ML20057A016

Safety Evaluation Concluding That Licensee Has Demonstrated That External Events Not Major Contributor to Core Damage Scenarios at Plant

ML20057A016
Person / Time
Site:	South Texas
Issue date:	08/31/1993
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20057A013	List: ML20057A012 ML20057A016
References
NUDOCS 9309100288
Download: ML20057A016 (13)

Text

'

.??gD* QEC A%

~

E'ljfj E

UNITED STATES Qm NUCLEAR REGULATORY COMMISSION g se,/

i WASHINGTON, D.C. 20555 4001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO PROBABILISTIC SAFETY ASSESSMENT - EXTERNAL EVENTS i

HOUSTON LIGHTING & POWER COMPANY CITY PUBLIC SERVICE BOARD OF SAN ANTONIO CENTRAL POWER AND LIGHT COMPANY CITY OF AUSTIN. TEXAS DOCKET NOS. 50-498 AND 50-499 SOUTH TEXAS PROJECT. UNITS 1 AND 2 l

1.0 INTRODUCTION

1.1 Background

i This safety evaluation (SE) presents the results of a review of the external events portion of Houston Lighting & Power Company's, et al., (HL&P, the licensee) South Texas Project (STP) probabilistic safety assessment (PSA),

including internal floods due to pipe breaks, but excluding internal fires.

~

The following subsections of the STP PSA from Section 3.4, Sequence j

Quantification of External Events and Internal Plant Hazards, are included in l

the review.

l 3.4.1 Spatial Interaction Analysis l

l 3.4.3 Internal Environmental Hazards Other Than Fires i

3.4.4 Seismic Events 3.4.6 External Flood Analysis 3.4.7 Other External Events i

Subsections 3.4.2, Internal Fires Analysis, and 3.4.5, HVAC Dependent failures, have been reviewed along with the internal events review.

1.2 Objectives and Scope of the Review This review was performed to see that the external events portion of the PSA was sufficiently complete in its scope so that its findings could be accepted.

Because the seismic hazard and most of the other external events at the STP site are not significant from the core damage point of view, and the results.

of the PSA do not show major contributions from external events, the staff review of the external events was limited.

l 9309100288 930831 h

l PDR ADOCK 05000498

[d P

PDR gi

s l

~

i

=

l '

2.0 REVIEW OF THE PSA REPORT AND SUP9tARY 2.1 Review Process After a preliminary review of the STP PSA report (Ref.1), the staff conducted a brief walk-down of selected areas of the STP Unit 1 on May 30-31,1990 and held a meeting with the licensee on May 31, 1990. The objective of the walk-down by the staff was to familiarize itself with the plant and make judgements regarding the assumptions made in the PSA. As a result of the walk-down and discussions, several action items were identified.

In the Meeting Minutes dated July 27, 1990 issued by the staff (Ref. 2), the staff identified six questions regarding the external events analysis. By letter dated October 18, 1990 (Ref. 3), the staff identified six additional questions. The staff has reviewed the licensee':. responses to these two sets of questions provided in November 1990 (Ref. 4) and March 1991 (Ref. 5), and incorporated the results of the review of these responses in this SE.

2.2 Summary of the PSA Estimates of core damage frequency (CDF) are given in Table 3.5.1.1, Point Estimate Core Damage Frequency, of the STP PSA Summary Report (Ref. 6). The total CDF is estimated to be 1.7E-4/yr which is composed of (1) a CDF of 1.7E-4/yr due to total internal initiating events (including fires in control room), and (2) a CDF of 1.2E-6/yr due to total external events.

The overall reasons for the relatively lower CDF for the external events are (1) the physical separation of the 3-train systems, (2) modern design, and (3) relatively low hazard exposure of certain external events when compared to many other nuclear power plant sites, e.g., seismic hazard is much lower in the Gulf Coast region compared to other regions of United States.

J 3.0 REVIEW OF INTERNAL ENVIRONMENTAL HAZARDS OTHER THAN FIRES 3.1 Spatial Interaction Analysis 3.1.1 Purpose and Methodology The purpose of the spatial interaction analysis (SIA) is to identify and rank the scenarios involving the ;nvironmental hazards originating within the plant boundaries and to determine the scope of s,pecific hazards requiring additional detailed analysis. HL&P performed the SIA in four steps (1) collecting and organizing information about components that are important to safety and their locations, (2) listing the sources of hazards within the plant and the available mitigative featu es for each location identified as important to j

safety, (3) constructing environmental hazard scenarios for each location, and i

estimating the occurrence frequencies of these scenarios, and (4) ranking the scenarios based on their contribution to the occurrence frequency of various impact vectors. The fourth step gives the final product of the SIA.

! The types of hazards addressed in the SIA are listed in Table 3.4.1-2 of the PSA. Out of 14 types of hazards listed in Table 3.4.1-2, the following hazards are likely to cause scenarios that may lead to core damage:

fire and smoke (FS) (fire and smoke related scenarios were reviewed separately), jets-water (JW), flood-water (FW), and missile (MI). The estimation of scenario frequency was made by using the information from published data sources, where available, and by using engineering judgement based on the results of previous PRA studies. Point estimate frequencies were then assigned to all the hazard scenarios that are listed in Table D6 of the main PSA report.

Finally, a scenario impact evaluation was perfomed to determine those scenarios that should be reintroduced in other parts of the PSA for detailed quantification and incorporation into the risk model. The scenarios were then grouped into four classes to establish the importance to risk. The scenario in the first class, called Class 0, does not affect any system and does not cause any initiating event in the plant model. The scenario in Class I causes an Initiating event and may or may not affect any system. The scenario in Class 2 affects one or more trains of a single system only, while the scenario in Class 3 affects one or more trains of more than one system.

In response to a staff question, HL&P has provided the basis for the failure frequencies used in the SIA for the flood analysis and the analysis of the missiles generated by rotating machinery and pressurized canisters (Ref. 4).

Internal flood initiating event frequencies were developed from two sources:

(1) analysis of Licensee Event Reports (LER) data published in Nuclear Power Egerience and classified in terms of location and size (the results of this analysis were used in the STP PSA), and (2) the LER database was updated and reanalyzed in a report by Pickard, Lowe and Garrick, Inc. (PLG) (Ref. 7) to support a shutdown events PSA for Seabrook. These updated results support flood frequencies that are generally smaller than those used in the STP PSA.

Assumptions made to support the flood initiating event frequencies for specific locations are given in the scenario tables in Appendix 0 of STP PSA.

Internal floods were quantified with a frequency of 8E-6 per pipe section per year for non-safety grade pipe and BE-7 per pipe section Mr year for safety-grade pipe.

(For safety-grade pipe, the failure rate was assumed to be a factor of 10 lower than for non-safety grade pipe.)

Regarding the staff's question about the missiles, HL&P has stated that the SIA considered two sources of missile generation depending on the type of equipment found in the specific location.

For rotating equipment such as turbines, motors, diesel engines, compressors, etc., it assumed a missile generation rate of 1.0E-9 per component operating hour which is 1/10th of the missile generation rate for large turbine generators. HL&P believes that the reduced value of 1.0E-9 event per hour is conservative for small rotating and reciprocating equipment. Large turbines contain sufficient stored energy to generate missiles that could penetrate the component casing if the control systems fail to prevent overspeed or if material failures occur. HL&P doubts that any of the safety-related components considered for missile generation in the STP PSA Table 8.2-2, Hazards Associated with Equipment, meets this condition, since the rotating mass of most of the components is relatively small, except the turbine-driven AFW pump and diesel generators.

i i

9 Regarding the pressurized canisters, (i.e., gas bottles), HL&P assumed, based on engineering judgement, that these will be handled once a year and that j

human errors resulting in missile generation would have a frequency of 1.0E-6

)

per handling. Table D-6 of Appendix D of STP PSA discusses the assumptions l

made in developing these judgements for each scenario.

Although the above treatment of pipe failure rates and missile frequencies departs to some extent from some of the past PRAs (e.g., treatment of pipe failure rates differ than that in WASH-1400), it is not anticipated that an alternate treatment would have any appreciable impact on the core damage frequency because of the plant features discussed earlier.

3.1.2 Summary of SIA HL&P has listed (in Ref. 6, Table 3.4.1.-16) 10 scenarios that may lead to core damage having a total initiating event frequency of 4.4E-3/yr. Six of these 10 scenarios have a frequency greater than 1.0E-6 per year.

(This threshold frequency is based on the total CDF from other causes and the fact there are already many significant event sequences with frequency between 1.0E-6 and 1.0E-5 per year). Out of these six hazard scenarios, the most dominant scenario is related to FS and has a frequency of 4.lE-3 which is 94 percent of the total frequency of 4.4E-3/yr. The next three scenarios in the descending order of frequency are also related to FS with frequencies ranging from 9.8E-5 to 8.2E-5.

No Class I scenarios (as defined earlier) were identified as important because the frequencies of all Class I scenario groups were much less than the initiating event frequencies in the plant analysis model.

HL&P has listed in two tables (Ref. 6) the scenarios that belong to Classes 1 and 2, and to Classes 1 and 3 respectively. Scenarios in these tables that have frequencies greater than 1.0E-4 per year were considered for further detailed analysis.

Scenarios that belong to Classes 2 and 3 respectively were judged to be insignificant contributors to risk.

As a result of the SIA, 36 non-fire related hazard scenarios warranted some detailed analyses as discussed in the next section.

3.2 Internal Hazard Analysis (excluding Fires) 3.2.1 Introduction The internal hazard analysis is an extension of the spatial interaction analysis. The potentially important scenarios identified in the SIA are analyzed in greater detail in the internal hazard analysis. The first step in this analysis is the characterization of the hazard sources for every potentially important scenario and creation of new sub-scenarios for each associated hazard source. Next, the impact of the scenario on the PSA equipment identified in the SIA is reexamined. Whereas, in the SIA, all of the susceptible components within the plant location are conservatively assumed to fail in the position that would lead to the worst plant conditions, J

in this reexamination, the exact failure modes of the components, the impact zone of the hazard, and the ultimate effect on system train availability are investigated. The functional loss of system trains is determined from the system descriptions, piping, and instrumentation diagrams, single-line diagrams, and elementary drawings. Finally, the annual frequencies of the hazard scenarios at different locations are quantified using the equation 3.4.3.1 given in Chapter 3.4.3 of Ref 6.

3.2.2 Significant Scenarios of Internal Environmental Hazards The SIA showed that 36 hazard scenarios other than those for fires, shown in Table 3.4.3-1 of the STP PSA Report, warranted detailed analysis. Nineteen out of the 36 scenarios can be screened out during the hazard source identification process. Table 3.4.3-2 (Scenarios Screened Out In the First Step of Reanalysis) in Ref. I shows jet water and medium pressure water as the hazard source for the first 15 of these 19 scenarios. HL&P's investigation of the pipe sections in the plant locations addressed in these scenarios shows that the likelihood of hazard type jet water and impact on the PSA equipment are very small because of the low pressure in the piping and the equipment locations. The remaining four of the 19 scenarios are two explosion scenarios (related to 4-kV/480V dry-type transformers), a missile scenario and a falling object scenario; HL&P has shown that these four are not important contributors to plant risk.

In addition to the 19 scenarios screened out as discussed above, HL&P has also shown several others to be insignificant. HL&P has listed (in Table 3.4.3-3) 13 hazard scenarios that have not been screened out. The conditional frequencies of core damage for these scenarios are very small because of the availability of numerous redundant and diverse systems for accident mitigation. Since, in all cases, the annual CDFs are significantly lest, than 2.0E-7 per year, none of the scenarios have been included in the overall plant risk computations.

4.0 REVIEW 0F EXTERNAL EVENTS HL&P has listed, in Table 3.4.1-1 in the STP PSA, a total of about 50 potential environmental and external hazards for STP out of which about 15 hazards were assessed to be significant enough to require detailed analysis.

In addition to the environmental hazards, such as internal flooding, jets and sprays, steam, high energy line break, and internal explosions and missiles i

included in Section 3.0 above, the PSA also included analyses of external events such as aircraft impact, external flooding, hurricane, and seismic events. The following sections provide a discussion of the majority of these important hazards.

4.1 Review of Seismic Events HL&P performed the seismic risk analysis in five steps which are discussed below.

4.1.1 Seismic Hazard Analysis In the first step of the seismic risk analysis, HL&P used the results of a seismic hazard analysis perfomed by the Electric Power Research Institute (EPRI) (Ref. 3) which are given in the fom of a table and curves of annual probability of exceedance for peak ground acceleration. Discrete annual acceleration frequencies were detemined at accelerations of 0.lg, 0.2g, 0.4g, and 0.6g from the exceedance frequencies taken from the mean hazard curve.

These frequencies were used as the initiating event frequencies when determining point estimates of plant damage states (PDS) and CDF from seismic events.

1 Additional sensitivity studies using a set of hazard curves developed by the j

Lawrence Livemore National Laboratory (LLNL) (Ref. g) are discussed in Section 4.1.4.

4.1.2 Fragility Analysis Fragility analysis is performed in the second step of the seismic risk analysis.

Fragility curves showing the peak ground acceleration (PGA) at which a-l component is expected to fail is developed primarily from analysis and judgement supported by limited test data, using the methodology used in most t

of the past PRAs.

Similar to other PRAs, in this study the Category I l

structuras are considered to have failed when the inelastic defomation of the structure potentially interferes with the safe operation of.the equipment attached to the structures. The equipment is considered to fail when it can t

no longer perfom its designated function.

HL&P adopted a bounding type of analysis for determining the fragilities of i

the structures and equipment. A plant walk-through was conducted by the fragility and systems analysts to determine by inspection the one or two buildings and the dozen or so plant components that appeared to be the most i

vulnerable to seismic events. Thus, the diesel generator building (DGB) and 1

the fuel handling building (FHB) were considered to conservatively represent the seismic capacity of other structures at the site. Masonry walls were not analyzed because HL&P determined that they would not impact on safety-related i

equipment or components in case they fail.

The PSA Table 3.4.4-3, Seismic Capacity of Structures, gives the results of the fragility analysis for the DGB and FHB. The median acceleration capacities of the DGB and the FHB are respectively 4.6g and 3.6g based on the critical shear wall failure modes for both buildings. The corresponding high confidence low probability of failure (HCLPF). values for the two buildings are 0.74g and 0.61g. The results of the equipment fragility analysis are given'in the PSA Table 3.4.4-4, Equipment Fragilities, which shows the median capacities and the HCLPF values of the equipment. As seen from this table, except for the offsite power and technical support center diesel generator many of the components have median capacities greater than 2.0g and HCLPF capacities greater than 0.39 Effects of relay chatter were assumed to be

i recoverable in this PSA.

In view of the low seismic hazard at the STP site (Ref. 6, Fig. 3.4.4-2, Annual Probability of Exceedance of Peak Ground Acceleration: South Texas Site), these components seem to have no chance of failing at low acceleration levels. There are, however, several components having median acceleration capacities less than 2.0g and they are grouped in Table 3.4.4-5.

HL&P has stated that other components not examined could have i

low capacities and low HCLPF values similar to those given in Table 3.4.4-4.

Therefore, HL&P_has included in Table 3.4.4-5 tanks such as fuel oil day I

tanks, electro-hydraulic control (EHC) tanks, and auxiliary feedwater (AFW) i storage tank in addition to closed cooling water (CCW) surge tank, and several electrical cabinets in addition to the 120V AC 25-Kv inverters. HL&P has not included the refueling water storage tank (RWST) in Table 3.4.4-5 since it is contained within a concrete enclosure and the tank contents would not be lost if the steel tank were to fail.

In response to a staff question concerning the components anchored by plug welds that might impact the seismic results, HL&P has reported (Ref. 2) that, out of 16 mechanical and electrical components exhibiting the relatively i

lowest capacities for the representative classes of equipment,'only the 4.16 KV switchgear were anchored by means of plug or puddle welds. HL&P has 4

further stated that the fragility for the switchgear was taken as the lower of (1) the functional fragility determined from results of tho seismic l

qualification test, or (2) the failure of the puddle welds.

l The switchpar are anchored by eight 17/32-inch puddle welds fc,r each cabinet.

l The effective portion of each puddle weld was equivalent to a 1.67-inch fillet I

with a leg dimension of 0.10 inen. Because of the large size of the footprint of the switchgear and because of the low location of the weight of the breaker l

(which strongly influences the weight of the cabinet), the shear load only l

governs the weld capacity. The functional fragility of the cabinet (calculated by comparing the. test response spectrum with the worst case location floor response spectrum) was lower than the fragility based on the_

failure of the puddle welds. Therefore the generic functional failure mode was used to describe the seismic fragility of the switchgear.

The fragility approach used in this PSA is an acceptable approach used in the l

past PRAs.

Limited review of the calculated fragility values indicate that 3

l values are similar to those used in other studies. The use of puddle weld for anchoring 4.16kV switchgear would be a concern at sites with higher seismicity as this represents a non-ductile construction, therefore, as a prudent engineering practice, the licensee may want to investigate an alternate i

anchoring system in the future at an opportune time.

j l

4.1.3 Plant Logic Analysis and Assembly The plant logic analysis is the third step in the seismic risk analysis in which a logic model is developed to depict the consequences of structure and component failures. The logic model includes the seismically induced events that may cause one or more different classes of initiating events and one or more failures of components needed to respond to the initiating event. The

-s.

model also considers non-seismic failures that can combine with seismically induced failures to produce an accident sequence.

The fourth step consists of the initial assembly which involves the quantification and initial assembly of the seismic hazard, component fragility, and the plant logic to determine point estimates of the frequencies of core melt and various plant damage states (PDS) that might be caused by thr-seismic initiating events.

In the fifth and final step in seismic risk analysis, the probability distribution of PDS and core damage frequencies for those seismically.

initiated scenarios that are major frequency contributors are calculated for combining with the probability distribution of frequencies from other initiating events.

Table 3.4.4-9, Seismic-Initiated Plant Dar.ege State Frequencies, in Ref. 6-gives the results of the seismic analysis point estimate.

In that table, the frequencies of the seismic-initiated PDSs and core damage are compared with those caused by all the.in'tiators. This comparison shows that the seismic contribution to core damage is less than 0.1 percent of the total. The PDSs dominating the seismic-initiated core damage are HXXXS and MAXXS accounting for about 45 percent and 37 percent, respectively, of-the seismic CDF.

(In response to a staff question (Ref. 2), HL&P has furnished a detailed report tracing the quantification of these top two seismic-initiated PDSs and provided the PDS fragilities '(Ref. 4) to get a better appreciation of overall plant capability to withstand sei nic events.)

The PSA has shown that the major contributors to the PDS HXXXS are LOOP and seismic failure of the diesel fuel oil day tanks, or failure of the 4160 V switchgear, both leading to the loss of AC power, or failure of the inverters, battery chargers, and AFW storage tank, leading-to the loss of DC control power and feedwater to the turbine-driven AFW pump. The PSA has also shown that the major contributors to the PDS MAXXS are the scenarios in which there is loss of the essential chilled water system, leading to the failure rF electric auxiliary building HVAC and loss of 4160 V switchgear and AC power, followed by the loss of CCW.

HL&P's approach to the quantification is similar to that used in PRAs employing large event tree - small fault tree approach.

4.1.4 Seismic Hazard Sensitivity Analysis-HL&P performed a sensitivity analysis using a set of hazard curves developed for the STP site by the Lawrence Livermore National Laboratory (LLNL) (Ref.

9), and quantified the seismic contribution to core damage. Section 2.2.4, Seismic Hazard Sensitivity, of the STP PSA (Ref. 2) gives the methodology and the results of this sensitivity study. The results of the sensitivity analysis indicate that the frequencies of the seismic-initiated PDSs and core damage, determined using the LLNL hazard curves, are higher than those determined using the EPRI hazard curves. While the seismic contribution to core damage using the latter hazard curves is only about 0.1 percent of the

1 i

~

j j i

l total, the contribution to core damage using the LLNL hazard curves is about 12 percent of the total, which is about 100 times as high as the valus I

obtained using the EPRI hazard curves. While this large increase highlights i

the basic differences between the EPRI and LLNL seismic hazard curves, it is not significant for the STP PSA since the seismic contribution is no higher than 12 percent of the total core damage and no significant weaknesses have been identified.

i 4.1.5 Sumary of Seismic Events Review Table 3.4.4-9 in the STP PSA compares the frequencies of the seismic-initiated plant damage states and core damage with the frequencies resulting from all 4

initiators to determine if any seismic scenarios were major contributors to a plant damage state and to core damage. By such comparison HL&P has determined that the seismic contribution to core damage is less than 0.1 percent of the total based on the EPRI seismic hazard curve. However, HL&P performed a sensitivity analysis using the LLNL seismic hazard curve which showed an increase in seismic contribution to core damage of about 12 percent of the total core damage.

The seismic PSA metnodology used by the licensee is a state-of-the-art approach used in many seismic PSAs. Use of both the EPRI and LLNL hazards curves is consistent with the guidance of Reference 10.

4.2 Review of External Floods The STP plant is located about 12 miles south-south west of Bay City, Texas, and consists of two pressurized water reactor (PWR) units. The center of the reactor buildings is about 3 miles from the Colorado River. The plant grade j

is at Elevation (El.) 28.0 ft. above mean sea level (MSL).

The STP main cooling reservoir (MCR) and the essential cooling pond (ECP) contain the cooling water required for the normal and emergency operations of the nuclear generating units. The normal maximum operating level of the MCR i

is at El. 49.0 ft. MSL while its normal operating level is at El. 45.0 ft.

1 MSL. The normal operating level of the ECP is between El. 25.6 ft. and El 26.0 ft. MSL.

i l

Based on an analysis of three fundamental sources of flooding at the site, namely, storms, off-site dam breaks, and on-site dam breaks, HL&P constructed a set of events that identified those failure causes and mechanisms that could result in site flooding, and determined that the source event of the greatest importance with respect to risk is the failure of the MCR. HL&P, then, examined a set of failure scenarios specific to the MCR, and quantified the likelihood of MCR breach. Then a set of scenarios, impacting plant equipment due to the MCR flooding event, was identified, and the annual core damage frequencies of the scenarios that follow a flood-induced loss of off-site power and flooding of risk-related equipment leadir,g to core damage were determined. As shown in 7able 3.4.6-6, Flood Scenarios That Impact the STP Site, the total frequency of the external flood-initiated scenarios is 2.1E-8

l i

i -

J l

which will have a negligible effect on the total annual core melt frequency i

from all initiating events.

l In response to a staff question (Ref. 3) regarding (1) the effects of failures j

of the Columbus Bend or other proposed / built dams, and (2) the effect of l

upstret= breaks on the MCR and the ECP, HL&P has provided the following i

j response (Ref. 5, Question 5):

i (1) The failures of the propMd Columbus Bend Dam and the Stacy Das have not j

been included in the STP PSA due to the timing of its analysis; however, J

HL&P has stated that the effect of the failure of both the existing and the proposed upstream dans will not raise the flood level above the design basis flood resulting from breach of the MCR embankment. HL&P has further stated that it will include the effect of the failure of the i

upstream dams in addition to the Mansfield and Buchanan dans in the STP PSA as it is updated in the future.

2a) No impact on the ECP by external flooding has been included in the PSA since HL&P expects such impact to be negligibly small, because of its design assumptions concerning the ECP.

l 2b) The MCR water does not provide a safety-related function. The south

,^

embankment of the ECP is designeri to withstand the effects of an MCR embankment breach. Therefore, the loss of the MCR as the result of an i

MCR embankment breach does not impact the availability of safety-grade i

cooling water (through ECP) for the plant's essential safety features.

i HL&P has, therefore, not included the impact on the MCR by external flooding in the PSA.

t The staff generally agrees with HL&P's arguments supporting its omission to include in the PSA the impact on the ECP and the MCR due to external flooding.

Subsequently, the licensee also evaluated the potential of flooding caused by the water from the ECP or MCR flowing freely by gravity in the event of valve failures in the connecting lines (Ref.13), and concluded that the possibility of such an event is negligible.

4.3 Review of Other External Events j

The staff requested HL&P (1) to compare the Updated Final Safety Analysis Report (UFSAR) design criteria (e.g., flood level, wind speed, etc.) with initiating event frequencies and corresponding criteria used in the PRA analysis in a tabular form, and (2) to report if any changes have occurred at or near the site to alter the design information described in the UFSAR.

HL&P provided the requested comparisons in Reference 5 which are briefly j

discussed below.

I e

E l

. 4.3.1 High Winds The high wind design criteria, in terms of wind speeds, pressure drops, and missiles, used at the STP are generally in conformance with guidance in the Standard Review Plan (SRP). The STP PSA shows a calculated mean annual frequency of a tornado at the site to be 1.7E-5, and the annual frequency of 3

excessive tornado wind speeds (in excess of 360 mph) to be 8.3E-9.

4.3.2 Aircraft Crash As per the UFSAR, a total frequency of aircraft crash from both general aviation and United States air carriers is 2.9E-6.

The STP PSA shows the 3

corresponding initiating frequency to be 7.0E-7.

Therefore the aircraft crash scenario has no significant impact on the CDF.

In response to a staff question regarding the aircraft crash data used in the PSA versus the data used in the UTSAR, HL&P has stated (Ref. 4) that the frequency of general aviation accidents per mile in the PSA is 2.3E-7 while it is 1.SE-7 in the UFSAR. The reason for the difference is the use of slightly different historical data bases. HL&P did not see any need to revise the PSA in view of the insignificant quantitative difference in the results.

4.3.3 Transportation and other External Hazards These evtnts were screened out based on a scoping study.

5.0 SUK9RY AND CONCLUSIONS Based on a review of the external events portion of the STP PSA, and HL&P's responses to the staff's request for additional information, the staff finds the following:

(1) The contribution of the external events to the total core damage frequency is insignificant. The total mean CDF due to both internal and external events is estimated to be 1.7E-4/yr. The CDF due to total external events (including all the external events and internal hazards, e.g. fires and floods) is 1.2E-6/yr. Thus the contribution to the total CDF from the external events is less than 1 percent of the total CDF.

This is extremely low compared to the contribution from external events in the case of other plants such as Three Mile Island, Seabrook, and Diablo Canyon which ranges from 20 percent to 38 percent (Ref.1).

The overall reasons for the relatively lower CDF due to the external events are (a) the physical separation of he 3-train systems, (b) modern design, and (c) the relatively low hazard of certain external events at the STP site.

(2) The contribution from the seismic event to the core damage frequency is less than 0.1 percent of the total. Two plant damage states, designated as HXXXS and MAXXS, dominated the seismic-initiated core damage accounting for about 45 percent and 37 percent respectively of the seismic CDF. The major contributors are seismically induced loss of

j i

. i l

offsite power coincident with failures of onsite electrical components, and loss of AFW storage tank. The scenarios in which there is loss of '

i the chilled water system, leading to the loss of 4160V switchgear and AC t

power, followed by the loss of CCW also contribute to the core damage.

l The fragility approach used in this PSA is an acceptable approach used in the past PRAs. Limited review of the calculated fragility values i

. indicate that values are similar to those used in other studies. The use of puddle weld for anchoring 4.16kV switchgear would be a concern at sites with higher seismicity as this represents a non-ductile construction, therefore, as a prudent engineering practice, the licensee i

may want to investigate an alternate anchoring system in the future at an j

opportune time.

l (3)

A' sensitivity analysis of the seismic event performed by HL&P showed that i

the seismic contriktion to the core damage frequency using the LLNL l

hazard curves isl12 percent which is 100 times as high as the seismic I

contribution of about 0.1 percent obtained by using the EPRI hazard curves. Although this ratio between the seismic contributions due to the use of LLNL and EPRI curves is very large, the seismic contribution is only about 12 percent of the total core damage frequency, and no significant plant weakness has been identified.

j i

(4) The core damage frequency due to external flooding has been estimated at i

2.lE-8 in the PSA. The failures of the proposed dans upstream of the site have not been included in the PSA due to the timing of its analysis; however, HL&P has stated that the effect of the failure of both the existing and the proposed upstream dans will not raise the flood level i

above the design basis flood resulting from breach of the MCR embankment.

i HL&P has further stated that it will include the effect of the failure of

[

the upstream dams in addition to the Mansfield and Buchanan dans in the i

STP PSA as it is updated in the future. Therefore, as long as the design l

basis at the site envelopes the potential failures of upstream dams, the i

external flooding is not likely to be a significant contributor.-

l In summary, the staff concludes that the licensee has carried out external event analyses using acceptable state-of-the-art approaches used in many recent PSAs.

External event initiating event frequencies (e.g., seismic hazard) are derived using acceptable methods. Subject to confirmation through IPEEE review, the staff finds that the licensee has demonstrated that the external events are not a major contributor to core damage scenarios at South 1

Texas plants.

J i

l

6.0 REFERENCES

l I

1.

Letter from M. A. McBurnett, HL&P, to NRC, " South Texas Project Electric Generating Station Units 1~and 2 Probabilistic Safety Assessment," dated June 15, 1989.

J

2.

Meeting Minutes Memorandum from George F. Dick, Jr., NRC, "Probabilistic Risk Assessrent (PRA) Review Meeting - South Texas Project, Units I and 2," dated July 27, 1990.

3.

Letter from G. F. Dick, Jr., NRC to D. P. Hall, HL&P, " Request for Additional Information Related to the Review of the Probabilistic Safety Assessment (PSA), South Texas Project, Units 1 and 2,* dated October 18, 1990.

Letter from M. A. Mc8urnett, HL&P, to NRC, " South Texas Project Electric 4.

Generating Station Units 1 and 2, Responses to the NRC Request for Additional Information on the External Events Analysis in the Probabilistic Safety Assessment," dated November 20, 1990.

5.

Letter from A. W, Harrison, HL&P, to NRC, " South Texas Project Electric Generating Station Units 1 and 2, Additional Information on the External Events Analysis in the Probabilistic Safety Assessment," dated March 15, 1991.

6.

Letter from M. A. McBurnett, HL&P, to NRC, " South Texas Project Electric Generating Station Units 1 and 2, Probabilistic Safety Assessment Summary Report," dated April 14, 1989.

7.

Fleming, K. M. et al., " Internal Flood Frequencies During Shutdown and Operation for Nuclear Power Plants," Pickard, Lowe and Garr ick, Inc.,

prepared for New Hampshire Yankee, PLG-0624, May 1988.

8.

EPRI Report, " Seismic Hazard Methodology for the Central and Eastern United States," Final Report No. EPRI NP-4726-A, Revision 1, November 1988.

9.

LLNL Report, " Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains," NUREG/CR-5250, January 1989.

10. Chen, J.T., et al., " Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident 1

Vulnerabilities," dated December 23, 1991.

II. Letter dated December 23, 1991 from S. L. Rosen of HL&P to NRC, " South i

Texas Project Electric Generating Station Units 1 and 2, Completion of the Individual Plant Examination of External Events for Severe Accident Vulnerabilities," dated December 23, 1991.

12. NRC Generic Letter 88-20, Supplement No. 4 " Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities-10 CFR 50.54(f)," June 28, 1991.

13. Letter from S. L. Rosen of HL&P to NRC, " Additional Information on the External Event Analysis for the South Texas Project Probabilistic Safety Assessment," dated January 13, 1993.