbine Building The turbine building was analyzed as one large area. No credit was given to suppression for fires in this area. For fires in this area, the turbine driven AFW pump (P-8B) via its manual steam supply and motor-driven AFW pump (P-8C) are available for decay heat removal with the steam generators.

In addition, both High Pressure Safety Injection (HPSI) pumps are available for feed & bleed cooling of the primary coolant system (PCS). However, only one train of HPSI injection motor-operated valves are available. The second HPSI pump can be used by cross-connecting its output to the available valves. All three air coolers and all three containment spray pumps are available to remove heat from containment. In recirculation, feed & bleed would be limited to one HPSI pump as the air supply to the other pumps subcooling valve would be failed by the fire .

• Control Room If not suppressed by automatic or manual equipment, a fire in the control room is assumed to cause loss of all equipment not controlled from the alternate hot shutdown system panel (ASDP). The ASDP assures the ability to shut down the plant in the event of a fire in the control room. Equipment control available at the ASDP includes the turbine driven auxiliary feedwater pump (P-8B). The availability of this train of Auxiliary Feedwater (AFW) from the ASDP limits the risk significance of fires in the control room and cable spreading area.

Cable Spreading Room If not suppressed by automatic or mant.ial equipment, a fire in the cable spreading room is assumed to cause loss of all equipment in the area that is subject to fire induced failure because the equipment is in the room or has cables in the room. For fires in the cable spreading room, Auxiliary Feedwater pump P-8B remains available at the ASDP to maintain decay heat removal via the steam generators.

The availability of P-8B limits the risk significance of fires in the cable spreading area.

Spent Fuel Pool (SFP) Equipment Room In the SFP equipment room, secondary heat removal using the steam generators can be accomplished .

with the turbine driven AFW pwnp. Feed & Bleed cooling is possible with one train of high

• pressure injection, one power operated .relief valve and containment heat removal with three 4-3

• containment air coolers. Successful feed & bleed cooling would require cross-connecting the HPSI pump discharge to the other trains motor-operated valves. The normal motor-operated valves for the available pump are assumed failed by the fire Additionally, continued feed & bleed cooling in recirculation would not be available due to the fire induced failure of the subcooling valve to the operable HPSI pump.

Auxiliary Building 590' Corridor In this fire area decay heat removal via the steam generators is available from all three AFW pumps.

Feed & bleed cooling is not available due to fire induced failures of both pumps and all the motor-operated injection valves of both HPSI trains. All three containment spray pumps and all three air coolers are also assumed failed by the fire .

• 4-4

-- - -------*--*- --- ----- *----~---------- - ---------- --------**---- -

[ ACCIDENT CLASSES

---

-- *----*-* -*~-----------~-*------------ ------------ --

PALISADES FIRE IPEEE Class 1A Class 2 Class1B FIGURE 4.0-1 4-5

[ C~F CO~-r-~1BU!IO_~~BYF1-R~n~~~~-~-

PALISADES FIRE IPEEE Fire Area 23 Fire Area 1A Others FireArea21 Fire Area 1Ob Fire Area 13 FlreArea20 Legend 0 Turbine Bldg

• Control Room

• Cable Spreading Room

• SFPEqRm ilil 590 Corr

• WESFRm

• ElecEqRm

• Others FIGURE 4.0-2 4-6

• 4.1 4.1.1 INTERNAL FIRE ANALYSIS Fire Analysis Methodology Tiris fire analysis combines the deterministic evaluation techniques of the FIVE methodology with classical PRA techniques. The flow chart in Figure 4.1.1 illustrates the process used to quantify accident sequences for the Palisades Fire IPEEE. Phase I is a deterministic evaluation of fire spread and ignition source frequencies. Phase II is a probabilistic evaluation of core damage using PRA techniques. If conditional core damage frequencies are unacceptable, Phase II continues with a deterministic evaluation of suppression effects and fire propagation. The FIVE methodology is used r'

to establish fire boundaries and to evaluate the probability and the timing of damage to components located in a compartment involved in a fire. PRA techniques are used to determine compartment-specific core damage frequencies for fires within specific fire areas.

Fire areas: The Appendix R Fire Areas for Palisades are defined in Table 4.1.1. For this IPEEE fire analysis, those area.5 which meet the following criteria were screened from further consideration:

1) The area contains no safety related equipment or cables supporting those systems, and

2) A fire in the area would cause no demand for safe shutdown functions because the operating crew can maintain normal plant operations .

• In applying this criteria, 11 areas or sub-areas were screened from further evaluation. Section 4.1.6 provides additional details of the screening process.

Spread of fires across boundaries: The spread of fires across fire area/zone boundaries is addressed in the FIVE methodology. The following criteria were applied to identify boundaries which can be considered to prevent the spread of a fire:

1)

• Boundaries between two areas, neither of which contain safe shutdown components nor plant trip initiators on the basis that a fire involving both areas would have no adverse effect on safe shutdown capability,

2) Boundaries that consist of a 2-hour or 3-hour rated fire barrier on the basis of fire barrier effectiveness,

3) Boundaries that consist of a 1-hour rated fire barrier with a combustible loading in the exposing area of less than 80,000 BTU/ft2 on the basis of fire barrier effectiveness and low combustible loading.

4) Boundaries where the exposing area has very low combustible loadirig (<20,000 BTU/ft2),

on the basis that manual suppression will prevent fire spread to the adjacent area.

• 4-7

• 5) 6)

Boundaries where both the exposing atea and exposed area have a very low combustible loading (<20,000 BTU/ft2) on the basis that a significant fire cannot develop in the area.

Boundaries where automatic fire suppression is installed over combustibles in the exposing area on the basis that this will prevent fire spread to the adjacent area..

If any one of criteria 1, 2, 3 or 5 were met, the potential for fire spread through or across the common boundary was assumed to be negligible or inconsequential. These four criteria credit fire boundary

. ratings and combustible loading.

Criteria 4 and 6, in which fire suppression is credited, were not initially applied, in order to allow future evaluation of the impact of suppression and because the probability of automatic fire suppression systems failing to actuate is non-negligible. If any of the compartment fire events led to dominant core damage sequences, the effect of fire suppression was then evaluated in a probabilistic manner. This approach allowed identification of fire suppression systems that have the greatest impact on fire-induced core da.Iilage.

• The potential for fire spread betWeen areas is discussed in more detail in section 4.9. Results of the fire spread analysis are also* presented in section 4.9.

Systems credited: Before fire sequence quantification could be performed, it was necessary to identify the functions and systems to be included in the Fire IPEEE. The associated equipment and cables and respective locations were then identified using plant documents (see section 4.3) in conjunction with the Palisades internal events IPE and a plant walkdown. Only frontline safe shutdown systems and their support systems that were included in the IPE were credited in this analysis. With the exception of the PORV system, these systems were selected because information was readily available on cable location and routing. Frontline safe shutdown systems credited in the Fire IPEEE consist of High Pressure Safety Injection (HPSI), Auxiliary" Feedwater (AFW), Atmospheric Dump Valves (ADVs), Containment Spray (CS), Containment Air Coolers (CAC) and Pressurizer Power Operated Relief Valves (PORVs). The PORV system is not defined in the Appendix R analysis as a safe shutdown system but was included in the Fire IPEEE because it has significant impact on core damage results.

Accident sequence evaluation: The next phase of the analysis was a multi-step, progressive probabilistic evaluation that considered the sequence of events that must occur to create the loss of safe shutdown/risk significant functions. Figure 4.1.1 shows the flow path and the major steps in the process. These steps consist of determining ignition source frequencies and quantifying specific fire scenarios. The impact of fire suppression was* also evaluated for risk significant areas. The potential impact on containment performance and isolation was evaluated following the core damage asse:;sment.

The first step of the accident sequence was to identify and tally the ignition source frequencies in each fire area. These sources were identified from a database of plant equipment (see section 4.3

• 4-8

• for description of the database) and a compartment specific frequency was calculated in accordance with the methods detailed in FIVE. Section 4. 7 details the actual methodology used in these calculations.

• The next step, quantifying specific fire scenarios, was performed using the ignition source information in conjunction with the fire spread and fire effects information developed in Phase I.

All the basic events in the logic models of the internal events PRA related to cables or components subject to fire induced damage* in the burning location were asswned to be failed. At this point in the evaluation, it was asswned that all equipment subject to fire induced damage and cabling within the affected fire area was inoperable. The CDF for each of the fire areas was then quantified using the internal events PRA fault tree and event tree models. Fires in the control room, cable spreading --*

r_oom and class 1E switchgear rooms included additional operator actions and asswnptions that were incorporated into event trees developed explicitly for these rooms. The quantification yielded a CDF for each area by incorporating the area specific ignition frequencies and crediting the unaffected systems/trains included in the internal events PRA.

Four areas, the cable spreading room, the control room, and both 2.4kV switchgear rooms, were selected for detailed fire suppression analysis. The cable spreading 2.4kV Class IE switchgear rooms were selected for more detailed analysis because they were a significant contributor to overall core damage and it was protected by an automatic suppression system. Similarly, the control room was selected for detailed analysis because it also was a significant contributor to core damage and it was continuously occupied, resulting in a high likelihood of early manual suppression.

The final step was to evaluate the impact of the fires on the containment, structurally and functionally. Containment structural evaluations included factors such as combustible loading in and around the containment. The potential for containment isolation or bypass was also investigated.

Containment isolation valves fail in a safe position (closed) and multiple failures are required for bypass. Because of these and other factors, containment integrity is expected to be maintained following any postulated fire. A more detailed description of these analyses is contained in Section 4.12.

Uncertainties: Most of the uncertainty in the results is related to the accuracy and quality of the available information to support the fire analysis. The current results are based on the best information that was available at the time. An upgrade of the Appendix R program for Palisades is currently being conducted. It is expected that the accuracy of information regarding the effects of fire and the potential for fire induced damage will be significantly improved when the project is completed. Other uncertainties are centered around asswnptions made in the accident sequence quantification. These asswnptions include those regarding credit for various systems and operator actions that may occur in response to a fire as well as those implicit in the deterministic evaluation of plant response to a fire such as that contained in the FIVE methodology or experimental studies.

As examples, automatic or manual fire suppression was not credited except in the control room, cable spreading room and 2.4kV switchgear rooms (Bus lC & lD). Crediting suppression would 4-9

have reduced the quantified core damage frequency. Fires were assumed to completely engulf an area in which they started. If deterministic methods had been applied to show the limit of the fire spread, core damage may have been reduced. Further, repair activities were not credited for any accident sequences. Non-Appendix R systems were also assumed to fail in an effort to limit the effort required to perform cable tracking. Wherever possible, assumptions such as these were made in a conservative manner to bound uncertainties.

Assumptions made to reduce the risk specific areas within the plant include the likelihood of fire spread between the turbine building and the lower level of the CCW room (through the "jailhouse" door) and suppression induced damage in the cable spreading room. While there may be uncertainties associated with these assumptions, they are supported by deterministic or experimental evidence which supports their application to specific conditions. Further, the overall conclusions of the Fire IPEEE can be shown to be insensitive to*these particular uncertainties. That is, there is no one area in the Palisades plant in which a fire could start that does not require additional failures unrelated to the fire before inadequate core cooling would result. . ,

• 4-10

• TABLE 4.1.1 PALISADES APPENDIX R FIRE AREAS FIRE AREA/ DESCRIPTION ZONE IA Control Room IB Office and Viewing Area IC North Office Area 2 Cable Spreading Room 3A Switchgear Room 1-D 38 North Penetration Room 4 Switchgear Room 1-C 5 - Diesel Generators 1-1

• 7&8 6

9 Diesel Generators 1-2 Diesel Day Tanks Intake Structure lOA East Engineered Safeguards 108 West Engineered Safeguards 11 Battery Room A 12 Battery Room 8 13A Auxiliary Building 590' Corridor 138 Charging Pump Room 13C Waste Gas Decoy Room 13D Decontamination Room

• 4-11

• FIRE AREA/

ZONE TABLE 4.1.l PALISADES APPENDIX R FIRE AREAS DESCRIPTION 13E Waste Gas Processing Room 13F Boric Acid Equipment Room 14 Containment 15 Engineered Safeguards Panel Room 16 Component Cooling Pump Room 17 Refueling and Spent Fuel Pool Room 18 Demineralizer Room 19 Compactor - Area Track Alley 20 Spent Fuel Pool Equipment Room

• 21 22 23A Electric Equipment Room Turbine Lube Oil Room Condensate Pump Room 23B Steam Generator Feed Pump Area 23C Main Generator - Seal Oil System Area 23D Turbine Building - General 24 Auxiliary Feedwater Pump Room 25 Boiler Rooms 26 Southwest Cable Penetration Room 27 Radwaste Addition - VRS

• 4-12

• FIRE PRA FLOW CHART- FIGURE 4.1.1 hase I: Define Fire Areas Low Loading &

Separation Low Fire Loading Fire Barriers Barriers FMEA of eadl area:

- equipment in ara;

• potentiol fi111 spread

- remaining equipment

• type of initiating tMH11 Qualitatiw ranking of Fire Areas:

• b1Hd on initiitor.

111molning equipmont, lie.

Initiating Event Frequency

• Phase II:

Sequence Quantiflcation &

Ranking YES Risk o~m*nt.

Conttnu* to Acceptance _

NextArH Low?

NO Choose Method Fire Propagation Analysis Automatic Suppression

[ Manual Detedion/

j Suppression Ii I

Redefine Fire Arau

• 4-13

• 4.1.2 Modeling Assumptions The following key asstimptions were made in this analysis:

1. An engineering analysis (Ref. 4-6) concluded that fire spread between transformers and between the transformers and the turbine building is not credible.

2. The impact of fires on plant risk was quantified using the internal events PRA general transient event tree model. This event tree was selected because it most closely represented the plant response given the systems being modeled. The frontline systems contained in the internal events PRA that were credited in the fire quantification are HPSI, AFW, ADVs, Containment Spray, Containment Air Coolers and PORVs, depending on the effects of the fire and knowledge of the location of cables for ~hese systems within each fire compartment. These systems were assumed to fail only due to non-fire related causes if their cables were not located in the compartment impacted by the fire.

3. ATWS events are not expected to be induced by fires, due to the fail..,safe design of the reactor protection system, and simultaneous occurrence of an ATWS during a fire is probabilistically insignificant.

4. LOCAs and SGTRs are not expected to be induced by a fire. Simultaneous occurrence of a LOCA or SGTR during a fire is probabilistically insignificant.

5. With the exception of the control room, cable spreading rooms and switchgear rooms, fires are assumed to spread until they engulf the entire area in which they start. No credit was taken for suppression in other than these four areas.

6. It is assumed that fire will not propagate through the "jailhouse door" opening in the wall separating the 590' elevation of the turbine building (F A-23) from the lower level of the CCW room (F A-16). A walkdown of the area resulted in the conclusion that fire spread through this opening is not credible. This.conclusion was based in part on the following facts: 1) The opening is located low in the wall. This eliminates the concern of a ceiling hot gas layer passing through the opening arid igniting combustibles or otherwise causing damage in the adjoining room. 2) There are no intervening combustibles and no/minimal combustibles located within 15' of either side of the opening. 3) The floors slope away from the opening to floor drains located on either side of the wall. This will prevent spreading of burning fluids from one room to the other. Additionally, the lower portion

.of the opening, which is at floor level is dammed with a solid metal plate spanning the entire width of the opening and to a height of approximately three feet. 4) The opening is relatively small, approximately 30 sq. ft. Based on these facts, fire spread across this opening is considered incredible. Reference (Ref. 4-6) provides the complete analysis .

• 4-14

• 7. The plant was built before the IEEE-383 standard was written. The cable used at the time of construction was rated per IPCEA Standards S-19-81, which was the combustibility standard at the time. Cable installed since construction is rated to IEEE-383. Because the mix of cable is very difficult to determine, it was conservatively assumed that all cable in the plant is non-IEEE-383 rated.

8. When calculating the ignition source frequencies, only the nilmber of areas and zones mentioned in the Fire Hazards Analysis was used instead of the total number of rooms in the plant. Because the total number of rooms in the plant is greater than what is described in the FHA, use of the smaller number of areas and zones results in a higher ratio -(e.g., 1/40 vs 1180). The higher ratio is multiplied by the. generic ignition source frequencies, resulting is more conservative (larger) ignition source frequencies.

4.1.3 Review of Plant Information and Sources Several sources of information were reviewed and utilized in support of the Palisades Fire IPEEE.

The information sources most often consulted were the Palisades Individual Plant Examination (IPE)

(Ref 5-2), Palisades Fire Hazards Analysis (Ref 5-7), Fire Protection drawings (M 216, Sheets 1-18),

Fire-Induced Vulnerability Evaluation (FIVE) Report (Ref 5-4) and various controlled electronic databases. A complete list of the references used in support of this project is contained in Section 4.16 .

• The IPE was used to identify important systems/functions and provided the base fault trees and event trees used to quantify the fire related plant risk. The IPE includes detailed information on support systems for the important frontline systems.

The Fire Hazards Analysis provided i¢'ormation on combustible loadings, detection and suppression capabilities, and fire barrier ratings for fire areas within the plant. Mechanical drawing M216, sheets 4-18, provided floor plans showing each fire barrier and identified adjacent and adjoining fire areas.

The fire area interaction analysis used the information contained in these documents.

Much of the information used for the Fire IPEEE analysis came from the spreadsheet file APR- .

EVTAB.WBI. Data from several sources including the Palisades Equipment Database (EDB), the Appendix R circuit analysis database and ,the Palisades Cable and Raceway Schedule were combined into a single relational database/spreadsheet. This file contains the following.data: equipment-ID; equipment description; building; floor elevation; room number; location; reference drawing; scheme number; and fire areas/zones.

The Fire IPEEE logic models are contained in electronic files. The models include logic for the PORV system in addition to all Appendix R safe shutdown systems. The electronic file provided basic event names, module (IST - Independent Sub Trees) names, equipment IDs and some equipment descriptions. The remaining equipment descriptions, equipment locations. (building/

• elevation/room #) and reference drawings_ were eXtracted from the EDB .

Many of the scheme numbers were collected by review of the schematic drawings referenced by the EDB. The remaining scheme numbers were obtained from the Palisades Cable and Raceway Schedules. The equipment room numbers and scheme numbers were used to identify the fire zones and fire areas associated with each equipment ID. The fire zones and fire areas were separated into the equipment locations and cable routings.

• A spreadsheet was generated by relationally combining all of these diverse information sources.

This spreadsheet was then used to identify all of the equipment, either by equipment location or by

, cable routing, that might be affected by a fire in any particular fire zone or area. The information in the spreadsheet was the best information available at the time that the required inputs were generated for quantification of the fire area sequences. A significant effort has been undertaken in .... ::.*

the Fire Protection organization to develop more accurate information with appropriate basis documentation. This revised information with be maintained in a controlled database. A major portion of the analytical work has been completed and is in the process of being validated. When the final approved information becomes available it will be used. to verify the potential for fire induced damage that was the basis for the fire risk analysis.

4.1.4 Plant Walkdown Various walkdowns were performed in support of the IPEEE analyses. The Fire IPEEE walkdown members included a qualified fire protection engineer and Fire IPEEE analysts. System engineers were consulted as questions arose to confirm key assumptions used in the IPEEE. Prior to the

• *walkdowns, a licensed senior reactor operator participated in area by area discussions of expected operational impact of fires in significant areas.

4.1.4.1 Objectives of Plant Walkdowns The primary objectives of the walkdowns were to confirm information/assumptions and conclusions of the Fire IPEEE analysis .. Issues associated with the Sandia Fire Risk Scoping Study Evaluation (Ref. 4-11) were also investigated. Tiie walkdowns were used to determine whether or not the assumptions and calculations, particularly fire barrier effectiveness assumptions, can actually be supported by the physical conditions that exist. This included verifying and validating 1) the combustible loading estimates in the fire hazards analysis, 2) the existence of fire protection systems,

3) fire barrier status, 4) interaction of fire areas and 5) existence of ignition sources.

4.1.4.2 Walkdown Process Important areas of the plant, as determined by the results of the Fire IPEEE quantification, and areas of the plant that required validation of assumptions made during the analysis were inspected during the walkdown. These areas included the control room, cable spreading room, cable penetration areas and the areas near the containment personnel airlock and equipment hatch. Combustible loadings, potential fire spread paths, fire barriers and equipment orientation were also inspected by the fire protection engineer.

• 4-16

4.1.4.3 Findings from Plant Walkdown Several general findings were made during the walkdowns. Boundary ratings were found to be conservative due to lack of combustible loading in close proximity to the barriers. The general condition of the plant was clean and well kept. The combustible loadings encountered during the walkdown were compatible with the estimates contained in the Fire Hazards Analysis.

The large containment penetrations, i.e., the personnel airlock and the equipment hatch were inspected to determine if fire damage was feasible. The personnel airlock is located in a small concrete room with minimal combustibles. The equipment hatch is recessed and protected by large concrete shield blocks during power operation. These factors lead to the determination that fire damage to these penetrations is not credible. -**

A walkdown of the 590' corridor (F A-13A) resulted in the reduction of the ignition source frequency for this area. Several significant ignition sources are located in a space at the extreme end of this area. The cables that, if damaged, could impact plant risk were located near the other end of the area.

There were minimal combustibles in the area and a large horizontal span between these locations with no intervening combustibles. The ignition sources were determined to have no impact on the cables of concern and were removed from the ignition source totals for this area.

4.1.5 Identification of Important Fire Areas

• The Appendix R fire area8 provide the starting point for this analysis. In accordance with Appendix R requirements and the Palisades Fire Hazards Analysis, a fire area is defined as a portion of a building that is separated from other areas by boundary fire barriers. Only a single division of safe shutdown equipment is allowed within a given fire area unless the redundant train is protected by additional separation requirements detailed in Appendix R \of 10 CFR 50.

The Palisades Nuclear Power Plant has previously analyzed the rating of the barriers incorporated in its FHA for all the pre-existing fire areas and has determined that the barriers are adequate. Where those barriers are incorporated into new area configurations generated to support the IPEEE analysis, an additional screening for fire spread was performed. The results of this screening, based on applying conservative criteria contained in FIVE, are consistent with the* analyses previously performed.

4.1.5.1 Auxiliary Building FIRE AREA 1 - Zone A: The control room provides a centralized location for operating controls and instrumentation for the various vital and nonvital systems associated with plant operation. Major equipment in the control room includes the main operator control console, the indicating panel and various instrument and control panels, all of enclosed design. Fire loading is considered light. The Control Room is occupied continuously.

• 4-17

The fire area, composed of Zones A, B and C, is bounded by a west wall with a minimum fire rating of three hours and a three-hour access door out to the turbine area. The north wall, which is poured concrete, is judged to have a fire rating in excess of four hours. A three-hour double door leads to the Technical Support Center (TSC). The east boundary encloses a staircase with a three-hour rated fire door. The wall is judged to have a two-hour rating. The south wall is rated in excess of three hours and has substantial bullet resistant and thr~e-hour rated double entry doors to the corridor.

These barriers are adequate based on the hazards.

Zone A is the control room proper. Zone B is the viewing gallery and east office zone and Zone C is the north office zone. One-hour walls with approximately 30% ordinary glass vision panels separate Zones Band C from Zone A. Access doors to adjacent zones have glass windows.

FIRE AREA 1 - Zone B: The office and viewing areas adjacent to the control room provide space for various administrative functions and observation of activities relating to plant operation. There are minor amounts of combustible materials in the viewing area. Offices are equipped with normal office furnishing having a light-fire loading.

The south and. north sides and part of the east side of the office and viewing area have a minimum t~ee-hour fire wall. A one-hour wall with 30% ordinary glass vision panels is provided between the control room (Zone A) and viewing area. Entrance is via three separate three-hour doors. The three-hour door to the north leads to the Technical Support Center, the east door leads to the lD switchgear room and the south door leads to a hallway. Access doors to adjacent zones are not fire

• rated. The wall containing the east door is a two hour rated wall.

FIRE AREA 1 - Zone* C: The office section adjacent to the control room area provides space for various administrative functions associated with plant operations. Normal office furnishings are provided. Overall fire loading is considered light.

The partition between this office section and the control room is a one-hour fire wall with 30%

ordinary glass vision panels. Adjacent walls have a minimum one-hour rating. The north wall has a three-hour rating. Access doors from the office area to adjacent zones are not fire rated. The barriers are considered adequate for the hazards involved.

FIRE AREA 2: The cable spreading room, located in the auxiliary building, provides routing of power, instrumentation and plant control wiring for both vital and nonvital systems and also accommodates various electrical equipment associated with the plant safety-related ac and de power suppliers. Primary power to this equipment is derived from redundant 2.4kV Buses lC and ID.

Feeder circuits to various safety-related eqwpment associated with Bus 1-D are also routed through the cable spreading room.

Equipment installation is on curbs to protect against water flooding. All electrical equipment is sealed where the electrical cables enter. Maximum utilization is made of available space for separation of redundant systems. *Cable runs are via horizontally stacked cable trays, with some

• 4-18

• individual conduits .

A three-hour fire wall is provided between the cable spreading room and the turbine building.

Access between these two areas is via a double three-hour rated bullet-resistant door. A three-hour fire barrier is provided between the cable spreading room and adjacent Switchgear Room ID.

Access between these two areas is via a three-hour door. Three-hour walls and door separate the cable spreading room from the battery rooms. With the moderate fire loading, this is considered adequate. All cable penetrations are sealed.

FIRE AREA 3 - Zone A: The switchgear room houses the 2.4kV electrical equipment associated with safety-related Bus.ID. (Redundant Bus lC is in a separate room on the 590' elevation. See Fire Area 4.) Major equipment is floor mounted without curbing. Two three-inch floor drains are provided against flooding. Electrical cabling associated with the switchgear is routed through the switchgear room in stacked cable trays. *

\

A three-hour fire barrier is provided between the switchgear room and the cable spreading room.

Access between these two areas is via a three-hour door. A three-hour rated door to the electric equipment room is available for access. There is an open stairway leading to the 625' level with a three-hour rated door providing access to the viewing gallery (Fire Area 1, Zone B). Open access also exists through the cableway room to the north containment penetration room located on the 625' level (Fire Area 3, Zone B). These barriers are considered adequate based on the fire loading .

• FIRE AREA 3 - Zone B: Cables are routed into the cable penetration room area using a horizontally stacked cable tray arrangement. The cables entering containment are considered safety related and include both vital and nonvital loads. Redundant systems required for safe reactor shutdown are accommodated via cables routed through the southwest cable penetration room on the 607'6" level (see Fire Area 26).

The cable penetration room is separated from the adjacent clean resin transfer and storage area by a .minimum three-hour fire wall. The access is through a three-hour bullet resistant door. Open access exists between the cable penetration room and the cableway leading to Switchgear Room lD.

A steel plate on part of the floor of the cableway provides separation from 590' elevation of the auxiliary building.

FIRE AREA 4: The switchgear room houses the 2.4kV electrical equipment associated with safety-.

related Bus lC. (Redundant Bus ID is in a separate room on the 607'6" elevation (see Fire Area 3, Zones A and B). Electrical cabling associated with the switchgear is routed through the switchgear room in stacked cable trays.

Enclosure for the switchgear room is provided by three-hour fire walls. Access to adjacent diesel generator room (Fire Area 5) is via a three-hour d_oor and access to the east corridor is via two three-hour doors. Access to the turbine room is via a three-hour door which is also watertight. One-hour fire resistant material has been applied to one cable tray and one junction box and conduit containing

• 4-19

circuits of the redundant train .

• FIRE AREA 5: This fire area contains emergency diesel generator 1-1. Each emergency diesel generator is housed in a separate enclosures defined by three-hour fire walls. The enclosure shares a common south wall with safety-related Switchgear lC. Main access to the rooms is via a three-hour door from Switchgear lC. The diesel day tank is in a separate room (Fire Area 7) located at the north end of the diesel generator room.

Enclosure for the diesel is provided by minimum three-hour fire walls with three-hour doors.

Access to the room is via a vestibule with three-hour doors. The room has a. three".'hour door leading to adjacent Switchgear Room lC. Three-hour walls and doors lead to the respective day tank room. In the vestibule is a double watertight door that leads outside.

FIRE AREA 6: This fire area contains emergency diesel generator 1-2. Each emergency diesel generator is housed in a separate enclosures defined by three-hour fire walls. The enclosure shares a common south wall with safety-related Switchgear lC. Main access to the rooms is via a three-hour door from Switchgear 1C. The diesel day tank is in a separate room (Fire Area 8) located at the north end of the diesel generator room.

• Enclosure for the diesel is provid~d by minimum three-hour fire walls with three-hour doors.

Access to room is via a* vestibule with three-hour doors. Three-hour walls and doors lead to the day tank room. In the vestibule is a double watertight door that leads outside .

• FIRE AREA 10 - Zones A and B: The plant engineered safeguards area, located fu the auxiliary building, is divided into two separate adjacent fire zones; each zone houses major items of safety-related equipment used to accomplish plant safe shutdown. The east safeguards room contains only Division I (right channel) equipment. The west safeguards room contains Division II (left channel) and some Division I equiprp.ent.

The safeguards area, including zone separation, is defined by a wall having a minimum three-hour fite rating. Access to. the safeguards area from the 590' elevation is via a three-hour door and a watertight door. The wall separating both zones has a steel watertight door, a substantial steel plate and is judged equal to a three-hour fire rating. Concrete plugs in the ceiling and a steel hatch in the ceiling of Zone B provide access to equipment from above.

FIRE AREAS 11AND12: Two redundant battery systems are available for supplying control power to the various plant vital loads. Each system is physically separate and electrically isolated from the other, having its own battery, battery chargers and distribution bus. Batteries are housed in individual enclosures, separated by a common wall, located adjacent to the cable spreading room area. A continuously operating ventilation system common to both rooms provides protection against hydrogen gas accumulation from the batteries, thereby minimizing the combustible hazard in this area.

• 4-20

Battery room enclosures have a three-hour fire rating. Entry into Battery Room B is via a single-access, three-hour fire door from the cable spreading room. The access door between Battery Rooms A and Bis a three-hour door.

FIRE AREA 13 - Zone A: This area comprises the 590' elevation corridor of the auxiljary building and radwaste building. The corridor is "E" shaped.

• The corridor is constructed of reinforced concrete with some concrete block walls. The corridor provides access to the various rooms on this elevation.

See.FireZones4,9, 11, 15, 16, 17, 18, 19and20.

FIRE AREA 13 - Zone B: The charging pump room, located in the auxiliary building, houses the three charging pumps used to inject boron into the core for cold shutdown and to provide primary coolant system (PCS) inventory and pressure control. Electrical power for each motor-driven pump is supplied from a safety-related 480-V ac source. Pumps A and Bare fed from 480-V Bus No 12 with cable routing provided via a common cable tray. Pump C is fed from 480-V Bus No 11 via a separate cable tray and conduit system. Pumps B and C can also be powered from LCC 13 In addition, pump B can be powered from 480-V Bus No 11.

Radiation shield wall barriers are provided between each pump area Access to the pump room area is via a restricted access corridor.

• Protective radiation shield walls are provided around each separate pump. Each pump area is open on one side to a common access corridor. A three-hour barrier is provided between the corridor and the 602' pipeway. A tunnel-like entrance to the area from the corridor provides access.

FIRE AREA 15: The Engineered Safeguards Panel C-33 is located adjacent to the radwaste control panel on the 590' level and provides plant remote shutdown capability under emergency conditions, i.e., extreme cases where control room evacuation becomes necessary. The engineered safeguards panel is classified as safety-related equipment. Other major equipment contained in this fire area include safety-related 480-V MCCs, No 7 and 8.

The safeguards panel area is enclosed by three-hour fire walls. Access is prpvided via three separate entryways. The doors to the corridor are three-hour rated. The door to the boron meter room is also three-hour rated.

FIRE AREA 16: The component cooling pump room provides a common enclosure for the three safety-related cooling pumps. Electrical power for the pumps is derived from the 2.4kV switchgear located on the 590' and 607'6" elevations (see analysis for Fire Areas 3 and 4). Power cables to each pump motor are routed via separate conduit. Redundancy is provided since only one of the three pumps is required for cold shutdown.

Tue pump room enclosure is bounded by three-hour fire walls. Access is provided to the north-end

• 4-21

corridor via a watertight door and an inner door and to the 607'6" level above via an open stairway.

• Pump spacing is 12' center to center. A pressure release opening is located in the wall to the turbine building. The annuli around the main steam pipes and feedwater pipes are not sealed. These openings are negligible when compared to the pressure release opening.

• FIRE AREA 20: The spent fuel pool equipment area houses equipment used to remove decay heat from the spent fuel pool which is generated by the stored spent fuel elements. Major items include heat exchangers, pumps, tanks, filters and associated piping.

The spent fuel pool equipment area is contained within a heavy radiation shield wall providing a minimum three-hour fire rating. Inside, the pumps, filters and demineralizer tank are further isolated from each other and the heat exchanger units by partitioning walls. Access to the general area from -*.

the south side corridor is through a substantial steel door. Some negligible openings may exist in some penetrations.

FIRE AREA 21: The electric equipment room provides a location for various safety-related and nonsafety-related load centers and motor control centers. 480-V Bus No 19, 480-V Bus No 20, 480-V MCC-25, 480-V MCC-26 and transformers EX-19 and EX-20 are in the fire area. All panels are enclosed.

The fire area is bourided by three-hour rated concrete walls and floor. The ceiling is concrete on metal pan. The ceiling is expected to withstand any fire in this room due to the minimal fire loading.

A three-hour rated fire door leads to Switchgear Room ID.

• 4.1.5.2 Reactor Building FIRE AREA 14: The reactor containment building is approximately 120' in diameter and 190' tall.

The concrete walls are approximately 4' thick. The'dome-shaped top is approximately 3' thick concrete. The reactor containment building houses the nuclear steam supply system and various support equipment. The normal entryway is through the personnel airlock. An emergency personnel access is the second access and egress route. Also, there is an equipment hatch which is closed during plant operation. The two electrical cable penetration areas for opposite divisions are separated from each other by approximately 70'. The reactor coolant pumps are separated from each other by approximately 25'.

The reactor containment l;milding walls have a fire resistance rating in excess of three hours. The equipment hatch is judged to have a fire resistance in excess of two hours. The personnel access and emergency access hatches have double doors. These double doors are judged to have a fire resistance of three hours.

4.1.5.3 Intake Structure FIRE AREA 9: *Major items of equipment housed in the intake structure include the thiee safety-

• 4-22

• • related service water pumps, two dilution pumps, two diesel engine-driven fire pumps, two 480-V MCCs providing electrical power to miscellaneous nonsafety-related equipment, including a motor-driven fire pump.

The pump room east wall adjacent to the turbine building has a three-hour fire rating with a single three-hour fire door installed. All other walls and access have outdoor exposure with a small section common with the diesel pump day tank room. Rating is in excess of three hours. A radiant energy shield wall and a horizontal distance of at least 20' separates one diesel fire pump from the others and the service water pumps. Control cables for P-41 have been wrapped in one-hour fire-resistant material.

• Because of the importance of the service water system and fire protection system as potential makeup sources to the suction of the AFW pumps and the capability under certain conditions for each to provide backup to the other, a more detailed examination of the impact of fires in this area was undertaken. Each set of pumps and their associated equipment are located at opposite ends of the intake structure. The walkdown confirmed that there is minimal combustible loading in the area between the pumps. Based on this information the intake structure was evaluated under two separate scenarios. The first assumed a fire started in the area of the service water pumps which resulted in their failure but left the fire pumps remained available. The second scenario assumed a fire was initiated in the area of the fire pumps and resulted in their failure but left the service water pumps available.

• 4.1.5.4 Turbine Building FIRE AREA 22: The turbine lube oil room contains the oil reservoir and storage tanks, pumps, filtration units and piping system associated with the main turbine lubrication system. An approximate total of 15,000 gallons oflubricating oil is stored in the oil reservoir and storage tanks.

None of the above equipment is safety related.

The turbine lube oil room is isolated on three sides from adjacent fire areas by three-hour fire walls.

Two south wall access doors; each has a three-hour rating. Openings in a non-rated sheet metal wall exist between this room and the pipeway to the feedwater purity building. Curbs are provided at each door to contain tank spillage within the designated fire area. The turbine lube oil room is physically located approximately 50 feet from the auxiliary feedwater pump room and approximately 40' from the auxiliary building.

FIRE AREA 23 - Zone A: The two condensate pumps, used in conjunction with the feed pumps to supply feedwater to the main steam generators, are located in an open pump pit on the 571' level, adjacent to the auxiliary feed pump room (see Fire Area 24). The condensate pumps are not considered safety related. Backup feedwater supply upon loss of the condensate pumps is provided by the three safety-related auxiliary feedwater pumps.

• The condensate pump area is defined by pit construction. Except for the open floor grating above

• • 4-23

the pumps, the enclosure is judged to have a three-hour fire rating. The two pumps are separated by

• a distance of approximately six feet.

FIRE AREA 23 - Zone B: The two steam-driven feed pumps are used in conjunction with the condensate pumps (see Fire Area 23, Zone A) to supply feedwater to the main steam generators. The feed pumps are not safety related and use nonclass IE electrical power for operating various pump auxiliary systems. Backup feedwater supply is available usillg the three redundant safety-related auxiliary feedwater pumps (see Fire Area 24).

There are no walls defining the feed pump area. Large open space exists between the containment building, the auxiliary building and the location of the pumps. Physical spacing between pumps is approximately 20 feet. There is no safety-related equipment located nearby.

FIRE AREA 23 - Zone C: Tile hydrogen seal oil system provides a means for maintaining cooling of the hydrogen gas within the confines of the main generator during normal plant operation.

Equipment associated with the seal system is not safety related. The major combustible material in

• this area is oil inventory.

There are no walls defining the hydrogen seal oil equipment area. There is a large open space surrounding installed equipment to limit potential fire spread. There is no safety-related equipment located nearby. Curbing is provided to contain accidental oil spillage and a drain system disposes of any oil leakage present during normal operation.

• FIRE AREA 23 - Zone D: This section considers the effect of fire on those nonspecific areas of the turbine building which contain equipment that is not safety related but which is, in some cases, physically located adjacent to or are near vital equipment required for achieving plant safe shutdown.

Areas associated with the latter or those having special significance with regard to combustible materials or fire loading have been considered previously.

The equipment concerned includes miscellaneous items such as electrical switchgear and distribution hardware, various power conversion equipment, instrumentation and assorted piping and cabling systems. The Fire Hazard Analysis relating to these systems is based on consideration of the main generator and turbine equipment as a source of fire which could adversely affect the above.

Major equipment layout and the various architectural barriers provided are shown on the turbine building plan drawings. The turbine/generator equipment is remotely located from other plant equipment. The turbine building is open between the various elevations shown.

4.1.5.5 Southwest Cable Penetration Room FIRE AREA 26: Cables are routed into the containment penetration room area using a horizontally stacked cable tray arrangement. The cables entering containment are considered safety-related and include both vital and nonvital loads. Redundant systems required for safe reactor shutdown are

• 4-24

accommodated via cables routed through the north cable penetration room on the 625' level.

The cable penetration room is enclosed by three-hour fire walls. Openings exist into the turbine building where three-hour cable penetration sealing has been provided. A three-hour fire door to the turbine building is provided.

4.1.5.5 Auxiliary Feedwater Pump Room FIRE AREA 24 The auxiliary feedwater pump room houses the two safety-related auxiliary feed pumps used to -*.

supply feedwater makeup to the steam generators during hot shutdown. One of the pumps is steam driven; the second pump is powered from safety-related Bus lC. Redundant equipment has a minimum 10' separation. A third AFW pump is located in the auxiliary building and is powered from safety-related Bus lD.

The pump room is separated from adjacent plant areas by a three-hour fire wall. Access to the adjacent condensate pump room is via a three-hour steel watertight door and a substantial steel inner door. A steel hatch is located in the ceiling. A ventilation pipe, open to the nirbine building, runs through the ceiling. No loss of barrier integrity is caused by these due to the minimal fire loading. *

• 4.1.6 Fire Area Initial Screening Fire areas were screened from further consideration if they contained no frontline safe shutdown equipment (defined in section 4.1) and would not lead to a plant trip or immediate plant shutdown.

Safe shutdown equipment locations were determined by sorting the equipment location data

• contained in the spreadsheet generated for this analysis (see section 4.3). Areas that, if destroyed by fire, would lead to a plant trip or immediate shutdown were determined by an expert panel of pl;:tnt operations personnel. Utilizing these criteria, approximately one-third of the fire areas were screened from further consideration. The complete set of results of the qualitative screening process are shown in Table 4.1.6.1.

• FIVE also provides the following additional guidance when screening fire areas: "Fire areas where Appendix* R safe shutdown components are found should not be screened out at this stage unless it can be shown with confidence that the postulated fire will not cause a demand for plant shutdown.

The project team should consult with the plant operations staff to make this determination." This guidance was also considered in the screening process .

• 4-25

• FIRE AREA/

ZONE DESCRIPTION TABLE 4.1.6.1

SUMMARY

OF PALISADES FIRE AREA SCREENING QUALITATIVELY SCREENED RETAINED FOR FURTHER EVALUATION IA Control Room x 18 Office and Viewing Area x IC North Office Area x 2 Cable Spreading Room x 3A Switchgear Room 1-D x 3B North Penetration Room x 4 Switchgear Room 1-C x 5 Diesel Generators 1-1 x

• 7&8 6

9 Diesel Generators 1-2 Diesel Day Tanks Intake Structure x

x x

lOA East Engineered Safeguards x

!OB West Engineered Safeguards x 11 Battery Room A x.

12 Battery Room B x 13A Auxiliary Building 590' x Corridor 13B Charging Pump Room x 13C Waste Gas Decoy Room x 13D Decontamination Room x

• 4-26

• FIRE AREN ZONE DESCRIPTION TABLE 4.1.6.1

SUMMARY

OF PALISADES FIRE AREA SCREENING QUALITATIVELY SCREENED RETAINED FOR FURTHER EVALUATION 13E Waste Gas Processing Room x 13F Boric Acid Equipment Room x 14 Containment x 15 Engineered Safeguards Panel x Rm 16 Component Cooling Pump x Room 17 Refueling and Spent Fuel Pool x Rm 18 Demineralizer Room x

• 19 20 Compactor - Area Track Alley Spent Fuel Pool Equipment Room x

x 21 Electric Equipment Room x 22 Turbine Lube Oil Room x 23A Condensate Pump Room x 23B Stearn Generator Feed Pump x Area 23C Main Generator - Seal Oil x System Area 23D Turbine Building - General x 24 Auxiliary Feedwater Pump x Room

• 4-27

TABLE 4.1.6.1

SUMMARY

OF PALISADES FIRE AREA SCREENING FIRE DESCRIPTION QUALITATIVELY RETAINED FOR AREA/ SCREENED FURTHER ZONE EVALUATION 25 Boiler Rooms x 26 Southwest Cable Penetration x Room 27 Radwaste Addition - VRS x

• 4-28

4.1.7 Fire Ignition Data

• Ignition source :frequencies for each area are necessary to allow quantification of the impact of a fire in that area. These individual impacts can be summed to yield the impact to the plant from all fires.

The EPRI Fire Event Database for U.S. Nuclear Power Plants (REF. 4-8) was used in estimating fire ignition source :frequencies for all the rooms located within the plant. This database contains a total of 800 events during a period from 1965-1988. These events were compiled from 114 BWR and PWR units across the United States representing a total sample of approximately 1300 reactor years of operation. The data includes fire incidents caused from both fixed and transient sources due to normal operations and maintenance activities. *

• FIVE incorporated this information into a procedure to develop ignition source :frequencies for .

individual fire areas. This process was used to evaluate the fire area specific ignition frequencies (F 1) at Palisades. An Ignition Source Data Sheet was completed for each Fire Area defined in Phase I.

The four step process identified in the FIVE methodology was used to develop the Ignition Source Data Sheet. The first step requires that the appropriate location (room or building) which

• corresponds best to the fire compartment in question be selected. Some locations may be specific Appendix R fire areas (e.g: control room, cable spreading room), while other locations may be general (e.g., turbine building fire area 23).

• The second step requires that a location weighting factor (WFL) be determined from this classification. The weighting factor is used to translate the generic fire :frequencies, compiled in FIVE (Table 4.1.7.1), for a location to specific, single unit fire :frequencies. The location weighting factors are designed to account for the relative amount of ignition sources in the plant in question compared to the "average" plant. These factors are easily calculated using the simple formulas found in Table 4.1.7.1.

The third step requires that weighting factors for each type of ignition source (WFLs) be deterlnined.

• The potential ignition sources in each room were identified from controlled electronic databases and a walkdown of each compartment. Some ignition sources (e.g. cables and transformers) are best apportioned by ignition sources on a "plant-wide" basis. Once the number of plant wide components (ignition sources) was identified, the WFLs was determined by dividing the number of components in the area by the total number of similar components in the building or generic location being considered. Again, these factors are easily calculated using the simple formulas found in Table 4.1.7.1.

The fourth step requires that the fire compartment fire :frequency (F 1) be calculated for each fire area (Table 4.1. 7 .2 lists the fire :frequency for each ignition source by location). F 1 is the sum of the ignition source :frequencies for each ignition source (Fie) located within the given fire area. This value was obtained for ea<;h fire area by multiplying:

• 4-29

1) The fire frequency (Fr) (Table 4.1. 7.2),

• 2) The weighting factor for the location (WF d, and

3) The weighting* factor for each ignition source (WF Ls).

This calculation was repeated for e.ach ignition source in the compartment and the total fire frequency for the specific fire compartment (F 1) was calculated as:

The resultant ignition frequencies for each compartment are provided in Table 4.1.7.3 .

• 4-30

• PLANT LOCATION TABLE 4.1.7.1 WEIGHTING FACTORS FOR ADJUSTING GENERIC LOCATION FIRE FREQUENCIES FOR APPLICATION TO PLANT-SPECIFIC LOCATIONS (TAKEN FROM FIVE METHODOLOGY)

WEIGHTING FACTORS 1 (WFd Auxiliary Building (PWR) The number ofunits per site divided by the number of buildings.

Reactor Building (BWR)2 The number of units per site divided by the number of buildings Diesel Generator Room The number of diesels divided by the number of rooms per site.

Switchgear Room The number of units per site divided by the number of rooms per site.

Battery Room The number of units per site divided by the number of rooms per site.

Control Room The number of units per site divided by the number ofrooms per site.

Cable Spreading Room The number of units per site divided by the number ofrooms per site.

Intake Structure The number of units per site divided by the number of intake structures.

• Turbine Building Radwaste Area Transformer Yard The number of units per site divided by the number of buildings.

The number of units per site divided by the number of radwaste areas.

The number of units per site divided by the number of switchyards.

Plant-Wide Components (Cables, The number of units per site.

transformers, elevator motors, hydrogen recombiner/analyzer)

1. The analyst must identify the number of like locations when determining the number of buildings, e.g., a 480-volt load center is "like" a switchgear room.

2. Reactor building does not include containment.

• 4-31

• PLANT LOCATION TABLE 4.1.7.2 FIRE IGNITION SOURCES AND FREQUENCIES BY PLANT LOCATION FIRE IGNITION/FUEL SOURCE IGNITION SOURCE WEIGHTING FIRE FREQUENCY1. 2 FACTOR Reactor Building . Electrical cabinets B 5.0 x 10*2 (BWR) 2 Pumps B 2.5 x 10*2 Diesel Generator Room Diesel generators A 2.6 x 10*2 Electrical cabinets A 2.4 x 10-3 Switchgear Room Elec~cal cabinets A 1.5 x 10-2 Battery Room Batteries A 3.2 x 10-3 Control Room Electrical cabinets A 9.5 x 10-3 Cable Spreading Rm Electrical cabinets A 3.2 x 10-3 Intake Structure Electrical cabinets A 2.4 x 10-3 Fire Pumps A 4.0 x 10-3 Others A 3.2 x 10-3 Turbine Building T/G Excitor B 4.0 x 10-3 T/G Oil B 1.3 x 10-2

' T/G Hydrogen B 5~5 x 10-3 Electrical cabinets B 1.3 x 10-2 Other pumps B 6.3 x 10-3 Main feedwater pumps A 4.o x 10-3 Boiler B 1.6 X 10~3 Radwaste Area Miscellaneous components A 8.7 x 10-3 Transformer Yard Yard xfiners (spread to TB) A 4.o x 10-3 Yard xfiners (LOSP) A 1.6 x 10-3 Yard transformers (Others) F 1.5 x 10-2

• 4-32

• PLANT LOCATION TABLE 4.1.7.2 FIRE IGNITION SOURCES AND FREQUENCIES BY PLANT LOCATION FIRE IGNITION/FUEL SOURCE IGNITION SOURCE WEIGHTING FIRE FREQUENCY 1*2 FACTOR Plant-Wide Fire protection panels F 2.4 x io-3 Components RPS MG sets F 5.5 x 10-3 Non-qualified cable run E 6.3 x 10-3 Junction in non-qualified cable E 1.6 x 10-3 Junction box in qualified cable E 1.6 x 10- 3 Transformers F 7.9 x 10- 3 Battery chargers F 4.0 x 10-3 Off-gas/H 2 Recombiner (BWR) G 8.6 x 10-2 Hydrogen Tanks G 3.2 x 10-3 Misc. hydrogen fires c 3.2 x 10*3 Gas turbines G 3.1x10*24 Air compressors F 4.7 x 10*3 Ventilation subsystems F 9.5 x 10*3 Elevator motors F 6.3 x 10-3 Dryers F 8.7 x 10*1 Transients D u x 10-11 Cable fires caused by welding c 5.1X10-z 3 Transient fires due to welding/cutting c 3.1 X 10-2 3 Footnotes associated with TABLE 4.1.7.2.

1. Frequencies are per reactor year unless otherwise noted.

2. Fire frequencies are per fraction of ignition sources per year.

3. Fire frequency represents one event. The thirteen transient events which occurred during power operation are considered by the weighting factor.

4. Fire frequency represents an estimated 130 gas-turbine-operating years.

General notes for Ignition Source Weighting Factor Method:

Area specific ignition sources were determined during the initial walkdown. Normally, ignition

• source frequencies are estimated using methods other than direct counting, including engineering judgement. These estimates are then verified during the walkdown. Estimates should be within 25%

of actual values.

A. No ignition source weighting factor is necessary.

B. Obtain the ignition source weighting factor by dividing the number of ignition sources in the 4-33

• C.

D.

fire compartment by the number in the selected location.

Obtain the ignition source weighting factor by calculating the inverse of the number of compartments in the locations. Exclude any areas contained in locations other than in this table.

Obtain the ignition source weighting factor by summing the factors for ignition sources which are allowed in the area and divide by the number of areas in the locations in this table.

For example, if cigarette smoking is prohibited do not include the cigarette smoking factor in the calculation. The factors are:

• Cigarette Smoking 2 _,

• Extension Cord 4

• Heater 3

• Candle 1

• Overheating 2

• Hot Pipe 1 Overheating addresses errors while heating potential combustibles.

E. Obtain the ignition source weighting factor by dividing the weight (or BTUs) of cable insulation in the area by the total weight (or BTUs) of cable insulation in Appendix. R fire areas, not including the fire areas in either the radwaste area or the containment. Cable

• F.

G.

insulation weights (or BTUs) are provided in Appendix R combustible loadings. (Junction boxes and splices are assumed to be distributed in proportion to the amount of cable.)

Obtain the ignition source weighting factor by dividing the number of ignition sources in the fire area by the total number in all the locatio~ in this table.

Obtain the ignition source weighting factor by dividing the number of ignition sources in the fire area by the total number in all plant locations, include locations that were not specified in this table.

4-34

• FIRE AREA DESCRIPTION TABLE 4.1.7.3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING COMBUSTIBLE IGNITION SOURCE LOADING 1 FREQUENCY (yr)

IA Control Room Light IA/B/C combined I.20E-2 IB Office and Viewing Area Light IA/B/C combined I.20E-2 IC North Office Area Light I A/B/C combined 1.20E-2 2 Cable Spreading Room Moderate 6.20E-3 3A Switchgear Room I-D Light 6.30E-3 3B North Penetration Room Light I.03E-4 4 Switchgear Room I-C Moderate 4.15E-3

. 5 Diesel Generators 1-1 Light l.69E-02 6 Diesel Generators 1-2 Light I.72E-02 7&8 Diesel Day Tanks Heavy NIA - Screened 9 Intake Structure Light I.44E-2 IOA East Engineered Safeguards Minimal 2.26E-3 lOB West Engineered Safeguards Minimal 5.86E-3 II Battery Room A Light I.60E-3 I2 Battery Room B Light 1.60E-3

• 4-35

• FIRE AREA TABLE 4.1.7.3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING DESCRIPTION COMBUSTIBLE IGNITION SOURCE LOADING' FREQUENCY (yr) 13A Auxiliary Building 590' Minimal - Moderate 5.37E-3 Corridor 13B Charging Pump Room Minimal 2.06E-3 13C Waste Gas Decoy Room Minimal NIA - Screened 13D Decontamination Room Minimal NIA - Screened 13E Waste Gas Processing Room Minimal NIA Screened 13F Boric Acid Equipment Room Minimal NIA - Screened 14 Containment Minimal NIA 15 Engineered Safeguards Panel Moderate l.SOE-4 Room 16 Component Cooling Pump Minimal 2.36E-3 Room 17 Refueling and Spent Fuel Pool Moderate NIA - Screened Room 18 Demineralizer Room Minimal NIA - Screened 19 Compactor - Area Track Alley Minimal - Moderate NIA - Screened 20 Spent Fuel Pool Equipment Minimal 6.02E-4 Room 21 Electric Equipment Room Light 3.80E-3 22 Turbine Lube Oil Room Heavy 7.63E-3

• 4-36

• FIREAREA DESCRIPTION TABLE 4.1.7.3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING COMBUSTIBLE IGNITION SOURCE LOADING' FREQUENCY (yr) 23A Condensate Pump Room Light l .55E-3 23B Steam Generator Feed Pump Moderate 8.91E-3 Area 23C Main Generator - Seal Oil Heavy 2.20E-2 System Area 23D Turbine Building - General Moderate 5.26E-2 24 Auxiliary Feedwater Pump Minimal 2.27E-04 Room 25 Boiler Rooms Heavy NIA- Screened 26 Southwest Cable Penetration Moderate 6.89E-5 Room 27 Radwaste Addition - VRS Minimal NIA- Screened Note 1 Minimal (0 - 2 psf, 10 minute maximum fire duration)

Light (3 - 7 psf, 35 minute maximum fire duration)

Moderate (8 - 20 psf, 120 minute maximum fire duration)

Heavy (>20psf, > 120 minute fire duration)

• 4-37

• 4.1.8 Fire Detection and Suppression This section discusses automatic detection and automatic/manual fire suppression at Palisades. The detection and suppression systems available in each fire area are presented in the Fire Hazards Analysis and listed in Table 4.1.8.1.

While detection and suppression capability are discussed for most areas of the plant, it should be noted that the only locations where detection and/or suppression were credited in the accident sequence quantification were the control rooD;l, the cable spreading room and the Class 1E switchgear rooms. It should also be noted that the assl.J.rnptions and methodology employed in the Fire IPEEE (specifically those dealing with suppression of fire in control room panels) are not necessarily the same as those employed in the Appendix R analysis.

4.1.8.1 Detection Two basic methods of automatic fire detection are used at Palisades. These methods are ionization detection and ultraviolet (UV) detection. Alarms are designed to sound locally and in the control room. The detection system will also sound an alarm if there is a fault in the detector system. The control room also has smoke detectors in the walk-in cabinets and detectors at the ceiling, though not visible from the general area of the control room. These detectors sound alarms locally.

• In addition to the alarms described above, there are water flow alarms associated with water suppression systems which alarm in the control room. These alarms are also identified in Table 4.1.8.1.

4.1.8.2 Automatic Suppression The automatic suppression systems at Palisades consist of water based systems. The water supply for the water suppression portion of the fire protection system consists of two diesel-driven pumps arid one electric motor-driven' pump that will each deliver 1500 gpm at 125 psi. The water delivery portion of the system consists of deluge, wet/dry pipe sprinklers and hose stations.

Although many locations in the plant are protected by automatic fire suppression systems, the cable spreading room is the only location in which this analysis takes credit for the automatic suppression of a fire. The cable spreading room is equipped with a fusible-link wet sprinkler fire extinguishing system. The unavailability of the wet sprinkler system used in the quantification of this fire scenario is taken from the FIVE methodology. This generic wet sprinkler system unavailability is 2.0E-2 .

• 4-38

• • FIRE AREA TABLE 4.1.8.l

SUMMARY

OF PALISADES FIRE DETECTION AND SUPPRESSION DESCRIPTION DETECTION SUPPRESSION IA Control Room Smoke, Discovery Ext, Hose 1 18 Office and Viewing Area Smoke Ext, Hose IC North Office Area Smoke Ext 1, Hose 1 2 Cable Spreading Room Smoke 2 Automatic Sprinkler, Ext, Hose' 3A Switchgear Room 1-D Smoke2 Automatic Sprinkler, Ext, Hose 1 3B North Penetration Room Smoke2 Automatic Spririkler, Ext, Hose 1 4 Switchgear Room 1-C Smoke2 Automatic Sprinkler, Ext, Hose 1

• 5 6

Diesel Generators 1-1 Diesel Generators 1-2 Water Flow Alarrn2 Water Flow Alarrn2 Automatic Sprinkler, Ext, Hose' Automatic Sprinkler, Ext, Hose 1 7&8 Diesel Day Tanks Discovery Ext 1, Hose' 9 Intake Structure uv2 Automatic Sprinkler, Ext, Hose 1 IOA East Engineered Safeguards Smoke2 Ext, Hose' IOB West Engineered Safeguards Smoke2 Ext, Hose 1 11 Battery Room A Smoke Ext 1, Hose 1 12 Battery Room B Smoke Ext 1, Hose 1 13A Auxiliary Building 590' Smoke (partial) Ext, Hose Corridor

• 4-39

• FIRE AREA DESCRIPTION TABLE 4.1.8. l

SUMMARY

OF PALISADES FIRE DETECTION AND SUPPRESSION DETECTION SUPPRESSION 138 Charging Pump Room Smoke 2 Automatic Sprinkler, Ext, Hose 1 13C Waste Gas Decoy Room Discovery Ext 1, Hose 1 13D Decontamination Room Discovery Ext 1, Hose 1 13E Waste Gas Processing Room Discovery Ext 1, Hose 1 13F Boric Acid Equipment Room Discovery Ext 1, Hose 1 14 Containment Discovery, Smoke2 in air Ext, Hose room & cable penetration area 15 Engineered Safeguards Panel Smoke Ext, Hose 1 Room

• 16 17 Component Cooling Pump Room Refueling and Spent Fuel Pool Room Smoke (on first level)

Smoke2 (located at north end)

Ext 1, Hose 1 Ext, Hose 18 Demineralizer Room Discovery Ext 1 19 Compactor - Area Track Alley Discovery Automatic Sprinkler (Dry Pipe), Ext, Hose 1 20 Spent Fuel Pool Equipment Discovery Ext 1, Hose 1 Room 21 Electric Equipment Room Smoke2 Automatic Sprinklers, Ext 22 Turbine Lube Oil Room Water Flow Alarm Automatic Sprinkler, Ext, Hose 23A Condensate Pump Room Discovery Automatic Sprinklers, Ext 1, Hose 1

• 4-40

TABLE 4.1.8.1

SUMMARY

OF PALISADES FIRE DETECTION AND SUPPRESSION FIRE DESCRIPTION DETECTION SUPPRESSION AREA 23D Turbine Building - General Water Flow Alarm Automatic Sprinklers (strategic), Ext, Hose 24 Auxiliary Feedwater Pump Smoke2 Ext, Hose 1 Room 25 Boiler Rooms Water Flow Alarm Automatic Sprinkler, Ext, Hose 1 26 Southwest Cable Penetration Smoke Automatic Sprinklers, Room Ext. Hose 1 27 Radwaste Addition - VRS Smoke Automatic Sprinklers (Dry Pipe), Ext. Hose1 Note 1. Located in adjacent space and accessible for fire fighting.

Note 2 . Alarms in Control Room.

• 4-41

4.L8.3 Manual Suppression

• NRC guidance requires each plant to maintain a manual fire fighting capability. The fire brigades developed under these requirements are well trained and capable of fighting fires while awaiting support from professional fire fighting teams, if called. To take credit for brigade or other manually actuated suppression system response in the FIVE methodology, however, the plant must demonstrate that the fire brigade can assemble, fight and control a fire in the compartment before the fire causes damage to safe shutdown equipment. That is, the time to detect a fire plus the time to respond to the scene with equipment and control the fire must be less than the time required for the fire to damage critical equipment.

Detection time is dependent upon the type of detection equipment in a compartment. Ionization detectors should detect a fire during the incipient stages whereas heat detectors would not be expected to detect a fire until the fire is more fully involved. Fire brigade response time includes time to verify the detection and the time for the team to respond to the scene with equipment.

Response time is obviously highly variable and is dependent upon the location of the fire, location of the brigade members at the time of the event and many other factors.

The FIVE methodology assigns a probability of successfully suppressing a fire manually if the following two criteria can be met:

1) The plant can demonstrate that detection and manual response can occur before damage to safe shutdown equipment, and

2) Fire brigade effectiveness can be demonstrated per the requirements of the Sandia Fire Risk Scoping Study (Ref. 4-11 ).

The FIVE methodology states that the probability of manually suppressing a fire should not be greater than 0. 9.

For the purpose of this analysis, no credit for manual suppression is taken before damage of safe shutdown equipment is assumed to occur (i.e., some equipment is assumed damaged even with successful suppression). This analysis recognizes that manual suppression efforts will be taken to suppress a fire to limit damage and to ensure that the fire does not propagate outside the fire area boundaries, even though this action is not credited. Manual fire suppression equipment is available throughout the plant in the form of portable fire extinguishers and hose stations. The fire fighting

. tra~ning program in place at Palisades ensures that fire brigade members are adequately trained to effectively use this equipment. The limited credit for manual suppression in the Palisades Fire IPEEE is for accident sequence quantification purposes only.

Following successful suppression some equipment was assumed to be lost. This equipment, Panel CO 1 in the control room assumed lost either directly due to fire damage or indirectly due to

• 4-42

suppression induced damage. Since all fires outside of this two area was assumed to engulf the

• entire space, manual suppression induced damage outside of this spaces is not an issue .

In the control room, fire detection can be accomplished in a variety of ways:

The walk-in control room cabinets contain local smoke detectors which would provide an audible alarm should smoke be generated within the cabinets.

The control room contains local smoke detectors in the ceiling which would provide an audible alarm should smoke be generated in the control room.

The control room is continuously staffed and a fire should be quickly sensed by smell or sight. by the operators.

It is assumed that the failure to detect a fire in the control cabinets is negligibly small due to the redundancy and diversity of cues and due to the continuous staffing of the control room. It is further assumed that fire suppression efforts would be initiated immediately upon detection of a fire because of the continuous staffing of the control room. The FIVE methodology normally allows a minimum value of 0.1 for the probability of failing to suppress a fire manually in a given space even if urioccupied. This analysis assumes additional credit for successfully suppressing a control room fire for the following reasons:

The control room is continuously staffed. In addition, all control room operators are trained in fire suppression techniques. Therefore, very early detection and action to suppress a fire is very likely.

The cabinets contain relatively small amounts of combustible material.

For these reasons, a probability of 0.01 is assigned to failing to manually suppress a fire in the control room.

4.1.9 Fire Growth and Propagation All potential propagation paths that could result in propagation to a fire compartment containing safe shutdown equipment or plant trip initiators were considered. The Appendix R fire areas were reviewed to assess the potential for area to area propagation based on the existing fire barriers and fire area loading.

The potential for fire spread from the fire area being evaluated (exposing compartment) to the adjacent fire areas (exposed compartments) was then examined. Each common boundary was analyzed for fire spread in either direction. A means of addressing fire spread across these boundaries is addressed in the FIVE methodology and was used in this study. Criteria to determine fire spread were identified in Section 4.1 .

• 4-43

Any scenario where a fire could potentially involve two or more adjacent areas was analyzed for potential fire spread, by extending unscreened boundaries. All fire area boundaries are either 2 or 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rated boundaries or have an engineering evaluation (Ref 4-7), performed by a qualified fire protection engineer, confirming fire spread across the boundary is not credible. Based on this information, no locations were identified within the plant that have the potential for fire spread beyond the originating fire area.

4.1.10 Fire Event Trees This analysis was based upon the Palisades transient event tree from the internal events PRA (Figure 4.10-1 ). A fire in most locations in the Palisades plant would initiate an event similar to a transient event with one or more of the systems identified in Section 4.1 out of service due to the fire. One additional event tree was developed specifically for this analysis (Figure 4.10-2). It was developed for fires in the main control, cable spreading and 2.4kV switchgear rooms (F A-3 and FA-4) and was based on the internal events PRA transient event tree. Top events were added to account for the effects of suppression and switching control of the plant to the alternate shutdown system panel or operation of equipment available given the fire damaged all equipment affected within the fire area..

Accident classes were defined such that core damage sequences with similar characteristics (e.g.,

PCS failure pressiire, core damage timing, system failures) could be grouped and analyzed together.

The three accident classes employed in the Fire IPEEE is a subset of the accident classes found in the internal events IPE. These accident classes are: Class IA - Core damage due to the failure of

• secondary heat removal and once through cooling during the injection phase, Class IB - Core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase and, Class II - Core damage due to loss of decay heat removal and the subsequent loss of containment heat removal.

4..1.10.1 Fire Event Tree Top Event Definitions

. FIRE Fire Initiator

. The fire is defined as initiating in a location that would cause a plant trip initiator or require a manual shutdown and affect frontline safe shutdown equipment potentially useful for plant shutdown.

RXC Reactivity Control Sufficient control rods to control reactivity are fully inserted into the reactor core.

SUP Sup_pression of Fire Before Spread (Control/Cable Spreading/Switchgear Rooms only) -

The fire is suppressed either by occupants in the room or by automatic suppressipn equipment before it can spread to locations impacting other safe shutdown equipment.

In the control room fire, successful manual suppression limits the extent of the fire to the cabinet (COl) in which it is assumed to initiate. Successful suppression of a fire in the cable spreading room assullies that fire damage occurs to at least one system (assumed to be Auxiliary Feedwater) but is limited to this system. It is assumed that the smoke 4-44

created from a fire involving one panel, given the existing ventilation, would not force the evacuation of the control room. In the event of fire suppression failure in the control room or cable spreading room, it is assumed that extensive damage is possible, requiring secondary cooling/inventory makeup to be accomplished outside the affected area. For fires in the control room the operator can transfer to the alternate shutdown panel.

Controls for the turbine driven auxiliary feedwater train (train B) are provided on the ASDP. For cable spreading and bu5 tc switchgear room fires, P-8C is available in local manual control. For a fire in bus ID switchgear, P-8B is available in local manual control.

ASDP Operators Control Plant at the Alternate Shutdown Panel (control/cable spreading only)

The operators carry out the "Alternate Shutdown Outside Control Room" procedure, Procedure No. ONP 25.2, evacuating the main control room, and transferring plant control to the ASDP.

2ND

• Secondary Cooling Maintenance of the steam generator secondary side inventory using train B of AFW and a steam release path for secondary heat removal using the ADV s.

POR PORV Opens to Su1wort Once Throu~h Coolin" Opening of at least one power operated relief valve to release thermal energy from the PCS and facilitate once through cooling (OTC) .

• Sii PCS Inventozy Control - Injection Prlrllary system make up flow utilizing at least one HPSI pump injecting through one of the four headers to the PCS.

SIR PCS Inventozy Control - Recirculation Safety injection in the recirculation phase of once through cooling requiring safeguard pump suction switchover from the SIRW tank to the containment sump and continued operation of at least one HPSI pump. Room cooling, pump suction subcooling and HPSI pump cooling (seals and bearings) are also required.

CHR Containment Heat Removal Containment heat removal for OTC consisting of operation of at least one containment spray pump or one containment air cooler. Operation of service water and component cooling water valves to align SDC heat exchanger cooling are also required for containment spray operation in the recirculation mode.

4.1.10.2 Event Tree For Fire in Main Control Room The event tree for fire in the Main Control room is similar to the tranSient event tree. The difference is:

• 4-45

( 1) The event SUP is included to account for the likelihood of the fire being suppressed by the operators before it can spread from a single control room panel. This event was discussed in Section 4.8. The probability assigned to the failure of this event is 0.01.

(2) The ASDP event is included to account for the operator's ability to recognize the need to evacuate the control room_and to successfully control the plant from, the ASDP.

This event tree asswnes that suppression of the fire in the control room must fail before it can spread to locations impacting more than one cabinet. Successful manual suppression, therefore, limits the extent of the fire to the cabinet in which it initiates. Spreading of the fire beyond the initiating cabinet is assumed to force the evacuation of the control room.

This event tree was quantified using the same methods used in the internal events PRA for the transient tree and the results of that quantification are provided in Table 4.1.11.1.

4.1.10.3 Event Tree For Fire in Cable Spreading and Switchgear Rooms The event tree for fire in the Cable Spreading and Switchgear rooms is also similar to the transient event tree. The differences are:

( 1) The event SUP is included to account for the likelihood of the fire being suppressed before it can spread to locations impacting more than one injection system. Automatic

• suppression is assumed to limit the extent of the fire to the cabling of a single system, auxiliary feedwater (or the particular switchgear). The AFW system was selected to be failed during cable spreading room fires that were suppressed because its loss has the greatest impact on the core damage frequency of any of the injection systems credited in the analysis. In the Switchgear rooms the fire is assumed to start in the switchgear and fail all equipment powered froqi the bus. The probability assigned to the failure of cable spreading room suppression is estimated to be 2E-2 as discussed in Section 4.8.

(2) The ASDP event is included to account for the operator's ability to recognize the need to evacuate the control room and to successfully control the plant from, the ASDP. -

It is assumed in this analysis that when the fire is suppressed by automatic suppression equipment, it does not spread to locations impacting other safe shutdown equipment. Automatic suppression,

-therefore, limits the extent of the fire to the auxiliary feedwater cabling or cabling from the affected 2.4kV bus.

This event tree was quantified using the same methods used in the internal events PRA for the transient tree and the results of that quantification are provided in Table 4.1.11.1.

4.1.10.4 Accident Sequence Classific~tion 4-46

This section discusses the binning of core damage sequences into functional categories based upon characteristics of the accident sequences with respect to reactor and containment conditions at the time core damage is assumed to occur. These functional categories are called "accident classes".

The potential types and frequencies of accident scenarios at a nuclear power plant cover a broad spectrum. In order to limit these sequences to a manageable number, -sequences with similar functional characteristics are grouped together. Three such functional classes were defined for the Palisades Fire IPEEE:

Class IA - Sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the injection phase.

Class I I B -

• Sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase.

Class II - Sequences involving the loss of containment heat removal leading to containment failure and the subsequent loss of coolant inventory makeup.

These accident classes are typical of other PRAs and are a. subset of those used .in the Palisades internal events PRA. Other accident classes that were included in the Palisades IPE but were not considered to be applicable to the Fire PRA include:

• Class IIIA- Sequences initiated by a small break loss of coolant accident (SBLOCA) with loss of primary coolant makeup during the injection phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the injection phase of high pressure safety injection. No fire initiator was identified that could credibly lead to a loss of coolant accident.

Class IIIB- Sequences initiated by a small break loss of coolant accident (SBLOCA) with loss of primary coolant makeup during the recirculation phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory. during the recirculation phase of high pressure safety injection. No fire initiator was identified that could credibly lead to a loss of coolant accident.

Class IIIC- Sequences initiated by a medium or large break loss of coolant accident with loss of primary coolant makeup during the injection phase. This class leads to core damage due to the inability _to maintain sufficient PCS inventory during the injection phase of high pressure safety injection. No fire initiator was identified that could credibly lead to a loss of coolant accident.

Class IIID- Sequences initiated by a medium or large break loss of coolant accident with loss of primary coolant makeup during the recirculation phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the

• 4-47

recirculation phase of high pressure safety injection. No fire initiator was identified that could credibly lead to *a loss of coolant accident.

Class IV- Sequences leading to core damage due to the failure of reactivity control. No fire initiator was identified that could credibly lead to a failure of the reactor protection system. The simultaneous failure of the reactor protection system or control rod insertion is probabilistically insignificant.

Class VB- Sequences initiated by steam generator tube rupture with loss of effective coolant inventory makeup. This class contains those steam generator tube rupture initiated events that do not lead to core damage due to failure of decay heat removal, but rather due to the inability to maintain sufficient PCS inventory .

• 4-48

TRANSIENT EVENT TREE CLASS OK OK II IB IA IA ATWS FIGURE 4.10-1 4-49

PALISADES FIRE EVENT TREE FIREIN PORVOPS OPERATORS PCS PC 8 CONTROL OR TO SUPPORT ONTAINllENT REACTIVITY FIRE CONTROL SECONDARY INVENTORY INVENTORY SEQ. CLASS CABLE ONCE HEAT CONTROL SUPPRESSION PLANT COOLING CONTROL* CONTROL* PROB.

SPREADING THROUGH REllOVAL FROllASDP INJECTION RECIRC.

ROOllS COOLING

--- -- --- - - - - - - -- __ µ_ ------ -----

PllE RXC SUPP ASDP 2ND POR 811 SIR CHR

---

-- -- -- ------- ----- - O.OE+OO OK c

• -- ----- --------- --- OJJE+OO

~

OK

--c-c-~

-- ----- --- -- - - OJlE.00

---

O.OE+OO 18

---

- - - - - - - - - - - - - O.OE+OO

- --- -- - - - - - ----.--- O.OE+OO

- - ------*------- ----- -- - O.OE+OO OK

[=~{ ---- --- - - - - --- ----- O.OE+OO

- - - - - - - - - --- --------* O.OE+OO

~-------- ----- ---- -- -- -- -- - - ---- - O.OE+OO ATWS FIGURE 4 .. 10-2 4-50

4.1.11 Analysis of Fire Sequences and Plant Response

• The functional reporting requirements presented in Generic Letter 88-20 and NUREG-1407 are:

(1) Functional sequences with a CDF greater than lE-6 per year. (Functional sequences for the Palisades Fire IPEEE are the three accident classes defined in Section 4.10).

(2) Functional sequences that contribute 5 percent or more to total CDF.

(3) Sequences determined by the utility to be important contributors to CDF or containment performance.

Although these reporting criteria are suggested by*NUREG-1407, all three functional accident classes quantified in th_e Palisades Fire IPEEE are described regardless of whether they meet. the screening thresholds.

4.1.11.1 Important Accident Classes Class IA: The sequences within this class were characterized by control room or cable spreading room fires in which fire suppression failed. Class IA sequences had a total CDF of 6.6E-05/year, or 39% of the overall internal fire events CDF. The Class IA sequences were dominated by sequences initiated by fires in the control room and cable spreading room. These two scenarios represent 60% of the Class IA CDF. The electrical equipment room fire added 8.6E-06/year or 15%

of the total. The dominant contributor to the turbine building fire was the loss of two AFW pumps due to fire induced damage .

• For these sequences, Important assumptions applicable to this class that are reiterated from the internal events PRA:

1. Once through cooling (OTC) is intitiated per procedure, with secondary inventory still available. Procedures direct the operators to inititate OTC if PCS/core temperatures are rising uncontrolled and S/G levels are less than -84%.

2. It is conservatively assumed that the loss of containment heat removal leads to containment failure, resulting in a loss of inventory used for PCS/core heat removal. The loss of heat transfer via PCS inventory results in the failure of heat transfer out of the core, and leads to core damage.

3 .. The use of P-8C requires either a steam generator pressure reduction or tripping of primary coolant pumps to reduce the energy input into the PCS to be considered "full capacity". The PRA is conservative in this assumption since only 1 ADV may be necessary early in the event, where as the PRA assumes all four ADVs are necessary for twenty-four hours. In addition, ongoing analysis may show that these actions are no longer required.

• 4-51

The most significant fire initiating events were:

1.

~*

Fire in the control room and cable spreading room contribute approximately 60% to accident class IA. Fires in both of these areas are dominated by failure of suppression to contain the fire resulting damage to all of the equipment in the area subject to fire damage. It was assumed that only P-8B is available in these events from the alternate shutdown panel (C-150).

2. Fires in the electrical equipment room contribure another 13% to this accident class. For fires in this room AFW pump P-8C is not available for secondary cooling and the power operated relief valves (PORVs) and HPSI motor-operated valves are unavailable preventing feed & bleed cooling of the core. The unavailability of equipment for feed

& bleed cooling is the result of fire induced damage to important electrical distribution equipment in the room. The available equipment is a motor-driven and turbine-driven AFW pump. The auto-start signal to these pumps was assumed failed in the fire requiring manual start. The human error assocaited with manual start of the AFW pumps represents 71 % of the CDF in this room. Random failure of the pumps add 12% and 9%

to the total.

The most significant operator actions contributing to this accident class were:

1. Failure to suppress the fire, in conjunction with failing to transfer and then take control oft17.e plant at the ASDP. Approximately 60% of the core damage associated with this accident class results from sequences in which fire suppression is unsuccessful and the operator is unable to take appropriate actions from the ASDP within a half hour of the loss of injection systems.

2. Failure to manually start the AFW pumps is signifcant in the next largest sequence.

Important hardware failures associated with this accident class include:

1. Failure of P-8B (turbine-driven AFW pump) was important in the top three fire areas.

Class lB: Sequences in this class were characterized by events with early and late failures of the AFW system and failure of feed & bleed cooling in recirculation. Class lB sequences made up 56%

of the fire-initiated CDF at Palisades.* They had a combined sequence frequency of 9.62E-05 per year .

. Assumptions associated with the Class lB sequences in general were:

1. . Credit was not taken for availability of nitrogen stations as backup air supplies to the high pressure injection subcooling valves necessary for continued operation m recirculation .

4-52

2. It is still assumed that high pressure air compressors are required to maintain the accumulators for operation (opening) of the sump valves when entry into recirculation may not occur for an extended time .

Significant fire initiating events for this accident class were:

1. Fire in the turbine building accounts for 60% of the fire initiated contribution to Class lB CDF. 21 % of the CDF for this event involve failure of the sump valves to open.

14% involve the unavilability of air to the sump vitlves. Random failure of the available HPSI adds 19%. Failure of the HPSI subcooling valve to the pump accounts for 13%.

Random failures of P-8B and its steam admission valve contribute 25 and 24%

respectively and the motor-driven pump 48%.

2. Fire in the 1D switchgear and auxilairy building 590' corridor each contributed 8% to the total. The dominant failures in ID swithc gear room fire are air system failures that contribute 29%, failure of manual valves for makeup to the AFW pumps ( 16%), human error to align makeup to AFW (12%), the only available service water pump (30%) (the other two were assumed failed by the fire, failure of nitrogen backup to AFW flow control (15%), failure of the fire protection pumps to provide makeup flow to AFW (14% ea), random failures of AFW pumps (13%, and 9%). The dominant contributors to the fire in the auxiliary building corridor are; random failure* of motor-dirven pump P-8C (44%), random failure of nitrogen backup to AFW flow control (45%), a pre-accident human error for misaclibration fo AFW components (13%), a human error for failure to trip the primary coolant pumps to reduce steam generator pressure for P-8C

• 3.

(18%) and random failures of P-8A (14%) .

Fire in the 1-1 diesel generator room contributed approximately 5%. The dominant contributors are; human error to align service water or fire protection makeup to AFW (59%), failure of the instrument air system (76%) (assumed to fail HPSI subcooling valve for recirculation), human error to manually start an AFW pump (auto start assumed failed by the fire) (20%) and random failures of P-8B ( 12%).

Accident Class lB is the largest contributor to fire induced core damage frequency. Significant contributions to this class include; random equipment failure and human errors which result in failure to transfer HPSI suction to the containment sump and failures which preclude makeup to the conderuiate storage taiik for continued AFW operation.

Class 2: Class 2 events were accident sequences resulting from a loss of containment heat removal.

The core damage probability for this accident class was determined to be 8.5E-06 per year due to

• fires, or approximately 5% of the total.

1. Fire in the East Engineered Safeguards room represents 50% of the CDF for this class.

The largest contributor is the failure of the service water supply to the containment air 4-53

coolers (all three containment spray pumps were assumed failed by the fire). Failure of

• the service water connection is 94% of the failure of heat removal for this fire area .

4.1.11.2 Important Fire Areas/Rooms Eighty-five percent of the plant risk assoeiated with internal fires can be traced to five fire areas.

These areas consist of the I) turbine building, 2) main control room, 3) cable spreading room, 4) 2.4kV switchgear room (Bus ID), and 5) 2.4kV switchgear room (Bus IC). Table 4.I.I I.I provides a detailed breakdown of core damage frequency for internal fires by fire area and accident class.

This section provides the detailed plant response for each fire area not previously screened from consideration. The quantification results presented in Table 4. I. I I. I include:

(I) The area in which the fire occurs; (2) The frequency of fire ignition in that area; (3) The core damage frequency (CDF) given that this fire has occurred and all the systems in this specific area failed; (4)

• Amplifying remarks where appropriate.

Turbine Buildin~ (Fire area 23): The turbine building is te dominant contributor to the fire induced core damage frequency. Cables for several makeup solirces to the AFW system are in the turbine building along with a non-safety related power supply (Bus IE) which also affects long term makeup to AFW. In addition, cables or compnents subject to fire damage for two of the AFW pumps (P-8A and B) are located in this fire area. One train of high pressure injection motor-operated valves can

.also be impacted by fires in the turbine building.

Control room/Cable spreadin~ room (Fire areas IA & 2): The control and cable spreading rooms contain controls, monitoring instrumentation, and cables for most of the equipment used to achieve safe shutdown of the plant. Loss of these areas due to a fire was assumed to disable all equipment that could not be controlled from the ASDP.

For fires in the control room, Panel COi, which contains controls for AFW, MFW, turbine bypass valves and the ADVs was considered to be the most significant panel and the fire was assumed to start there. The analysis assumed that, if the fire suppression is successful, the fire is extinguished before it can spread to locations impacting other safe shutdown equipment. Manual suppression, therefore, limits the extent of the fire to the cabinet in which it initiated. It was also assumed that the smoke created from a fire involving more than one panel forced the evacuation of the control room.

If the fire was suppressed, all equipment not controlled from panel CO I was assumed to be available for use and could fail only due to random causes. If the fire was not suppressed, the only equipment considered available for Use was equipment controlled from the ASDP .

• 4-54

Automatic suppression is available for fires in the cable spreading room. If this suppression is successful, the*cabling associated with at least one system was assumed to be damaged (auxiliary feedwater). If automatic suppression was unavailable, the fire was assumed to engulf the whole area.

Only equipment controlled from the ASDP was credited for sequences in-which fire suppression in the cable spreading room was not successful.

Class IA and Class IB sequences comprise the majority of the risk associated with a fire in the turbine building, control room, and cable spreading room. Class IA sequences were dominated by operator inability to take control at the ASDP in time to provide adequate core cooling following failure to suppress the fire in the control room or the cable spreading room. The specific steps to transfer control to the ASDP are detailed in Palisades Off Normal Procedure ONP 25.2, "Alternate Safe Shutdown Procedure." Class IB sequences were dominated failure of the sump valves or subcooling valves for the high pressure injection pumps in the turbine building fire .

• 4-55

• *TABLE 4.1.11.1 PALISADES PLANT RESPONSE TO AREA SPECIFIC FIRES Fire Fire Area Ignition Class Class Class Total Area/ Description Frequency IA 1B 2 CDF Comments Zone IA* Control Room IAIBIC combined 2.4E-05 3.0E-07 7.0E-09 2.4E-05 l.20E-2 1B Office and Viewing Area I AIBIC combined see above see above see above see above l.20E-2 IC North Office Area IAIBIC combined see above see above see above see above 1.20E-2 -

2* Cable Spreading Room 6.20E-3 l.4E-05 l.6E-06 3.4E-08 l.6E-05 3A* Switchgear Room I ~D 6.30E-3 l.5E-06 7.9E-06 2.IE-07 4.IE-05 39* North Penetration Room l.03E-4 see above see above see above see above 4* Switchgear Room 1-C 4.15E-3 2.7E-06 2.7E-06 3.2E-08 5.4E-06 s Diesel Generators 1-1 1.69E-02 l.2E-06 6.3E-06 7.2E-08 7.6E-06 6 Diesel Generators 1-2 l.72E-02 l.7E-06 5.0E-06 5.4E-08 6.75E-06 7&8 Diesel Day Tanks NIA - Screened NIA NIA NIA NIA 9 Intake Structure - SWS 7.2E-03 3.5E-07 3.9E-06 8.8E-09 4.3E-06 9 Intake Structure - FPS 7.2E-03 3.2E-08 l.IE-06 2.SE-08 l.2E-06 IOA East Engineered Safeguards 2.26E-3 9.4.E-09 4.9E-08 4.4E-06 4.5E-06 108 West Engineered Safeguards 5.86E-3 4.0E-07 2.SE-08 3.0E-09 4.3E-07 11 Battery Room A 1.60E-3 l.IE-07 4.0E-07 l.9E-09 5.IE-07 12 Battery Room B l.60E-3 7.5E-08 2.IE-07 2.0E-07 4.9E-05 13A Auxiliary Building 590' Corridor 1.15E-2 2.6E-07 7.3E-06 1.5E-07 7.7E-06 138 Charging Pump Room 2.06E-3 see above see above see above see above 4-56

TABLE 4.1.11.1 PALISADES PLANT RESPONSE TO AREA SPECIFIC FIRES Fire Fire Area Ignition Class Class Class Total Area/ Description Frequency IA IB 2 CDF Conunents Zone 13C Waste Gas Decoy Room NIA - Screened NIA NIA NIA NIA 130 Decontamination Room NIA - Screened NIA NIA NIA NIA 13E Waste Gas Processing Room NIA - Screened NIA NIA NIA NIA 13F Boric Acid Equipment Room NIA - Screened NIA NIA NIA NIA 14 Containment NIA NIA NIA NIA NIA IS Engineered Safeguards Panel l.50E-4 2.3E-06 negligible negligible 2.3E-06 Room 16 Component Cooling Pump Room 2.36E-3 3.SE-07 2.2E-06 2.4E-07 2.SE-06 17 Refueling and Spent Fuel Pool NIA - Screened NIA NIA NIA NIA Room 18 Demineralizer Room NIA - Screened NIA NIA NIA NIA 19 Compactor - Area Track Alley NIA - Screened NIA NIA NIA NIA 20 Spent Fuel Pool Equipment 6.02E-4 8.6E-06 negligible negligible 8.6E-06 Room 21 Electric Equipment Room 3.SOE-3 3.2E-06 negligible negligible 3.2E-06 22 Turbine Lube Oil Room 7.63E-3 5.SE-09 8.3E-08 l.JE-07 2.2E-07 23 Turbine Building 8.SE-02 3.6E-06 S.7E-05 2.SE-06 6.3E-05 23A/BIC/D Combined 23A Condensate Pump Room l.SSE-3 see above see above see above see above 23B Steam Generator Feed Pump 8.91E-3 see above see above see above see above Area 4-57

TABLE 4.1.11.l PALISADES PLANT RESPONSE TO AREA SPECIFIC FIRES Fire Fire Area Ignition Class Class Class Total Areal Descriptioq Frequency IA IB 2 CDF Comments Zone 23C Main Generator - Seal Oil System 2.20E-2 see above see above see above see above Area 230 Turbine Building - General 5.26E-2 see above see above see above see above 24 Auxiliary Feedwater Pump Room 2.27E-4 5.SE-09 8.3E-08 l.JE-07 2.2E-07 25 Boiler Rooms NIA - Screened NIA NIA NIA NIA 26 Southwest Cable Penetration 6.89E-5 3.0E-08 3.SE-08 l.4E-07 2.1 E-07 Room 27 Radwaste Addition - VRS NIA - Screened NIA NIA NIA NIA CDF 6.6E-05 9.62E-05 8.SE-06 1.7E-04 NIA NIA NIA TOTAL NOTES:

• Manual or automatic suppression credited.

4-58

4.12 Containment Performance

• As stated in NUREG-1407, the purpose of the IPEEE containment performance evaluation is to identify vulnerabilities that involve early failure of containment functions that differ significantly from those identified in the internal events IPE. For the Fire IPEEE, the evaluation should consider fire related vulnerabilities found in the systems/functions which could lead to early containment failure or which may result in high consequences. This includes: isolation, bypass, integrity, and systems required to prevent early failure.

The scope of this analysis is based upon a review of the Level 2 analysis that was performed for the internal events PRA as well as the specific results of the Level I Fire PRA presented in Section 4.11 of this report.

4.12.1 Containment Structures and Systems Two facets of containment performance were evaluated with regard to fire induced damage. First, the impact of fires on containment integrity in the form of structural performance and containment isolation/bypass was investigated. . Second, containment system performance following a fire was also evaluated.

Containment Integrity The containment at Palisades is a large dry pre-stressed concrete design with the entire interior

• surface of the structure lined with 114-inch-thick welded steel plate to ensure leak tightness .

Because the containment contains minimal combustible material during power operation, a significant fire within the containment is not expected to occur. Additionally, none of the spaces surrounding the containment contain heavy loadings of combustible material. A large fire in these comp~ents is not likely given their combustible loading. The FIVE methodology also indicates that fire spread between these compartments is not credible. Therefore, because any fire in the spaces adjoining the containment will be contained within a single area and will be of limited duration/intensity, structural damage to the containment is not expected.

During the walkdown, several specific containment penetrations were inspected/investigated for potential susceptibility to fire damage. These penetrations consisted of the equipment hatch, personnel airlock and north/southwest cable penetration areas. The personnel airlock is located in a small completely enclosed area on the 607' level of the auxiliary building. Because of the minimal combustibles located in the vicinity of the airlock, the airlock is not expected to be threatened by any postulated fire. The equipment hatch is also located in the auxiliary building, on the 649' level. There are minimal combustibles located in the vicinity of the hatch. In addition, during power operation the equipment hatch is protected by large concrete blocks utilized for shielding. Combining theses two factors results in the conclusion that fire damage to the equipment hatch is not credible. The southwest penetration area is located on the 607' level of the turbine building and the north penetration area is located on the 625 elevation of the I

auxiliary building. Both of these areas are protected by sprinklers in the vicinity of the actual

• 4-59

~

I penetrations .

• .The potential for containment isolation/bypass due to valve failure was also investigated.

Containment isolation valves are provided on all lines penetrating the containment and serve to isolate the containment building atmosphere when required. The isolation valves are of two basic types: those that automatically close and those that are locked closed during normal operation.

Instrumentation and control circuits in the Containment Isolation system are fail-safe; i.e., the valves, with the exception of the component cooling water return isolation valves, will fail closed upon the loss of voltage or control air. As component cooling water is a closed system inside containment, the return valves play little role in providing containment isolation.

Fires can affect containment isolation valves in one of two ways, 1) Failure of power cables or -**

motive power (air to AOVs) to AOVs/SOVs will cause the valve to fail closed, 2) Hot shorts in control cables to AOVs/SOVs could possibly cause inadvertent valve opening. The second of these outcomes, however, is considered probabilistically insignificant. All of the valves that connect the containment atmosphere to the Reactor Building are air-operated valves that fail closed on a loss of air or power. Although extremely unlikely, if a hot short in one of these valve circuits were to occur that did not fail the protective fuse, manual recovery by removing fuses in the affected circuit would cause the valve to fail closed.

For the reasons discussed above, fire induced degradation of containment isolation is expected to be negligible. There were no unique containment failure modes identified during the Fire IPEEE

• • analysis that differ from those identified in the internal events PRA .

Containment Systems Many of the essential components needed to maintain containment functionality were evaluated as part of the Level I portion of the Fire PRA, including components of the following systems:

AC power, DC power, ECCS, service water, component cooling, and fire protection. In addition, examination of important components associated with containment systems was performed: containment spray and containment coolers The purpose of this evaluation is to determine the functionality of systems which impact containment response to important accident sequences identified during the Level I seismic analysis. Table 4.12-1 provides a summary of the systems available following fire induced core damage to provide functions such as debris cooling and .containment heat removal. The three accident classes analyzed in the Level I part of the Fire PRA (Accident Classes IA, IB and m are discussed for each of the fire areas meeting the screening criteria of NUREG-1407. The challenge to containment for these accident sequence types is discussed below. The review of these accident classes supports the conclusion that containment re.sponse to core damage following a fire is similar to that analyzed in the internal events PRA .

• *4-60

4.12.2 Analysis of Containment Performance Following a Severe Accident In the internal events PRA, an evaluation of the containment response to any given severe accident used a two phase approach irivolving:

• a Plant Damage State event tree (evaluation of the status of containment systems),

• a Containment event tree (evaluation of phenomenological response to each Plant Damage State).

In this section, an evaluation is made of the Plant Damage States which would be expected to dominate the Fire PRA results. It is followed by a quantitative estimate of accident sequence _..

frequencies from the containment event tree to determine the distribution of containment challenges.

4.12.2.1 Plant Damage States Dominant in the Fire PRA In the first phase of the containment analysis for the internal events PRA, distribution of the Level I core damage sequences among eighteen possible Plant Damage States was performed. Table 4.12-2 identifies aspects of the accident sequences which define each of these eighteen Plant Damage States. The plant damage states were developed around four distinct parameters which establish the characteristics of the accident sequence and plant systems important to quantification

• of phenomenological challenges evaluated in the CET:

Accident sequence initiator type (e.g., Transient, LOCA, SGTR, ATWS, etc.)

Timing of core damage with respect to initiation of offsite protective actions (early or late)

• Status of secondary cooling

• Status of plant systems important to containment functions (e.g., containment spray, coolers, location of SIRWT inventory, etc.)

Fire PRA Initiator Types As noted in Section 4.11, the Fire PRA is dominated by three specific Accident Classes; Class IA (loss of secondary heat removal with failure of once through cooling in the injection mode),

Class IB (loss of secondary heat removal with failure of once through cooling in the recirculation mode), and Class II (loss of containment heat removal). All three of these accident classes represent transient initiators in which both the reactor coolant system and containment are intact up to the.time at which core damage is assumed to occur. Other initiators such as LOCA, ATWS or SGTR are substantially less likely to be caused by a fire event and 4o not dominate the Fire PRA results .

• 4-61

• • Fire PRA Core Damage Timing In Section 4.11, it was noted that the principle failures leading to core damage following a fire begin with damage to equipment associated with the AFW system and require additional random failures to occur in this system.

In Accident Class IA, initiation of once through cooling is assumed to be unsuccessful resulting in the slow depletion of reactor inventory through pressurizer PORVs or safety relief valves.

Assuming AFW is lost at the time of the initiating event, steam generator dryout is estimated to occur between 1-1/4 and* 1-1/2 hours later. Approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> into the event, primary system depletion would be sufficient for fuel damage to be initiated. Another hour would be required' before fuel melting and slump to the bottom of the vessel. .

In Accident Class IB, once through cooling is initiated successfully and core cooling is adequate as the contents of the SIRWT are injected to the vessel. Core cooling can be maintained in the once through cooling mode for several hours in this manner. At the time of SIRWT depletion, switch to recirculation requires piggy-backing a HPSI pump to the discharge of a containment spray pump. In this accident class, recirculation is assumed to be unsuccessful. Depletion of reactor inventory is assumed to occur such that core damage would be expected approximately 5 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> into the event. Another one to two hours would be required for fuel melt progression to the lower portions of the vessel.

• For either of these accident classes, core damage and core melt progression to lower head penetration would not be expected before 4 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event. It was assumed in the internal events PRA that implementation of protective actions in accordance with the Emergency Plan would not occur until core damage was anticipated .. As such, Accident Classes IA and IB would be considered to be early con~ damage scenarios. This classification will be retained in the Fire i>RA to be consistent with the definitions in the internal events PRA even though core damage would not be expected for a substantial period of time.

Accident Class II is characterized by long term pressurization of containment due to limited or no decay heat removal from containment. In fact, heat removal is partially successful in that once through cooling through the RHR heat exchangers is being performed successfully. Pressurization of containment to its ultimate capacity is not expected for days under these conditions. Accident Class II is not considered to result iil early core damage.

Fire PRA Secondary Heat Removal Status Accident sequences classified in Classes IA, IB and II are defined as having no secondary heat removal .

• 4-62

Fire PRA Containment Systems Status Tabie 4.12-2 lists each of the systems evaluated in the Plant Damage State event tree in the internal events PRA [See Section 3.3 of Ref. 4-2]. The availability of each system is noted for the two dominant accident classes of the Fire PRA, Classes IA and m by fire area. Accident Class II is evaluated only where it contributes significantly to the core damage frequency for that fire area. Also noted are any potential vulnerabilities of the systems to fire induced failure modes as identified in Section 4.11.

Selection of Fire PRA Plant Damage States From the preceding discussion, the characteristics of the Accident Classes which dominate the Fire PRA are as follows: * *

• Transient initiated (non-LOCA, ATWS, etc.)

• "Early" core damage (even though not expected for 4 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the fire initiator).

• No secondary cooling

• SIRWT contents in containment with containment for the majority of accident sequences. (The fire areas in which SIR.WT is not injected are control room or cable spreading room fires in which fire suppression is not successful) .

• The availability of long term ESP operation in the form of recirculation and containment cooling is highly location dependent and the damage postulated for each area. Two plant damage states make up more than half of the total core damage frequency for fires in which long term recirculation is successful. Plant Damage States TFJP and TFJQ represent accident sequences in

• which core damage bas occurred but containment spray initiation and recirculation is performing successfully. Containment spray operation plays a significant role in keeping the reactor cavity

• flooded and preventing lower head penetration by core debris.

The remaining Plant Damage States are those in which long term recirculation is assumed not to be established. TEJR represents fire initiated events in which the SIR.WT has been injected successfully to containment but long term recirculation is not available. The principal fire area contributing to this plant damage state is the turbine building. High pressure air compressors are*

assumed to be unavailable or random failures of sump valves are assumed for fires in this area prohibiting alignment of ESP pump suction from the sump. In plant damage state TEJW, no containment safeguards are assumed to be available and initial injection of the SIR.WT has not occurred. This plant damage state represents control room and cable spreading room fires in which control room evacuation is necessary and only the equipment available from the alternate shutdown panel is assumed to be operable. Table 4.12-2 summarizes Plant Damage State assignment by fire area .

• 4-63

4.12.2.2 Containment Event Tree Evaluation Figure 4.12-1 is the containment event tree developed for the internal events PRA. Heading

• definitions for the Palisades CET are as follows.

BYE Early Containment Bypass. This CET heading principally identifies the potential for interfacing system LOCA. This containment faiiure mode is not likely to result from a fire and, therefore, is not applicable to the Fire PRA.

CIS Containment Isolation. This mode of containment failure. was evaluated as a part of the fire walkdowns discussed in Section 4.12.1.

BYL Late Containment Bypass. This mode of containment bypass is considered as a part of core melt progression. In the Palisades internal events PRA it was driven by creep rupture of the steam generator tubes. This containment failure mode did not dominate the containment results for the internal events PRA and would not be expected to become any more likely as a result of a fire initiator.

RIV Recovery in Vessel. The principal means of terminating core melt progression prior to vessel penetration credited in the internal events PRA is to submerge the lower vessel head. To accomplish this at Palisades, Containment Sprays are assumed*to be required to recirculate water through the RHR heat exchangers and maintain water

• UDD level up around the reactor vessel by means of the reactor cavity flooding system piping.

Upward Debris Dispersal at reactor vessel failure. This CET heading defines the potential for core debris exiting the lower vessel head and being entrained by steam and gases from the vessel blowdown to areas in the upper part of containment. For this relocating of debris out of the reactor cavity to occur, the reactor must be at high pressure and a significant portion of debris must be entrained.

CAE Early Relocation of the Core to the Auxiliazy Buildin~. The containment sump for Palisades is located beneath the reactor cavity as shown in Figure 4.12-2. If debris were to exit the lower head and remain in the reactor cavity in an uncooled state*, flow through the reactor cavity floor drains and erosion of the floor of the reactor cavity could lead to relocation of the debris to the sump. From there, the debris is assumed to flow through the suction piping of ESF pumps into the engineered safeguards rooms in the Auxiliary Building*.

CIE Containment Intact Early. This CET heading identifies potential challenges to containment from phenomena that might occur at or near the time of vessel failure.

These phenomena include hydrogen burning, steam explosion, vessel blowdown forces, and direct containment heating .

• 4-64

LVE Early Lar~e Volatile Fission Product Release. Sequences in which sprays are available or releases are through pools of water result in limited volatile releases .

• CAL Late Relocation of the Core to the Auxiliary Buildin~. This CET heading is similar to CAE except that relocation to the Auxiliary Building is substantially delayed due to significant debris being retained in the reactor cavity and only a limited amount flowing through drains to the sump until long term erosion of the cavity floor occurs.

CIL Containment Intact Late. This heading defines potential challenges to containment that might occur substantially later than core damage or vessel penetration. Such challenges would include long term over-pressurization by steam, noncondensible gas generation and combustion of hydrogen evolved from core concrete interaction.

CCI Core Concrete Interaction resulting in a large fission product release. This type of release requires oxidation of zirconium to be in progress at the time of containment failure.

L VL Late Lari:e Volatile Release. This type of release requires revaporization of fission products at the time of containment failure or long term dryout of pools performing debris cooling.

The Palisades containment event tree was quantified as a part of the internal events PRA for each Plant Damage State. As containment systems are not a part of the CET, but are quantified in the

• Plant Damage State analysis, the CET quantification is based strictly on phenomenological challenges important for each plant damage state and is independent of what initiates the accident sequence. The CET quantification performed in the internal events PRA is therefore applicable to the Fire PRA.

• As discussed in Section 4.12.2.1, any of several Plant Damage States are possible depending on the equipment located in each fire area. The distribution of each plant damage state through the CET from the internal events PRA is shown in Table 4.12-3. For any of these plant damage states, early challenges to containment are no different than expected in the internal events PRA.

They do not dominate risk because of the large volume of containment and its strength (ultimate capacity in excess of 140 psig).

Four Plant Damage States, TFJP, TEJQ, TEJR and TEJW, dominate the containment response.

The Plant Damage States in the Fire PRA with the highest frequency are those in which secondary cooling is failed, once through cooling is unavailable in either the injection or recirculation mode but containment spray is available throughout the event. To terminate core melt progression in-vessel, the reactor cavity must be flooded above the lower head. This requires operation of containment spray and the reactor cavity flooding system. Once the SIR.WT is depleted, containment spray must continue in the recirculation mode to maintain reactor cavity inventory from falls due to boiling heat removal or draining to the sump.

,* Two plant damage states have the characteristics defined above, TFJP and TEJQ. The difference 4-65

between them is that containment coolers are not assumed to be available for the latter plant damage state. Together, these two plant damage states make up more than half of the total core damage frequency. For both Plant Damage States, one CET sequence dominates the results

1. 13 Successful recovery in-vessel Long term containment integrity successful with lesser contribution from two other sequences

1. 19 No recovery in-vessel Significant upward debris dispersal Long term containment integrity successful

1. 32 No recovery in-vessel No significant upward debris dispersal Early core relocation to the Auxiliary Building No early large volatile release or long term core concrete interaction.

For these Plant Damage States, containment spray in the recirculation mode is available supporting long term reactor cavity flooding. Review of systems required to support long term spray operation reveal no significant susceptibility to failures due to fire. Recovery in vessel is successful for an estimated 54% of TEJP and TEJQ sequences.

• In the remaining two sequences, 19 and 32, the core debris is assumed to penetrate the lower vessel head and enter containment. These sequences determine the distribution between long term containment integrity and the p0tential for relocation of the core debris to the Auxiliary Building.

The differences between these two sequences is that in the first one, significant carry over of debris to the upper part of containment occurs such that the remaining debris remains cooled in the reactor cavity or sump as opposed to the flowing to the Auxiliary Building. The roughly even split between these two sequences reflects the uncertainty whether the reactor is at pressure or has blown down as a result of creep rupture failure in the primary coolant loops as well as in how much debris will actually be entrained and removed from the cavity if blowdown from high pressure occurs .

. CET sequence #19 ultimately results in a long term intact containment with heat being removed by the RHR heat exchanger or containment air coolers. For plant damage states TEJP and TEJQ, this sequence makes up roughly 16% of the core damage frequency.

CET sequence #32 leads to release of the core to the Auxiliary Building. However, there are only low volatile releases expected as a result of reactor coolant, accumulator and SIR.WT inventory submerging the debris providing a means of debris cooling and fission product scrubbing.

Sequence #32 makes up approximately 20% .of the TEJP and TEJQ core darilage frequency.

• There is little potential for an early large volatile release for these sequences due to the availability of containment spray early in the event as well as the large volume of water from the SIR.WT to scrub any releases.

4-66

• In Plant Damage State TEJR, random failure of AFW system components has lead to the need for once through cooling which has been successfully initiated. Adequate core cooling occurs for as much as 4 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in this mode until SIRWT inventory is depleted. At this point in time, recirculation actuation is required but is not successful.. The dominant contributor to this Plant.

Damage State is fire in the Turbine Building. Random failures of the sump valves or High Pressure Air lead to the inability to initiate long term recirculation. This Plant D~age State is estimated to make up less than 15 % of the total core damage frequency.

Assuming recirculation cannot be initiated for either the HPSI or containment spray pumps, two CET accident sequences represent the dominant containment response:

1. 19 No recovery in-vessel Significant upward debris dispersal Long term containment integrity successful

1. 32 No recovery in-vessel No significant upward debris dispersal Early core relocation to the Auxiliary Building No early large. volatile release or long term core concrete interaction For this plant damage state, loss of recirculation is assumed to contribute to core damage. As a

• result, it is assumed that it is also not available for long term operation of containment spray. For this reason, recovery in-vessel is assumed not to be successful for plant damage state TEJR.

The two sequences which contribute most to containment response for TEJR sequences have the same characteristics defined in the preceding discussion of plant damage state TEJP.

CET Sequence #19 ultimately results in a long term intact containment with heat being removed by containment air coolers. For TEJR sequences, when recovery in..:vessel did not occur, this sequence makes up roughly 40 % of the core damage frequency for TEJR.

CET Sequence #32 leads to release of the core to the Auxiliary Building. However, there are only low *volatile releases expected as a result of the SIRWT inventory submerging the debris providing a means of debris cooling and fission product scrubbing. Sequence 32 makes up approximately 45 % of the core damage frequency for plant damage state TEJR. Because the containment remains intact for a significant portion of this plant damage state and due to the scrubbing provided by water inventory in containment should the core relocate to the Auxiliary Building, only a small fraction of TEJR sequences lead to early large releases.

Plant Damage State TEJW is dominated by control room and cable spreading room fires which are not suppressed sufficiently early such that plant shutdown is required from the hot shutdown panel. Controls for the turbine driven AFW pump are available at this panel. Random failures

• 4-67

in this train of AFW are assumed to lead to steam generator dryout without the ability to initiate

• once through cooling. (In fact, local operation of the remaining two AFW pumps is possible but not credited in the Fire PRA). This plant damage state is estimated to make up less than 25 % of the total core damage frequency. Without injection of the SIRWT to containment, recovery of the event in the reactor vessel is assumed not to be possible. Two accident sequences dominate the CET results for plant damage state TEJW:

1. 22 No recovery in-vessel Significant upward debris dispersal Long term containment failure due to lack of debris cooling in the upper compartment.

1. 31 No recovery in-vessel No significant upward debris dispersal Early core relocation to the Auxiliary Building Late volatile releases In accident sequence 22, core debris is transported to upper parts of containment during blowdown of the vessel. Lack of containment sprays or air coolers is assumed to result in a low pressurization of containment. Containment integrity is maintained for a significant period under these conditions. Containment failure is not postulated for more than 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> into this accident scenario .

• In accident sequence 31, the core remains in the reactor cavity following penetration of the lower vessel head. Slow erosion of the cavity floor eventually results in relocation of the debris to the sump and ultimately the Auxiliary Building. Reactor and accumulator inventory are available to provide debris cooling given that the SIR.WT inventory was not available. Dryout of the pool in the Auxiliary Building begins approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> into the event. This dryout is assumed to lead to volatile releases but only late in the accident scenario. As is the case for the preceeding plant d~age states, there is only limited potential for a large early volatile release.

4.12.3 Comparison of Containment Response to the Internal Events PRA The dominant containment failure mode for core damage sequences quantified in the Fire PRA is relocation of core debris to the Auxiliary Building. The fraction of the core damage frequency of this failure mode is on the order of 35 %, similar to the internal events PRA. The total frequency of this containment failure mode due to fire initiators is on the order of 5E-5, which is within a factor of three of the internal events PRA. As noted in the discussion of the fire areas which lead to Plant Damage States that result in this failure mode, there is significant conservatism in assumptions made regarding equipment available to cope with a fire in these areas. Removal of these conservative assumptions would lower the total frequency of core damage and this failure mode to perhaps less than that of the internal events PRA. The timing of this failure mode is expected no sooner than 4 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the initiating event .

• • 4-68

Because of the availability of reactor coolant, accumulator, and SIRWT inventory .for* scrubbing

• releases, there is little potential for early large volatile releases from fire events .

• 4-69

Table 4.12-1 Level I to Level II Dependencies CONTROL ROOM (FZ-1)*

Plant Accident HPSI LPSI css Damage Class AFW HPSI LPSI css Recirc Recirc Recirc CTMCoolers State Class IA - ./* (All) ./(All) ./(All) ./* ./ ./ ./ (lA, 2A, 3A) TEJP Class IB - ./(All) ./(All) ./(All) - ./ ./ ./ (lA, 2A, 3A) TEJP

• Table address only fires that were successfully suppressed. Frres m which Control Room evacuat10n 1s assumed were assigned to Plant Damage State TEJW.

Failed as part of Level I Core Damage Sequences.

./ Available Post Core Damage .

./* Available only if failure due to PORVs or Operator Action CABLE SPREADING ROOM (FZ-2)*

Plant

!Accident HPSI LPSI css Damage

!Class AFW HPSI LPSI css Recirc Recirc Recirc CTMCoolers State

• !Class IA Class IB

./*(All)

./(All)

• ./(All)

./(All)

./(All)

./(All)

./*

./

./

./

./

./ (lA, 2A, 3A)

./ (lA, 2A, 3A)

Table address only fires that were successfully suppressed. Frres m which suppression 1s assumed to be unsuccessful were assigned to Plant Damage State TEJW.

Failed as part of Level I Core Damage Sequences .

TEJP TEJP

./ Available Post Core Damage .

./* . Available only if failure due to PORVs or Operator Action SWITCHGEAR ROOM ID (FZ-3)*

Plant k\ccident HPSI LPSI css CTM Damage IC lass AFW HPSI LPSI css Recirc Recirc Recirc Coolers State

• ic1ass IA - ./*(Loop B) ./(Loop B) ./ (Loop B/C) ./* ./ ./ ./ 2 TEJQ Class IB - ./(Loop B) ./(Loop B) ./ (Loop B/C) -1 l l ./ 2 2/3 TEJQ l/3 TEN

• Table address only fires that were successfully suppressed w1thm !IDtiatmg cabinet.

Failed as part of Level I Core Damage Sequences.

./ Available Post Core Damage .

./* Available only if failure due to PORV (PRV-l043A/B failed by fire) or Operator Action.

2/3 Piggyback alignment failure, l/3 service water failure.

l 2 VHX-4 is isolated General Note: SW pumps 7A and 7C are failed by frres in this area.

4-70

Table 4.12-1 Level I to Level II Dependencies Continued SWITCHGEAR ROOM lC (FZ-4)*

Plant Accident HPSI LPSI css CTM Damage

!Class AFW HPSI LPSI css Recirc Recirc Recirc Coolers State

!Class IA - .t* (Loop A) ./(Loop A) ./(Loop A) .t* ./ ./ -1 TEJQ Class IB - ./(Loop A) ./(Loop A) ./ (LoopA) -2 ./ ./ -1 TEJQ

• Table address only fires that were successfully suppressed within imt1ating cabinet.

Failed as part of Level I Core Damage ~equences.

./ Available Post Core Damage .

.t* Available only if failure due to PORVS or Operator Action .

l Cables for all coolers located in this space~ Exact location of cables are unknown and are assumed to fail even with successful suppression.

2 Majority piggyback alignment failure. .

DIESEL GENERATOR 1-1 ROOM (FZ-5)

Plant Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Recirc Recirc Recirc Coolers State Class IA - .t* (All) ./(All) ./(All) .1* 1 ./1 ./ ./(All) TEJP

• - ./1 Class IB ./(All) ./(All) ./(All) -2 ./ ./(All) TEJP Failed as part of Level I Core Damage Sequences.

./ Available Post Core Damage.

.t* Available only if failure due to PORVs or Operator Action .

l Only one train ofHPSI/PORVs available. (Damage to LC"'.19 which feeds MCC-1/ MCC-25).

2 Majority piggyback alignment failure.

General Note: DC power is lost to alternate shutdown panels C-150/ 150A.

DIESEL GENERATOR 1-2 ROOM (FZ-6)

Plant

• Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Recirc Recirc Recirc Coolers State Class IA - .t* (All) ./(All) ./(All) .1* 1 ./I ./ ./(All) TEJP Class IB - ./(All) ./(All) .t* (All) -2 ./I ./ ./(All) TEJP Failed as part of Level I Core Damage Sequences .

./ Available Post Core Damage .

.t* Available only if failure due to PORVs or Operator Action.

I Only one train ofHPSI/PORVs available. (Damage to LC-20 which feeds MCC-2/ MCC-26).

2 Majority piggyback alignment failure .

• 4-71

- )

Table 4.12-1 Level I to Level II Dependencies Continued

• Accident INTAKE STRUCTURE - SW AREA (FZ-9)

HPSI LPSI css CTM Plant Damage Class AFW HPSI LPSI css Recirc Recirc Rec ire Coolers State Class IA - ./*(All) ./(All) ./(All) -2 -2 -2 l TEN Class IB - ./(All) ./(All) ./(All) -2 -2 -2 l TEN Failed as part of Level I Core Damage Sequences .

./ Available Post Core Damage .

./* Available only if failure due to PORVs or Operator Action.

l Containment cooling fails due to direct dependency on SW (all SW pumps are located in this area).

2 Service water failure leads to CCW failure which in turn precludes recirculation success.

INTAKE STRUCTURE - FP AREA 1 (FZ-9)

Plant Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Rec ire Recirc Recirc Coolers State Class IA - ./*(All) ./(All) ./(All) ./* ,/ ,/ ./(All) TEJP Class IB - ./(All) ./(All) ./(All) - ./ ./ ./(All) TEJP Failed as part of Level I Core Damage Sequences .

./. Available Post Core Damage .

./* Available only if failure due to PORVs or Operator Action.

All fire pumps are located in this area. (Fire pumps provide backup supply to AFW and SW).

AUXILIARY BUILDING CORRIDOR 590 (FZ-13)

Plant Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Recirc Recirc Rec ire Coolers State Class IA - -2 2 ./(All) -2 2 ./ l TEJQ Class IB - -2 2 ./(All) -2 2 ./ l TEJQ Failed as part of Level I Core Damage Sequences .

./ Available Post Core Damage.

I Cables for cooling water control valves for all containment coolers are located in this area.

2 Cables for all LPSI/ HPSI injection valves located in this area.

• 4-72

Table 4.12-1 Level I to Level II Dependencies Continued

• Accident Class AFW HPSI ENGINEERED SAFEGUARDS PANEL ROOM (FZ-15)

LPSI css HPSI Recirc LPSI Recirc css Recirc CTM Coolers Plant Damage State Class IA - -2 2 ./(All) -2 2 ./ I TEJQ Failed as part of Level I Core Damage Sequences .

./ Available Post Core Damage.

Cables for cooling water control valves for all containment coolers are located in this area.

2 Cables for all LPSI/ HPSI injection valves located in this area.

COMPONENT COOLING PUMP ROOM (FZ-16)

Plant Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Recirc Rec ire Rec ire Coolers State Class IA - ./* (All) ./(All) ./(All) -1 . l l ./(All) TEJR Class IB - ./(All) ./(All) ./(All) -1 1 l ./(All) TEJR Failed as part of Level I Core Damage Sequences.

./ Available Post Core Damage .

./* Available only if failure due to PORVs or Operator Action .

l Recirculation fails because all CCW pumps are located in this area.

SPENT FUEL POOL EQUIPMENT ROOM (FZ-20)

Plant

!Accident HPSI LPSI css CTM Damage t'lass AFW HPSI LPSI css Recirc Recirc Recirc Coolers State t'lass IA - ./*(Loop B) ./(Loop B) ./(All) ./* ./ . ./ ./(All) TEJP Failed as part of Level I Core Damage Sequences .

./ Available Post Core Damage .

./* Available only iffailure due to PORVs or Operator Action.

l Cables for cooling water control valves for all containment coolers are located in this area .

• 4-73

Table 4.12-1 Level I to Level II Dependencies Continued

• ELECTRIC EQUIPMENT ROOM (FZ-21) .

Plant Accident HPSI LPSI css CTM Damage Class AFW HPSI LPSI css Recirc Recirc Recirc Coolers' State Class IA - -1 -1 .t -2 -2 -2 .t TEN Failed as part of Level I Core Damage Sequences.

.t Available Post Core Damage .

I Cables for HPSI and LPSI injection valves are located in this area.

2 Long term failure due to Engineered Safeguards Room HVAC loss.

TURBINE BUILDING (FZ-23)

Plant Accident HPSI LPSI css CTMCoolers Damage Class AFW HPSI LPSI css Recirc Recirc Recirc State tlass IA - .t* .t (Loop 2) .t (All) .t* ./ ./ ./(IA, 2A, 3A) TEJP

• tlass 18 Class II

.(

.t (Loop 2) ./(Loop 2)

.t (Loop 2) .t (Loop 2)

./(All)

./(All)

Failed as part of Level I Core Damage Sequences .

Available Post Core Damage

-1

./

./

./ (lA, 2A, 3A)

./(IA, 2A, 3A)

.6 TEJP

.4 TEJR TEJX

.t* Available only if failure due to PORVs or Operator Action I 40% Sump Valve or HPA random failure, 60% Pump Train or Piggyback alignment failure .

• 4-74

Table 4.12-2 Palisades Plant Damage State Designators

• A1 Ai Initiators Large LOCA (d > 18 in)

Medium LOCA (2 in < d < 18 in)

B Small LOCA ( 112 in < d < 2 in) c Interfacing System LOCA D Steam Generator Tube Rupture T Transients Secondary Cooling G Secondary Cooling Available J No Secondary Cooling Available

• E L

Core Damage Timing Early Damage Late Damage Containment Safeguards p Containment Sprays and Air Coolers Available Q Containment Sprays Available and Containment Air Coolers Unavailable R Only Containment Air Coolers Available with SIRWT in Containment s Only Containment Air Coolers Available without SIRWT in Containment v No Containment Safeguards with SIRWT in Containment w No Containment Safeguards without SIRWT in Containment x Only HPSl/LPSI Available after Vessel Failure

• 4-75

Table 4.12-3 Frequency of Core Damage by Fire Area ,(per yr)

• CR FZ-1

• TEJP TEJW 2.4E-05 TE.JV TE.JR TEJQ TE.JS TEJX*

2.4E-05 cs FZ-2 5.2E-06 l.2E-05 . l.7E-05 lD FZ-3 lE-06 2.6E-06 6.7E-06 l.OE-05 lC FZ-4 3.3E-06 3.3E-06 DGl-1 FZ-5 7.5E-06 7.5E-06 DGl-2 FZ-6 6.7E-06 6.7E-06 SH (SW) FZ-9 4.3E-06 4.3E-06 SH (FP) FZ-9 1. lE-06 1.lE-06 AB Corr FZ-13 7.6E-06 17.6E-06 ESF Panel FZ-15 2.3E-06 2.3E-06 ccw FZ-16 2.6E-06 2.6E-06 SFP FZ-20 8.6E-06 8.6E-06 Elec Equip FZ-21 . 3.2E-06 3.2E-06 TB FZ-23 3.4E-05 2E-05 2.SE-06 5.6E-05 TOTAL 6.27E-05 3.70E-05 1.0lE-05 2.26E-05 1.99E-05 2.SOE-06 1.55E-04 CAE Fraction 0.20 0.53 0.53 0.46 0.20 0.53 0.53 Frequency 1.25E-05 l.96E-05 5.31E-06 1.03E-05 3.94E-06 O.OOE+OO l.48E-06 5.31E-05 LVE Fraction 0.06 0.05 0.05 05 0.05 Frequency 2.0E-06 5.5E-07 l. lE-06 0 l.5E-07 3.83E-06

• Assume similar to TEJV CAE - Core to Auxiliary Building Early L VE - Large Volatile Release Early 4-76

4.1.13 Treatment of Fire Risk Scoping Study Issues NRC Generic Letter 88/20, Supplement 4 lists the following Fire Risk Scoping Study (FRSS) issues to be addressed in IPEEE fire analyses:

(1) Seismic/fire interactions, (2) Fire barrier assessment, (3) Effectiveness of manual fire fighting, (4) Effects of fire suppressants on safety equipment. (Total environment equipment survival), and (5) Control systems interac~ions.

The specific concerns regarding each of these issues are discussed in the FIVE methodology.

This methodology was used as guidance for evaluating each of the issues. Where appropriate, relevant Fire Risk Scoping Study issues have been incorporated into other phases of this study, such as the area screening and* the detailed fire scenario evaluation.

Review of the Fire Risk Scoping Study issues resulted in the conclusion that these issues are not a significant contributors to fire induced core damage at the Palisades Nuclear Power Plant.

The evaluation of each Fire Risk Scoping Study issue is discussed below:*

4.1.13 .1 Seismic/Fire Interactions This issue involves three concerns: seismically induced fires, seismic actuation of fire protection systems and seismic degradation of fire suppression systems.

Seismically induced Fires In general, earthquakes are not known to cause fires in industrial facilities (Ref. 4-12).

However, the potential failure of vessels containing flammable liquids or gases could cause a fire hazard in the plant following an earthquake. As a part of the seismic walkdowns, a survey of tanks and vessels that may contain flammable fluids was performed.

Only the turbine building was identified as having potentially significant consequences due to fires resulting from a seismic event. The hydrogen piping that is routed through the turbine building is not seismically designed. It passes through non-seismically designed block walls and cable trays which pose a rupture hazard to the piping at relatively low seismicity levels.

The turbine building also contains flammable liquid storage cabinets in numerous locations that are unanchored and at risk of spilling their inventory if they were to fall over. Because of the multiple ignition sources in the turbine *building, the likelihood of ignition is high giveri 4-77

\

spillage of these materials. Hydrogen piping is also found in the auxiliary building, but, due to seismic restraints, is not expected to be susceptible to a seismic event Seismic Actuation of Fire Suppression Systems Information Notice 94-12 notes that (1) mercury relays are susceptible to seismic actuation and (2) smoke detectors coul<;l be actuated by dust rising during a seismic event, and (3) unprotected essential components could be damaged by spray from deluge systems. Mercury relays and fire suppression equipment actuated by smoke detectors are not used for any fire protection systems at the Palisades Nuclear Power Plant.

Of the plant areas containing safety related equipment considered in the Palisades IPEEE, only the (1) diesel generator rooms, (2) pump room in the intake structure, (3) cable spreading room, (4) switchgear rooms lC and lD and (5) charging pump rooms are protected by fire water systems. These areas are protected by fusible link wet-pipe systems. Loss of availability of essential equipment in these areas due to inadvertent fire water system actuation by a seismic event is considered unlikely .. No specific seismically related deficiencies were noted in the walkdown of these systems. In addition, safe shutdown related cabinets in the switchgear and cable spreading rooms are protected with spray shields.

Seismic De~radation of Fire Protection Systems

• Fire suppression systems in close proximity to safe shutdown components could disable these equipment if they were to impact or fail (causing spray or flooding) during a seismic event.

Such interactions of installed piping and equipment were investigated as a part of the seismic

.walkdowns. No instances of potential failure of essential equipment due to impact with fire protection systems were identified in the seismic walkdown.

4.1.13.2 Fire Barrier. Effectiveness Ffre barriers are used at Palisades to provide physical separation of redundant trains of safe shutdown equipment. Qualification of these barriers must be maintained to ensure an effective

. fire protection program. A series of detailed barrier inspection procedures are implemented to inspect all fire area boundaries for the express purpose of protecting safe shutdown equipment.

Fire barrier inspection procedures require that every boundary be inspected, including penetration seals and fire dampers. Fire doors are inspected and maintained per procedure on a semiannual basis. All fire barrier inspections are performed on an 18 month interval. Fire dampers are inspected and tested during each refueling outage.

In addition to inspection of the fire area boundaries required by Appendix R, certain other boundaries are also inspected per previous NRC commitments and/or good fire protection practices due to high combustible loading considerations. Other fire barrier concerns such as fire damper operability, as outlined in NRC Information Notices 83-69 and 89-52, have been 4-78

resolved with walkdowns/inspections and operating procedure modifications. This detailed inspection and maintenance program ensures that all fire boundaries are adequate and in good repair. Fire barrier effectiven~ss is ensured by implementation of these procedures.

4.1.13.3 Effectiveness of Manual Fire*Fighting The Sandia Fire Risk Scoping Evaluation identified six components of an effective manual fire fighting program. These components consist of 1) fire reporting, 2) fire brigade personnel and equipment, 3) fire brigade training, 4) fire brigade practice, 5) fire brigade drills and, 6) record keeping on fire brigade members. Palisades Fire Protection Implementing Procedures (FPIP) (Ref. 4-3), Palisades Administrative Procedures (Ref. 4-13) address all six of these issues.

fire reporting is accomplished with two way radios carried by the operators (and staged with the fire brigade equipment) or via the phone lines designated for emergency purposes. Use and staging of this equipment is detailed in plant procedures. Adequate staffing consists of fire brigades of at least five people each. No more than two of the members can be members of the minimum operations shift crew necessary for safe shutdown. Supporting equipment is prestaged at various locations throughout that plant and includes personal protective equipment, communications equipment, portable lights and ventilation, etc.

Course work associated with fire brigade training covers subjects ranging from basic principles of fire chemistry and physics to more advanced subjects including evaluation of fire hazards

• and fighting fires in confined areas. All fire brigade members also receive hands-on fire fighting training at least once per year to provide experience in actual fire extinguishment and the use of emergency* breathing apparatus. Fire brigade drills are performed in the plant so that each fire brigade shift can practice as a team. Backshift drills and unannounced drills are performed for each shift at least once per year.

Detailed training records and periodic quality assurance audits of the fire protection program assess the adequacy of the fire brigade training. Training records and audit reports are kept on file at the plant for at least three years.

Based on an examination of Palisades's established fire fighting training program, the .

attributes of an adequate fire protection program related to manual fire fighting identified in the Sandia Fire Risk Scoping Study Evaluation are satisfied. The plant's fire brigade and manual fire fighting capability is, therefore, considered to be effective. Section 4.8 describes how manual fire fighting is accounted for in this study.

4-79

4.1.13.4 Total Environment Equipment Survival This issue includes the following three concerns:

a) The potential for adverse effects on plant equipment caused by combustion products released from the fire causing damage, and possible loss of safe shutdown function.

b) The spurious or inadvertent actuation of fire suppression systems resulting in the loss of safe shutdown functions.

c) Operator effectiveness in performing manual safe shutdown actions and potentially misdirected suppression effects in smoke filled environments.

With the exception of the control, cable spreading, and 2.4kV switchgear rooms, all fire initiators included in the accident sequence quantification are assumed to spread and engulf the entire area in which they are assumed to occur. Smoke effects on equipment located in these spaces is not an issue because the equipment is ass~ed destroyed by the fire. Equipment in adjoining spaces is unlikely to be damaged because the barriers that prevent the fire spread will also limit smoke propagation. Smoke that does propagate to other spaces will be dissipated/diluted. In addition, the FIVE methodology does not currently evaluate non-thermal environmental effects of smoke on equipment because the detrimental effects of smoke on equipment are not believed to be significant.

• Use of automatic wet fire suppression systems at the Palisades station is limited to fewer than one-half of the fire areas. This type of system is located over significant risk related equipment in the diesel generator/day tank rooms, the cable spreading room, the Southwest cable penetration room, the intake structure and, the yard transformers. Effects of an inadvertent actuation are reduced by installation of spray shields protecting key electrical cabinets and pumps. Susceptibility of multiple trains of safe shutdown equipment to spurious actuation of suppression systems is not expected in any case.

• Manual actions to operate equipment outside of the control room or ASDP is given only limited credit in this study. Manual response to fires inside the control room are discussed in Section 4.8. Review of the Heating Ventilation and Air Conditioning (HVAC) systems determined that sufficient ventilation is available to prevent excessive smoke* propagation between systems, and structures. Emergency lighting is positioned throughout the plant and Self Contained Breathing Air (SCBA) equipment is also staged at appropriate locations in the plant. This equipment allows the operator/fire fighter to effectively combat any anticipated fires 4 .1.13. 5 Control Systems Interactions Control system interactions following a fire is principally a concern at facilities without a

• 4-80

remote shutdown capability. Installation of the Alternate Shutdown System panel (ASDP) resolved this issue at the Palisades station. This panel (C-150/C-150A) allows the operators tci remotely control one train (train B) of auxiliary feedwater from the southwest cable penetration room.

One of the primary features of this panel is that cables supporting the turbine driven auxiliary feedwater pump can be isolated from the control and cable spreading rooms. This feature allows remote operation of the equipment regardless of the condition of these rooms. The Palisades Off Normal Procedures provide the necessary guidance to control the plant from this panel. In addition to the written guidance, all tools and equipment required to implement the actions iare staged near the panel.

4~ 1.14 USI A-45 and Other Safety Issues Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal (DHR) Requirements",

addresses the adequacy of the heat removal function at operating plants. For the purposes of the IPE and IPEEE, decay heat removal is defmed as "decay heat removal from the core and primary coolant system at conditions beyond the capabilities of the shutdown cooling system."

The two basic methods of decay heat removal at Palisades consist of: 1) secondary cooling, which utilizes the steam generators as a heat sink for the primary coolant system; and 2) once through cooling .

• Heat removal via the steam generators is the primary and preferred method of removing decay

. heat. Effective heat removal using the steam generators requires circulation of primary coolant through the core with energy removal in the steam generators by use of steam release and makeup. Although the main condenser is the preferred heat sink, DHR using the steam generators is not dependent on the main condenser. Palisades has the capability to release steam directly to the atmosphere via dump valves and other manually aligned pathways.

The two mechanisms available for steam generator makeup are auxiliary feedwater and low pressure feed using the condensate pumps. The normal method is using AFW, which has two independent, redundant trains. The primary train has a motor driven pump and a steam driven pump, with nitrogen backup supplies to critical air operated control valves. The secondary train has a motor driven pump and control valves that are located separately from the primary train. The backup method of steam generator makeup, low pressure feed, is* not credited in.

the Fire IPEEE but would be available during many of the fire scenarios included in this analysis.

During accident scenarios in which secondary cooling cannot be established, decay heat is absorbed by the primary coolant causing PCS temperature and pressure to rise. In these accidents, operators are directed to initiate once-through-cooling. This is performed by starting the HPSI pumps and opening the PORV/PORV block valves. Primary coolant is then released into the containment building resulting is PCS pressure reduction and decay heat

• 4-81

removal. HPSI injection in this mode maintains adequate PCS inventory as well as core cooling.

Following initial construction of the Palisades facility, several significant mo~ifications were made to improve the reliability of the DHR systems. These improvements include: 1)

Addition of a second motor-driven AFW pump and associated piping, 2) Installation of larger PORVs and block valves to improve the OTC and vent capability, 3) Addition of nitrogen bottles to provide backup motive force to operate the primary AFW train flow control valves and turbine steam supply valve and, 4) Installation of an additional 2.4kV transformer to improve power reliability to the safeguards AC buses.

The DHR issue was examined as part of the IPE, the details of which are contained in Appendix B of the IPE submittal (Ref. 4-2). The results of this examination indicate that failure of the Palisades DHR capability does not contribute significantly to the*potential for core damage. Analysis of the impact of fire hazards on the containment DHR function is covered in Section 4.11.1 under the discussion of Accident Class 2. This analysis did not yield results unique or dissimilar from those contained in the IPE. Loss of containment heat removal sequences due to fire only contribute on the order of 5.3E-06/year. The redundant and diverse systems available for decay heat removal at the Palisades plant are considered adequate to resolve this generic issue.

4.1.15 Results and Conclusions

. 4.1.15.1 Summary of Results The total vulnerability due to fires at the Palisades Nuclear Power Plant is calculated to be less than 2E-04 core damage events per year. This information is summarized by fire area in Table 4.1.1 ~ .1. Eighty-five percent of the plant risk associated with internal fires can be

• traced to five rooms/bum areas; 1) turbine building, 2) main control room, 3) cable spreading room, 4) spent fuel pool equipment room, and 5) auxiliary building 590' corridor.

4.1.15.2 Conclusions and Recommendations The results of the Fire IPEEE accident sequence quantification were derived from a methodology that includes a number of conservative assumptions. Fires were assumed to increase until they completely engulfed the area where they were located. In addition, with the exception of the main control room, cable spreading room and the 2.4kV switchgear rooms (fire areas 3 and 4), the effects of suppression were not credited. Therefore, while the core damage frequency due to internal fires is higher than desired, the me.thodology as applied has resulted in potentially conservative results.

The core damage frequency in several fire areas is reduced due is in large part to Palisades plant specific implementation of the requirements of 10 CPR 50, Appendix R. These 4-82

requirements, including separation of alternate/redundant trains of safe shutdown equipment, fire barriers, and an alternate shutdown location (outside of control/cable spreading rooms) combine to limit the total risk due to fires. The administrative control of transient combustibles (Ref. 4-10) is also a contributing factor to the low fire risk in certain key areas.

Additionally, the Palisades Fire Protection organization is in the process of upgrading the existing Fire Protection Program. The upgrade includes enhan~ements to the cable/raceway schedule, completion of circuit analyses to verify operability of key equipment and

• incorporation of this information into a controlled database. The database will integrate the results of the circuit analyses with other information such as fire area/zone designations, cable designations, raceway locations, etc., into a product that can provide the status of the equipment evaluated in each fire area. This effort is expected to be completed by the end of 1995. The new information will be evaluated for input into the fire risk analysis. Once the fire PRA models have been updated with the revised Fire Protection Program information, the fire risk will be requantified.

Several potential insights/improvements were identified during the various steps of this study.

The following insights are candidates for further studies to see if they provide a reduction in overall plant risk. It should be noted that the list includes actions to address the conservatism that exists in the current analysis. Addressing this conservatism is appropriate prior to considering any plant modification at the Palisades plant.

• Review the circuit analyses completed as part of the Appendix R enhancements to verify assumed failures in each fire area Identify any areas where the current risk may be the result of conservative assumptions

• not yet addressed.

Evaluate alternative methods for providing makeup water sources to the Auxiliary Feedwater system in certain fire areas.

• Evaluate methods to accomplish the switchover to recirculation from the containment sump in certain fire areas.

• I;:valuate the possibility of continued operation on main feedwater in certain areas (particularly auxiliary building fires). *

• Evaluate the possibility of more detailed analyses of detailed examination of control room and cable spreading room fires.

Based on requantification results with updated Appendix R information and the results of .

sensitivity studies in important' areas (see above), any changes to plant operation or configuration determined necessary and cost-beneficial will be identified with any requisite implementation schedules by the end of the first quarter of 1996 .

• 4-83

4.1.16 References

• 4-1. Generic Letter No. 88-20, Supplement 4, "Individual Plant Examination Of External Events (IPEEE) for Severe Accident Vulnerabilities", United States Nuclear Regulatory Commission, June 1991.

4-2. Palisades Nuclear Plant Individual Plant Examination (IPE), Consumers Power Company, November 1992.

4-3. Palisades Fire Protection Implementing Procedures FPIP-1, Organization and Responsibilities, 1017/94

• FPIP-2, Fire Emergency Responsibility and Response, 12/6/94 FPIP-3, Plant Fire Brigade, 11/16/94 FPIP-4, Fire Protection Systems and Fire Protection Equipment, 10/13/94 FPIP-5, Requireme~ts for Inspection and Testing of Fire Protection Systems and Fire Protection Equipment, 12/5/94 FPIP-6, Fire Suppression Training, 10/19/94 FPIP-7 Fire Prevention Activities, 11117/94 44 Fire Induced Vulnerabilities Evaluation (FIVE) Plant Screening Guide, EPRI,.

September 1991.

• 4-5. NUREG/CR-4527 /1 of 2, An Experimental Investigation of Internally Ignited Fires In Nuclear Power Plant Control Cabinets:* Part 1: Cabinet Effect Tests, U.S. Nuclear Regulatory Commission, April 1987.

4-6. Palisades Nuclear Plant, Fire Protection Program Report (FPPR), Compilation of engineering evaluations dealing with fire related subjects at the Palisades Nuclear Plant.

4-7. Fire Hazards Analysis - Palisades Nuclear Power Plant, Consumers. Power Company, Rev. 2, February 1989.

4-8. . Fire Events Database for U.S. Nuclear Power Plants, NSAC-178L, June 1992.

4-9. Appendix ill, Table ill 5-3, "Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, 1975.

4-10. Palisades Nuclear Plant Fire Protection Implementing Procedure, "Fire Prevention Activities", Revision 8, November 17, 1994.

4-11. NUREG/CR-5088, "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," USNRC, January 1989 .

• 4-84

4-12. EPRI NP-6041, Revision 1 "A methodology for Assessment of Nuclear Power Plant Seismic Margin", EPRI, July 1991.

4-13. Palisades Administrative Procedures 10.21, Fire Protection Plan, 6/4/93 10.46, Plant Records, 3/15/95

• 4-85

TABLE OF CONTENTS SECTION 5.0 OTHER EXTERNAL EVENTS 5.1 Summary 5-2 5.2 Assessment of Other External Events for Palisades 5-8 5.3 Conclusions 5-29 5.4 References 5-30

Table of Contents Section 5.1 Summary 5 .1.1 Background 5-2 5.1.2 Plant Familiarization 5-2 5.1.3 Overall Methodology 5-2 5.1.4 Summary of Major Findings 5-3 5.1.5 Figures for Summary Section 5-5

• 5-1

• 5.1 Summary 5.1.1 Background The assessment that is described in this section addresses the external events other than seismic and internal fires. These "other" external events include phenomena such as high winds, floods, transportation-related accidents and accidents at nearby facilities that could potentially pose a threat to the Palisades Plant. This assessment was performed using a screening approach similar to that suggested in Generic Letter 88-20, Supplement 4 (Ref. 5-1), and the accompanying guidance for implementation, NUREG-1407," Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for -*

• Severe Accident Vulnerabilities" (Ref. 5-2).

5.1.2 Plant Familiarization The Palisades nuclear generating plant is a pressurized water reactor with a large dry containment designed by Combustion Engineering and Bechtel Corporation. Bechtel Corporation constructed the plant. The reactor core produces 2530 Mwt. The turbine-generator has a maximum electrical output of 845 Mwe. The plant is located on Lake Michigan, west of Covert Michigan. The construction permit was issued on March 14, 1967, and commercial operation began on December 31, 1971 .

• Palisades was designed before final issuance of the general design criteria for nuclear plants (10CFR50, Appendix A) and the 1975 Standard Review Plan (SRP) (NUREG-75/087).

Subsequently Palisades participated in the Systematic Evaluation Program (SEP). The SEP was conducted to assess differences between original and current plant design requirements, and to reconfirm and document plant safety. The SEP resulted in*an Integrated Plant Safety Assessment (Ref. 5-3). For each of the events assessed below, a SEP analysis has been conducted, referenced to the applicable SRP requirements. The following review also considered any significant differences between the SEP documented plant design and operation, and current conditions with respect to the more recent SRP criteria.

5.1.3 Overall Methodology Generic Letter 88-20, Supplement 4, and the accompanying guidance for documentation, NUREG-1407, include a recommended screening approach that can be used to evaluate the impact of high winds, external floods, and transportation and nearby facility accidents. Figure 5 .1-1 is a flow chart of this recommended screening approach. The steps shown in this figure represent a series of analyses in increasing level of detail, effort, and resolution. This approach was modified slightly, as shown in Figure 5.1-2, for the Palisades evaluation of other external events .

• 5-2

• After identifying the external events that should be considered for the Palisades Plant, pertinent SEP documents were reviewed to determine whe.ther that assessment had satisfied the SRP criteria. Because Palisades received its provisional operating license prior to 1975, it was necessary to review the Palisades Final Safety Analysis Report (FSAR), and other analyses to make this assessment. If the standard review plan (SRP) requirements are satisfied and a confirmatory walkdown does not identify unique vulnerabi~ities not included in the original design for the external event under evaluation, then per the guidance of the NRC Generic Letter 88-20, Supplement 4, it is assumed that the contribution from that hazard to the core damage frequency is less than lE-6/yr, and that hazard may be screened from further consideration. If the SRP is not satisfied, additional analysis may be necessary, up to and including the development of probabilistic risk assessment models to evaluate the specific concerns.

5.1.4 Summary of Major Findings Based upon the evaluations presented in this section, there are no "other" external events (fire and seismic were examined in preceding sections) that are a safety concern to the Palisades Plant. No vulnerabilities were identified, and the screening criteria modified from NUREG-1407 and Generic Letter 88-20, Supplement 4, are satisfied for all events. Because no new vulnerabilities were found in this assessment, no changes to plant hardware or procedures are recommended, beyond those presently docketed .

• Applicable results of the Palisades SEP program were reviewed to determine whether they remained accurate. Walkdowns were performed to confirm the results of the evaluations. The observations from those walkdowns were reviewed and factored into the appropriate portions of the evaluation, prompting further analysis in some cases. Ultimately, the walkdowns confirmed the conclusions discussed in the next section and identified no unique vulnerabilities.

Most of the external events considered could be readily screened from further consideration because they either do not apply to the Palisades site (volcanos, avalanches, and landslides, for example), or have limited impact based on the history of the site (lightning for example). 'fh:e remaining events - tornados and tornado missiles, external flooding, and hazards due to local transportation and nearby facilities - were evaluated in greater detail. The threat due to tornados was shown through the SEP to conform adequately to the SRP review criteria.

Walkdowns of the plant site, and evaluation of modifications since the SEP, confirm that Palisades remains adequately designed to withstand design basis tornados, and their missiles.

Flooding due to external sources is adequately addressed by site design and the nature of the local drainage. The bounding external flooding event remains a surge/seiche from Lake Michigan, which is analyzed to not render inoperable any safety related equipment necessary for plant. safe shutdown. The adequacy of the plant's design with respect to the probable maximum precipitation was established using a conservative approach, detailed analysis, and 5-3

• • walkdowns to show that roof drainage is adequate to prevent accumulation of rain water above levels that would lead to roof failures. The evaluation conducted for this review confirms the results of the SEP review remain valid for such events.

Transportation accidents do not pose a serious threat to the safety of the plant staff or structures. Even though Palisades is located on Lake Michigan, lake traffic patterns are far enough offshore so as to rule out damage to the plant due to shipping accidents. The explosion hazard due to pipelines, railroad cars, or trucks is bounded by the overpressure design of the ,

plant's critical structures. The threat from an explosion of on-site materials, or processes at industrial facilities was found to be small. The assessment considered aircraft accidents and determined that the site is remotely located from any military installations and not exposed to military-related training flights; and is well below the screening criteria in terms of the potential threat posed by small aircraft traffic in the vicinity of the site. While the plant is at the edge of a federal airway, the low frequency of airway use results in acceptably low site accident probabilities.

The last event to be considered in the assessment was the spill of hazardous material from sources on site, or transportation near site. These events remain sufficiently unlikely, or are shown to lack severe accident consequences .

• 5-4

5.1.5 Figures for Summary Section FIGURE 5.1-1 FLOW CHART OF SCREENING PROCESS FOR EXTERNAL EVENTS OTHER THAN SEISMIC AND FIRE NUREG-1407 (1) Review Plant Specific Hazard Data and Licensing Basis (FSAR)

{2) Identify Significant Changes, If any since OL Issuance (3) Does Plant/ Facllltles Design Meet 1975 SRP Criteria?

NO - ~YES--t (Quick Screening & Wal~down)

• OR ___, (4) Is the Hazard Frequency Acceptably Low? ~YES--t OR

-- (5) Bounding Analysls (Response I Consequence) ~YES--t OR ---.... (6) PRA (7) Documentation (Includes ldentlfted Reportable Items anc Proposed Improvements) -

• 5-5

FIGURE 5.1-2 FLOW CHART OF SCREENING PROCESS FOR EXTERNAL EVENTS OTHER THAN SEISMIC AND FIRE, AS USED AT PALISADES (1) Review Plant Specific Hazard Data and Licensing Basis (FSAR)

(2) Identify Significant Changes, If any since Palisades SEP was completed (3) Do the changes to the Plant I Facllltles Design since NO - Pallsades SEP was completed Meet 1975 SRP Criteria? .----ves--t (Quick Screening & Walkdown)

OR (4) Is the Hazard Frequency Acceptably Low?

• t----YES --J

• r OR (5) Bounding Analysls (Response I Consequence) ,____YES --J 1'

OR

_____. (6) PRA (7) Documentation (Includes Identified Reportable Items anci~

Proposed Improvements) ~

• 5-6

Table of Contents Section 5.2 Assessment of Other External Events for Palisades 5.2.1 External Events Considered for Palisades 5-8 5.2.1.1 Severe Temperature Transients 5-8 5.2.1.2 Severe Weather Storms 5-8 5.2.1.3 Lightning .Strikes 5-9 5.2.1.4 External Fires 5-9 5.2.1.5 Extraterrestrial Activity 5-9 5.2.1.6 \Tolcanic Activity 5-10 5.2.1.7 Earth Movement 5-10 5.2.2 High Winds and Tornados 5-10 5.2.2.1 High Winds and Tornado Loading 5-11 5.2.2.2 Tornado Missiles 5-12 5.2.2.3 Other High Wind and Tornado Related Issues 5-13 5.2.2.3.1 Diesel Generator Fuel Oil Supply 5-13 5.2.2.3.2 Hydrogen Tanks 5-14

• 5.2.2.3.3 Diesel Generator Room H\TAC 5.2.2.3.4 1984 Auxiliary Building Addition 5.2.3 External Flooding and Probable Maximum Precipitation 5-14 5-15 5-16 5.2.3.1 External Flooding 5-16 5.2.3.2 Probable Maximum Precipitation 5-17 5.2.4 Transportation and Nearby Facility Accidents 5-18 5.2.4.1 Transportation Accidents 5-19

. 5.2.4.1.1 Roads/Highways 5-19 5.2.4.1.2 Railroads 5-19 5.2.4.1.3 Great Lakes Shipping 5-19 5.2.4.1.4 Pipelines 5-19 3.2.4.1.5 Aviation 5-20 5.2.4.2 Nearby Industrial Facilities 5-22 5.2.4.3 On-site Storage Hazardous Material Releases 5-23 5.2.4.4 Other On-site Hazards 5-24 5.2.5 Table and Figures for Assessment of Other External Events 5-26 5-7

5.2 Assessment of Other External Events for Palisades 5.2.1 External Events Considered for Palisades NUREG-1407 (Ref. 5-2) contains a list of other external events which need to be considered by nuclear power plants. This list is an extract of a larger .listing considered in NUREG/CR-5042, Supplement 2 "Evaluation of External Hazards to Nuclear Power Plants in the United States" (Ref. 5-4). The NRC, in their review of this and similar lists, concluded that many of the events may be deleted from consideration due to the low frequency of occurrence and the subsequently low conditional probability of core damage. Other events may be removed because they or their effects are considered within the IPE (Ref. 5-5). However, each plant is to review this list and ensure that there is no unique plant-specific design or operating characteristic which may require that the events be evaluated. A review of the list of events as they apply to Palisades confirms that the following events can be removed from further consideration.

5.2.1.1 Severe Temperature Transients (Extreme Heat, Extreme Cold)

Palisades is located in a region more likely to be affected by extreme cold,. than extreme heat.

These events, being normally slow acting, generally affect only the ultimate heat sink, or offsite power. Because of this timing, ample opportunity exists for plant staff to recognize the need for, and to initiate plant shutdown and other mitigative actions. Generally, Palisades

• . systems and components important to safe plant shutdown are located within heated buildings .

Exceptions include the safety injection and refueling water tank (SIRWT), the condensate storage tank (CST), and off-site electrical power supply equipment. Both of the tanks are heated, temperature monitored and alarmed. Plant administrative controls prescribe response actions, including plant shutdown, in the event of failure to maintain tank temperatures, or ultimate heat sink. Additionally, alternate sources of water have been procedurally developed should these tanks become inoperable when called upon for safe shutdown. Given the slow acting nature of these events, such controls are con8idered adequate to mitigate their impact upon safe shutdown. The potential impact on the plant due to loss of off-site power, is considered by the Palisades IPE (Ref. 5-5).

Based upon the foregoing, no further analysis of severe temperature events is considered necessary.

5.2.1.2 Severe Weather Storms (lcestorms, Hailstorms, Snowstorms)

The primary concern due to severe weather storms (ice storm, hailstorm, snowstorm, dust storm, sandstorm) accompanied by strong winds, has been the complete or partial losses of off-site power. Additionally, such events could result in the loss of ultimate heat sink cooling.

At Palisades, the potential effect of loss of offsite power and station blackout is addressed in

• 5-8

• the internal events IPE. Any impact upon the ultimate heat sink would likely be slow acting and could be mitigated by established administrative controls (Ref. 5-6).

Based upon the foregoing, no further analysis of severe weather storm events is considered necessary.

5.2.1.3 Lightning Strikes As stated in NUREG-1407, the major impact of lightning strikes at nuclear plants is the loss of off-site power. The Palisades internal events IPE considers the frequency, and evaluates the consequences of this events. Based upon the inclusion of this event in the internal event IPE loss of off-site.power initiat0r, and the lack of other site specific lightning related damage over the plant operating life, further analysis of these events is considered unnecessary.

5.2.1.4 External Fires These are fires which occur outside of a plant site boundary, such as forest fires and grass fires. Potential impacts include loss of off-site power, forced isolation of the plant's ventilation system, and possible control room evacuation due to smoke. The Palisades Plant protected area is clear of forest and brush, making it very unlikely that a fire would spread to the site. As such, the (safe shutdown) affects of such a local, off-site fire may be limited to control room ventilation isolation, and the loss of off-site power.

• The loss of off-site power initiating event frequency employed in the internal events IPE is based upon actual plant experience, and includes both losses due to in-plant equipment and .

external events. It is judged that this frequency is sufficiently high that it bounds other lower probability contributors, such as external fires.

The Palisades Control Room Ventilation system is designed to permit isolation and a 100 %

recirculation mode of operation. This function is designed to permit continued habitability during a variety of hazards, including, radiological releases, toxic chemical releases, and fires.

Plant System Operating Procedure provides instruction for manual initiation of a recirculation mode of operation, including isolation of outside makeup air sources. Therefore, it is concluded that no further consideration of the effects of off-site fires is necessary.

5.2.1.5 *Extraterrestrial Activity (Meteorite Strikes, Satellite Falls)

These events include objects such as meteorites and man-made satellites entering the earths atmosphere, and disabling important plant equipment upon impact. Although the likely damage from such an event would be great, the probability of such events has been considered to be adequately low enough as to justify screening out these events from further consideration (Ref. 5-4) .

• 5-9

5.2.1.6 '\'olcaJlic Activity The Palisades site is too far away from any active volcanoes to expect any effect at the plant.

Therefore Palisades does not need to consider any volcanic effects (Ref. 5-2).

5.2.1. 7 Earth Movement (AvalaJlche, Landslide)

Upon review of the Palisades FSAR (sections 2.3, "Geology", 2.4, "Seismicity", and 2.5, "Meteorology" (Ref. 5-7)), and the SEP Topics II-4, "Geology and Seismology" (Ref. 5-8) and II-4A-F, "Settlement of Foundations and Buried Equipment" (Ref. 5-9), the conclusions arrived at in the SEP are still valid, namely that there are no geological features that present an avalanche, landslide, or other earth movement-related hazard to the continued safe operation of the Palisades Plant. Therefore, these events will be excluded from further investigation in this analysis.

Having eliminated the preceding events, the 'other' remaining external events requiring further consideration at Palisades are limited to the following :

High Winds and Tomados External Flooding Transportation and nearby facilities

)

These events require further consideration due to modifications since the SEP, or updating of selected offsite hazard data.

5.2.2 High Winds aild Tornados The objective of this review is to assure that Palisades Design Class I structures are adequately designed to resist wind loading, tornado loading, tornado pressure drop, and tornado missiles.

Design Class I structures are defined as those whose failure could cause uncontrolled release of radioactivity or loss of systems essential for. safe shutdown of the Nuclear Steam Supply System and long term operation following a Loss of Coolant Accident. NUREG/CR-5042 (Ref. 5-10) provides a listing of review criteria including pertinent sections of the Standard Review Plan (SRP) ~d Regulatory Guides. Appropriate SRP Sections include:

- SRP No. 3.3.1, "Wind Loadings"

- SRP No. 3.3.2, "Tornado Loadings"

- SRP No. 3.5.1.4, "Missiles Generated by Natural Phenomena"

- SRP No. 3.5.1.5, "Site Proximity Missiles (Except Aircraft)"

- SRP No. 3.5.2, "Structures, Systems, and Components to be Protected From Externally Generated Missiles"

-SRP No. 3.5.3, "Barrier Design Procedures"

• 5-10

For tornados and missiles, additional criteria are provided in Regulatory Guide 1. 76, "Design Basis Tornado for Nuclear Power Plants" (Ref. 5-11), and Regulatory Guide 1.117, "Design Basis Classification" (Ref. 5-12).

Because the winds expected from a tornado are much higher than those classified as "high winds," it is assumed that plant structures that satisfy the design criteria for tornados will also satisfy those required for high winds.

These requirements were considered during the SEP process. Subsequent review by NRC resulted in final acceptable evaluations of these subjects (SEP Topic 111-2 , "V/ind and Tornado

• Loadings - Palisades" (Ref. 5-13), and SEP Topic III-4A, " Tornado Missiles - Palisades" /

(Ref. 5-14)). The following discussion provides a summary of the SEP results pertinent to these requirements. These results are considered to remain applicable, except as noted.

Additionally, discussion is provided to address new structures erected after the SEP analysis was completed, and the results of walkdowns conducted to assess potential hazards due to this issue.

5.2.2.1 High Winds and Tornado Loading The capability of the CPCo Design Class 1 structures to resist the effects of tornado and wind loads was evaluated in Topic 111-2 of the Nuclear Regulatory Commission'.s (NRC) Systematic Evaluation Program (SEP). SRP sections 3.3.1and3.3.2 and Regulatory Guides 1.76 and

• 1.117 were employed as review criteria. A tornado wind load was the governing wind load and was specified in Regulatory Guide 1.76 as 360 mph maximum wind speed and a pressure drop of 3 psi at a rate of 2 psi per second for the Palisades Plant. Except as noted in FSAR section 5.3.2 (Tornado) (Ref. 5-7), Palisades CPCo Design Class I structures are designed for tornado loads. The following structures and components were determined not to have been designed to resist tornado wind loads:

1. Condensate storage tank

2. Intake and exhaust vents for the electric diesel generators

3. Safety injection and refueling water (SIRW) tank

4. Steel framed enclosure over the spent fuel pool Revisions to Plant Emergency Operating Procedures were subsequently made to provide alternative sources of water for safe shutdown should the safety injection and refueling water tank (SIRWT), or the condensate storage tank (CST) fail due to tornado wind and pressure loading (Ref." 5-15). The availability of these alternate sources were judged as an adequate basis for not requiring a backfit to the safety injection refueling water tank and the condensate storage tank. Additionally, it was determined that the failure of these tanks would not cause the flooding of any safety related equipment (Ref. 5-3) .

• 5-11

Further review of the simultaneous loss of engine supply air/exhaust to both emergency diesel generators due to tornado loadings concluded that this event was unlikely . This conclusion was based upon the fact that these intake/exhaust lines are enclosed on three of four sides, and overhead by reinforced concrete walls and a concrete roof. These enclosures will withstand the wind loading from a 360 mph tornado, as well as missiles, including the 4' x 12' wood plank considered in the original design. Only the north side of these enclosures where the diesel exhaust lines terminate, is exposed to missiles. The unprotected north side is generally shadowed by other structures, including the Service building and the Feedwater Purity Building. Additionally, Each diesel's intake and exhaust pipe is in one cubicle, separate from the other, thus decreasing the probability of both diesels being disabled (Ref. 5-3).

While the Steel framed covering over the Spent Fuel Pool was shown to be unable to withstand a 360 mph tornado load, it is recognized that the failure of this structure does not pose any threat to the safe shutdown *of the plant (Ref. 5-3).

Based upon the above considerations, the NRC concluded that any damage that might occur to these 'unprotected' structures and components would not adversely affect the safe shutdown capability of the plant (Ref. 5-3).

The above evaluation was performed prior to construction of the auxiliary building addition in 1984. The capability of this structure to withstand high wind and tornado loadings, and

. tornado missiles will be discussed in section 5.2.2.3 .

• 5.2.2.2 Tornado Missiles The capability of the CPCo Design Class 1 structures to resist the effects of tornado missiles was evaluated in Topic 111-4.A of the Nuclear Regulatory Commission's (NRC) Systematic Evaluation Program (SEP). This review was performed in accordance with SRP section 3.3.2, .

"Tornado Loadings", 3.5.3, "Barrier Design Procedure", and 3.1.5.4, "Missiles Generate~ by Natural Phenomena" . Additionally, nine CPCo Design Class 1 systems identified as "safe shutdown systems" by the SEP program were evaluated.

The NRC review of the nine CPCo Design Class 1 systems determined that the following safety-related equipment was vulnerable to tornado missiles:

1. Condensate storage tank

2. Intake and exhaust vents for the electric diesel generators

3. Safety injection and refueling water tank (SIRWT)

4. Atmospheric relief stacks of steam relief valves

5. The compressed air system The Integrated Assessment portion of the SEP concluded that the arguments provided in the preceding sections were adequate for tornado missiles as well as tornado loading to justify a

• 5-12

• decision to not require backfit for the above list of vulnerabilities, excepting item #4, atmospheric relief stacks of steam relief valves.

Three safety/relief valves discharge lines are combined into one safety/relief stack. There are a total of eight groups of three safety/relief valves each discharging through its own exhaust stack. Also, there are four atmospheric dump valves each releasing through its own stack.

The combined flow area of the 12 stacks (8 safety/relief and 4 atmospheric dump) is 2800 square inches.

The likelihood of not being able to bring the reactor to a safe shutdown because of the inability to vent steam (during a loss of offsite power event) is judged to be low for the following reasons :

to achieve safe shutdown, one relief or one dump valve has sufficient capacity to remove all decay heat from the core;

-these 12 relief and dump valve stacks extend approximately 6 to 8 feet above the auxiliary building roof and are distributed over an area of approximately 300 square feet; and this section of the auxiliary building roof is below that of the surrounding structures,

• and is well protected from ail sides except from above.

• These arguments were considered adequate to justify not requiring backfit to remove vulnerabilities to tornado missile for these valve stacks (Ref. 5-3).

In summation, the NRC concluded that the Palisades Plant, as configured at the time of the SEP, met the current criteria for protection from tornado missiles ..

5.2.2.3 Other High Wind, Tornado, and Tornado Missile Related Issu~

As part of this assessment, several issues not previously considered by SEP were evaluated.

These issues were included in this assessment based upon the results of walkdowns, recent plant modifications, and reclassification (safety related) of systems. The following paragraphs

_discuss these additional (wind, tornado, and tornado missile related) assessments.

5.2.2.3.1 Emergency Diesel Generator Fuel Oil Supply In 1994, it was determined that the Emergency diesel generator fuel supply system does not meet General Design.Criterion 2, "Design Basis for Protection Against Natural Phenomenon".

Continued plant operation has been justified by using some temporarily installed equipment to meet GDC-2. The Emergency diesel generator fuel oil storage tank (T-10) was not constructed to current licensing basis. To meet current requirements, the storage tank should 5-13

• be completely buried and covered with a concrete slab to provide for tornado protection. The tank is now only partially buried and covered with sand (mounded). The plant engineering staff has since evaluated the design requirements and has planned modifications to the Emergency diesel generator fuel oil supply system to meet General Design Criteria -2.

Modifications (FC-958) will be completed by the end of the refueling outage following the 1995 refueling outage (Ref. 5-16).

5.2.2.3.2 Hydrogen Tanks From the walkdowns, it was determined that potential tornado generated missiles (wood planks and Fire Protection System piping) from the cooling towers south of the protected area and trailers could impact the bulk hydrogen tanks. Hydrogen, used for electrical generator cooling, is stored south qf the turbine building in six cylindrical tanks. The loss of the

• hydrogen tanks due to a tornado generated missile would not impair the plants ability to achieve safe shutdown.

5.2.2.3.3 Emergency Diesel Generator Room HVAC Recently, the emergency diesel generator room HVAC was reclassified as safety related, and required for safe shutdown. This support system was not technically analyzed during the SEP process.

• The emergency diesel generator room HVAC system is constructed of galvanized steel material, in a helically reinforced cylindrical configuration. All of the ductwork associated with the emergency diesel generator HVAC is located within the diesel generator rooms.

None of the ductwork is external to the building. 20 gauge galvanized duct work (nonreinforced - nominal for such installations) is rated for a negative pressure of 2.4" of water ( 0. 0866 psi) (Ref. 5-17). This rating is well below that required for the design basis tornado pressure drop (3 psi, at 2 psi/sec). Tornados create negative pressures relative to that inside nearby buildings. Consequently, failure of this ducting must be anticipated from such an event.

A review of the construction prints and a walkdown confirmed that the supply fans are wall mounted to the supply air inlet plenum area (a concrete box area), without any ductwork on the fan suction. Therefore, the collapse of the Emergency diesel, generator HVAC supply air fan suction (intake) is considered unlikely. The only actual HVAC ducting installed is the fan discharge I distribution ducting. If the discharge ducting were to collapse due to excessive pressure forces, it is not considered credible that it would crush to the extent that its flow area would be significantly restricted. Thus, collapse of the ducting would not cause the failure of the fans to provide outside air for cooling, into the room.

The emergency diesel generator HVAC inlet plenum is exposed to potential tornado generated missiles on the north side of the plant auxiliary building. However, its position is to a large 5-14

extent shielded by nearby building structures. Additionally, the emergency diesel generator HV AC inlet plenum is physically one concrete box from which both diesel HV AC fans take suction. . As such, it is judged unlikely that a tornado generated missile strike would incapacitate the HVAC for both diesel generator rooms.

Based upon the foregoing, it is judged that the present ducting configuration has an acceptably low probability of causing a loss of room cooling, and consequently, no modifications are warranted.

5.2.2.3.4 1984 Auxiliary Building Addition - High Winds and Tornados This modification was performed to add a Technical Support Center (TSC) for enhanced emergency management capability, an Electrical Equipment Room (EER) to house additional safety-related Class 1-Electrical equipment, and Heating, Ventilating, and Air Conditioning (HVAC) for the TSC and EER. The following discussion is provided to address the ability of this structure to withstand high winds and tornado loadings, and tornado missiles.

1984 Auxiliary Building Addition - High Winds Section 3. 3 .1 of the Standard Review Plan states that " . . . the procedures delineated in either the American Society of Civil Engineers (ASCE) Paper No. 3269 (Ref. 5-18), "Wind Forces on Structures" ... or in ANSI A58.l-1972 (Ref. 5-19) ... "are acceptable" for addressing

• wind velocity and effective pressure applied to exposed surfaces of structures. The design criteria (Ref. 5-20) applied to the construction of this building modification provides for a maximum wind velocity of 100 mph at a height of 30 feet above ground. This is in accordance with ASCE Paper 3269. A factor of 1.1 was applied to the wind velocities to develop applied wind velocity pressures. The resulting formula was :

q = 0.00256v2 x 1.1 psf Based upon the above comparison of the Auxiliary Addition design requirements and those provided by ASCE Paper 3269, the Palisades Auxiliary Building Addition meets the criteria of the SRP for High winds.

1984 Auxiliary Building Addition - Tornados Missiles According to Regulatory Guide 1. 76, Palisades is located in tornado region 1. For this region, Regulatory Guide 1.76 and SRP section 3.1.5.4 provide the tornado characteristics shown in the Table 5.2-1. Palisades design basis tornado characteristics from FSAR sections 5.3.2.1 and 5.5.1.1.4 are shown for comparison.

As can be seen from the table, there are some differences between the Palisades Auxiliary Building Addition design, and .those in Regulatory Guide 1. 76 and SRP 3 .1. 5 .4. Chief among

• 5-15

these is that the maximum wind speed used for Palisades is 60 mph lower than the NRC criteria .

As part of the SEP analysis (topic 2-2.A, "Severe Weather Phenomena") for Palisades, an assessment of tornado and straight wind hazard probability for the Palisades site was conducted (Ref. 5-21). The analysis determined that the probability of experiencing maximum tornado wind speeds of 264 mph or greater is equal to or less than lE-6/yr. Accordingly, the frequency of a tornado with 300 mph maximum wind speed at the Palisades site is no greater than lE-6/yr. This provides adequate justification for eliminating structures designed for the 300 mph tornado from further consideration, based upon the low frequency of this maximum wind speed.

A second difference between review criteria and the Palisades design is in the weight of the wood plank missile. ANSI/ANS-2.3-1983, "American National Standard for Estimating Tornado and Extreme Wind Characteristics at Nuclear Power Sites" (Ref. *5-22) suggests a 750-pound wide flange beam as its standard design "large, hard" missile. For the lE-6/yr tornado (260-mph maximum wind speed), the beam is specified to have a 75-mph impact velocity. Comparing the ANSI/ ANS standard to the Palisades design basis shows that the Palisades design basis tornado is more severe than that associated with the lE-6/yr tornado, such that the effects of the design basis missiles are also likely to be more severe.

Based upon the foregoing, the Palisades Auxiliary Building Addition is considered to meet applicable design standards for high winds and tornados, and may be screened from further

• consideration in this evaluation.

5.2.3 External Flooding and Probable Maximum Precipitation 5.2.3.1 External Floods External flooding review criteria are contained in Regulatory Guide 1.59 (Ref. 5-23), and Standard Review Plan Section 2A.2, "Floods", and 2.4.3, "Probable Maximum Flood (PMF)", and 2.4.5, "Probable Maximum Surge and Seiche Flooding". The SEP process evaluated these criteria, under topics 11-3.A, "Hydrologic Description", 11-3.B, "Flooding Potential and Protection Requirements", 11-3.B.1, "Capability of Operating Plants to Cope with Design Basis Flooding Conditions", and 11-3.B.C, "Safety Related Water Supply (Ultimate Heat Sink)". This evaluation~oncluded that the runoff depth (due.to local' Probable Maximum Precipitation (PMP) on the plant site, in the vieinity of safety related structures would be less than six inches above ground elevation (elevation 589' mean sea level - msl) and should not constitute a flood threat (Ref. 5-24). The lowest elevation safety related equipment at Palisades are the Service Water pump motors, at elevation 594. 7' msl. These reviews concluded that the bounding condition (Design Basis Surge level - 593. 5 feet msl) is not a threat to equipment required for safe shutdown, and the emergency procedures for this flood level are adequate (Ref. 5-25).

5-16

• Given the minimal site flooding caused by the older PMP, it is judged that the analyzed site flooding due to the revised PMP (see section 5.2.3.2) for the Palisades site would remain bounded by the surge/seiche event.

Emergency Diesel Gener_ator Fuel Oil System As noted above, it was determined subsequent to the SEP analysis, that emergency diesel generator fuel oil system would need to function to assure safe plant shutdown. As a result, the fuel oil transfer system, including pumps and storage tanks are now required for the

.specified coping time for safe shutdown. Several aspects of the fuel system were found to be deficient with respect to safety related design criteria :

1. The design of the T-10 fuel oil supply tank does not meet design criteria for withstanding the effects of a tornado missile, and may not withstand the affects of a design basis flood.

2. Portions of the fuel oil piping from the T-10 tank to the emergency diesel generator day tanks have not been verified to be able to withstand the effects of tornado missiles, or seismic event.

3. The design of the fuel oil system does not provide automatic isolation of non-essential fuel oil loads upon the initiation of a design basis event.

• Since these determinations have been made, a seiche protection barrier around the fuel oil transfer pumps, (located at elevation 590 in the Service Water Pump Building) has been constructed.

CPCo has docketed commitments to resolve these design deficiencies by the end of the refueling outage following the 1995 refueling outage (Refs. 5-26, 5-27, 5-28). These modifications will complete necessary actions to mitigate the effects of design basis flooding at Palisades.

5.2.3.2 Probable Maximum Precipitation Generic Letter 89-22 (Ref. 5-29) informed licensees of operating reactors that more recent probable maximum precipitation (PMP) criteria had been published by the National Oceanic and Atmospheric Administration (NOAA) and the National Weather Service (NWS)(Ref. 5-30)

(Ref. 5-31), and (Ref. 5-32). According to the generic letter, these new criteria may result in higher site flooding levels and greater roof ponding loads than may have been used previously.

The older PMP for Palisades was 25.5 inches in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> - 10 square miles (Ref. 5-32).

The impact of the new PMP on the magnitude of external floods was discussed in the preceding section. This section will review the affect of the new PMP on roof ponding .

• 5-17

• The PMP assumed for the roofs at the site was determined to be the smallest drainage area for which PMP values are estimated in the NOAA/NWS reports, one square mile. This assumption is consistent with the drainage area indicated as approprfate by Generic Letter 89-

22. In order to maintain conservatism, a one-hour duration for the precipitation was used, since the data indicate that PMP values are maximum for this time period for a one-square-mile drainage area. According tb the NOAA/NWS report*" Application of the PMP Estimates

- United States East of the 105th Meridian" (Ref. 5-31), Figure 24, the one hour, one-square-mile PMP for the Palisades site is approximately 17.4 inches. Figures 36 through 38 of the same report were used to develop a graph of PMP versus time for the one-hour PMP. These results are shown in Figure 5.2-1. This figure shows that 9.27 inches of precipitation falls in the first 15 minutes for this PMP estimate, which exceeds the 7. 7 inch design limit for those buildings that have a 40 pounds per square foot live load capacity. Consequently, the drainage capability of these buildings was examined, and the roof and building drawings were reviewed to identify design features which might mitigate the effects of roof ponding. These drawings were supplemented by a walkdown to confirm as-built dimensions.

In review of the Palisades buildings, the only roof of potential concern is the SFP roof which is built to a 50 lb/:ft2 design loading capacity. A calculation (Ref. 5-33) of maximum water depth using the PMP yielded a level of 10.2 inches. This level exceeds design but is less than yield.

Based upon the foregoing, using both a conservative approach and data, it is concluded that the new PMP criteria do not represent a credible threat of severe accidents, and may be screened from further consideration.

5.2.4 Transportation and Nearby Facility Accidents As with other hazards discussed in this section of the report, the SEP process provided a systematic assessment of hazards due to transportation and nearby facility accidents (SEP Topic 11-1.C, "Potential Hazards Due to Nearby Industrial, Transportation and Military Facilities"). This topic addressed the 1975 SRP sections 2.21, 2.22, and 2.23. It was concluded that Palisades was adequately protected and could be operated with an acceptable degree of safety with respect to industrial and transportation activities in the vicinity of the plant (Ref. 5-34).

In a related subject, the effect of such events upon control room habitability was evaluated as part of the response to the TMI Action Plan, NUREG-0737, Task 111.D.3.4, "Control Room Habitability". This evaluation was conducted in accordance with Regulatory Guides 1.78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release" (Ref. 5-35), 1.91, "Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants" (Ref. 5-36), and

1. 95, "Protection of Nuclear power Plant Control Room Operators against an Accidental

• 5-18

• • Chlorine Release" (Ref. 5-37). The NRC Safety Evaluation Report concluded that the control room design (including committed improvements) meets the review criteria (Ref. 5-38).

The following paragraphs discuss the results of reviews conducted to determine whether the SEP results remain valid considering updated hazard conditions.

5.2.4.1 Transportation Accidents 5.2.4.1.1 Roads/Highways The nearest transportation routes to the plant are US Route 33 (3600 feet) and Interstate I-196 -*

(4200 feet) at their closest approach. The highway separation distances from the Plant exceed the minimum distance criteria given in the Regulatory Guide 1.91, Revision 1. This distance, therefore, provides reasonable assurance that transportation accidents resulting in explosions of truck-sized shipments of hazardous materials will not have an adverse effect on the safe operation of the Plant. This is without any consideration of the potential deflection capability of the forested dunes between the plant and the transportation routes.

5.2.4.1.2 Railroads The nearest railroad, the Chesapeake and Ohio line, is about 9 miles to the east of the site.

Potential railroad accidents involving.hazardous materials are not considered to be a credible risk to the safe operation of the plant from this distance (i.e., this distance exceeds the generic acceptance criteria of Reg. Guide 1.91). Therefore, railcar accidents are not considered as credible threats to the safe operation of the plant.

5.2.4.1.3 Great Lakes Shipping There are no large commercial harbors along the western shore of Lake Michigan near the plant. Some freight is shipped through the St. Joseph harbor about 17 miles to the south. The FSAR states that the Major shipping lanes in the lake are located well offshore, at least 10 miles or more from the plant. In a visit to the US Coast Guard Station in St. Joseph, it was pointed out from their navigational maps (Ref. 5-39) that the nearest shipping lane is the north bound lane which is 35 miles offshore from the plant. Ships going into and out of St. Joseph would be at least ten miles away; and therefore, lake shipping is not considered to be a hazard to the plant.

5.2.4.1.4 Pipelines The nearest large pipelines to the plant lie in a corridor about three miles southeast (Ref. 5-7).

However, a new 4" gas pipeline, *l.25 miles from the plant, was put into service in the fall of 1993 to service a manufacturer's training and conference center. At this distance, and with

• 5-19

• forested dunes between the plant and the gas line, the 4" line is of insufficient size for either an explosion or control° room habitability (leak) concern.

Larger pipelines including a 22" and a 30"- 42" diameter natural gas pipeline and a 10-inch diameter petroleum products pipeline, are located east of Covert, about 4 miles away, at the nearest point .*There are no gas or oil production fields, underground storage facilities or refineries in the vicinity of the Plant. Again, as discus~ed above, these pipelines are far enough away that pipeline accidents will not affect the safety of the nuclear plant.

5.2.4.1.5 Aviation The U.S. NRC has issued the following acceptance criteria in their Standard Review Plan (SRP Section 3.5.1.6, "Aircraft Hazards")for the siting of nuclear power plants near airports and/or airways:

The probability of an aircraft accident resulting in radiological consequences greater than 10 CFR Part 100 exposure guidelines is considered fo be less than lE-7 /yr if the distances from the plant meet all of the requirements listed below:

a. The plant-to-airport distance Dis between 5 and 10 statute miles, and the projected annual number of operations is less than 500 D2 , or the plant-to-

.airport distance D is greater than 10 statute miles, and the projected annual number of operations is less than 1000 D2 , .

b. The plant is at least 5 statute miles from the edge of military training routes, including low-level training routes, except for those associated with a usage greater than 1000 flights per year, or where activities (such as practice bombing) may create an unusual stress situation,

c. The plant is at least 2 statute miles beyond the nearest edge of a federal airway, holding pattern, or approach pattern.

These conditions are discussed in the following paragraphs.

Airports The closest airport to the Plant is the South Haven Regional Airport. The South Haven Regional Airport is a general aviation facility located approximately three miles northeast of the Plant. Southwest Michigan Regional Airport (Ross Field) in Benton Harbor is approximately 15 miles south of the Plant and had 58,000 operations in 1994. Ross Field has approximately 25 military business fly-ins per year. Due to its proximity, the South Haven Airport is the only airport facility of concern to the plant ..

• 5-20

• There are currently 22,000 operations per year (1994) at the South Haven airport, where an operation is either a takeoff or a landing. The airport is used for general aviation activities such as business and pleasure flying and for agricultural spraying operations. There are twenty-five single engine and three twin engine aircraft with gross weights from 1,250 to 5,200 pounds based at the airport. Other aircraft with weights up to 12,500 pounds will land at the South Haven Airport on an infrequent basis.

The NRC, based on evaluations performed in several licensing reviews, has concluded that nuclear power plant structures which are designed to withstand tornado missiles and other design loads can withstand the collision forces imposed by light general aviation aircraft without adverse consequences. Safety-related equipment located outside of such structures, however, would be vulnerable to a light airplane crash (Ref. 5-40).

During the SEP process, an assessment was made of the probability of a light aircraft striking vulnerable plant equipment (SEP Topic III-4.D, "Site Proximity Missiles). This assessment conservatively determined the probability of such an event to be d.55E-7 per year. The probability of an aircraft striking the spent fuel pool was also determined at this time, at

~2.5E-8 per year (Ref. 5-40).

Since the SEP assessment was conducted, the South Haven Airport has increased the size and condition of its runways slightly and the total operations have increased from 20,000 to 22,000 annually. The increase in operations has increased the probability of an aircraft striking such equipment to d.7E-7 per year (Ref. 5-41), which is still within the SRP 2.2.3 criteria-of acceptability. The increased operations has also increased the probability to the spent fuel pool to ~2:8E-8 per year (Ref. 5-41). These probabilities remain acceptably low.

The Independent Spent Fuel Storage Installation (ISFSI) was certified May 7, 1993. The ISFSI was evaluated for the probability of aircraft striking storage casks and determined to be d.OE-7 per year (Ref. 5-41). The increase in aircraft operation at South Haven Airport to 22,000 has increased this probability to d.3E-7 per year (Ref. 5-41). This still meets the SRP 2.2.3 acceptance criteria, and the analysis still employs the same conservatism, i.e., assuming all flights fly over the dry fuel storage pad.

Military Bases There are no nearby military air bases. The nearest facility is the Air National Guard in Battle Creek, Michigan, some 60 plus miles from the plant. Based on phone conversations with personnel at local and regional airport authorities (South Haven, Southwest Michigan, and Chicago) (Ref. 5-42) (Ref. 5-43) (Ref. 5-44), there are no military training routes within 30 miles of the site, therefore, military activities are not considered as a credible risk to the safe operation of the Plant .

• 5-21

Federal Airways According to the FAA , the nearest Federal Airways are three low altitude airways (V193, V84 & V55) which pass 4 miles q.orthwest, 9 miles northwest and 10 miles east of the plant respectively. From 14 CFR 71.75 (Extent of Federal Airways), each Federal Airway is based on a center line that extends from one navigational aid or intersection to another navigational aid (or through several navigational aids or intersections) specified for that airway. Each Federal airway includes the airspace within parallel boundary lines 4 miles each side of the center line. The Federal airway airspace can also include the airspace between lines diverging at angles of 4.5° from the center line at each or either end of the navigational aids depending on their relative positions, as defined in 14 CFR 71.75. The Palisades plant is approximately -*.

4 miles from the center line of the Federal airway V-193, and this does not meet the condition to be 6 miles from the center or two miles from the edge of a Federal airway. This Federal airway (V-193) is the only Federal airway of concern to the Plant.

According to the FAA, there is no traffic regularly scheduled on V-193 between the intersection of V-100 and V-193, and the Pullman, MI VORTAC (Very High Frequency Omni-Directional Tactical Navigation Aid) (Ref. 5-45). Traffic in this area is Chicago metropolitan departure or arrival traffic on vectors, for the most part, north or south of the Plant. The traffic is a random mix of land based, 2 engine piston, 2 engine turboprop, 2 and 3 engine turbo-jet, and an occasional 4 engine turbo-jet. The FAA examination of the traffic in this area indicates a maximum traffic flow of slightly less than 2200 flights per year .

• Applying the aircraft hazard equations of the SRP, section 3.1.5.6, "Aircraft Hazards", which are restated in NUREG/CR-5042, section 6.4 (Ref. 5-4), the probability per year of an aircraft crashing into the plant is conservatively 9. 6E-8 (Ref. 5-41). The area used in the equation was conservatively calculated to include all structures which contribute to normal operation, to safe shutdown operation ~d the independent spent fuel storage installation (ISFSI). This area was then doubled in the equation for additional conservatism.

Based upon the foregoing update of current Federal air traffic near the Palisades site, the probability of damage to the plant from this source is acceptably low and screened from further evaluation.

Based upon the foregoing review of current transportation related hazards, no further consideration of such events is warranted.

5.2.4.2 Nearby Industrial Facilities The SEP assessment of nearby industrial facilities noted that :

"There is little industrial activity in the vicinity of the Palisades Plant. The nearest concentration of industrial activity is located in the South Haven area and consists

• 5-22

• primarily of light manufacturing facilities. Regional planning officials have stated tllat to their knowledge, no industrial developments are planned for the vicinity of the nuclear plant" (Ref. 5-34).

A recent review of current industrial facilities indicates this conclusion remains valid (Refs.

5-46, 5-47).

5.2.4.3 On-site Storage Hazardous Material Releases/On-site Hazards The release of hazardous material from on-site storage presents a potential threat through the possibility of incapacitating control room operators or challenging safe shutdown capability.

This issue has been the subject of two prior regulatory mandated reviews : (1) SEP Topic 11-1.C, "Potential Hazards due to Nearby Industrial, Transportation and Military Facilities (1981), and (2) NUREG-0737, Item 111.D.3.4 "Control Room Habitability"(1982). The latter review was done in accordance with Regulatory Guide 1. 78 " Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release" (Ref. 5-35), and Regulatory Guide 1.95, "Protection of Nuclear Power Plant Control Room Operators Against an Accidental Chlorine Release" (Ref. 5-37). The U.S. Nuclear Regulatory Commission completed the two reviews, and issued their Safety Evaluation Reports (Ref. 5-34)(Ref. 5-38); The following paragraphs briefly discuss the pertinent results of those reviews, and recent reviews to determine their continued applicability.

• Two calculations were performed in support of the NUREG -0737 Control Room Habitability assessment, postulating (nearby highway off-site) spills of hydrogen cyanide and chlorine (Ref.

5-48). In both cases, the concentrations conservatively analyzed to reach the control room were considered acceptable. Recent wind rose data (Ref. 5-49) has been reviewed, and found to be consistent with that used in the referenced calculation.

On-site chemical usage has decreased since the above referenced reviews, resultant from regulatory activity. Current usage (Ref. 5-50) of hazardous chemicals on-site is limited to:

- Hydrazine

- Sodium Hydroxide

,- Sodium Hypochlorite

- Sulfuric Acid

- Aliphatic Petroleum Distillates

- Gasoline (Benzene)

- Nitrogen (liquid)

These on-site chemical sources have not changed in quantity, or in proximity to the control room since the above referenced reviews .

• 5-23

• 5.2.4.4 Hydrogen Other On-site Hazards Hydrogen, used for electrical generator cooling, is stored south of the turbine building in six cylindrical tanks. If a hydrogen tank were to explode, a plant trip could occur due to failure of the insulators on the nearby transformers and failure of the switchgear structure housing F and G buses. The loss of F and G buses results in the tripping of the cooling tower pumps and the cooling tower fans. Such an event would result in a plant trip, an event analyzed in the IPE.

In selecting review criteria, Regulatory Guide 1. 91 "Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants" was considered, but not used.

The guide does provide a review methodology for deriving minimum distances between transportation routes, and safety related structures. This guide is based upon much larger quantities of explosive than is available from the explosion of a single plant hydrogen tank.

The attendant conservatisms applied to such large quantities are not appropriate to smaller quantities. Additionally, the guide is limited to solid and hydrocarbons liquified under pressure, and not applicable to compressed gasses. Finally, the guide specifically considers the effects of explosions due to railway, highway, and water routes, excluding fixed facilities, such as plant hydrogen tanks .

• EPRl's "Guidelines for Permanent BWR Hydrogen Water Chemistry Installations" (Ref. 5-51) provides a methodology specifically for assessing the hazard presented by this tank to surrounding safety related equipment. The method determines the amount of explosive material (expressed in pounds of TNT) and the resultant minimum distances from walls of various strengths. The reference provides a relationship between minimum required separation distance to safety-related structures, and (gaseous hydrogen) vessel size. With this conversion applied to the rupture and explosion of one of the six 90 ft3 (1500 psi nominal operating gas pressure) tanks, a volume of about 9800 SCP hydrogen gas is available. Using this value, and Figure 5.2-2 (taken from reference 51), a required distance of 120 feet is determined for wall at least 8" thick. As the nearest building containing safety related equipment is over 150 feet away (Screen House - 24" thick walls), it is concluded that the hydrogen tanks do not pose a credible threat to the plant.

Propane North of the turbine building is located a propane tank, associated with heating boiler operation.

Reviewing the equipment in proximity to the propane tank it was noted that there are electrical conduit lines running nearby into the turbine building electrical raceways. The circuits in

• • 5:-24

these conduits were reviewed and found to contain no equipment important to safe plant shutdown (Ref. 5-52).

Station power transformer #17 and the associated switchgear are located approximately 45'-50' away from the propane tank. Transformer #17 feeds 480V bus #17 for miscellaneous non-safety related equipment such as, auxiliary boiler M-24, MCC#18, outage welder supply, transformer #69 (temporary trailer power supply) and other miscellaneous equipment. The loss of the station power transformer #17 would not affect the plant ability to achieve safe shutdown.

Additionally, the emergency diesel generators are located nearby. The emergency diesel*

generators are located within the CPCo Class 1 portion of the Auxiliary Building, and have walls 18" thick. The ability of this structure to withstand missiles generated by a design basis tornado was evaluated during the SEP (Topic 111-4.A, "Tornado Missiles"), in accordance With SRP section 3.1.5.4, "Missiles Generated by Natural Phenomena". It is judged that the forces exerted by the SRP des~gn missiles encompass those possibly generated by an explosion of the propane tank .

• 5-25

5.2.5 Tables and Figures for Assessment of Other External Events

• Table 5.2-1 Comparison of NRC Criteria to Palisades Auxiliary Building Addition Design NRC Guide Palisades Aux Bldg Topic Guide 1.76 Addition (FSAR)

Maximum wind speed (tornado loading) 360 mph 300 mph Translational speed 70mph 60mph Pressure drop . 3.0 psi 3 psi Maximum wind speed (tornado missiles) 360 mph 360 mph Utility pole missile 1490 lbs 1490 lbs Utility pole missile 144 mph 144 mph Utility pole missile 30 ft above ground 30 ft above ground

• Utility pole missile (ht/diameter)

Automobile Automobile 35 ft/13.5" 4000 lbs 72mph 35 ft/13.5" 4000 lbs 72mph Automobile 30 ft above ground 30 ft above ground Automobile 20 sq ft contact area 20 sq ft contact area Steel rod (1 "x3' long - 8#) 216 mph 216 mph Wood plank (4"x12"x12') 200# 108#

Wood plank (4"xl2"xl2') 288 mph 300 mph

• 5-26

• FIGURE 5.2-1 PALISADES PROBABLE MAXIMUM PRECIPITATION PMP VS TIME FOR 1 SQUARE MILE DRAINAGE AREA 20 18 17.4 16

-~ 1412 Cl)

(..)

c:

=:. 10 9.27 a..

~

a.. 8

• 6 4

2 5.88 0

0 5 10 15 20 25 30 35 40 45 50 55 60 TIME (minutes)

• 5-27

• FIGURE 5.2-2 MINIMUM REQUIRED SEPARATION DISTANCES TO SAFETY-RELATED STRUCTURES VERSUS VESSEL SIZE FOR GASEOUS HYDROGEN STORAGE SYSTEM

~ i8-inch reinforced concrete

. 140 II>

(a) Ps 2: 1.5 pSi: [~J;::: o. 12 ksi

~ 100%

s

-g psi:[..£>.!LJ;l!:

Ci5 120 (b) P 5 ::J!: 3.0 100%

0.30 ksi

~

c!;;...

~ 100 Reinforced wall

=: 8 inches thick V) s QJ u

~ 80 iii c5 c:

.g

!! 60 a.

GJ rJ)

~

-~:J 40 lE g

'2 20

s 2 4 6 ' 8 10 12 14 Vessel Size (thousands of SCF per vessel)

• 5-28

5.3 Conclusions Based upon the foregoing discussions, we conclude that there are no 'other' external events (not considering fire and seismic events) that are a safety concern to the Palisades Plant.

Specific attention was given to consider changes in plant facility or hazard that have occurred since the conduct of the Palisades SEP. No vulnerabilities were identified and the screening criteria (modified from NUREG-1407) are satisfied for all events .

j

• 5-29

5.4 References 5-1 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), April 1991 5-2 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 5-3 NUREG-0820, Integrated Plant Safety Assessment - Systematic Evaluation Program, Palisades Plant, Final Report, October 1982 5-4 NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power Plants in the United States, Supplement 2, February 1989 5-5 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 5-6 Palisades Off-Normal Procedure ONP 6 .1, Loss of Service Water 5-7 Palisades Final Safety Analysis Report 5-8 Letter from RAVincent (CPCo) to DMCrutchfield (NRC), subject: Palisades Plant -

SEP Topics 11-4 Geology and Seismology, and 11-4 Proximity of Capable Tectonic Structures in Plant Vicinity, 7 /22/81 5-9 Letter from DPHoffman (CPCo) to DMCrutchfield (NRC), subject: Palisades Plant -

SEP Tqpics 11-4.D Stability of Slopes, and 11-4.F Settlement of Foundations and Buried Equipment, 6/1/81 5-10 NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power Plants in the United States, December 1987 5-11 Regulatory Guide 1.76, Design Basis Tornado for Nuclear Power Plants, April 1974 5-12 Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978 5-13 Letter from TVWambach (NRC) to DPHoffman (CPCo), subject: SEP Topic 111-2, Wind and Tornado Loadings - Palisades, 2/8/82 5-14 Letter from TVWambach (NRC) to DPHoffman (CPCo), subject: SEP Topic llI-4A, Tornado Missiles - Palisades, 2/2/82 5-15 Letter from JLKuemin (CPCo).to Document Control Desk (NRC), subject: Palisades Plant - SEP Topics 111-2, 111-4.A, V-lOB and VII-3, 1130/87

• 5-30

• 5-16 5-17 Letter, DWRogers (CPCo) to NRC Document Control Desk,

Subject:

Palisades Plant Electric Diesel Generators - Testing and Fuel Oil Supply - Supplementary Information Revision 1, 10/27/94 HVAC Duct Construction Standards - Metal and Conditioning National Association, 1985 Flexibl~, 1st Edition, Sheet Metal Air 5-18 American Society of Civil Engineers (ASCE) Paper No. 3269 5-19 ANSI A58.1, Building Code Requirements for Minimum Design Loads in Buildings and Other Structures, Committee A58.l, American National Standards Institute -

5-20 Civil/Structural Design Criteria for Control Room-Heating, Ventilating, and Air Conditioning and Auxiliary Building Addition for Consumers Power Company Palisades Nuclear Plant South Haven, Michigan, Bechtel Associates Professional Corporation, 7/1182, Rev. 0 5-21 Tornado and Straight Wind Hazard Probability for Palisades Nuclear Power Reactor Site, Michigan, JRMcDonald, P.E., May 1980 5-22 ANSI/ANS-2.3-1983, American National Standard for Estimating Tornado and Extreme Wind Characteristics at Nuclear Power Sites 5-23 Regulatory Guide 1.59, Design Basis Floods for Nuclear Power Plants, August 1977 5-24 Letter from TVWambach, NRC, to DNandeWalle, CPCo, 2/19/82, subject: Palisades

- SEP Topic 11-3.A, Hydrologic Description, 11-3.B, Flooding Potential and Protection Flooding Conditions, and 11-3.C, Safety Related Water Supply (Ultimate Heat Sink) 5-25 Letter from TVWambach (NRC) to DNandeWalle (CPCo), subject: Palisades - SEP Topic 11-3.A, Hydrologic Description, 11-3.B, Flooding Potential and Protection Requirements, 11-3.B.1, Capability of Operating Plants to Cope with Design Basis Flooding Conditions, and 11-3.C, Safety-Related Water Supply (Ultimate Heat Sink),

1017/82 5-26 Palisades Event Report: E-PAL-93-010, EDG Fuel Oil Supply , 3-8-94 5-27 Palisades Request for Modification RFM-1511, Diesel Fuel Oil Transfer System Upgrade, 10/12/94 5-28 Letter from KMHaas (CPCo) to Document Control Desk (NRC), subject: Emergency Diesel Generators - Completion of Fuel Oil Supply System Modifications -

Supplementary Information, 10/27/94

• 5-31

• 5-29 5-30 Generic Letter 89-22, Potential for Increased Roof Loads and Plant Area Flood Runoff Depth at Licensed Nuclear Plants due to the Recent change in Probable Maximum Precipitation Criteria Developed by the National Weather Service National Oceanic and Atmospheric Administration (NOAA), National Weather Service (NWS) Hydrometeorological Reports (HMR) #53, Seasonal Variation of 10-Square Mile Probable Maximum Precipitation Estimates, United States East of the 105th Meridian, April 1980 5-31 National Oceanic and Atmospheric Administration (NOAA), National Weather Service (NWS) Hydrometeorological Reports (HMR) #52, Application of the PMP Estimates - -

United States East of the 105th Meridian, August 1982 5-32 National Oceanic and Atmospheric Administration (NOAA), National Weather Service (NWS) Hydrometeorological Reports (HMR) #51, PMP Estimates, United States East of the 105th Meridian, June 1978 5-33 Palisades Calculation EA-CALC-95-01, Probable Maximum Precipitation and Roof Ponding 5-34 Letter from DMCrutchfield (NRC) to DPHoffman (CPCo), subject: SEP Topic 11-1.C, Potential Hazards due to Nearby Industrial, Transportation and Military Facilities (Big Rock and Palisades), 5/13/81 5-35 Regulatory Guide 1. 78 : Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, June 1974 5-36 Regulatory Guide 1.91, Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants, Revision 1, February 1978 5-37 Regulatory Guide 1. 95, Protection of Nuclear power Plant Control Room Operators against an Accidental Chlorine Release, Revision 1, January 1977 5-38 Letter from DMCrutchfield (NRC) to DNandeWalle (CPCo), subject: NUREG-0737, Item 111-D.3.4, Control Room Habitability - Palisades Plant, 4/29/83 5-39 Navigational Maps~ United States - Great Lakes - Lake Michigan Waukegan to South Haven, Soundings in feet, Loran - C Overprint #14905, 26th Edition, 3/9/91 5-40 Letter DMCrutchfield (NRC) to DPHoffman (CPCo), subject: SEP-Topic 111-4.D, Site Proximity Missiles, 8/3/81

• 5-32

• 5-41 5-42 Palisades Calculation EA-CALC-95-02, Airplane Traffic Hazard Telephone Conversation with Don Woodhams, South Haven Airport Authority, 1116/95 5-43 Telephone Conversation with John Chaddock, Southwest Michigan Regional Authority (Ross Field), 1I17/95 5-44 Telephone Conversation with Bill Ottens, Chicago Air Route Traffic Control Centers (ARTCC), FAA, Aurora Illinois, 1118/95 5-45 Letter from DCBurke, Air Traffic Manager - Chicago ARTCC, to DLAllen (CPCo),

subject: Traffic on V-193, South Haven Airport, Visual Flight Rules, 1/20/95 5-46 Telephone Conversation with JBland, Southwest Michigan Growth Alliance - Regional Planning Authority, 10/5/93 5-47 Telephone Conversation with CDehn, South Haven Economic Development Association, 10/5/93 5-48 Letter from Brian D. Johnson, CPCo, to Dennis M. Crutchfield, NRC, 10/19/82 subject: NUREG-0737, Item III.3.4, Control Room Habitability - Additional Information 5-49 1989-1993 Annual 10 and 60 Meter Wind Roses for Palisades, Dennis Kahlbaum, CPCo, 7125194 5-50. Letter from Joe Hager, CPCo, to Michigan Department of Natural Resources, 2/14/95

SARA Title III - Tier II Reporting for Consumers Power Company Palisades Nuclear Plant

. 5-51 EPRI Report NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations, September 1987 5-52 CPCo Memo from DLAllen to PRA file 91-03, subject: IPEEE Other External Events Walkdown Observations

• 5-33

TABLE OF CONTENTS

• 6.1 IPEEE Program Organization SECTION 6.0 LICENSEE PARTICIPATION AND INTERNAL REVIEW 6-1 6.2 Composition of Independent Review Team 6-2 6.3 Resolution of Major Comments 6-3

6.0 LICENSEE PARTICIPATION AND INTERNAL REVIEW

• One of the major benefits from the IPEEE process is for the licensee to obtain knowledge and understanding of severe accident behavior at its plant through the performance of the IPEEE.

Also, involvement by utility personnel allows more efficient use of the knowledge gained from the performance of the IPEEE to be applied to plant improvemen~s. To realize the greatest benefit, utility participation must be maximized. This is achieved through utility participation in the development and independent review processes. Palisades committed extensive personnel resources to the development and review of the IPEEE.

6.1 IPEEE Program Organization The IPEEE was performed by the Palisades PRA group with assistance from consultants (TENERA, L.P.; Stevenson and Associates; and J.R. Benjamin and Associates). The Palisades PRA group was responsible for developing the IPEEE and coordinating the efforts of utility and consultant personnel.

The Palisades PRA group was instrumental in developing the IPE submittal. Many of the same personnel involved in that effort were involved in the IPEEE development. With this type of experience and plant knowledge, the IPEEE modelling was performed by the utility along with portions of the independent review. Consultants provided general direction and methodology guidance as well as an independent review of the IPEEE .

• The walkdowns wei:e performed by consultants and utility personnel. The seismic fragility development for the components. was performed by consultants. Modifying the IPE models for the fire and seismic events and quantifying the models was performed by utility personnel.

Methodology review and guidance was provided by consultants. Tiie independent review was performed by both utility personnel and consultants .

• 6-1

6.2 Composition of Independent Review Team

• The independent review of the IPEEE was perfonned in three parts: seismic; fire; and other events. Each part received an internal and external mdependent review.

Seismic The seismic PRA received an independent review of the methodology by Dr. R.P. Kennedy and :br. J.D. Stevenson. This review evaluated the walkdown methods, Screening Evaluation Worksheets (SEWS) and other seismic documentation prepared for Palisades. Also, the seismic modelling and quantification setup and results were reviewed by J .R. Benjamin and Associates (JRB). The hazard integration program SHIP was developed by JRB and used by Palisades for final seismic quantification. In addition, the seismic results and report was reviewed by the Palisades structural group and TENERA. The Palisades structural group was involved in the performance of the resolution of USI A-46. TENERA has experience with several IPEEEs, including seismic PRAs.

Fire The fire IPEEE received an independent review by utility personnel and TENERA. The in-house review was performed by the Fire Protection Group which is currently re-evaluating the Appendix R project. TENERA has experience with several IPEEEs, including fire analysis.

• • Other External Events The other external events IPEEE received an independent review by utility personnel and TENERA. The in-house review was performed by the Licensing group. The individual that performed the independent review was involved in many of the SEP topics covered in the other external events analysis. TENERA has experience with several IPEEEs, including other external events analysis .

• 6-2

6.3 Resolution of Major Comments The results and comments of all the reviews were formally documented and dispositioned.

Changes to the models and requantification was performed for any comments that were anticipated to impact the results of the IPEEE.

• 6-3

TABLE OF CONTENTS SECTION 7.0 PLANT IMPROVEMENT AND UNIQUE SAFETY FEATURES 7.1 Unique Safety Features and Insights 7-1 7.1.1 Unique Safety Features 7-1 7.1.2 IPEEE Insights 7-1 7 .2 Plant Improvements 7-2

• 7.0 7.1 PLANT 'PROVEMENT AND UNIQUE SAFETY FEATURES Unique *safety Features and Insights One unique safety features and no new insights were identified in the IPEEE that were not identified in the IPE.

7.1.1 Unique Safety Features The unique safety feature identified in the IPEEE was the high safe shutdown earthquake (SSE) design basis for this region. The Palisades design basis SSE is 0.20g. This high design basis SSE contributes to the high seismic capacity of engineered safeguards equipment at Palisades. There were no seismic vulnerabilities or weaknesses in the engineered safeguards equipment at Palisades.

7.1.2 IPEEE Insights There were 5 significant insights discussed in the Palisades IPE:

1) small break LOCA as a significant contributor to core damage probability;

• 2) failure of a single component with a small break LOCA initiator leading to core damage;

3) loss of off-site power as a significant contributor;

4) condensate storage tank makeup capabilities; and

5) safety injection and refueling water tank makeup capabilities.

Insights 1, 2 and 5 pertain to LOCAs. The IPEEE did not receive any contribution to core damage frequency from any LOCAs. Therefore, these three IPE insights are not applicable to the IPEEE results. Insights 3 and 4 have similar contributions to the results of the IPEEE. No additional insights were identified as a result of the IPEEE .

• 7-1

• 7.2 Plant hiiprovements No major plant changes have been identified as a result of the IPEEE. The IPEEE confirmed that the reactor cavity sump improvements identified in the Palisades IPE would provide a similar benefit in the IPEEE.

The Palisades USI A-46 program performed a relay review. The relay review identified 17 outlier relays. The SPRA expanded that review to include all SPRA relays with no additional

'bad actor' relays identified. The Palisades SPRA assumes that the outlier relays identified in the USI A-46 program will be properly dispositioned in the SQUG program and that specific seismic modelling for these relays was not included in the SPRA .

• 7-2

• TABLE OF CONTENTS SECTION 8.0 RESULTS AND CONCLUSIONS 8.1 Results 8-1 8.1.1 Seismic 8-1 8.1.2 Fire 8-2 8.1.3 Other External Events 8-2 8.2 Conclusions 8-3

• 8.0 RESULTS AND CONCLUSIONS This section presents a summary of the results and conclusions of the IPEEE. The results and conclusions are presented in three parts: seismic; fire; and other external events.

8.1 Results Detailed discussions of the results are presented in Section 3 .6 for seismic, Section 4.11 for fire and Section 5. 2 for other external events. This section presents a summary of the detailed results discussions.

8.1.1 Seismic There were no significant seismic concerns identified as a result of the seismic PRA (SPRA).

The new Lawrence Livermore National Laboratory (LLNL) hazard curves, as contained in NUREG-1488 (Ref. 1-6), were used to evaluate the SPRA. The SPRA mean core damage frequency is 8. 88E-06/yr, which is considerably less than the IPE (internal events) core damage frequency of 5.15E-05/yr. The median fragility (capacity) of the plant is .488g peak ground acceleration (PGA) and the high confidence of a low probability of failure (HCLPF) is .217g PGA. Both of these results are higher than the Palisades safe shutdown earthquake design of .20g PGA.

• None of the Accident Classes (defined in Section 3.6.4) met the screening requirements for reportability as defined in Generic Letter 88-20. The two highest contributors to core damage frequency are Accident Classes IA (loss of secondary heat removal and failure of once through cooling during the injection phase) and IB (loss of secondary heat removal with failure of once through cooling during the recirculation phase). Accident Class IA contributed approximately 36 % and Accident Class IB contributed approximately 34 % to the core damage frequency.

The rest of the contribution comes from: Accident Class II (failure of containment heat removal) with a contribution of 3 %; failure of the reactor building or auxiliary building, each with a contribution of 11 %; and complete failure of all components with a contribution of 5 %.

A review of the results of the SPRA conclude that:

1) there are no dominant seismic failure modes contributing to the core damage frequency;

2) non-seismic failures and operator errors are an important part of the SPRA core.

damage frequency; and

3) the engineered safeguards equipment are inherently rugged with no seismic vulnerabilities.

Important seismic contributors include the fire protection system (FPS), MSIVs, diesel fuel oil storage tank (T-10), and bus lD undervoltage relays. The FPS is a high contributor mainly due to condensate storage tank (CST) makeup, for which the FPS is a major alternative 8-1

• following loss of off-site power (normal makeup sources). The MSIVs have a potential interference which might prevent them from closing, thus, inducing a two steam generator blowdown scenario upon failure of one ADV to close. Both diesel generators have a common long term fuel oil storage tank (T-10), which is important following a loss of off-site power.

Bus lD becomes important for powering the AFW pump P-8C, which is the only AFW pump available following loss of the FPS.

8.1.2 Fire The Palisades core damage frequency is less than 2.00E-04/yr. This information is summarized by fire area in Table 4.1.11-1. Eighty-five percent of the core damage frequency associated with internal fires can be traced to five rooms/bum areas; 1) turbine building, 2) main control room, 3) cable spreading room, 4) spent fuel pool equipment room, and 5) auxiliary building 590 corridor.

The results of the Fire IPEEE accident sequence quantification were derived from a methodology that includes a number of conservative assumptions. Fires were assumed to increase until they completely engulfed the area where they were located. In addition, with the exception of the main control room, cable spreading room and the 2.4kV switchgear rooms (fire areas 3 and 4), the effects of suppression were not credited. Therefore, while the core damage frequency due to internal fires is higher than desired, the methodology as applied has

• resulted in a conservative core damage frequency .

The core damage frequency in several fire areas is reduced due in large part to Palisades plant specific implemen~tion of the requirements of 10 CPR 50, Appendix R. These requirements, including separation of alternate/redundant trains of safe shutdown equipment, fire barriers, and an alternate shutdown location (outside of control/cable spreading rooms) combine to limit the total core damage frequency due to fires. The administrative control of transient combustibles is also a contributing factor to the low fire core damage frequency in certain key areas.

8.1.3 Other External Events There were no other external events identified that have an impact on the core damage frequency at.Palisades. All of the screening criteria used from NUREG-1407and Generic Letter 88-20, Supplement 4 were satisfied. Results of the.Palisades Systematic Evaluation Program (SEP) were used, whenever possible, to complete the evaluation of other external events .

• 8-2

---

::i-- - ---

• 8.2 Conclusions The IPEEE results for the seismic and *other external events analyses are acceptable and do not require any further evaluation or action. The results for the fire IPEEE have conservative assumptions that lead to higher than desired results. Addressing these conser\ratisms is appropriate prior to considering any plant modification at the Palisades plant.

One impact on the assumptions and inputs to the fire analysis is the inputs to the Palisades Appendix R program. The Palisades Fire Protection Section has committed to upgrading the existing Appendix R Program at Palisades. The upgrade includes enhancements to the cable/raceway schedule, completion of circuit analyses to verify operability of key equipment and incorporation of this information into a controlled database. The database will integrate the results of the circuit analyses with other information such as fire area/zone designations, cable designations, raceway locations, etc., into a product that can provide the status of the equipment evaluated in each fire area. This effort is expected to be completed by the end of 1995. The new information will be evaluated for input into the fire risk analysis. Once the fire PRA models have been updated with the revised Appendix R information, the fire risk will be requantified.

Several potential insights/improvements were identified during the various steps of this study.

The following insights are candidates for further studies to see if they provide a reduction in

• overall plant* risk .

1) Review the circuit analyses completed as part of the Appendix R enhancements to verify assumed failures in each fire area;

2) Identify any areas where the current risk may be the result of conservative assumptions not yet addressed;

3) Evaluate alternative methods for providing makeup water sources to the Auxiliary Feedwater system in certain fire areas;

4) Evaluate methods to accomplish the switchover to recirculation from the containment sump in certain fire areas; *

5) Evaluate the possibility of continued operation on main feedwater in certain areas (particularly auxiliary building fires);

6) Evaluate the possibility of more detailed analyses of the control room and cable spreadi,ilg room fires.

Based on requantification results with updated Appendix R information and the results of sensitivity studies in important areas, any changes to plant operation or configuration determined necessary and cost-beneficial will be identified with any requisite implementation schedules by the end of the first quarter of 1996 .

• 8-3