ML18065A757

Rev 1 to IPEEE Rept, Per GL 88-20

ML18065A757
Person / Time
Site:	Palisades
Issue date:	05/22/1996
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML18065A756	List: ML18065A754 ML18065A757
References
GL-88-20, NUDOCS 9606070056
Download: ML18065A757 (271)

Text

':'

• . ~ . *.

ATTACHMENT CONSUMERS POWER COMPANY PALISADES PLANT DOCKET 50-255 INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS REPORT REVISION 1 MAY 22, 1996

INDIVIDUAL PLANT EXAMINATION

__ OF_ EXTER.NAL EVE~TS .....,:_ " -

• * (IPEEE)

MAY 1996 REVISION 1 . . . . .ll"S . . . . . .' '

TABLE OF CONTENTS SECTION 1.0 EXECUTIVE

SUMMARY

1.1 Background and Objectives 1-1 1.2 Plant Familiarization 1-2 1.3 Overall Methodology 1.4 Summary of M~jor Findings 1-4 1.4.1 Seismic Summary 1-4 1.4.2 Fire Summary 1-4 1.4.3 Other External Events Summary 1-5 1.5 R.eferences 1-6 2* * * *-- **

• 1.0 EXECUTIVE

SUMMARY

1.1 Background and Objectives The NRC issued its policy on Severe Reactor Accidents Regarding Future Designs and Existing Plants in 1985,. which concluded that existing nuclear power plants pose no undue risk to the public health and safety and that there is no present basis for immediate action on any regulatory requirements for these plants. However, the Commission recognized, based on NRC and industry experience with plant specific probabilistic risk assessments (PRAs), that systematic examinations are beneficial in identifying plant specific vulnerabilities to severe accidents. *;i:;:;

As part of the closure process for the Severe Accident Program, the NRC issued Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities -

10CFR50.54(f)," (Ref. 1-1) on November 23, 1988, formally requesting that each licensee conduct an Individual Plant Examination (IPE) for internally initiated events, including internal flooding. Then on June 28,1991, the NRC issued Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities:- 10CFR50.54(f)"' (Ref. 1.:2). The objectives of the IPE and the IPEEE are :

similar: *

1) to develop an appreciation of severe accident behavior;

2) to understand the most likely severe accident sequences that could occur under full power operations;

3) to gain a qualitative understanding of the overall likelihood of core damage and fission product releases; and

4) if necessary, reduce the overall likelihood of core damage and fission product

• releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.

Consumers Power has completed and documented the IPEEE f~r Palisades which meets the objectives and requirements of Generic Letter 88-20, Supplement 4 (Ref. 1-2). This report provides a summary of the methodologies, results and conclusions of the IPEEE.

1-1

1.2 Plant Familiarization

• The Palisades IPEEE utilized, wherever possible, information from the Palisades IPE effort . *

(Ref. 1-3) .. This included information on the as-built, as-operated plant. Further walkdowns I . .

were performed and documented to provide additional information required to complete the seismic, fire and other external events analyses.

• The Palisades Plant is located on the eastern shores of Lake Michigan, six miles south of South Haven, Michigan. Construction started on Au~st 25, .1966, and commercial operation began on December 31, 1971.

• • .~ / .

Palisades has a two-loop Combustion Engineering nuclear steam supply system (NSSS) licensed for 2530MWth. The NSSS contains the reactor vessel, pressurizer with two power operated relief valves (PORVs) and three safety relief valves, two steam generators, and four primary coolant pumps. The NSSS is contained within a large, dry, pre-stressed concrete containment building with a 114" carbon steel liner designed by Bechtel Power Corporation.

The containment concrete walls are reinforced and post-tensioned. The plant secondary system has a turbine and generator manufactured by the W estingliouse Electric Corporation and has a* .

maximum electrical output of 845 MWe ...Amore detailed discussion of plant.systems is. _.

• _.

presented Section 3. 4.

1-2

1.3 Overall Methodology

- Palisades followed the guidance for performing the IPEEE provided in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Ref. 1-4) .

The seismic IPEEE is a Level 1 PRA with a containment performance analysis. The appropriate system fault trees and accident event trees from the IPE were used and modified,*

as necessary, for the seismic probabilistic risk assessment (SPRA).

The EPRI Fire-'lnduced Vulnerability Examination (FIVE) methodology (Ref. ::i~5) was used for the fire IPEEE analysis.

The methodology for identifying other external events is consistent with the approach described in NUREG-1407 (Ref. 1-4). The methodology for analyzing other external events used a progressive screening approach .

. Each of the analyses (seismic, fire and other external events) received detailed reviews by .

• plant staff and consultants. Detailed.reviews were performed on the PRA modeling '

• techniques, assumptions and data. These reviews identified areas where the models or data were very conservative and could be revised to provide a more realistic representation of the .*

plant. In addition, detailed reviews were performed on the quantification results (cutset reviews) to identify and correct problems associated with illogical and invalid cutsets.

Detailed reviews were also performed on the overall methodologies for each of the IPEEE analysis to identify consistency among thein and verify that acceptable practices were used throughout the IPEEE.

Details of the specific methodologies are contained in Section 2.3 .and the seismic, fire and other external events section5 of this report.

1-3

1.4 Summary of Major Findings This section s1immarizes the results and conclusions of the Palisades IPEEE. Details of the results and conclusions are presented in Section 8.

1.4.1 Seismic Summary There were no significant seismic concerns identified as a result of the:seismic PRA (SPRA).

The new Lawrence Livermore National Laboratory (LLNL) hazard curves, as contained in NUREG-1488 (Ref. 1-6), were used to evaluate the SPRA. The SPRA meari core damage frequency is 8.88E-06/yr, which is considerably ~ess than the IPE (internal ev,ents) core damage frequency of 5.15E-05/yr. The median fragility (capacity) of the plant is .488g peak ground acc~leration (PGA) and the high confidence of a _low probability of failure (HCLPF) is .217g PGA. Both of these results are higher than the Palisades safe shutdown earthquake design basis of .20g PGA~

A review of the results of the SPRA conclude that:

)) there are no dominant .seismic failure mpdes contributing to the core damage * -

• frequency-; *- : -* * * *- - - -- -- - - -- _- * - - -- * -:- -

• 2) no Accident Classes (functional failures) met- the screening requirements for reportability;

3) non-seismic failures and operator errors are an important part of the SPRA core damage frequency; and *

4) the engineered safeguards equipment are inherently rugged with no seismic vulnerabilities.

1.4.2 Fire Suinmary The Palisades core damage frequency due to fires was calculated to be 3.31E-05/yr. *The fire sequences represent approximately 643 of the CDF for the IPE. It should be noted that these results include a number of conservative assumptions. For example, automatic or manual fire suppression were not credited except in the control room, cable spreading room and Class lE switchgear rooms. Even when suppression was credited, the AFW system was assumed failed due to the fire. Fires were also assumed to completely engulf an area, once ignited, and fail all equipment and cabling within the fire area/zone if not suppressed. No credit was given for continued operation of the main feedwater system for auxiliary building fires. Additional effort to make these and other conservative assumptions more realistic could result in a fire initiated CDF lower than that presented in this report.

More than 89 % of the plant core damage frequency associated with internal fires can be Revision 1, May 22, 1996 1-4

traced to five fire areas: cable spreading room (33.53); main control room (24.43); ID switchgear room (14.7%); turbine building (9.33); and IC switchgear room (7.6%).

1.4.3 Other External Events Summary There were no other external events identified that have an impact on the core damage frequency at Palisades. All of the screening criteria used from NUREG-1407 (Ref. 1-4) and Generic Letter 88-20, Supplement 4 (Ref. 1-2) were satisfied. Results of the Palisades Systematic Evaluation Program (SEP) (Ref. 1-7) were used,. whenever possible, to complete the evaluation of other external events. ,. ... .

\* :

Revision 1, May 22, 1996. 1-5

1.5 References 1~1 NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(t), November 1988

• 1-2 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External

• Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(t), April 1991 1-3 Palisades Nudear Plant Individual Plant Examination (IPE), November:l992 1-4 NUREG-1407, Procedural and Submittal Guidance for the lnd.ividual Pl~t Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 1-5 EPRI Report, Fire-Induced Vulnerability Evaluation (FIVE), April 1992 1-6 NUREG/CR-1488, Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains.

• :-*t-7 *:NUREG-0820, *Integrated Plant Safety Assessment:--Systematic Evaluation Program; Palisades Plant, Final Report, October 1982

• 1-6

TABLE OF CONTENTS SECTION 2.0 EXAMINATION DESCRIPTION 2.1 Introduction 2-1 2.2 Conformance with Generic Letter and Supporting Material 2-2 2.3 *General Methodology  ; ~-3 2.3.1 Seismic Methodology . "2-3 2.3.2 Fire Methodology 2-3 2.3.3 Other External Events 2-3 2.4 Information Assembly 2-4 2.5 References 2-5

2.0 EXAMINATION DESCRIPTION 2.1 Introduction The NRC issued its policy on Severe Reactor Accidents Regarding Future Designs and Existing Plants in 1985, which concluded that existing nuclear power plants pose no undue risk to the public health and safoty and that there is no present basis* for immediate action on any regulatory requirements for these plants. However, the Commission recognized, based on NRC and industry experience with plant specific probabilistic risk assessments (PRAs),

that systematic examinations are beneficial in identifying plant specific vulneht.~ilities to severe accidents. On May 25, '1985, the NRC issued SECY 88-147, "Integration Plan for Closure of Severe Accident Issues," (Ref. 2-1) which identified the following four areas that require licensee action:

1) Individual Plant Examination (IPE);

2) Containment Performance Improvements;

3) IPE of External Events (IPEEE);

4) Severe Accident Management.

• To address the first licensee action, the NRC issued Generic Letter 88.:20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10CFR50.54{f)," (Ref. 2-2) on November 23, 1988, formally requesting that each licen8ee conduct an Individual Plant Examination (IPE) for internally initiated events, including iilternal flooding.

The containment performance improvements were included in the IPE process by Generic Letter 88-20, Supplements 1 (Ref. 2-3) and 3 (Ref. 2-4).

On June 28,1991, the NRC issued Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -

• 10CFR50.54{f)," (Ref. 2-5) to address the third licensee action. The objectives of the IPEEE are similar to the objectives of the IPE:

1) to develop an appreciation of severe accident behavior;

2) to understand the most likely severe accident sequences that could occur under full power operations; *

3) to gain a qualitative understanding of the overall likelihood of core damage and fission product releases; and

4)

• if necessary, reduce the overall likelihood of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.

2-1

2.2 Conformance with Generic Letter and Supporting Material The Palisades PRA group was responsible for performing the IPEEE. This group directed all aspects of the IPEEE including coordination and discussions with other plant departments and outside contractors. Technology transfer from the contractors and all IPEEE related documentation is the responsibility of the PRA group. This allows future revisions or applications of the IPEEE to be performed by plant personnel. Further details of .the plant organization can be found in Section 6 of this report. : .

Consumers Power has completed and documented the IPEEE for Palisades which meets the objectives and requirements of Generic Letter 88-20, Supplement 4 (Ref. 2-5):*:'This report provides a summary of the methodologies, results and conclusions of the IPEEE.

The Palisades IPEEE utilized, wherever possible, information from the Palisades IPE effort.

This included information on the as-built, as-operated plant. Further walkdowns were performed and documented to provide additional information required to complete the seismic, fire and other external events analyses. In addition, independent, technical reviews were performed by outside contractors as well as other plant department personnel.

Sensitivity analyses were performed to identify operator actions or plant equipment that have a significant impact on the core damage analysis. These sensitivity analyses* and results are presented in the discussion sections for seismic, fire or other external events.

2-2

2.3 General Methodology Palisades followed the guidance for performing the IPEEE that is provided in NUREG-1407, *

"Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Ref.. 2-6). The specific methodologies used for each analyses vary a.nd are discussed in this section.

2.3.1 Seismic Methodology Palisades performed a Level 1 PRA with a containment performance analysis to.compete the seismic IPEEE. The appropriate system fault trees and accident everit trees frorii the IPE were used and modified, as necessary, for the SPRA. One additional seismic event tree was created to complete the SPRA model. The fault and event trees were quantified using Logic Analysts SETS computer code (Ref. 2-7). Core damage quantification was performed using the J. R.

Benjamin

. . SHIP computer code (Ref. 2-8). Palisades used the seismic haZard curves developed by the Lawrence Livermore National Laboratory (LLNL) in NUREG/CR-1488 (Ref. 2-9) to calculate the seismic results.

• • • • * -* -2:3.2 Fire,Methodology

• The EPRI Fire-Induced Vulnerability Examination (FIVE) methodology (Ref. 2-10) was used for the fire IPEEE analysis. An abbreviated, Level 1 fire PRA model was developed and used to provide! the core damage frequencies for the FIVE methodology.

2.3.3 Other External E:vents High winds, floods, transportation and nearby facility accidents, and external fires were included in the _external e.vent analysis .. The methodology for identifying. external e~ents is consistent with the approach described in NUREG-1407 (Ref. 2-6). The methodology for analyzing these external events used a progressive screening approach consistent with that described in NUREG-1407.

2-3

2.4 Information Assembly System requirements and containment building information used in the IPEEE was taken from the IPE analysis (Ref. 2-11). In general, the IPE used the FSAR or identified alternate analyses, and utilized the plant procedures and drawings. Plant walkdowns were performed in the IPE to obtain the as-built configuration. Plant.walkdowns were performed to obtain plant information relating to the IPEEE analyses. Differences between the IPE and the IPEEE are discussed in the seismic, fire and other external events sections.

2-4

2.5 References 2-1 SECY 88-147, Integration Plans for Closure of Severe Accident Issues, May 25, 1988 2-2 NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f), November 1988 2-3 NRC Generic Letter 88-20, Supplement 1, Initiation of the Individual Plant Examination for Severe Accidents Vulnerabilities - 10 CFR 50.54 (f), August 1989 2-4

• NRC Generic Letter 88-20, Supplement 3, Completion of Containmeiit'.Performance Improvement Programs and Forwarding of Insights for use in the Individual Plant Examination for Severe Accident Vulnerabilities; June 1990 *

• 2-5 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), April 1991 .

2-6 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External.Events (IPEEE) for Severe Accident Vulne_rabilities 2-7 Set Equation Transformation System (SETS) Program, Developed by Logic Analysts, Inc.

2-8 Seismic Hazard Integration Package (SHIP) Program, Developed by Jack R. Benjamin.

and Associates, Inc.

2-9 NUREG/CR-1488, Revised Livermore Seismic Haiard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains 2-10 EPRI Report, Fire-Induced Vulnerability Evaluation (FIVE), April 1992 2-11 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 2-5

TABLE OF CONTENTS .

SECTION 3.0 SEISMIC ANALYSIS 3.1 Summary 3-2 3.2 Seismic Hazard Analysis 3-4 3.3 Review of Plant Information and Walkdown ....:3-6 3.4 Plant Systems and Structures _ *.. 3-9 3.5 Evaluation of Component Fragilities and Failure Modes 3-23 3.6 SPRA Modelling and Results 3-44

3. 7 Containment Performance 3-67 3.8 Conclusions 3-78 3.9 Other Seismic Safety Issues 3-80 3.10 References. 3-83

Table of Contents

• 3.1.1 Background Section 3.1 Summary.

3-2 3.1.2 Plant Familiarization 3-2 3.1.3 Methodology Description 3-2 3.1.4. Summary of Major Findings 3-1

3.1 Summary

• 3.1.1 Background .

The Palisades IPE (Ref. 3-10) evaluated the effects of core damage frequency and plant response following internally initiated events. The NRC has recognized that externally initiated events may contribute as much or more to the core damage frequency as the internally initiated events~ One of the major external events is earthquakes. Even though Palis.ades is designed to withstand a credible earthquake, the impact on the overall plant response and risk .

profile of beyond design basis earthquakes may differ. The seismic IPEEE helps to understand the plant response and risk associated with all magnitudes of earthquakes, inCIUding those beyond the design basis.

3.1.2 Plant Familiarization Palisades Nuclear Power Plant is designed to withstand the effects of unusual natural phenomena including *earthquakes. The plant was designed to withstand a design basis event (DBE) earthquake (also known as a safe shutdown earthquake [SSE]) with a peak ground acce!eration (PGA) of 0.20 g (203 of gravity)(ReL 3-11). l'he operating basis earthquake -

(OBE) is one-half of the DBE event.

3.1.3 Methodology Description The methodology used in the Palisades SPRA is consistent With NUREG-1407 (Ref. 3-14) guidance for a new SPRA analysis. The SPRA used and modified the existing level 1 PRA developed for th<! IPE. A seismic event tree (Fig. 3. 6-1) was developed that provided a transition to the existing PRA fault and event trees. The SPRA modified the PRA in such a way that the independent subtrees of the internal events PRA were maintained so that the results of each are compatible and directly comparable. Also, a containment performance analysis was performed that used the containment performance data from the IPE and modified

.it, as appropriate, to include the seismic level 1 PRA results.

The seismic analysis was performed in two parts: 1) quantification of the seismic faulttrees and event trees using point estimates for the fragility values; and 2) integration of the plant cutsets with the mean seismic hazard curve and component fragilities to obtain an estimate of the seismic core damage frequency and plant level fragility.

The logic models for the SPRA included seismic failures, random failures and operator actions. To produce an initial cutset equation for integration with the hazard curves and component fragilities, seismic failure rates were estimated using the component fragility for a .

.6g earthquake level. This earthquake level was chosen because it is higher than the expected plant median fragility and provides a high failure rate for seismic components so that important seismic components are not screened out (truncated). The random failure rates were the same 3-2

as the random failure rates for the IPE since an earthquake does not affect the random failure

• rates of a component, and seismic basic events were used to represent earthquake failures. To produce the cutset equation, all post-accident human error probabilities (HEPs) were set to J .0.

so that important operator actions were not screened out (truncated).

The cutsets from the seismic event tree were used as input into the seismic integration program. This integration used the seismic hazard curve to assess the core damage frequency at various seismic ground accelerations. The failure rates of the seismic components and the HEPs were changed to reflect the various ground accelerations. This was accomplished by replacing the point value probability* with a fragility. The seismic structures arid :components used the fragility value assigned them in the fragility analysis. The HEPs were*assigned a non-lognormal fragility as discussed in Section 3.6.5.2.2.

• 3.1.4 Summary of Major Firidings The results of the SPRA confirm the seismic ruggedness of Palisades. The high confidence-of a low probability of failure (HCLPF) for Palisades is .217g. HCLPF is defined as less than a 5% failure probability on the 953 confidence curve. The plant HCLPF is higher than the plant design basis of .20g. No significant seismic concerns. \\:'ere identified as a result _of the seismic PRA .

• 3-3

3.2 Seismic Hazard Analysis The Palisades Seismic PRA implements the mean seismic hazard estimate published by the Lawrence Livermore National Laboratory (LLNL) in NUREG/CR-1488 (Ref. 3-1). This NUREG has been reviewed and accepted by the NRC as the best available information on

• seismic hazard estimates as discussed in NRC Information Notice 94-32 (Ref. 3-2). Fragilities were based on the median spectral shape for a 10,000 year return period provided in

• NUREG/CR-1488. Since the Palisades SPRA relied on a published hazard curve, the details of the development of the hazard curve are not presented in this report. This hazaid curve provides probabilities for ground motion levels from 0.051g through L02g ..

..~.~*

• 3-4

Table of Contents Section 3.3 * .

Review of Plant Information and Walkdo\vn 3.3.1 Plant Information 3-6 3.3.2 Information Sources 3-6 3.3.3 Plant Walkdown 3-7 3-5

3.3 Review of Plant Information and Walkdowns

• 3.3.1 Plant Information The Palisades site is a soil site with the safety-related power block structures founded on dense sands and stiff to very stiff silty clay to an approximate depth of 150 feet. The original dynamic building analyses considered the effects of the soil by use of so-called elastic half space soil springs coupled to the fixed base structural models. As part of the SPRA investigation, the original dynamic building models were used in a modem soil-structure interaction analysis. This analysis obtained amplified floor response spectra (FRS) for the Lawrence Livermore National Laboratory (LLNL) (Ref. 3-1) median ground spectral shape corresponding to the 10,000 year return period for the containment and auxiliary buildings.

The remaining site buildings include~ in the SPRA and housing vital equipment - the Intake Structure, Auxiliary Feedwater Pump Room, and some portions of the Turbine Building - are mostly below grade or at grade. For these buildings, the ground spectrum was used.

The structures and components that were used in the IPE were used in the SPRA. The SPRA model was created by modifying the IPE to remove dependence on the instrument air system (non-s~fety_related ~the turbine b,uilding), whic~ ~as cons~rvatively assumed to fail in all _

seismic events. The use of nitrogen as a backup to instrument air was included in the SPRA model. The structures and components remaining were included in the SPRA analysis ..

3.3~2 Information Sources The Palisades Final Safety Analysis Report (FSAR) was used to.obtain seismic design criteria

-for the DBE earthquake and identify those structures and components that are seismically designed. The safety-related power block structures were originally evaluated by Bechtel Corporation, the Architect-Engineering firm responsible for the Palisades design.

The existing seismic evaluations of the safety-related piping and mechanical_ and electrical equipment were primarily found in the Palisades project engineering files originally developed by the Architect-Engineering firm. Safety related piping was re-evaluated in accordance with requirements set forth in NRC Information Notice 79-14 (Ref. 3-3) piping seismic analysis program. This effort evaluated piping in the as-built configuration in* accordance with then-current seismic-dynamic analysis-procedures. Piping stress summaries and equipment stress analyses were obtained from these files. As-built and original installation drawings were used to obtain routing, equipment weights, and anchorage details.

Original site soil properties, which formed the basis for the study, were obtained from a geological study using soil borings of the Palisades plant site from studies performed by Bechtel Corporation (Ref. 3-4).

3-6

Much of the methodology of the seismic fragility program was based on the procedures described in EPRI Report NP-6041 (Ref. 3-5) which establishes bases for seismic binning and screening of nuclear power plant equipment, mechanical and electrical distribution systems, and power block structures. A great deal of the basis for the procedures in NP-6041

• rests on the Generic Implementation Procedures (GIP) (Ref. 3-6) developed for resolution of the USI A-46 issue. Other supporting documentation for the GIP and NP-6041 that is used for Palisades include EPRI Reports NP-5228 (Ref. 3-7) for anchorage issues, -NP-7146 (Ref. 3-8) for electrical cabinet amplification characteristics, and NP-7147 (Ref. 3-9) for relay generic seismic ruggedness levels.

3.3.3 Plant Walkdowns The Palisades SPRA took advantage of the overlapping requirements between the IPEEE _and USI A-46 programs. Seismic Review Teams (SRT) conducted the Palisades SPRA walkdowns following the walkdown procedures detailed in EPRI NP-6041- (Ref. 3-5). _Each team consisted of two Seismic Review Engineers trained by EPRI both in the A-46 walkdown requirements and also in the IPEEE add-on requirements._

__ Consumers Power (CPCO)_ and Stevenson & Associates-CS<%~) supplied-the-~~is~ic l_leview-~,

Engineers for the walkdown t_eams. The majority of the walkdowns were conducted in July 1993 and August 1993. Subsequent walkdowns took place in April 1994, May 1994, July

• 1994, and March 1995, to complete all of the walkdown assessments.

Specific walkdowns were conducted to evaluate components. For the sake of documentation, all components were treated as if they were A-46 items, even if they were designated as SPRA items only. As such, each component item has a Screening Evaluation Worksheet (SEWS) completed for it in accordance with GIP requirements as well as a fragility value assigned to it.

Safety-related piping, _electrical raceways and ductwork were walked down separately to assess fragility capabilities.- Essential relays-were evalu_ated based on the relay review* and circuit analyses performed by the Palisades USI A-46 program (Ref: 3-25). For relays that were not part of the USI A-46 safe shutdown equipment list (SSEL) but in the SPRA, the USI A-46 screening criteria were used. This consisted of identifying low ruggedness relays in systems that were not chatter acceptable (as identified by USI A-46). In accordance with GIP rules, spot checks were made through0,ut performance of the walkdowns to confirm type (model number and manufacturer), location and installation adequacy. Structural screening walkdowns were conducted to assess the primary site structures and determine building fragilities. -

An independent peer review was conducted by Drs. R. P. Kennedy (RPK) and J. D; Stevenson (S&A) to review the seismic screening and assessment performed by the walkdown teams.

The peer review concluded that the effort is being accomplished in a professional and highly competent manner .

• 3-7

Table of Contents Section 3.4 Plant Systems and Structures.

3.4.1 Front Line Systems Included in the SPRA 3-9 3.4.1.1 Reactivity Control J-9 3.4.1.2 Primary System/Core Heat Removal '~-10 3.4.1.3 Primary System Inventory Control 3-12 3.4.1.4 Containment Heat Removal *~*,**J-12 3.4.2 Support Systems Included in the SPRA 3-13 3.4.3 Supporting Components Included in the SPRA 3-16 3.4.4 Site Buildings Included in the SPRA 3-17

• 3.4.5 Structural Response* 3-1s*

3.4.6 Soil Properties and Soil Failure Analysis 3-19 3.4. 7 Tables for Plant Systems and Structures 3-20

• 3-8

3.4 Plant Systems and Structures This section discusses the development of the plant systems, strucnires and components considered in the SPRA. The systems used in the SPRA along with the components supporting them are presented. Structures containing these systems are identified and their seismic response characteristics are also discussed. Finally, site soil conditions and soil

• stability are presented in this section ..

3.4.1 Front Line Systems Included in the SPRA The front line systems required for mitigating the consequences of a seismic event are a subset of the front line systems that were used in the IPE (Ref. 3-10). The IPE contains the front line system descriptions and fault tree development. Success or failure of the front line systems directly impacts the accident progression. The front line systems are usually event tree headings or referenced as part of an event tree heading definition.. The front line systems directly support one of the general functional areas: 1) reactivity control; 2) primary*

system/core heat removal; 3) primary system inventory control; or 4) containment heat reinoval.

Each of the front line systems has a fault tree. Multiple top events (success criteria) may be present if the front line system provides multiple functions. Fault trees from the internal events PRA were reviewed and modified, as necessary, for use in the SPRA. Changes to the IPE fault trees include recent plant modifications and insertion of seismic e\'.ents. Table 3.4-1 contains a list of the front line systems used in the SPRA.

3.4.1.1 ,Reactivity Control An important safety function_ in response to any plant transient is reactivity control. The systems required for successful reactivify control are control rod drives (CRDs), reactor protection system (RPS), and the charging system.

Control Rod Drives (CRDs)

The primary method for bringing the reactor to a subcritical state is through automatic or manual control rod insertion. Automatic rod insertion occurs as a result of a trip signal generated from the RPS, which disrupts power to the CRDs. Successful control rod insertion rapidly reduces reactor power to decay heat levels.

Reactor Protection System (RPS)

The RPS consists of four independently powered trains of logic circuitry that monitor key plant parameters to detect an off-normal condition. An automatic trip signal is generated if two of 3-9

four values of a monitored parameter reach a specified setpoint. There are nine plant parameters monitored by the RPS.

Charging System If control rod insertion is not successful, then long term reactivity control is accomplished by injecting concentrated boric acid

• into the primary system via the charging system. The system is designed such that any one of the three charging pumps can provide sufficient boron to reduce the reactor power to decay heat levels. The boric acid storage tanks are used as the suction source for the charging system for reactivity control.

3.4.1.2 PCS/Core Heat Removal Primary Coolant System (PCS)/Core Heat Removal is a critical safety function that provides a*

means for removing the core decay heat following a reactor trip. Decay heat absorbed by the PCS must be removed to effectively control PCS temperature and pressure. There are two .*

primary methods for removing PCS decay removal: secondary cooling and core once through cooling (OTC).

Secondary cooling in the SPRA is accomplished by removing PCS decay via the steam generators and the Auxiliary Feedwater (AFW) System. Successful secondary cooling requires a pathway for steam release. The preferred method for steam release is the Turbine Bypass Valve (TBV) or the Atmospheric Dump Valves (ADVs). The SPRA does not consider the use of the alternate secondary cooling method of low pressure feed using the condensate pumps as_

in the IPE. Most of the low pressure feed equipment

. is located in the

. turbine building, which is a non-seismic structure. Also, this equipment is powered from non-lE buses. With a relatively high potential for loss of off-site power, the equipment is assumed to be unavailable following a seismic event. .

Emergency procedures specify that OTC be initiated whenever secondary cooling is not.

successful at core decay heat removal. OTC requires the operator to: 1) depressurize the PCS using the Power Operated .Relief Valves (PORVs); 2) initiate and verify adequate High Pressure Safety Injection (HPSI) flow to replenish coolant losses out the PORVs; and 3) verify successful recirculation frorn the containment sump upon depletion of the Safety Injection and Refueling Water Tank (SIRWT).

The following front line systems support PCS/core heat removal.

Auxiliary Feedwater (AFW)

The emergency design function of the AFW system is to provide heat removal for the PCS when the main feedwater system is unavailable. The AFW system provides feedwater to the secondary side of the steam generators. Water from any of the three AFW pumps can feed 3-10

either steam generator. Successful secondary cooling via AFW is flow from at least one pump to at least one steam generator. The AFW system consists of two motor-driven and one steam-driven pumps. Each of the two vital AC busses supplies power to one of the motor-driven AFW pumps. Steam for the steam-driven AFW pump is automatically supplied from the B steam generator and can be manually supplied from the A steam generator.

Turbine Bypass-Valve (TBV)/Atmospheric Dump Valves (ADVs)

The TBV exhausts directly to the main condenser. The TBV will not be available in cases where the Main Steam Isolation Valves (MSIVs) are closed or loss of off-site power occurs .

. The capacity of the TBV is 5 % of full power steam flow. There are four AD Vs that automatically exhaust to the outside atmosphere, two ADVs on each steam generator. The total capacity of the ADVs is 30% of full power steam flow. All five valves are normally in the automatic mode with the capability of manual control from the control room. The four ADVs also have the capability to be manually controlled from the engineered safeguards control panel. Besides opening to relive decay heat, the ADV s are required to close to maintain steam pressure to supply the turbine driven AFW pump. The SPRA assumes that if an ADV fails to close, steam generator depressurization occurs and that the operator will respond to this excessive demand event by isolating AFW flow to the affected .steam generator.

Power Operated Relief Valves (PORVs)

• The PORVs provide the PCS heat removal path when OTC is initiated. Without a heat removal path, OTC would not be successful. There are two PORVs designed to relieve sufficient PCS inventory to protect the PCS from overpressurization during abnormal transients. The PORVs are solenoid operated power relief valves located in parallel lines off the top of the pressurizer. These lines exhaust to a relief line that discharges to the quench .

tank. A ~otor operated isolation valve (block valve) is located in each PORV line. Both the power operated solenoid valves and the motor operated block valves are powered from safety busses. The plant operates with the PORVs and the block valves norn'lally closed. Operation of the PORVs for OTC requires opening the block valves and the PORVs. Operation of the block valves requires the operator to supply power to the block valves by closing breakers in the cable spreading room and operating a control switch in the control room. Operation of the PORVs requires the operators to tum a control switch in the control room. Successful

• operation of the PORVs is opening at least one train (one PORV and its block valve).

High Pressure Safety Injection (HPSI)

Initiation of OTC requires PCS inventory control beyond the capability of the charging system.

The HPSI system provides this inventory control during OTC. The HPSI system provides borated water from the SIRWT. Upon depletion of the water in the SIRWT, suction is automatically switched over to the containment sump. Manual alignment of the containment sump is available from the control room upon failure of the automatic switchover function.

3 There are two motor-driven HPSI pumps. Each pump is powered from a different safety bus.

Successful HPSI is operation of at least one pump during injection from the SIRWT and the operation of at least one pump, the engineered safeguards room coolers, HPSI pump cooling and successful transfer of pump suction to the containment sump during the recirculation phase.

.3.4.1.3 PCS Inventory Control The principle medium used for core decay heat removal is the PCS liquid inventory.

Therefore, it is important to maintain adequate PCS inventory for successful core decay heat removal. During normal reactor shutdowns, the charging system is used to mai.lltain the PCS inventory due to cooldown and shrinkage. The charging system cannot maintain sufficient PCS inventory during OTC. Therefore, the SPRA relies on the HPSI sy*stem to maintain

• sufficient PCS inventory for successful core decay heat* removal. There are two modes of operation for successful PCS inventory control using HPSI: 1) injection from the SIRWT; and

2) recirculation from the containment sump. The HPSI system, both injection and recirculation, are discussed .in Section 3.4.1.2.

3.4.1.4 Containment Heat Removal .

OTC results in energy release into the containment, which leads to higher containment temperature and pressure. To maintain containment pressure below design limits and guard against excessive temperatures, adequate heat removal must be provided. Containment heat

• removal is accomplished by using the Containment Air Coolers (CACs) or the Containment Spray (CS) System. Successful containment heat removal is operation of one CAC train or one CS pump.

Containment Air Cooler (CAC) System The CAC system is designed to limit the containment building pressure rise and reduce the

. leakage of airborne radioactivity by providing a means of cooling the containment atmosphere.

Success of the CAC system is operation of one train. There are four trains or cooling units located in the containment building. Only three of them are safety related and used during accident scenarios. Successful operation of a cooling units is: 1) having at least the accident rated fan remain on; and 2) have the high capacity discharge service water valve open.

Success also requires that the Service Water System is operational.

Containment Spray (CS) System The CS system is designed to remove heat and condense vapor from the containment atmosphere during accident conditions. The CS system pumps borated SIRWT water or cooled containment sump recirculated water into the containment atmosphere as a spray. The sump water is pumped through the shutdown cooling heat exchangers, which is cooled by the 3-12

• • Component Cooling Water (CCW) System, to remove the heat from the containment. The CS water is discharged into the containment through spray headers and nozzles. The spray headers are supported from the roof trusses and the nozzles are arranged to provide complete .

spray coverage of the containment cross-section. . There are three CS pumps. Two are powered from the same safety bus and the third is powered from the other safety bus. Success*

of the CS system requires operation of one pump and its associated header and nozzles along with one shutdown cooling heat exchanger.

3.4.2 Support Systems Included in the SPRA The support systems required for the SPRA are a subset of the support systefilS:;fuat were used in the IPE (Ref. 3-10). The IPE contains the support system descriptions and fault tree development. Support systems are required for the proper operation of the front line systems.

The support systems are used as inputs into the front line systems.

Each of the support systems has a fault tree. Multiple top events (success criteria) may be present if the support system provides multiple functions. The IPE fault trees were reviewed and modified, as necessary, for use in the SPRA. Table 3.4-2 contains a list of the support

. systeqis. used in the. SPRA, Actuating Relays The actuating relays are comprised of four groups that initiate various safety *functions. The actuating relays have two separate trains that initiate their respective safety train. The four relay groups are:

• 1) containment high pressure (CHP) relays which trip the reactor, actuate the SIS relays, initiate containment spray and initiate containment isolation;

2) safety injection system initiation (SIS) relays which provide a signal to valves and actuate either the SIS-X or the DBA relays;

3) safety injection system actuation (SIS-X) relays which provide an initiation.signal to all safety injection equipment if off-site power is available; and *

4) design basis accident (DBA) or shutdown sequencers which provide a timed, sequenced initiation signal to all safety injection equipment when off-site power is lost and emergency power is available.

Component Cooling Water (CCW)

The CCW system is designed to cool components carrying radioactive and potentially radioactive fluids. It provides a monitored intermediate barrier between these fluids and the 3-13

service water system which uses Lake Michigan water as its cooling medium. The CCW system is closed loop consisting of three half-capacity motor-driven pumps and two half-capacity heat exchangers. The CCW system is continuously monitored to detect radioactivity that may leak into the system.

Condensate Storage Tank (CST)

The CST (T-2) provides two services: 1) makeup to and surge capacity for the main condenser; and 2) AFW pump suction. The CST is an outdoor tank with an approximate capacity of 126,000 gallons. Technical Specifications require 100,000 gallons:between the CST and the primary system makeup tank (PSMT). The low level setpoint fo1<the CST is around 60,000 gallons, which is sufficient to accommodate approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of decay heat removal.* Manual makeup to the CST is supplied by the PSMT (T-81, 75,000 gallons) or the demineralized water storage tank (T-939, 300,000 gallons). Makeup to the CST from these tanks requires operation of transfer pumps that rely on off-site power. If off-site power is lost, the operators can cool the primary system by initiating shutdown cooling prior to CST .

depletion or provide alternate suction for the AFW pumps. Alternate suction for the AFW pumps can be provided by the fire protection system (FPS). Additionally, alternate suction for P~8C can be provided by the SWS. _

Electrical Distribution System The electrical distribution system is designed to supply and power plant components during start-up, power operations, shutdown and emergency operations. The electrical distribution system uses two emergency diesel generators to provide a dependable on-site power source

• capable of starting and supplying essential loads to safely shutdown and maintain shutdown of the plant. Reliability of the emergency power is assured by the two-channel concept where independent electrical controls and sources of power supply redundant AC and DC engineered safeguards ioads. * **

Fire Protection System (FPS)

The FPS. is included in the SPRA for two of its capabilities: 1) backup AFW pump suction supply; and 2) backup/cross-tie to the critical service water system. The FPS consists of two diesel-driven pumps and one motor-driven pump. Each of the diesel motors has its own diesel tank and starting circuits.

The backup supply to the AFW system provides direct suction water to the AFW. pumps P-8 A&B, and indirect suction (via the CST) to P-8C. The FPS line is connected to the P-8 A&B suction header through two, hand-operated valves in series and underground piping. This cross-tie line is connected to the fire protection ring header .

• 3-14

The fPS backup to service wateds via separate, tornado protected lines, with a manual valve to each of the critical service water headers. These cross-tie lines are connected to the fire protection ring header. .

HV AC to the Engineered Safeguards Systems (ESS) Rooms This system provides cooling for the protection of the engineered safeguards (ES) equipment .

. Each ES room has redundant fans to maintain suitable service conditions for the equipment inside the rooms. Each room consists of one cooling train. Each cooling train has a cooling unit, two fans (each with its own damper), and a connection to the service*water.system. Each

• train of fans is powered from a different emergency power bus. Room cooling; is automatically actuated via temperature detectors in the room. -*

High Pressure Air (HPA)

The HPA system provides high pressure air for cylinder-operated valves in the ES rooms, principally, the suction valves for the ESS pumps. There are three trains of HPA that are normally separated. These thr~e trains can be cross-tied in an emergency. The HPA system .

. air receiver$ are designed with enough capacity. to allow *each valve to stroke in,one direction with the air compressors unavailable.

Main Condenser The main condenser is used to condense the steam from the steam generators flowing through the turbine bypass valve* (TBV). Without the main condenser, the TBV could not be used as a steam release path from the steam generators. The circulating water system is the closed cooling system for the main condenser that is required to maintain condenser vacuum and

. transfer heat to the c_ooling towers. The main condenser is not available. following loss of off-site power.

• Service Water System (SWS)

The SWS is designed to supply Lake Michigan water (ultimate heat sink) fot removal -of waste heat from the plant during start-up, power operation, shutdown and emergency .conditions.

The SWS.is divided into two critical and one non-critical headers. The SPRA models isolation of the non-critical header and operation of the two critical headers. The SWS consists of three*

motor-driven pumps: two powered from the same safeguards bus and one from the other safeguards bus. Each pump discharges into a header where each of the critical headers can be fed from. Therefore, any pump can supply water to either critical header.

The SWS can also be used to provide suction water to the AFW pump P-8C following depletion.of the CST.

• 3-15

Safety Injection and Refueling Water (SIRW) Tank and Containment Sump The SIRW tank contains a minimum of 250,000 gallons of borated water. This is sufficient to provide a shutdown margin of 5% with all control rods withdrawn and a new core. The tank has two full-capacity discharge lines that feed the two trains of engineered safeguards equipment. Upon reaching a low SIRW tank level, a recirculation actuation signal is generated which switches the engineered safeguards equipment suction from the SIRW tank to the containment sump.

• The containment sump is located directly below the reactor cavity at the lowe~~ elevation of the containment building. This allows any water in the containment to be collectedin the sump for recirculation. Upon recirculation, the engineered safeguards equipment uses* the sump as the source of water for injection. There are two full-capadty lines that feed the two trains of engineered safeguards equipment. Sump water is cooled by the engineered safeguards system .

by the shutdown cooling heat exchangers.

Containment Isolation System (CIS)

The CIS is designed tp minimize the release of radioactivity from the containment to-the atmosphere following an accident. Isolation valves are provided in all process systems that penetrate the containment. Electrical penetration also provide containment building isolation while allowing electrical power to be fed inside the containment. The CIS valves are repositioned upon a CIS actuation signal which is initiated by a containment high pressure or high radiation.

Reactor Cavity Flooding (RCF) System The reactor vessel is located within a concrete cavity which has a network of floor drain piping feeding into it. This piping is designed to CQllect and transport a portion of the containment .

spray water into the reactor cavity. This water floods the reactor cavity and cools the outside of the reactor vessel. This system is not modelled in core damage sequences, but is used in the containment performance and consequence analyses.

3.4.3 Supporting Components Included in the SPRA Several components were included in the SPRA for their seismic capacity and impact on the a

plant following seismic event. Palisades specific components include: piping; electricai raceways and HVAC ducting.

Piping Numerous systems were identified as being considered in the SPRA. These systems were reviewed to determine if the mechanical piping is seismically designed. Seismically designed

• 3-16

piping at Palisades can be screened out at a relatively high value of acceleration as discussed in Section 3. 5. 2. 3 .1. As part of the IPEEE walkdown, a candidate piping system was walked down from end-to-end to verify design adequacy. Piping inertial failure is generally not the issue, rather inadequate piping system flexibility and*excessive relative support deflections are more likely contributors to seismically induced failures. Specific items which could diminish seismic capaciry include: . * - .

• threaded or Victualic connections cast iron pipe inflexibly attached branch lines excessive nozzle loads proximity of valve operators to structures,. components and other systems poor supports **

lack of flexibility across seismic gaps The service water and main steam lines were walked down in detail. Also, in general, other piping systems were observed during the course of the walkdowns for these concerns .

.* Electrical Raceways**. . . - "'

' The electrical raceways at Palisades were* inspected in detail. All areas were walked down in accordance with the guidance of Section 8 of the GIP (Ref. 3-6). All walkdowns were documented in Plant. Area Summary Sheets (PASS) and representative, bounding support hangers were selected for ductility and load capacity evaluations referred to as limited

. analytical reviews.

HV AC Ducting

. * .."/ .* . . .

Puctwork was inspected, in general, throughout the site buildings. The major concern in these

.inspections is anchorage adequacy and support details, such as no missing bolts or connections.

As noted, all areas were.generally inspected. Particular attention was given to ducting in two areas: 1) inside containment; and 2) inside the battery rooms where collapse could short circuit

. the emergency station batteries.

3.4.4 Site Buildings Included in the SPRA All buildings which contain either SPRA front line systems, support systems or supporting components are also included in the SPRA. A site walkdown of the structures was performed by Stevenson & Associates *(S&A). The buildings included in the assessment walkdown were:

Containment Structure and its Internals Auxiliary Building Auxiliary Feedwater Pump Room

• 3-17

Turbine Building Intake Structure.

The evaluations were made in accordance with NP-6041, Table 2-3 (Ref. 3-5). Field walkdowns supported by a thorough review of the Palisades FSAR (Ref. 3-11), seismic stress evaluations by Blume (Ref. 3-12), and design calculations generated by the Palisades Architect-Engineer, Bechte~ (Ref. 3-4).

3.4.5 Structural Response The original design basis earthquake (DBE) or safe shutdown earthquake (SSE)':seismic analysis floor response spectra (FRS) at the Palisades site is based on simpk dynamic models and soil springs, with peak input ground acceleration of 0.20g .. The IPEEE seismic motion of interest for the SPRA would necessarily be well in excess of the design basis PGA. Given the availability of advanced Soil-Structural-Interaction (SSI) analysis techniques, and that the analysis for IPEEE should be as realistic as possible, the FRS were developed using three-dimensional SSI analysis instead of scaling from the design basis response spectra.

_The FRS generation and *the soil structure interaction analysis were performed according to ,the requirements of the NRC Standard Review Plan (SRP) except:

(1) For the IPEEE input time history generation from the response *spectrum, the time

• history does not envelope the prescribed response as required in the SRP. Instead, the time history matches the response spectra on average.

(2) The variation of soil shear modulus uses the recommendations provided by GEi Consultants for this project instead of the requirement in the SRP.

• (3) The spectral amplitude of the horizontal acceleration response spectra i,n the free field at the foundation depth is not limited by the required 60 3 of the corresponding design response spectra at the finished grade in the far field.

In cases where the SRP does not specify guidance, the performance of the SSI analysis relied on ASCE Standard 4-86 (Ref. 3-13) .

. Uniform hazard spectra were used for the seismic input. In accordance with the provisions of NUREG-1407 (Ref. 3-14), the median shape for the 10,000 year return period as provided by the Lawrence Livermore National Laboratory Revised Eastern Seismicity Report (Ref. 3-1) was used for this study. Structural damping for all modes was set to 7 3 in accordance with the recommendation of NP-6041 (Ref. 3-5). The FRS for the 10,000 year median shape are provided in Appendix S 1 of NP-6041.

Selection of Peak Ground Acceleration for SSI Analysis

• 3-18

The exact PGA value used in the SSI analysis to generate the FRS required consideration of the likely range for the plant median fragility. The FRS generated by the SSI analysis is used to scale the componentseismic capacity to the ground level PGA thereby establishing the median fragility level. If the SSI analysis were linear, the selection of the PGA would not matter because the ratio between the zero period acceleration (ZPA) of the FRS and the PGA would be constant. However, the SSI analysis process is non-linear due to the d,ependency of soil properties on shear strains. Scaling up inserts additional conservatism into a process seeking to realistically portray the seismic ruggedness of the plant. Thus, the selection of a single PGA for development of in-structure response spectra was an important decision.

• The input PGA level should be selected to match the range of acceleration levels *that:contribute most to the core melt frequency. However, this acceleration level is not laiowji Until the SPRA analysis is done. Therefore, it must be .selected based on best judgment and expert opinion. After consultation with Dr. John W. Reed, the value selected was 0.4g. Results of the SPRA indicate that the highest contribution to core damage frequency occurs.in the range

• of .35g to .45g PGA (Section 3.6.5.3.5).

3.4.6 Soil Properties and Soil Failure Analysis

. NUREO 14:07 (Ref..3-: 14) specifically requir~s .the c_onsideration of soil_ failure effects in the -

• seismic IPEEE. Soil failure effects were considered from two perspectives: 1) soil liquefaction potential; and, 2) differential soil displacements under seismic conditions as an input to buried component fragilities.

The stratigraphy of the Palisades site consists of the following strata starting from the existing site grade of EL 589 feet: about 25 feet of dense, brown fine sand with a trace of medium sand and gravel (dune sand); about 20 feet of den5e to very dense, gray fine sand that grades wifu..

depth to silt (fine sand/silt); about 15 feet of stiff, gray silty clay;90-100 feet of very stiff to hard silty clay and/or clayey silt with sand and gravel (glacial till); and 10-15 (eet of weathered shale followed by unweathered shale. The surface of the weathered shale is at about El. 440 feet.

GEi (Ref. 3-16) estimated the shear wave velocities and reported best estimate shear wave velocities of the dune sand and gray fine sand/silt as 750 fps and 900 fps, respectively. The clay stratum shear wave velocity was estimated at 1000 fps. The lower till strata estimated shear wave velocities tange from 1400 to 1800 fps from the upper to lower (deeper) part of the overall till stratum. The shale's shear wave velocity was estimated to be 9500 fps .

• 3-19

3.4. 7 Tables for Plant Systems and Structures Tab.le 3.4-1 List of Front Line Systems Used in the SPRA

• I ACRONYM IFRONT LINE SYSTEM I

' .. ,\.~~-~~/

-. ~:

ADV/TBV Atmospheric Dump Valves/Turbine Bvpass Valve**

AFW Auxiliarv Feedwater System CAC Containment Air Coolers CHRG. Charging System

• CRD Control Rod Drives cs Containment Spray System

• HPSI High Pressure Safetv lniection PORV Power Operated Relief Valves RPS Reactor Protection System 3-20.

Table 3.4-2 List of Support Systems Used in the SPRA IACRONYM. I SUPPORT SYSTEM I

ARS Actuating Relay System .. ...

.~ .; *'

• *4-*

ccw Component Cooling Water System CIS Containment Isolation System CST Condensate Storage Tank

.. ~ ..

EDS Electrical Distribution System FPS Fire Protection System HPA High Pressure Air HVAC-ESS HV AC - Engineered Safeiruards System MC Main Condenser RCF Reactor Cavity Flood System SIRWT Safety Injection and Refueling Water Tanlc sws Service Water System 3-21

Table of Contents *

. - _Section 3.5 Evaluation of Component Fragilities and Failure

. . Modes 3.5.1 Screening Criteria 3-23 3.5.1.1 Component Screening 3-23 3.5.1.2. Relay Screening *-3-24 3.5.1.3 Structural Screening  :'.-_-3-24

,* : ~

3.5.1.4 Potential Seismic Interaction Screening . .,;\.~'t-3-24

• .r-..:

3.5.2 Fragility Analysis Results 25 3.5.2.1 Simplified Fragility Analysis Methodology 3-25 3.5.2.2 Detailed Fragility Analysis Methodology 3-26 3.5.2.3 Fragility Evaluation Results 3-26

.. --3!5.2.3~1- - _.Screened-- _Co~ponents

• -* . - ' - _- -* 3-26. _,

3.5.2.3.2 Detailed Fragilities 3-31 3.5.2.3.3 Seismically Induced Initiators 3-32 3.5.3 Surrogate Fragility - 3-35 3.5.4 Tables.for Component Fragilities ~d Failure Modes 3-36 3-22

3.5 Evaluation of Component Fragilities and Failure Modes The development of fragility values for components and structures in the Palisades SPRA proceeded through a three phase process: 1) component screening; 2) simplified fragility analysis; and, 3) detailed fragility analysis. This three phase consideration of the seismic ruggedness of plant components and structures effiCiently concentrated attention on those items i most significant to the overall assessment of seismic risk.

All equipment was screened using the first and second columns in Table 2-3 in EPRI Report NP-6041 (Ref. 3-5). The screening approach utilizes the experience gained 'in performing seismic margin assessments (SMAs) to screen components out of a SPRA. Meeting the caveats for these components ensures that they may be ass~gned a fragility with a median peak 5-percent damped spectral acceleration capacity of l.8g or l.2g - which are equivalent to l.08g (.5g HCLPF) or 0.7g (.3g HCLPF) PGA, respectively - with a combined logarithmic standard deviation, be, value of 0.30. Equipment not screened in one of these two screening lanes was assigned a fragility with a median peak spectral acceleration capacity of 0.4g, equivalent to 0.22g (.lg HCLPF) PGA, with a combined logarithmic standard deviation, be, value of 0.30.

The potential for seismic interaction hazards resulted in specific seismic failure events modelled in the SPRA. Thus, the individual component fragilities represented the inherent seismic ruggedness of the components, independent of any seismic interaction hazards. The fragility of the interaction hazard, such as a masonry block wall, applied to the hazard as an independent component. This interaction component was associated with the failure of the affected components. Section 3. 5. 1.4 discusses the screening of the potential seismic interaction hazards.

3.5.1 Screening Criteria All components, structures and potential interaction hazards received a walkdown to provide a screening value: This screening value was used to identify how to incorporate the various items into the SPRA.

3.5.1.1 Component Screening During the detailed plant walkdowns, the SRT engineers assigned a screening value to every component in the SPRA. EPRI NP-6041 (Ref. 3-5) supplied the framework for the screening decision making. Although the seismic margins procedure characterizes seismic ruggedness as high confidence of a low probability of failure (HCLPF), the direct relationship between HCLPF and median fragility supports the use of this reference in performing SPRA component fragility screening .

• 3-23

Application of the screening* guidelines to SPRA items resulted in the following categories:

1) screened out at the l .2g screening level;

2) screened out at the 0.8g screening level, but does not. meet the l.2g criteria;

3) does not meet the 0.8g screening criteria, but the item is also in the A-46 program and meets design basis;

4) does not meet the 0.8g screening criteria, and the item is not in the A-46 program.

Follow up anchorage analysis verified inclusion at either screening level, or pro<luced a fragility value for individual components. ..

.; ~- : .

Based on the results of the walkdowns, all components meeting the first screening level were screened out, and the balance were explicitly considered within the SPRA. All screened out components were represented by a single surrogate element in the SPRA.

The Surrogate Element The SPRA included a single surrogate element representing the aggregate effect of all screened out components.* The* surrogate element appears as a top heading-in the seismic event tree with failure leading directly to core damage.

3.5.1.2 Relay Screening The USI A-46 program at Palisades (Ref. 3-25) performed a relay chatter evaluation. The relay evaluation was performed in accordance with Section of the GIP (Ref. 3-6). Since bad actor relays were identified as a result of the USI A-46 relay review, a relay review was performed for those systems/relays that are in the SPRA but not in the USI A-46 scope. The SPRA included specific seismic modelling for each bad actor relay identified as a result of

• either review. Those relays that were not identified as bad actors were screened out and were explicitly modelled in the SPRA.

3.5.1.3 Structure Screening There are five structures included in the SPRA: 1) reactor building (containment building); 2) auxiliary building (AB); 3) turbine building (TB); 4) AFW pump room; and 5) intake structure (screenhouse). The containment building, AB and AFW pump room are seismically designed structures and screen out for inclusion in the surrogate element. However, the Palisades SPRA models the containment building and the AB as top headings in the seismic event tree. The TB and screenhouse did not meet the screening criteria for inclusion in the surrogate event and had simplified fragility analyses performed.

3-24

3.5.1.4 Potential Seismic Interaction Screening The only credible potential seismic interactions identified at Palisades were*masonry block walls. The masonry block walls did not meet the screening criteria for inclusion in the surrogate event and had simplified fragility analyses performed.

3.5.2 Fragility Analysis Results The Palisades SPRA implemented the concept of simplified fragility analysis as a means to .

bridge the gap between the summary level of the screening methodology and detailed fragility analysis. This approach improves on the use of industry generic fragilities by*,fuciuding plant specific analysis in the determination of median seismic capacity.

• 3.5.2.1. Simplified Fragility Analysis Methodology Simplified fragility analysis concentrated on_determining the median seismic capacity taking actual plant specific conditions into consideration. All simplified fragilities used the same

• value for an estimated combined uncertainty (bJ = 0.40. Techniques used in simplified fragility analysis included:

. 1) Detailed anchorage anal¥sis;

2) Factoring analysis;

3) USI A-46 equivalency analysis; and, *

4) Detailed stress analysis.

Anchorage considerations relied heavily on the availability of detailed and bounding analyses performed for components also within the USI A-46 examination program. For cases where the_ USl A'4Bresults were notavaifable~.the*SPRA capacity assumed tha( components minimally met the USI A-46 requirements using equivalency analysis The SPRA treated the USI A-46 values as equivalent to a HCLPF for purposes of establishing median capacity fragilities.

Factoring analysis converted available design analysis results to median capacity fragilities substituting the IPEEE in-structure floor spectra for the existing design spectra as applicable.

Factoring separates out the seismic component from other design loads, such as dead load and live load, following the methodology outlined in EPRl NP-6041 (Ref. 3-5).

The availability of IPEEE in-structure floor spectra reflecting the favorable impact of soil structure interaction analysis made the simplified fragility analysis concept a productive intermediate step for this SPRA. In general, conservative assumptions of seismic capacity yielded attractive seismic fragility values. Component capacity values came from one of the

' following sources:

3-25

1) Available calculations, or reports of previous seismic analysis and tests;

2) Detailed anchorage analysis performed for the SPRA floor spectra;

3) Generic Equipment Ruggedness Spectra (GERS);

4) Application of the lower EPRI NP-6041 screening lane (0.8g); or

5) Equivalency to the minimum GIP demand (A-46 components only).

The estimated fragilities coupled an estimated median capacity (Am) with an estimated logarithmic standard deviation (bJ accounting for both randomness (br) and uncertainty (bu) ..

_Examination of east coast earthquake records suggested that an adjustment to the. commonly selected value for be would be appropriate to account for a higher degree of v~~bility in the peaks and valleys. This examination suggested that a more appropriate value :fer the br associated with the randomness of the peaks and valleys of seismic records would be 0. 29.

Because this site is a mid-western, low seismicity site and a soil site like many western US sites, br was set to 0.18. This corisiderat1on resulted in the selection of be = 0.40 for use with all ~ut the detailed fragilities.

3.5.2.2 Detailed Fragility Analysis Methodology I~ems which could not be screen~d out or could not have a simplified fragility analysis performed, required a detailed fragility analysis. The detailed fragility analysis consisted of

• performing calculations to determine their seismic capacity. Fragilities were calculated based on the results of the seismic capacity calculations .

Detailed fragility analysis also calculated the uncertainty to be included in the SPRA. The uncertainty is expressed as a logarithmic standard deviation (bJ accounting for both randomness (br) and uncertainty (b) .*

3.5.2.3 Fragility Evalu~tion Results.*

Table 3.5-1 presents all of the components in SPRA that were not Screened ou*t (included in the surrogate event). The table also presents the fragility value used in the SPRA quan.tification and whether it was a screening value or a detailed fragility.

3.5.2.3.1 Screened Components This section presents the general categories of components that were screened out at a 1. 08g PGA median fragility and represented by the surrogate event. Supporting justification for this screening level is also provided. General categories that use a generic type of fragility value (such as small break LOCA) are also presented in this section .

• 3-26

Relays A detailed relay review was performed for the USI A46 program (Ref. 3-25). The results of

• that review identified bad actor relays (outliers) at Palisades. Since bad actors were found in the USI A-46 scope, the scope of review was expanded to include the additional systems (and associated relays) in the SPRA. After functionally screening out relays (circuits) for which relay chatter is not an issue, no additional bad actor relays were found. All of the bad actor relays will be dispositioned through the USI A-46 program. Following the disposition, the SPRA assumes that all of the relays will be screened out and no relay-specific _modelling is required. Therefore, no bad actor relays were modelled in the SPRA. -~

~. :;~*~ .

Masonry Block Walls The availability of recent detailed calculations for masonry block walls developed under the IEB 80-11 program (Ref. 3-17) at Palisades provided a ready reference for the determination of estimated fragilities. Conservatively, the block walls were assigned a HCLPF capacity equal to the design basis peak ground acceleration. This value was then factored in accordance with the guidance in EPRI documents (Ref. 3-18) to obtain a median capacity with an associated be = 0.40. All such block walls were found to have HCLPF capacities well in .

excess of the surrogate element capacity. Therefore, no block walls were.explicitly modelled in the SPRA, but were all represented by the surrogate .element. .

• Building Structures The structures for the Palisades site considered in the SPRA are the containment building, auxiliary building (AB), iritake structure (screenhouse), turbine building (TB), and the AFW pump room. The AB is founded on a single shallow mat foundation at approximately El. 587' (plant grade elevation is El. 589'). The containment building, TB and AFW pump room are embedded approximately 21' to 2r: The screenhouse is fairly deeply embedded at approximately 40' below grade. These buildings are Category I structures except for portions of the TB and screenhouse, which are designated as Category III structures. Category III indicates that the structure is not related to reactor operation or containment; however, it is designed for seismic loads corresponding to SSE ground response spectra (0.20g PGA). It was determined that this results in meeting the condition cited in Note (k) of Table 2-3 of NP-6041 (Ref. 3-5) and, thus, the Category III structures were initially screened out using the first column in Table 2-3.

• Subsequently, using the building story shears and moments based on the soil-structure interaction analysis, the IPEEE demand moments and shears (Ref. 3-19) were scaled based on the design basis moments and shears as given in Figure 5.7-6 of the FSAR (Ref. 3-11) and the SEP Seismic Review (Ref. 3-20). In the case of the TB, this scaling was accomplished based on design accelerations as no story shears or moments were documented. The scaling using the excess margin for these structures ensures that the structures may be represented by a 3-27

surrogate element with a median peak ground acceleration capacity of 1. 08g with a combined logarithmic standard deviation, b1:, value of 0.30.

The AFW pump room, TB and screenhouse are represented by the surrogate element in the SPRA with a median peak ground acceleration capacity of l.08g, with a composite logarithmic standard deviation of 0. 30.

The AB and containment are specifically modelled in the seismic event tree as top headings.

Failure of either of these buildings leads directly to core damage. These were explicitly modelled in the seismic event tree because they impact the containment isolatfon system and, therefore, affect the containment performance analysis. *~:_;~~*

Building Separation Although the design philosophy for the critical structures was separation by providing a gap between buildings, some interconnection still resulted. This was recognized _in the original

• design and three analysis cases were investigated as described in the FSAR (Ref. 3-11) for the possible interaction between the TB and AB. The first case was to consider the buildings tied together at the operating floor by encasement of the secondary columns of the TB frame. It was determined that if the TB transfers its loads tO the AB, that both buildings would survive (not collapse). The second case investigated the situation where both buildings are free-standing, and considered the _effects of interaction due to closing the gap between them. This gap was predicted to close due to design basis seismic loads, so a third case was investigated in which the turbine pedestal acts as a restraint to the TB at the operating floor level which is .*

elevation 625' .

Based on the third case investigation, it was concluded that the buildings will not interact *

• (close the gaps); however, on_the opc;:ratll!g floor elevation outside of the-control room where the TB moment resisting frames butt up against the control room wall (which is part of the AB), there is no gap. This is not considered a structural concern given the aforementioned analyses, but it is an impact concern which leads to a concern over the essential relays

• contained in the cabinets in the main control room. Given that relay functionality is a major issue, this structural impact potential cannot be ignored in the main control room. This is not judged as an issue elsewhere (in other rooms) at the Palisades plant - it is only an identified as*

an issue in the main control room area.

A similar, but more severe building interaction exists at another power plant (Ref. 3-21). In that case, the columns of the TB are in contact with the floor of the AB along an entire elevation. On that elevation, the switchgear room (with numerous relays) is immediately adjacent to this building interface column line. The referenced calculation showed that the effects of the impact do not appreciably increase the floor response spectrum in the switchgear room area and the peak spectral accelerations associated with the impacts, although in a different frequency range from the seismic spectral peaks, do not exceed (remain below) the

• 3-28

seismic peak spectral accelerations. Based on that detailed evaluation, this interaction was judged less severe than the interaction at the other plant by the SRT. The peer reviewers, also familiar with the other plant's evaluation, agree with the SRT on this issue.

Reactor Vessel Internals and Control Rod Drive Housing and Mechanisms The reactor vessel mtemals and control rod drive housings were scaled based on design acceleration capacities given in NUREG/CR-1833 (Ref. 3-20). Using the demand spectral accelerations calculated (Ref. 3-19) resulted in excess margin for these components ensuring that they may be represented by. a surrogate element with a median peak grou.ll,(~cceleration capacity of l.08g with a combined logarithmic standard deviation, be, value of(f30.

Soil Failure Analysis and Buried Piping

• Soil stability and seismic displacements, both transient and permanent, along with permanent settlements were investigated for the Palisades site. Because of the high factor of safety, the evaluations were conducted at 0.56g, 0.4g and 0.2g PGA using " the SHAKE (Ref. 3-22) computer program.

Liquefaction The results of the liquefaction stability analyses conducted for the site structures showed that regardless of the magnitude of the earthquake, there is a low likelihood of liquefaction instability. A minimum factor of safety of over 3 was obtained for the critical surface. This surface was one that contained within it all of the critical structures, and pass~d along the bottom of the clay layer: Using lower bound (soft) soil properties, it was found that 1003 pore pressure would develop in the very dense dune sand with a PGA of 0.56g. *For these

. -dense soils-the con5equences of l00%'porepressufe~are miiiiirial;'however, no analysifwas performed for PGAvahie.s in excess-of o.56g*since for strains' in excess of*about 0.33 there IS

• no unique shear modulus that can be used in an equivalent linear analysis.

• Transient and Permanent Horizontal Displacements and Settlements

• The maximum transient horizontal displacements calculated at the ground surface for a peak ground acceleration of 0.56g are 1.9 inches to 0.4 inches for the 0.2g PGA ground motion.

No (negligible) permanent horizontal displacements are predicted for a peak ground acceleration up .to 0. 56g:

The 1:11-axiffium calculated settlements at the ground surface range from 0.5 inch at 0.56g peak ground acceleration to less than 0.1 inch for a PGA of 0.2g PGA ..

3-29

Differential settlements can be expected within the foundation imprint of any one building and within the areas between buildings due to natural variability of the compressibility of the soil deposits. These can be taken equal to the total settlements and can be taken to occur over a distance of about 25 feet for structures on individual spread footings and for the areas between buildings.

Differential settlements can also be expected between any one building and the ground and between adjacent buildings, such as those within the Power Block, due tO the different thicknesses of the soil strata beneath the various structures and beneath *the ground surface.

Those between a building and* the surrounding ground will occur over a dista.llc;e. of only a few feet. The distance over which the differential settlements between adjacent buildfugs will occur is dependent on the interaction of the foundation mat with the foundation soil and can occur abruptly at construction or expansion joints between or within the buildings.

Buried Piping From Diesel Storage Tank Through Transfer Pump to Diesel Generator The SPRA *considered the influence of the displacementS *and settlementS for the fragility analysis of fuel oil piping from the main diesel fuel oil tank (T-10) to the transfer pump in the Intake Structure then on to the emergency diesel generator. There is sufficient margin (Ref. 3-23), even for displacements corresponding to the 0.56 g PGA; thus, the buried piping is screened out of the SPRA and conservatively represented by the surrogate element.

.* Piping Piping was revi~wed throughout the plant as part of the SPRA walkdown. Piping was _

. observed throughout all safety-related buildings and the Turbine building. The SPRA mainly

• relies on seismically designed piping. Some non-seismically designed piping is included in the SPRA model .. Allsafecy* relateqpipirig was re-evaluated usfug modem-dyilan:iie *analysis procedures*: as part of the IEB 79214 program (Ref. 3-3).

• All non-safety related piping* was walked down to estimate its capa~ity. *

• The non-seismic piping was determined to not be the weak link of the system modelled.

Therefore, the non-seismic piping was not specifically modeled. The systems that include non-seismic piping are: fire protection and circulating water system. The FPS system has many low fragilities components and is not affected by piping fragilities. The circulating.

water system is limited by other non-seismic components in the turbine bu'ilding and the availability of off-site power. Piping fragilities will not affect the availability of the circulating water system.

The service water system was W(llked down from "end-to-end" to identify any anomalies during the April walkdown in_ 1994. This system was found to be completely in order with no design anomalies .

• • 3-30

Small bore piping was also reviewed during the walkdowns to consider any interaction effects that could result from such piping, for example, falling (collapsing) on equipment modeled in the SPRA. It was observed that piping supports would support more than 3 times an estimated deadweight and that support spacing was within 2 times that recommended by the ASME

. B.31.1 Code for piping. Therefore, this issue is considered resolved and small bore piping may be considered to have the same capacity as the seismically designed large bore piping.

The non-critical portions of the main steam and service water piping are welded steel piping that are gravity, rod-hung. They were walked down in the Turbine building an~ found to be flexible and capable. No hard points were found and both of these non-critical segments of piping are assigned a HCLPF of 0.2g (median fragility=0.45g) PGA. The critical, thus seismically designed portions, of the main steam and service water piping are judged rugged and may be screened at 0.5g HCLPF (median fragility=l.08g) PGA. The service water piping system was used as a prototype for all seismically designed piping at Palisades and was walked down in its entirety. It exhibited no anomalous designfeatures with respect to good seismic design. Adequate flexibility was found at building interfaces to preclude overstress concerns.

Some drain lines were observed to have Victualic couplings, but these lines are normally not over safety-related equipment, nor are they normally full of water.

In conclusion, the piping is represented by the surrogate element in the SPRA with a median peak capacity of l .08g, peak ground acceleration with a composite logarithmic standard*

deviation of 0. 30.

HVAC Ducting was* reviewed in all areas of the plaiit. Particular attention was given to containment systems, and those in the control room and battery rooms. In general, the smaller size ducting is supported by sheet metal straps secured to the ceiling by expansion anchors. Larger duct cross-sections are supported by rod trapeze hangers anchored by Phillips shells.

The duct is supported in accordance with SMACNA (Ref. 3-24) spacing rules and anchorage vertical capacities exceed 3 times dead weight. The ducting are represented by the surrogate element in the SPRA with a median peak capacity of 1.08g, peak ground acceleration with a compo~ite logarithmic standard deviation of 0.30.

Electrical Raceways The electrical raceways were walked down as part of the USI A-46 effort (Ref. 3-25). All areas of the plant were surveyed and inspected against inclusion rules and caveats for raceways such as maximum spans, missing or broken hardware, and good design practices as presented in the GIP, Section 8. The results were documented in Plant Area Summary Sheets and are

• 3-31

included in the USI A-46 report for Palisades. In addition, bounding and representative supports were selected for structural and seismic evaluations called Limited Analytical Reviews (LAR). The LAR evaluations checked dead load stresses, ductility, and vertical capacity.

The Palisades raceways passed all of the USI A-46 evaluations and can be represented by the surrogate element in the SPRA with a median peak capacity of l .OSg, peak ground acceleration with a composite logarithmic standard deviation of 0.30.

3.5.2.3.2 "Detailed Fragilities All components were initially screened into three bins: 1) l .08g PGA median {~g HCLPF);

2) 0.65g PGA median (.3g HCLPF); or 3) 0.~2g PGA median (.lg HCLPF). *Most of the components modelled in the SPRA were screened at .5g HCLPF and represented by the surrogate event (l.08g PGA median, beta of 0.30). Some of the components were screened at

.3g HCLPF and modelled with a 0.65g PGA median and a beta of0.46. The remaining components were screened at a . lg HCLPF (essentially a very low ruggedness category) and modelled with a .22g PGA median and a beta of 0.46 .

.An initial quantification was performed to assess the seismic events that were important contributors to core damage frequency. The results of the initial quantification identified components for detailed fragility analysis.

Detailed fragility analysis was also performed for components where the anchorage was limiting and the component could no longer meet the caveats of the screening bins.

All components that had a detailed fragility less than a l .Og HCLPF(2.16g PGA median) were explicitly modelled in the SPRA. Components with a detailed fragility of 1. Og HCLPF or higher were not modelled explicitly, but were represented *by th,e surrogate ev~nt (.5g HCLPF, l.08g PGA median).

3.5.2.3.3 Seismically Induced Initiators Palisades considered the possibility of an earthquake inducing another type of initiator. These other initiators at Palisades were evaluated for their like,lihood of occurrence. All events screened out with a low probability of occurrence except for small break loss of coolant accident (SBLOCA), loss of off-site power (LOOP), turbine building fire and turbine building flood.

Seismically Induced Small Break Loss of Coolant Accident Figure s-1 of NUREG/CR-4840 (Ref. 3-26) presents the relationship between increasing seismic levels, and the conditional probability of a small break loss of coolant accident. This curve was used in the SPRA.

3-32

Medium and large break LOCA have remote probabilities and will not contribute to core damage frequencies and, thus, were not included explicitly in the SPRA model. The initiating event frequency for medium and large break LOCAs is less than that for a small break LOCA.

The small break LOCA initiator did not contribute to the core damage frequency and, therefore, the medium and large break LOCA would be expected to also not contribute to core damage frequency.

Seismically Induced Flooding A walkdown was conducted on October 5, 1994, by the SRT to address the-seismic wlnerability of potential internal flooding sources. Initially, an inventory offlOOcling sources was compiled. This included non-seismically designed piping (seismically designed piping was screened out at the high median fragility of l .08g J>GA) and large tanks greater than 1000 gallons. In particular, non-critical - thus, non-seismically designed - piping such as fire protection, non-critical main steam and non-critical service water piping were studied.

All areas of the auxiliary building, turbine building, and screenhouse were walked down. The containment building was reviewed from drawings because the plant was operating. As a corollary to the inspection of flooding sources, areas (rooms) vulnerable to flooding wer:e also reviewed such as the auxiliary Jeedwater pump room which is located at the lowest elevation of the turbine building, below elevation 590' .

• The greatest concern identified, was the circulating water line in the screenhouse. It does not appear to be seismically designed. If it were to rupture, it would probably flood the screenhouse, and particularly the service water pumps, rendering the service water system inoperable. Upon review-of the drawings and seismiC analysis of the circulating water line, it was concluded that although the line was not seismically restrained in some areas, that it would nofbreak between the screenhouse's operating floor-(El. 59Q')"and the roof. As such; it was judged not Jo.pose a flooding risk inside the screenhouse.

The fire piping headers run throughout the plant; and, although they are not seismically designed, they are gravity rod-hung, welded steel piping that frame through concrete walls (which act as lateral guides) and are not seen as plausible failure sources below a 0.2g HCLPF (median fragility = 0.43g PGA). The fire piping spray lines (with sprinkler heads) are threaded end steel piping that are charged (filled with water). They are predominantly 2 piping that is gravity rod-hung. They are not constrained with respect to the fire water headers and are not seen as potentially rupturing below a 0.2g HCLPF (median fragility=0.43g PGA) since they are small bore and not capable of large force reactions. The main steam and non-critical service water piping is welded steel piping that is gravity, rod-hung. It was walked down in the turbine building and found to be flexible and capable. No hard points were found and both of these piping segments are assigned a HCLPF of 0.2g (median fragility =0.43g PGA). Therefore, seismically induced flooding on the 590' elevation in the turbine building is evaluated with a median fragility of 0.43g PGA with a beta of 0.30.

3-33

The following tanks were reviewed as potential flooding sources:

T-1 Domestic Water Tank~

T-53A,B Boric Acid Storage Tanks; T-54 Volume Control Tank; T-58 Safety Injection and Refueling Water Tank T-7 Demin Water Tank; T-81 Primary System Makeup Storage Taruc T-85 Clean Waste Holdup Tank T-86 Clean Waste Distillate Tank T-90 Primary System Makeup Storage Tank .* ...

T-92A,B,C. Miscellaneous Waste Holdup Tank In all cases, the tanks are well anchored and judged to have a HCLPF in excess of 0.3g (median fragility= 0.7 g PGA) with the exception of T-81. This tank may buckle at a value.

below design basis. Its location adjacent to T-2, the Condensate Storage Tank, makes it a*

• potential hazard; however, loss of inventory poses neither a flooding hazard nor a realistiC collapse hazard. It is not a flooding hazard because it is located outdoors. In the judgment of

• the SRTs, the tank may buckle and rupture, but it will not catastrophically collapse...

• The auxiliary feed water pump room is protected from flooding sources by a water tight door.

Moreover, a ventilation opening at the top of the room is located on a 4-5' high standpipe at elevation 590' making it improbable that a flood will result in_ water flowing into the pump room itself.

The seismically induced flooding review resulted in the following flood modelling: 1) none for the containment building; 2) none for the auxiliary feedwater pump room; 3) none for the

. auxiliary building; 4) the.:590' .elevation in llie turbine huilaing is evaluated with a mec:lj~1f' .

fragility of-0.43g *PGA with *a beta of O:JQ; and 5) the screenhouse is evaluated with* a media.n fragility of l.08g PGA and a beta of 0.30.

Seismically Induced Fire All potential fire sources were walked down in the turbine building, auxiliary building and

• screenhouse. The containment building was reviewed from drawings because the plant was in full operation. Combustible sources such as fuel oil tanks, waste gas tanks, hydrogen gas bottles, flammable liquid storage cabinets, and hydrogen piping were assessed.

The containment building, auxiliary building and screenhouse have few sources of flammable liquids. The diesel generator fuel oil day tanks have high seismic capacities. The diesel fire pumps day tanks are located in an appendage to the turbine building and, although they are unanchored, there are no ignition sources in the appendage. Moreover, the turbine building is protected from the day tanks by a reinforced concrete wall. The hydrogen piping that is routed

• 3-34

through the turbine building is not seismically designed. It passes along non-seismically designed block walls and cable.trays which pose a puncture or rupture hazard to the hydrogen.

piping at relatively low seismicity levels. The turbine building also contains flammable liquid sforage cabinets in numerous locations and these storage cabinets are unanchored and at risk of spilling their inventory if they were to fall over. Based on simple observation; a multitude of ignition sources exist in the turbine building to ignite such flammable sources. Therefore, the turbine building is at high risk for a fire initiated by a seismic event. The auxiliary building contains hydrogen piping that is judged to be seismically designed and, thus, does not pose a fire issue.

.* \,

The seismically induce fire review resulted in the following fire modelling: lfnone for the

• containment building, auxiliary building, auxiliary feedwater pump room and screenhouse; and

2) the turbine building (all elevations) is evaluated with a median fragility of 0.22g PGA and a beta of 0.30.

3.5.3 Surrogate Fragility The SPRA included a single surrogate element represent.ing the aggregate effect of all screened out components. The surrogate element appears as a top event in the model with failure leading directly to core damage. The median capacity of the surrogate element computes as a direct function of the site ground spectral shape, which for the IPEEE was the median spectral shape with a 10,000 year return period provided in NUREG/CR-5250 (Ref. 3-27). Using the Palisades IPEEE ground spectral shape resulted in a median capacity of l .08g PGA for the sm;rogate element. Following the recommendations of Drs. Kennedy and Reed (Ref. 3-18),

• the surrogate element has an associated combined uncertainty (bJ of 0.3 .

• 3-35

3.5.4 Tables for Component Fragilities and Failure Modes

_TABLE 3.5-1 SPRA COMPONENT FRAGILITIES .

EQUIPMENT ID . EQUIPMENT DESCRIPTION HCLPF TYPE 42-771 C-6A STARTER ... 1 Screening

• - '.~:.:.42-811 C-6B STARTER >-,;<1 Screening.

52-1306CS P-5 CS .1 Screening 52-347 P-79B BREAKER .1 -Screening 52-7701 LOAD CENTER EB-77 INCOMING BKR .1 Screenirig 52-7702 MOTOR CNTRL CENTER EB-79 FEEDER .1 Screening 52~771 .

• C-6A BREAKER .1 -- Screening 52-811 C-6B BREAKER .1 Screening C-50A WASTE GAS COMPRESSOR ~ 1. Screening

• C-50B WASTE GAS COMPRESSOR .1 Screening CV-0501 MAIN STEAM ISOLATION E-50B .1 Screening

-cV-0510 .. MAIN :STEAM lSOLATION E-"5QA *--

.1 Screening CV-0511 TURBINE BYPASS CONTROL .1 Screening CV-0944A SPENT FUEL POOL CLG ISOL. .1 Screening*

CV-1037 CLEAN WASTE RECEIVER TK RECIRC .1 Screening CV-1045 P-69A/B SUCTION .1 Screening CV-1101 T-67INLET VENT HEADER .1 Screening CV-3001 CS HEADER ISOLATION .1 Screening E-1/2/3/4/5/6A/B FEEDWATER HEATERS .1 Screening E-19

• TURBINE GLAND SEAL CONDENSER ' .1 Screening

• 3-36

EQUIPMENT ID EQUIPMENT DESCRIPTION HCLPF TYPE E/P-0511 TURBINE BYPASS VALVE CONTROL .1 Screening EB-07 MCC7 .1 Screening EB-08 MCC8 .1 Screening EB-14 LOAD CENTER 14 ;l Screening*

EB-77 LOAD CENTER 77 *,_;'.l Screening

/

EB-79 MCC 79 :1 Screening EC-137 P-41 ACTUATING PANEL .1 Screening ED-16 CHMGER2 .1 Screening ED-36A P-9B BATTERY BANK 1 .1 Screening ED-36B P-9B BATTERY BANK 1 .1 Screening ED-36C P-9B BATTERY BANK 2 .1 Screening ED-36D P-9B BATTERY BANK 2 .1 Screening ED-38A P-41 BATTERY BANK 1 .1 Screening ED-38B P-41 BATTERY BANK 1 .1 . Screening

• Eo:38C P-41 BATTERY BANK 2 * .1 Screelling ED-38D P-41 BATTERY BANK 2 .1 . Screening EX-13 STATION POWER TRANSFORMER 13 .1 Screening EX-77 STATION POWER TRANSFORMER #77 .1 Screening FUZ/B771-1 SCHEMEB771 .1 Screening FUZ/B81 l-1 SCHEME B811 .1 Screening HIC-0823 CCW HX SW OUTLET .1 Screening HIC-0826 CCW HX SW OUTLET .1 Screening HIC-0881 CCW HX SW OUTLET .1 Screening 3-37

EQUIPMENT ID EQUIPMENT DESCRIPTION HCLPF TYPE IDC-0882 CCW HX SW OUTLET .1 Screening HS-771 C-6A CS .1 Screening HS-811 C-6B CS .1 Screening LS-0204 VCT OR RWS VALVE LEVEL SWITCH . !-<;;J *. Screening

• • ,,;:_'1 LS-2019 T-81 LEVEL SWITCH Screening M-59A A EVAPORATOR .1 Screening M-59B B EVAPORATOR .1 Screening P-5 WARM WATER RECIRC .1 Screening P-9A MOTOR DRIVE FIRE PUMP .1 Screening PCV-2274 NITROGEN FOR. C-150 .1 Screening PS-5350 P-41 DISCHARGE PS .1 Screening PT-0510 TBV CONTROLLER PRESSURE .1 Screening

~

RV-2274 NITROGEN SYSTEM RELIEF VALVE .1 Screening T-13A DG 1-1 JACKET WATER SURGE TANK .1 Screening

• . T-13B' DG-1-21ACKET WATER SURGE TANK .1- --Screening T-24 P-9B DIESEL DAY TANK .1 Screening T-3 CCW SURGE TANK .1 Screening T-40 P-41 DIESEL DAY TANK .1 Screening T-54 VCT .1 Screening T-77 BORIC ACID BATCH TANK .1 Screening T-81 PRIMARY SYSTEM MAKEUP TANK .1. Screening T-82A SIT .1 Screening T-82B SIT .1 Screening 3-38

EQUIPMENT ID EQUIPMENT DESCRIPTION HCLPF TYPE T-82C SIT .1 Screening T-82D SIT .1 Screening T-9C HIGH PRESSURE AIR RECEIVER* .1 Screening TC-0216 CHARGING PP P-55A TEMP CNTRL * -~ ;l Screening 42-2111 V-15A STARTER 42-2113 HPSI VALVE M0-3081 .3 Screening 42-2139 M0-2139 .3 Screening 42-2213 HPSI VALVE M0-3082 .3 Screening 42-2239 M0-3198 .3 Screening 42-2313 HPSI VALVE M0-3083 Screening 42-2625. O/C RELAY FOR M0-1043A .3 Screening 52-2111 V-15A BREAKER .3 Screening 52-2111/CS V-15A CONTROL SWITCH .3 Screening 52-2113 HPSI VALVE M0-3081 .3 Screening HPSI VALVE M0-3082 -* Screening 52-2313 HPSI VALVE M0-3083 . .3 Screening

. 52-2625

• M0-1043A BREAKER .3 Screening 52-427 P-79A BREAKER .3 Screening CV-1064 T-64A/B/C/D VENT VALVE .3 Screening

-CV-1102 T-67 INLET VENT HEADER .3 Screening CV-1211 *1A CONTAINMENT ISOLATION .3 Screening CV-1814 V-46 DISCHARGE .. 3 Screening E-50A I A STEAM GENERATOR I '.3 Screening 3-39

• EQUIPMENT ID E-50B E-54A EQUIPMENT DESCRIPTION

'B' STEAM GENERATOR CCW HEAT EXCHANGER HCLPF

.3

.3 TYPE Screening Screening E-54B CCW HEAT EXCHANGER .3 Screening E-60A SHUTDOWN COOLING HX * ' .. -:3 Screening

. *.,;".-.. 3 E-60B SHUTDOWN COOLING HX Screening EB-21 MCC21 .3 Screening EB-22 MCC22 .3 Screening EB-23 MCC23 .3 Screening EB-26 MCC26 .3 Screening EY-50 INSTR AC BUS TRANSFER SWITCH .3 Screening

• • FUZ/B2 ll 1-1 V-15A CIRCUIT FUSE .3 . Screening FUZ/B2111-2 V-15A BACKUP PROTECTION FUSE .3 Screening FUZ/B2625-1 SCHEME B2625 .3 Screening M0-3007 HPSI TO LOOP lA .3 Screening M0-3009

• HPSI TO LOOP lB .3 Screening .

M0-3010 LPSI TO RX COOLANT LOOP lB .3 Screening M0-3011 HPSI TO LOOP 2A .3 Screening M0-3012 LPSI TO RX COOLANT LOOP 2A .3 Screening M0-3013 HPSI TO LOOP 2B .3 Screening M0-3014 LPSI TO RX COOLANT LOOP 2B .3 Screening M0:-3041 SAFETY INJECT TK T-82A OUTLET ISOL .3 Screening M0-3045 SAFETY INJECT TK T-82B OUTLET ISOL .3 Screening M0-3049 SAFETY INJECT TK T-82C OUTLET ISOL .3 Screening

• 3-40

• EQUIPMENT ID M0-3052 M0-3082 EQUIPMENT DESCRIPTION SAFETY INJECT TK T-82D OUTLET ISOL HPSI HOT LEG INJECTION HCLPF

.3

.3 TYPE Screening Screening M0-3083 HPSI HOT LEG INJECTION .3 Screening P-50A PRIMARY COOLANT PUMP A .3 Screening P-50B PRIMARYCOOLANTPUMPB *;;*:~*3 Screening P-50C PRIMARY COOLANT PUMP C .3 Screening P-50D PRIMARY COOLANT PUMP D .3 Screening RV-3057A CV-3057 CLOSING AIR .3 Screening RV-3057B CV-3057 OPENING AIR .3 Screening SV-1037 P-70 DISCHARGE ISOLATION .3 Screening SV-1064 CLEAN WASTE RECEIVER TANK .3 Screening SV-1065 CLEAN WASTE RECEIVER TANK .3 Screening SV-1101 T-67 INLET .3 Screening SV-1102 T-67 INLET .3 Screening SV-1.103 CONTAINMENTSUMPDRAiN .3 *screening

• . . *~ ..

SV-1104 CONTAINMENT SUMP DRAIN ' .3 Screening sv.:1813 V-46 DISCHARGE .3 Screening SV-1814 V-46 DISCHARGE .3 Screening SV-2113 E-56 TO CHARGING LINE LOOP IA .3 Screening SV-2115 E-56 TO CHARGING LINE LOOP lB .3 Screening T-10 DG FUEL OIL STORAGE TANK .3 Screening T-2 CST .3 Screeniilg T-926 FUEL OIL STORAGE TANK .3 Screenin~

3-41

• I EQUIPMENT ID T-9A EQUIPMENT DESCRIPTION HIGH PRESSURE CONTROL AIR .3 Screening T-9B HIGH PRESSURE CONTROL AIR .3 Screening P-67A LPSI PUMP .33 Detailed P-67B LPSI PUMP*

• c'._ .33 Detailed

. __ ..;,.A P-52B COMP. COOLING PUMP Detailed VHX-1 CONTAINMENT AIR COOLER 1 .47 Detailed VHX-2 CONTAINMENT AIR COOLER 2 .47 Detailed VHX-3 CONTAINMENT AIR COOLER 3 .47 Detailed VHX-4 CONTAINMENT AIR COOLER 4 .47 Detailed E-58 LETDOWN HEAT EXCHANGER .5 Detailed T-73 QUENCH TANK .51 Detailed

• P-7A P-7B P-7C SERVICE WATER PUMP SERVICE WATER PUMP SERVICE WATER PUMP

.52

.52

• .52 Detailed Detailed Detailed

-P-:8C MOTOR DRIVEN Aux FEED .PUMP .55 *Detailed.

T-58 SAFETY INJECT REFUELING WTR TK .57 Detailed E-53A SPENT FUEL POOL HX A .58 Detailed E-53B SPENT FUEL POOL HX B .58 Detailed P-54C CONTAINMENT SPRAY PUMP .60 Detailed 127D-2 DIESEL GEN 1-2 UNDERVOLTAGE .66 Detailed P-8A MOTOR DRIVE AUX FEED PUMP .72 Detailed P-54A CONTAINMENT SPRAY PUMP .77 Detailed

• 127D*:-1 DIESEL GEN 1-1 UNDERVOLTAGE .87 Detailed

• 3-42

Table of Contents Section 3.6 SPRA Modelling and Results .

3.6.1 Seismic Event Tree 3-44 3.6.2 Seismic Event Tree Heading Fragilities . 3-45 3.6.3 Seismic Fault Trees - \:*;:3-46 3.6.4 Accident Classes 3.6.4.1 Accident Class IA 3-47 3.6.4.2

• Accident Class IB 3-47 3.6.4.3 Accident Class II 3-47 3.6.4.4 Accident Class IIIA 3-47 3.6.4.5 Accident Class IIIB 3-48 3.6.4.6 Accident Class IV 3-48 3.6.5 Seismic Risk Quantification and Results 3-48 3.6.5.1 Seismic Event Tree Sequences 3-48 3.6.5.2 Seismic Event Tree Quantification 3-49 3.6.5.2.1 Component Failure Probabilities 3-49 3.6.5.2.2 Human Error Fragilities 3-49 .

3.6.5.2.3 Seismic Event Tree Headings 3-50 3.6.5.2.4 -Quantification 3-50.

3.6.5.3 Quantification Results 3-50 3.6.5.3.1 Accident Class Results 3-51 3.6.5.3.2 -Important Seismic Events

• 3-53 3.6.5.3.3 Important Random Failures 3-54 3.6.5.3.4 Important Human Actions 3-55 3.6.5.3.5 Contribution by Ground Motion 3-56.

3.6.5.4 Sensitivity Analyses 3-57 3.6.5.4.1 Fire Protection Systein Sensitivity 3-57 3.6.5.4.2

• Turbine Building Fire Sensitivity 3-57 3.6.5.4.3 . Random Events Sensitivity 3-58 3.6.6 Tables and Figures for SPRA Modelling and Results 3-59

• 3-43

3.6 SPRA Modelling and Results The SPRA used the event and fault trees developed for the IPE whenever possible. One event tree was developed to tie the seismic initiating event to the IPE event trees. The quantification of the SPRA was similar to the IPE except that the plant level fragility and core damage .

frequency were calculated by integrating the fault and event tree results over the range of earthquake levels and. probabilities .in the hazard curve.

3.6.1 Seismic Event Tree Figure 3.6-1 contains .th~ seismic event tree (SET) used for the Palisades SPRA~ . This event tree includes seven headings: SURR, RB, AB, TBFR, TBFL, LOOP and SBL..:These headings were chosen based on the discussion in Section 3.5.2.3.3. The SET was developed to transfer into the transient or small break LOCA event trees used. in the IPE. The transient and small break LOCA event trees both had a transfer into the ATWS event tree. Therefore, a*

total of three IPE event trees were used in the SPRA.

• Heading SURR is the surrogate event. Failure of this heading conservatively bounds the failure of all equipment represented by the. surrogat~ event. Sine~ the vast majority of the equipment is represented by tlie surrogate event, Palisades. assumes that failure of the surrogate **

event leads to failure of all plant equipment and, therefore, core damage.

Heading RB is the reactor building (containment building). Failure of this heading represents structural failure of the, containment building. The Palisades SPRA conservatively assumed that structural failure .of the containment building leads directly to core damage rather than

. analyzing the specific failure modes and probabilitl.es of the various structural failures.' For' this failure.mode, it was assumed that all piping connections betwt!en the containment building auxiliary'buildi~g fail, includi1lg*c9n~inmc:!nt isolation functions.

He(\ding AB is the auxiliary building (AB). Failure of this heading represents structural failure of the AB. The Palisades SPRA conservatively assumes that structural failure of the AB leads directly to core damage. Structural failure of the AB assumes tIJ.at all of the piping connections between the containment building and the AB fail. This would lead to failure of all engineered safeguards equipment, containment cooling and containment isolation.*

Heading TBFR is a turbine building (TB) fire. Failure of this heading represents a seismically induced fire in the TB. This fire is conservatively assumed to disable all of the equipment and cables routed through the TB. This is consistent with the fire analysis for the TB (Section 4.0). Engineered safeguards equipment and diesel generator power to both ClasslE buses are not* affected by the TB fire because. these are located in the AB.

Heading TBFL is a TB flood. Failure of this heading represents a seismically induced flood

. on the 590' elevation of the TB. The flood is caused by the catastrophic failure of non-seismic 3-44

piping and tanks located in the TB (i.e., non-critical service water, fire protection, main steam, etc.). This flood is assumed to disable all equipment located on the 590' or below in the TB. Even though higher elevations of the TB contain piping or tanks that may rupture in a

. seismic event, these elevations have floor grating. Palisades assumes that any water from a rupture would drain to the 590' elevation and accumulate there versus on the elevation of the rupture.

Heading LOOP is off-site power. Failure of this heading means that off-site power is lost due to a seismic event.  ::,-*.

Heading SBL is small break loss of coolant accident (SBLOCA). Failure ofliii_s.-heading

. means that a small break LOCA has occurred as a result of a seismic event.

The SET is used to determine which IPE event tree to use for quantification. *The SET has fifteen sequences as indicated in Table 3. 6-1. Six sequences transfer to the transient event tree .

(1, 3, 5, 7, 9, 11), six sequences transfer to the SBLOCA event tree (2; 4, 6, 8, 10, 12), and three sequences are not devefoped further, but are quantified as leading directly to core damage (13, 14, 15): The transient and SBLOCA event trees used in the SPRA are the same as those used in the. internal events PRA. The ATWS event tree was considered in the SPRA .

as a transfer from the transient and SBLOCA event trees.

The success criteria* for the transient and SBLOCA event trees is the same as for the IPE. The fault trees used to support the transient and SBLOCA event trees are also the same as the IPE fault tree except that seismic basic event were added to the fault trees as discussed in Section 3.6.3. Also, the conditions represented by the SET sequences modify the fault tree structure for that sequence. For example, all fault trees used in the transient event tree for SET sequence 3 have loss of off-site power set to true (failure rate = 1.0) before quantification.

• 3.6.2 . Seismic Event Tree Heading Fragilities .

Each of the seven SET headings has a fragility. These event tree headings are not represented by fault trees, rather, their fragility is used as the branch point probability.

The fragility for SURR (surrogate event) is discussed in Section 3.5.3 and is l.08g PGA median with a beta of 0. 30.

• The fragility for RB and AB is discussed in Section 3.5.2.3.1. The fragility for each is the same and is l.08g PGA median with a beta of 0.30.

The fragility for TBFR (TB fire), TB.FL (TB flood) and SBL (small break LOCA) are discussed in Section 3.5.2.3.3. These fragilities are: 1) TBFR is a 0.22g PGA median and a beta = 0.30; 2) TBFL is a 0.43g PGA median and a beta = 0.30; and 3) SBL is represented by Figure s-1 of NUREG/CR-4840 (Ref. 3-26) ..

3-45

The fragility for LOOP (off-site power) was calculated based on the most limiting component that causes this event. The most limiting component is the ceramic insulators. The fragility for off-site power also incorporates the possible affects of the fire protection system on the main transformers, should it be actuated. The main transformers deluge system contains a low seismic capacity check valve that may cause a loss of off-site power by actuating the deluge system during a seismic event. The fragility for off-site po~er is 0.35g PGA median with a beta of 0.55.

3.6.3 Seismic Fault Trees The IPE fault trees that were used to support the three IPE event trees (transietit; SBLOCA, ATWS) used in the SPRA were modified to create the seismic fault trees. These fault trees were modified to include seismic basic events.

To create seismic basic events, the components in the IPE fault trees that may be seismically affected were identified. All of the components in the IPE fault trees that were used in the -

SPRA received a walkdown to assess their seismic capacity. As discussed in Section 3.5 and presented in Table 3. 5-1, all of these components were assigned a fragility or were screened qut and represented py the su.rrogate event. For those components that were not screened out, a seismic basic event was created with a fragility assigned to it. All of the seismic basic events were added to the fault trees to create the seismic fault trees. The seismic fault trees include both seismic and non-seismic basic events. Therefore, the SPRA considers seismic and random failures, human error probabilities, out of service and test unavailabilities.

In addition to the seismic basic events, the seismic fault trees were modified to include seismically induced initiating events. The four seismic event tree headings that are seismically induced initiating events are: TBFR; TBFL; LOOP; and SBL. All events that are affected by a TB fire haye,an associated basic event of TBFR. -All basic events- that are affected by a TB flood have an associated basic event of TBFL. The .affected off-site power_ related equipment received an associated basic event of LOOP. The initiating event SBLOCA was given to all sequences that were quantified by the SBLOCA event tree and was not included in the fault tree as a basic event.

The fault tree logic structure was modified to add the seismic basic events and conditional sequence events. The logic changes were such that the affected random event was renamed to

• an OR gate and the OR gate input was defined as: 1) the random basic event; 2) the seismic basic event; and 3) any seismic event tree heading events.

3.6.4 Accident Class Definitions The core damage sequences were grouped into accident classes based on the critical safety function failure which resulted in core damage. The accident classes are defined to provide an easy method of identifying the primary functional failures most likely to lead to core damage

• 3-46

and to provide a method of comparing the likelihood of various functional failures leading to core damage. The accident classes used in the SPRA.are the same as those defined in the IPE Report Section 2.4.23 (Ref. 3-10) and are consistent with those used in other PRAs and the NUMARC,Severe Accident Closure Guidelines (Ref. 3-28). This method of grouping the core damage sequences provides initial insight into the reliability of critical accident mitigating functions. Six accident classes are defined and used in the SPRA.

. 3.6.4.1 - Accident Class IA

-. ' *~.

Accident Class IA contain sequences that progress to core damage due to the Jail.Ure of secondary heat.removal and once through cooling during the injection phase (~ater from the safety injection and refueling water tank - SIRWT). This class includes sequences from the transient event tree.

3.6.4.2 Accident Class IB Accident Class IB contain sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase (water from the containment sump). This* class includes sequences from the transient event tree.

3.6.4.3 Accident Class II Accident Class II contains sequences that progress to core damage due to failure of containment heat removal which leads to containment failure and the subsequent loss of coolant inventory makeup. This class includes sequences from both the transient and SBLOCA event trees.

3.6.4.4 Accident Class IIIA Accident Class IIIA contains sequences that are initiated by a small break LOCA and progress to core damage due to failure of primary coolant makeup during the injection phas~. This class includes sequences from the SBLOCA event tree.

3.6.4.5 Accident Class IIIB Accident Class IIIA contains sequences that are initiated by a small break LOCA and progress to core damage due to failure of primary coolant makeup during the recirculation phase. This class includes sequences from the SBLOCA event tree.

3.6.4.6 Accident Class IV Accident Class IV contains sequences that progress to core damage due to the failure of reactivity control. This class includes sequences from the ATWS event tree. No results were

• 3-47

.obtained for this accident class due to the low probabilify of an ATWS initiator coupled with the low probability of the seismic initiator.

3.6.5 Seismic Risk Quantification and Results The seismic quantificatio~ was performed in two parts: 1) quantification of and fragility development for the 12 seismic event tree transfer sequences; and 2) quantification of the seismic event tree.

?" *-

3.6.5.1 Seismic Event Tree Sequences .:-.,:* >

7 Figure 3.6-1 shows the seismic event tree. As discussed in Section 3.6.1, there are 12 sequences that transfer to other event trees: odd sequences from 1 through 12 transfer to the transient event tree; and even sequences from 1 through 12 transfer to the SBLOCA event tree.

The initial conditions for each of these 12 sequences is different, as defined by the success/failure of the seismic event tree top headings. Table 3.6-1 shows the sequence

'definitions. These sequence definitions are used to set seismically induced initiating event probabilities to 1. 0 or 0. 0 during the sequence quantification.

There are* three top headings that are seismically induced initiating events for which the probability in the fault trees was set to 1.0 or 0.0: TBFR (TB fire), TBFL (TB flood) and LOOP (off-site power). The SBLOCA initiating event was attached to all sequences resulting from the SBLOCA event tree. As discussed in Section 3.6.3, TBFR, TBFL and LOOP were included in the seismic fault trees. For sequences where there is a TB fire (failure of heading TBFR), the basic event TBFR probability in the fault tree was set to 1.0. For sequences

• where there is no TB fire, the basic event TBFR probability in the fault tree was set to 0.0. **A similar procedure was used for the top heading TBFL and LOOP. This proct:'.dure was used to quantify. th~ faul( tre~s. and prod"Qce the cutser equation for eacli: of ilie 12 sequences.

Quantification of these sequences is performed by the SETS Code (Ref. 3-29) to provide a cutset equation, This quantification is performed using point estimates only, not fragilities.

• To ensure that all important cutsets are maintained and not truncated out, two adjustments were performed: 1) assigning high probabilities for seismic basic events; and 2) increasing

• human error probabilities.

The seismic basic events were assigned a probability of failure from their fragility curve corresponding to a 0.6g earthquake. A 0.6g earthquake was chosen since this is a large earthquake and the plant level median fragility was expected to be less than 0.6g (Section 3.6.5.3 confirms this assumption).

Post-accident human error probabilities were set to 1.0 to obtain the cutset equation using the

• SETS code.* Fragilities were developed for human error probabilities (Section 3.6.5.2.2) and used in the seismic event tree quantification .

• 3-48

3.6.5.2 Seismic Event Tree Quantification The seismic event tree quantification involved defining the component random probabilities and fragilities, the human error fragilities and the seismic event tree heading fragilities in the SHIP code for final integration.

3.6.5.2.1 Component Failure Probabilities The component random failures rates that were used in the IPE were also used in the SPRA.

No adjustments to these probabilities were made. The seismic impact on the~e.:eomponents was assessed by including seismic basic events and fragilities. * :;_;>'

The component fragilities that were identified in Section 3.5.2 were used in the SPRA. The fragilities were input as a median capacity with a lognormal standard deviation (beta), which defined a lognomial fragility curve.

3.6.5.2.2 Human Error Fragilities Only the post-accident h1Jman error probabilities (HEPs) were changed from the IPE. All pre-

. accident HEPs were the same as in the IPE. Post-accident HEPs were assigned based on the time required to perform the function. Post-accident human actions were divided into three groups: 1) performed in the control room and required within one hour of the seismic' event; 2) performed outside the control room and required within one hour of the seismic event; and 3) not' required within one hour of the seismic event.

Post-accident human actions that can be performed from the control and that are required within one hour were assigned a non-lognormal fragility.* The IPE HEP was used up to a 0.2g earthquake (design basis). From.0.2g to.0.4g, the HEP linearly increased from the IPE HEP to a value of 0. 5. - Fr.om 0 .4g !O 0. 6g, the IJEP Ii.Dearly increased from- the ~0 .4g value to 1. 0.

Above 0.6g, the HEP was set to 1.0. Figure 3.6-2 shows a generic representation of this type of non-lognormal fragility.

Post-accident human actions that are performed outside the control room and required within one hour were also assigned a non-lognormal fragility. The IPE HEP was used up to a 0.2g earthquake. From 0.2g to 0.4g, the HEP linearly increased from the IPE HEP to a value of 1.0. Above 0.4g, the HEP was set to 1.0. Figure 3.6-3 shows a generic representation of this type of non-lognormal fragility.

Post-accident human actions that were not required within one hour of the seismic event wer~

not changed from the IPE HEP. These were assumed to be required well beyond the time of .

the seismic initiator and, with exception of structural and component* failures, not expected to be affected by the initial ground motion. These HEPs did not have a fragility associated with them .

• 3-49

3.6.5.2.3 . Seismic Event Tree Headings The seismic event tree heading fragilities were developed and discussed in Section 3.6.2. The fragilities were input as a median capacity with a lognormal standard deviation (beta), which defined a lognormal fragility curve.

3.6.5.2.4 Quantification The SHIP Code (Ref. 3-30) was used to perform the seismic event tree quantific.ation. Fifteen sequences were identified. Figure 3.6-1 shows the seismic event tree and Table 3;6-1 contains .

the fifteen sequence definitions. The sequence cutsets discussed in Section 3 :6j5 .1 were used along with the seismic event tree heading fragilities and site hazard curve. **

SHIP evaluated the site hazard curve at discrete ground motion levels and quantified each sequence cutset at each ground motion level. This resulted in a fragility for each sequence.

The sequence fragilities were combined in the seismic event tree according to the event tree sequence definitions (T~ble 3. 6-1). The core damage frequency and plant level fragility was calculated by integrating the event tree sequence definitions with the mean site hazard curve.

3.6.5.3 Quantification Results The results of the seismic event tree quantification provided a mean core damage frequency, pl.ant median fragility and plant HCLPF. These results are presented in Table 3.6-2.

Sensitivity analyses were performed to identify important random failures as well as important seismic events and human actions.

The following screening criteria were used to identify sequences to discuss in this section.

This criteria is identical to the functional reporting requirements presentecl in Generic Letter

• '88-20 (R.ef. 3-31) and prese11t¢d j.11 NUREG-1407 (Ref. 3'-14):

1) Functional sequences with a CDF greater than lE-06/yr. Functional sequences for .

the Palisades SPRA are the five accident classes defined in Section 3.6.4.

2) Functional sequences that contribute 53 or more to total CDP.

3) Sequences determined by Palisades to be important contributors to CDP or containment performance.

3.6.5.3.1 Accident Class Results The results of the seismic event tree quantification was evaluated with respect to accident classes. The accident classes are defined in Section 3.6.4. The results of the accident class

• 3-50

evaluation are presented in Table 3.6-3 and Figure 3.6-4. Accident Classes IHA, HIB and IV

. had no contribution to core damage frequency.

Only two functional acCident Classes meet the reporting criteria defined in NUREG-1407:

Class IA and Class IB. Discussion of the other accident classes is provided to complete the presentation of the SPRA results.

Accident Class IA Accident Class IA (loss of secondary heat removal and failure of once througfrcc>oling during

. the injection phase) contributes to approximately 37% of the total core damage:~fi-equency.

This accident class has a mean core damage frequency of 3.85E-6/yr and a HCLPF of .229g.

The principal contributors to Class IA following a seismic event are associated with makeup to the condensate storage tank (CST). The CST nominally has capacity to provide makeup of the steam generators to account for approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of decay heat removal. Normal on-site makeup supplies (such as from demin water storage) rely on offsite power for transfer to the CST. Alternate sources of makeup include fire protection system (FPS) makeup to the suction of AFW pumps P-8A&B or the CST itself (which can then supply suctjon to AFW pump P:-

8C). Additionally, AFW pump P-8C suction can be aligned from the service water system (SWS).

Dominant seismic contributors to these sources of makeup include the day tanks for the diesel

• fire pumps, FPS control cabinet (EC-137) and transformer EX-13 (power for electric fire pump P-9A). Loss of this equipment is assumed to lead to failure of the FPS leaving only P-8C with SWS as the principle long term suction source. There are no significant '

vulnerabilities of the SWS to a seismic event. However, the SWS feeds only the suction of the AFW pump P-8C. No creqit is_ taken for the SWS cross-tie to the FPS to allow the SWS to supply suction water to AFW pumps _P-8A&B. -The seismically induced faiiures of the FPS:

effectively leaves one train of AFW (pump P-8C) for long term makeup to the steam generators: Loss of this train due to random failure leads to initiation of once through cooling with either train of HPSI pumps and at least one PORV. There are no seismic failures that significantly impact the operation of equipment required for once through cooling during the injection phase.

• Accident Class IB Accident Class IB (loss of secondary heat removal with failure of once through cooling during the recirculation phase) contributes to approximately 35 % of the core damage frequency. This accident class has a mean frequency of 3.65E-6/yr and a HCLPF of .236 g.

Similar to Class IA, the dominant failures leading to damage in this accident class are a result of loss of)equipment used for CST makeup. This equipment includes the day tanks for the

• 3-51

diesel fire pumps, FPS control panel (EC-137) and transformer EX-13. Also, like Class IA, there are no seismic failures that significantly impact the operation of equipment required for once through cooling during the recirculation phase should random failures for AFW pump P-8C suction result in failure to provide long term makeup* to the steam generators.

Accident Class II Accident Class II (failure of containment heat removal) contributes to only 4 3 of the core damage frequency. This accident class has aHCLPF of .416g.

Following a small break LOCA or successful initiation of recirculation followmg initiation of

. once through cooling, long term containment heat removal is required. System8 supporting containment heat removal include containment spray, containment air coolers, component cooling water and service water. All of these systems have relatively high seismic fragilities.

Accident Classes IIIA and IIIB Accident Classes IIIA (primary coolant system makeup failure during the injection phase for SBLOCAs) and IIIB (primary coolant system makeup failure during the recirculation phase for SBLOCAs) did not contribute to* core damage frequency or plant level fragility. The seismically induced LOCA requires HPSI injection and recirculation, which have limited vulnerability to seismic failures as discussed for Accident Classes IA and IB.

Accident Class IV Accident _Class IV (core damage due to failure of reactivity) contains sequences from the ATWS event tree and did not contribute to core damage frequency or plant level fragility.

Non-Accident Class Core Damage Frequency Contributors Single seismic fragilities were developed for the reactor building (containment building),

auxiliary building, and_ the surrogate event. Each of these failure modes conservatively is assumed to lead to core damage. The results for these events are included in Table 3.6-3.

3.6.5.3.2 Important Seismic Events There was no seismic event or group of similar seismic events that dominated the SPRA results. Then~ were four groups of events that contribute the most to the SPRA results: fire protection system (FPS); main steam isolation valves (MSIVs); diesel generator fuel oil supply; and bus undervoltage relay for safety bus lD.

3-52

Fire Protection System The dominant seismic events in the FPS are: 1) the seismic capacity of the diesel day tanks (T-

.24 and T-40) for the two diesel driven fire protection pumps (P-9B .and P-41); 2) the control panel for one of the diesel driven fire protection pumps (EC-137); and 3) station transformer

13. All of these components were given a low fragility, 0.22g PGA median.

• The walkdown for these components identified issues that result in low seismic* fragilities. The diesel day tanks are unanchored and located on unanalyzed (assumed unqualified) block walls.

The control panel is considered unanchored due to severe corrosion of the b~e. steel. The transformer is unanchored. <'::;/~*

The FPS is important in a seismic event because it provides an alternate suCtion source for AFW pumps P-8A and B and makeup to the CST (for AFW pump P-8C). This failure mode contributes to Accident Classes IA and IB because the AFW pumps are the primary long term system for cooling the PCS, via the steam generators. Loss of FPS makeup to the suction of .

AFW leaves the SWS as the principal long term makeup source to AFW through the suction PSC. No credit is taken for the cross-tie of the SWS to the FPS for AFW pumps P-8A&B suction.

Main Steam Isolation Valves The MSIV s are assumed to interact with components located near the valves during significant ground motion. The SPRA models the result of this interaction as failure of the MSIV s to close and isolate the steam generators. Closure of the MSIVs is important only if an ADV randomly fails closed. ADVs are assumed to open on a plant trip. If the MSIV on the unaffected steam generator remains open, then both steam generators depressurize as there is a cross-connect between the steam lines downstream of the .MSIVs. The blowdown,of both

.. steam generators is modeled in th~ SPRA ~s-an-ex~~s~ive steam.demand re_quiring termiruition

-.-*-<*'.:cof AFW flow to the stearri generators.-* This is very conservative modeling as, in fact, the operators would continue to supply AFW makeup to the least affected steam generator rather than isolate both of them. Realistic development of two steam generator blowdown sequences would likely eliminate seismic interactions with the MSIVs as having any risk significance.

No credit is taken for operators to continue to feed at least one steam generator.

Diesel Generator Fuel Oil Supply The diesel generator fuel oil tank (T-10) provides a fuel supply for both diesel generators.

While having a relatively high fragility., the diesel generators are important following a seismic event in that a loss of off-site power is relatively likely. The DG day tanks have a high fragility and can supply approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> of fuel oil for each DG. Following that, T-10 is relied upon for diesel oil replenishment of the day tanks. Operation of the turbine driven AFW pump can provide for adequate heat removal even if loss of the diesel generators occurs .

• 3-53

. It is assumed in the SPRA, however, that this independent means of makeup is no longer available once station battery depletion occurs (approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />).

Undervoltage Relay for Bus ID Should a seismic event lead to a loss of off-site power, diesel generator operation becomes

• important. DG t-2 has higher importance relative to DG 1-1 as it supplies power to AFW pump P-8C. This AFW pump is important to long term makeup to the steam generators should the fire system become unavailable following a seismic event (as discussed in the results for Accident Classes IA & IB, Section 3.6.5.3.1). While it has a relatiy~ly high fragility, the undervoltage relay for Bus lD provides a signal to start DG 1-2 :reSulting in its

• importance. As operation of P-8C by itself is not likely to be required until CST depletion, credit for local operator actioµ to start and load the diesel after the earthquake reduces the importance of this seismic failure.

3.6.5.3.3 Important Random Failures The Palisades SPRA has few low fragility seismic failure modes that by themselves lead to core damage following an earthquake .. There are several random failures which are necessary in addition to any seismically induced failures before core damage would occur. The following are several of the more important random failures to the SPRA: 1) diesel generator 1-2 (DGl-2); 2) auxiliary feedwater (AFW) pump P-8C; and 3) atmospheric dump valves (ADVs).

Diesel Generator 1-2 There are two dominant random event groups contributing to the failure of DGl-2: failures associated with the DG; and failure associated with the feeder breaker to the bus. The failure rate for these two groups is 5.56E-02/yr and i. BE-02/y~, ~espectively, for a total of 7.69E-02/yr. DG 1-2 is the more risk significant of the t\vo diesel generators following a seismic

• event as it powers AFW Pump P-8C as well as two of the three SWS pumps. AFW pump P-8C and service water makeup to AFW become important should seismically induced failures of*

the FPS occur preventing this means of makeup for a long term AFW operation.

Auxiliary Feed water Pump P-8C There are two dominant random event groups contributing to the failure of AFW pump P-8C:

failures associated with the pump and power supply; and failures associated with the manual supply valves to align service water as an alternate suction source. The failure rate for these.

two groups is 2.36E-02/yr and 3.65E-02/yr, respectively, for a total of 6.0lE-02/yr. Again P-8C operation becomes important for long term makeup to the steam generators should other means of supplying water to the CST or AFW pumps P-8A and B become unavailable following a seismic event.

• 3-54.

Atmospheric Dump Valves The random events associated with the ADVs are the valves fail to close or remain closed.

Failure of the ADVs to close or remain closed leads to an excessive steam demand and, if MSIV failure also occur_s, results in blowdown of both steam generators. The failure rate associated with one ADV is 3.26£-02/yr. As noted in the discussion above for the MSIVs, realistic modeling of AFW operation following the depressurization of both steam generators would credit continued makeup to the least affected steam generator. This would limit the importance of failed open ADVs to the SPRA results. No credit is taken for the ,operators to continue to feed at least one steam generator. * - _,

.*-. ,' *.=**

• ~~ ~*.~.~,-

3.6.5.3.4 Important Human Actions A sensitivity analysis was performed to identify those operator actions that are most important .

to the results of the SPRA. No operator actions were added to the logic models that were unique to the SPRA.

• However, a number of the operator actions already included in the IPE

• are also important following a seismic event. As discussed in Section 3.6.5.2.2, post-accident human error probabilities were assigned a fragility based on the location of the human action (control room or local) and the timing of the hurrian action (early or late).

Initiation of Once Through Cooling Once through cooling is initiated if makeup to the steam generators is lost. In the SPRA, it is credited after random failure of the AFW system or in sequences in which CST depletion occurs and alignment of the SWS or the FPS to AFW suction is not successful. This operator action plays a significant role in limiting the magriitude of accident class IA (loss of secondary heat removal and failure of once through cooling during the injection phase).

• Initiation of Makeup. to the SJ,Iction of AFW A number of operator actions are modeled in the SPRA that are directed at continued makeup to AFW following CST depletion. These actions include alignment of the FPS to the suction of AFW pumps P-8A and P-8B or the SWS to the suction of P-8C. Successful alignment of these sources of water to AFW can be performed if normal CST makeup is unavailable (as a

' result of loss of off-site power). Alternatively, the operator can elect to cooldown the plant and establish operation of shutdown cooling prior to CST depletion. Makeup to AFW plays a role in limiting the potential for both Accident Class IA (loss of secondary heat removal and

. failure of once through cooling during the injection phase) and Class IB (loss of secondary heat removal and failure of once through cooling during the recirculation phase).

3-55

AFW Flow Control Upon initiation of AFW, control valves regulate flow at 150 gpm to each steam generator. If one steam generator failed to receive the required flow (via failure of the AFW header or

• control valves), operator action is required to increase the flow to the good header to remove the decay heat. This operator action is important to both Aecident Class IA and IB if one of the two AFW headers to a steam generator is unavailable due to random failures following an earthquake.

3.6.5.3.5 Contribution by Ground Motion The seismic event tree integration was evaluated at discrete ground motion5.

• nie contribution to core damage frequency by ground Iflotion is shown in Figure 3.6-5. The highest core damage contribution occurs from the range of 3.5g to .45g PGA. Approximately 80% of the core damage frequency occurs between .25g and .75g ..

The hazard curve o~y provides data through a ground motion of l .02g. No analysis beyond l .02g is performed. Beyond this ground motion, the surrogate event,* for which failure leads directly to core damage, is dominant. The surrogate event has a fragility of l .08g median

/ . .and beta of 0.30. Thus, it is not expected to lower the plant HCLPF or median fragility value, as calculated. In addition, the overall contribution of the surrogate event is less than 6 %. The worst case scenario would be for the surrogate event to fail at the maximllin evaluated ground motion level of l.02g versus the 503 failure rate provided. This would increase the core damage frequency to l.03E-05 versus the calculated core damage frequency of 8.88E-06 .

. Based on this evaluation, contribution from seismic events above l .02g is not expected to impact the results of the SPRA.

3.6.5.4 Sensitivity Analyses Several sensitivity analyses were perfonned foobtam abetter understanding of the SPRA results. The sensitivity analyses assisted in identifying the dominant contributors to core damage frequency. There were three sensitivity analyses performed: upgrading of the FPS equipment; eliminating the TB fire initiating event; and modifying the random events probabilities.

3.6.5.4.i Fire Protection System Sensitivity The fire protection system (FPS) is a low fragility system that appears in many cutsets. This identified the FPS as a candidate for a sensitivity analysis. The sensitivity analysis requantified the seismic event tree with the fragility for several FPS components modified.

The following fragilities were increased to .3g HCLPF (.65g median, beta of .46) from . lg HCLPF (.22g median, beta oL46): diesel day tanks (T-24 and T-40); station transformer 13 (EX-13); and FPS control panel (EC-137).

3-56

The results of this sensitivity analysis decreased the core damage frequency to 7 .16E-06 and increased the HCLPF and median fragility to* .229g and .534g, respectively.

3.6.5.4.2 Turbine Building Fire Sensitivity The seismically induced TB fire conservatively assumes that all equipment located in the TB fails. A sensitivity analysis was performed to assess the impact of this conservative assumption. The sensitivity analysis requantified the seismic event tree with no TBFR heading. *c.*c.",** ***

. ... .~~~.:1Z¥~t:i:{ :.~-.: ;~

The results of this sensitivity analysis had very little impact on the core damageiftequency or fragility. The core damage frequency decreased to 8.64E-06 and the HCLPF lµld median fragility increased to .221g and .490g, respectively.

3.6.5.4.3 Random Events Sensitivity To assess the impact of random events on the SPRA, a sensitivity analysis was performed on the random event probabilities. Two sensitivity analyses were performed with the random event probabilities: resetting all to 0.0; and resetting all to 0.0 except for the high failure rate and important random events.

The results of resetting all random event probabilities to 0.0 reduced the core damage frequency to 5.83E-06 and increased the HCLPF and median fragility to .266g and .562g, respectively. This .indicates that random events are important to the SPRA.

The high probability and important random events were determined to be those with a failure

• rate greater than 2~0E-02 and those in cutsets with low fragility seismic events. These were anticipated to be the events that contribute. the mo~t, There. were. a total of eight random events* divided irlto three group*s as identified and disc.uss~d in Section ~.6.~3.3. *The results of resetting- all random probabilities to 0: 0 except for the eight e*vents in these groups reduced core damage fre.quency to 7 .93E-06 and increased the HCLPF to .222g .

• 3-57

3.6.6 Tables and Figures for SPRA Modelling and Results Table3.6-l Seismic Event Tree Sequence Definitions SEQUENCE SEQUENCE DEFINITION 1 /SURR*/RB*/AB*/TBFR*/TBFL*/LOOP*/SBL*TRANS 2 /SURR*/RB*/AB*/TBFR*/TBFL*/LOOP* SBL*SBLOCA 3 /SURR*/RB*/AB*/TBFR*/TBFL* LOOP*/SBL*TRANS **:.'

4 /SURR*/RB*/AB*/TBFR*/TBFL* LOOP* SBL*SBLOCA 5 /SURR*/RB*/AB*/TBFR* TBFL*/LOOP*/SBL*TRANS 6 /SURR*/RB*/AB*/TBFR* TBFL*/LOOP* SBL*SBLOCA 7 /SURR*/RB*/AB*/TBFR* TBFL* LOOP*/SBL*TRANS 8 /SURR*/RB*/AB*/TBFR* TBFL* LOOP* SBL*SBLOCA 9 /SURR*/RB*/AB* TBFR*/LOOP*/SBL* TRANS 10 /SURR*/RB*/AB* TBFR*/LOOP* SBL* SBLOCA 11 /SURR*/RB*/AB* TBFR* LOOP*/SBL* TRANS 12 /SURR*/RB*/AB* TBFR* LOOP* SBL* SBLOCA 13 * /SURR*/RB* AB 14 /SURR* RB 15 SURR

/. = success of the heading (i.e., /LOOP means off-site power available)

SURR = surrogate event RB = reactor building AB .. = auxiliary building TBFR = turbine b\lil.ding *fire TBFL = turbine building flood LOOP = off-site power .

SBL = small break LOCA TRANS = transfer to the Transient Event Tree SBLOCA = transfer to the SBLOCA Event Tree 3-58

• Table 3.6-2 Seismic Resuits INDEX RESULT Mean CDF 8.88E-06 Median Fragility . 0.488g HCLPF 0.217g

• 3.,59

• Table 3.6-3 Seismic Results by Acddent Class MEDIAN ACCIDENT CLASS MEANCDF FRAGILITY HCLPF IA 3.16E-06 .522 *.; ... 229

• .,.Y IB 3.00E-06 .598 .195 II 3.llE-07 1.23 .416 IIIA 3.34E-11 NIA . NIA IIIB 2.57E-10 NIA NIA IV NIA NIA NIA SURROGATE 5.24E-07 1.08 .500 RB 9.41E-07 1.08 .500 AB 9.41E-07 1.08 .500 NI A = Not avallable - could not be calculated

• 3-60

FIGURE 3.6-1 SEISMIC EVENT TREE INIT SURR RB AB TBFR TBFL LOOP SBL RESULTS TRANSIENT ET I

I SBLOCA ET

'. *.: ~*

TRANSIENT ET I

I SBLOCA ET TRANSIENT ET I

I SBLOCA ET.

TRANSIENT ET I

I SBLOCA ET TRANSIENT ET I

I SBLOCA ET TRANSIENT ET I

I SBLOCAET CORE MELT CORE MELT I

CORE MELT INIT- SEISMIC INITIATING EVENT SURR-SURROGATE EVENT INTACT RB - REACTOR BUILDING INTACT AB -AUX BUILDING INTACT TBFR - NO TB BLDG SEISMIC-FIRE TBFL - NO TB BLDG SEISMIC-FLOOD LOOP - OFF-SITE POWER AV All.ABLE SBL - NO SEISMIC-SBLOCA 3-61

EARLY CONTROL ROOM OPERATOR ACTIONS GENERIC HEP FRAGILITY I. . - - - - - - - - - - - - - - - - - - - - - - i t : M - - - - - - - - t - ? + - - - - - - - - + r

• j 0.8 n

0 0.6

~~

~o Vl

°'N I

• .D cu

.0

~

~~

no t"'4

-~

~

~-

Q:0 0.4 ~;

~~

CM c:l'I

~

I N

t==

~~-

~ gj 0.2 ~

0 -+-----..---~___,----.----....,.-----..---~---...----.--*~-~~*-:_**~".T.~*---1 0 0.2 0.4 0.6 0.8

• Ground Motion

EARLY LOCAL OPERATOR ACTIONS GENERIC HEP FRAGILITY 0.8

~~

trl 0

\.>)

°'

I c

0.6

~

e~

(j

( j tfj

-~

"'!'j

~

~~i<

\.>) .D cu

.D 0

.... ~

0...

~ . Q'\

0.4 I t= ~ w

~~

0.2 0 0.2 0.4 0.6 0.8 Ground Motion

SEISMIC RESULTS BY ACCIDENT CLASS IB (33.8%)

IA (35 .6%)

00

~

00

~

(j

~

00 e; ~

wI '""3 ~

00

~ = ~

~

> w (j ~

I (j

9 """

~

~

(j toe 00 00

FIGURE 3.6-5 SEISMIC RESULTS BY GROUND MOTION 8

\ /)

0°'

\ /)

00 0

I\ -r-:

\ /).

0

~ ~

0

-. .02

\ /)

c

~-

~

c

' -~-. e 0

' ~

M

\ /)

' 0

' i'\.

\.

\.

~

\

• .._:e

.~

~L~

0 M N 0 UO!lOQ!JlUOJ lUa:uad 3-65

Table of Contents Section 3.7 Containment Performance 3.7.1 Containment Structures and Systems . 3-68

3. 7 .2 *Analysis of Containment Performance Following a Severe* Accident 3-69 3.7.2.1' Plant Damage States Dominant in the SPRA *.:.:\j:.69 3.7.2.2

• Containment Event Tree Evaluation  :, -'*> 3-72

3. 7 .3 Comparison of Containment Response to the IPE 3-75

3. 7 .4 Tables for Containment Performance . 3-76

. \

3-66

3. 7 Containment Performance

• • • -** As stated iil NUREG.:.1407 (Ref. 3-14), the purpose of the IPEEE containment performance evaluation is to identify vulnerabilities that involve early failure of containment functions that differ significantly from those identified in the internal events IPE. NUREG-1407 guidance for the seismic IPEEE requires an evaluation of any seismically induced containment failures and other containment performance insights. Particularly, the evaluation should consider vulnerabilities found in the systems/functions which could lead to early containment failure or which may result in high consequences. This includes: isolation, bypass, integrity, and systems required to prevent early failure.

• The scope of this analysis is based upon a review of the Level 2 analysis that was performed for the IPE (Ref. 3-10) as well as the specific issues presented in Section 3.2.6 of NUREG-1407.

3.7.1 Containment Structures and Systems A seisniic assessment was performed to identify potential vulnerabilities that could lead to early failure of containment functions. Structures, systems, and components needed to ensure containment integrity, containment isolation, and prevention of bypass were reviewed.

Containment Integrity A specific walkdown for containment integrity was conducted to identify, if they exist, any vulnerabilities associated with early containment failures. This review included the integrity of the containment itself, isolation systems such as valves, mechanical and electrical penetrations, byp~ss systems_ and pl<tnt-:unique containment systems such as igniters or active seals. * .,

• Virtually all power-actuated valves from the containment air coolers were reviewed as either .

part of the USI A-46 *(Ref. 3-25) or IPEEE program efforts. In addition, service water isolation valves along with their associated solenoid valves were reviewed and no concerns were found (these valves receive a signal to open on SIS). Typical mechanical penetrations with their associated valves were assessed from both the inside and outside of the containment wall (shell). No piping supports were closer than 3' to the containment shell so all systems have sufficient flexibility to withstand differential displacement between the internal structure and the shell of containment.

• Electrical penetration areas were reviewed at Elevations 609', 613', 617', 621', 627', and 630'. Ceramic insulators were found, but there is no potenti~l to stress them due to differential movement, so they were judged not to be susceptible to damage during an earthquake .

• 3-67

--* The emergency hatch was walked down. It is welded to the liner, is about 4' in diameter and cantilevers about 4' from the liner. It was judged to be rugged with no seismic vulnerabilities.

The personnel air lock and equipment access hatch are rugged with no credible seismic vulnerabilities.

Containment Systems Many of the essential components needed to maintain containment functionality were seismically evaluated as part of the Level I portion of the SPRA, including components of the following systems: AC power, DC power, ECCS, service water, and component cooling.

In addition, examination of important components associated with containment:Systems was performed: containment spray and containment coolers. Screening and fragility evaluation results for these components are discussed in Section 2.5. .

The purpose of this evaluation is to determine the functionality of systems which impact containment response to important accident sequences identified during ihe Level I seismic

• analysis. Table 3. 7-1 provides a summary of the systems available following seismically induced. core damage to provide functions such as debris cooling and containment heat removal. Of the six accident classes analyzed in the Level I part of the SPRA, only two

• (Accident Classes IA and IB) meet the screening criteria of NUREG-1407 (Ref. 3:-14). The challenge to containment for these accident sequence types is discussed below. The review of both accident classes supports the conclusion that containment response to core damage following a seismic event is similar to that analyzed in the internal events PRA.

3.7.2 Analysis of Containment Performance Following a Severe Accident Jn the internal events PRA, an evaluation of the containment response ,to any given severe accident used a* two phase approach involving: *

1) a Pla.nt Damage State event tree (evaluation of the status of containment systems); and

2) a Containment event tree (evaluation of phenomenological response to each Plant Damage State).

In this section, an evaluation is made of the Plant Damage States which would be expected to

.dominate the Palisades SPRA results. It is followed by a quantitative estimate of accident sequence frequencies rom the containment event tree to determine the distribution of containrrient challenges.

3.7.2.1 Plant Damage States Dominant in the SPRA In the first phase of the containment analysis, distribution of the Level I core damage sequences among eighteen possible Plant Damage States was perlormed. Table 3.7-2 identifies aspects of the accident sequences which define each of these eighteen Plant Damage

• 3-68

States. The plant damage states were developed around four distinct parameters which

• establish the characteristics of the accident sequence and plant systems important to quantification of phenomenological challenges evaluated in the CET:

1)

• Accident sequence initiator type (e.g., Transient, LOCA, SGTR, ATWS, etc.);

2) Timing of core damage with respect to initiation of offsite protective actions (early or late);

3) Status of secondary cooling; and

4) Status of plant systems important to containment functions (e.g., containment spray, coolers, location of SIRWT inventory, etc.). .. *.::

- *._,J*'

The discussion which follows identifies Plant Damage States TFJP and TFJR as dominant, ..

requiring evaluation for containment response in the Palisades SPRA. The characteristics of both of these plant damage states are that they are transient initiated events with no secondary cooling leading to relatively "early" core damage. The SIRWT contents are successfully injected to containment. For the first plant damage state (TFJP) long term recirculation is available whereas for'the second plant damage state (TEJR) it is not.

SPRA Initiator Types As noted in Section: 3.6, the Palisades SPRA is dominated by two specific Accident Classes; Class IA (loss of secondary heat removal with failure of once through cooling in the inject_ion phase) and Class IB (loss of secondary heat removal with failure of once through cooling in the recirculation phase). Both of these accident. classes represent transient initiators in which both the reactor coolant system and containment are intact up to the time at which core damage is

• assumed to occur. Other initiators such as LOCA, ATWS or SGTR are substantially less likely to be caused by a sei~mic event and do* not dominate the. s:rRA results.

SPRA Core Damage Timing In Section 3.6, it was noted that the principle failures leading to core damage*following a seismic event are associated with CST makeup. In the majority of accident sequences, makeup*

to the steam generators and removal of decay heat is adequate using the inventory normally available in the CST. It is not until CST depletion occurs (nominally 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after the initiating event) that other means of providing makeup for AFW operation or initiation of once through cooling is required .

. In Accident Class IA, initiation of once through cooling is assumed to be unsuccessful resulting in the slow depletion of reactor inventory through pressurizer PORVs or safety relief valves. Approximately 7 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event, primary system depletion would be sufficient for fuel damage to be initiated. Another hour would be required before fuel melting and slump to the bottom of the vessel .

• 3-69

In Accident Class IB, once through cooling is initiated successfully and core cooling is adequate as_ the contents of the SIRWT are injected to the vessel. Core cooling can be maintained in the once through cooling mode for several hours in this manner. At the time of SIRWT depletion, switch to recirculation is required piggy-backing a HPSI pump to the discharge of a containment spray pump. In this accident class, recirculation is assumed to be unsuccessful. Depletion of reactor inventory is assumed to occur such that core damage would be expected approximately 9 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> into the event. Another one to two hours would be required for fuel melt progression to the lower portions of the vessel.

For either of these accident classes, core damage and core melt progression to J<:>wer head

- penetration would not be expected before 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the initiating event". It was assumed in the internal events PRA that implementation of protective actions in accordance with the Emergency Plan would not occur until core damage was anticipated. As such, Accident Classes IA and IB would be considered to be early core damage scenarios. This classification will be retained in the SPRA to be consistent with the definitions in the internal events PRA even though core damage would not be expected for a substantial period of time.

SPRA Secondary Heat Removal Status Accident sequences classified in both Classes IA and IB are defined as having no secondary heat removal. *

• SPRA Containment Systems Status Table 3. 7-2 lists each of the systems evaluated in the Plant Damage State event tree in the IPE, Section-3.3 (Ref. 3-10). The availability of each system is noted for the two dominant

• accident.classes-of the SPRA-,-classes Ikand IB. -Also noted are any potenti~l vulnerabilities of the systems to se-ismic failure modes as identified in Section 2.5. In Class IB, once through cooling has been successful initially, allowing the SIRWT inventory to be pumped into the reactor and ultimately containment. It is noted for Class IA, on the other hand, that initial injection of the SIRWT would not have occurred at the point that core damage is assumed.

However, other systems are available to assure SIRWT contents are provided to containment in the form of containment spray or LPSI once vessel penetration occurs. With the exception of one containment spray valve, these systems are not susceptible to seismic failure modes that

• * *would preclude their operation post core damage. For these reasons, it can be concluded that the predominant plant damage states expected in the SPRA are those in which the SIRWT contents are located in containment.

In Accident Cfass IA, low head injection and containment spray should be available for recirculation as well as injection of the SIRWT as there are no significant _vulnerabilities of components important to recirculation to seismic failure. In Class IB scenarios, recirculation in the once through cooling mode is not assumed to be successful. -

• 3-70

Having assessed the status of injection systems, containment sprays and the location of SIRWT .

inventory, the remaining containment system in Table 3.7-2 is Co~ta~ent Coolers. As neither the containment coolers or service water systein were identified as being susceptible to any significant seismic failure modes, it can be concluded that containment coolers are likely to I,"emain available following a seismic event.

Selection of SPRA Plant Damage States J

From the preceding discussion, the characteristics of the Accident Classes which. dominate the Palisades SPRA are as follows: *

1) Transient initiat~d (non-LOCA, ATWS, etc.); _

2) -_"Early" core damage (even though not expected for 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following a_seismic event);

3) No secondary cooling;

4) SIRWTcontents in containment with containment coolers available;

5) For Accident Class IA, recirculation with containment spray or LPSI is available; and

6) For Accident Class IB, recirculation is assumed.

These ac.cident sequence characteristics match those of two Plant Damage States as defined in the internal events PRA. Accident Class IA is expected to be predominantly assigned to Plant Damage State TEJP due to the availability of long tertn recirculation. Under the assumption

• that recirculation is not available, Accident Class IB can be largely represented by Plant Damage State TEJR.

3.7.2.2 Containment Event Tree Evaluation.

Figure 3.7-1 is the containment event tree.developed for the internal events PRA. Heading definitions for the Palisades CET are as follows. .

• BYE Early Containment Bypass. This CET heading principally identifies the potential for

_interfacing system LOCA. This containment failure mode is not likely to result from a seismic event and, therefore, is not applicable to the SPRA.

CIS Containment Isolation. This mode of containment failure was evaluated as a part of the seismic walkdowns discussed in Section 3. 7. 2.

BYL Late Containment Bypass. This niode of containment bypass is considered as a part of core melt progression. In the Palisades internal events PRA it was driven by creep rupture of the steam generator tubes. This containment failure mode did not dominate the containment results for the internal events PRA and would not be expected to become any more likely as a result of a seismic initiator.

~ 3-71 '

RIV Recovery in Vessel. The principal means of terminating core melt progression prior to vessel penetration credited in the internal events PRA is to submerge the lower vessel head. To accomplish this at Palisades, Containment Sprays are assumed to be required to recirculate water through the RHR heat exchangers and maintain water level up

. around the reactor vessel by means of the reactor cavity fl~oding system piping.

UDD Upward Debris Dispers.al at reactor vessel failure. This CET heading defines the potential for core debris exiting the lower vessel head and being entrained by steam and gases from the vessel blowdown to areas in the upper part of containment. For this relocating of debris out of the reactor cavity to occur, the reactor mustJ>~ at high pressure and a significant portion of debris must be entrained.* *,,.**

CAE Early Relocation of the Core to the Auxiliary Building. The containment sump for Palisades is located beneath the reactor cavity as shown in Figure 3.7-2. If debris were to exit the lower head and remain in the reactor cavity in an uncooled state, flow through the reactor cavity floor drains and erosion of the floor of the reactor cavity could lead to relocation of the debris to the sump. From there, the debris is assumed to flow through the suction piping of ESF pumps into the engineered safeguards rooms in the Auxiliary Building.

CIE Containment Intact Early. This CET heading identifies potential challenges to containment from phenomena that might occur at or near the time of vessel failure.

These phenomena include hydrogen burning, steam explosion, vessel blowdown forces, and direct containment heating.

LVE Early Large Volatile Fission Product Release. Sequences in which sprays are available or releases are through pools <?f water re~ult in -limited* volatile releases.

CAL

• Late Reiocation of the Core to the Auxiliary Building. This CET heading is similar to CAE except that relocation to the Auxiliary Building is substantially delayed due to significant debris being retained in the reactor cavity and only a limited amount flowing through drains to the sump until long term erosion of the cavity floor occurs.

CIL Containment Intact Late.* This heading defines potential challenges to containment that might occur substantially later than core damage or vessel penetration. Such challenges would include long term over-pressurization by steam, noncondensible gas generation and combustion of hydrogen evolved from core concrete interaction.

CCI Core Concrete Interaction resulting in a large fission product release. This type of release requires oxidation of zirconium to* be in progress at the time of containment failure.

3-72

LVL Late Large Volatile Release. This type of release requires revaporization of fission products at the time of containment failure or long term dryout of pools performing debris cooling;

• The Palisades containment event tree was quantified as a part of the internal events PRA for each Plant Damage State. As containment systems are not a part of.the CET, but are quantified in the Plant Damage State analysis, the CET quantification is based strictly on phenomenological challenges important for each pl~nt damage state and is independent of what initiates the acddent sequence. The CET quantification performed iri the internal events PRA is therefore applicable to the SPRA; * *. * * *

~,

. As discussed in Section 3. 7. 2 .1, Plant Damage States TEJP and TEJR are expected to dominate the Palisades SPRA results. The distribution of these plant damage states through the CET from the internal events PRA is shown in Figure 3. 7-1.

• For both of these plant damage states, early challenges to containment are no different than exp~cted in the internal events PRA. They do not domiriate risk because of the large volume of containment and its strength (ultimate capacity in excess of 140 psig).

For State TEJP (Accident Class IB), one CET sequence dominates the results

1. 13 Successful recovery in-vessel Long term containment integrity successful with lesser contribution from two other sequences

1. 19 No recovery in-vessel Significant upward debris dispersal Long* term containment integrity successful

1. 32 No recovery in-vessel No significant upward debris dispersal Early core relocation to the Auxiliary Building No early large volatile release or long term core concrete interaction.

For State TEJR, only sequences 19 and 32 dominat~.

The difference between the two plant damage states lies in the capability of recovering the event within the vessel. To terminate core melt progression in-vessel, the reactor cavity must be flooded above the lower head. This requires operation of containment spray and the reactor cavity flooding system. For both plant damage states, containment spray is available in the injection mode. Once the SIRWT is depleted, containment spray must continue in the .

recirculation mode to maintain reactor cavity inventory from falls due to boiling heat removal or draining to the sump .

• . 3-73

For State TEJP, containment spray in the recirculation mode is available supporting long term*

reactor cavity flooding._ Review 9f systems required to support long term spray operation reveal no significant susceptibility to seismic failures with the exception of one spray valve.

The remaining spray valve would need to fail due to random causes before cavity flooding would be lost. Recovery in vessel is successful for an estimated 54 % of TEJP sequences (2. lE-6/yr).

For State TEJR, loss of recirculation is assumed to contribute to core damage. As a result, it is assumed that it is also not available for long term operation of containment spray. For this reason, sequence 13, in which recovery in-vessel occurs, is not successful for,plant damage state TEJR. .:..;

In the remaining two sequences, 19 and 32, the core debris is assumed to penetrate the lower vessel head and enter containment. These sequences determine the distribution between long

• term containment integrity and the potential for relocation of the core debris to the Auxiliary Building. The differences between these two sequences is that in the first one, significant

• . carry over of debris to the upper part of containment occurs such that the remaining debris remains cooled in the reactor cavity or sump as opposed to the flowing to the Auxiliary Building. The roughly even split between these two sequences reflects the uncertainty whetlier the reactor is at pressure or has blown down as a result of creep rupture failure in the primary coolant loops as well as in how much debris will actually be entrained and removed from the cavity if blowdown from high pressure occurs.

CET Sequence #19 ultimately results in a long term intact containment with heat being removed by containment air coolers. For theTEJP plant damage state, this sequence makes up roughly 16% of the core damage frequency (6E-7/yr). In TEJR sequences, when recovery in-vessel did not occur,. it is nearly-40% (l.5E-6/yr).

CET Sequence #32 leads to release of the core to the Auxiliary Building. However, there are only low volatile releases expected as a result of the SIRWT inventory submerging the debris providing a means of debris cooling and fission product scrubbing. Sequence 32 makes up approximately 20% (7E-7/yr) of the TEJP core damage frequency and 45% of TEJR (l.6E-6/yr).

3. 7 .3 Comparison of Containment Response to the IPE The dominant containment failure mode for core damage sequences in Accident Classes IA and IB quantified in the SPRA is relocation of core debris to the Auxiliary Building. The total frequency of this failure mode is on the order of 2.3E-6/yr. or less than 20% of the frequency of this failure mode in the IPE (Ref. 3-10). Even if uncertainties associated with upward debris dispersal after vessel penetration are considered and all SPRA core damage sequences assumed to lead to this failure .mode, this containment challenge would be estimated to be between half to two-thirds that reported for the IPE. The timing of this failure mode is 3-74

expected no sooner than 8 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following the seismic event as it is dominated by depletion of the CSTs before failure of secondary cooling occurs. Because of the availability of SIRWT inventory, there is little or no potential for early large volatile releases from seismic .

events.

• I ~ .-* '

3-75

3.7.4 Tables for Containment Performance Table 3.7-1 Level I to Level* II Dependencies

• HPSI LPSI css CONT.

AFW HPSI LPSI css . RECIRC RECIRC RECIRC COOLERS Class IA ,/ ,/ ,/ ,/ ,/

Class IB ,/ NIA NIA ,/

Systems/ FPS Components wI Low makeup CV3001 Seismic Capacity to CST Failed as a part of Level I Core D;amag~ Sequence

./ Available Post Core Damage

• NI A Not applicable to outcome of Level II results

. . . ~...... . ; .

3-76

Table 3.7-2 Palisades Plant Damage State Designators Initiators A1 Large LOCA (d > 18 in)

Ai Medium LOCA (2 in< d < 18*in)

B Small LOCA (1/2 in < d < 2 in) ..

c Interfacing System LOCA *-*

D Steam Generator Tube Rupture T Transients *'

Secondary Cooling G Secondary Cooling Available J No Secondary Cooling Available Core Damage Timing E Early Damage

• L p

Q Late Damage Containment. Safeguards Containment Sprays and Air Coolers Available Contaiilllleiir~prays. Av_ailable-and ContaJnment Air Cpolers Unavailable R Orily Containment Air Coolers Available with SIRWT in Containment '

s Only Containnient Air Coolers Available without SIRWT in Containment .

v Containment Safeguards with SIRWT in Containment w No Containment Safeguards without SIRWT in Containment x Only HPSl/LPSI Available after Vessel Failure

• 3-77

CONTAillMENI' INl!NT TR!B RSV 10 I PLANT ~AMAGB STATS PDS IBY! ICIS IBYL IRIV IUDD ICAl! ICI! *IL\11! ICAL ICIL ICC! ILVL ISEQ I PROB 10 11 12 lJ 14 lS 16 17 18 I .,:

19 **:'"--.'

20 21 22 2J 24 2S 26 27 28 29 JO 31 J2 JJ 34 JS 36 37 JB J9 40 41 42 4J 44 4S

.46 47 48 49 so Sl S2 SJ S4 SS S6 S7 SB S9 60 61 62 6J 64 PDS IBYB ICIS IBYL IRIV IUDD ICAB ICIB PALISADBS IPB r+/-= .

PAGB 1 Figure 3.7-1 3-77a

~*:. ) .

REFUELING POOL ACCESS TUBE AUXILIARY BUILDING ESF RECIRCULATION SUCTION PIPE Figure 3.7-2 3-77b

3.8 Conclusions The results of the Level 1 seismic PRA did not identify any significant seismic concerns. The a

seismic core damage frequency is 8.88E-06, with high confidence of a low probability of failure (HCLPF) of .217g PGA. The median fragility is .488g PGA. Approximately 803 of the core damage frequency occurs between .25g and .75g.

There are no seismic events that are dominant contributors to the core damage frequency.

Random failures or human errors are required, along with seismic events, to produce the highest contributing cutsets to core damage in the SPRA. This is expected siil~e ,Palisades has a relatively high design basis earthquake for its geographic region. None of tlie*' engineered safeguards equipment has significant seismic failure modes.

3-78

---* Table of Contents Section 3.9 Other Seismic Safety Issues .

3.9.1 GI-131 Flux Mapping Cart 3-80 3.9.2 Charleston Earthquake Issue (GL 88-20) 3-80 .

3.9.3 USI A".'45 Shutdown Decay Heat Removal Requirements . ::/:cJ-80 3.9.3.1 Secondary Cooling .

• 3-80 3.9.3.2 Once '.fhrough Cooling 3-81 3.9.3.3 Decay Heat Removal Conclusions . 3-81 3.9.4 USI A-17 Systems Interactions 3-82 3.9.5 USI A-40 Seismic Design Criteria 3-82 3.9.6 USI A-46 Verification of Seismic Adequacy 3-82 3-79

3.9 Other Seismic Safety Issues The performance of the IPEEE at Palisades was closely related to several other seismic safety issues. The link between the IPEEE and these other issues is presented in this section.

3.9.1 GI-131 Flux Mapping Cart This generic issue pertains to Westinghouse plants only. The Nuclear Steam Supplier for Palisades is Combustion Engineering.

• 3.9.2 Charleston Earthquake Issue (GL 88-20) .

The NRC states in response to industry question 7 .13 on page D-13 of NUREG 1407 (Ref. 3-14):

"The issue of the 1886 Charleston earthquake has been resolved. The issue of eight outlier pltznts identified through the Eastern U.S. Seismicity program has been subsumed in the IPEEE and no specific reporting is required to close this issue. "

Palisades uses the current LLNL seismic.hazard curves (Ref. 3-1) to fulfiil the requirements for this issue.

3.9.3 USI A-45 Shutdown Decay Heat Removal Requirements USI A-45, "Shutdown Decay Heat Removal Requirements" is intended to be resolved in the submittal of the IPE and IPEEE, as stated in Generic letter 88-20. This section highlights. the conclusions found in the IPEEE with regard to decay heat removal (DHR) *systems availability .

and capabilities. For the purpose of this discussion, DHR is defined as "decay heat removal.

from the core and primary coolant system (PCS) at conditions beyond the capabilities of the shutdown cooling system."

The two principle mechanisms used for PCS/core heat removal at Palisades are: 1) secondary cooling, which utilizes the steam generators as a heat sink for the primary coolant system; and

2) once through cooling (OTC).

3.9.3.1 Secondary Cooling Heat removal via the steam generators is the primary and preferred method of removing decay heat until shutdown cooling entry conditions are reached and the shutdown cooling system is placed in-service. Effective heat removal using the steam generators requires circulation of primary coolant through the core with energy removal in the steam generators by use of steam release and makeup. Although it is preferred to utilize the main condenser as the heat sink (to minimize the risk of radioactive releases and to conserve secondary inventory), DHR using the 3-80

Sf Gs is not dependant upon the main condenser since Palisades has the capability to directly release steam to the atmosphere via steam dump valves and other manually aligned pathways.

There are two mechanisms available for SIG makeup, which are auxiliary feedwater (AFW) and low pressure feed.(LPF) using the condensate pilmps. LPF is.not considered in the SPRA due to the location (in the turbine building) and the reliance on off-s,ite power. The normal method is using AFW, which has two independent, redundant trains. The primary train has a motor driven pump and a steam driven pump, with nitrogen backup supplies to critical control valves. The secondary train has a motor operated pump and control valves, all l9cated separate from the primary train. '..

• 3.9.3.2 Once Through Cooling Transients resulting in* a reactor trip employ secondary cooling as the primary mechanism tor PCS/core heat removal. For accident scenarios in which secondary cooling cannot be established or maintained, decay heat is absorbed by the primary coolant system causing PCS pressure and temperature to rise. In these accidents, the emergency procedures dictate the use of once-through-cooling (OTC). The operator is di[ected to start both HPSI pumps, open the .

.PORV block valves and place both PORVs in the open position inducing a medium-break .

LOCA. In this cooling mode, primary inventory is released through the PORVs into containment resulting in PCS pressure reduction and decay heat removal. HPSI injection in this mode maintains adequate PCS inventory as well as additional core cooling. It is important to note that for transitions from the steam generator heat sink to OTC, only one PORV and one HPSI pump are required for sufficient DHR removal. .

OTC will continue until either shutdown cooling system conditions are met or some form. of

. secondary* cooling 1s recovered. Failure of the-J>ORV*s ..to.remain-open will result in Pc;s -

pressure rising to the safety relief valve setpoints, disabling injection 'flow from the HPSI pumps due to the high pressure. Failure of the PORVs to close subsequent to recovery of secondary cooling results in the continued need for PCS inventory control.

3.9.3.3 ' Decay Heat Removal Conclusions AcCident Classes IA and IB represent sequences that result from the failure of DHR. The results for these classes is presented in Section 3. 6. 5. 3 .1. The core damage frequency for these classes is 3.85E-06 and 3.65E-06, respectively. The fragility for these classes is .522g PGA median with a HCLPF of .229g PGA and .645g PGA median with a HCLPF of .236g PGA, respectively.

The DHR issue was examined as part of the IPE (Ref. 3-10) with details presented in Appendix A of that submittal. Those results indicated that the probability of core damage due to DHR failure is low. The IPEEE evaluated the impact of seismic hazards on the DHR capability and did not yield results that were significantly different from the IPE. Therefore, 3-81

• the results show the methods used for decay heat removal at Palisades are adequate and the

--~-*

. USI A-45 has been addressed by the Palisades IPE..

3.9.4 USI A-17 Systems Interactions The walkdowns explicitly considered USI A-17 interactions and is subsumed in the USI A-46 progr~. The seismic, fire, and flooding examinations for this IPEEE report incorporate the walkdown findings for USI A-17 related items. _

3.9.5 USI A-40 Seismic Design Criteria

.The one remaining element of USI A-40 concerns the evaluation of tanks. The SPRA added tank to the PRA models to evaluate their seismic affects. The SPRA used the results of the A-46 assessments, which evaluated tanks for the concerns raised in USI A-40. Evaluation techniques incorporated the considerations established for the Seismic Margins Program (Ref.

3-5) thereby resolving the analytical concerns raised in A-40.

3.9.6 USI A-46 Verification of Seismic Adequacy The IPEEE project team performed the SPRA jointly with the A-46 evaluations. The selection

. of SPRA systems and ~omponents sought to retain commonalty with the A-46 SSEL to the extent practical. Seismic walkdown te_ams gathered data for both evaluations simultaneously .

• 3-82

• • 3.10 3-1 References*

NUREG/CR-1488, Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains 3-2 NRC Information Notice 94-32, Revised Seismic Hazard Estimates, April 29, 1994, Review of Revised Livermore Seismic Hazard Estimates for 69 Sites East of the Rocky Mountains 3-3 . IE Bulletin 79-14, Seismic Analysis for As-Built Safety-Related .Piping .Systems, July 2, 1979 . ~* .

3-4 Bechtel Reports: Foundation Investigation for Palisades Nuclear Plant, South Haven, Michigan, 1965; Foundation Investigation for Design of Palisades Nuclear Plant, South.

Haven, Michigan, 1966; and Soils and Foundation Investigation, Proposed Nuclear Power Plant, Palisades Unit 2, South Haven, Michigan, 1972 3-5 EPRI Report NP-6041-SL, Nuclear Power Plant Seismic Margin, Revision 1 3-6 Generic Implementing Procedure (GIP) for Seismic Qualification of Nuclear Power Plant Equipment, Revision 2 3-7 EPRI Report NP-5228-SL, Seismic Verification of Nuclear Plant Equipment Anchorage, Revision 1 3-8

• EPRI Report NP-7146, Development of In-Cabinet Amplified Response Spectra for Electrical Panels and Benchboards, Revision O 3-9 EPRI Report NP-7147-SL, Seismic Ruggedness of Relays Projects 1707-15 and 2925-2, Final Report, August 1991 3-10 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 3-11 Palisades Final Safety Analysis Report (FSAR) 3-12

• John A. Blume and Associates Engineers, Calculations of Anchorage and Support of Safety Related Electrical Equipment 3-13 Seismic Analysis of Safety Related NuclearStructures" ASCE Standard 4-:86,

. September 1986 3-14 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 3-83

' \

---* 3-15 3-16 Deleted Palisades Soil Evaluation Report prepared by GEi Consultants, Inc., Revision 1 3-17 . Inspection and Enforcement Bulletin IEB 80-11, Evaluation of Masonry Wall Design 3-18 EPRI Report TR-103959, Methodology for Developing Seismic Fragilities, by JWReed and RPKennedy, EPRI, June 1994 3-19 Palisades Calcillatipn EA-POC007899-BLDGS, Calculation of Powei<S.Iqek Building

• Shears and Moments Due to UHS Ground Motion, June 1995 *.:.:.;

3-20 . NUREG-0820, Integrated Plant Safety Assessment - Systematic Evaluation Program, Palisades Plant, Final Report, October 1982 3-21 Palisades Calculation EA-91C2846-C007, Pali_sades SSI and IPEEE Floor Response Spectra, March 1994 3-22 SHAKE, Computer Program for Earthquake Response Analysis of Horizontal Layered Sites, JLysmer, Report No. EERC 72-12, University of California, Berkeley 3-23 Stevenson and Associates Calculation 91C2850-c013, Seismic Evaluati.on of Buried Piping Asi;ociated with the Diesel Oil Tank T-10, March 1994 3-24 Sheet Metal and Air Conditioning Contractors National Association, Inc, 1985, 1st

• Edition 3-25 .*Report of SQUG Assessment at Palisades Nuclear Plant for the Resolution of USI A-_

46, May 1995 3-26 NUREG/CR-4840, Recommended Procedures for the Simplified External Event Risk

• Analysis for NUREG-1150, September 1989 3-27 NUREG/CR-5250, Seismic Hazard Characterization of 69 *Nuclear Power Plant Sites East of the Rocky Mom.~tains, Volumes 1-8, January 1989 3-28 *. Severe Accident Issue Closure Guidelines, Nuclear Energy Institute (NEI) 91-04, Rev 1, December 1994 3-29 Set Equation Transformation System (SETS) Program, Developed by Logic Analysts, Inc.

• .3-84

3-30 Seismic Hazard Integration Package (SHIP) Program, Developed by Jack R. Benjamin

• and Associates, Inc.

3-31 NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f), November 1988

. *~ ;

. -~:: ... ::- *_:.":.:-

- - .. *' ,~

• 3-85

TABLE OF CONTENTS SECTION 4.0 FIRE ANALYSIS 4.0 . INTRODUCTION 4-1 4.1 FIRE MODELING METHODOLOGY 4-13 4.2 MODELING ASSUMPTIONS . . ..*.. :

4-24

. _.. -~

4.3 REVIEW OF PLANT INFORMATION AND SOURCES 4-26 4.4 PLANT WALKDOWNS . 4-27 4.5 IDENTIFICATION OF IMPORTANT FIRE AREAS 4-3.0 4.6 . FIRE AREA INITIAL SCREENING 4-41 4.7 FIRE IGNITION DATA -4_45 4.8 FIRE DETECTION AND SUPPRESSION 4-55

• 4.9 4.10 FIRE ~ROWTH

. FIRE EVENT TREES AND PROPAGATION 4-62 4-63 4.11 ANALYSIS OF FIRE SEQUENCES AND PLANT RESPONSE 4-71 4.12 HUMAN RELIABILITY ANALYSIS FOR FIRES 4-87 4.13 . CONTAINMENT PERFORMANCE 4-93 4.14 FIRE RISK SCOPING STUDY ISSUES 4-111 4.15 USI A-45 AND OTHER SAFETY ISSUES 4-116 4.16 SENSITIVITY ANALYSIS 4-118 4.17 RESULTS AND CONCLUSIONS 4-119 4.18 REFERENCES 4-121

• Revision 1, May 22, 1996 4.0-i

Table of Contents Section 4.0 Introduction 4.0.1 Background 4-2 4.02 Plant Familiarization 4-2 4.03 Overall Methodology . 4-2 4.04 Summary of Major Findings 4-3 .

4.0.4.1 Cable Spreading Room 4-4 4.0.4.2 Control Room 4-5 4.0.4.3 lD Switchgear Room 4-5

.. 4.0.4.4 Turbine Building 4-6 4.0.4.5 lC Switchgear Room 4-7 Revision 1, May 22, 1996 4-1

4.0 INTRODUCTION

4.0.1 Background The assessment that is described in this section addresses the requirements of Supplement 4 to Generic Letter (GL) 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" (Ref 4-1) for internal fires at the Palisades Nuclear Plant. The fire analysis performed for the IPEEE began in 1994 and reflects some of the major plant changes made since the IPE (Ref. 4-2). This internal fire assessment combines the PRA approach used in the IPE with the deterministic evaluation techniques of the Fite Induced -Vulnerabilities Evaluation (FIVE) Methodology (Ref. 4-4). ~--~:> *.

4.0.2 Plant Familiariz;ition Palisades has implemented plant specific requirements of 10 CFR 50, Appendix R, a5 part of its Fire Protection Program. Implementation of the plant Fire Protection Program addressed issues such as fire barriers/penetration seals, administrative control of combustibles, fire brigade training and equipment, protection of safe shutdown equipment, etc. The administrative control of transient cbmbustibles is also a contributing factor to the low fire risk in certain key. areas.

Fulfillment of these requirements resulted .in physical modifications to the plant including installation of an alternate shutdown panel (ASDP), re-routing of safe shutdown cables, and upgrading of fire barriers. AdditioIJ.ally, the Fire Protection organization recently upgraded the existing Fire Protection Program at Palisades. The upgrade .includes enhancements to the cable/raceway schedule, completion of circuit analyses to verify operability of key equipment and

• incorporation of this information into a controlled database. The database integrates the results of the circuit analyses with other information such as fire area/zone designations, cable

~esignations, raceway locatiol).s, etc., into a proquct that c~ provide the status. of the equipment evaluated in each fire (!Iea. The updated information has been used as *input to the fire risk

. analysis ..

• 4.0.3 Overall Methodology The Palisades fire analysis uses an approach that combined the deterministic evaluation techniques from the FIVE methodology with classical PRA techniques. The FIVE methodology provides a means of establishing fire boundaries as well as methods to evaluate the probability and the timing of damage to components located in a fire area/zone involved in a fire. PRA techniques allow determination of fire area/zone specific core damage frequencies associated with fires within these fire areas/zones. Fire areas identified by the Fire Protection Program were used as the basis of the fire areas evaluated by the fire risk analysis. These fire areas were evaluated for further division based on combustible loading and fire spread potential to identify fire zones within fire areas. The fire areas/zones identified were evaluated and quantified using the fault trees and transient event tree from the IPE. The fault and event trees were modified to accurately reflect the fire analysis. Any modifications to the fault or event trees are documented and 1 discussed in this report.

Revision 1, May 22, 1996 4-2

The transient event tree from the IPE and related fault trees were used to perform the

. quantification .. The. resulting accident sequer.ices were binned into three accident clas_ses which are a subset of those used in the IPE: Contribution to the core damage frequency (CDF) by fire .

area is shown in Figure 4.0-1. Contribution to the CDF by accident class is shown in Figure 4.0-

2. The major contributors to each accident class are shown in Figures 4.0-:-3, 4.0-4 and 4.0-5.

4.0.4 Summary of Major Findings The principle finding of this analysis is that there is no area in the .plant in. which a fire would.

lead directly to the inability to cool the core. Without additional* random ~quipment failures (unrelated to damage caused by the fire) or human errors, core damage will.'~ot occur. As a result, this study concludes that there are no major vulnerabilities due to ,fire ev.ents at the Palisades Nuclear Power Plant. .. -

The core damage frequency (CDF) resulting from fires is estimated to be 3.3 IE-5/year. The fire sequences represent approximately 64% of the CDF for the IPE. It should be noted that these results include a number of conservative assumptions. For example, fire suppression wa.S not credited except in the control room, cable spreading room and Class IE switchgear rooms. Even when suppression was credited, .the AFW system was assumed failed due to the fire. Fires were

.(llso assumed to completely engulf an area, once ignited, and fail all equipment and cabling .

within the fire area/zone if not suppressed. No credit was given for continued operation of the plant (all fires evaluated were assumed to result in a plant trip) and no credit was given for low pressure feed (condensate pumps) for any fire area. Additional effort to make these and other conservative assumptions more realistic could result in a fire initiated CDF lower than that presented in this report.

As shown in Figure 4.0-I, the majority of the fire CDF (>89%) can be traced to five fire areas:*

cable sprea4ingroom (33.5%); mai11*control i:.ooqif24:4%); 1D'Bwitchgearroom (14.7%); turbine building (9.3%); and IC switchgear room (7.6%). A brief discussion of each of these areas is presented later in this section, including a description of the means by which adequate core .

cooling can be assured even if a fire were to cause significant damage.

• As shown in Figure 4.0-2, fire core damage sequences are defined by three accident classes. The majority of the CDF is related principally to two accident classes: Accident IA (59.4%) and Accident Class I~ (39.6%). Accident ClassU is a minor contributor to fire CDF (1.0%).

Accident Class IA represents sequences in which core damage results from failure of secondary heat removal and once through cooling in the injection phase. This accident class represents 59.4% of the fire core damage frequency. As shown in Figure 4.0-3, the majority of the contribution (>97%) from Accident Class IA is due to fires in the cable spreading room (39.0%),

C()ntrol room (25.0%), ID switchgear room (15.2%), turbine building(I0.6%), and IC switchgear room (7.3%).

Revision 1, May 22, 1996 4-3

Accident Class IB represents sequences in which core damage results from failure of secondary heat removal and once through cooling in the recirculation phase: Accident Class IB is 39.6%

of the fire core damage frequency. As shown in Figtire 4.0-4, the majority of the contribution

(>92%) from Accident Class IB is due to fires in the cable spreading room (26.2%), control room (24.2%), lD switchgear room (12.2%), west *safeguards rooin (8.5%), lC switchgear room (8.1 %), turbine building (7.4%), and 590' auxiliary building (6.2%).

Accident Class II represents sequences in which core damage results from failure of containment heat removal leading to a containment failure. Accident Class II is 1.0% _qf the fire CDF. As shown in Figure 4.0-5, only three fire areas contribute to Accident Class II: lD*s~tchgear room (89.0%); turbine building (9.2%); and 590' auxiliary building (1.7%).. ~- *

. - .. ~. .

4.0.4.1 Cable Spreadfog Room The cable spreading room was evaluated in two ways: cabinet fires and whole room exposure .

fires. The fire initiation frequency for each cabinet fire was conservatively set equal to the total of all cabinet fire initiating frequencies. *Therefore, only the worst case cabinet fire was included in the fire area results, which is assumed to bound the results . of cabinet

. fires. The worst ca5e '

cabinet* fire and exposure fire results were combined to obtain the fire result for the cable spreading room.

Cabinet fires were assumed to start inside and be contained within the cabinet (Ref. 4-15). The worst case cabinet fire was in EJ-575. This cabinet contains cables that connect to DC panel DI IA. A fire in this cabinet could lead to a failure of DC panel Dl lA, which is assumed to lead to the unavailability of one SWS pump, one diesel generator (DG 1-1 ), startup power to safety-related bus lC, one moto~ driven auxiliary feedwater {AFW) pump, two containment spray pumps cmd. on~ ~gh pr~SSty°(! ~.afefy injec~_i,O.!l (fIP~l) pump. -~quipmept -~vailableJo_l~9wing_a fire !n this cabinet includes-two AFW pumps (on~ motor _and one steam driven) for decay heat removal via

. the steam generators and one HPSI and two power operated relief valves (PORVs) for once*

through cooling (OTC). One containinent spray pump and all three containment air coolers are available for containment heat removal.

Exposure fires were asstimed to start outside of all the cabinets. The exposure fire initiating frequency was cakulated based* on the equipment and combustibles in the room outside of the cabinets. Credit was taken for automatic detection and suppression. If automatic detection and suppression failed, the* fire is assumed to engulf the entire room and fail all the cabling and equipment in the room. Failure of automatic detection *and suppression leaves only the steam driven AFW pump from the alternate shutdown panel (ASDP) or local manual operation of the

• steail) supply valves. and injection valves available for decay heat removal via the steam generators.

If automatic detection and suppression was successful, then the fire was assumed to be conra'ined locally and fail only one system (either AFW or HPSI). Failing the AFW system results in a higher CDF, so only the AFW system was considered failed by the fire following succes.sful Revision 1, May 22, 1996 4-4

suppression. This leaves the steam driven AFW pump from the alternate shutdown panel (ASDP) or local manual operation of the steam supply valves and injection valves available for decay heat removal via the steam generators and both trains of PORVs and HPSI available for OTC. In addition, all three containment spray pumps and all three containment air coolers are available for containment heat removal.

4.0.4.2. Control Room The control room was evaluated similar to the cable spreading room with cabinet fires and exposure fires. The same cable spreading room assumptions for the cabinet and exposure fires apply to the control room. Also, detection and suppression was credited in a s~_milar manner to the cable spreading room, except that the control room relied on automatic anct"manual detection along with manual suppression (no automatic suppression).

Walkdowns were performed to confirm that there is sufficient fire protection within a cabinet to prevent a fire from disabling both channels simultaneously. Each cabinet has a physical barrier to separate each train within a cabinet. The physical barriers were some type of metal* radiant heat shields, determined to be sufficient to prevent a:* fire from damaging the cables inside the barrier. Therefore, each control room cabinet was evaluated for a right and left channel fire. The worst case cabinet fire was the right channel of EC-08 (EC-OSR). Equipment available following a fire in this cabinet includes two AFW pumps (one steam driven and one motor driven) for decay heat removal via the steam generators and one HPSI and two PORVs for OTC. Two containment spray pumps and all three containment air coolers*are available for containment heat.

removal.

Failure of detection and suppression leaves only the steam driven AFW pump from the ASDP

• or local manual operation of the steam supply valves and injection valves available for decay heat removal .via the steam 'generators. . ..

If manual suppression was successful, then the fire was assumed to be contained localiy and only fail the worst case ' system. The worst case system for* this fire area is the AFW. system ..

Successful detection and suppression leaves the steam driven AFW pump from the ASDP or local manual operation of the steam supply valves and injection valves available for decay heat removal via the steam generators and both trains of PORVs and HPSI available for OTC. In addition, all three containment spray pumps and all three containment air; coolers are available for containment heat removal.

4.0.4.3 lD. Switchgear Room The 1D switchgear room was evaluated similar to the cable spreading room with cabinet fires and exposure fires. The same cable spreading room assumptions for the cabinet and exposure fires apply to the 1D switchgear room. Also, automatic detection and suppression was credited in a similar manner to the cable spreading room. *

• Revision 1, May 22, 1996 4-5

There were nine cabinets evaluated in the ID switchgear room. The worst case cabinet fire was

• the bus 1D cubicle. Equipment available following a fire in this cabinet includes two auxiliary

• feedwater pumps (AFW) (one steam driven and one motor driven) for decay heat removal via the steam generators and one train of high pressure safety injection (HPSI) and power operated relief valves (PORVs) for once through cooling (OTC). Two containment spray pumps are available for containment heat removal.

Failure of automatic detection and suppression leaves only the steam driven AFW pump from the ASDP or local manual operation of the steam supply valves and injection valves available for decay heat removal via the steam generators.

If automatic detection and suppression was successful, then the fire was assumed to be contained locally and only fail the worst case system. The worst case system for this fire area is the AFW system. Successful dete_ction and suppression leaves the steam driven AFW pump from the ASDP or local manual operation of the steam supply valves and injection valves available for decay heat removal via the steam generators and both trains of PORVs and HPSI available for OTC. In addition, all three containment spray pumps and all three containment air coolers are available for containment heat removal.

4.0.4.4 Turbine Building The turbine building was divided into three fire zones: east; south; and west. No credit was given for suppression of fires in this area.

• Equipment available* following a fire in the east zone includes two AFW pumps (one turbine driven via its manual steam supply and one motor-driven) for decay heat removal via the steam

,generators and both HPSI pumps for OTC. However, only one train of HPSI injection motor-operated*valves are.avail~ble. The second HPSI pump.can be used by locally opening the valves using a. hand wheel. .* All three air coolers and all three containment spray .pumps are available to remove heat from containment. This fire zone may have fire induced damage to cables that leads to loss of the safeguards transformer and loss of fast transfer to the startup transformer ..

Iii this scenario, both diesel generators start and load and have the startup trcµisformer available for use by manual transfer.

Equipment available following a fire in the south zone includes all three AFW pumps (one turbine driven and two motor-driven) for decay heat removal via the steam generators and both high pressure safety injection (HPSI) pumps for OTC. However, only one train of HPSI injection" motor-operated valves are available. The second HPSI pump can be used by locally opening the valves using a hand wheel. All three air coolers and all three containment spray pumps are available to remove heat from containment. This fire zone may also have fire induced damage to cables that leads to loss of the safeguards .transformer and loss of fast transfer to the startup transformer. In .this scenario, both diesel generators start and load and have the startup transformer available for use by manual transfer.

Revision 1, May 22, 1996

• 4-6

Equipment available following a fire in the west zone includes all three AFW pumps (one turbine driven and two motor-driven) for decay heat removal. via the steam generators and both HPSI pumps for OTC (including both trains of injection valves). All three air coolers and all three containment spray pumps are available to remove heat from containment. The safeguards transformer and fast transfer are available.

4.0.4.5 1C Switchgear Room The 1C switchgear room was evaluated similar to the cable spreading room with cabinet fires and exposure fires. The same cable spreading room assumptions for the cabinet and exposure fires apply to the 1C switchgeaf room. Also, automatic detection and suppression . ~as credited in a similar manner to the cable spreading room. **

The worst case cabinet fire was in the bus 1C cubicle. Equipment available following a fire in this cabinet includes two AFW pumps (one turbine driven and one motor driven) for decay heat removal via the steam generators and one HPSI and PORV for OTC. One containment spray pump and all three containment air coolers are available for containment heat removal.

Failure of automatic detection and suppression leaves only the steam driven AFW pump from the ASDP or local manual operation of the steam supply valves and injection valves available for decay heat removal via the steam generators.

If automatic detection and suppression was successful, then the fire was assumed to be contained locally and only fail the worst case system. The worst case system for this fire area is the AFW system. Successful detection and suppression leaves the steam* driven AFW pump from the ASDP or local manual operation of the steam supply valves and injection valves available for

.decay heat removal via the steam generators and both trains of PORVs and HPSI availaple for.

• OTC. In addition; all three containment spraf pumps *and all three contairiment air coolers are '

available for containment heat removal. . * *

• Revision 1, May 22, 1996 4-7

FIGURE 4.0-1 CDF By Fire A..rea CONTROL RM (24.4%)

TURB BLDG (9 .3%)

BUS lC RM (7.6°/o)

BUS lD RM (14 .7°/o)

CABLE SPRDG RM (33.5%)

Revision 1, May 22, 1996 4-8

• FIGURE 4.0-2 CDF By Accident Class IB (39.6%)

IA (59.4%)

Revision 1, May 22, 1996 4-9

FIGURE 4.0-3 Accident Class IA By Fire Area OTHER (2 .8%)

TURB BLDG (10.6%)

CONTROL RM (25.0o/o)

BUS lC RM (7.3%)

BUS lD RM (15.2%)

CABLE SPRDG RM .(39.0%)

Revision 1, May 22, 1996 4-10

FIGURE 4.0-4 Accident Class IB by Fire Area W SAFEGUARDS (8.5%) CONTROL RM (24.2%)

TURB BLDG (7.4%)

590 1 AUX BLDG (6 .2°/o)

BUS lC RM (8.1%)

CABLE SPRDG RM (26.2%)

BUS lD RM (12 .2o/o)

Revision 1, May 22, 1996 4-11

FIGURE 4.0-5 Accident Class II by Fire Area TURB BLDG (9.2o/o) 590' AUX BLDG (1.7°/o)

BUS lD RM (89.0%)

Revision 1, May 22, 1996 4-12

Table of Contents

• 4.1.1 Fire Areas Section 4.1 Fire Analysis Methodology 4-14 4.1.2 Spread of Fires Across Boundaries 4-14 4.1.3 Systems Credited 4-15 4.1.4 Accident Sequence Evaluation 4-16 4.1.5 Uncertainties 4-17

• Revision I, May 22, 1996 4-13

4.1 FIRE ANALYSIS METHODOLOGY

• This fire analysis combines the deterministic evaluation techniques of the FIVE methodology with classical PRA techniques. The flow chart in Figure 4.1:-1 illustrates the process used to quantify accident sequences for the Palisades fire IPEEE. Phase I is a deterministic evaluation of fire spread and ignition source frequencies. Phase II is a probabilistic evaluation of core damage using PRA techniques. If core damage frequencies (CDF) are unacceptable (higher than the screening value), Phase II continues With a deterministic evaluation of suppression effects and fire propagation. The FIVE methodology is used to establish fire boundaries and to evaluate the probability and the timing of damage to components located in a compartment involved in a fire.

• PRA techniques are used to determine compartment-specific CDF for fires ~9iifl specific fire areas.

4.1.1 Fire Areas The Appendix R Fire Areas for Palisades are defined in Table 4.1-1. For this IPEEE fire analysis, those areas which meet the following criteria were screened from further consideration:

1) The area contains no safety related equipment or cables supporting those systems, and

2) A fire in the area would cause no demand for safe shutdown functions because the operating crew_ can maintain normal plant operations.

• In applyiilg this criteria, 13 fire areas we.re screened from further evaluation. In addition, the fire IPEEE used the FIVE methodology to divide the Appendix R fire areas into smaller fire zones.

Section 4.5 provides more details on the division of a fire ar~a into smaller fire zones. Table 4.1-2 contains the fire IPEEE fire zones. Section 4.6 provides additional details of the screening process.

4.1.2 . Spread of Fires Across Boundaries The spread of fires across fire area/zone boundaries is addressed in the FIVE methodology. The

• following criteria were. applied to identify boundaries which can be considered to prevent the spread of a fire: *

1) Boundaries between two areas, neither of which contain safe shutdown components nor plant trip initiators on the basis that a fire involving both areas would have no adverse effect on safe shutdown capability,

2) Boundaries that consist of a 2-hour or 3-hour rated fire barrier on the basis of fire barrier effectiveness, Revision 1, May 22,. 1996 4-14

3) Boundaries that consist of a 1-hour rated fire barrier with a combustible loading in the

• 4) exposing area of less than 80,000 BTU/ff on the basis of fire barrier effectiveness and low combustible loading.

Boundaries where the exposing area has very low combustible loading

(<20,000 BTU/ff), on the basis that manual suppression will prevent fire spread to the adjacent area.

• 5) Boundaries where both the exposing area and exposed area have a very low combustible loading ( <20,000 BTU/ff) on the basis that a significant fire cannot deyelop ill the area .

6) Boundaries where automatic fire* suppression is installed over .co~bustibles in the exposing area on .the basis that this will prevent fire spread to the adjacent area.

If any one of criteria 1, 2, 3 or 5 were met, the potential for fire spread through or across the common boundary was assumed to be negligible or inconsequential. These four criteria credit fire boundary ratings artd combustible loading.

• Criteria 4 and 6, in which fire suppression is credited, were not initially applied, in order to allow future evaluation of the impact of suppression and because the probability of automatic fire suppression systems failing to actuate is non-negligible. *If any of the compartment fire events led to dominant core damage sequences, the effect of fire.suppression was( then evaluated in a probabilistic manner. This approach allowed identification of fire suppression systems that have the greatest impact on fire-induced core damage.

• The potential for fire spread between areas is discussed in more detail in Section 4.9.

4.1.3 Systems Credited

• Before fire sequence quantification can be performed, if is necessary to l.de~tify the functions and*.

systems to be included in the fire IPEEE. The associated equipment and cables and respective locations are identified using plant documents (see Section 4.3) in conjunction with the Palisades

• IPE and plant walkdowns. Only frontlin_e safe shutdown systems and their support systems that were included in the IPE were credited in this analysis. Frontline safe shutdown systems credited in the fire IPEEE consist of high pressure safety injection (HPSI), auxiliary feedwater (AFW),

atmospheric dump valves (ADVs), containment spray (CS), containment air coolers (CAC) and pressurizer power operated relief valves (PORVs). The PORV system is not defined in the Appendix R analysis as _a safe shutdown system but was included in the fire IPEEE because it has significant impact on core damage results.

Revision 1, May 22, 1996 4-15

4.1.4 Accident Sequen~e Evaluation

• The next phase of the analysis was a multi-step,

• progressive probabilistic evaluation that considered the sequence of events that must occur to create the loss of safe shutdown/risk significant functions. Figure 4.1-1 shows the flow path and the major steps in the process. These steps consist of determining ignition source frequencies and quantifying specific fire scenarios.

The impact of fire suppression was also evaluated for risk significant areas. The potential impact

_on containment performance and isolation was evaluated following the core damage assessment.

The first step of the accident sequence was to identify and tally the ignition somce frequencies in each fire area. These sources were identified from a database of plant equip~ent (see Section 4.3 for description of the database) and a fire zone specific frequency was calculated in accordance with the methods detailed in FIVE. Section 4.7 details the actual methodology used in these calculations.

The next step, quantifying specific fire scenarios, was performed using the ignition so'urce

• information in conjunction with the fire spread and fire effects information developed in Phase I. At this point in the evalilation, it was assumed that all equipment subject to fire induced damage and cabling within the affected fire area was inoperable. All the corresponding basic events in the IPE logic models were assumed to be failed. The core damage frequency (CDF) for each of the fire area5 was then quantified using *the IPE fault trees and event tree models.

• Some fire zones included ~dditional operator actions and assumptions that were incorporated into the fault trees and event trees developed explicitly for these rooms. The quantification yielded a CDF for each fire zone by incorporating the zone specific ignition frequencies and crediting the unaffected systems/trains included in the IPE.

The cable spreading room, the control room, and both Class 1E switchgear rooms were selected for detailed fire detection and suppression analysis. The cable spreading and Class 1E switchgear

- "rooms .were selected for. more detailed analysis because fuey were significant -contributors to ove~ali core dainage and are protected-by automatic detectiOn and suppression systems. Similarly, the control room was selected for detailed analysis because it was also a significant contributor to core damage _and it was continuously occupied, resulting in a high likelihood of early manual detection and suppression.

The final step was to evaluate the impact of the fires on the containment, structurally and functionally. Containment structural evaluations included factors such as combustible loading in and around the containment. The potential for containment isolation failure or containment bypass was also investigated. Containment isolation valves fail in a safe position (closed) and *

• multiple failures are required for bypass. Because of these and other factors, containment integrity is expected to be maintained following any postulated fire. A more detailed description*

of these analyses is contained in Section 4.13.. *

• • Revision 1, May 22, 1996 4-16

• • 4.1.5 Uncertainties Most of the uncertainty in the results is related to the accuracy and quality of the available information to support the fire analysis. The accuracy of information regarding the effects of fire and the potential for fire induced damage were significantly improve4 by* using the current results of the recent upgrade of the Appendix R program for Palisades .. The major uncertainties in the fire analysis are centered around assumptions made in the accident sequence quantification.

These assumptions include those. regarding credit for various systems and operator actions that may occur in response to a fire as well as those implicit in the deterministic evalµation of plant response to a fire such as that contained in the FIVE methodology or experimental .. . :

~* .

studies .

As examples, automatic or manual fire suppression was not credited except iii *~the control room, cable ~preading room and both Class IE sWitchgear rooms (buses IC & ID). Crediting suppression would have reduced the quantified core damage frequency. Fires were assumed to completely engulf an area in which they started. If deterministic methods had been applied to show the limit of the fire spread, core damage may have been reduced.. Further, repair or*

recovery activities were only credited for' two fire areas (AFW system in the auxiliary building and west safeguards room). These repair and recovery activities are supported by data collected in the nuclear industry for PWR AFW systems.* Non-Appendix R systems were credited in some scenarios and the uncertainty for the cable *routing is higher than for Appendix R systems.

Wherever possible, assumptions such as these were made. in a ~onservative manner to bound

. uncertainties.

Assumptions made to reduce the risk specific areas within the plant include the likelihood of fire spread between the turbine building and the lower level of the CCW room (through the "jailhouse" door) and suppression induced damage in the cable spreading room. While there m().y ..

.be *uncertainties associated with these assumptions, they are supported by deterministic or experimental evidence which supports their application to specific conditions .. Further, the~overall conclusions of the fire IPEEE can be shown to be insensitive to these~ particular.~unc~rtainties. *.

That is, there is no one area in the Palisades plant in which 'a fire- could start that do-es not require additional failures Unrelated to the fire before inadequate core cooling would result.

• . Revision 1, May 22, 1996 4-17

TABLE 4'1-1 PALISADES APPENDIX R FIRE AREAS FIRE AREA DESCRIPTION 1 Control Room 2 Cable Spreading Room

-'.~-*

3 1D Switchgear Room 4 1C Switchgear Room 5 Diesel Generator 1-1 Room 6 Diesel Generator 1-2 Room 7&8 . Diesel Day Tank Rooms 9 Intake Structure 10 East Engineered Safeguards 11 Battery Room #2 12 Battery Room #3 13 Auxiliary Building 14 Containment Building

\

15 Engineered Safeguards Panel Room 16 Component Cooling Water Pump Room

• 17 Refueling and Spent Fuel Pool Room 18 Demineralizer Rooms 19 Compactor Area - Track Alley

• • Revision 1, May 22, 1996 4-18

• TABLE 4.1-1 PALISADES APPENDIX R FIRE AREAS FIRE AREA DESCRIPTION 20 Spent Fuel Pool Equipment Room 21 Electric Equipment Room 22 Turbine Lube Oil Room .. ': .. ~

• .. ~***

23 Turbine Building 24 Auxiliary Feedwater Pump Room 25 Heating Boiler Rooms 26 Southwest Cable Penetration Room 27 Radwaste Addition - Volume Reduction System 28 West Engineered Safeguards Room 29 Center Mechanical Equipment Rooms 30 East Mechanical Equipment Rooms 31 We_st Mechanical Equipment Rooms 32 SIR W Tank/CCW Roof Area 33 Technical Support Center ~

34 Man Hole #1 35 Man Hole #2 36 Man Hole #3 Revision 1, May 22, 1996 4-19

TABLE 4J-2 PALISADES FIRE IPEEE FIRE AREAS/ZONES FIRE AREA/ DESCRIPTION ZONE 1 Control Room Cable Spreading Roorri . *::.

2

., *.. ; .~

3 ID Switchgear Room 4 IC Switchgear Room 5 Diesel Generator 1-1 Room 6 Diesel Generator 1-2 Room 7&8 Diesel Day Tank Rooms 9A* Intake Structure - East Side (Service Water System Area) 9B*. Intake Structure - West Side (Fire Protection System Area) 10 East Engineered Safeguards 11 Battery Room #2.

12 Battery Room #3 13Al

• Auxiliary Building 590' Corridor (CCW Room to Charging Room) 13A2* Auxiliary Building 590' Corridor (Except for Zone 13A 1) 13B* Charging Pump Room Revision 1, May 22, 1996 4-20

TABLE 4.1-2 PALI SADES FIRE IPEEE FIRE AREAS/ZONES FIRE AREA/. DESCRIPTION ZONE 13C*

• All Other Areas on the 590' Auxiliary Building

. 14 Containment Building ** ',

15 -Engineered Safeguards Panel Room ..

16 Component Cooling Water Pump Room 17 Refueling and Spent Fuel Pool Room 18 Demineralizer Rooms 19 Compactor Area - Track Alley 20 Spent Fuel Pool Equipment Room 21A* Electric Equipment Room - East Side (Bus 19 Area) 21B* Electric Equipment Room - West Side (Bus 20 Area) 22 Turbine Lube Oil Room 23E* East Side of Turbine Building (North of MFW Pumps)*

23S* South Side of Turbine Building (South of MFW Pumps) 23W* West Side of Tur,bine Building (North of MFW Pumps) 24 Auxiliary Feedwater Pump Room 25 Heating Boiler Rooms 26 Southwest Cable Penetration Room 27 Radwaste Addition - Volume Reduction System 28 West Engineered Safeguards Room

• Revision 1, May 22, 1996 4-21

TABLE 4.1-2 PALISADES FIRE IPEEE FIRE AREAS/ZONES FIRE AREA/ DESCRIPTION ZONE 29 Center Mechanical Equipment Rooms 30 East Mechanical Equipment Rooms  :

31 West Mechanical Equipment Rooms -...

• • ~:

32 SIR W Tank/CCW Roof Area 33 Technical Support Center 34* Man Hole #1, #2, #3

• New fire zones created by the fire IPEEE analysis based on discussions in Section 4.5.

Revision 1, May 22, 1996 4-22

FIGURE 4.1-1

• FIRE PRA FLOW CHART Define Fire Areas _

Low Fire Loading Low Loading Separation Fire Barriers

- &Barriers FMEA of each area

.. _equipment in area

.. potential fire spread

.. remaining equipment

.. type of initiating event Qualitative ranking of Fire Areas

.. based on initiator, remaining equipment, etc.

Initiating Event Frequency Sequence Quantification

& Ranking Document, Continue Yes Acceptance to Next Area Low?

No Choose Method Fire Propagation Analysis 1- '

Automatic Suppression Manual Detection/Suppression Redefine Fire Areas Modify Fl\1EA Revision 1, May 22, 1996 4-23

4.2 MODELING ASSUMPTIONS The following key assumptions were made in this analysis:

1. An engineering analysis (Ref. 4-6) concluded that fire spread between transformers and the turbine building is not credible.

2. The impact of fires on plant risk was quantified using the IPE general transient event tree model. This event tree was selected because it most closely represented the plant

• response given the systems being modeled. The frontline systems contained in the IPE that were credited in the fire quantification are HPSI, AFW, ADVs, C~~tainment Spray, Containment Air Coolers and* PORVs, depending on* the effects of the fire and knowledge of the location of cables* for these systems .within each 'frre compartment.

These systems were assumed to fail only due to non-fire related causes if their cables were. not located in the compartment impacted by the frre.

3~ A TWS events are not expected to be induced by fires, due to the fail-safe design of the reactor protection system, and simultaneous occurrence. of an ATWS during a fire is probabilistically insignificant.

4.

• LOCAs and SGTRs are not expected to be induced by a fire. Simultaneous occurrence of a LOCA or SGTR during a fire is probabilistically insignificant .

• 5.

6.

With the exception of the control room, cable spreading room and Class 1E switchgear rooms, fires are assumed to spread until they engulf the entire area in which they start.

No credit was taken for suppression in other than these four areas.

It is assumed that fire will not propagate through the "jailhouse door" opening in the wall separating the 590' elevation of the turbine building (fire area 23E) from the lower level of the CCW room (fire area 16). A walkdown of the. area resulted in the conclusion that fire spread through this opening is not credible. This conclusion was based in part on the following facts: 1) The opening is located low in the wall. This eliminates the concern of a ceiling hot gas layer passing through the opening and .

igniting combustibles or otherwise causing damage in the adjoining room; 2) There are no intervening combustibles and no/minimal combustibles located within 15' of either side of the opening; 3) The floors slope away from the opening to floor drains located on either side of the wall. This will prevent spreading of burning fluids from one room to the other. Additionally, the lower portion of the opening, which is at floor level is dammed with a solid metal plate spanning the entire width of the opening and to a height of approximately three feet; and 4) The opening is relatively small,

. approximately 30 sq. ft. Based on these* facts, fire spread across this opening is considered incredible. Reference 4-6 provides the complete analysis.

Revision 1, May 22, 1996 4-24

The plant was built before the IEEE-383 standard was written. The cable used at the

• . 7. time of construction was rated per IPCEA Standard S-19-81, which was the combustibility standard at the time. Cable installed since construction is rated to IEEE-383. Because the mix of cable is very difficult to determine, it was conservatively assumed that. all cable in the plant is non-IEEE-3 83 rated.

8. When calculating the ignition source frequencies, only the fire areas identified in the Fire Hazards Analysis (FHA) were used instead of the total number of rooms in the plant. Because the total number of rooms in the plant is greater than what is identified in: the FHA, evaluation of fewer fire areas results in a higher ratio used to multiply by the generic ignition source frequencies, resulting in more conservatiy¢,;(larger) ignition source frequencies.

9. Hot shorts were not considered for the fire IPEEE evaliiation. The occurrence of hot shorts was considered to be probabilistically insignificant.

10. Fires that initiate within cabinets are contained within that cabinet and do not affect*,

equipment or cabling outside of that cabinet (Ref. 4-15) .

11. . The time to recir~ulation following successful OTC injection phase :is assumed to be greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This is because only one HPSI and one containment spray pump, with no LPSI pumps, is assumed to be operating. The combined flow rate for these two

. pumps (at design flow ratings) is 1640 gpm. Based on the amount of water in the *

• SIRW tank and this flow rate, recirculation would occur more then 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> later.

Revision 1, May 22, 1996 4-25

4.3 REVIEW OF PLANT INFORMATION AND SOURCES Several sources of information were reviewed and utilized in support of the Palisades fire IPEEE.

The information sources most often consulted were the Palisades Individual Plant Examination (IPE) (Ref 4-2), Palisades Fire Hazards Analysis (Ref 4-7), Palisades fire protection drawings (M-216, sheets 1-18), Fire-Induced Vulnerability Evaluation* (FIVE) Report (Ref 4-4) and various controlled electronic databases. A complete list of the references used in support of this project is contained in Section 4.18.

The IPE was used to identify important systems/functions and provide the base Jault trees and event tree used to quantify the plant fire risk. The IPE includes detailed infonp,.~tion on support systems for the important frontline systems. . .

The Fire Hazards Analysis provided information on combustible loadings, detection and suppression capabilities, and fire barrier ratings for fire areas within the plant. Mechanical drawing M-216, sheets 4-18, provided floor plans showing each fire barrier and identified adjacent and adjoining fire areas. The fire area interaction analysis used the information contained in these documents.

The fire IPEEE logic models are contained in ,electronic files. The models include logiC for the PORV system in addition to all Appendix R safe shutdown systems.* The electronic files provided basic event names, module (IST - Independent Sub Tree) nanies, equipment IDs and some equipment descriptions. The remaining equipment descriptions, equipment locations (building/elevation/room #/cabinet #) and reference drawings were extracted from the Palisades Equipment Database (EDB)~

The information collected from these sources was combined into a QuattroPro spreadsheet file.

These sources included the EDB, the Appendix R circuit analysis database and the Palisades Cable and Raceway Schedule (including the updated Appe~dix R cable and raceway verificatfon data). *This -spreadsheet file contains the following data: equipment ID; equipment description; building; floor elevation; room number; cabinet number; reference drawing; scheme number; and fire areas/zones affecting the equipment or cable.

Revision 1, May 22, 1996 4-26

Table of Contents

• 4.4.1 Objectives of Plant Walkdowns Section 4.4 Plant Walkdowns 4-28 4.4.2 Walkdown Process 4-28 4.4.3 Findings From Plant Walkdowns 4-28

• Revision 1, May 22, 1996 4-27

4.4 PLANT WALKDOWNS Various walkdowns were performed in support of the fire IPEEE analyses. The fire IPEEE walkdown members included a qualified fire protection engineer and fire IPEEE analysts. System engineers were consulted as questions ~ose to confirm key assumptions used in the fire IPEEE.

Prior to the walkdowns, a licensed senior reactor operator participated in area by area discussions of expected operational impact of fires in significant areas.

4.4.1 Objectives of Plant Walkdowns The primary objectives of the walkdowns were to confirm information/~~umptions and conclusions of the fire IPEEE analysis. Issues associated with the Sandia- Fire Risk Scoping Study Evaluation (Ref. 4-11) were also investigated. The walkdowns were used to determine whether or not the assumptions and *calculations, particularly fire barrier effectiveness assumptions, can actually be supported by the physical conditions that exist. This included verifying and validating: the combustible loading estimates in the fire hazards analysis; the existence of fire protection systems; fire barrier status; interaction of fire areas; and existence of ignition sources.

4.4.2 Walkdown Process Important areas of the plant, as determined by the results of the fire IPEEE quantification, and areas of the plant that required validation of assumptions made during the analysis were inspected

• during the walkdown. These areas included the control room, cable spreading room, west safeguards room, spent fuel pool equipment room, auxiliary building 590' elevation, cable penetration areas and the areas near the containment personnel airlock and equipment hatch.

Combustible loadings, potential fire spread paths, fire barriers and equipment orientation were.

atso inspected by the fire protection engineer.

• 4.4.3 Findings from Plant Walkdowns Several general findings were made during the walkdowns. Boundary ratings were found to be conservative due to lack of combustible loading in close proximity to the barriers. The general condition of the plant was clean and well kept., The combustible loadings encountered during the walkdown were compatible with the estimates contained in the Fire Hazards Analysis.

Each control room cabinet was inspected to determine the potential to damage two trains of cabling within the same cabinet. The cabinets in the control room provide adequate protection to IEEE fire separation guidelines. The separation is achieved by metal barriers that provide radiant heat shield protection. This leads to the conclusion that there is sufficient train separation to model damage to only one train of equipment within a cabinet during a cabinet fire.

Revision 1, May 22, 1996 4-28

The large containment penetrations, i.e., the personnel airlock and the equipment hatch were inspected to determine if fire damage was feasible. The personnel airlock is located in a small concrete room with minimal combustibles. The equipment hatch is recessed and protected by large concrete shield blocks during power operation. These factors lead to the determination that fire damage to these penetrations is not credible.

A walkdown of the 590' auxiliary building corridor (specifically, fire zones 13Al & 13A2) resulted in dividing the corridor into the two fire zones. Several significant ignition sources are located in fire area 13A2. The cables that, if damaged, could impact plant risk were located in fire zone 13A1. Review of the walkdown information identified that there was a large horizontal span between these fire zones with no intervening combustibles. Therefore, th¢~ two fire zones were deemed to be sufficiently separated to be evaluated as independent fire -rones.

Walkdown information from the spent fuel pool equipment room was used in the FIVE methodology to reduce the inipact of a fire in this room. There is one area in this room where

• safe shutdown equipment cables are routed. The potential fire ignition sources and combustible materials are located in other areas of the room. This information, along with the physical layout of the room, was used in the FIVE methodology to reduce the overall CDF due to a fire in this area.

Revision 1, May 22, 1996 4-29

Table of Contents

• Section 4.5 Identification of Important Fire Areas 4.5.1 Auxiliary Building . 4-31 4.5.1.1 Fire Area 1: Control Room 4-31 4.5.1.2 Fire Area 2: Cable Spreading Room 4-32 4.5.1.3 Fire Area 3: lD Switchgear Room 4-32 4.5.1.4 Fire Area 4: lC Switchgear Room ' .... -

~

4-33 4.5.1.5 Fire Area 5: 1-1 Diesel Generator Room

• 4-33 4.5.1.6 Fire Area 6: 1-2 Diesel Generator Room 4-33 4.5.1.7 Fire Area 10: East Safeguards Room 4-34 4.5.1.8 Fire Areas 11 and 12: Battery Rooms 4:.34 4.5.1.9 Fire Area 13 - Zone Al: 590' Corridor - South Branch 4-34 4.5.1.10 Fire Area 13 - Zone A2: 590' Corridor - Middle Branch. 4-35 4.5.1.11 Fire Area 13 - Zone B: Charging Pump Rooms 4-35 4.5.1.12 Fire Area 13 - Zone C: 590' Auxiliary Building -Misc 4-35

.4.5.1;13 Fire Area 15: Engineered Safeguards Panel Room 4-36 4.5.1.14 Fire Area 16: Component Cooling Water Pump Room 4-36 4.5.1.15 Fire Area 20: Spent Fuel Pool Equipment Room 4-36 4.5.1.16 . Fire Area 21: Electric Equipment Room 4-37 4.5.1.17 Fire Area 28: .West Safeguards Room 4-37 4.5.1.18 Fire Area 32: SIRW Tank/CCW Roof.* 4-37 4.5.1.19 Fire Area 34: 1~ Switchgear Room Manholes 4-37 4.5.2 Containment Building . 4-37 Intake Struc,ture 4.5.4 Turbine Building 4-38 ..

4.5.4.1 Fire Area 23 - Zone E: Turbine Building - East Side . 4-38 4.5.4.2 Fire Area 23 - Zone S: Turbine Building - South Side . 4-39 4.5.4.3 Fire Area 23 - Zone W: Turbine Building - West Side 4-39 4.5.5 Southwest Cable Penetration Room 4-39 4.5.6 Auxiliary Feedwater Pump Room 4-40

• Revision 1, May 22, 1996 4-30

4;5 IDENTIFICATION OF IMPORTANT FIRE AREAS The identified Appendix R fire areas provide the starting point for this analysis. In accordance with Appendix R requirements and the Palisades Fire Hazards Analysis (FHA), a fire area is.

defined as a portion of a building that is separated from other areas by boundary fue barriers.

Only a single division of safe shutdown equipment is allowed within a given fue area unless the redundant train is protected by additional separation requirements detailed in Appendix R of 10 CFR 50.

Palisades has previously analyzed the rating of the barriers incorporated in* its FHA for all the pre-existing fire areas and has deteml.ined that the barriers are adequate. Th~ *fue. areas were evaluated to identify possible further breakdown into fire zones for which an additional screening for fire spread was performed. The results of this screening, based on applying conservative criteria contained in FIVE, are consistent with the analyses previously performed. The important fire areas and fire zones are described in this section.

4.5.1 Auxiliary Building 4.5.1.1 Fire Area 1: Control Room The control room provides a centralized location for operating controls and instrumentation. for the various vital and non-vital systems associated with plant operation. Major equipment in the control room includes the main operator control console, the indicating panel and various instrument and control panels, all of enclosed design. Fire loading is considered light. The control room is occupied continuously.

This fire area is composed of three rooms: the main control room; viewing area; and office area.

The west wall has a minimum fire rating of three hours and a three-hour rated access .door out to the turbine area. The north wall, which is poured concrete, is judged to have a fire rating in exces~ of four hours. A three-hour rated double door leads to the technical support center (TSC).

The east boundary encloses a staircase with a three-hour rated fire door. The wall is judged to have a two-hour rating. The south wall is rated in excess of three hours and has substantial bullet resistant and three-hour rated double entry doors to the corridor, These barriers are adequate based on the hazards.

The control room has smoke detectors that locally alarm within each of the large, walk-in cabinets. Manual detection is credited since the control room is continuously manned. There is no automatic suppression system in the control room. However, there is adequate fire extinguishers and hoses available to manually suppress fires and these are credited in the contr~l room .

• Revision 1, May 22, 1996 4-31

4.5.1.2 Fire Area 2: Cable Spreading Room The cable spreading room provides routing of power, instrumentation and plant control wiring for both vital and non-vital systems and also accommodates various electrical equipment associated with the plant safety relat~d AC and DC power supplies. Primary power cabling routed through this room includes redundant 2.4kV Class lE buses lC and lD. Feeder circuits to various safety related equipment associated with bus. lD aie also routed through the cable*

spreading room. .

Equipment and cabinet installation is on *curbs to protect against water flooding. All electrical cabinets ares sealed where the electrical cables enter. Maximum utiliiation is made of available space for separation of redundant systems. Cable runs are via horizontally .st&;ked cable trays, with some individual conduits.

A three-hour fire wall is provided between the cable spreading room and the turbine building.

Access between these two areas is via a double three-hour rated bullet-resistant*door. A three-hour fire barrier is provided between the cable spreading room and adjacent 1D switchgear room.

Access between these two areas is via a three-hour door. Three-hour walls and door separate the cable spreading room from the battery rooms. With the moderate fire loading, this is considered adequate. All cable penetrations are sealed where they penetrate the fire area boundary.

• The cable spreading room is equipped with a fusible-link wet sprinkler fire extinguishing system that alarms in the -control room upon activation. This suppression system is credited in the fire analysis.

4.5.1.3 Fire Area 3: lD Switchgear Room This fire area includes the 1D switchgear room and cable penetration room. The 1D switchgear rooni houses the 2.4kV electrical equipment associated With safety related bus lD {redundant bus a

-"IC -is iri separate room~ see fire area 4). Major -~quipment and cabinets are floor molinted -

without curbing. Two three-inch floor drains are provided against flooding. Electrical cabling associated with the switchgear is routed through this switchgear room in stacked cable trays.

Cables are routed into the cable penetration room area using a horizontally stacked cable tray arrangement. The cables entering containment are considered safety related and include both vital

- - and non-vital loads. Redundant systems required for safe reactor shutdown are accommodated via cables routed through the southwest cable penetration room on the 607'6" level (see fire area 26).

A three-hour fire barrier is. provided between the iD switchgear room and the cable spreading room. Access between these two areas is via a three-hour door. A three-hour rated door to the electric equipment room is available for access. There is an open stairway leading to the 625' level with a three-hour rated door providing access to the viewing gallery for the control room (fire area I). These barriers are considered adequate based on the fire loading.

Revision I, May 22, 1996 4-32

The cable penetration room is separated from the adjacent clean resin transfer and storage area

• by a minimum three-hour fire wall. The access is. through a three-hour bullet resistant door. A steel plate on part of the floor of the cableway provides separation from 590' elevation of the

.auxiliary building.

The ID switchgear room fusible-link wet sprinkler fire extinguishing system, which alarms in the*

control room upon activation, is credited in the fire analysis.

4.5.1.4 Fire Area 4: 1C Switchgear Room The 1C switchgear room houses the 2.4kV electrical equipment associated with:¢ety~related bus 1C (redundant bus ID is *in a separate room, see fire area 3). Electrical cabling associated with

. this switchgear is routed through the switchgear room in stacked cable trays.

Encloslire for this switchgear room is provided by three-hour fire walls. Access to adjacent diesel generator room (fire area 5) is via a three-hour door and access to the east corridor is via two three-hour doors. Access to the turbine building is via a three-hour door which is also watertight.

One-hour fire resistant material has been applied to one cable tray and one junction box and conduit containing circuits of the redundant train.

The 1C switchgear room is equipped with a fusible-link wet sprinkler fire extinguishing system that alarms in the control room upon activation. This suppression system is credited in the fire analysis.

4.5.1.5 Fire Area 5: 1-1 Diesel Generator Room This fire area contains emergency diesel generator 1-1. Emergency diesel generator 1-1 is housed in a separate enclosure defined by three-hour fire walls. The e.nclosure. shares a common south wall with safety-related 1C sWitchgear room. The diesel day tank is in a separate room (fire area

7) located at the n~rth end of the diesel generator 1-1 room. . -

Enclosure for the diesel is provided by minimum three-hour fire walls .with three-hour doors.

There are two doors that provide access to the room: one on the north wall and one on the south wall. The door on the north wall is. three-hour rated and leads to a vestibule. In the vestibule is a double watertight door that leads outside and a three-hour rated door that leads to the diesel generator 1-2 room. The door on the south wall is three-hour rated and leads to the 1C switchgear room. There is a three-hour wall and door that leads to the day tank room.

4.5.1.6 Fire Area 6: 1-2 Diesel Generator Room This fire area contains emergency diesel generator 1-2. Emergency diesel generator 1-2 is housed in a separate enclosure defined by three-hour fire walls. The enclosure shares a common south wall with safety-related 1C switchgear room. The diesel day tank is in a separate room (fire area

8) located at the north end of.the diesel generator 1-2 room .

• Revision 1, May 22, 1996 4-33

Enclosure for the diesel is provided by minimum three-hour fire walls with three-hour doors.

There are two doors that provide access to the room: one on the north wall and one on the west wall. The door on the north wall is three-hour rated and leads to a vestibule. In the vestibule is a double watertight door that leads outside and a three-hour rated door that leads to the diesel generator 1-1 room. The door on the west wall is three-horir rated and leads to the turbine building .. There is a three-hour wall and door that leads to the day tank room.

4.5.1.7 Fire Area 10: East Safeguards Room The east safeguards room contains only Division I (right channel) equipment. The east safeguards room is defined by a wall having a minimum three-hour fire rating~* *.:.f.\ccess to the east safeguards room from the 590' elevation is via a.three-hour door and a watertighfdoor. The west wall separates this room from the west safeguards room (fire area 28) and contains a steel

. watertight door, a substantial steel plate and is judged equal to a three-hour fire rating. Concrete plugs in the ceiling provides access to equipment from above.

4.5.1.8 Fire Areas U and 12: Battery Rooms Two redundant battery systems are available for supplying control power to the various plant vital loads. Each syStem is physically separate and electrically isolated from the other, having its own battery, battery chargers and distribution bus. Batteries are housed in individual enclosures, separated by a common wall, located adjacent to the cable spreading room area. A continuously.

operating ventilation system common to both rooms provides protection against potential hydrogen gas accumulation from the batteries, thereby minimizing the combustible hazard in these areas. The IPE and IPEEE assume that following an accident, there is no significant hydrogen generation and a combustible hazard does not exist.

Battery room enclosures have a three-hour fire rating. Entry into battery room #2 is via a single-access, three-hour fire door from the cable spreading room. The access door between battery rooms .#1 and #2 is athree-hour door. '

4.5.1.9 Fire Area 13 - Zone Al: 590' Auxiliary *Building Corridor - South Branch The 590' corridor is "E" shaped. This fire zone comprises the 590' corridor of the auxiliary building from the component cooling water room to the charging pump rooms and is called the south "finger." This zone is constructed of reinforced concrete with some concrete block walls.

This fire zone provides access to the various rooms on this elevation (fire areas/zones 4, BA2, BB, BC, 15, 16, and 20).

This fire zone has a three hour barrier bordering fire areas 4, 15 and 16. Access to fire area 20 is through a substantial steel door. This door is judged to have an adequate fire resistance rating to separate the two fire areas/zones. Separation to fire zones BA2 and BC is provided by large open spaces with minimal combustible material and three hour barriers. This was judged satisfactory in separating these fire zones. Fire zone 13B is separated by a three hour barrier with Revision 1, May 22, 1996 4-34

a an access door. This access door is tunnel-like hallway with no combustible material. This hallway was judged satisfactory to separate these two fire zones.

4.5.1.10 Fire Area 13 - Zone Al: 590' Auxiliary Building Corridor - Middle Branch The 590' corridor is "E" shaped. This fire z0ne comprises the 590' corridor of the auxiliary building except for fire area 27 (north "finger") and fire area 13Al (south "f}nger"). This zone

• is constructed of reinforced concrete with some concrete block walls. This fire zone provides access to the various rooms on this elevation (fire areas/zones 13Al, 13B, 13C, 20 and 27).

There is a three hour barrier bordering fire area 20. Fire area 27 does nQt.~contain any safe shutdown equipment credited in the fire analysis and contains minimal comb~ible loading so a fire barrier is not required. Separation to fire zones 13Al and 13C is provided by large open spaces with minimal combustible material and three hour barriers. This was judged satisfactory in separating these fire zones. Fire zone 13B is separated by a three hour barrier with an access door. This access door is a tunnel-like hallway with no combustible material. This hallway was judged satisfactory to separate these two fire zones.

4.5.1.11 Fire Area 13 - Zone B: Charging Pump Rooms The charging pump rooms, located in the auxiliary building, house the three charging pumps, which are the positive displacement, high head boron injection pumps. Electrical power for each motor-driven pump is supplied from a safety-related 480 VAC source. Pumps A and B are fed from bus 12 with cable routing provided via a common cable tray. Pump C is fed from bus 11 via a separate cable tray and conduit system. Pumps B and C can also be powered from bus 13.

In addition, pump B can be powered from bus 11.

Protective*radiation shield walls are provided around each pump. Each pump area is open on one side to a common access corridor. A thre~-hour barrier with access doors separates this fire zone from fire zones 13Al and 13A2. These access doors are tunnel-like. hallways* with no combustible material. These hallways are judged satisfactory to separate fire zone 13B from fire zones 13Al and 13A2.

4.5.1.12 Fire Area 13 - Zone C: 590' Auxiliary Building - Miscellaneous All of the 590' elevation of the auxiliary building that is not included in another fire area is included in this zone. This zone does not contain any major equipment, but has cable trays and conduits that contain safety-related cabling. The cable trays and conduit provide the pathway for cables to corinect equipment and power from two other fire areas. The walls are constructed of reinforced concrete with some concrete block walls. *This fire area is adjacent to many other fire areas (fire areas 13Al, 13A2, 13B, 15, 16, 17, 18, 20 and 27).

This fire zone has a three hour barrier bordering fire areas 15, 16, 17, 18 and 20. Fire area 27.

does not contain any safe shutdown equipment credited in the fire analysis and contains minimal Revision 1, May 22,. 1996 4-35

combustible loading so a fire barrier is not required. Separation to fire zones 13Al, 13A2 and 13B have been discussed previously.

4.5.1.13 Fire Area 15: Engi~eered Safeguards Panel Room The engineered safeguards panel, C-33, is located adjacent to the radwaste control panel on the 590' elevation and provides plant remote shutdown capability under emergency conditions, i.e.,

extreme cases where control room evacuation becomes necessary. The engineered safeguards

• panel is classified as safety-related equipment. Other major equipment contained iri this fire area

. include safety-related 480 VAC MCC 7 and 8. * .. *

• The safeguards panel area is enclosed by three-hour fire walls. Access is provided via three separate entry ways. The doors to the corridor are three-hour rated. The door to the boron meter room is also three-hour rated.

4.5.1.14 Fire Area 16: Component Cooling Water Pump Room The component cooling pump room provides a common enclosure for the three safety-related component cooling water pumps. Electrical power for the .pumps is derived from the 2.4kV switchgear located on the 590' and 607'6" elevations (see analysis for fire areas 3 and 4). Power cables to each pump motor are routed via separate conduit. Redundancy is provided since only one of the three puinps is required for cold shutdown.

The pump room enclosilre is bounded by three-hour fire walls. Access is provided to the north to the 590' corricior (fire area 13Al) via a watertight door arid an inner door and to the 607'6" level above via a stairway with a door to the outside. Pump spacing is 12' *center to center. A pressure release opening is located in the wall to the turbine building. There are no combustible

)J1aterials within 20 ft. of the either side of the opening. Therefore, this opening is judged to not affect the bo~dary betWeen fire.area 16 and fire area 23 .(turbine.building). The aruiuli around the main steam pipes and feedwater pipes are nof sealed. These openings are negligible when *

.compared to the pressure release opening.

4.5.1.15

• Fire Area 20: Spent Fuel Pool Equipment Room The.spent fuel pool equipment area houses equipment used to remove decay heat from the spent fuel pool which is generated by the stored spent fuel elements. Major items include heat exchangers, pumps, tanks, filters and associated piping.

The spent fuel pool equipment area is contained within a heavy radiation shield wall providing a minimum three-hour fire rating. Inside, the pumps, filters and demineralizer tank are further

• isol~ted from each other and the heat exchanger units by partitioning walls. Access to the general area from the south side corridor is through a substantial steel door. Some negligible openings may exist in some penetrations.

Revision 1, May 22, 1996 4-36

4.5.1.16 Fire Area 21 .: Zones A and B: Electric Equipment Room The electric equipment room provides a location for various safety-related and non-safety related load centers and motor control centers. The 480 VAC bus I 9 and MCC 25 and transformer EX-I 9 are located on the east side (fire zone 2IA) and 480 VAC bus 20 arid MCC 26 and transformers EX-20 are located on the west side (fire zone 2IB). The east and west sides are separated by an area with no equipment or combustible material. This provides separation between left and right channels. It is deemed that sufficient separation exists so that each zone*

can be evaluated independently.

The room is bounded by three-hour rated concrete walls and floor. The cei~g is concrete on

. metal pan. The ceiling is expected to withstand any fire in this. room due to 'the minimal fire loading. A three-hour rated fire door leads to the ID switchgear room.

• 4.5.1.17 Fire Area 28: West *safeguards Room The west safeguards room contains only Division II (left channel) equipment. The west safeguards room is defined by a wall having a minimum three-hour fire rating. Access to the west safeguards room is via the east safeguards room *through a steel watertight door and a

• substantial steel plate and is judged equal to a three-hour fire ratirig. A steel hatch in the ceiling provides access to equipment from above.

4.5.1.18 Fire Area 32: SIRW Tank/CCW Roof The safety injection and refueling water (SIRW) tank and component cooling water (CCW) room roof area contains the SIRW tank and the atmospheric steam dump valves. This fire area is located outside, cin the roof of the auxiliary building. Main access to this area is via a three-hour door from the turbine building.

4.5.1.19 Fire Area 34: lC Switchgear Room Manholes The three manholes in the floor along the south wall of the IC switchgear room (fire are*a 4) comprise fire area 34. These manholes contain cables that are routed underground. Access to this area is via steel plate covers in the floor of the 1C switchgear room.

• No equipment is located in this area, but safety related cables are routed through this area. This fire area consists of all three Appendix R fire areas 34, 35 and 36.

4.5.2 Containment Building Fire Area 14: Containment Building The reactor containment building is approximately 120' in diameter and 190' tall. The concrete walls are approximately 4' thick. The dome-shaped top is approximately 3' thick concrete. The reactor containment building houses the nuclear steam supply system and various support

• Revision I, May 22, 1996 4-37

equipment.

• The normal entryway is through the personnel airlock. An emergency personnel access is the second access and egress route. Also, there is an equipment hatch which is closed during plant operation. The two electrical cable penetration areas for opposite divisions are separated from each other by approximately 70'. The reactor coolant pumps are separated from each other by approximately 25'.

• The reactor containment building walls have a fire resistance rating in excess of three hours. The equipment hatch is judged to have a fire resistance in excess of two hours. The personnel access and emergency access hatches have double doors. These double doors are judged to have a fire resistance of three hours.

~

_, I ~~)

4.5.3 Intake Structure Fire Area 9 - Zones A and B: Intake Structure Major items of equipment housed in the intake structure include the three safety related service water pumps, two diesel engine-driven fire pumps, one motor driven fire pump and two 480 V AC MCCs providing electrical power to miscellaneous non-safety related equipment and the motor driven fire pump.

• The pump room east wall adjacent to the turbine building has a three~hour fire rating with a single three-hour fire* door installed. All other walls and access have outdoor exposure with a small section common with the diesel fire pump day tank room. Rating is in excess of three hours. A radiant energy shield wall and a horizontal distance ofat least 20' separates one diesel fire pump from the others and the service water pumps. Control cables for this fire pump have been wrapped in one-hour fire-resistant material.

Because of the importance of the service water system and fire protection system as potential makeup sources to the suction of the AFW pumps and the capability under-certain cori.ditionsfor each fo *provide backup to llie other, a more *detailed examination of the impact of fires in this area was undertaken. Each set of pumps and their associated equipment are located at opposite ends of the intake structure. The walkdown confirmed that there is minimal combustible *loading

• in the area between the pumps. Based on this information the intake structure was evaluated as two separate fire zones. Fire zone 9A contains the service water pumps and treats the fire pumps as independent. Fire zone 9B contains the fire pumps and treats the service water pumps as independent.

4.5.4 Turbine Building 4.5.4.1 Fire Area 23 - Zone E: Turbine Building - East Side This fire area is located north of the main feedwater pumps on the east half of the buildiilg.

Equipment and cabling in the condensate pump pit (center of the building north of the condenser) was conservatively included in both this fire area and fire area 23W. This fire area contains Revision 1, May 22, 1996 4-38

various cable tray and conduits (some safety related) along with various non-safety related

• equipment (mainly the instrument air system). This area contains the power cable feeding the Class lE bus lD from the safeguards transformer (off-site power). The alternate off-site power feeder cable from the startup transformer is located underground. The FIVE methodol_ogy has identified this area as sufficiently separated and independent from fire areas 23S and 23W.

4.5.4.2 Fire Area 23 - Zone S: Turbine Building - South Side

• This fire area is located south of the north end of the main feedwater pumps. This fire area contains various cable tray and conduits (some safety related) along with vafiJ>US non-safety related equipment (mainly the main feedwater pumps). This. area containsJJie power cable feeding the Class lE bus ID and non-Class IE bus IE from the safeguards transformer (off-site power). The alternate off-site power feeder cable from the startup transformer for bus ID is located underground. The FIVE methodology has identified this area as sufficiently separated and independent from fire areas 23E and 23W.

4.5.4.3 Fire* Area 23 - Zone W: Turbine Building - West Side This fire area is located north of the main feedwater pumps on the west half of the building.

Equipment and cabling in the condensate pump pit (center of the building north of the condenser) was conservatively included in both this fire area and fire area 23E. This fire area contains various cable tray and conduits (some safety related) along with various non-safety related equipment (mainly the hogger and steam jet air ejectors). One piec~ of safety related equipment located in this area is the steam supply valve (CV-0522B) for the steam driven AFW pump. The FIVE methodology has identified this area as sufficiently separated and independent from fire areas 23E and 23S.

4.5.5 Southwest Cable Penetration .Room Fire Area 26: Southwest Cable Penetration Room Cables are routed into the containment penetration room area using a horizontally stacked cable tray arrangement. The cables entering containment are considered safety-related and include both vital and non-vita~ loads. Redundant systems required for safe reactor shutdown are*

accommodated via cables routed through the north cable penetration room on the 625' elevation.

The cable penetration room is enclosed by three-hour fire walls. Openings exist into the turbine building where three-hour cable penetration sealing has been provided. A three-hour fire door to the turbine building is provided. **

Revision I, May 22, 1996 4-39

4.5.6 Auxiliary Feedwater Pump Room

• Fire Area 24: Auxiliary Feedwater Pump Room

• The auxiliary feedwater pump room houses two of the three safety-related auxiliary feed pumps used to supply feedwater to the steam generators during startup, shutdown and accident conditions. One of the pumps is steam driven and the other pump is powered from Class lE bus lC. A third AFW pump is located in the auxiliary building (west safeguards room - fire area 28) and is powered from Class lE bus lD.

The pump room is separated from adjacent plant areas by three-hour fire w8.\~~ . - Access to the adjacent condensate pump room is via a three-hour steel watertight door and a::substantial steel inner door. A steel hatch is located in the ceiling. A ventilation pipe, open to the turbine building, runs through the ceiling. No loss of barrier integrity is caused by these openings due to the minimal fire loading.

Revision 1, May 22, _1996 4-40

4.6 FIRE AREA INITIAL SCREENING

• Fire areas were screened from further consideration if they contained no safe shutdown equipment (see Section 4.1), did not affect safe shutdown equipment cables and would not lead to a plant

• trip or immediate plant shutdown. Safe shutdown equipment and cable locations were determined by sorting on equipment location data and affected fire areas contained in *the spreadsheet generated for this analysis (see Section 4.3). Areas that, if destroyed by fire, would lead to a*

plant trip or immediate shutdown were determined by discussions with plant operations personnel and review of plant procedures. Utilizing these criteria, approximately one-third of the fire areas were screened from further consideration. The complete set of results of the q~tative screening process are shown in Table 4.6-1. * ;::~;

FIVE also provides the following additional guidance when screening fire areas: "Fire areas where Appendix R safe shutdown components are found should not be screened out at this stage unless it can be shown with confidenc~ that the .postulated fire will not cause a demand for plant

• shutdown. The project team should consult with the plant operatfons staff to make this determination." This guidance was also considered in the screening process by consulting With the operations personnel to determine areas that would not cause a demand for plant shutdown.

Revision 1, May 22, 1996 4-41

• FIRE AREA/

ZONE DESCRIPTION TABLE 4.6-1

SUMMARY

OF PALISADES FIRE IPEEE SCREENING QUALITATIVELY SCREENED RETAINED FOR FURTHER EVALUATION l Control Room x 2 Cable Spreading Room .\.~*

~ :* ,; .~

3 Switchgear Room 1-D *.x 4 Switchgear Room 1-C x 5 Diesel Generators 1-1 x 6 Diesel Generators 1-2 x 7&8 Diesel Day Tanks' x 9A Intake Structure (SWS) . x 9B Intake Structu.re (FPS) x 10 East Engineered Safeguards x 11 Battery Room A x 12 Battery Room B x l3Al Auxiliary Building 590' x Corridor (South Finger) l3Ai Auxiliary Building 590' x Corridor (Except Area l 3A l) .

13B Charging Pump Rooms x 13C Auxiliary Building 590' x Elevation (Except Areas l3Al, 13A2, BB)

Revision 1, May 22, 1996 4-42

TABLE 4.6-1

SUMMARY

OF PALISADES FIRE IPEEE SCREENING FIRE DESCRIPTION QUALITATIVELY RETAINED FOR AREA/ SCREENED FURTHER ZONE EVALUATION 14 Containment2 x 15 Engineered Safeguards Panel <.)X Room -~* ,; *'

16 Component Cooling Pump x Room 17 Refueling and Spent Fuel Pool x Room 18 Demineralizer Room x

. 19 Compactor - Area Track Alley x 20 Spent Fuel Pool Equipment x Room 21A Electric Equipment Room x (Bus 1_9/MCC 25) 2IB Electrical *Equipment Room ,X (Bus 20/MCC 26) 22 Turbine Lube Oil Room x 23E Turbine Building - East Side x 23S Turbine Building - South Side x 23W *Turbine Building - West Side x 24 Auxiliary Feedwater Pump x Room 25 Boiler Rooms x

• Revision 1, May 22, 1996 4-43

• FIRE AREA/

ZONE DESCRIPTION TABLE 4.6-1

SUMMARY

OF PALISADES FIRE IPEEE SCREENING

• QUALITATIVELY SCREENED RETAINED FOR.

FURTHER EVALUATION 26 Southwest Cable Penetration x.

Room -*

27 Radwaste Addition* - YRS x . *... ~ ~*

28 West Engineered Safeguards x-Room 29 Center Mechanical Equipment x Room 30 East Mechanical Equipment x Room 31 West Mechanical Equipment x Room 32 SIR W Tank/CCW Room Roof x Area 33 Technical Support Center x 34 Manholes #1,2,3 < -x (l C Switchgear Room) 1 - The fuel oil is the only combustible source and is contained in an explosion proof tank.

2 - Fires in containment were qualitatively screened according to the criteria provided in FIVE, mainly: a hot gas layer is unlikely to form in areas that would damage cables; reactor coolant pump fires are unlikely due to installed oil collection systems; and no .

unique circumstances were identified at Palisades that would lead to a different conclusion than other PRAs, which show that containment fires are not .risk significant.

Revision 1,

• May 22, 1996 4-44

4.7 FIRE IGNITION DATA

• Ignition source frequencies for each fire area/zone ate necessary to allow quantification of the impact of a fire in that area/zone. These individual impacts can be summed to yield the impact to the plant from all fires.

The EPRI Fire Event Database for U.S. Nuclear Power Plants (Ref. 4-8) was used in estimating

. fire ignition source frequencies for all the rooms located within the plant. This database contains a total of 800 events during a period from 1965-1988. These events were compiled from 114 BWR and PWR units across the United States representing a total sample ofappr9ximately 1300 reactor years of operation. The data includes fire incidents caused from both;fi:~ed and transient sources due to normal operations and maintenance activities. **:

FIVE incorporated this information into a procedure to develop ignition source frequencies for individual fire areas. This process was used to evaluate the fire area specific ignition frequencies

. (F 1) at Palisades. An Ignition Source Data Sheet was completed for each Fire Area defined in Phase I.

The four step process identified in the FIVE methodology was used to develop the ignition Source Data Sheet. The first step requires that the appropriate location.(room or building) which corresponds best to the fire compartment in question be selected. Some location's may be specific Appendix R fire ~eas (e.g. control room, cable spreading room), while other locations may be general (e.g., turbine building fire area 23).

The second step requires that a location weighting factor (WFL) be determined from .this classification. The weighting factor is used to translate the generic fire frequencies compiled in

• FIVE, for a location to specific, single unit fire frequencies. The location:weighting factors are

. designed to account for the relative amount of ignition sources in the plant in. question compa,red to the "average" plant". These factors are easily calculated using the simple formula$ found in Table 4.7-1.

The third step requires that weighting factors for each type of ignition source (WFLs) be

• determined. The potential ignition sources in each room were identified from controlled electronic databases and a walk.down of each compartment. Some ignition sources (e.g. cables and transformers) are best apportioned by ignition sources on a "plant-wide" basis. Once the number of plant wide components (ignition sources) was identified, the WFu; was determined by dividing the number of components in the area by the total number of similar components in the building or generic location being considered. Again, .these factors are easily calculated using the simple formulas found in Table 4.7-1.

The fourth step requires that the fire compartment fire frequency (F 1) be calculated for each fire area. Table 4.7-2 lists the fire frequency for each ignition source by location. F 1 is the sum of the ignition source frequencies for each ignition source (Fir) located within the given fire area.

This value was obtained for each fire area by multiplying:

.* . Revision 1, May 22, 1996 .4-45

1) The fire frequency (Fr) (Table 4.7-2),

2) The weighting factor for the location (WFd, and

3) The weighting factor for each ignition source (WFLs)*

This calculation was repeated for each -ignition source in the compartment and the total* fire frequency for the specific fire compartment (F 1) was calculated as:

The resultant ignition frequencies for each compartment are provided in Ta~le~4.7-3.

Revision 1, May 22, _1996 . 4-46

• TABLE 4.7-1 WEIGHTING FACTORS FOR ADJUSTING GENERIC LOCATION FIRE FREQUENCIES FOR APPLICATION TO PLANT-SPECIFIC LOCATIONS PLANT LOCATION (TAKEN FROM FIVE METHODOLOGY)

WEIGHTING FACTORS 1 (WFJ Auxiliary Building (PWR) The number of units per site divided by the number of buildings.

Reactor Building (BWR) 2 The number of units per site divided by the number of,buildiilgs H*'.

Diesel Generator Room The number of diesels divided by the number of room~ per. site.* .

Switchgear Rooin The number of units per site divided by the number "of rooms per site.

Battery Room The number of units per site divided by the number of rooms per site.

Control Room The number of units per site divided by the number of rooms per site.

Cable Spreading 'Room The number of units per site divided by the number of rooms per site.

Intake Structure The number of units per site divided by the number of intake structures.

Turbine Building The number of units per site divided by the number of buildings.

Radwaste Area The number of units per site divided by the number of radwaste areas.

Transfqnner Yard The number of units per site divided by ti_te number of switchyards.

Plant-Wide Components The number of units per site.

(Cables, transfonners, elevator motors, hydrogen recombiner/analyzer) 1~ The analyst must identify the number of like locations when determining the number of buildings, e.g., a 480-volt load center is "like" a switchgear room.

2. Reactor building does not include containment.

Revision 1, May 22, 1996 4-47

• PLANT LOCATION TABLE 4.7-2 FIRE IGNITION SOURCES AND FREQUENCIES BY PLANT LOCATION FIRE IGNITION/FUEL SOURCE IGNITION SOURCE WEIGHTING FACTOR FIRE FREQUENCY 1.i Reactor Building Electrical cabinets B 5.0 x 10*2 (BWR) 2 Pumps B  : ,::.<;, 2.5 x 10*2

':~. ..

Diesel Generator Diesel generators A .r~*".

2.6 x 10-2 Room Electrical cabinets A 2.4 x 10-3 Switchgear Room Electrical cabinets A 1.5 x 10*2 Battery Room Batteries ' A 3.2 x 10* 3 Control Room Electrical cabinets A 9.5 x 10* 3 I

Cable Spreading Rm Electrical cabinets A 3.2 x 10* 3 Intake Structure Electrical cabinets A 2.4X 10"3 Fir_e Pumps A 4.0 x 10-3 Others A 3.2 x 10*3 Turbine Building T/G Excitor B 4.0 x 10* 3 T/G Oil B 1.3 x 10*2 T/G Hydrogen B 5.5 x 10*3 Electrical cabinets -B 1.3 x 10*2 Other pumps B 6.3 x 10-3 Main feedwater pumps A 4.0 x 10*3 Boiler B 1.6 x 10*3 Radwaste Area Miscellaneous components A 8.7 x 10*3 Transformer Yard Yard xfmers {spread to TB) A 4.0X 10-3 Yard xfmers (LOSP) A 1.6 x 10*3 Yard transformers (Others) F 1.5 x 10*2

• Revision 1, May 22, 1996 4-48

• PLANT LOCATION TABLE 4.7-2 FIRE IGNITION SOURCES AND FREQUENCIES BY PLANT LOCATION

• FIRE IGNITION/FUEL SOURCE IGNITION SOURCE WEIGHTING FACTOR FIRE FREQUENCY 1*2 Plant-Wide Fire protection panels F 2.4 x 10- 3 Components RPS MG sets F . 5.5 x 10- 3 Non-qualified cable run E '6.3 x 10- 3 Junction in non-qualified cable E

.. 1.6 x 10-

• i ~~

3 Junction box in qualified cable E 1.6 x 10* 3 Transformers F 7.9 x 10* 3 Battery chargers F 4.0 x 10* 3 Off-gas/H 2 Recombiner (BWR) G 8.6 x 10* 2 Hydrogen Tanks G 3.2 x 10* 3 Misc. hydrogen fires c 3.2 x 10* 3 Gas turbines G 3.1 x 10* 24 Air compressors F 4.7 x 10- 3 Ventilation subsystems F 9.5 x 10- 3 Elevator motors F 6.3 x 10- 3 Dryers F 8.7 x 10- 3 33 Transients D I .3 X I 0-Cable fires caused by welding c 5.1 x 10-23 Transient fires due to c 3.1 x 10-23 welding/cutting .

Footnotes associated with Table 4.7-2

1. Frequencies are per reactor year unless otherwise noted.

2. Fire frequencies are per fraction of ignition sources per year.

3. Fire frequency represents one event. The thirteen transient events which occurred during power operation are considered by the weighting factor.

4. Fire frequency represents an estimated 130 gas-turbine-operating years, General notes for Ignition Source Weighting Factor Method:

Area specific ignition sources were determined during the initial walkdown. Normally, ignition source frequencies are estimated using methods other than direct counting, including engineering judgement. These estimates are then verified during the walkdown. Estimates should be within 25% of actual values.

Revision 1, May 22, 1996 4-49

A. No ignition source weighting factor is necessary.

B. Obtain the ignition source weighting factor by dividing the number of ignition sources in the fire compartment by the number in the selected location.

• C. Obtain the ignition source weighting factor by calculating the inverse* of the number of compartments in the locations. Exclude any areas contained in locations other than in this table. *

• D. Obtain the ignition source weighting factor by summing the factors for ignition sources which are allowed in the area and divide by the number of areas in the locations in this table. For example, if cigarette smoking is prohibited do not include the cigarette smoking factor in the calculation. The factors are: . . .,

<:..~*:

• Cigarette Smoking 2

• Extension Cord 4

• Heater 3

• Candle 1

• Overheating 2

• Hot Pipe 1

. Overheating addresses errors while heating potential combustibles.

E. . Obtain the ignition source weighting factor by dividing the weight (or BTUs) of cable insulation in the area by the total weight (or BTUs) of cable insulation in Appendix R fire areas, not including the fire areas in either the radwaste area or the containment.

Cable insulation weights (or BTUs) are provided in Appendix R combustible loadings.

(Junction boxes and splices are assumed to be distributed in proportion to the amount of cable.)

F. Obtain the ignition source weighting factor by dividing the number of ignition sources

• in the fire area by the total number in all the locations in this table.

G. Obtain the ignition source weighting factor by dividing the number of ignition sources in the fire area by the total number in all plant locations, include locations that Were not specified in this table.

Revision 1, May 22, 1996 4-50

• FIRE DESCRIPTION TABLE 4.7-3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING COMBUSTIBLE 1

IGNITION SOURCE AREA LOADING I FREQUENCY (yr) 1 Control Room Moderate ..

Exposure Fire .. ~

2.43E-3 Cabinet Fire *;:,I~

9.50E-3 )

2 Cable Spreading Room Moderate Exposure Fire 3.19E~3 Cabinet Fire . 3.20E-3 3 lD Switchgear Room Moderate Exposure Fire 9.81E-4 Cabinet Fire 3.75E-3 4 1C Switchgear Room Moderate Exposure Fire 4.15E-4 Cabinet Fire 3.75E-3 5 Diesel Generator 1-1 Light l.69E-2 6

• Dies~l Generator 1-2 L_ight l.72E-2 7&8 Diesel *Day Tanks Heavy NIA - Screened 9A Intake Structure - East Side Light * . 7.20E-3 (SWS) 9B Intake Structure - West Side Light 7.20E-3 (FPS) 10 East Engineered Safeguards Minimal 2.36E-3 11 Battery Room #2 Moderate 1.60E-3 12 Battery Room # 1 Moderate 1.60E-3 Revision 1, May 22, 1996 4-51

TABLE 4.7-3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING FIRE DESCRIPTION COMBUSTIBLE IGNITION SOURCE AREA LOADING 1 FREQUENCY (yr) 13Al Auxiliary Building 590' Minimal l.99E-3 Corridor (CCW to Charging) *.* r ..

• • • 9 13A2 Auxiliary Building 590' Moderate 5.37E-3 Corridor (Except Zone 13Al) 13B Charging Pump Room Minimal 2.06E-3 13C All Other Areas on the 590' Minimal - l.15E-2 Auxiliary Building Moderate 14 Containment Building Light NIA 15 Engineered Safeguards Panel Moderate 1.50E-4 Room 16 Component Cooling Water Minimal 2.36E-3 Pump Room 17 Refueling and Spent Fuel Pool Minimal ...NIA - Screened Room 18 Demineralizer Room Minimal NIA - Screened 19 Compactor Area - Track Alley Minimal - NIA - Screened Moderate 20

• Spent Fuel Pool Equipment Minimal 6.02E-4 Room 21A Electric Equipment Room - Light 3.80E-3 East Side (Bus 19)

Revision 1, May 22, 1996 4-52

TABLE 4.7-3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING FIRE *DESCRIPTION COMBUSTIBLE IGNITION SOURCE AREA

• LOADING 1* FREQUENCY (yr) 21B Elec~ic Equipment Room - Light ... 3.80E-3 West Side (Bus 20) ..'-

22 Turbine Lube Oil Room Heavy. NIA- Screened 23E Turbine Building East Side Moderate 2.94E-2 23S Turbine Building South Side Heavy 6.42E-2 23W Turbine Building West Side Moderate l.55E-3 24 Auxiliary Feedwater Pump Minimal 2.27E-4 Room 25

• Heating Boiler Rooms Moderate NIA - Screened 26 Southwest Cable Penetration Moderate 6.89E-5 Room 27 Radwaste Addition - VRS Moderate NIA - Screened 28 West Engineered Safeguards Minimal 2.74E-3 29 Center Mechanical Equipment Minimal NIA - Screened Rooms 30 East Mechanical Equipment Moderate NIA - Screened Rooms 31 West Mechanical Equipment Moderate NIA - Screened Rooms 32 SIRW Tank/CCW Roof Area Minimal 4.85E-5 Revision 1, May 22, 1996 4-53

- TABLE 4.7-3 PALISADES IGNITION SOURCE FREQUENCIES AND COMBUSTIBLE LOADING FIRE DESCRIPTION COMBUSTIBLE IGNITION SOURCE AREA LOADING 1 FREQUENCY (yr) 33 Technical Support Center *Moderate .NIA - Screened

. : .-1:~..

34 Man Hole # 1, #2, #3 Light 3.97E-5 Note 1 Minim~ (0 - 2 psf, 10 minute maximum fire duration)

Light (3 - 7 psf, 35 minute maximum fire duration)

Moderate (8 - 20 psf, 120 minute maximum fire duration)

Heavy (>20psf, > 120 minute fire duration)

Revision 1, May 22, 1996 4-54

Table of Contents Section 4.8

. Fire Detection and Suppression 4.8.1 Detection 4-56 4.8.2 Automatic Suppression 4-56 4.8.3 . Manual Suppression 4-56

.....!1.*'*

4.8.3.1 Control Room Cabinet Fires 4-58 4.8.3.2 Control Room Exposure Fire 4-58

• Revision 1, May 22, 1996 4-55.

4.8 FIRE DETECTION AND SUPPRESSION The detection and suppression systems available in each fire area are presented in the Fire Hazards Analysis and listed in Table 4.8-1. While detection and suppression capability are discussed for most areas of the plant, it should be noted that the only locations where detection and/or suppression were credited in the accident sequence quantification were the control room, the cable spreading room and the Class lE switchgear rooms. It should also be noted that the assumptions and methodology employed in the fire IPEEE (specifically those dealing with suppression_ of fire in control room panels) are not necessarily the same as those employed in the Appendix R analysis. - .- .

• .:.:;:~: :.

4.8.1 Detection Two basic methods *of automatic fire detection are used at Palisades. These methods are ionization detection and ultraviolet (UV) detection. Alarms are designed to sound locally and in the control room*. The detection system will also sound an alarm if there is a fault in the detector system. The control room also has smoke detectors in the walk-in cabinets and detectors at the ceiling, though not visible from the general area of the control room. These detectors sound "al.arms locally.

In addition to the alarms described above, there are water flow alarms associated with water

_suppression systems which alarm in the control room. These alarms are also identified m Table 4.8-1.

4.8.2 Automatic Suppression The automatic suppression systems at Palisades consist of water based systems. The water supply for the water suppression portion" of the fire prot_ection system consists of two diesel-driven pumps and one electric motor-driven pump that will each deliver 1500 gpm *at 12? psi.* The water delivery portion of the system consists of deluge, wet/dry pipe sprinklers and hose stations.

Although many locations in the plant are protected by automatic fire suppression systems, the cable spreading room and ClasslE switchgear rooms are the only locations in which this analysis takes credit for the automatic suppression of a fire. These rooms are equipped with a fusible-link

• wet sprinkler fire extinguishing system. The unavailability of the wet sprinkler system used in the quantification of this fire scenario is taken from the FIVE methodology. This generic wet sprinkler system unavailability is 2.0E-2.

4.8.3 Manual Suppression NRC guidance requires each plant to maintain a manual fire fighting capability. The fire brigades developed under these requirements are well trained and capable of fighting fires while awaiting support from professional fire fighting teams, if called. To take credit for brigade or other manually actuated suppression system responses in the FIVE methodology, however, the plant Revision I , May 22, I 996 4-56

must demonstrate that the fire brigade can assemble, fight and control a fire in the compartment before the fire causes damage to safe shutdown equipment. That is, the time to detect a fire plus the time to respond to the scene with equipment and control the fire must be less than the time required for the fire to damage critical equipment.

• Detection time is dependent upon the type of detection equipment in a compartment. Ionization detectors should detect a fire during the incipient stages whereas heat detectors would not be expected to detect a fire until the fire is more fully involved. Fire brigade response time includes time to verify the detection and the time for the team to respond to the scene with equipment.

Response time is obviously highly variable and is dependent upon the location of the fire, location of the brigade members at the time of the event and many other fact9rs.

The FIVE methodology assigns a probability of successfully suppressing a fire manually if the following two criteria can be met:

1) The plant can demonstrate that detection and manual resporise can occur *before damage to safe shutdown equipment, and

2) Fire brigade effectiveness can be demonstrated per the requirements of the Sandia Fire Risk Scoping Study (Ref. 4-11).

This analysis recognizes that manual suppression efforts will be taken to suppress a fire to limit damage and to ensure that the fire does not propagate outside the fire area boundaries, even though this action is credited only for the control room. Manual fire suppression equipment is available thr~ughout the plant in the form of portable fire extinguishers and hose stations. The fire . fighting training program in place at Palisades ensures that . fire brigade members are

~dequately trained to effectively use this equipment.

The only, fire area credited with manual suppression is the control room. In .the control room,

. fire detection can be accomplished in a variety of ways:

• the walk-in control room cabinets contain local smoke detectors which would provide an audible alarm should smoke be generated within the cabinets; the control room contains local smoke detectors in the ceiling which would provide an audible alarm should smoke be generated in the control room; and the control room is continuously staffed and a fire should be quickly sensed by smell or sighted by the operators.

Control room cabinet and exposure (whole room) fires were evaluated differently, as discussed in the following sedions. .

Revision 1, May 22, 1996 4-57

4.8.3.1 Control Room Cabinet Fires Palisades assumed that a cabinet fire will be contained 'Vithin the cabinet for the following reasons:

NUREG/CR-5384 (Ref. 4-15) concludes ihat cabinet fires will tend to remain within cabinets even without suppression; failure to detect a fire in the control room is negligibly small due to the redundancy and diversity of cues and due to the continuous staffing of the control. room; all control room operators are trained in fire suppression techniques, th~;efore, very early detection and immediate action to suppress a fire is very likely; and the cabinets contain relatively small amounts of combustible material.

Wal.kdowils were performed to confirm that there is sufficient fire protection within a cabinet to prevent a fire from disabling both channels simultaneously. Therefore, each control room cabinet was evaluated for a left and right channel fire. For each cabinet fire, all of the equipment in that cabinet associated with that channel was assumed to be lost due to fire damage. No damage to equipment or cables outside of the cabinet with the fire is assumed in this analysis.

• 4.8.3.2 Control Room Exposure Fires A control room exposure fire is defined as a fire that starts outside of any cabinet. Upon failure to suppress a control room exposure fire, the entire control room is assumed to be engulfed resulting in a loss of all equipment and cabinets. The FIVE methodology normally allows a minimum value of 0.1 for the probability of faili~g to suppress a fire manually _in a given space.

This an*alysis .assumes additional credit for successfully suppressing a control *room *fire and assigns a value of l .OE-2 and is supported by the following reasons:

failure to detect a fire in the control room is negligibiy small due to the redundancy and diversity of cues and due to the continuous staffing of the control room; all control room operators are trained in fire suppression techniques, therefore, very early detection and immediate action to suppress a fire is very likely; there is minimal combustible material (loading) in the control room outside of the cabinets.

Revision I, May 22, 1996 4-58

• FIRE AREA DESCRIPTION TABLE 4.8-1

SUMMARY

OF PALISADES FIRE DETECTION AND SUPPRESSION DETECTION* SUPPRESSION Control Room Smoke, Discovery Ext, Hose 1 2 Cable Spreading Room Smoke2 Automatic Sprinkler, Ext, Hos.e! . ~

3 ID Switchgear Room Smoke2 Automatic Sprinkler, Ext, Hose 1 4 1C Switchgear Room Smoke 2 Automatic Sprinkler, Ext, Hose 1 .

5 Diesel Generators 1-1 Water Flow Alami 2 Automatic Sprinkler, Ext, Hose 1 6 Diesel Generators 1-2 Water Fiow Alarm 2 Automatic Sprinkler, Ext, Hose 1 7.& 8 Diesel Day Tanks Discovery Ext 1, Hose 1 9A&B Intake Structure uv 2 Automatic Sprinkler, Ext, Hose 1 10 East Engineered Safeguards Smoke 2 Ext, Hose 1 11 Battery Room A Smoke Ext 1, Hose' 12 Battery Room B Smoke Ext 1, Hose 1 13Al Auxiliary Building 590' Smoke (partial) Ext, Hose Corridor (South Finger) 13A2 Auxiliary Building 590' Smoke (partial) Ext, Hose Corridor (Except Zone 13Al) 13B Charging Pump Room Smoke2 Automatic Sprinkler, Ext, Hose 1 13C Rest of 590' Auxiliary Discovery Exe, Hose 1 Building Revision 1, May 22, 1996 4-59

• FIRE AREA DESCRIPTION TABLE 4.8-1

SUMMARY

OF PALISADES FIRE DETECTION AND SUPPRESSION DETECTION SUPPRESSION 14 Containment Discovery, Smoke2 in Ext, Hose air room & cable penetration area 15 Engineered Safeguards Panel Smoke Ext, Hose 1*:'.

Room 16 Component Cooling Pump Smoke (on first level) Ext 1, Hose 1 Room 17 Refueling and Spent Fuel Pool Smoke 2 (located at Ext, Hose Room north end) 18 Demineralizer Room Discovery Ext 1 19 Compactor - Area Track Alley Discovery Automatic Sprinkler .

(Dry Pipe), Ext, Hose 1 20 Spent Fuel Pool Equipment Discovery Ext 1, Hose 1 Room 21A&B Electric Equipment Room Smoke 2 Automatic Sprinklers, Ext 22 Turbine Lube Oil Room Water Flow Alarm Automatic Sprinkler, Ext, Hose

.23E Turbine Building - East Side Water Flow Alarm, Automatic Sprinklers, Discovery Ext 1,. Hose 1 23S Turbine Building ~ South Side Water Flow Alarm, Automatic Sprinklers, Discovery Ext, Hose 23W Turbine Building - West Side Water Flow Alarm, Automatic Sprinklers, Discovery Ext, Hose 1 24 Auxiliary Feedwater Pump Smoke 2 Ext, Hose 1 Room Revision I, May 22, 1996 A-60

TABLE 4.8-1

SUMMARY

OF PALISADES FIRE. DETECTION AND SUPPRESSION FIRE DESCRIPTION DETECTION SUPPRESSION AREA 25* Boiler Rooms Water Flow Alarm Automatic Sprinkler, Ext, Hose 1 26 Southwest Cable Penetration Smoke Automati<;. Sprinklers, Room Ext, Hos~\'

• 27 Radwaste Addition - YRS Smoke Automatic Sprinklers (Dry Pipe), Ext, Hose 1 28 West Engineered Safeguards Discovery Ext, Hose 1 29 Center Mechanical Equipment Smoke Ext, Hose 1 Room '

30

• East Mechanical Equipment Smoke Ext, Hose 1 Room ..

31 West Mechanical Equipment Room Smoke Ext, Hose 1 .

32 SIR W Tank/CCW Room Roof Discovery Ext, Hose 1 Area 33 TechnicarSupport Center Smoke I:.xt, Hose 1 34 Manholes #1, #2, #3 Discovery, Smoke3 Automatic Sprinkler, Ext, Hose 1 NOTE 1 Located in adjacent space and accessible for fire fighting.

.NOTE 2 Alarms in Control Room .

NOTE 3 Available in the 1C Switchgear Rooin directly above manholes.

Revision I, May 22, 1996 4-61

4.9 FIRE GROWTH AND PROPAGATION All potential propagation paths that could result in propagation to a fire compartment containing safe shutdown equipment or plant trip initiators were considered. The Appendix R fire areas were reviewed to assess the potential for area to area propagation based on the existing fire barriers and fire area loading. In addition, some of the fire areas were divided into smaller fire zones utilizing the criteria of FIVE.

The potential for fire spread from the fire area/zone being evaluated (exposing compartment) to the adjacent fire areas (exposed compartments) was then examined. Each common boundary was analyzed for fire spread *in either direction. A means of addressing fire spt¢ad across these boundaries is addressed in the FIVE methodology and was used in this study. Criteria to determine fire spread were identified in Section 4.1.2.

Any scenario where a fire could potentially involve two or more adjacent areas/zones was analyzed for potential fire spread. All fire area boundaries are either 2 or 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> .rated boundaries or have an engineering evaluation (Ref 4-7) performed by a qualified fire protection engineer confirming fire spread across the boundary is not credible or meet the criteria of FIVE. Based on this information, no locations were identified within the plant that have the potential for fire spread beyond the originating fire area/zone.

Revision 1, May 22, 1996 4-62

Table of Contents Section 4.10 Fire Event Trees 4.10.1 Fire Event Tree Top Event Defmitions 4-64 4.10.2 Event Tree .for Fire in Control Room 4-65 4.10.3 Event Tree for Fire in Cable Spreading and Switchgear Rooni. *.;

• 4-66

~:~*'*

4.10.4 Accident Sequence Classification 4-67

• Revision I, May 22, 1996 4-63

4.10 FIRE EVENT TREES

• The fire analysis was based on the Palisades transient event tree from the IPE as shown in Figure 4.10-1. A fire in most locations in the Palisades plant would initiate an event similar to a transient event with one or more of the systems identified in Section 4.1.3 unavailable due to the fire. One additional event tree was developed specifically for this analysis as shown in Figure 4.10-2. It was developed for fires in the main control room (fire area 1), cable spreading room (fire area 2) and Class lE switchgear rooms (fire areas 3&4) and was based on the IPE transient event tree. Top events were added to account for the effects of suppression and switching control of the plant to the alternate shutdown system panel or operation of equipment available given the fire damaged all equipment affected within the fire area. , *-:.~.

• Accident classes were *defined such that core damage sequences with similar characteristics (e.g.,

PCS failure pressure, core damage timing, system failures) could be grouped and analyzed together. The three accident classes e111ployed in the fire IPEEE are a subset of the accident classes found in the IPE. These accident classes are: Class IA - core damage due to the failure of secondary heat removal and once through cooling during the injection phase; Class IB - core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase; and Class II - core damage due to loss of containment heat removal.

4.10.1 Fire Event Tree Top Event Definitions FIRE Fire Initiator The fire is defined as initiating in a location that would cause a plant trip or require a manual shutdown and affect frontline safe shutdown or support system equipment potentially useful for plant shutdown.

RXC -* Reactiv~ty Control Sufficient control rods to control reactivity are fully inserte~ into the reactor core.

SUPP Suppression of Fire Before Spread (Control/Cable Spreading/Switchgear Rooms only)

The fire is suppressed either by occupants in the room or by automatic suppression equipment before it can spread to locations impacting other safe shutdown equipment.

ASDP Operators Control Plant at the Alternate Shutdown Panel (Control/Cable Spreading Rooms only)

The operators carry out the "Alternate Shutdown Outside Control Room" procedure, Procedure ONP 25.2, evacuating the main control room, and transferring plant control to the ASDP. This also includes successful operation of the AFW steam driven pump via local control of the steam supply valves and injection valves.

Revision 1, May 22, 1996 4-64

2ND Secondary Cooling

• Maintenance of the steam generator secondary side inventory using AFW and a steam release path for secondary heat removal.

POR PORV Opens to Support Once Through Cooling Opening of at least one power operated relief valve to release thermal* energy from the PCS and facilitate once through cooling (OTC).

Sil PCS Inventory Control - Injection Primary system make up flow utilizing at least one HPSI pump injecting through one

• of four headers to the PCS with suctiori from the SIRW tank.

SIR PCS Inventory Control - Recirculation Safety injeetion in the recirculation phase of once through cooling requiring safeguard

• pump suction switchover from the SIRW tank to the containment sump and continued operation of at least one HPSI pump. HPSI pump suction subcooling and HPSI pump cooling (seals and bearings) are also required.

CHR Containment Heat Removal Containment heat removal for OTC consisting of operation of at least one containment

• spray pump or one containment air cooler. Operation of service water and component coolii~1g water valves to align shutdown cooling heat exchanger cooling are also required for containment spray operation in the recirculation mode.

4.10.2 Event Tree For Fire in Control Room The control room was* evaluated two ways: cabinet fires and exposure fires (fire outside of cabinets). Each channel (right and left) for each cabinet was evaluated independently. Each cabinet fire initiating frequency is the same and is based on the total number of cabinets in the control room. Each cabinet fire was evaluated assuming the initiating frequency is the sum of the fire initiating frequencies for all of the cabinets in the control room. The worst case cabinet fire was combined with the exposure fire results to obtain the control room fire result. The control room cabinet fires were quantified using the transient event tree. The event tree for control room exposure fires is,similar to the transient event tree, with the following changes:

( 1) The event SUP is included to account for the likelihood of the fire being suppressed by the operators as discussed in Section 4.8. Successful manual suppression is assumed to limit the extent of the fire to the failure of the most .

significant system in the room. Therefore, successful manual suppression is

• Revision 1, May 22, 1996 4-65

assumed to limit cable damage to the AFW system leading to failure of the two motor driven AFW pumps (steam driven pump available from ASDP). The AFW system was selected to be failed because its loss has more of an impact on the

.core damage frequency than loss of both HPSI pumps. The probability of failure of this event is l.OE-2, as discussed in Section 4.8. Failure of manual suppression allows the fire to engulf the entire control room and disable all equipment and cabling in the room.

(2) The ASDP event is included to account for the operator's ability to recognize the need to evacuate the control room and to successfully control *t4e plant from the ASDP or through local manual operations. * ** * ~.'.) .

This event tree assumes that suppression of the fire in the control room must'fail before it can spread to locations impacting equipment in cabinets. Spreading of the fire into the control room cabinets is assumed to force the evacuation of the control room and shutdown from the ASDP.

This event tree was quantified usirig the same methods used in the IPE for the transient tree. *The results of the fire analysis quantification are provided in Table 4.11-1.

• 4.10.3 Event Tree For Fire in Cable Spreading and Switchgear Rooms The cable spreading and both Class 1E switchgear rooms were evaluated two ways: cabinet fires and exposure fires (fire outside of cabinets). Each cabinet fire initiating frequency is the same and is based on the total number of cabinets in the room. *Each cabinet fire was evaluated assuniing the initiating frequency is the sum of the fire initiating frequencies for all of the cabinets in the room. The worst case cabinet fire was combined with the exposure fire results to obtain the fire area result. The cabinet fires were quantified using the transient event tree.

rhe event tree for exposure fires is similar to the ij:'ansient event tree, with the following changes:

( 1) The event SUP is include.d to account for *the likelihood of. the fire being suppressed before it can spread into the cabinets.* Successful autoniatic suppression is assumed to limit the extent of the fire to the failure of the most sigruficant system in the room. Therefore, .successful automatic suppression is assumed to limit cable damage to the AFW system leading to failure of the two motor driven AFW pumps (steam driven pump available from ASDP). The AFW system. was selected to be failed because its loss has more of an impact on the core damage frequency than loss of both HPSI pumps. The probability assigned to the failure of automatic suppression is 2.0E-2, as discussed in Section 4.8.

Failure of automatic suppression allows the fire to engulf the entire room and fail all equipment and cable* in the room .

• Revision 1, May 22, 1996 4-66

(2) The ASDP event is included to account for the operator's ability to recognize the need to evacuate the control room due to the inability to control safe shutdown equipment because of fire induced damage and to successfully control the plant from the ASDP or through local manual operations.

This event tree was quantified using the same methods used in the IPE for the transient tree. The results of the fire analysis quantification are provided in T~ble 4.11-1.

• 4.10.4 Accident Sequence Classification Accident classes define the functional categories for binning core damage sequ~n~es ~ased upon cP.aracteristics of the acCident sequences with respect to reactor and containment conditions at the time core damage is assumed to occur.

• The potential types and frequencies of accident scenarios at a nuclear power plant cover a broad spectrum. In order to limit these sequences to a manageable number, sequences with similar functional characteristics are grouped together. Three such functional classes were defined for the Palisades fire IPEEE:

Class IA -

• Sequences that progress to core damage due to the failure of secondary heat removal *and once through cooling during the injection phase.

Class IB - Sequences that progress to core damage due to the failure of secondary heat removal and once through cooling during the recirculation phase.

Class II - Sequences involving the loss of containment heat removal leading to containment failure and the subsequent loss of coolant inventory makeup.

These accident_ classes are *typical of other PRAs and are a subset of those used in the Palisades IPE. Other accident classes that were .included in the Palisades IPE but were not considered to be applicable to the fire IPEEE include:

Class IIIA- Sequences initiated by a small break loss of coolant accident (SBLOCA) with loss of primary coolant makeup during the injection phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the injection phase of high pressure safety injection. No fire initiator was identified that could credibly lead to a loss of coolant accident.

Class IIIB- Sequences initiated by a small break loss of coolant accident (SBLOCA) with loss of primary coolant makeup during the recirculation phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the recirculation phase of high pressure safety injection. No fire initiator was identified that could credibly lead to a loss of coolant accident.

• Revision 1, May 22, 1996 4-67

Class IIIC-. Sequences initiated by a medium or large break loss of coolant accident with loss of primary coolant makeup during the injection phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the injection phase of all engineered safeguards pumps. No fire initiator was identified that could credibly lead to a loss of coolant accident.

Class IIID- Sequences initiated by a medium or large break loss of coolant accident with loss of primary coolant makeup during the recirculation phase. This class leads to core damage due to the inability to maintain sufficient PCS inventory during the recirculation phase of all engineered safeguards pumps. No :,fir~ initiator was identified that could credibly lead to a loss of coolant accident.'/

• *- *** ~ f .

Class IV- Sequences leading to core damage due to the failure of reactivity control. No fire initiator was identified that could credibly lead to a failure of the reactor protection system. The simultaneous failure of the reactor protection system or control rod insertion is probabilistically insignificant.

Class VB-* Sequences initiated by steam generato_r tube rupture with loss of effective coolant inventory makeup. This class contains those steam generator tube rupture initiated events that do not lead to core damage due to failure of decay heat removal, but rather due to the inability to maintain sufficient PCS inventory. No fire initiator was identified that could credibly lead to a steam generator tube rupture event.

• . Revision 1, May 22, 1996 4-68

FIGURE 4.10-1 FIRE EVENT TREE PORV OPENS TO PCS INVENTORY PCS INVENTORY CONTAINMENT REACTIVITY SECONDARY" SUPPORT ONCE CONTROL- CONTROL- HEAT CLASS*

• • coOLING THROUGH INITIATOR CONTROL INJECTION RECIRCULATION REMOVAL COOLING TRANS RXC 2ND POR Sii SIR CHR OK OK II IB IA IA ATWS Revision 1 May 22, l996 4-69

FIGURE 4.10-2 MODIFIED FIRE EVENT TREE FIREIN PORVOPS OPERATORS PCS PCS CONTROL OR TO SUPPORT t:ONTAINMEN1 REACTIVITY FIRE CONTROL SECONDARY INVENTORY INVENTORY SEQ.

CABLE ONCE HEAT CLASS CONTROL SUPPRESSIOll PLANT COOLING CONTROL- CONTROL- PROB.

SPREADING THROUGH REMOVAL FROMASDP INJECTION RECIRC.

ROOMS COOLING FIRE RXC SUPP ASDP 2ND .POR 811 SIR CHR D.DE+GO OK D.DE+GO OK D.DE+GO II D.DE.00 18 D.DE+GO IA.

D.DE+GO IA D.DE.00 OK D.DE+GO IA D.DE+GO IA

' '."~ .... D.DE+GO ATWS Revision 1 May 22, 1996 4-70

Table of Contents Section 4.11 Analysis of Fire Sequences and Plant Response 4.11.1 Important Accident Classes 4-72 4.11.1.1 Class IA 4-72 4.11.1.2 . Class IB 4-73 4.11.1.3 Class II *>

4-75

• 4.11.2 Important Fire Areas/Rooms 4-76 4.11.2.1 Cable Spreading Room ' 4-76 4.11.2.2 Control Rooni 4-77 4.11.2.3 lD Switchgear Room 4-79 4.11.2.4 Turbine Building 4-80

. 4.11.2.5 1C Switchgear Room 4-82

• Revision 1, May 22, 1996 4-71

4.11 ANALYSIS OF FIRE SEQUENCES AND PLANT RESPONSE The functional reporting requirements presented in Generic Letter 88-20 and NUREG-I407 are:

(I) Functional sequences with a CDF greater than IE-6 per year (functional sequences for

- the Palisades fire IPEEE are the three accident classes defined in Section 4. I 0).

(2) Functional sequences that contribute 5 percent or more to total CDF.

(3) - Sequences determined by the utility to be important contributors to CDF or containment performance.

Although these reporting criteria are suggested by NUREG-I407, all three ~ctional accident classes quantified in the Palisades Fire IPEEE are described regardless of whether they meet the screening thresholds. -

4.11.1 Important Accident Classes 4.11.1.1 Class IA The sequences within this class are characterized by failures of the AFW system and failure of once through cooling (OTC) during the injection phase. Accident Class IA sequences have a total CDF of I .97E-5/year, or 59.4% of the overall fire CDF, as *shown in Figure 4.0-2. As shown in Figure 4.0-3, more than 97% of the CDF from Accident Class IA was provided by five fire areas: cable spreading room (39.0%); control room (25.0%); ID switchgear room (15.2%);

turbine building (10.6%); and IC switchgear room (7.3%). Approximately 64% of the contribution is a result of fires in the cable spreading room and control room.

Important assumptions applicable tQ Accident Class IA are:

1. * -OTC is initiated_ per procedure, with second'!fY inventory still 'avaihble. Procedures

. direct the operators to initiate OTC if PCS/core temperatures are rising uncontrolled and SIG levels are less than -84%.

2. It is conservatively assumed that the loss of containment heat removal leads to containment failure, resulting in a loss of inventory used for PCS/core heat removal.

The loss of heat transfer via PCS inventory results in the failure of heat transfer out of the core, and leads to core damage.

Significant fire initiating events are:

1. Fires in the control room, cable spreading room, 1C and 1D switchgear rooms contribute more than 86% to Accident Class IA. Approximately half of the contribution from these .

areas is from exposure fires with successful suppressi~n, but with failure of the AFW system (worst case system as described in Section 4.0.4). Failure of the worst case system is conservative because fire induced damage of cable for all three AFW pumps Revision 1, May 22, I 996 72

or both HPSI pumps is unlikely due to separation of trains.* Approximately 38% of the contribution from these areas is from exposure fires with a failure of suppression to contain the fire resulting in damage to all of the equipment in the area. Only P-8B (steam driven AFW pump) is available in these sequences from the alternate shutdown panel (ASDP) or through local manual control of steam supply and injection valves.

The rest of the contribution from these areas is from cabinet fires.

2. A fire in the nirbine building contributes another 10.6% to this accident class. Fires in this area are dominated by fires in the east side and south side. A fire in the east side or south side may disable the safeguards transformer and fast transfer. '.fhe safeguards buses (buses 1C&D) would transfer to the diesel generators with the ~p transformers available for manual transfer. Also, the instrument air compressors.and one train of HPSI injection valves are lost. Automatic and remote control of one motor driven and

• the steam driven AFW pumps may be unavailable, but local manual control is available.

Significant operator actions contributing to this accident class are:

1. Failure to initiate OTC following failure of the AFW system is the most significant operator action for this accident class. This operator action occurs following a successfully suppressed exposure (which fails the AFW system except for local controls) in the control room, cable spreading room and both switchgear rooms. Sequences with failure of this operator action contribute 38.8% to CDF for this accident dass.

2. Failure to control the steam supply valves for the steam driven AFW pump, either from the ASDP or locally, and failure to control the injection valves, either from the ASDP or locally, following exposure fires in the control room, cable spreading room and both switchgear rooms, is the next most significant operator action for this accident class.

Sequences with failure of this operator action contribute 29 .4% of CDF for this accident class. - - . -

Significant equipment failures and sequences associated with this accident class include:

1. Failure of P-8B (steam driven AFW pump) is the most significant equipment failure for this accident class. All of the exposure fire sequences for the control room, cable spreading room and IC and ID switchgear rooms contain faililres of P-8B. Sequences with failure to suppress these exposure fires results in core damage upon failure of P-8B.

2. Station blackout sequences contribute <1 % to this accident Class.

4.11.1.2 Class IB Sequences in this class are \:haracterized by events with failures of the AFW system and failure of once through cooling (OTC) during recirculation. As shown in Figure 4.0-2, Accident Class IB sequences have a CDF of l.31E-5/year or 39.6% of the overall fire CDF at Palisades. As Revision 1, May 22, 1996 4-73

shown in Figure 4.0-4, more than 92% of the CDF from Accident Class IB was provided by seven fire areas: cable spreading room (26.2%); control room (24.2%); lD switchgear room (12.2%); west safeguards room (8.5%); lC switchgear room (8.1%); turbine building (7.4%); and 590' auxiliary building (6.2%).

Assumptions associated with the Accident Class IB sequences are: _

1. Engineered safeguards room coolers are not required for several days and, therefore, were not modelled as failures. -

~ .. , *..

2. It is assumed that high pressure air compressors are required for op~on (opening) of the sump valves when entry into recirculation inay not occur for an -extended time.

Significant fire initiating events for this accident class are:

1. Successfully suppressed exposure fires in the control room, cable spreading room, 1C and ID switchgear rooms contribute more than 54% to Accident Class - IB.

Approximately 88% of the contribution from these areas is from exposure fires with successful suppression, failure of the AFW system, successful initiation of OTC with a failure to initiate HPSI pump subcooling (only required during recirculation).

Significant operator actions contributing to this accident class are:

1. Failure to initiate HPSI pump subcooling- upon successful transfer of HPSI suction from the SIRW tank to the containment sump (recirculation) is the most significant operator -

action for this accident class. Sequ~nces with failure of this operator action contribute -

to 58.2% of the CDF for this accident class. - -

2. Failure to recover from random f').ilures in the AFW system prior to recirculation is the next most significant operator action for this acddent class. These sequences occur

• when the AFW system fails and OTC is successfully initiated. Recirculation is failed due to fire induced damage to the circuitry for both containment sump valves. If random failures of the AFW system are not recovered by the time recirculation is required, then core damage occurs. Sequences. with failure of this operator action contribute 12.3% of CDF for this accident class. AFW system recovery was credited for the west safeguards room and 590' auxiliary building fires only. Recovery of randomly failed AFW components was credited in accordance with NSAC-161 (Ref. 4-

14) and given a probability of faililre of' 0. L This failure rate was based on the reference document stating that 90% of AFW failures were recovered within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

Recirculation for OTC is not expected to occur for more than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

• Revision 1, May 22, 1996 4-74

Significant equipment failures associated with this accident class include:

1. The most significant equipment failures are random failures of the steam driven AFW pump. Sequences containing this failure contribute 44.5% to CDF for this accident class. Failure of the steam driven AFW pump combined with operator failure to initiate HPSI pump subcooling combination contributes over half of the contribution for random failures of the steam driven AFW pump for this accident class.

2. Other significant equipment failures. are random failures of the AFW system with successful OTC, but the containment sump valves do not function due to fire induced damage, combined with failure to recover random failures of 1li~ AFW system.

Sequences with this combination of failures contributes 12.3% to CDF for this accident class.

3. Station blackout sequences contribute <1 % to this accident class.

4.11.1.3 Class II 1

Accident Class II events are characterized as sequences resulting from a loss of containment heat removal. The CDF for this accident class is 3.48E-7/yr or approximately 1.0% of the total fire CDF, as shown in Figure 4.0-2. As shown in Figure 4.0-5, only three fire areas contribute to this accident class: ID switchgear room cabinet fire (89.0%); turbine building east side fire (9.2%);

and 590' auxiliary building (1.7%).

Assumptions associated with the Accident Class II sequences are:

• 1. Containment heat removal requires only one of three containment spray pumps or orie

. of three containment air coolers.

2. Containment heat removal is only required when once through cooling is initiated.

Successful secondary cooling by the AFW system does not require containment. heat

• removal.**

The only significant fire initiating event for this accident class is:

1. This accident class is dominated by a fire in the 1D switchgear room bus 1D cubicle (89%). A fire in this area may cause fire induced damage to the safety related bus ID, thereby disabling one train of safety related equipment. Only the remaining equipment from the redundant safety related bus 1C is available for safe shutdown.

Revision 1, May 22, 1996 4-75

The only significant operator action contributing to this accident class is:

I. Failure to locally operate the steam supply valves for the steam driven AFW pump upon failure to automatically open. Sequences with failure of this operator action contribute to 6.8% of CDF for this accident class.

Significant equipment failures associated with this accident class include:

I. This accident class consists of failures of secondary cooling (AFW system) combined with containment heat removal. Containment heat removal is '-:-provided by the containment spray pumps. The CCW heat exchangers remove :ihe /heat from the containment spray system. The SWS removes the heat from the CCW system and transfers it to the ultimate heat sink. The most significant equipment failures are sequences with randoin failures of the CCW system, which contribute 72.4% to CDF for this accident class. -

2. The rest of the sequences are random failures of the containment spray system, which contribute 27.6% of CDF for this accident class.

4.11.2 Important Fire Areas/Rooms Approximately 90% of the plant risk associated with internal fires is attributable to five fire areas, llS shown in Figure 4.0-1. These areas are: cable spreading room (33.5%); control room (24.4%);

ID switchgear room (I4.7%); turbine building (9.3%); and IC switchgear room (7.6%). Table

4. I I-1 provides a detailed breakdown of_core damage frequen~y for internal fires by fire area and accident class.

This section provides the detailed plant response for each fire area not previously screened from consideration. The quantification results presented in Table 4. I I-1 include: *

( 1) * .The area in which the fire occurs; (2) The frequency of fire ignition in that area; and (3) The core damage frequency (CDF) given that this fire has occurred.

4.11.2.1 Cable Spreading Room (fire area 2)

Cable spreading room fires were evaluated two different ways (see Section 4.0.4): cabinet fires and exposure fires. The worst case cabinet fire (electrical box EJ-575) contributes 3.6% to CDF for this fire area. Exposure fires that are successfully suppressed with only the AFW system assumed to have fire induced failure (except for local control or control from the ASDP for the steam driven pump), as described in Section 4.0.4, contributes to 64.3% of the CDF for this fire area. Exposure fires where suppression fails and thus leaves only the steam driven AFW pump available from the ASDP or through local m~ual control contributes to 32. I% of CDF for this fire area.

Revision 1, May 22, I 996 4-76

EJ-575 Cabinet Fire The worst case cabinet fire is in electrical box EJ-575. A fire in this cabinet may lead to fire induced damage to all cabling associated with this box. A fire in this cabinet disables DC panel D-11 A~ which leads to the unavailability of one train of equipment. Equipment affected by a loss of panel D-11 A includes: one motor driven AFW pump and one HPSI train. Even though this is the worst case cabinet fire in the cable spreading room, it is not a .significant contributor to CDF. This cabinet fire contributes 3.6% of CDF for this fire area.

Exposure Fire Exposure fires were evaluated in two ways: successfully suppressed and failure of suppression.

Exposure fires contribute 96.4% to CDF for this fire area.

Successfully suppressed exposures fires area assumed to cause cable damage to the AFW system where the steam driven AFW is availab~e from the ASDP or locaily only. All other systems (HPSI, PORVs, CCW, SWS, containment sprays and containment air coolers) are assumed to be unaffected by the fire (see Section 4.0.4). The two most significant sequences are: random failures of the AFW steam driven pump combined with operator failure to initiate OTC; and random failure of the AFW steam driven pump combined with operator failing to initiate HPSI pump subcooling for recirculation. Other significant operator actions are: failure to locally operate the AFW injection valves; and failure to locally operate the steam supply valves to the AFW pump.

Unsuccessfully suppressed exposure fires may lead to fire induced failure of all equipment and cabling in the room, including both motor driven AFW pumps, automatic control of steam driven AFW pump (control still available from the ASDP or by local manual control only), both HPSI trains, both PORY trains, both containment spray trains, and all three containment air coolers.

Since b9th HPSI trains* and both PORV trains_ may be unavailable, OTC is_unavailable and, _

therefore, only the steam driven AFW pump operated from the ASDP or by local manual control is available_ for plant shutdown. Suppression failed exposure fires lead directly to core damage upon failure of the steam driven pump train. The dominant operator action for suppression failed exposure fires is failure to control :the steam supply valves for the steam driven AFW pump (either from the ASDP or locally) following evacuation from the control room (due to inability to control plant shutdown from fire induced damage to cables/circuitry).

4.11.2.2 Control Room (fire area 1)

Control room fires were evaluated two different ways (see Section 4.0.4): cabinet fires and

. exposure fires. The worst case cabinet fire (electrical cabinet EC-08R) contributes 16.1 % to CDF for this fire area. Exposure*_ fires that are successfully suppressed with only the AFW system assumed to have fire induced failure (except for local control or control from the ASDP for the steam driven pump), as described in Section 4.0.4, contributes to 67.2% of the CDF for this fire area. Exposure fires where suppression fails and thus leaves only the steam driven AFW pump Revision 1, May 22, 1996 4-77

available from the ASDP or through local manual control contributes to 16. 7% of CDF for this fire area.

EC-08R Cabinet Fire The worst case cabinet *fire is the right channel of electrical cabinet EC-08 (EC-08R). As discussed in Sections 4.0.4.4 and 4.10.2, control room cabinets were determined to be sufficiently built to consider each channel within a cabinet as a separate fire area. A fire in EC-08R may lead to fire induced loss of all cabling associated with the right channel in this cabinet. This cabling loss leads to the loss of one motor driven AFW pump, one HPSI . train and one containment spray train. This cabinet fire contributes 16. l % of the CDF for ~ntrol room fires.

The two most significant sequences are: random failures of the two remaining AFW pumps combined with random failures of the remaining HPSI pump; and random failures of the two remaining AFW pumps combined with random failures of the recirculation valves.

The dominant operator actions are failure to: initiate OTC upon AFW system failure; and initiate HPSI pump subcooling for recirculation upon depletion of the SIRW tank ..

Exposure Fire Exposure fires were evaluated in two ways: successfully suppressed and failure of suppression.

Exposure fires contribute 83.9% to CDF for this fire area.

Successfully suppressed exposures fires area assumed to cause cable damage to the AFW system where the steam driven AFW is available from the ASDP or locally only. All other systems

{HPSI, PORVs, CCW, SWS, containment sprays and containment air coolers) are assumed to be unaffected by the fire (see Section 4.0.4). The two most significant sequences are: random failures of the. steam driven AFW pump combined with operator failure to initiate OTC; and random failure of the steam driven AFW pump combined with operator failing to initiate HPSI pump subcooling for recirculation. Other significant op~rator actions are failure to: locally operate the AFW injection valves; and locally operate the. steam supply valves to the AFW pump.

Unsuccessfully suppressed exposure fires may lead to fire induced failure of all equipment and cabling in the room, including both motor driven AFW pumps, automatic control of steam driven AFW pump (control still available from the ASDP or by local manual control only), both HPSI trains; both PORV trains, both containment spray trains and all SWS pumps (fire protection is _

available as a backup to SWS). Since both HPSI trains and both PORVs may be unavailable, OTC is unavailable and, therefore, only the steam driven AFW pump operated from the ASDP

• .or by local manual control is available for plant shutdown. Suppression failed exposure fires lead directly to core damage upon failure of the steam driven pump train. The dominant operator action for suppression failed exposure fires is failure to control the steam supply valves for the steam driven AFW pump (either from the ASDP or locally) following evacuation from the control room .

• Revision 1, May 22, 1996 4-78

4.11.2.3 lD Switchgear Room (fire area 3)

This fire area was evaluated two different ways (see Section 4.0.4): cabinet fires and exposure fires. The worst case cabinet fire (bus ID cubicle) contributes 33.0% to CDF for this fire area.

Exposure fires that are _successfully suppressed with only the AFW system assumed to have fire induced failure (except for local control or control from the ASDP for the steam driven pump),

as described in Section 4.0.4, contributes to 44.7% of the CDF for this fire area. Exposure fires where suppression fails and thus leaves only the steam driven AFW pump available from the ASDP or through local manual control contributes to 22.3% of CDF for this fire area.

Bus JD Cubicle Fire The worst case cabinet fire in. the room is the bus ID cubicle. A fire in this cabinet may lead

• to fire induced loss of all equipment powered from safety related bus ID including one motor driven AFW pump, one HPSI train, one PORV train, one containment spray train, one train of

. component cooling water (CCW) and two service water pumps (which leads to a loss of containment air cooling). This cabinet fire contributes 33.0% of CDF for this fire area. .

The most significant equipment failures are sequences containing random failures of the AFW pumps combined with random failures of OTC (HPSI, sump valves or PO RVs). Other significant.

equipment failures include sequences with random failures of the AFW system combined with

• random failures of the CCW system (required for cooling recirculation water during OTC).

The most significant operator actions are failure to: initiate OTC upon AFW system failure; and initiate HPSI pump subcooling for recirculation upon depletion of the SIRW tank.

Exposure Fire

. Exposure fires were evaluated in two ways: successfully suppressed and faillire of suppression.

Exposure fires contribute 67.0% to CDF for this fire area.

Successfully suppressed exposures fires area assumed to cause cable damage to the AFW system where the steam driven AFW is available from the ASDP or locally only. All other systems (HPSI, PORVs, CCW, SWS, containment sprays and containment air coolers) are assumed to be unaffected by the fire (see Section 4.0.4). The two most significant sequences are: random failures of the steam driven AFW pump combined with operator failure to initiate OTC; and random failure of the steam driven AFW pump combined with operator failing to initiate HPSI pump subcooling for recirculation. Other significant operator actions are failure to: locally operate the AFW injection valves; and locally operate the steam supply valves to the AFW pump.

Unsuccessfully suppressed exposure fires may lead to fire induced failure of all equipment and cabling in the room, including both motor driven AFW pumps, automatic control of steam driven AFW pump (control still available from the ASDP 9r by local manual control only), one HPSI train, both PORV trains, one containment spray train, one train of CCW and two service water*

• Revision 1, May 22, I 996 4-79

pumps (which leads to a loss of containment air cooling). Since both PORVs may be unavailable, OTC is unavailable (no steam release path) and, therefore, only the steam driven AFW pump operated from the ASDP or by local manUal control is available for plant shutdown.

Suppression failed exposure fires lead directly to core damage upon failure of the steam driven

. pump train. The dominant operator action for suppression failed exposure fires is failure to control the steam supply valves for the steam driven AFW pump (either from the ASDP or locally) following evacuation from the control room (due to inability to control plant shutdown from fire induced damage to cables/circuitry).

4.11.2.4 Turbine Building (fire area 23)

The turbine building was evaluated as three separate, independent fire zones: east side, west side and south side. Station blackout sequences contribute 29.5% to CDF for turbine building fires.

The most sigmficant contributors are sequences with random failures of the AFW system combined with operator failure to initiate OTC, which contributes to 30. I% of CDF for this fire area. The significant operator actions are failure to initiate OTC upon AFW system failure (40.8%), failure to transfer safety related buses IC&D to the startup tran$former following diesel generator failure (I9.6%) and .failure to locally operate the steam supply valves for the steam driven AFW pump (I 0.6%).

Turbine Building Fire - East.Side Fires in the east side (fire area 23E) are the dominant contributors for turbine building fires.

Fires in this zone may lead to fire induced loss of all cabling and equipment in the east side including safeguards bus (primary off-site power source for bus IE and safety related buses I C&D), fast transfer to alternate off-site power source (startup transformer) (automatic starting and loading of the diesel generators for buses I C&D occurs and manual transfer to startup transformers for buses IC, ID&. IE available), instrument air system, one AFW motor driven pump, automatic control of steam driven AFW pump (local operation available), all pumps for*

makeup to the condensate storage tank (CST) (gravity feed or fire protection system available) and loss of one train of HPSI injection valves (local manual operation available). This fire zone .

contributes 69.6% of CDF for turbine building fires. *

• The dominant contributors to this fire zone are sequences containing random failures of the two remaining AFW pumps combined with the failure to initiate OTC. These sequences contribute*

34.3% to CDF for this fire zone. The most significant random failure contributors are sequences containing random failures of the AFW pumps combined with random failures of OTC, which contribute 9.8% to CDF for this fire zone. Sequences with random failures of the motor driven AFW pump combined with faililre to locally operate the steam supply valves and failure to initiate OTC contribute 6.5% to CDF for this fire zone. Also, station blackout sequences contribute 13.4% to CDF for this fire zone .

• Revision I, *May 22, 1996 4-80

The dominant operator action is failure to initiate OTC upon AFW system failure, which is included in sequences that contribute to 48.4% of CDF for this fire zone. Other significant operator actions include the failure to locally open the steam valves for the steam driven AFW pump (14.9%) and failure to manually transfer to the startup transformer following diesel generator failure (14.3%).

A recent modification resulted in rerouting the bus 1D feeder cable from the safeguards transformer through the turbine building versus underground (original configuration). Sensitivity analysis for this change indicates an increase in the C:QF for this fire zone by 75% and the overall turbine building fire CDF by 42.4%. The overall fire CDF is increased 5~0% as a result of this modification. * ....';.;-** *.

• Turbine Building Fire - South Side A fire in the south side (fire area 23S) may lead to fire induced loss of all cabling and equipment in the south side including safeguards bus (primary off-site power source for safety related buses 1C&D), fast transfer to alternate off-site power .source (startup transformer) (automatic starting and loading of the diesel generators for buses 1C&D and manual transfer to startup transformers for buses 1C, D & E available), automatic control of steam driven AFW pump (local operation

. available), all pumps for makeup to the CST (gravity feed or fire protection system available) and

.loss of one train of HPSI injection valves (local manual operation available). This fire zone contributes 28.0% of CDF for the turbine building fire. .

Station blackout sequences contribute 72.2% to CDF for this fire zone. Other significant contributors to this fire zone are sequences containing random failures of the AFW pumps combined with failure to initiate OTC. T_hese sequences contribute 13.5% to .CDF for this fire

• zone.

The dominant operator action is failure to manually transfer safety related buses* JC&D to the startup transformer following diesel generator failure, which is included in sequences that contribute 34.5% of CDF for this fire zone. Another significant operator action is the failure to initiate OTC upon AFW system failure, which is included in sequences that contribute 18.0% to CDF for this fire zone.

Turbine Building Fire - West Side

. A fire in the west side (fire area 23W) may lead to fire induced loss of all cabling and equipment in the west side including one AFW motor driven pump; automatic control of steam driven AFW pump (local operation available) and all pumps for makeup to the condensate CST (gravity feed or fire protection system available). This fire zone contributes to 2.4% of the CDF for the turbine building fire. All of the contribution to this fire zone are sequences containing random failures of the two remaining AFW pumps combined with operator failure to initiate OTC.

• Revision 1, May 22, 1996 4-81

4.11.2.5 lC Switchgear Room (fire area 4) .

This fire area was evaluated two different ways (see Section 4.0.4): cabinet fires and exposure fires. The worst case cabinet fire (bus IC cubicle) contributes 45.3% to CDF for this fire area.

Exposure fires that are successfully suppressed with only the AFW system assumed to have fire '

induced failure (except for local control or control from the ASDP for the steam driven pump),

as described in Section 4.0.4, contributes to 36.3% of the CDF for this fire area. Exposure fires where suppression fails and thus )eaves only the steam driven AFW pump available from the ASDP or through local manual control contributes to 18.3% of CDF for this fire area ..

Busl C Cubicle Fire The worst case cabinet fire in the room is the bus 1C cubicle. A fue in this cabinet may lead to fire induced loss of all equipment powered from safety related bus 1C including one motor driven AFW pump, one HPSI train, one PORV train, both containment spray trains, one train of CCW and one service water pump. This cabinet fire contributes 45.3% of CDF for this fire area.

The most significant contributors are sequences containing random failures of the two remaining AFW pumps combined with random failures of OTC (HPSI, sump valves or PORVs). Other significant contributors are sequences containing random failures of the AFW system combined with random failures of the instrument air (IA) system. The IA system provides air to open the sump valve to the available HPSI pump. This sump valve can be opened with IA or high'

• pressure air (HPA), but the HPA compressor for this sump valve is powered from bus 1C. No credit was taken for manual action to cross-tie the HP A systems for this cabinet fire, but the likelihood of HP A system cross-tie is high since this. action would not be required for several hours. Random failures of the AFW pumps combined with failure to initiate OTC contribute 9.4% of CDF for this cabinet fire.

_The most significant operator actions are failure _to: locally start an AFW pump; initiate OTC upon AFW system faih.rre; initiate HPSI pump* subcooling for recirculation upon .SIRW tank depletion; and makeup to the condensate storage tank for long term AFW suction.

Exposure Fire Exposure fires were evaluated in two ways: successfully suppressed and failure of suppression.

Exposure fires contribute 54. 7% to CDF for this fire area.

• Successfully suppressed exposures fires area assumed to cause cable damage to the AFW system where the steam driven AFW is available from the ASDP or locally only. All other systems (HPSI, PORVs, CCW, SWS, containment sprays and containment air coolers) are assumed to be unaffected by the fire (see Section 4.0.4). The two most significant sequences are: random failures of the steam driven AFW pump combined with operator failure to initiate OTC; and random failure of the steam driven AFW pump combined with operator failing to initiate HPSI pump subcooling for recirculation. Other significant operator actions are failure to: locally

• Revision 1, May 22, 1996 4-82

operate the AFW injection valves; and locally operate the steam supply valves to the AFW ptimp .

Unsuccessfully suppressed exposure fires may lead to fire induced failure of all equipment and cabling in the room, including both motor driven AFW pumps, automatic control of steam driven AFW pump (control still available from the ASDP or by local manual control only), both HPSI trains, one PORV train and both containment spray trains. Since both HPSI trains may be unavailable, OTC is unavailable and, therefore, only the steam driven AFW pump operated from the ASDP or by local manual control is available for plant shutdown. Suppression failed exposure fires lead directly to core damage upon failure of the steam driven pump train. The dominant operator action for suppression failed exposure fires is failure to :*control the steam supply valves for the steam driven AFW pump (either from the ASDP otJ9chlly) following evacuation from the control room (due to inability to control plant shutdown from fire induced damage to cables/circuitry). * .

• Revision 1, May 22, 1996 4-83

• Fire Areal Fire Area Description TABLE 4.11-1 PALISADES PLANT RESPONSE TO BPECIFIC FIRE AREAS Ignition Frequency Class IA Class 18 Class II Total CDF Zone 1* Control Room Cabinet Fire 9.SOE-3 S.93E-7 7.12E-7 NIA l.30E-6 Exp. Fire 2.43E-3 4.33E-6 2.46E-6 . *' -~IA 6.79E-6 2* Cable Spreading Room Cabinet Fire 3.20E-3 l.91E-7 2.06E-7 <*i.NIA 3.98E-7 Exp. Fire 3.19E-3 7.48E-6 3.23E-6 NIA l.07E-6 3* ID Switchgear Room Cabinet Fire 3.75E-3 6.95E-7 6.IOE-7 3.1 OE-7 l.61E-6 Exp. Fire 9.~IE-4 2.29E-06 9.83E-7 NIA 3.27E-6 4* IC Switchgear Room Cabinet Fire 3.75E-3 4.84E-7 6.53E-7 NIA I .l4E-6 Exp. Fire 4.1 SE-4 9.60E-7 4.09E-7 NIA. l.37E-6 s Diesel Generator 1-1 Room l.69E-02 4.85E-8 4.69E-8 NIA 9.54E-8 6 Diesel Generator I ~2 Room l.72E-02 5.61E-8 7.56E-8 NIA l.32E-7 7&8 Diesel Day Tanks NIA - Screened NIA NIA NIA NIA 9A Intake Structure - SWS 7.20E-03 4.66E-8 4.12E-7 NIA 4.59E-7 9B Intake Structure - FPS' 7.20E-03 NIA NIA NIA NIA JO East Engineered Safeguards 2.36E-3 7.58E-9 l.28E-8 NIA 2.04E-8 II Battery Room #2 l.60E-3 l.24E-7 l.SJE-7 NIA 2.77E-7 12 Battery Room # I l.60E-3 7.77E-8 8.47E-8 NIA t.62E-7 IJAI Auxiliary Building 590' l.99E-3 S.50E-9 6.61E-7 6.0SE-9 6.73E-7 Corridor (South Finger) 13A2 Auxiliary Building 590' 5.37E-3 l.09E-8 I.I 7E-8 NIA 2.26E-8 Corridor (Middle Finger)

IJB Charging Pump Room 2.06E-3 2.68E-9 2.68E-9 NIA S.36E-9 13C 590' Auxiliary Building l.ISE-2 2.94E-8 l.31E-7 NIA 1.60E-7 (all not included in other zones) 14 Containment NIA NIA NIA NIA. NIA

• Revision 1, May 22, 1996 4-84

TABLE 4.11-1 PALISADES PLANT RESPONSE TO SPECIFIC FIRE AREAS Fire Fire Area Ignition Class Class Class Total Areal Description Frequency IA IB II CDF Zone 15 Engineered Safeguards Panel l.50E-4 NIA 3.35E-8 NIA 3.35E-8 Room ..

16 Component Cooling Pump 2.36E-3 3.07E-9 6.13E-9 .NIA 9.20E-9 Room 17 Refueling and Spent Fuel Pool NIA - Screened NIA NIA NIA NIA Room 18 Demineralizer Room NIA - Screened

• NIA NIA NIA NIA 19 Compactor - Area Track Alley NIA - Screened NIA NIA NIA NIA 20 Spent Fuel Pool Equipment 6.02E-4 NIA 2.19E-8 NIA 2.19E-8 Room 21A Electric Equipment Room 3.SOE-3 NIA NIA NIA NIA (Bus 19)2 218 Electric Equipment Room 3.SOE-3 3.50E-8 2.33E-8 NIA 5.83E-8 (Bus 20) 22 Turbine Lube Oil Room NIA - Screened NIA NIA NIA NIA

- 23E Turbine Building 2.94E-2 l.27E-6 8.46E-7 3.21E-8 2.15E-6 (East Side) 23S Turbine Building 6.42E-2 7.77E-7 8.74E-8 NIA 8.65E-7 (South Side) 23W Turbine Building l.55E-3 3.99E-8 3.29E-8 NIA 7.28E-8 (West Side) 24 Auxiliary Feedwater Pump 2.27E-4 I .07E-7 8.50E-8 NIA l.92E-07 Room 25 Boiler Rooms NIA - Screened NIA NIA NIA NIA 26 Southwest Cable Penetration 6.89E-5 NIA NIA NIA NIA Room

• Revision 1, May 22, 1996 4-85

• Fire Area/

Fire Area Descnption TABLE 4.11-1 PALISADES PLANT RESPONSE TO SPECIFIC FIRE AREAS Ignition Frequency Class IA Class IB Class II Total CDF Zone 27 Radwaste Addition - VRS NIA - Screened NIA NIA NIA NIA 28 West Engineered Safeguards 2.74E-3 NIA I.I IE-6 *;NIA 1.1 IE-6 29 Center Mechanical Equipment NIA NIA NIA NIA NIA - Screened Room 30 East Mechanical Equipment NIA NIA NIA NIA NIA - Screened Room 31 West Mechanical Equipment NIA NIA NIA NIA NIA - Screened Room 32 SIRW Tank/CCW Roof Area 4.85E-5 NIA NIA NIA NIA 33 Technical Support Area NIA - Screened NIA NIA NIA NIA

• 34

. CDF Total Manholes # 1,2,3 3.97E-5 NIA l.97E-5 l.OIE-8 l.3 IE-5 NIA 3.48E-7 l.OIE-8 3.31E-5 NOTES:

• Manual or automatic suppression credited.

• 1 Fire Zone 9A is the worst case fire for this fire area and, therefore, Fire Zone 9B is not included in the results since they are mutually exclusive events.

2 Fire Zone 21 B is the worst case fire for this fire area and, therefore, Fire Zone 21 A is not included in the results since they are mutually exclusive events .

• Revision 1, May 22, 1996 4-86

Table of Contents Section 4.12 .

Human Reliability Analysis for Fires 4.12.1 Objectives of the.Human Reliability Analysis 4-88 4.12.2 Identification of Operator Actions for Fires 4-88 4.12.3 Fire Human Error Probabilities . *'* -

.*.. 4-88

--~~~>-~;

4.12.4 Recovery or Repair of Failed Components 4-89 Revision I, May 22, 1996 4-87

4.12 HUMAN RELIABILITY ANALYSIS FOR FIRES The Palisades IPE included a human reliability analysis (HRA) to properly model the operator actions that affect the course of an accident. The operator actions included in the IPE were reviewed for their applicability in the fire analysis. There were four categories of operator actions considered in the IPE: testing; m~tenance; instrument calibration; and response to an accident or control room annunciator. All of the operator actions credited in the IPE were

• deemed appropriate for the fire analysis. Additional operator actions were credited in the fire analysis, but only in the category of response to an accident or control room annunciator. The fire HRA used a similar methodology as was used for the IPE HRA (Ref. . 4-16)..

- ~-* !***

4.12.1 Objectives of the Human Reliability Analysis There are two major purposes of the HRA:

develop an understanding of the role of the human element in the safe operation of the plant; and

• structure. this information in such a manner that it may be integrated into the risk models.

The HRA provides both a qualitative and quantitative evaluation of operator actions on the safe operation of the plant. Qualitatively, the HRA identifies the operator actions that have the potential to affect components or systems important to the safe shutdown of the plant.

Quantitatively, .the HRA identifies the likelihood of occurrence of an operator action and its impact on system performance and plant response.

4.12.2 Identification of Operator Actions for Fires All of the operator actions credited in the IPE ~for transient initiated sequences were also credited in the fire analysis. Each fire area/zone was quantified to determine a baseline core damage frequency (CDF). For those fire areas/zones that were not screened out, a detailed evaluation was performed to determine if operator actions could be included that help mitigate the consequences of a fire. The evaluation included a review of several sources to identify the potential operations to credit. These sources include: plant emergency operating procedures; off-normal procedures .

and Appendix R compliance strategies. All of the operator actions credited in the fire analysis that were not credited in the IPE are shown in Table 4.12-1. Risk significant operator actions are shown in Table 4.12-2.

4.12.3 Fire Human Error Probabilities Several of the human actions credited in the fire analysis were not credited in the IPE. The IPE minimized the reliance on operator actions by crediting only those operator actions that were important for mitigating the consequences of an accident. Operator actions that were not credited

• Revision 1, May 22, 1996 4-88

in the IPE were assumed not to occur (assumed to fail). Some operator actions that were not credited (assumed to fail) in the IPE already had evaluations performed to identify the human error probability (HEP). Some operator actions credited in the fire analysis, but not in the IPE, used these previously calculated HEPs. If the operator actfon did not have a HEP previously calculated, a screening value HEP of l.OE-1 was used. The HEPs for the operator actions used in the fire analysis that were not in the IPE are shown in Table 4.12-1.

Some operator actions are dependent on other operator actions occurring first. Whenever this occurs, the fire analysis identifies one operator action that represents all dependent operator actions. This methodology accounts for operator actions with completet:dependency and conservatively models operator actions that have partial dependency. ':.>:

4.12.4 Recovery or Repair of Failed Components To complete the HRA, an assessment of recovery or repair of failed components should be performed. . Not including repair or recovery of failed components is conservative since availability of more components would lower the CDF. The IPE d~finition of repair or recovery of failed components was used for the fire analysis: an operator action that is not covered by procedures or extensively covered by training. Only one repair or recovery action was credited in the IPE (recovery of off-site power). That repair/recovery event did not apply to the frre analysis. However, one additional repair or recovery action was identified for the fire analysis:

repair or recovery of randomly failed AFW components within two hours of the fire initiating event.

Repair or recovery of randomly failed AFW components was credited only for two fire areas:

west safeguards room *and auxiliary building corridor. In both of these fire areas, one motor

• driven AFW pump (P-8C) is unavailable due to fire induced damage. The accident scenario progresses when both the steam driven AFW and other motor driven AFW pump (both located in the same room .and utilizing some of the same instrumentation and suction and -discharge piping) fail randomly, but OTC is initiated. Due to fire damage, the containment sump valves

• do not open to initiate recirculation when the SIRW tank is depleted. In these scenarios; recirculation is not expected for several hours (>2 hours). To mitigate the consequences of the accident, credit is taken to repair or recover randomly failed components so that at least one AFW pump becomes available.

• NSAC 161 (Ref. 4-~4) discusses repair and recovery of AFW system failures at PWRs. There were two types of repair or recovery actions for failed AFW systems: minor operator actions to correct a problem (hand switch mispositioned, blown fuse, valve left closed, etc.); and maintenance activity. The maintenance activities included two categories: major (large component repair/replacement like valves, motor repair, etc.) and minor maintenance (calibration, cleaning, repair/replacement of small components like flow or limit switches, etc.). For the AFW system repair/recovery, less than 44% was maintenance related (both major and minor) and more than 56% was operator action related. The NSAC information indicated that the cumulative repair/recovery from all types of failures of the AFW system 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the failure is 90% .

• Revision l, May 22, 1996 4-89

Therefore, Palisades used a repair/recovery factor of 90% for AFW system failure from AFW components (not support systems) during recirculation. This means that if the AFW system failed and OTC was successfully initiated for injection from the SIRW tank, then there was a I .OE-I probability that the AFW system would still be unavailable by the time the ~IRW tank was depleted.

• Revision I, May 22, I 996 4-90

- TABLE 4.12-1 OPERATOR ACTIONS IN THE FIRE ANALYSIS AND NOT IN THE IPE Human Error Event Description Class* Fire Areas HEP AFWRECOVER Repair/recovery of randomly Post 13Al, 28 l.OOE-1 failed AFW components (2 hrs)

IXVOMN2106 1 N2 supply valve left closed Pre All 2.00E-3 after maint.

IXVOMN2115 1 N2 supply valve left closed Pre

• All 2.00E-3 after maint.

IXVOMN2127 1 N2 supply valve left closed Pre All 2.00E-3 after maint.

. IXVOMN2135 1 N2 supply valve left closed Pre All 2.00E-3 after maint.

KAVOA3070 Locally bypass solenoid valve Post 13Al, 15, l.OOE-1 16, 23 KAVOAHOGGR Utilize the hogging air ejector Post 1, .13Al, 3.40E-2 for steam removal 15, 16 KXVOBAFW2 Locally open AFW valves CV- *Post 1, 2, 3; 4, l.OOE 0727/0749 13Al, 15, 23 Added to fire analysis as part of added logic to credit nitrogen backup systems that were not included in the IPE. Operator action is not a fire specific operator action.

• Revision I, May 22, 1996 4-91

TABLE 4.12-2 RISK SIGNIFICANT OPERATOR ACTIONS FOR THE FIRE ANALYSIS

. Human Error Event Description RAW Fire Areas - HEP AISOTABC Miscalibration of all flow 202.0 All l.60E-5 instruments on all AFW headers

~; :~ _,.:

APSOHP8AC Miscalibration of all low 154.0 All l.30E-4 suction pressure switches for ~

all AFW trains AISOHAB Miscalibration of all flow 55.9 All 1. lOE-4 instruments on AFW headers A&B SHVF-BOT Failure to initiate feed and 24.0 All l.OOE-2 bleed (OTC)

RPORVOA Failure to open PORV 23.7 All l.OOE-2 AOPMANST Failure to start AFW pump in 11.3 All l.OOE-2 control room or locally KXVOBAFW2 Failure to locally operate 6.2 1, 2, 3, 4, l.OOE-1

-~

- *AFw injection valves CV- - BAI, 15, 0727/0749 23 AOPADJFL - Failure to adjust AFW flow to 3.8 All l.70E-3 one steam generator following failure of the other SIG AOPERLOCOT Failure to align alternate 3.6 All 1.00E-3 suction source to AFW system upon depletion of CST PCBOTFXFR Failure to manually transfer 2.8 23E,23S 1.00E-2 safety related buses to startup transformer

• Revision 1, May 22, 1996 4-92

Table of Contents Section 4.13 Containment Performance 4.13.1 Containment Structures 4-94 4.13.1.1 Containment Integrity . 4-94 4.13.1.2 Containment Systems 4-95 4.13.2 Analysis of Containment Performance Following a Severe Acci~~~t: 4-95 4.13.2.1 Plant Damage States Dominant in the Fire Analysis 4-96 4.13.2.1.1 Initiator Types 4-96 4.13.2.1.2 Core Damage Timing 4-96 4.13.2.1.3 Secondary Heat Removal Status 4-97 4.13~2.1.4 Containment Systems Status 4-97 1

4.13.2.1~5 Selection of Plant Damage States 4-97 4.13.2.2 Containment Event Tree Evaluation 4-98 4.13.2.2.1 Plant Damage State TEJP 4-100 4.13.2.2.2 Plant Damage State TEJW 4-101 l

4.13.3 Comparison of Containment Response to IPE 4-102

• Revision 1, May 22; 1996 4-93

4.13 CONTAINMENT PERFORMANCE As stated in NUREG-1407, the purpose of the IPEEE containment performance evaluation is to identify vulnerabilities that involve early failure of containment functions that differ significantly from those identified in the IPE. For the fire IPEEE, the evaluation should consider fire related vulnerabilities found in the systems/functions which could lead to early containment failure or which may result in high consequences. This includes: isolation, bypass, integrity, and systems required to prevent early failure.

The scope of this analysis is based upon a review of the Level 2 analysis that was performed for the IPE as well as the specific results of the Level I fire analysis presented in Section

.*.** 4.11 of this report.

4.13.1 Containment Structures and Systems Two facets of containment performance were evaluated *with regard to fire induced damage.

First, the impact of fires on containment integrity in the form of structural performance* and containment isolation/bypass was investigated. Second, containment syst~m performance following a: fire was also evaluated.

• 4.13.1.1 Containment Integrity The containment at Palisades is a large dry pre-stressed concrete design with the entire interior surface of the structure lined with 1/4-inch-thick welded steel plate to ensure leak tightness.

Because the containment contains minimal combustible material during power operation, a significant fire within the containment is not expected to occur. Additionally, rione of the spaces surrounding the containment contain heavy loadings of combustible material. A large fire in these compartments is not likely given their combustible loading. The FIVE methodology also indicates that fire spread between these compartments is not credible. Therefore, because any fire in the spaces adjoining the containment Wilf be contained Within a single area and Will be of limited duration/intensity, structural damage to the containment is not expected.

During the walkdown, several specific containment penetrations were inspected/investigated for potential susceptibility to fire damage. These penetrations consisted of the equipment hatch, personnel airlock and north/southwest cable penetration areas: The personnel airlock is located in a small completely enclosed area on the 607' level of the auxiliary building. Because of the minimal combustible~ located in the vicinity of the airlock, the airlock is not expected to be threatened by any postulated fire. The equipment hatch is also located in the auxiliary building, on the 649' level. There are minimal combustibles located in the vicinity of the hatch. In addition, during power operation the e*quipment hatch is protected by large concrete blocks utilized for shielding. Combining theses two factors results in the conclusion that fire damage to the equipment hatch is not credible. The southwest penetration area is located on the 607' level of the turbine building and the north penetration area is located on the 625' elevation of the auxiliary building. Both of these areas are protected by sprinklers in the vicinity of the actual Revision 1, ~ay 22, 1996 4-94

penetrations.

The potential for containment isolation/bypass due to valve failure was also investigated.

Containment isolation valves are provided on all lines penetrating the containment and serve to isolate the containment building atmosphere when required. The isolation valves are of two basic types: those that automatically close and those that are locked closed during normal operation .

. Instrumentation and control circuits in the containment isolation system are fail-safe; i.e., the valves, with the exception ~f the component cooling water return isolation valves, will fail closed upon the loss of voltage or control air. As component cooling water is a closed sy~tem inside containment, the return valves play little role in providing containment isolatio11.

• .1*

Fires can affect containment isolation valves in one of two ways: failure of power cables or motive power (air/nitrogen) to AOVs/SOVs will cause the valve to fail closed; and hot shorts in control cables to AOVs/SOVs could possibly cause inadvertent valve opening. The second of these outcomes, however; is considered probabilistically insignificant. All of the valves that connect the containment atmosphere to the auxiliary building are air-operated valves that fail closed on a loss of air or power. Although extremely unlikely, if a hot short in one of these valve circuits were to occur that did not fail the protective fuse, manual recovery by isolating the

. air supply to the valve would cause the valve to fail closed.

For the reasons discussed above, fire induced degradation of containment isolation is expected to be negligible. There were no unique containment failure modes identified during the fire IPEEE analysis that differ from those identified in the IPE .

4.13.1.2 Containment Systems The containment safeguards states were used to evaluate the containment performance. The definitions for the containment safeguards states that were used for the fire analysis are defined fn Table 4.13-1. The important systems that define the contaillinent safeguards states are the availability "of the containinent spray system, the availability of the containment air coolers and the location of the SIRW tank contents. This information is available from the accident class cutsets for the fire analysis.

4.13.2 Analysis of Containment Performance Fol.owing a Severe Accident In the IPE, an evaluation of the containment response to any given severe accident used a two phase approach involving: .

a Plant Damage State event tree (evaluation of the status of containment systems);

a containment*event tree (evaluation of phenomenological response to each Plant Damage State).

In this section, an evaluation is made of the Plant Damage States which would be expected to Revision 1, May 22, 1996 4-95

• dominate the fire results. It is followed by a quantitative estimate of accident sequence

• frequencies .from the containment event tree to determine the distribution of containment challenges ..

4.13.2.1 Plant Damage States Dominant in the Fire Analysis In the first phase of the containment analysis for the IPE, distribution of the Level I core damage sequences were divided among eighteen Plant Damage States. Only six Plant Damage States were identified for use in the fire analysis. Table 4.13-2 defines each of these six Plant Damage States. The plant damage states were developed around four distinct parameters ~hich establish the characteristics of the accident sequence and plant systems important to:*qilantification of phenomenological challenges evaluated in the CET: .*. .,

accident sequence initiator type (e.g., Transient, LOCA, SGTR, ATWS, etc.);

timing of core damage with respect to initiation of off-site protective actions (early or late);

status of secondary cooling; status of systems important to containment functions (e.g., containment spray, coolers, location of SIRWT inventory).

4.13.2.1.1 Initiator Types As noted in Section 4.11, there are three accident classes that comprise the results of the fire IPEEE: Class IA (loss of secondary heat removal with failure of once through cooling in the injection mode); Class IB (loss of secondary heat removal with failure of once through cooling in the recirculation mode); and Class II (loss of containment heat removal). All three of these accident classes represent transient initiators in which both . the reactor coolant system and

• containment are intact up to the time at which core darriage is assumed to occur. Other irnt~ators

• such as LOCA, ATWS or SGTR are not caused by a fire event aricl do not contribute to the fire results.

• 4.13.2.1.2 Core Damage Timing In Section 4.11, it was noted that the principle failures leading to core damage following a fire (Accident Classes IA and IB) include failures to equipment associated with the AFW system and require additional failures to other plant systems to occur.

In Accident Class IA, initiation of once through cooling is assumed to be unsuccessful resulting in the slow depletion of reactor inventory through pressurizer PORVs or safety relief valves.

Assuming AFW is lost at the time of the initiating event, steam generator dryout is estimated to occur between 1-1/4 and 1-1/2 hours later. Approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> into the event, primary system depletion would be sufficient for fuel damage to be initiated. Another hour would be required before fuel melting and slump to the bottom of the vessel would occur. .

Revision 1, May 22, 1996 4-96

In Accident Class IB, once through cooling is initiated successfully and core cooling is adequate as the contents of the SIRW tank are injected to the vessel. Core cooling can be maintained in the once through cooling mode for several hours in. this manner. At the time of SIRW tank depletion, a switch to recirculation requires injecting sub-cooled containment spray water into the suction of a HPSI pump. In this accident class, recirculatiori is assumed to be unsuccessful.

Depletion of reactor inventory is assumed to occur such that core damage would be expected approximately 5 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> into the event. Another one to two hours would be required for fuel melt progression to the lower portions of the vessel.

• Accident Class II is characterized by long term pressurization of containment*due to limited or no decay heat removal from containment. In fact, heat removal is partially-$,Uccessful in that once through cooling through . the shutdown cooling heat exchangers is being performed successfully. Pressurization of containment to its ultimate capacity is not expected for days under these conditions.

For all of these accident classes, core damage and core melt progression to lower head penetration would not be expected before 4 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event (much longer for Accident Class II). It was assumed in the IPE that implementation of protective actions in accordance with the Emergency Plan would not occur until core damage was anticipated. As such, all of the accident classes are considered to be early core damage scenarios. this classification will be retained in *the fire analysis to be consistent with the definitions iri the IPE even though core damage would not be expected for a substantial period of time.

4.13.2.1.3 Secondary Heat Removal Status Accident sequences classified in Accident Classes IA, IB and II are defined as having no

• secondary heat removal.

4.13.2.1.4 .Containment Systems Status _

Table 4.13-2 defines the Plant Damage States in terms of availability of containment saf~guards system. Table 4.13-3 presents the core damage frequency (CDF) for each Plant Damage State by fire area.

4.13.2.1.5 Selection of Plant Damage States From the preceding discussion, the characteristics of the accident classes which dominate the fire*

analysis are as follows:

transient initiated (non-LOCA, etc.);

"early" core damage (even though not expected for 4 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the fire initiator); and no secondary cooling.

Revision 1, May 22, 1996 4-97

The only questions left to ask to determine the Plant Damage State are: success of containment spray system; success of containment air coolers; and location of SIRW tank contents. The Plant Damage States that define the fire analysis results arid their definitions are contained as Table 4.13-2. The contribution of each fire area to the Plant Damage States is presented in Table 4.13~

3." These results are *also shown in Figure 4.13-1. *

• Approximately 97% of the CDF are contributed by two Plant Damage States: TEJP and TEJW.

The Plant Damage State TEJP represents sequences where the containment spray system and containment air coolers are available and the SIRW tank water is in containment at the onset of core damage (75.4% of CDF) .. Plant Damage State TEJW represents sequences where the containment spray system and containment air coolers are not available and the..SIRW tank water is not in containment at the onset of core damage (21.6%).

4.13.2.2 Containment Event Tree Evaluation Figure 4.13-2 is the containment event tree developed for the IPE. Heading definitions for the Palisades CET are as follows.

BYE Early Containment Bypass. This CET heading principally identifies the potential for interfacing system LOCA. This containment failure mode is not likely to result from a fire and, therefore, is not applicable to the fire analysis.

• I .

CIS Containment Isolation. This mode of containment failure was evaluated as a part of the fire walkdowns discussed in Section 4.13.1.

BYL Late Containment Bypass. This mode of containment bypass is considered as a part of core melt progression. In the Palisades IPE it was driven by creep rupture of the steam generator tubes. This containment failure mode did not dominate the containment results for the JPE and is not likely to be applicable to a fire.

RIV

• Recovery in Vessel. The principal means of terminating core melt progression prior to vessel penetration credited in the IPE is to Submerge the lower vessel head. To accomplish this at Palisades, containment sprays are assumed to be required to recirculate water through the shutdown cooling heat exchangers and maintain water level up around the reactor vessel by means of the reactor cavity flooding system piping.

UDD Upward Debris Dispersal at reactor vessel failure .. This CET heading defines the potential for core debris exiting the lower vessel head and being entrained by steam and gases from the vessel blowdown to areas in the upper part of containment. For this relocating of debris out of the reactor cavity to occur, the reactor must be at high pressure and a significant portion of debris must be entrained.

• Revision 1, May 22, 1996 4-98

CAE Early Relocation of the Core to the Auxiliarv Building. The containment sump for

• Palisades is located beneath the reactor cavity as shown in Figure 4.13-3. If debris were to exit the lower head and remain in the reactor cavity in an uncooled state, flow through the reactor cavity floor drains and erosion of the floor of the reactor cavity could lead to relocation of the debris to the sump. From there, the debris is assumed to flow through the suctiori piping of ESF pumps into the engineered safeguards rooms in the auxiliary building.

CIE Containment Intact Early. This CET heading identifies potential challenges to containment from phenomena that might occur at or near the time of vessel failure.

These phenomena include hydrogen burning, steam explosion, vessel }?,lowdown forces, and direct containment heating.  ;. ,

LVE Early Large Volatile Fission Product Release. Sequences in which sprays are available or releases are through pools of water result in limited volatile releases.

CAL Late Relocation of the Core to the Auxiliary Building. This CET heading 'is similar to CAE except that relocation to the auxiliary building is substantialiy delayed due to significant debris being retained in the reactor cavity and only a limited amount flowing through drains to the sump until long term erosion of the cavity floor occurs.

CIL Containment Intact Late. This heading defines potential challenges to containment that might occur substantially later than core damage or vessel penetration. Such challenges would include long term over-pressurization by steam, noncondensible gas generation and combustion of hydrogen evolved from core concrete interaction.

CCI Core Concrete Interaction resulting in a large 'fission product release. This type of

. release requires oxidation of zirconium .to. be in progress at the* time of c9ntainment failµre.

LVL Late Large Volatile Release. This type of release requires revaporization of fission products at the time* of containment failure or long term dryout of pools performing debris cooling.

The Palisades containment event tree was quantified as a part of the IPE for each Plant Damage

• State. As containment systems are not a part of the CET, but are qtiantified in the Plant Damage State analysis, the CET quantification is based strictly on phenomenological challenges important for each plant damage state and is independent of what initiates the accident sequence. The CET quantification performed in the IPE is, therefore, applicable to the fire analysis.

As discussed in Section 4.13 .2.1, six Plant Damage States are possible depending on the equipment located in each fire area. For any of these Plant Damage States, early challenges to containment are no different than expected in the IPE. The two dominant Plant Damage States for the fire analysis are TEJP and TEJW.

Revision 1, May 22, 1996 4-99

. 4.13.2.2.1 Plant Dam~ge State TEJP

• This Plant Damage State is characterized by failed secondary cooling with both the containment spray *system and containment air coolers* available throughout the event and the SIRW tank contents inside containment. This Plant Damage State has one dominant CET sequence:

1. 13 (54.2%) Successful recovery in-vessel with successful containment isolation and containment integrity (long and short term) and no containment bypass.

Other significant CET sequences for this Plant Damage State are:

1. 19 (16.2%) No recovery in-vessel (core outside of vessel) with succe~sful containment isolation and containment integrity (long and short term) and no containment bypass.

1. 31 (19.7%) No recovery in-vessel (core outside vessel) and early relocation of core debris to the auxiliary building with a large volatile fission product release late (not early) with successful containment isolation and no containment bypass .

1. 35 (6.4%) No recovery in-vessel (core outside vessel) with no containment bypass, successful containment isolation, no relocation of the core to the auxiliary building (early or late), and successful containment integrity (long and short term).

. I .

For Plant Damage State TEJP, recovery in vessel is successful an estimated 54% of the time (CET sequence #13). In the remaining three sequences, #19, #31 and #35, the core debris is assumed to penetrate the lower vessel head and enter containment These sequences determine the distribution between long term containment integrity and the potential for relocation of the core debris to the. auxiliary building. The differences between the first two sequences is that in the first one~ significant carry over of debris to the upper part of containment occurs such that the remaining debris remains cooled in the reactor cavity or sump as opposed to flowing to the auxiliary building. The third sequence does not have significant

. carry over of debris to the upper part of containment, but the core debris is cooled in the reactor cavity or sump prior to flowing to the auxiliary building. The major factor in determining if significant debris is carried over to the upper part of containment is whether the reactor is at pressure or has blown down as a result of creep rupture failure in the primary coolant loops as well as in how much debris will actually be entrained and removed from the cavity if blowdown from high pressure occurs.

CET sequence # 19 ultimately results in a long term intact containment with heat being removed by the shutdown cooling heat exchanger or containment air coolers.

CET sequence #31 leads to release of the core to the auxiliary building early with only low volatile releases expected early as a result of reactor coolant and SIRW tank inventory Revision 1, May 22, 1996 4-100

submerging the debris providing a means of debris cooling and fission product scrubbing.

However, revaporization of retained fission products (either in the PCS or pools) leads to large volatile releases late in the scenario .

. CET sequence #35 results in the core debris relocates to the reactor cavity or containment surrip, but is cooled and does not relocate to the auxiliary building. There is no fission product release outside of containment because there is no containment bypass, containment isolation is successful and the containment is intact throughout this scenario.

4.13.2.2.2 Plant Damage State TEJW This Plant Damage State is characterized by failed secondary cooling with no eontainment spray system or containment air coolers available and the SIRW tank contents not inside containment.

This Plant Damage State has one dominant CET sequence:

• # 22 (44 .4%) No recovery in-vessel (core outside of vessel) with significant upward debris dispersal and long term failure of the containmeht due to lack of debris cooling in the upper containment and a iarge volatile fission product release late in the scenario. Also, there is successful containment isolation with no containment bypass.

Other significant CET sequences for this Plant Damage State are:

1. 30 (23. 7%) No recovery in-vessel (core outside of vessel) with no significant upward debris dispersal and core relocation to the auxiliary building early accompanied by a large volatile fission product release early. Also, there is successful containment isolation and containment integrity (long and short temi) and no containment bypass.

1. 31 (29.0%) This sequence is similar to #30 except that the large volatile fission product release is late rather than early.

In CET sequence #22, core debris is transported to upper parts of containment during blowdown of the vessel. Lack of containment ,sprays or air coolers is assumed to result in slow pressur.ization of containment. Containment integrity is maintained for a significant period under these conditions. Co11tainment failure is not postulated for more. than 40 hotirs into this accident scenario.

In CET sequences #30 and #31, the core debris relocates into the sump and ultimately the auxiliary building early in the scenario. The difference between these two sequences is when the volatile fission product release occurs. In CET sequence #30, the release is assumed to occur early and in CET sequence #31, the release is assumed to occur late with the revaporization of fission products.

Revision 1, May 22, 1996 4-101

4.13.3 Comparison of Containment Response to the IPE Table 4.13-4 shows the contribution of the dominant CET end states by Plant Damage State.

This table also shows the contribution of the CET end states from the IPE transient sequences

• only.

The CET end state #13 is increased significantly and CET end state #19 is increased slightly.

These increases are a result of the CDF contribution from successfully suppressed exposure fires in the control room, cable spreading room and both switchgear rooms. ,The suppressed fires iri these rooms have a high percentage of CDF in PDS TEJP. A high percentage of PDS TEJP results in CET end states #13 (54.2%) and #19 (16.2%). The high CDF co~µ.ibution to PDS TEJP is due to the conservative assumption that the entire AFW system (except for ASDP or local control of the steam driven pump) is lost due to the fire upon successful suppression in the room. It is highly unlikely that both trains of motor driven AFW pumps would be lost due to a small, contained fire in these rooms.

CET end states #22 and #30 are decreased significantly. The majority of the CDF contribution from CET #22 and #30 is from PDS TEJW whereas a very small part of PDS TEJP contributes to these PDSs. Since a small part of PDS TEJP leads to these CET end states and PDS TEJP is. the highest contribution from CDF (75.4%), it follows that a small contribution from CDF leads to these end states.

Revision 1, May 22, 1996 ' 4-102

TABLE 4.13-1 CONTAINMENT SAFEGUARDS STATES Designator Description p Containment spray system and containment air coolers available and SIRW tank contents inside containment Q .

Containment spray system available, containment air coo~~rs . .

not available and SIRW tank contents inside containment R Containment spray system not available, containment air coolers available and SIRW tank contents inside containment s Containment spray system not available, containment air coolers available and SIRW tank contents not inside containment v Containment spray system and containment air coolers not available and SIRW tank contents inside containment w

Containment spray system and containment air coolers not available and SIRW tank contents not inside containment

• Revision 1, May 22, 1996 4-103

TABLE 4.13-2 PLANT DAMAGE STATES FOR*THE FIRE ANALYSIS Plant Damage State Description TEJP Transient initiator, early core damage, no secondary cooling, containment spray system and containment air coolers available, SIRW tank contents in containment TEJQ Transient initiator, early core damage, no secondafy.cooling, containment spray system available, containment air coolers not available, SIRW tank contents in containment TEJR Transient initiator, early core damage, no secondary cooling, containment spray system not available, containment air coolers available, SIRW tank contents in containment TEJS Transient initiator, early core damage, no secondary cooling, containment spray system not available, containment air coolers available, SIRW tank contents not in containment

• TEN*

TEJW Transient initiator, early core damage, no secondary cooling, containment spray system and containment air coolers not available, SIRW tank contents in containment Transient initiator, early core damage, no secondary cooling,

• containment spray system and containment air coolers not available, SIRW tank contents not in containment Revision 1, May 22, 1996 4-104

TABLE 4.13-3 PLANT DAMAGE STATE CONTRIBUTIONS BY FIRE AREA Fire Area TEJP TEJQ TEJR TEJS TEN TEJW 1 (Cab) 1.30E-6 NIA NIA l.lOE-9 3.76E-9 NIA 1 (Exp) 5.35E-6 NIA 6.76E-8 2.42E-8 4.52E-9 1.35E-6 2 (Cab) 3.85E-7 l.20E-8 NIA NIA l.27E~9- NIA 2 (Exp) 7.03E-6 NIA 8.88E-8 3.18E-8 5.94E-9 3.57E-6 3 (Cab)* l.21E-6 3.62E-9 NIA NIA 3.23E-7 7.70E-8 3 (Exp) 2.lSE-6 NIA 2.47E-8 . 9.77E-9 l.02E-9 l.09E-6 4 (Cab) l.13E-6 5.'52E-9 NIA NIA 1.48E-9 NIA 4 (Exp) 8.98E-7 NIA l.04E-8 3.64E-9 . NIA 4.59E-7 5 8.69E"-8 l.75E-9 NIA NIA 6.71E-9 NIA 6 l.25E-7 NIA NIA NIA 6.81E-9 NIA 9A 4.59E~7 NIA NIA NIA 2.85E-9 NIA 10 2.04E-8 NIA NIA NIA NIA NIA 11 2.77E-7 NIA NIA NIA NIA NIA 12 l .56E-7 6.02E-9 NIA NIA NIA NIA 13Al 6.67E-7 NIA NIA NIA NIA 6.0SE-9 13A2 2.0SE-8 NIA NIA NIA 2.13E-9 NIA 13B 5.36E-9 NIA NIA NIA NIA NIA 13C l.57E-7 NIA NIA NIA 2.76E-9 NIA

• Revision 1, May 22, 1996 . 4-105

TABLE 4.13-3 PLANT DAMAGE STATE CONTRIBUTIONS BY FIRE AREA Fire Area TEJP TEJQ TEJR TEJS TEN TEJW 15 3.35E-8 NIA NIA NIA NIA NIA 16 9.20E-9 NIA NIA NIA NIA ... NIA 20 2.19E-8 NIA NIA NIA NIA**..;,- NIA 21B 5.68E-8 NIA NIA NIA l.51E-9 NIA 23E l.59E-6 l.88E-7 1.20E-8 3.43E-9 l.26E-7 2.27E-7 23S 4.62E-7 l.26E-9 l.OlE-9 NIA 5.36E-9 3.95E-7 23W 7.28E-8 NIA NIA NIA NIA, NIA 24 l.90E-7 NIA l.55E-9 NIA NIA NIA 28 l.llE-6 NIA NIA NIA NIA NIA 34 l.OlE-8 NIA NIA NIA NIA NIA Total 2.50E;.5

• 2.18E-7' 2.06E;,7 7.40E - 4.95E-7* - 7.17E-6

• Revision 1, May 22, 1996 4-106

• CET # TEJP TEJW TABLE 4.13~4 DOMINANT CET END STATES BY PDS Other Total . % of Fire  % of IPE PDS CDF Transient CDF 13 l.36E-5 NIA l.18E~7 l.37E-5 4L4 ;.:;:

• 18.9 19 4.05E~6 NIA l.44E-7 4.19E-6 12.8 9.1 22 4.13E-:8 3.18E-6 l.71E-8 3.24E-6 9.9 25.4 30 NIA l.70E-6 l.76E-7 L88E-6 5.8 15.1 31 4.93E-:-6 2.08E-6 2.59E-7 7.27E-6 22.0 25.4 35 l.61E-6 NIA 2.76E-8 l.64E-6 5.0 2.8 Other 7.69E-7 2.08E-7 2.70E-8 l.OOE-6 3.0 3.4 Total 2.50E-5 7.17E-6 2.52E-7 3.3 lE-5 100.0 100.0 Revision 1, May 22, 1996 4-107

FIGURE 4.13-1 CDF By Plant Damage State TEJW (21.6%)

. TEJP (75.4%) .

Revision 1, May 22, 1996 4-108

FIGURE 4.13-2 Containment Event Tree PI..Am' DAMAGB STATB CIB LVB CAL CIL CCI LVL SBQ PROB 1

2 4

5 7

8*

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 36 39 40 41 4"2" 43 44 45 46 47 46 49 so 51 52 53 54 55 56 57 SB 59 60 61 62 63 Revision 1, May 22, 1996 - 4-109

FIGURE 4.13-3 Containment Sump Drawing

- '*~~ ~*:

REFUELING POOL ACCESS TUBE AUXILIARY BUILDING ESF RECIRCULATION SUCTION PIPE

• Revision 1, May 22, 1996 4-110

Table of Contents Section 4.14

_Fire Risk Scoping Study Issues 4.14.1 - Seismic/Fire Interactions- 4-112 4.14.1.1 Seismically Induced- Fires 4-112 4.14.1.2 Seismic Actuation of Fire Suppression Systems 4-113 4.14.1.3 Seismic Degradation of Fire Protection Systems .. ,- . ~ . :* . . 4-113 4.14.2 Fire Barrier Effectiveness 4-113 4.14.3 Effectiveness of Manual Fire Brigade 4-114 4.14.4 Total Environment Equipment Survival 4-114 4.14.5 Control Systems Interactions 4-115 Revision 1, May 22, _1996 4-111

4.14 FIRE RISK SCOPING STUDY ISSUES NRC Generic Letter 88-20, Supplement 4, lists the following Fire Risk Scoping Study (FRSS) issues to be addressed in IPEEE fire analyses: *

(1) Seismic/fire interactions, (2) Fire barrier assessment, (3) Effectiveness of manual fire fighting, (4) Effects of fire suppressants on safety equipment. (Total environment equipment survival), and (5) Control systems interactions.

The specific concerns regarding each of these issues are discussed in the FIVE methodology.

This methodology was used as guidance for evaluating each of the issues. Where appropriate, relevant Fire Risk Scoping Study issues have been incorporated into other phases of this study, such as the area screening and the detailed fire scenario evalwttion.

Review of the Fire Risk Scoping Study issues resulted in the con~lusion that these issues are not significant contributors to fire induced core damage at the Palisades Nuclear Power Plant. The evaluation of each Fire Risk Scoping Study issue is discussed below.

4.14.1 Seismic/Fire Interactfons This issue involves three concerns: seismically induced fires, seismic actuation of fire protection systems and seismic degradation of fire suppression systems. -

4.14.1.1 Seismically Induced Fires In general, earthquakes are not kno\.vn to cause fires in industriai facilities (Ref. 4"12). However, the potential failure of vessels containing flanuriable liquids or gases could cause a fire hazard in the plant following an earthquake. As a part of the seismic walkdowns, a survey of tanks and vessels that may contain flammable fluids was performed. -

Only the turbine building was identified as having potentially significant consequences due to

• fires resulting from a seismic event. The hydrogen piping that is routed through the turbine building is not seismically designed. It P.!iSses through non-seismically designed block walls and cable trays which pose a rupture hazard to the piping at relatively low seismicity levels. The turbine building also contains flammable liquid storage cabinets in numerous locations that are unanchored and at risk of spilling their inventory if they were to fall over. Because of the multiple ignition sources in the turbine building, the likelihood of ignition is high given spillage of these materials. Hydrogen piping is also found in the auxiliary building, but, due to seismic*

restraints, is not expected to be susceptible to a seismic event. The seismic evaluation (Section 3.0) considered the effects of the seismic/fire interactions identified for the turbine building.

Revision 1, May 22, 1996 . 4-112

4.14.1.2 Seismic Actuation of Fire Suppression Systems Information Notice 94-12 notes that (1) mercury relays are susceptible to seismic actuation, (2) smoke detectors could be actuated by dust rising during a seismic event, and (3) unprotected

• essential components could be damaged by spray from dehlge systems. Fire suppression equipment actuated by smoke detectors are not used for any fire protection systems at the Palisades Nuclear Power Plant. Mercury relays are used for the deluge system for the station transformers. The potential for inadvertent actuation of these systems following a seismic event is addressed in the seismic evaluation (S.ection 3.0).

Of the plant areas containing safety related equipment considered in the PaliSCl;Cles IPEEE, only the diesel generator rooms, pump room in the intake structure, cable spreading :room, 1C & lD switchgear rooms and charging pump* rooms are protected by fire water systems. These areas are protected by fusible link wet-pipe systems. Fusible links are not prone to seismically induced failures. Additionally, safe shutdown related cabinets in the switchgear and cable spreading rooms are protected with spray shields. Finally, no specific seismically related deficiencies were noted in the walkdown of these systems. Therefore, loss of availability of essential equipment in these areas due to inadvertent fire water system actuation by a seismic event is considered unlikely. *

• 4.14.L3 Seismic Degradation of Fire Protection Systems Fire suppression systems could be disabled during a seismic event if seismic considerations were not incorporated during design and installation. Installation of fire suppression systems in close proximity to safe shutdown cabinets/components could lead to failure of the suppression system as well as fail safe shutdown equipment if they were to impact or fail (causing spray or flooding) dilling a seismic event. Installation of .the piping systems as well as interactions of installed piping and equipment were investigated as part of the seismic walkdowns. No instances of potential degradation of fire protection systems were identified during the seismic walkdown.

4.14.2 Fire

}

Barrier Effectiveness Fire barriers are used at Palisades to provide physical separation of redundant trains of safe shutdown equipment. Qualification of these barriers must be maintained to ensure an effective fire protection program. A series of detailed barrier inspection procedures are implemented to inspect all fire area boundaries for the express purpose of protecting safe shutdown equipment.

Fire barrier inspection procedures require that every boundary be inspected, including penetration seals and fire dampers. Fire doors are inspected and maintained per procedure on a semiannual basis. All fire barrier inspections are performed on an 18 month interval. Fire dampers are inspected and tested during each refueling outage.

In addition to inspection of the fire atea boundaries required by Appendix R, certain other boundaries are also inspected per previous. NRC commitments and/or good fire protection practices due to high combustible loading considerations. Other fire barrier concerns such as fire Revision 1, May 22, 1996 4-113

damper operability, as outlined in NRC Information Notices 83-69 and 89-52, have been resolved with walkdowns/inspections and operating procedure modifications. This detailed inspection and maintenance program ensures that all fire boundaries are adequate and iri good repair. Fire barrier effectiveness is ensured by implemen~tion ofthese procedures.

4.14.3 Effectiveness of Manual Fire Fighting The Sandia Fire Risk Scoping Evaluation identified six components of an effective manual fire fighting program. These components consist of: fire reporting; fire brigade personnel and equipment; fire brigade training; fire brigade practice; fire brigade drills; and recprd keeping on fire brigade members. Palisades Fire Protection Implementing Procedures *(:F,PIP) (Ref. 4-3),

Palisades Administrative Procedures (Ref. 4-13) address all six of these issues.

Fire reporting is accomplished with two way radios carried by the operators (and staged with the fire brigade equipment) or via the phone lines designated for emergency purposes. Use and staging of this equipment is detailed in plant procedures. Adequate staffing consists of fire brigades of at least five people each. No more than two of the members can be members of the minimum operations shift crew necessary for safe shutdown. Supporting equipment is prestaged at various locations throughout that plant and includes personal. protective equipment,

. communications equipment, portable lights and ventilation, etc.

Course work associated with fire brigade training covers subjects ranging from basic principles of fire chemistry and physics to more advanced subjects including evaluation of fire hazards and fighting fires in confined areas. All fire brigade members also receive hands-on fire fighting training at least once per year to provide experience in actual fire extinguishrnent and the use of emergency breathing apparatus. Fire brigade drills are performed in the plant so that each fire brigade shift can practice as a team. Backshift drills and unannounced drills are performed for each shift at least once per year. Detailed training records and periodi9 quality assur~ce audits of the fire* proteetion program assess the. adequacy of the fire *brigade training. Training records and audit reports are kept on file at the.plant for *at least three years. . . . .

Based on an examination of Palisades's established fire fighting training program, the attributes of an adequate fire protection program related to manual fire fighting identified in the Sandia Fire

• Risk Scoping Study Evaluation are satisfied. The plant's fire brigade and manual fire fighting capability is, therefore, considered to be effective. Section 4.8 describes how manual fire fighting is accounted for in this study.

4.14.4 Total Environment Equipment Survival This issue includes the following three concerns:

a) The potential for adverse effects on plant equipment caused by combustion products released from the fire causing damage, and possible loss of safe shutdown function;

• • Revision 1, May 22, 1996 4-114 P.

b) The spurious or inadvertent actuation of fire suppression systems resulting in the loss

• c) of safe shutdown functions; and Operator effectiveness in performing manual safe shutdown actions and potentially misdirected suppression effects in smoke filled environments.

With the exception of the control, cable _spreading, and Class IE switchgear rooms, all fire initiators included in the accident sequence quantification are assumed to spread and engulf the entire area/zone in which they are assllined to occur. Smoke effects on equipment located in these spaces is not an issue because the equipment is assumed destroyed by the .fire. Equipment in adjoining spaces is unlikely to be damaged because the barriers that prevent*fu.~ fire spread will also limit smoke propagation. Smoke that does propagate to other: *-*spaces will be dissipated/diluted. In addition, .the FIVE methodology does not currently evaluate non-thermal environmental effects of smoke on equipment because the detrimental effects of smoke on equipment are not believed to be significant.

Use of automatic wet fire suppression systems at the Palisades station is limited to fewer' than one-half.of the fire areas. This type of system is located over significant risk related equipment in the diesel generator/day tank rooms, the cable. spreading room, Class IE switchgear rooms, the southwest cable penetration room, the intake structure, and the yard transformers. Effects of an inadvertent actuation are reduced by installation of spray shields protecting key electrical cabinets and pumps. Susceptibility of multiple trains of safe shutdown equipment to spurious actuation of suppression systems is not expected in any case.

Manual actions to operate equipment outside of the control room or ASDP is given only limited credit in this study as discussed in Section 4.I2. Manual response to fires inside the control room are discussed in Section 4.8. Review of the heating ventilation and air conditioning (HV AC) systems determined that sufficient ventilation is available to prevent excessive smqke prop(lgation between systems and structures. Emergency lighting.ls posit.loned throug~out_the plant and ~elf

_contained breathing air (SCBA) equipment is also staged. at appropriate locations in the plant.

This equipment allows the operator/fire fighter to effectively combat any anticipated fires 4.14.5 Control Systems Interactions

.Control system interactions following a fire is principally a concern at facilities without a remote*

shutdown capability. Installation of the alternate shutdown panel (ASDP) resolved this issue at the Palisades station. This panel (C-150/C- I 50A) allows the operators to remotely control one train (train B) of auxiliary feedwater from the southwest cable penetration room.

One of the primary features of the ASDP is that cables supporting the steam driven AFW pump can be isolated from the control and cable spreading rooms. This allows remote operation of the equipment regardless of the condition of these rooms. The Palisades Off Normal Procedures provide the necessary guidance to control the plant from the ASDP. In addition to the written.

guidance, all tools and equipment required to implement the actions are staged near the ASDP.

Revision 1, May 22, 1996 4-115

4.15 USI A-45 AND OTHER SAFETY ISSUES Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal (DHR) Requirements",

addresses the adequacy of the heat removal function at operating plants. For the purposes of the IPE and IPEEE, decay heat removal is defined as "decay heat removal from the core and primary coolant system at conditions beyond the capabilities of the shutdoWI1 cooling system." The two basic methods of decay heat removal at Palisades consist of: secondary cooling, which utilizes the steam generators as a heat sink for the primary coolant system; and once through cooling.

Heat removal via the steam generators is the primary and preferred method ,of removing decay heat. Effective heat removal using the steam generators requires circulation -o(:primary coolant through the core with energy removal in the steam generators by use of steam release and makeup. Although the main condenser is the preferred heat sink, DHR using the steam generators is not dependent on the main condenser. Palisades has the capability to release steam directly to the atmosphere via dump valves and other manually aligned pathways.

The two mechanisms available for steam generator makeup are AFW and low pressure feed using the condensate pumps. The normal method is* using AFW, which has two independent, redundant trains. .The primary train has *a motor driven pump and a steam driven pump, with nitrogen backup supplies to critical air operated control valves. The secondary train has a motor driven pump and control valves that are located separately from the primary train. The backup method of steam generator makeup, low pressure feed, is not credited in.the fire IPEEE but would be available during many of the fire scenarios included in this analysis .

During accident scenarios in which secondary cooling cannot be established, decay heat is absorbed by the primary coolant causing PCS temperature and pressure to rise. In these accidents, operators are direc.ted to initiate once through cooling (OTC). This is performed by

• starting the HPSI pumps and opening the PORV/PORV block valves. Primary coolant is then rdea5ed -into the containment building- resulting in. PCS presstire reducti_on and decay heat

• removal. HPSI injectiOn in this mode maµitains adequate PCS inventory as well as core cooling.

Following initial construction of the Palisades facility, several significant modifications were made to improve the reliability of the DHR systems. These improvements include: addition of a second motor driven AFW pump and associated piping; installation of larger PORVs and block valves to improve vent capability; addition of nitrogen bottles to provide backup motive force to operate the primary AFW train flow control valves and turbine steam supply valve; and installation of an additional 2.4kV transformer to improve power reliability to the safeguards AC buses.

The DHR issue was examined as part of the IPE, the details of which are contained in Appendix B of the IPE submittal (Ref. 4-2). The results of this examination indicate that failure of the Palisades DHR capability does not contribute significantly to the potential for core damage.

Revision 1, May 22, 1996 4-116

Analysis of the impact of fire haz.ards on the containment DHR function is covered in Section 4.11.1 under the discussion of Accident Class II. This analysis did not yield results unique or dissimilar from those contained in the IPE. The redundant and diverse systems available for decay heat removal at the Palisades plant are considered adequate to resolve this generic issue.

~

.*-*~:.! ;'

.r

• Revision 1, May 22, 1996. 4-117

4.16 SENSITMTY ANALYSIS

• The results. of the IPE sensitivity analysis are also applicable to the fire analysis. In addition, there were two operator actions added to the fire analysis that were not in the IPE that are risk significant: repair/recovery of randomly failed AFW components; and manual transfer to the startup transformer following fire induced failure of the safeguards transformer and fast transfer.

The sensitivity of the human error probability (HEP) for these two events was performed.

The event AFWRECOVER was used to represent recovery of failed AFW components. This event is only credited in the west safeguards room (fire area 28) and 590' a~liary building corridor - south finger (fire zone 13AI ). The HEP for this event is l.OOE-'l <)-1 the HEP was increased to I .O, the fire CDF would increase by 44%. The CDF for both 'Of these fire areas would increase approximately one order of magnitude. If the HEP was decreased to I .OOE-2; then the fire CDF would decrease by 4.2%. The CDF of both of the contributing fire areas would decrease by approximately 85%.

The event PCBOTFXFR was used to represent failure to manually load buses IC, ID, and IE onto the startup transformers given a failure of the diesel generators. This operator action is only credited in the turbine building (fire zones 23E and 238). The HEP for this event is l .OOE-2.

If the HEP was increased to l.OOE-1, the fire CDF would increase by 19.0%. The CDF for a fire in the east side of the turbine building would increase by 2-1/2 times. The CDFfor the south side turbine building fire would increase by 4-1/2 times. If the HEP was decreased to I .OOE-3, then the fire CDF would decrease by I.5%. The east side turbine building CDF would decrease by I3% and the CDF for the south side turbine building would decrease by 32%. The HEP for this operator was previously evaluated using a THERP model, but this operator action was not

• credited in the IPE.

• Based on these sensitivity analyses, the HEPs _used_ for each of these. operator actions is appropriate:

• All order of magnitude change up or down in the HEP does alter the results and

• conclusions of the fire analysis. - - .

Revision I, May 22, I 996 4-I I8

Table of Contents Section 4.17 Results and Conclusions 4.17.1 Summary of Results 4-120

'4.17.2 Conclusions and Recommendations 4-120 Revision 1, May 22, 1996 4-119

4.17 RESULTS AND CONCLUSIONS 4.17.1 Summary of Results The total core damage frequency due to fires at the Palisades Nuclear Power Plant is estimated to be 3.3 lE-5 core damage events per year. This information is summarized by fire area in Table 4.11.1. Over 89% of the plant risk associated with internal fires can be traced to five fire areas:

cable spreading room (33.5%); main control room (24.4%); lD switchgear room (14.7%); turbine*

building (9.3%); and lC switchgear room (7.6%). The fire results are qominated by Accident Class IA (59.4%), which.is failure of secondary cooling and failure of OTC during the injection phase. Accident Class IB is a significant contributor (39.6%), which is a faiJ.~e of secondary cooling and failure of OTC during the recirculation phase.

• 4.17.2 Conclusions and Recommendations The results of the fire IPEEE accident sequence quantification were derived from a methodology that includes a number of conservative assumptions. Fires were assumed to completely engulf the entire fire area/zone or cabinet where they were located except where suppression was credited. With the exception of the main control room, cable spreading room and the two s'Yitchgear rooms, the effects of suppression were not credited. Therefore, the methodology as applied .has resulted in potentially conservative results.

The core damage frequency in several fire areas is reduced due in large part to Palisades plant specific implementation of the requirements of 10 CFR 50, Appendix R. These requirements, including separation of alternate/redundant trains of safe shutdown equipment, fire barriers, and an alternate shutdown location (outside of control/cable spreading rooms), combine to limit the total risk due to fires. The administrative control of transient combustibles (Ref. 4-10) is also .

a contributing factor to the low fire risk in certain key areas.

~ .. .

As discussed in Section 4:12, operator actions had a -significant contribution to the fire results.

These operator actions will be included in the overall training on the operator actions credited in the IPEEE .

. Revision 1, May 22, 1996 4-120.

REFERENCES 4.18 4-1. Generic Letter No. 88-20, Supplement 4, "Individual Plant Examination Of External Events (IPEEE) for Severe Accident Vulnerabilities", United States Nuclear Regulatory Commission, June 1991.

4-2. Palisades* Nuclear Plant Individual Plant Examination (IPE), Consumers Power Company, November 1992.

4-3. Palisades Fire Protection Implementing Procedures FPIP-1, Organization and Responsibilities, 10/7194 FPIP-2, Fire Emergency Responsibility and Response, 12/6/94 FPIP-3, Plant Fire Brigade, 11116/94 FPIP-4, Fire Protection Systems and Fire Protection Equipment, 10/13/94 FPIP-5, Requirements for Inspection and Testing of Fire Protection Systems and Fire Protection Equipment, 12/5/94 FPIP-6, Fire Suppression Training, 10/19/94 FPIP Fire Prevention Activities, 11117/94 4:-4 Fire Ind_uced Vulnerabilities Evaluation (FIVE) Plant Screening Guide, EPRI, September 1991.

4-5. NUREG/CR-4527/1 of 2, An Experimental Investigation of Internally Ignited Fires In Nuclear Power Plant Control Cabinets: Part 1: Cabinet Effect Tests, U.S. Nuclear Regulatory Commission, April 1987.

4-6. Palisades Nuclear Plant, Fire Protection Program Report (FPPR), Compilation of

• enginee~ing evaluations.dealing with fire related subjects at the Palisades Nuclear Plant.

• 4-7. Fire Hazards Analysis - Palisades Nuclear Power Plant, Consumers Power Company,

• Rev. 2, February 1989.

4-8. Fire Events Database for U.S. Nuclear Power Plants, NSAC-178L, June 1992.

4-9. Appendix III, Table III 5-3, "Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, 1975.

4-10. Palisades Nuclear Plant Fire Protection Implementing Procedure, "Fire Prevention Activities", Revision 8, November 17, 1994.

4-11. NUREG/CR-5088, "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, lnduding Previously Unaddressed Issues," USNRC, January 1989 .

• Revision 1, May 22, 1996 4-121

\

4-12. EPRI NP-6041, Revision 1 "A Methodology for Assessment of Nuclear Power Plant

• 4-13.

S,eismic Margin", EPRI, July 1991.

Palisades Administrative Procedures:

10.21 Fire Protection Plan, 6/4/93 10.46 Plant Records, 3/15/95 4-14. NSAC 161, Faulted Systems Recovery Experience, The NucleCU" Safety Analysi~ Center, May 1992. . ***. '** ,

~ :- .. ; . :_{

4-15. NUREG/CR-5384 (SAND89-1359), "A Summary of Nuclear Powe;.piant Fire Safety Research at Sandia National Laboratories, 197~-1987," Sandia National Laboratories, December 1989.

4-16. Revision 1 to* the Palisades Nuckar Plant Individual Plant Examination (IPE),

• Consumers Power*company, July 11, 1994.

4.17 Palisades Drawing M-216, sheets 4 through 18.

4.18 Palisades Equipment Database.

4.19 Palisades Appendix R Circuit Analysis Database.

4.20 Palisades Cable and Raceway Schedules, Drawings E-33 and E-37.

• Revision 1, May 22, 1J96 4-122

TABLE OF CONTENTS SECTION 5.0 OTHER EXTERNAL EVENTS 5.1 Summary 5-2 5.2 Assessment of Other External Events for Palisades 5-8 5.3 Conclusions - **5-29 5.4 References 5-30

Table of Contents Section 5.1 Summary 5.1.1 Background 5-2 5.1.2 Plant Familiarization 5-2 5.1.3

• Overall Methodology * .:* *.*

5-2 5.1.4 Summary of Major Findings 5-3 5.1.5 Figures for Summary Section 5-5 5-1

• • 5.1 Summary 5.1.1 Background The assessment that is described in this section addresses the external events other than seismic and internal fires. These "other" external events include phenomena such as high winds, floods, transportation-related accidents and accidents at nearby facilities that could potentially pose a threat to the Palisades Plant. This assessment was performed using a screening approach similar to that suggested in Generic Letter 88-20, Supplement 4 (Ref. 5-1), and the accompanying guidance for implementation, NUREG-1407," Proce<Iilral and Submittal Guidance for the Individual Plant Examination of External Events (i:Pi;:EE) for Severe Accident Vulnerabilities" (Ref. 5-2).

5.1.2 Plant Familiarization The Palisades nuclear generating plant is a pressurized water reactor with a large dry containrilent designed by Combustion Engineering and Bechtel Corporation. Bechtel Corporation constructed the plant. The reactor core produces 2530 Mwt. The turbine-generator has a maximum electrical output of 84S Mwe. The plant is located on Lake Michigan, west of Covert Michigan. The construction permit was issued on March 14, 1967,

• and commercial operation began on December. 31, 1971.

Palisades was designed before final issuance of the general design criteria for nuclear plants (10CFR50, Appendix A) and the 1975 Standard Review Plan (SRP) (NUREG-75/087).

• Subsequently Palisades participated in the Systematic Evaluation Program (SEP). The SEP was conducted to assess differences between original and current plant design requirements, and to reconfirm and document plant safety. The SEP resulted in an Integrated Plant Safety

. Assessment (Ref. 5-3Y, For each of the events assessed below, a SEP analysis has been conducted, referenced to the applicable SRP requirements. The following review also considered any significant differences between the SEP documented . plant design and operation, and current conditions with respect to the more recent SRP criteria.

5.1.3 Overall Methodology Generic Letter 88-20, Supplement 4, and the accompanying guidance for documentation, NUREG-1407, include a recommended screening approach that can be used to evaluate the impact of high winds, external floods, and transportation and nearby facility accidents. Figure 5 .1-1 is a flow chart of this recommended screening approach. The steps shown in this figure represent a series of analyses in increasing level of detail, effort, and resolution. This approach was modified slightly, as shown in Figure 5.1-2, for the Palisades evaluation of other external events .

• 5-2

After identifying the external events that should be considered for the Palisades Plant, pertinent SEP documents were reviewed to determine whether that assessment had satisfied the SRP criteria. Because Palisades received its provisional operating license prior to 1975, it was necessary to review the Palisades Final Safety Analysis Report (FSAR), and other analyses to make this assessment~ If the standard review plan (SRP) requirements are ,satisfied and a confirmatory walkdown does not identify unique vulnerabilities not included in the original design for the external event under evaluation, then per the guidance of the NRC Generic Letter 88-20, Supplement 4, it is assumed that the contribution from that hazard to the core damage frequency is less than lE-6/yr, and that hazard may be screened from further consideration.* If the SRP is not satisfied, additional *analysis may be necessai.Y,.:*iiP to and including the development of probabilistic risk assessment models to evahiat(t_he specific concerns.

5.1.4 Summary of Major Findings Based upon the evaluations presented in this section, there are no "other" external events (fire

• and seismic were examined in preceding sections) that are a safety concern to the Palisades

• Plant. No vulnerabilities were identified, and the screeniilg criteria modified from NUREG-1407 and Generic Letter 88-20, Supplement 4, are satisfied for all events. Because no new

• Vulnerabilities were found in this assessment, no changes to plant hardware or procedures are recommended, beyond those presently docketed.

Applicable results of the Palisades SEP program were reviewed to determine whether they remained accurate. Walkdowns were performed to confirm the results of the evaluations. The observations from those walkdowns were reviewed and factore.d into the appropriate portions of the evaluation, prompting further analysis in some cases. Ultimately, the walkdowns confirmed the conclusions discussed in the next section and identified no unique vulnerabilities. .

Most of the external events considered could be readily screened from further consideration becaus~ they either do not apply to the Palisades s_ite (volcanos, avalanches, and landslides, for example), or have limited impact based on the history of the site (lightning for example). The remaining events - tornados and tornado missiles, external. flooding, and hazards due to local transportation and nearby facilities - were evaluated in greate~ detail. The threat due to tornados was shown through the SEP to conform adequately to the SRP review criteria.

Walkdowns of the plant site, and evaluation of modifications since the SEP, confirm that Palisades r~mains adequately designed to withstand design basis tornados, and their missiles.

Flooding due to external sources is adequately addressed by site design and the nature of the .

local drainage. The bounding external flooding event remains a surge/seiche from Lake Michigan, which is analyzed to not render inoperable any safety related equipment necessary for plant safe shutdown. The adequacy of the plant's design with respect to the probable maximum precipitation was established using a conservative approach, detailed analysis, and

• 5-3

walkdowns to show that roof drainage is adequate to prevent accumulation of rain water above levels that would lead to roof failures. The evaluation conducted for this review confirms the results of the SEP review remain valid for such eventS.

Transportation accidents do not pose a serious thfeat to the safety of the plant staff or structures. Even though Palisades is located on Lake Michigan, lake traffic patterns are far enough offshore so as to rule out damage to the plant due to shipping accidents. The explosion hazard due to pipelines, railroad cars, or trucks is bounded by the overpressure design of the plant's critical structures. The threat from an explosion of on-sire materials; .or,processes at industrial facilities was. found to be small. The assessment considered aircraft accidents and

• determined that the site is remotely located from any military iiistallations and:Orit exposed to military-related training flights; and is well below the screening criteria in terms of the potential threat posed by small aircraft traffic in the vicinity of the site. While the plant is at the edge of a federal airway, the low frequency of airway use results in acceptably low site .

accident probabilities.

• The last event to be considered in the assessment was the spill of hazardous material from sources on site, or transportation near site. These events remain sufficiently unlikely, or are shown_to lack severe accident consequences'.

• 5-4

5.1.5 Figures for Summary Section FIGURE 5.1-1 FLOW CHART OF SCREENING PROCESS FOR EXTERNAL EVENTS OTHER THAN SEISMIC AND FIRE NUREG-1407 (1) Review Plant Specific Hazard Data and LICenslng Basis *.-:--':~:./{

(FSAR) . ..::..: ~:*

'-----------~-----------' -~~~;~..:~*;~/ **;

(2) Identity Significant Changes, If any since OL Issuance (3) Does Plant I Facllltles Design Meet 1976 SRP Criteria?

NO - --:-YES___.

(Quick Screening & Walkdown)

OR (4) Is the Hazard Frequency Acceptably Low ? -YES___.

OR (6) Bounding Analysls (Response I Consequence) --'-YES ___.

1*

OR ----.... (6) PRA (7) Documentation (Includes Identified Reportable Items anc

• Proposed Improvements) -

5-5

FIGURE 5.1-2

• FLOW CHART OF SCREENING PROCESS FOR EXTERNAL EVENTS OTHER THAN SEISMIC AND FIRE, AS USED AT PALISADES (1) Review Plant Specific Hazard Data and Licensing Basis (FSAR)

(2) Identify Significant Changes, If any since Palisades SEP was completed (3) Do the changes to the Plant I Facllltles Design since NO - Pallsades SEP was completed Meet 19 75 SRP Criteria? - -YES ___.

(Quick Screening & Walkdown)

OR ---+ (4) Is the Hazard Frequency Acceptably Low? >---YES___.

OR ---+ (5) Bounding Analysis (Response I Consequence) >---YES ___.

OR ---+ (6) PRA

,. I (7) Documentation (Includes Identified Reportable Items ancJ Proposed Improvements) 5-6

Table of Contents Section 5.2 Assessment of Other External Events for Palisades 5.2.1 External Events Considered for Palisades 5-8 5.2.1.1 Severe Temperature Transients 5-8 5.2.1.2 Severe Weather Storms 5.2.1.3 Lightning Strikes 5.2.1.4 . External Fires

. ,,!>t:

5.2.1.5 Extraterrestrial Activity 5-9 5.2.1.6 Volcanic Activity 5-10

. 5.2.1.7 Earth Movement 5-10 5.2.2 High Winds and Tornados 5-10 5.2.2.1 High Winds and Tornado Loading 5~11 5.2.2.2 Tornado Missiles 5-12 5.2.2.3 Other High Wind and Tornado Related Issues 5-13 5.2.2.3.1 Diesel Generator Fuel Oil Supply 5-13 5.2.2.3.2 Hydrogen Tanks 5-14 5.2.2.3.3 Diesel Generator Room HVAC 5-14 5.2.2.3.4 1984 Auxiliary Building Addition 5-15 5.2.3 External Flooding.and Probable Maximum Precipitation 5-16 5.2.3.1 External Flooding 5-16 5.2.3.2 Probable Maximum Precipitation 5-17.

5.2.4 Transportation and Nearby Facility Accidents 5-18 5.2.4.1 . Transportation Accidents 5-19 5.2.4.1.1 Roads/Highways 5-19 5.2.4.1.2 Railroads 5-19 5.2.4.1.3 Great Lakes Shipping 5-19 5.2.4.1.4 Pipelines 5-19 3.2.4.1.5 Aviation 5-20 5.2.4.2 Nearby Industrial Facilities

• 5-22 5.2.4.3 On-site Storage Hazardous Material Releases 5-23 5.2.4.4 Other On-site Hazards 5-24 5.2.5 Table and Figures for Assessment of Otber External Events 5-26 5-7

5.2 Assessment of Other External Events for Palisades 5.2.1 External Events Considered for Palisades NUREG-1407 (Ref. 5-2) contains a list of other external events which need to*be considered by nuclear power plants. This list is an extract of a larger listing considered in NUREG/CR-5042, Supplement 2 "Evaluation of External Hazards to Nuclear Power Plants in the United States" (Ref. 5-4). The NRC, in their review of this and similar lists, concluded that many of the events may be deleted from consideration due to the low frequency of occurrence and the subsequently low conditional probability of core damage. Other events may b~ .removed because they or their effects are considered within the IPE (Ref. 5-5). However; each plant is to review this list and ensure that there is no unique plant-specific design or operating characteristic which may require that the events be evaluated. A review of the list of events as they apply to Palisades confirms that the following events can be removed from further*

consideration.

5.2.1.1 Severe Temperature Transients (Extreme Heat, Extreme Cold)

Palisades is located in a region more likely to be affected by extreme cold, than extreme heat.

These events, being normally slow acting, generally affect only the ultimate heat sink, or offsite power. Because of this timing, ample opportunity exists for plant staff to recognize the need for, and to initiate plant shutdown and other mitigative actions. Generally, Palisades

• systems and components important to safe plant shutdown are located within heated buildings.

Exceptions include the safety injection and refueling water tank (SIRWT), the condensate storage tank (CST), and off-site electrical power supply equipment. Both of the tanks are heated, temperature monitored and alarmed. Plant administrative controls prescribe response actions, including plant shutdown, in the event of failure to mai:fltain_ ta1* temperawres, or

ultimate heat sink:. Additionally, alte~te sources_of water have been pro-cedu~ally developed should these tanks become inoperable when. called upon for safe shutdown. Given the slow acting nature of these events, such controls are considered adequate to mitigate their impact upon safe shutdown. The potential impact on the plant due to. loss of off-site power, is considered by the Palisades IPE (Ref. 5-5).

Based upon the foregoing, no further analysis of severe temperatlire events is considered necessary.

5.2.1.2 Severe Weather Storms (lcestorms, Hailstorms, Snowstorms)

The primary concern due to severe weather storms (ice storm, hailstorm, snowstorm, dust storm, sandstorm) accompanied by strong winds, has been tl).e complete or partial losses of off-site power. Additionally, such events could result in the loss of ultimate heat sink cooling.

At Palisades, the potential eff~ct of loss of offsite power and station blackout is addressed in 5-8

the internal events IPE. Any impact upon the ultimate heat sink would likely be slow acting and could be mitigated by established administrative controls (Ref. 5-6).

Based upon the foregoing, no further analysis of severe weather storm events is considered necessary.

5.2.1.3 Lightning Strikes As stated in NUREG~1407, the major impact of lightning strikes at nuclear plants is the loss of off-site power. The Palisades internal events IPE considers the frequency, .and evaluates the consequences of this events. Based upon the inclusion of this event in the internal event IPE loss of off-site power initiator, and the lack of other site specific lightning* relaWd damage .over the plant operating life, further analysis of these events is considered unnecessary.

• 5.2.1.4 External Fires These are fires which occur outside of a plant site boundary, such as forest fires and grass fires. Potential impacts include loss of off-site power, forced isolation of the plant's ventilation system, and possible control room evacuation due to smoke. ':fhe Palisades Plant protected area is clear of forest and brush, making it very unlikely that a fire would spread to the site. As such, the (safe shutdown) affects of such a local, off-site fire may be limited to control room ventilation isolation, and the loss of off-site power.

The loss of off-site power initiating event frequency employed in the internal events IPE is based upon actual plant experience, and includes both losses due to in-plant equipment and .

external events. It is judged that this frequency is sufficiently high that it bounds other lower probability contributors, such as external fires.

• The Palisades Control Room Ventilatiorf system is designed to permit isolation and a 100%

recirculation mode of operation. This function is designed to permit continued habitability

• during a variety of hazards, including, radiological releases, toxic chemical releases, and fires, Plant System Operating Procedure provides instruction for manual initiation of a recirculation mode of operatio.n, including isolation of outside makeup air sources. Therefore, it is concluded that no further consideration of the effects of off-site fires is necessary:

5.2.1.5 Extraterrestrial Activity (Meteorite Strikes, Satellite Falls)

These events include objects such as meteorites and man-made satellites entering the earths atmosphere, and disabling important plant equipment upon impact. Although the likely damage from such an event would be great, the probability of such events has been considered to be adequately low enough as to justify screening out these events from further consideration (Ref. 5-4).

5-9

5.2.1.6 Volcanic Activity The Palisades site is too far away from any active volcanoes to expect any effect at the plant.

Therefore Palisades does not need to consider any volcanic effects (Ref. 5-2).

5.2.1.7. Earth Movement (Avalanche, Landslide)

Upon review of the Palisades FSAR (sections 2.3, "Geology", 2.4, "Seismicity", and 2:5,

. "Meteorology" (Ref. 5-7)); and the SEP Topics 11-4, "Geology and Seismology".(Ref. 5-8) and II-4A-F, "Settlement of Foundations and Buried Equipment" (Ref. 5-9), the*oonclusions arrived at in the SEP are still valid, namely that there are no geological featur~~ihat present an avalanche, landslide, or other earth movement-related hazard to the continued:safe operation of the Palisades Plant. Therefore, these.events will be excluded from further investigation in this analysis.

Having eliminated' the preceding events, the 'other' remaining external events requiring further consideration at Palisades are limited to the following :

High Winds and Toinados External Flooding Transportation and nearby facilities .

• These events require further consideration due to modifications since the SEP, or updating of selected offsite hazard data.

5.2.2 High Winds and Tornados The objective of this review is to assure. that Palisades Design Class I .structures are adequately designed to resist wind loadirig, tornado loading, tornado pressure drop, and tornado missiles.

Design Class I structures are defined as those whose failure could cause uncontrolled release of radioactivity or loss of systems essential for safe shutdow.n of.the Nuclear Steam Supply System and long term operation following a Loss of Coolant Accident. NUREG/CR-5042 (Ref. 5-10) provides a listing of review criteria including pertinent sections of the Standard Review Plan (SRP) and Regulatory Guides. Appropriate SRP Sections include:

- SRP No. 3.3.1, "Wind Loadings"

- SRP No. 3.3.2, "Tornado Loadings"

- SRP No. 3.5.1.4, "Missiles Generated by Natural Phenomena"

- SRP No. 3.5~ 1.5, "Site Proximity Missiles (Except Aircraft)"

-SRP No. 3.5.2, "Structures, Systems, and Components to be Protected From Externally Generated Missiles"

-SRP No. 3.5.3, "Barrier Design Procedures"

For tornados and missiles, additional criteria are provided in Regulatory Guide 1. 76, "Design

• Basis Tornado for Nuclear Power Plants" (Ref. 5-11), and Regulatory Guide 1.117, "Design Basis Classification" (Ref. 5-12).

• Because the winqs expected from a tornado are much higher than those classified as "high winds," it is assumed that plant structures that satisfy the design criteria for tornados will also satisfy those required for high winds.

These requirements were considered during the SEP process. Subsequent review by NRC resulted in final acceptable evaluations of these subjects (SEP Topic 111-2., "Wind and Tornado Loadings - Palisades" (Ref. 5-13), and SEP Topic III-4A, " Tornado Missiles*.,;;;palisades" (Ref. 5-14)). The following discussion provides a summary of the SEP results pertinent to these requirements. These results are considered to remain applicable, except as noted.

Additionally, discussion is provided to address new structures erected after the SEP analysis was completed, and the results of walkdowns conducted to assess potential hazards due to this issue.

5.2.2.1 . High Winds and Tornado Loading The capability of the CPCo Design Class 1 structures to resist the effects of tornado and wind loads was evaluated in Topic 111-2 of the Nuclear Regulatory Commission's (NRC) Systematic Evaluation Program (SEPr SRP sections 3.3.1 and 3.3.2 and Regulatory Guides 1.76 and 1.117 were employed as review criteria. A tornado wind load was the governing wind load and was specified in Regulatory Guide 1. 76 as 360 mph maximum wind speed and a pressure drop of 3 psi at a rate of 2 psi per second for the Palisades Plant. Except as noted in FSAR section 5.3.2 (Tornado) (Ref. 5-7), Palisades CPCo Design Class I structures are designed for tornad.o loads. The following structures and components were determined not to have been

• designed to resist tornado wind loads: *

• 1. Condensate storage tank

2. Intake and exhaust vents for the electric diesel generators

3. Safety injection and refueling water (SIRW) tank

4. Steel framed enclosure over the spent fuel pool Revisions to Plant Emergency Operating Procedures were subsequently made to provide alternative sources of water for safe shutdown should the safety injection and refueling water tank (SIRWT), or the condensate storage tank (CST) fail due to tornado wind and pressure loading (Ref. 5-15). The availability of these alternate sources were judged as an adequate basis for not requiring a backfit to the safety injection refueling water tank and the condensate storage tank. Additionally, it was determined that the failure of these tanks would not cause the flooding of any safety related equipment (Ref. 5-3).

5-11

Further review of the simultaneous loss of engine supply air/exhaust to both emergency diesel generators due to tornado loadings concluded that this event was unlikely . This conclusion was based upon the fact that these intake/exhaust lines are enclosed on three of four sides, and overhead by reinforced concrete walls and a concrete roof. These enclosures will withstand .

the wind loading from a 360 mph tornado, as well as missiles, including the 4' x 12' wood

• plank considered in the original design. Only the north side of these enclosures where the diesel exhaust lines terminate, is exposed to missiles. The unprotected north side is generally shadowed by other structures, including the Service building and the Feedwater Purity Building. Additionally, Each diesel's intake and exhaust pipe is in one cubicle, separate from the other, thus decreasing the probability of both diesels being disabled (Ref.. ?~ 3).

• ).;

While the Steel framed covering over the Spent Fuel Pool was shown to be unable to withstand a 360 mph tornado load; it is recognized that the failure of this structure does *not pose any threat to the safe shutdown of the plant (Ref. 5-3).

Based upon the above considerations, the NRC concluded that any damage that might occur to these 'unprotected' structUres and components would not adversely affect the safe shutdown capability of the plant (Ref. 5-3).

The above evaluation was performed prior to construction of the auxiliary building addition in 1984. The capability of this structure to withstand high wind.and tornado loadings, and tornado missiles will be discussed in section 5.2.2.3.

5.2.2.2 Tornado Missiles .*

The capability of the CPCo Design Class 1 structures to resist .the effects of tornado missiles.

was eval~ated in 'fqpicJH-4:A of the Nucle~r Regula!qry Co~ission's (NRC) Systematic Evaluation Program- (SEP). . This review was. performed*in accordance

~

with SRP section 3.3.2, "Tornado Loadings", 3.5:3, "Barrier Design Procedure", and 3.1.5.4, "Missiles Generated by Natural Phenomena". Additionally, nine CPCo Design Class 1 systems identified as ... safe shutdown systems" by the SEP program were evaluated.

The NRC review of the nine CPCo Design Class 1 systems determined that the following safety-related ~quipment was vulnerable to tornado missiles:

1. Condensate storage tank

2. Intake and exhaust vents for the electric diesel generators

3. Safety injection and refueling water tank (SIRWT)

• 4. Atmospheric relief stacks of steam relief valves

5. The compressed air system The Integrated Assessment portion of the SEP concluded that the arguments provided in the preceding sections were adequate for tornado missiles as well as tornado loading to justify a

• 5-12

decision to not require backfit for the above list of vulnerabilities, excepting item #4, atmospheric relief stacks of steam relief valves.

Three safety/relief valves discharge lines are combined into one safety/relief stack. There are

• a total of eight groups of three safety/relief valves each discharging through its own exhaust stack. Also, there are fo~r atmospheric dump valves each releasing through its own stack.

The combined flow area of the 12 stacks (8 safety/relief and 4 atmospheric dump) is 2800 square inches.

• The likelihood of not being able to bring the reactor to a safe shutdown becatis~~'Of the inability to vent steam (during a loss of offsite power event) is judged to be low for the**,fc>nowing reasons :

to achieve safe shutdown, one relief or one dump valve has sufficient capacity to remove all decay heat from the core; these 12 relief and dump valve stacks extend approximately 6 to 8 feet above the auxiliary building roof and are distributed over an area of approximately 300 square fect;a~ *

• this section of the auxiliary building roof is below that of the surrounding structures, and is well protected from all sides except from above.

These arguments were considered adequate to justify not requiring backfit to remove vulnerabilities to tornado missile for these valve stacks (Ref. 5-3).

In summation, the NRC concluded that the Palisades Plant, as configured at the time of the SEP, met the current criteria for protection from tornado missiles.

5.2.2.3 Other High *Wind, Tornado, and Tornado Missile Related Issues As part of this assessment, several issues not previously considered by SEP were evaluated.

These issues were included in this assessment based upon the results of walkdowns, recent plant modifications, and reclassification (safety related) of systems. The following paragraphs discuss these additional (wind, tornado, and tornado missile related) assessments.

5.2.2.3.1 Emergency Diesel Generator Fuel Oil Supply In 1994, it was determined that the Emergency diesel generator fuel supply system does not meet General Design Criterion 2, "Design Basis for Protection Against Natural Phenomenon".

Continued plant operation has been justified by using some temporarily installed equipment to meet GDC-2. The Emergency diesel generator fuel oil storage tank (T-10) was not constructed to current licensing basis. To meet current requirements, the storage tank should 5-13

be completely buried and covered with a concrete slab to provide for tornado protection. The tank is now only partially buried and covered with sand (mounded). The plant engineering staff has since evaluated the design requirements and has planned modifications to the Emergency diesel generator fuel oil supply system to meet General Design Criteria -2.

Modifications (FC-958) will be completed by the end of the refueling outage following the 1995 refueling outage (Ref. 5-16).

5.2.2.3.2 Hydrogen Tanks From the walkdowns, it was determined that potential tornado generated missil~s'*(wood planks and Fire Protection System piping) from the cooling towers south of the protected area and trailers could impact the bulk hydrogen tanks. Hydrogen, used for electrical generator cooling, is stored south of the turbine building in six cylindrical tanks. The lo_ss of the hydrogen tanks due to a tornado generated missile would not impair the plants ability to achieve safe* shutdown.

5.2.2.3.3 Emergency Diesel Generator Room HV AC Recently, the emergency diesel generator room HV AC was reclassified as safety related, and required for safe shutdown. This support system was not technically analyzed during the SEP process.

The emergency diesel generator room HVAC system is constructed of galvanized steel material, in a helically reinforced cylindrical configuration. All of the ductwork associated with the emergency diesel generator HVAC .is located within the diesel generator rooms.

None of the ductwork is external to the building. 20 gauge galvanized duct work (nonreinforced - nominal for such iil_stallations) is rated for a µegative pressure of 2. 4" of water-( 0.0866 psi) (Ref. 5-17). This rating is wen below that required for the design basis tornado pressure drop (3 psi, at 2 psi/sec)." Tornados create negative pressures relative to that inside nearby buildings. Consequently, failure of this ducting must be anticipated from such an event.

A review of the construction prints and a walkdown confirmed that the supply fans are wall mounted to the supply air inlet plenum area (a concrete box area), without any ductwork on the fan suction. Therefore, the collapse of the Emergency diesel generator HV AC supply air fan suction (intake) is considered unlikely. The only actual HV AC ducting installed is the fan discharge I distribution ducting. If the discharge ducting were to collapse due to excessive pressure forces, it is not considered credible that it would crush to the extent that its flow area

• would be significantly restricted. Thus, collapse of the ducting would not cause the failure of the fans to provide outside air for cooling, into the room.

The emergency diesel generator HVAC inlet plenum is exposed to potential tornado generated missiles on the.north side of the plant auxiliary building. However, its position is to a large 5-14

extent shielded by nearby building structures. Additionally, the emergency diesel generator HV AC inlet plenum is physic.ally one concrete box from which both diesel HV AC fans take suction. . As such, it is judged unlikely that a tornado generated missile strike would incapacitate the HVAC for both diesel generator rooms.

Based upon the foregoing, it is judged that the prese11t ducting configuration has an acceptably low probability of causing a loss of room cooling, and con5equently, no modifications are warranted.

5.2.2.3.4 1984 Auxiliary Building Addition - High Winds and Tornados .*

• • • 4 This modification was performed to add a Technical Support Center (TSC) for ~enhanced emergency management capability, an Electrical Equipment Room (EER) to house additional safety-related Class 1-Electrical equipment, and Heating, Ventilating, and Air Conditioning (HV AC) for the TSC and EER. The following discussion is provided to address the ability of this structure to withstand high winds and tornado loadings, and tornado missiles.

1984 Auxiliary Building Addition - High Winds Section 3.3.1

. of the Standard Review Plan states that*" ... the. procedures delineated in either the American Society of Civil Engineers (ASCE) Paper No. 3269 (Ref. 5-18), "Wind Forces on Structures" .... or in ANSI A58.l-1972 (Ref. 5-19) ... "are acceptable" for addressing wind velocity and effective pressure applied to.exposed surfaces of structures: The design criteria (Ref. 5-20) applied to the construction of this building modification provides for a maximum wind velocity of 100 mph at a height of 30 feet above ground. This is in accordance with ASCE Paper 3269. A factor of 1.1 was applied to the wind velocities to develop applied wind velocity pressures. The resulting formula was :

2 .

q = 0.00256v x 1.1 psf Based upon the above comparison of the Auxiliary Addition design requirements and those provided by ASCE Paper 3269, the Palisades Auxiliary Building Addition meets the criteria of the SRP for High winds.

1984 Auxiliary Building Addition - Tornados Missiles According to Regulatory Guide 1. 76, Palisades is located in tornado region 1. For this region, Regulatory Guide 1.76 and SRP section 3.1.5.4 provide the tornado characteristics shown in

. the Table 5.2-1. Palisades design basis tornado characteristics from FSAR sections 5.3.2.1 and 5.5.1.1.4 are shown for comparison.

As can be seen from the table, there are some differences between the Palisades Auxiliary Building Addition design, and those in Regulatory Guide 1. 76 and SRP 3.1.5.4. Chief among

• 5-15

these is that the maximum wind speed used for Palisades is 60 mph lower than the NRC criteria .

As part of the SEP analysis (topic 2-2.A, "Severe Weather Phenomena") for Palisades, an assessment of tornado. and straight wind hazard probability for the Palisades site was conducted (Ref. 5-21). The analysis detei"mined that the probability of experiencing maximum tornado wind speeds of 264 mph or greater is equal to or less than lE-6/yr. Accordingly, the frequency of a tornado with 300 mph maximum wind speed at the Palisades site is no greater than lE-6/yr. This provides adequate justification for eliminating structures designed for the.

300 mph tornado from further consideration, based upon the low frequency of this maximum wind speed.  :: .. .*./* .

A second difference between review criteria and the Palisades design is in the weight of the

• wood plank missile. ANSl/ANS-2.3-1983, "American National Standard for Estimating Tornado and Extreme Wind Characteristics at Nuclear Power Sites" (Ref. 5-22) suggests a 750-pound wide flange beam as its standard design "large, hard" missile. For the lE-6/yr tornado (260-mph maximum wind speed), the beam is specified to have a 75-mph impact

. velocity. Comparing the ANSI/ ANS standard to the Palisades design basis shows that the Palisades design basis tornado is more severe than that associated with the lE-6/yr tornado, such that the effects of the design basis missiles are also likely to be more severe.

Based upon the foregoing, the Palisades Auxiliary Building Addition is considered to meet applicable design standards for high winds and tornados, and may be screened from further consideration in this evaluation.

5.2.3 External Flooding and Probable Maximum Precipitation 5~2.3.1 External Floods External flooding review criteria are contained in Regulatory Guide 1.59 (Ref. 5-23), and Standard Review Plan Section 2A.2, "Floods", and 2.4.3, "Probable Maximum Flood (PMF)", and 2.4.5, ".Probable Maximum Surge and Seiche Flooding". The SEP process evaluated these criteria, under topics II-3.A, "Hydrologic Description", II-3.B, "Flooding Potential and Protection Requirements" , II-3. B.1, "Capability of Operating Plants to Cope with Design Basis Flooding Conditions", and II-3.B.C, "Safety Related Water Supply (Ultimate Heat Sirik)". This evaluation concluded that the runoff depth {due to local Probable Maximum Precipitation (PMP) on the plant site, in the vicinity of safety related structures would be less than six inches above ground elevation (elevation 589' mean sea level - msl) and should not constitute a flood threat (Ref. 5-24). The lowest elevation safety related equipment at Palisades are the Service Water pump motors, at elevation 594.7' msl. These reviews I

concluded that the bounding condition (Design Basis Surge level - 593. 5 feet insl) is not a

• threat to equipment required for safe shutdown, and the emergency procedures for this flood .

level are adequate (Ref. 5-25).

5-16

Given the minimal site flooding caused by the older PMP, it is judged that the analyzed site flooding due to the revised PMP (see section 5.2.3.2) for the Palisades site would remain bounded by the surge/seiche event.

Emergency Diesel Generator Fuel Oil System As noted above, it was determined subsequent to the SEP analysis, that emergency diesel generator fuel oil system would need to function to assure safe plant shutdown. As a result, the fuel oil transfer. system, including pumps and storage tanks are now required for the specified coping time for safe shutdown. Several aspects of the fuel system w~re found to be -~

deficient with respect to safety related design criteria : - - .. * -

1. The design of the T-10 fuel oil supply tank does not meet design criteria for withstanding the effects of a tornado missile, and may not withstand the affects -

of a design basis flood.

2. Portions of the fuel oil piping from the T-10 tank to the emergency diesel generator day tanks have not been verified to be able to withstand the effects of tornado missiles, or seismic event.

3. The design of the fuel oil system does not provide automatic isolation of non-essential fuel oil loads upon the initiation of a design basis event.

Since these determinations have_ been made, a seiche protection barrier around the fuel oil transfer pumps, (located at elevation 590 in the Service Water Pump Building) has been constructed._

CPCo has docketed commitments to resolve these design deficiencies by the end of the refueling outage following the 1995 refueling outage (Refs. 5-26, 5-27, 5-28). _These modifications will complete necessary actioris to mitig_ate the effects of design _basis flooding at

• Palisades.

-5.2.3.2_ Probable MaXimum Precipitation Generic Letter 89-22 (Ref. 5-29) informed licensees of operating reactors that more recent probable maximum precipitation (PMP) criteria had been published by the National Oceanic and Atmospheric Administration (NOAA) and the National Weather Service (NWS)(Ref. 5-30)

(Ref. 5-31), and (Ref. 5-32). According to the generic letter, these new criteria may result in higher site flooding levels and greater roof ponding loads than may have been used previously.

The older PMP for Palisades was 25.5 inches in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> - 10 square miles {Ref. 5-32).

The impact of the new PMP on the magnitude of external floods was discussed in the preceding section. This section will review the affect of the new PMP on roof ponding .

• 5-17

The PMP assumed for the roofs at the site was determined to be the smallest drainage area for which PMP values are estimated in the NOAA/NWS reports, one square mile. This assumption is consistent with the drainage area indicated as appropriate by Generic Letter 89-

22. In order to maintain conservatism, a one-hour duration for the precipitation was used, since the data indicate that PMP values are maximum for this tilne period for a one-square-mile drainage area. According to the NOAA/NWS report "Application of the PMP Estimates

- United States East of the 105th Meridian" (Ref. 5-31), Figure 24, the one hour, one-square-mile PMP for the Palisades site is approximately 17.4 inches. Figures 36 through 38 of the same report were used to develop a graph of PMP versus time for the one-hour .PMP. These results are shown in Figure 5.2-1. This figure shows that 9.27 inches of precipitation falls in the first 15 minutes for this PMP estimate, which exceeds the 7. 7 inch design iiimt for those buildings that have a 40 pounds per square foot live load capacity. Consequently, the drainage capability of these buildings was examined, and the roof and building drawings were reviewed to identify design features which might mitigate the effects of roof ponding. These drawings

. were supplemented by a walkdown to confirm as-built dimensions.

In review of the Palisades buildings, the only roof of potential concern is the SFP roof which is built to a 50 lb/ft2 design loading capacity. A calculation (Ref. 5-33) of maximum water depth using the PMP yielded a level of 10.2 inches. This level exceeds design but is less than yield.

• • Based upon the foregoing, using both a conservative approach and data, it is concluded that the new PMP criteria do not represent a credible threat of severe accidents, and may be screened from further consideration.

5.2.4 Transportation and Nearby Facility Accidents As with other hazards discussed in this section of the report, the SEP process provided a systematic assessmentof hazards due to transportation and nearby facilify accidents (SEP Topic 11~1.C, "Potential Hazards Due to Nearby Industrial, Transportation and Military Facilities"). This topic addressed the 1975 SRP sections 2.21, 2.22, and 2.23. It was concluded that Palisades was adequately protected and could be operated with an acceptable degree of safety with respect to industrial and transport4tion activities in the vicinity of the .

plant (Ref. 5-34).

In a related subject, the effect of such events upon control room habitability was evaluated as part of the response to the TMI Action Plan, NUREG-0737, Task 111.D.3.4, "Control Room Habitability". This evaluation was conducted in accordance with Regulatory Guides 1. 78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release" (Ref. 5-35), 1.91, "Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants" (Ref. 5-36), and

1. 95, "Protection of Nuclear power Plant Control Room Operators against an Accidental

• 5-18

Chlorine Release" (Ref. 5-37). The.NRC Safety Evaluation Report concluded that the control room design (including committed improvements) me~ts the review criteria (Ref. 5-38).

The following paragraphs discuss the results of reviews conducted to determine whether the SEP results remain valid considering updated hazard conditions.

5.2.4.1 Transportation Accidents 5.2.4.1.1 Roads/Highways The nearest transportation routes to the plant are US Route 33 (3600 feet) and *interstate I-196 (4200 feet) at their closest approach. The highway separation distances from tµe Plant exceed the minimum distance criteria given in the Regulatory Guide 1.91, Revision 1. This distance, therefore, provides reasonable assurance that transportation accidents resulting in explosions of truck-sized shipments of hazardous materials will not have an adverse effect on the safe operation of the Plant. This is without any consideration of the potential deflection capability of the forested dunes between the plant and the transportation routes.

5.2.4.1.2 Railroads The. nearest railroad, the Chesapeake and Ohio line, is about 9 miles to the east of the site.

Potential railroad accidents involving hazardous materials are not considered to be a credible risk to the safe operation of the plant from this distance (i.e., this distance exceeds the generic acceptance criteria of Reg. Guide 1. 91). Therefore, rail car accidents are not considered as credible thre~ts to the safe operation of the plant.

• 5.2.4.1.3 Great Lakes Shipping There are no large cotnmercial harbors along the western s~ore of Lake Michigan near the

• plant.. Some freight is shipped through the St. Joseph harbor about 17 miles to the south. The FSAR states that the Major shipping lanes in the lake are located well offshore, *at least 10 miles or more from the plant. In a visit to the US Coast Guard Station in St. Joseph, it was pointed out from their navigational maps (Ref. 5-39) that the nearest shipping lane is the north bound lane which is 35 miles offshore from the plant. Ships going into and out of St. Joseph*

would be at least ten miles away; and therefore, lake shipping is not considered to be a hazard to the plant.

5.2.4.1.4 Pipelines The nearest large pipelines to the plant lie in a corridor about three miles southeast (Ref. 5-7).

However, a new 4" gas pipeline, 1. 25 miles from the plant, was put into service in the fall of 1993 to service a manufacturer's training and conference center. At this distance, and with

• 5-19

forested dunes between the plant and the gas line, the 4" line is of insufficient size for either an explosion or control' room habitability (leak) concern.

Larger pipelines including a 22" and a 30"- 42" diameter natural gas pipeline and a 10-inch diameter petroleum products pipeline, are located east of Covert, about 4 miles away, at the nearest point. There are no gas or oil production fields, underground storage facilities or refineries in the vicinity of the Plant. Again, as discus~ed above, these pipelines are far enough away that pipeline accidents will not affect the safety of the nuclear plant.

5.2.4.1.5 Aviation The U.S. NRC has issued the following acceptance criteria in their Standard Review Plan (SRP Section 3. 5 .1. 6, " Aircraft Hazards") for the siting of nuclear power plants near airports and/or airways:

The probability of an aircraft accident resulting in radiological consequences greater than 10 CFR Part 100 exposure guidelines is considered to be less than lE-7 /yr if the distances from the plant meet all of the requirements listed below:

a. The plant-to-airport distance D is between 5 and 10 statute miles, and the projected annual number of operations is less than 500 D 2 , or the plant-to-airport distance D is greater than 10 statute miles, and the projected annual*

number of operations.is less than 1000 D 2 ,

b. . The plant is at least 5 statute miles from the edge of military training routes, including low-level training routes, except for those associated with a usage greater than 1000 flights per year, or where activities (such as practice bombing) piay create an µnusual stress situation, -

c. Th~ plant is at least 2 statUte miles beyond the nearest edge of a federal a~ay, holding pattern, or approach pattern.

These conditions are discussed in the following paragraphs.

Airports The closest airport to the Plant is the South Haven Regional Airport. The South Haven Regional Airport is a general aviation facility located approximately three miles northeast of the Plant. Southwest Michigan Regional Airport (Ross Field) in Benton Harbor is approximately 15 miles south of the Plant and had 58,000 operations in 1994. Ross Field has approximately 25 military business fly-ins per year. Due to its proximity, the South Haven Airport is the only airport facility of concern to the plant.

• 5-20

There are currently 22,000 operations per year (1994) at the South Haven airport, where an operation is either a takeoff or a landing. The airport is used for general aviation activities such as business and pleasure flying and for agricultural spraying operations. There are twenty-five single engine and three twin engine aircraft with gross weights from 1,250 to 5,200 pounds based at the airport. Other aircraft with weights up to 12,500 pounds will land at the South Haven Airport on an infrequent basis.

The NRC, based on evaluations performed in several licensing reviews, has concluded that nuclear power plant structures which are designed to withstand tornado missiles and other design loads can withstand the collision forces imposed by light general aviaticm aircraft without adverse consequences. Safety-related equipment located outside of such structures, however, would be vulnerable to a light airplane crash (Ref. 5-40).

During the SEP process, an assessment was made of the probability of a light aircraft striking vulnerable plant equipment (SEP Topic 111-4.D, "Site Proximity Missiles). This assessment conservatively determined the probability of such an event to be d.55E-7 per year. The probability of an aircraft striking the spent fuel pool was also determined at this time, at

~2.5E-8 per year (Ref. 5-40).

Since the SEP assessment was conducted, the South Haven Airport has increased the size and condition of its runways slightly and the total operations have increased from 20,000 to 22,000 annually. The increase in operations has increased the probability of an aircraft striking such equipment to d.7E-7 per year (Ref. 5-41), which is still within the SRP 2.2.3 criteria of acceptability. The increased operations has also increased the probability to the spent fuel pool to ~2.8E-8 per year (Ref. 5-41). These probabilities remain acceptably low.

The Independent Spent Fuel Storage Installation (ISFSI) was certified May 7, 1993. The ISFSI was evaluated for the probability of aircraft_ striking storage casks and determined to be

~ 3. OE-7 per year (Ref. _5-41). The increase ill_ aircraft operation at South Haven Airport to 22,000 has increased this probability to i3:3E-7 per year (Ref. 5-41). This still meets the SRP 2.2.3 acceptance criteria, and the analysis still employs the same conservatism, i.e., assuming all flights fly over the dry fuel storage pad.

• Military Bases There are no nearby military air bases. The nearest facility is the Air National Guard in Battle Creek, Michigan, some 60 plus miles from the plant. Based on phone conversations with personnel at local and regional airport authorities (South Haven, Southwest Michigan, and Chicago) (Ref. 5-42) (Ref. 5-43) (Ref. 5-44), there are no military training routes within 30 miles of the site, therefore, military activities are not considered as a credible risk to the safe operation of the Plant.

5-21

Federal Airways Accordmg to the FAA , the nearest Federal Airways are three low altitude airways (V193, V84 & V55) which pass 4 miles northwest, 9 miles northwest a.nd 10 miles east of the plant respectively. From 14 CPR 71. 75 (Extent of Federal Airways), each Federal Airway is based on a center line that extends from one navigational aid or' intersection to another navigational aid (or through several navigational aids or intersections) specified for that airway. Each

. Federal airway includes the airspace within parallel boundary lines 4 miles each side of the center line. The Federal airway airspace can also include the airspace between lines.diverging at angles of 4. 5° from the center line at each or either end of the navigational. aj~ depending on their relative positions, as defined in 14 CFR 71.75. The Palisades plant is*~pproximately 4 miles from the center line of the Federal airway V-193, and this does not meet the condition to be 6 miles from the center or two miles from the edge of a Federal airway. This Federal airway (V-193) is the only Federal airway of concern to the Plant.

According to the FAA, there is no traffic regularly scheduled on V-193 between the intersection of V-100 and V-193, and the Pullman, MI VORTAC (Very High Frequency Omni-Directional Tactical Navigation Aid). (Ref. 5-45). Traffic in this area is Chicago metropolitan departure or arrival traffic on vectors, for the most part, north or south of the Plant. The traffic is a random mix of land based, 2 engine piston, 2 engine turboprop, 2 and 3 engine turbo-jet, and an occasional 4 engine turbo-jet. The FAA examination of the traffic in this area indicates a maximum traffic flow of slightly less than 2200 flights per year.

Applying the aircraft hazard equations of the SRP, section 3.1.5.6, "Aircraft Hazards"', which are restated in NUREG/CR-5042, section 6.4 (Ref. 5-4), the probability per year of an aircraft crashing into the plant is conservatively 9.6E-8 (Ref. 5-41). The area used in the equation was conservatively calculated to include all structures which *contribute to normal operation, io safe shutdown operation and the independent spent.fuel.storage installation (ISFSI). This area was then doubled in the equation for" additional co.nservatism.

Based upon the foregoing update of current Federal air traffic near the Palisades site, the

• probability of damage to the plant from this source is a~ceptably low and screened from further evaluation.

Based upon the foregoing review of current transportation related hazards, no further consideration of such events is warranted.

5.2.4.2 Nearby Industrial Facilities The SEP assessment of nearby industrial facilities noted that :

"There is little industrial activity in the vicinity of the Palisades Plant. The nearest concentration of industrial activity is located in the South Haven area and consists 5-22

primarily of light manufacturing facilities. Regional planning officials have stated that to their knowledge, no industrial developments are planned for the vicinity of the nuclear plant" (Ref. 5-34).

A recent review of current industrial facilities indicates this conclusion remains valid (Refs.

5-46, 5-47).

5.2.4.3 On-site Storage Hazardous Material Releases/On-site Hazards The release of hazardous material from on-site storage presents a potential thre~~ through the possibility of incapacitating control room operators or challenging safe shutdown capability.

This issue has been the subject of two prior regulatory mandated reviews : (1) *sEP Topic 11-1.C, "Potential Hazards due to Nearby Industrial, Transportation and Military Facilities (1981), and (2) NUREG-0737, Item 111.D.3.4 "Control Room Habitability"(l982). The latter review was done in accordance with Regulatory Guide 1. 78 " Assumpti~ns for Evaluating the Habitability of *a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release" (Ref. 5-35), and Regulatory Guide 1.95, "Protection of Nuclear Power Plant Control Room Operators Against an Accidental Chlorine Release" (Ref. 5-37). The U.S. Nuclear Regulatory Commission completed the two reviews, and issued their Safety Evaluation Reports (Ref. 5-34)(Ref. 5-38). The following paragraphs briefly discuss the pertinent results of those reviews, and recent reviews to determine their continued applicability.

Two calculations were performed in support of the NUREG -0737 Control Room Habitability assessment, postulating (nearby highway off-site) spills of hydrogen cyanide and chlorine (Ref.

5-48). In both cases, the concentrations conservatively analyzed to reach the control room were considered acceptable. Recent wind rose data (Ref. 5-49) has been reviewed, and found to be consistent with that used in the referenced calculation.

On-site chemical u_sage has decreased since the above referenced reviews, resultant from regulatory activity. Current usage (Ref. 5-50) of hazardous chemicals on-site is limited to:

- Hydrazine

- Sodium Hydroxide

- Sodium Hypochlorite

- Sulfuric Acid *

- Aliphatic Petroleum Distillates

- Gasoline (Benzene) *

- Nitrogen (liquid)

These on-site chemical sources have not changed in quantity, or in proximity to the control room since the above referenced reviews .

• 5-23

5.2.4.4 Other On-site Hazards Hydrogen Hydrogen, used for electrical generator cooling, is stored south of the turbine building in six cylindrical tanks. If a hydrogen tank were to explode, a plant trip could occur due to failure of the insulators on the nearby transformers and failure of the switchgear structure housing F and G buses. The loss of F and G buses results in the tripping of the cooling tower pumps and the cooling tower fans. Such an event would result in a plant trip, an event analyzed in the IPE. . .....

In selecting review criteria, Regulatory Guide 1. 91 "Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants" was considered, but not used.

The guide does provide a review methodology for deriving minimum distances between transportation routes, and safety related structures. This guide is based upon much larger quantities of explosive than is available from the explosion of a single plant hydrogen tank.

• The attendant conservatisms applied to such large quantities are not appropriate to smaller quantities. Additionally, the guide is limited to solid and hydrocarbons liquified under pressure, and not applicable to compressed gasses. Finally, the guide specifically considers the effects of explosions due to railway, highway, and water routes, excluding fixed facilities, such as plant hydrogen tanks.

EPRl's "Guidelines for Permanent BWR Hydrogen Water Chemistry Installations" (Ref. 5-51) provides a methodology specifically for assessing the hazard presented by this tank to surrounding safety related equipment. The method determines the amount of explosive material (expressed in pounds of TNT) and the resultant minimum distances from walls of various strengths. The reference provides a relationship between minimum required separation distance to safety-related structures, and (gaseous hydrogen) vessel size. -With this conversion .

applied to the rupture and explosion of one of the- six 90 ft3 (1500 psi nominal operating gas pressure) tan}cs, a volume of about 9800 SCF hydrogen gas is available. Using this value, and Figure 5.2-2 (taken from reference 51), a required distance of 120 feet is determined for wall at least 8" thick. As the nearest building containing safety related equipment is over 150 feet away (Screen House - 24" thick walls), it is concluded that the hydrogen tanks do not pose a credible threat to the plant.

Propane North of the turbine building is located a propane tank, associated with heating boiler operation.

Reviewing the equipment in proximity to the propane tank it was noted that there are electrical conduit lines running nearby into the turbine building electrical raceways. The circuits in 5-24

these conduits were reviewed and found to contain no equipment important to safe plant shutdown (Ref. 5-52).

Station power transformer #17 and the associated switchgear are located approximately 45'-50' away from the propane tank. Transformer #17 feeds 480V bus #17 for miscellaneous

• non-safety related equipment such as, auxiliary boiler M-24, MCC#18, outage welder supply, transformer #69 (temporary trailer power supply) and other miscellaneous equipment. The loss of the station power transformer #17 would not affect the pl~t ability to achieve safe shutdown.

• Additionally, the emergency diesel generators are located nearby. The emergency diesel generators are located within the CPCo Class 1 portion of the* Auxiliary Building, and have walls 18" thick. The ability of this structm:e to withstand missiles generated by a design basis tornado was evaluated during the SEP (Topic 111-4.A, "Tornado Missiles"), in accordance with SRP section 3.1.5.4, "Missiles Generated by Natural Phenomena". It is judged that the forces exerted by the SRP design missiles encompass those possibly generated by an explosion of the propane tank .

• 5-25

5.2.5 Tables and Figures for Assessment of Other External Events Table 5.2-1 Comparison of NRC Criteria to Palisades Auxiliary Building Addition Design NRC Guide Palisades Aux Bldg Topic Guide 1.76 Addition (FSAR)

Maximum wind speed ..... "

(tornado loading) 360 mph 300 mph Translational speed 70 mph* - 60mph Pressure drop 3.0 psi 3 psi

• Maximum wind speed (tornado missiles) 360 mph 360 mph Utility pole missile 1490 lbs. 1490 lbs Utility pole missile 144 mph 144 mph Utility pole missile 30 ft above ground . 30 ft above ground Utility pole missile (ht/ diameter) 35 ft/13.5" 35 ft/13.5" Automobile 4000 lbs 4000 lbs Automobile 72 mph 72mph Automobile 30 ft above ground 30 ft above ground Automobile 20 SQ ft contact area 20 SQ ft contact area Steel rod (1 "x3' long - 8#) 216 mph 216mph Wood plank (4"x12"x12') 200# 108#

Wood plank (4"xl2"x12') 288 mph 300 mph 5-26

FIGURE 5.2-1 PALISADES PROBABLE MAXIMUM PRECIPITATION PMP VS TIME FOR 1 SQUARE MILE DRAINAGE AREA 1;* _:-

".~ ~: .

20 18 17.4 16

-Cl)

~ 12 14 0

c:

.. 10 9.27 a..

~

a.. 8

• 6 4

2 5.88 0

0 5 10 15 20 .25 30. 35 40 .45 50 55 .. 60.

• T,IME (minutes)

• 5-27

• FIGURE 5.2-2 MINIMUM REQUIRED SEPARATION DISTANCES TO SAFETY-RELATED STRUCTURES VERSUS VESSEL SIZE FOR GASEOUS HYDROGEN STORAGE SYSTEM

.. . . .~

~ 18-inch reinforced concre1e

=

.. 140 Ill (a) P, i!!

: 1.5 pSi:[~Ja::

100%

0.12 ksi

~

II

~ (b) P, 2 3.0 psi:[~J:!!: 0.30 ksi 100%

<ii 120

'E

.a

-~

... Reinforced wall

]? 100

.,, a:: 8 inches lliick V>

g Ql g

n:I 80 iii c5 c

.g

~ 60 a.

C>> .

en

~

Ql

• ~ 40

~

~

E

)

E

• c: 20

i

• o &.....~-----"~~---"--------'--------'-~--~""---~---.__----__.

0 2 4 6 8 10 12 14 Vessel Size (thousands of SCF per vessel)

• 5-28

5.3 Conclusions Based upon the foregoing discussions, we conclude that there are no 'other' external events (not considering fire and seismic events) that are a safety concern to the Palisades Plant.

Specific attention was given to consider changes in plant facility or hazard that have occurred since the conduct of the Palisades SEP. No vulnerabilities were identified and the screening criteria (modified from NUREG-1407) are satisfied for all events.

• . *.-.~:..-:

• 5-29

5.4 References 5-1 NRC Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CPR 50.54(f), April 1991 5-2 NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 5-3 NUREG-:0820, Integrated Plant Safety Assessment - Systematic Evaluation Program, Palisades Plant, Final Report, October 1982 ,.,.

.*.. ~* .

5-4 NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power Plants in the United States, Supplement 2, February 1989 5-5 Palisades Nuclear Plant Individual Plant Examination (IPE), November 1992 5-6 Palisades Off-Normai Procedure ONP 6.1, Loss of Service Water 5-7 Palisades Final Safety Analysis Report 5-8 Letter from RAVincent (CPCo) to DMCrutchfield (NRC), subject: Palisades Plant -

SEP Topics 11-4 Geology and Seismology, and 11-4 Proximity of Capable Tectonic Structures in Plant Vicinity, 7/22/81 5-9 Letter from DPHoffman (CPCo) to DMCrutchfield (NRC), subject: Palisades Plant -

SEP Topics 11-4.D Stability of Slopes, and 11-4.F Settlement of Foundations and Buried Equipment, 6/1181 5-10 NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power Plants in the United States, December 1987 5-11 Regulatory Guide 1. 76, Design Basis Tornado for Nuclear Power Plants, April 1974 5-12 Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978 5-13 Letter from T\'Wambach (NRC) to DPHoffman (CPCo), subject: SEP Topic 111-2, Wind and Tornado Loadings - Palisades, 2/8/82 5-14 Letter from TVWambach (NRC) to DPHoffman (CPCo), subject: SEP Topic lll-4A, Tornado Missiles - Palisades, 2/2/82 5-15 Letter from JLKuemin (CPCo) to Document Control Desk (NRC), subject: Palisades Plant - SEP Topics llI-2, 111-4.A, V-lOB and VII-3, 1/30/87

• 5-30

5-16 Letter, DWRogers (CPCo) to NRC Document Control Desk,

Subject:

Palisades Plant Electric Diese1 Generators - Testing and Fuel Oil Supply - Supplementary Information Revision 1, 10/27/94 5-17 HVAC Duct Construction Standards - Metal and Flexible, 1st Edition, Sheet Metal Arr Conditioning National Association, 1985 5-18 American Society of Civil Engineers (ASCE) Paper No. 3269 5-19 ANSI A58 .1, Building Code Requirements for Minimum Design Load~:~ Buildings

• and Other Structures, Committee A58. l, American National Standards'*histitute 5-20 Civil/Structural Design Criteria for Control Room Heating, Ventilating, and Air Conditioning and Auxiliary Building AdditiOn for Consumers Power Company Palisades Nuclear Plant South Haven, Michigan, Bechtel Associates Professional Corporation, 7/1182, Rev. 0 5-21 Tornado and Straight Wind Hazard Probability for Palisades Nuclear Power Reactor Site, Michigan, JRMcDonald, P.E., May 1980

)

.5-22 ANSl/ANS-2.3-1983, American National Standard for Estimating Tornado and Extreme Wind Characteristics at Nuclear Power Sites 5-23 Regulatory Guide 1.59, Design Basis Floods for Nuclear Power Plants, August 1977 5-24 Letter from TVWambach~ NRC, to DNandeWalle, CPCo, 2/19/82, subject: Palisades

- SEP Topic 11-3.A, Hydrologic Description, 11-3.B, Flooding Potential and Protection Flooding Conditions, and 11-3.C, Safety Related Water Supply (Ultimate Heat Sink)

• 5-25 Letter from TVWambach (NRC) to DNandeWalle (CPCo), subject: Palisades - SEP.

Topic 11-3.A, Hydrologic Description, 11-3.B, Flooding Potential and Protection Requirements, 11-3. B.1, Capability of Operating Plants to Cope with Design Basis Flooding Conditions, and 11-3.C, Safety-Related Water Supply (Ultimate Heat Sink),

10/7/82 5-26 Palisades Event Report: E-PAL-93-010, EDG Fuel Oil Supply , 3-8-94 5-27 Palisades Request for Modification RFM-1511, Diesel Fuel Oil Transfer System .

Upgrade, 10/12/94 5-28 Letter from KMHaas (CPCo) to Document Control Desk (NRC), subject: Emergency Diesel Generators - Completion of Fuel* Oil Supply System Modifications -

Supplementary Information, 10/27 /94

• 5-31

5-29 Generic Letter 89-22, Potential for Increased Roof Loads and Plant Area Flood Runoff Depth at Licensed Nuclear Plants due to the Recent change in Probable Maximum Precipitation Criteria Developed by the National Weather Service 5-30 National Oceanic and Atmospheric Administration (NOAA), National Weather Service (NWS) Hydrometeorological Reports (HMR) #53, Seasonal Variation of 10-Square Mile Probable Maximum Precipitation Estimates, United States East of the 105th Meridian , April 1980 5-31 National Oceanic and Atmospheric Administration (NOAA), Nationa~ :Weather Service (NWS) Hydrometeorological Reports (HMR) #52, Application of the *p:MP Estimates -

United States East of the 105th Meridian, August 1982

• 5-32 National Oceanic and Atmospheric Administration (NOAA), National Weather Service (NWS) Hydrometeorological Reports (HMR) #51, PMP Estimates, United States East of the 105th Meridian, June 1978*

5-33 Palisades Calculation EA-CALC-95-01, Probable Maximtim Precipitation and Roof Ponding 5-34 Letter from DMCrutchfield (NRC) to DPHoffman (CPCo), subject: SEP Topic 11-1.C, Potential Hazards due to Nearby Industrial, Transportation and Military Facilities (Big Rock and Palisades), 5/13/81 5-35 Regulatory Guide 1. 78 : Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, June 1974 5-36 Regulatory Guide 1.91, Evaluations of Explosions Postulated io Occur on Transportation Routes Near Nuclear Power Plants, Revision 1, February 1978 5-37 Regulatory Guide 1.95; Protection of Nuclear power Plant Control Room Operators against an Accidental Chlorine Release, Revision 1, January 1977 5-38 Letter from DMCrutchfield (NRC) to DNandeWalle (CPCo), subject: NUREG-0737, Item 111-D.3.4, Control Room Habitability - Palisades Plant, 4/29/83 5-39 Navigational Maps - United States - Great Lakes - Lake Michigan Waukegan to South Haven, Soundings in feet, Loran - C Overprint.#14905, 26th Edition, 3/9/91 5-40 Letter DMCrutchfield (NRC) to DPH.offman (CPCo), subject: SEP-Topic 111-4.D, Site Proximity Missiles, 8/3/81 5-32

5-41 Palisades Calculation EA-CALC-95-02, Airplane Traffic Hazard 5-42 Telephone Conversation with Don Woodhams, South Haven Airport Authority, 1116/95

• 5-43 Telephone Conversation with John Chaddock, Southwest Michigan Regional Authority (Ross Field), 1117 /95 5-44 Telephone Conversation with Bill Ottens, Chicago Air Route Traffic Control Centers (ARTCC), FAA, Aurora Illinois, 1/18/95 ,-

5-45 Letter from DCBurke, Air Traffic Manager - Chicago ARTCC, to DLAllen (CPCo),

subject: Traffic on V-193, South Haven Airport, Visual Flight Rules, 1120/95 5-46 Telephone Conversation with JBland, Southwest Michigan Growth Alliance - Regional Planning Authority, 10/5/93 5-47 Telephone Conversation with CDehn, South Haven Economic Development Assocfation, 10/5/93 5-48 Letter from Brian D. Johnson, CPCo, to Dennis M. Crutchfield, NRC, 10/19/82 subject: NUREG-0737, Item III.3.4, Control Room Habitability - Additional

• Information 5-49 1989-1993 Annual 10 and 60 Meter Wind Roses for Palisades, Dennis Kahlbaum, CPCo, 7/25/94 5-50 Letter from Joe Hager, CPCo, to Michigan Department of Natural Resources, 2/14/95

SARA Title III - Tier II Reporting for Consumers Power Company ~alisades Nuclear fuAf .

5-51 EPRI Report NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations, September 1987 5-52 CPCo Memo from DLAllen to PRA file 91-03, subject: IPEEE Other External Events Walkdown Observations 5-33

TABLE OF CONTENTS SECTION 6.0 LICENSEE PARTICIPATION AND INTERNAL REVIEW 6.1 IPEEE Program Organization 6-1 6.2 Composition of Independent Review Team 6-2 6.3 Resolution of Major Comments

6.0 LICENSEE PARTICIPATION AND INTERNAL REVIEW One of the major benefits from the IPEEE process is for the licensee to obtain knowledge and understanding of severe accident behavior at its plant through the performance of the IPEEE.

Also, involvement by utility personnel allows more efficient use of the knowledge gained from the performance of the IPEEE to be applied to plant improvemen~. To realize the greatest benefit, utility participation must be maximized. This is achieved through utility participation in the development and independent review processes. Palisades committed extensive personnel resources to the development and review of the IPEEE.

'*.. ; ~'

6.1 IPEEE Program Organization The IPEEE was performed by the Palisades PRA group with assistance from consultants (TENERA, L.P.; Stevenson and Associates; and J.R. Benjamin and Associates). The Palisades PRA group was responsible for developing the IPEEE and coordinating the efforts of utility and consultant personnel.

The Palisades PRA group was instrumental in developing the IPE submittal. Many of the same personnel involved in that effort were involved in the IPEEE development. With this type of experience and plant knowledge, the IPEEE modelling was performed by the utility along with portions of the independent review. Consultants provided general direction and methodology guidance as well as an independent review of the IPEEE.

The walkdowns were performed by consultants and utility personnel. The seismic fragility development for the components was performed by consultants. Modifying the IPE models for the fire and seismic events and quantifying the models was performed by utility personnel.

Methodology review and guidance was provided by consultants. The independent review was performed by both utility personnel and consultants.

6-1

6.2 Composition of Independent Review Team The independent review of the IPEEE was performed in three parts: seismic; fire; and other events.

• Each part received an internal and external independent review.

Seismic The seismic PRA received an independent review of the methodology by Dr. R.P.* Kennedy and Dr. J.D. Stevenson. This review evaluated the walkdown methods, Screening _

Evaluation Worksheets (SEWS) and other seismic documentation prepared-for Palisades.

Also, the seismic modelling and quantification setup and results were review~ by J.R.

Benjamin and Associates (JRB). The hazard integration program SHIP was developed by JRB and used by Palisades for final seismic quantification. In addition, the seismic results and report was reviewed by the Palisades structural group and TENERA. The Palisades structural group was involved in the performance of the resolution of USI A-46. TENERA has experience .with several IPEEEs, including seismic PRAs.

Fire The fire IPEEE received an independent review by utility persqnnel and TENERA. The in-house review was performed by the Fire Protection Group, which recently completed a re-evaluation of the Appendix R project, and the Operations Department. TENERA has experience with several IPEEEs, including fire analysis.

Other External Events .

The other external events IPEEE received an independent review by utility personnel and TENERA. The in-house review was performed by the Licensing group. The individual that performed the independent review was inyolved in many of the SEP topics covered in the*

other external events analysis. TENERA has experience* with severnl IPEEEs, including other external events,analysis.

J Revision 1, May 22, 1996 6-2

6.3 Resolution of Major Comments The results and comments of all the reviews were formally documented and dispositioned.

Changes to the models and requantification was performed for any comments that were anticipated to impact the results of the IPEEE. .

. '*.. ~-.... .

• 6-3

TABLE OF CONTENTS SECTION 7.0 PLANT IMPROVEMENT AND UNIQUE SAFETY FEATURES 7.1 Unique Safety Features and Insights 7-1 7.1.1 Unique Safety Features 7-1 7.1.2 IPEEE Insights . '7-1 7 .2 Plant Improvements

(~

7.0 PLANT IMPROVEMENT AND UNIQUE SAFETY FEATURES

• 7.1 Unique Safety Features and Insights One unique safety features and no new insights were identified in the IPEEE that were not identified in the IPE.

7.1.1 Unique Safety Features The unique safety feature identified in the IPEEE was the high safe shutdown earthquake (SSE) design basis for this region. The Palisades design basis SSE is 0.20g. *This high design basis SSE contributes to the high seismic capacity of engineered safeguards equipment at Palisades. There were no seismic vulnerabilities or weaknesses in the engineered safeguards equipment at Palisades.

7.1.2 IPEEE Insights There were 5 significant insights discussed in the Palisades IPE:

1) small break LOCA as a significant contributor to core damage probability;

2) failure of a single component with a small break LOCA initiator leading to core damage;*

3) loss of off-site power as a significant contributor;

4) condensate storage tank makeup capabilities; and

5) safety injection and r~fueling water tank makeup capabilities.

Insights 1, 2 and 5 pertain to LOCAs. The IPEEE did not receive any contribution to core damage frequency from any LOCAs. Therefore, these three IPE insights are not applicable to the IPEEE results. Insights 3 and 4 have similar contributions to the results of the IPEEE. No additional insights were identified as a result of the IPEEE .

• 7-1

7 .2 Plant Improvements No major plant changes have been identified as a result of the IPEEE. The IPEEE confirmed that the reactor cavity sump improvements identified in the Palisades IPE would provide a similar benefit in the IPEEE.

The Palisades USI A-46 program performed a rel&y review. The relay review identified 17 outlier relays. The SPRA expanded *that review to include all SPRA relays with no additional 'bad actor' relays identified. The Palisades SPRA assumes that the outlier relays identified in the USI A-46 program will .be properly dispositioned in the SQUG program and that specific seismic modelling for these relays was not included in the SPR.t\..' '

The fire analysis identified several significant operator actions that impact the fire core damage frequency. Operator training will be conducted on all of the operator actions credited in the IPEEE that were not credited in the IPE, including the fire risk significant operator actions.

• Revision 1, May 22, 1996 7-2

TABLE OF CONTENTS

• . 8.1 Results SECTION 8.0 RESULTS AND CONCLU~IONS.

8-1

.8.1.1 Seismic 8-1 8.1.2 Fire 8-2.

8.1.3 Other External Events *< ;,8-2.

8.2 Conclusions *. ~ 8-3

8.0 RESULTS AND CONCLUSIONS This section presents a summary of the results and conclusions of the IPEEE. The results and conclusions are presented in three parts: seismic; fire; and other external events.

8.1 Results Detailed discussions of the results are presented in Section 3.6 for seismic, Section 4.17 for fire and Section 5.2 for other external events. This section presents a summary of the detailed results discussions.

• -:***i.* ..

8.1.1 Seismic There were no significant seismic concerns identified as a result of the seismic PRA (SPRA).

The new Lawrence Livermore National Laboratory (LLNL) hazard curves, as contained in NUREG-1488 (Ref. 1-6), were used to evaluate the SPRA. The SPRA mean core damage frequency is 8.88E.:.Q6/yr, which is considerably less than the IPE (internal events) core damage frequency of 5.15E-05/yr. The median fragility (capacity) of the plant is .488g peak

• ground acceleration (PGA) and the high confidence of a low probability of failure (HCLPF) is .217g PGA. Both of these results are higher than the Palisades safe shutdown earthquake design of .20g PGA.

None of the Accident Classes (defined in Section 3.6.4) met the screening requirements for reportability as defined in Generic Letter 88-20. The two highest contributors to core damage frequency are Accident Classes IA (loss of secondary heat removal and failure of once through cooling during the injection phase) and IB (loss of secondary heat removal with failure of once through cooling during the recirculation phase). Accident Class IA contributed approximately 36 3 and Accident Class IB contributed approximately 34 % to the core damage frequency. The rest of the contribution comes from: Ac~_ident Class II (failure

• of containment heat removal) with a contribution of 3 %; failure -of the reactor building or _

auxiliary building, each with a contribution of 11 3; and complete. faiiure of all components a

with contribution of 5 %.

A review of the-results of the SPRA conclude that:

1) there are no dominant seismic failure modes contributing to the core damage frequency; _

2) non-seismic failures and operator errors are an important part of the SPRA core damage frequency; and

3) the engineered safeguards equipment are inherently rugged with no seismic vulnerabilities.

Important seismic contributors include the fire protection system (FPS), MSIVs, diesel fuel oil storage tank (T-10), and bus lD undervoltage relays. The FPS is a high contributor

• Revision 1, May 22, 1996 8-1

mainly due to condensate *storage tank (CST) makeup, for which the FPS is a major alternative following loss of off-site power (normal makeup sources). The MSIVs have a

• potential interference which might prevent them from closing, thus, inducing a two steam generator blowdown scenario upon failure of one ADV to close. Both diesel generators have a common long term fuel oil storage tank (T-10), which is important following a loss of off-site power. Bus lD becomes important for powering the AFW pump P-8C, which is the

• only AFW pump available following loss of the FPS.

8.1.2 Fire The fire core damage frequency is 3.31E-05/yr. Over 89% of the plant risk.~'sociated with internal fires can be traced to five fire areas: cable spreading room; main control room; 1D

. switchgear room; turbine building; and lC switchgear room. The fire results are dominated by Accident Class IA (59.4%), which is failure of secondary cooling and failure of once through cooling during the injection phase. Another significant contributor is Accident Class IB (39.6%), which is failure of secondary cooling and failure of once through cooling during recirculation.

The results of the Fire IPEEE accident sequence quantification were derived from a .

methodology that includes a number of conservative assumptions. Fires were assumed to increase until they completely engulfed the area/zone where they were located, .except where suppression was credited. In addition, with the exception of the main control room, cable spreading room and the 2.4kV switchgear rooms (lC and lD switchgear rooms), the effects of suppression were not credited. Therefore, the methodology as applied has resulted in po~entially conservative results.

• The core damage frequency in several fire areas is reduced due in large part to Palisades plant specific implementation of the requirements of 10 CPR 50, Appendix R. These requirements, including separation of alternate/redundant ~ains of safe shutdown equipment, fire barriers, and an alternate shutdown location (outside of control/cable spreading rooms) combine to liffiit the total core damage frequency due to fires. The admimstrative control of transient combustibles is also a contributing factor to the low fire core damage frequency in certain key areas.

8.1.3 Other External Events There were no other external events identified that have an impact on the core damage frequency at Palisades. All of the screening criteria used from NUREG-1407 and Generic Letter 88-20, Supplement 4 were satisfied. Results of the Palisades Systematic Evaluation Program (SEP) were used, whenever possible, to complete the evaluation of other external events.

Revision 1, May 22, 1996 8-2

8.2 Conclusions The IPEEE results for seismic, fire and other external events analyses are acceptable and do

• not require any further evaluation or action. The total core damage frequency (CDF) for Palisades, including the IPE and IPEEE results, is 9.35E-05/yr. *The IPE results contribute 55% to the overall CDF, while fire contributes 353 and seismic contributes 103. Even though there are conservative assumptions that artificially increase the CDF, the total plant .

CDF is acceptable and the contributors to CDF are identified. No further action is required

• to satisfy the requirements of Generic Letter 88-20, Supplement 4*.

Revision 1, May 22, 1996 8-3