ML20086B160

Individual Plant Exam of External Events for River Bend Station

ML20086B160
Person / Time
Site:	River Bend
Issue date:	06/30/1995
From:	ENTERGY OPERATIONS, INC.
To:
Shared Package
ML20086B163	List: ML20086B160
References
NUDOCS 9507050201
Download: ML20086B160 (163)

Text

{{#Wiki_filter:. ) n Table of Contents pg{ li d k[< EXECUTIVE

SUMMARY

!O M DESCRIPTION EXAMINATION M SEISMIC ANALYSIS M FIRE ANALYSIS M AND OTHERS HIGH WINDS, FLOODS, O LICENSEE PARTICIPATION AND INTERNAL REVIEW TEAM M AND UNIQUE SAFETY PLANT IMPROVEMENTS FEATURES E

SUMMARY

AND CONCLUSIONS E REFERENCES O ytas B y .I h ' [.',;',[.}l, 'f j.,[,- . Y.k, :l, Q% ::,. :. ,e -, 9507050201 950630 - - - - ' " " = PDR ADOCK 05000458 Y E AVCTU - PC ADY lt/DEX " (NDEXING SYSTEM

~ O ENGINEERING REPORT NO.: SEA-95-001 REVISION: 0 PAGE 1 OF 159 ENTERGY RIVER BEND STATION ENGINEERING REPORT 1 FOR INDIVIDUAL PLANT EXAMINATION OF EXTERNAL PLANTS (IPEEE) l Prepared By: //77 Date: Todd A.Reichardt !#/0 E Reviewed By: 009o Date: LoyFK. Bedell A'pproved By: [b d476 Date: 6 /27/45 ~ Paul A. Sicard O

R: port Nu.nber SEA-95-OO1 Revision ,q, Page ,,2., of 15,9_ . rm f

• s TABLE OF CONTENTS 1.0 EXECUTIVE SUMM ARY.................................... 8 8

1.1 Background and O bjectives.............................. 9 1.2 Plant Familiarization................................... 9 1.3 Overall Method olog y................................... 9 1.4 Summary of Major Findings.............................. 11 2.0 EXAMINATION DESCRIPTION.............................. 11 2.1 I ntr o d u cti on........................................ 2.2 Conformance With Generic Letter and Supporting Material....... 11 12 2.3 General Methodology................................. 12 2.3.1 Seismic Analysis............................... 12 2.3. 2 Fire Anal ysis.................................. 13 2.3.3 Other External Events............................ 13 2.4 inf ormation Assembly................................. 14 p 3.0 SEISMIC ANALYSIS...................................... 0 14 3.0 Method ology Selection................................ 14 j 3.1 EPRI Seismic Margins Method (SMM)...................... 3.1.1 General Plant Information and Seismic Input 14 14 3.1.1.1 General Plant information 16 3.1.1.2 S eismic input........................... 16 3.1.2 System Analysis............................... 1 3.1.2.1 Success Path Logic Diagrams (SPLDs) 16 17 3.1.2.2 As sum pti ons........................... 18 ) 3.1.2.3 Principle Safety Functions.................. 19 j 3.1.2.4 System Success Criteria................... 3.1.2.5 Support System Identification............... 19 3.1.2.6 Success Path Logic Diagram................ 21 3.1.2.7 Primary and Alternate Success Path Selection.... 23 24 3.1.2.8 System Operational Aspects................ 3.1.2.9 Equipment identification and Selection......... 27 28 3.1.3 Seismic Walkdown.............................. p( 28 3.1.3.1 Approach............................. 29 3.1.3.2 Screening Criteria........................

1 RipIrt Number SEA-95-OO1 Revision ,Q,, Page 1 of M 1 s TABLE OF CONTENTS i i 3.1.3.3 Walkdown Preparation 30 3.1.3.4 Walkdown Process....................... 30 3.1.4 Walkdown Re sults.............................. 31 3.2 USl A-45, GI-131, and Other Seismic Safety issues............ 31 3.2.1 USl A-45 " Shutdown Decay Heat Removal Requirements".. 31 3.2.2 GI-131 " Potential Seismic Interaction involving the Movable In-Core Flux Mapping System Used in Westinghouse Pl a n t s "............................... 32 3.2.3 The Eastern U. S. Seismicity issue (The Charleston Ea rthqua ke )................................... 32 3.2.4 US! A-17 " System Interactions in Nuclear Power Plants" 32 4.0 FI RE AN ALYSI S......................................... 47 4.1 Fire H azard Analysis.................................. 47 4.2 Review of Plant information and Walkdown 47 (] 4.3 Fire Growth and Propagation............... 48 V 4.4 Evaluation of Component Fragilities and Failura Mooes.......... 50 4.5 Fire Detection and Suppression.......................... 50 4.6 Analysis of Plant Systems, Sequences, and Plant Response...... 51 4.6.1 Fire PRA Power Event Tree........................ 51 4.6.1.1 Succe ss Criteria......................... 51 4.6.1.2 Assum ptions........................... 52 4.6.1.3 Eve nt Tre e............................. 55 4.6.2 Progressive Screening Analysis..................... 59 4.6.2.1 Screen 1: Fire Areas With No SSA Equipment.... 59 4.6.2.2 Screen 2: Fire Areas inside Containment........ 60 4.6.2.3 Screen 3: CDF < 1 x 10/yr Assuming all Equipment in Area Failed........................... 60 4.6.3 Detailed Screening Analysis........................ 60 4.6.3.1 Screen 4: CDF < 1 x 10elyr Equipment Damage Determined by Fire Modeling................ 61 4.6.3.2 Screen 5: CDF < 1 x 10/yr Ignition Frequencies Specific To Scenarios..................... 61 4.6.3.3 CDF < 1 x 10/yr Credit Given For (G 61 Feedwater

Rep;rt Number SEA-95-OO1 Revision Q. Page _4._ of 1 M s i N / TABLE OF CONTENTS 4.6.4 Unscreened Fire Area....................... 62 4.7 Analysis of Containment Performance (if Applicable) 63 4.8 Treatment of Fire Risk Scoping Study issues................. 63 63 4.8.1 Background................................... 4.8.2 River Bend Station Program........................ 63 4.8.3 Seismic / Fire Interactions.......................... 64 64 4.8.4 Fire Barrier Qualifications 4.8.4.1 Fire Barrie rs............................ 64 4.8.4.2 Fir e D o or s............................. 65 4.8.4.3 Penetration Seal Assemblies 65 4.8.4.4 Fire Dam pe rs........................... 66 4.8.5 Manual Fire-fighting Ef fectiveness................... 67 4.8.5.1 Re porting Fire s.......................... 68 (3 4.8.5.2 Fir e Brig a de............................ 69 () 4.8.5.3 Fire Brigade Training...................... 70 4.8.5.4 Pr a c t i c e............................... 71 4.8.5.5 D r il l s................................. 72 4.8.5.6 Records............................... 72 4.8.6 Total Environment Equipment Survival 73 4.8.6.1 Potential Adverse Effects on Plant Equipment by Combustion Products..................... 73 4.8.6.2 Spurious or inadvertent Fire Suppression Activation 73 74 4.8.6.3 Operator Action Ef fectiveness............... 75 4.8.7 Control Systems interactions....................... 76 4.8.8 Adequacy of Analytical Tools 77 4.9 USI A-45 and Other Safety issues........................ 4.9.1 USI A-45 " Shutdown Decay Hear Removal Requirements".. 77 4.9.2 USI A-17 " Systems Interactions in System Interaction f 77 in Nucle ar Power"....................... 4.9.3 NUREG/CR-5088 " Fire Risk Scoping Study"............ 77 -) i ( / 77 4.10 Main Control Room Analysis............................ 78 4.10.1 Main Control Room Design i

k; -) i.l R:psrt Number SEA-95-OO1 Revision _Q_ Page ,,5. of _LL9. ..O i \\. TABLE OF CONTENTS i 4.10.2 Core Damage Scenarios....................... 79 4.10.2.1 Ignition and Propagation................ 79 4.10.2.2 Impacts on Habitability................. 81 4 10.2.3 Induced Equipment Failures.............. 81 4.10.2.4 Core Damage Scenario Descriptions........ 82 4.10.3 Fires Not Resulting in Evacuation.................. 82 4.10.3.1 Fraction of Cabinets in MCR 83 4.10.3.2 Probability of Extinguishing a Cabinet Fire.... 83 4.10.3.3 CCDP for Fires not Result in Evacuation..... 84 4.10.3.3.1 CCDP for in a Division 1 Cabinet. 84 4.10.3.3.2 CCDP for a Division 11 Cabinet 85 4.10.3.3.3 CCDP for a Division ill Cabinet.. 85 4.10.3.3.4 CCDP for a Non-Divisional Cabinet 85 4.10.3.4 CDF Fires Not Resulting in Evacuation....... 86 G 4.10.3.5 Fires Resulting in Evacuation............. 86 5 4.10.3.5.1 MCR Evacuation Event Tree.... 87 4.10.3.5.2 Fire Event Tree Success Criteria and Top Events 87 4.10.3.5.3 CDF for Fires Resulting in Evacuation................ 89 4.10.3.6 Results and Conclusions................ 89 4.11 Discussion of important Fire Areas........................ 91 5.0 HIGH WINDS, FLOODS, AND OTHERS ANALYSIS.............. 134 5.1 Hi g h Win d s....................................... 134 5.1.1 Original Design Basis........................... 134 s 5.1.2 Changes to Design Basis......................... 134 5.1.3 Occurrences of High Wind Events at River Bend Station... 135 5.1. 4 R e sult s..................................... 135 5.1.4.1 High Wind s........................... 135 5.1.4.2 Torna d oe s............................ 135 5.1.4.3 H urrica nes............................ 135 kb 5.2 Fl o o d s........................................... 136

1 ~ IRrpart Number SEA-95-001 1 Revision = ,g, Page ,3, _ of,,13,3,, TABLE OF CONTENTS et 5.2.1 Original Design Basis.......................... 136 5.2.2. Changes to Design Basis......................... 137 5.2.3 Occurrences of Floods at River Bend Station........... ' 137 -

5. 2.4. R e sult s..................................... - 13 7 5.2.4.1 Flooding Due to Local intense Precipitation :... -.. 137 5.2.4.2 Flooding Due to the Mississippi River

........ 137 5.2.4.3 Flooding Due to Grants Bayou.............. 137-5.2.4.4 Flooding Due to West Creek 137 i 5.3 Transportation and Nearby Facility Accidents............... ~ 138 i 5.3.1 Original Design Basis........................... 138 s 1 5.3.1.1 Transportation of Hazardous Materials........ 138: i 5.3.1.2 Onsite/ Nearby Facility Spill of Stored Hazardous-l Materials............................. ' 138 e 5.3.1.3, Intake Structure Inoperability Due to Barge-l Collision or Barge Spill.................... 139 1 5.3.1.4 Aircraft Hazards........................ 140-l 5.3.2 Changes to Design Basis......................... - 140~ I ) t 5.3.2.1 Transportation of Hazardous Materials........ 141 5.3.2.2 Onsite/ Nearby Facility Spill of Stored Hazardous l Ma terials............................. 142 l 5.3.2.3 Intake Structure Inoperability Due to Barge Collision or Barge Spill.................... 142 5.3.2.4 Aircraft Hazards ~........................ 142-1 5.3.3 Occurrences of Transportation and Nearby Facility-Accidents at RBS.............................. 143 j

5. 3.4 R e sult s.....................................

143 5.3.4.1 Transportation of Hazardous Materials........ 143 5.3.4.2 Onsite/ Nearby Facility Spill of Stored Hazardous Materials............................. 143 5.4.3.3 Intake Structure Inoperability Due to Barge Collision or Barge Spill.................... 143 5.4.3.4 Aircraft Hazards........................ 143 144 5.4 Severe Temperature Transients......................... 5.5 Severe Weather Storms (Icestorms, Hailstorms, Snowstorms).... 144 144 5.6 Lightni nc........................................ 1

R:ptrt Number SEA-95.OO1 Revision .Q Page .2 of 119 .I, -w) TABLE OF CONTENTS 5.7 Exter nal Fire s...................................... 144 5.8 - Remaining Other External Events........................ 144 i 5.9 Wal kd ow ns............................ 144 5.10 R e s ul t s.......................................... 145 i 6.0 UCENSEE PARTICIPATION AND INTERNAL REVIEW TEAM... 146 6.1 IPEEE Program Organization............................ 146 6.2 Composition of Review Team.......................... 146 6.3 Areas of Review and Major Comments.................... 147 6.4 Resolution of Comments.............................. 147 7.0 PLANT IMPROVEMENTS AND UNIQUE SAFETY FEATURES...... 150 150 7.1 Seismic Analysis 7.2 Fi r e An al ysis...................................... 150 7.3 O ther External Events................................ 155 8.0

SUMMARY

AND CONCLUSIONS (INCLUDING PROPOSED RESOLUTION OF USis AND Gis)........................... 156 I 9.0 REFEREN C ES.......................................... 157 \\N

t 8.y 6 1 Rf' d.,nJ . -.. _ ~.. ___e.- h-.--.. ,hM'e4brm++*er-4s.. w.1s$--are.-,. ,,e ,,y .,1,, ,a e,+,_a,,-<- .pa msoap- -erm4em,=>,. ped,, um eum'm.' +c.am e en t14 ee-a 4=twaswmm-me-.F d'-* =1-aams*" g sym,=.m.-. t.,a-4 c. e e. A r w- .*'Pcimariw s + NM9qaGG *pWJ ud 'emb= e,#d-un4m ew-w a w N- --m-h 4Af*W hW4P( de mus 'W 4fa"+9'w+a w .e. -+M-w.-- e-au--ee. +m.mu-==w- =4-e ,m's"'tec ,'8 h'a ssp u sur ee w.pe..1pe haiu.w.-w e+Mk-+ e+a. 4u w me-s. .,eme-wia- >a%+=>r' + w md s WV-w+- "*.m-*- -,m, _,,y s etr8t.m.-+w.s+w' ~. -e a ,s.qa;ews dre re-* e+mha^+ a %+- 4 m. - - w c heMsa+-sed-+-+w~<---. m -_-.ati.--- s--' ,.,.e- = 1 I o,..<.,....._..---, l 1 9 -v.s4.- s e Wee ms..eer-4*e 4 l 1 w,_.., ,.--,,,-e-use*J.=es 4.-mA* maw a* P um .u,. - - 6se sw a.ne =1 star's>e we w r*wr ~ -.sne__ m=4=w.4. .c.4 emai-,. -d+. -.- eba.u-re is.e =dreem +wam'-N-'

• =4+

men .,sw~,- +..,.,,y.w..,a_ ~ ,.4wr--... 4,Ar..., ,,.e.,. Pd 884 44.Ce Je%e.-ea -hr te' a**ew -em m y6 -w m.-a,.-- u use n% %w.was=-a,.in. m +. a m.. tw yam pe.-.s-4-.se.u-i. %-*Asam.m.,,,,.,w wma. +w.- .m edspe.maeya,S.,--ee.anwe,g 9i s.- Mwntemce=x,++. ,a-a -,,o-w-h% T 44Wwer" nummmanus.

I Report Numbsr SEA-95-OO1 Revision _Q, Page _H. of.151, Ov 1.0 EXECUTIVE

SUMMARY

In June 1991, the NRC issued Supplement 4 to Generic Letter 88-20, " Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities", which requested that utilities perform an Individual Plant Examination of External Events (IPEEE). This report provides the requested information for River Bend Station regarding external events (excluding internal flooding). Internal Flooding was included in the Individual Plant Examination (IPE) for internal events. 5 1.1 Background and Objectives in the Commission policy statement on severe accidents in nuclear power plants issued on August 8,1985, the Commission concluded, based on available information, that existing plants posed no undue risk to the public health and safety and that there was no present basis for immediate action on any regulatory requirements for these plants. I However, based on NRC and industry experience with plant-specific probabilistic risk assessments (PRAs), the Commission recognized that systematic examinations are beneficialin identif ying plant-specific vulnerabilities to severe accidents that could be fixed with low-cost improvements. As part of the implementation of the Severe Accident. Policy, the Commission issued Generic Letter 88-20 on November 23,1988, requesting that each licensee conduct an individual plant examination (IPE) for internally initiated events including internal flooding. Many PRAs indicate that, in some instances, the risk from external events could contribute significantly to core damage. In December 1987, an External Events Steering Group (EESG) was established by the NRC to make recommendations regarding the scope, methods and coordination of the individual plant examination of extemal events (IPEEE). In June 1991, the NRC issued Supplement 4 to Generic Letter 88-20 requesting a plant i specific analysis of external events. Jointly issued with Supplement 4, NUREG-1407 was issued to give procedural and submittal guidance for the iPEEE. l The objectives of the IPEEE, as outlined in NUREG-1407, are: 1. To develop an appreciation of severe accident behavior 2. To understand the most likely severe accident sequences due to external events that could occur at River Bend Station under full power operating conditions. 3. To gain a qualitative understanding of the overall likelihood of core damage and fission product releases. ] 4. If necessary, to reduce the overall likelihood of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents. Entergy Operations, Inc., (EOI), has completed and documented an IPEEE for River Bend Station. This report contains a summary of the methods, results, and conclusions for the IPEEE. This report complies with the NRC request for information contained in Generic

I Report Number SEA 95-OO1 Revision _Q. Page Q. of.159_ l Letter 88-20, Supplement 4 and NUREG-1407. 1.2 Plant Familiarization River Bend Station is a single unit 936 Mwe (net) Nuclear Power Plant located approximately 24 miles Northwest of Baton Rouge, Louisiana. The nuclear system is a direct-cycle, forced circulation, GE BWR6/ Mark ll1 reactor that produces steam for direct use in the steam turbine. The construction permit and operating license dates were March 1977 and October 1985, respectively. 1.3 Overall Methodology The IPEEE consists of three separate analyses: e Seismic Analysis e Intemal Fire Analysis e High Winds, Floods and Others Analysis For Seismic analysis, the EPRI Seismic Margins Methodology was used to perform the analysis. For the internal Fire analysis, a Fire PRA was performed. For High Winds, Floods ( and Others analysis, a review was performed to demonstrate conformance to the 1975 Standard Review Plan (SRP). These methodologies are consistent with those endorsed by NUREG-1407. 1.4 Summary of Major Findings For the Seismic Analysis, RBS is identified as a reduced scope plant by NUREG-1407. Therefore, the Safe Shutdown Earthquake (SSE) ground response spectra and corresponding in-structure response spectra were used as the Review Level Earthquake (RLE) input for the walkdown and evaluation. The conclusion of the seismic walkdowns is that River Bend Station is seismically rugged and that all components identified in the safe shutdown paths have adequately considered the seismic input. All anchorage to these components was found to be rugged. No vulnerabilities to seismic events are identified. The methodology and assumptions used in the RBS Fire Analysis have been compared to those used at the other EOl sites. The RBS Fire Analysis was compared to Grand Gulf Nuclear Station (GGNS) study in greater detail due to the similarities in design and the f act that GGNS also performed a Fire PRA. Slight changes in the methodology and assumptions were made as a result of the comparison. The principal differences in the results of GGNS study and the RBS study are related primarily to differences in plant design. The Fire PRA conservatively estimates the core damage frequency (CDF) due to internal fires. No vulnerabilities to internal fires are identified.

R: port NumbIr SEA-95-OO1 Revision A Page 10 of _15.1, (% The estimate of CDF from internal fires is comprised of 7 fire areas. The CDF is spread fairly equally over the 7 fire areas with no one fire area dominating the results. The fire area CDFs range from a high of 4.87 x 10'*/yr to a low of 1.26x10-8/yr. The Control Room has the highest fire area CDF representing approximately 22% of the total estimated CDF. The summation of these individual CDFs is 2.25 x 10-5/yr. Due to the conservatisms in the analysis this is an upper bound estimate of the true CDF. The CDFs estimated for internal fires are not and should not be directly compared to the CDFs calculated in the internal events IPE. The conservatisms and uncertainties associated with a Fire PRA are much greater than those associated with an internal events PRA, thus making a direct comparison impractical and meaningless. The Fire PRA study demonstrates that the fire hazard in most fire areas is relatively minor, whether the hazard is measured deterministically or probabilistically. From a deterministic perspective, fire sources often were predicted to damage only a few targets or, more likely, to self-extinguish. From a probabilistic perspective, the frequency of damaging fires was typically low. For the High Winds, Floods, and Others analysis, RBS meets the 1975 SRP design critena for these events. No vulnerabilities to these events are identified. O O

Rep;rt Numb:r SEA-95-OO1 Revision J_ Page 11 of _151 2.0 EXAMINATION DESCRIPTION 2.1 Introduction EOl has completed an IPEEE for River Bend Station. This section provides details on the conformance with the Generic Letter and supporting material, the general methodology and the information assembly. 2.2 Conformance With Generic Letter and Supporting Material An IPEEE has been completed and is documented as requested by Generic Letter 88-20, Supplement 4. This report conforms with Generic Letter 88-20 and its supporting material. NUREG-1407 was followed closely in preparing this report. The content and format of this report conforms with the requirements of NUREG-1407. A major thrust of GL 88 20 is that the Utility should gain the insights into severe accident behavior. EOI has expended significant resources developing in-house personnel to perform the IPEEE. The majority of contractor work was performed on-site and in-house personnel worked closely with the contractors. Because of this working philosophy, the insights and knowledge gained in performance of the IPEEE have been retained by the utility. Technical adequacy of the IPEEE is assured by a combination of: Use of information from robust documents Use of knowledgeable individuals Evaluation by multiple individuals Performance of a Peer review There are two sources of information which were critical to the performance of the IPEEE. The first source is the River Bend Level 1 PRA [141. The Level 1 PRA provided the majority of the system information used in the IPEEE. The second source is the Safe Shutdown Analysis (SSA)[301. The SSA provided the majority of the location informa!'on for cables and components. River Bend has expended significant resources in development of the Level 1 PRA and the SSA. Both of these sources have had independent reviews and are thus assumed to contain technically accurate information. i For the Seismic analysis, the Level 1 PRA was used in determining what components are required for safe shutdown. Two " Seismic Capability Engineers" as defined in EPRI NP-6041129) evaluated the components for seismic adequacy. Where questions arose on the seismic walkdowris, additional sources of information, such as existing calculations, were referred to. i

R; port Number SEA-95-001 ~ Revision ,,g,, - Page ..j,2, of 15.R i l 'N For the Fire PRA, the SSA provided location information for cables and components. The - Level 1 PRA provided the system information and the tools to quantify Conditional Core Damage Probabilities. Individuals knowledgeable in both the SSA and the Level 1 PRA had. significant involvement in the Fire PRA'. i There is a high confidence in the technical accuracy of the IPEEE. Knowledgeable individuals performed the analysis using robust sources of information. Additionally a Peer l review was performed which provides additional assurance that the IPEEE is technically - ' accurate. 2.3 General Methodology i The IPEEE consists of three separate analyses: l} e Seismic Analysis i e Intemal Fire Analysis l e High Winds, Floods and Others Analysis This section gives a brief description of the methodology used in performing these analyses. i 2.3.1 Seismic Analysis River Bond Station (RBS) is classified in NUREG-1407 as a reduced-scope plant based on. . low seismicity; therefore, emphasis was placed on conducting detailed seismic . I walkdowns. Guidelines and procedures documented in Electric Power Research Institute j (EPRI) Report NP-6041, Revision 1 [29] were used in performing this work. ~ Since River Bend Station is a reduced-scope plant, the Safe Shutdown Earthquake (SSE) ) ground response spectra and corresponding in structure response spectra were used as j the Review Level Earthquake (RLE) input for the walkdown and evaluation, as requested ] by the NUREG-1407. No new in structure response spectra were developed and those ') contained in the River Bend Nuclear Station Updated Safety Analysis Report (USAR) were utilized. ) i Success Path Logic Diagrams (SPLDs) were developed to identify the systems that must func; ion in order to successfully cool the reactor core following the occurrence of a RLE. The existing Level 1 PRA was the primary source document for the identification of j systems and components required as part of the Success Path Logic Diagram (SPLD). The l equipment identification task resulted in identifying eleven systems and 276 components l which were evaluated for seismic adequacy. l 2.3.2 Fire Analysis l i A Fire PRA was performed to meet the objectives of the IPEEE. The methodology used l was a progressive screening analysis. If at anytime in the screening the CDF for a fira .i area dropped below 1 x 104/yr [16] then the fire area was screened. Conservatism was i removed progressively in steps and areas were screened from further analysis when they j could be shown to be of low risk significance. This methodology allowed increasing i l i F .I

- - ~ ~~ -... a Repsrt Number SEA-95-OO1 I Rwisiin ,g,. Page .13. of _L%t, 3-Lresources to be used on the more risk significant areas. The models and methods used in the intomal events IPE served as the basis for quantification of the Conditional Core Damage Probabilities (CCDPs). The event trees and j fault trees were modified slightly to account for equipment for which cable location information was available. i The Safe Shutdown Analysis (SSA) served as the basis for cable and component location information. 2.3.3 High Winds, Floods and Others High Winds, Floods and Others are external events other than seismic, internal fire, or ~~ internal flooding events that may be initiators of accident sequences leading to core damage. Such phenomena are potentially important because they may affect multiple components. An accident involving a number of different component failures may be nearly incredible in the absence of some externalinfluence, but may be possible under the occurrence of a tornado, for instance. As recommended in Generic Letter 88-20, Supplement 4,121, the methodology employed for analyzing other extemal events at River Bend Station (RBS) was a screening approach. The first step in the screening approach was to determine if the criteria of the 1975 Standard Review Plan (SRP) [271 are met. .n general, the information contained in the Updated Safety Analysis Report (USAR) [28) was reviewed to determine its present applicability, and hardware and procedural changes were reviewed to determine any resultant significant vulnerabilities. This information was -l used to judge whether RBS presently meets the criteria contained in the 1975 SRP (271. J 2.4 Information Assemtdy This section describes the approach taken in assembling information for the IPEEE. Additional plant layout information not contained in the USAR is provided in Figures 4-1 through 4 5. These figures provide information on the Fire Areas as analyzed in the SSA. The two major sources of information were the Level 1 PRA and the SSA. Both of these sources have programs to ensure that they are updated to reflect the as-built, as-operated plant. These programs were not evaluated further as part of the IPEEE. Individuals who were knowledgeable in the Level 1 PRA and the SSA and also review modifications to assess the impact on these analyses had significant involvement in the IPEEE. Where different sources of information were used, appropriate measures were taken to ensure that the information represented the as-built, as-operated plant. f The only major coordination activities between the IPEEE teams, other than team members and sources of information (e.g., Level 1 PRA), was in the analysis of seismically induced { fires.

Report Number SEA-95-001 (T Revision ,Q. {} Page 14 of 15_%, 3. SEISMIC ANALYSIS 3. METHODOLOGY SELECTION River Bend Station (RBS)is classified in NUREG-1407 as a reduced-scope plant based on low seismicity; therefore, emphasis was placed on conducting detailed seismic walkdowns. Guidelines and procedures documented in Electric Power Research Institute (EPRI) Report NP-6041, Revision 1 [29] were used in performing this work. Since River Bend Station is a reduced scope p! ant, the Safe Shutdown Earthquake (SSE) ground response spectra and corresponding in-structure response spectra were used as the Review Level Earthquake (RLE) input for the walkdown and evaluation, as requested by the NUREG-1407. No new in-structure response spectra were developed and those contained in the River Bend Nuclear Station Updated Safety Analysis Report (USAR) were utilized. Success Path Logic Diagrams (SPLD) were developed to identify the systems that must (~ \\ function in order to successfully cool the reactor core following the occurrence of a RLE. \\ The existing Level 1 PRA was the primary source document for the identification of systems and components required as part of the SPLD. The equipment identification task resulted in identifying eleven systems and 276 components which were evaluated for seismic adequacy. 3.1 EPRI Seismic Margins Method (SMM) The EPRI Seismic Margins Method (SMM) was used to perform the seismic analysis. This section provides the details about the analysis. 3.1.1 General Plant information and Seismic Input This section provides general plant information and the seismic input used in the analysis. 3.1.1.1 General Plant Information River Bend Station is a single unit 936 Mwe (net) nuclear power plant. The nuclear i system is a direct-cycle, forced circulation, GE BWR6/ Mark 111 reactor that produces steam for direct use in the steam turbine. The Construction Permit and Operating License dates were March 1977 and October 1985, respectively. The plant site is located in West Feliciana parish,3 miles southeast of St. Francisville, i g Louisiana, and approximately 24 miles northwest of Baton Rouge. The site lies within the ( Southem Hills section of the Gulf Coastal Plain physiographic province approximately 85 l

RIport Numb;r SEA-95-001 Revision _Q, Page _11 of 159 n i 4 V miles from the Gulf of Mexico. The plant area is situated on the uplands adjacent to the Mississippi Alluvial Valley. These uplands are composed of the fluvial deposits of the Pliocene-Pleistocene Citronelle Formation and the Pleistocene Port Hickey Terrace Formation with a thin blanket of overlying loess. The Citronelle Formation is underlain by hard Pascagoula clay. The site is located in an area of infrequent and low seismicity, typified by shallow focus earthquakes. Twenty-eight earthquakes of epicentral MM Intensity lil-IV or greater have occurred within 200 miles of the site. Of these, only four have occurred within 100 miles of the site since 1811. Significant faulting associated with the New Madrid fault zone, which is located approximately 360 miles north of the site, trends southwest to about 31 miles northwest i of Memphis, Tennessee. The southern extent of this fault zone is regarded to be a point near Memphis, which is 310 miles north of the site. The Donaldsonville and New Madrid earthquakes are considered to be the only earthquakes important to the site and were felt at the site with MM Intensity IV and IV-V, respectively. No surface faulting was found within a 5 mile radius of the site. Consequently, a SSE was selected at 0.10g at the foundation grade based on the seismicity of both the Mississippi embayment and Gulf Coast Basin tectonic provinces. The principal buildings and structures which house the success path equipment are: the primary containment structure, the shield building, the auxiliary building, the fuel building, b the control building, the diesel generator building, and the ultimate heat sink. These V buildings are founded on dense, compacted, granular fill overlying dense, buried channel sands, and gravelly sands and hard tertiary clays. The sedimentary deposits overlie bedrock. The buildings and internal structures essential to the safe operation and shutdown of the plant are designed in accordance with recent industry codes and Nuclear Regulatorf Commission (NRC) regulations to provide protection as required from tornadoes, i l earthquakes, and the failure of equipment producing flooding, missiles, and pipe whip. The plant was designed based on the NRC Standard Review Plan (SRP) and associated Regulatory Guides (RG) published after 1973. The primary containment structure is a Seismic Category 1 structure which encloses the reactor coolant system (RCS), the drywell, the suppression pool, the upper fuel pool and refueling cavity, and some of the engineered safety feature systems and supporting systems. The shield building is a limited leakage Seismic Category 1 structure that completely encloses the primary containment structure, it is designed to withstand all design basis environmental events, including tornadoes. The primary function of the shield building is to provide missile protection for the primary containment. The auxiliary building is a Seismic Category 1 structure that contains engineered safety systems and necessary auxiliary support systems. p)

R; port Numb;r SEA-95-OO1 Revision _Q_ Page

16. of _151.

,n U The fuel building is a Seismic Category 1' structure that contains fuel storage and shipping equipment and necessary auxiliary support systems. The control building is a Seismic Category 1 structure in which many of the control and electrical systems, including required support systems directly related to safety or necessary for plant operations, are located. The diesel generator building is a Seismic Category 1 structure enclosing the three diesel generators and their associated equipment. Each diesel generator is in an individual room within the diesel generator building. These rooms are separated by concrete fire walls. The ultimate heat sink consists of a Seismic Category 1 combination mechanical draft standby cooling tower /pumphouse/ basin structure. The tower consists of four cells; each cell has an induced draft fan system. The cells are completely isolated from each other and have separate missile-protected inlet distribution piping systems. 3.1.1.2 Seismic input The plant design response spectra for horizontal and vertical ground motions for SSE and the operating basis earthquake (OBE) are in accordance with requirements of RG 1.60. The maximum ground acceleration for both horizontal and vertical motion for SSE is 0.1g and for OBE is 0.05g. Synthesized acceleration time histories were generated by matching the design response spectra for several specified damping ratios. (n) Since River Bend Station is a reduced-scope plant, the SSE ground response spectra and corresponding in-structure response spectra are used as the RLE input for the walkdown and evaluation (as required by NUREG-1407). No new in-structure response spectra are developed, and those contained in the USAR [281 are utilized. During the seismic walkdown, the equipment was inspected considering a 0.5g or 1.0g input depending upon the building and elevation. In determining input acceleration vaiues from the in-structure response spectra, it was judged that the equipment has fundamental frequency greater than 5 Hz and a damping value of 5%. Tables 3-1 and 3-2 summarize i the input accelerations for different buildings and elevations. 3.1.2 System Analysis This section describes the process used in selecting the equipment for which the seismic adequacy was determined. 3.1.2.1 Success Path Logic Diagrams (SPLDs) SPLDs were developed to identify the systems that must function in order to successfully cool the reactor core following the occurrence of a RLE. Once the frontline systems were identified, the systems required to support the operation of the frontline systems were identified. The components that must function in order for each system to work were O then identified. These components were then the focus of the seismic review. U

Riport Numb;r SEA-95-OO1 Revision ,,Q_ Page 17 of,,159 g-tC) The existing Level 1 PRA [14] for River Bend Station (RBS) was the primary source l document for the identification of systems and components. The Level 1 PRA models are of high quality and have been independently reviewed for correctness and completeness. 3.1.2.2 Assumptions The following major assumptions for the development of the SPLDs are consistent with EPRI NP-6041 (29]. 1) Success of a path in the logic diagram is defined as the ability to achieve and maintain a stable hot or cold shutdown condition for at least 72 hours [29] following the seismic event. Note that the Level 1 PRA uses a mission time of only 24 hours. The longer mission time for the seismic margin earthquake (SME) is reasonable due to the fact that recovery of functions and systems would be more difficult and time consuming due to the ancillary damage that is likely to cccur as a resuli of the seismic event. Ths increased mission time was accounted for in reviewing the PRA systems for inclusion in the SPLD. 2) It was assumed the offsite power is unavailable for the entire 72 hour niission time. l i Again this is a reasonable assumption given the susceptibility of the offsite power and grid system to seismic induced failure and the difficulty in restoring the power once it has failed. (m) 3) It was assumed the RLE will result in a plant trip. In addition, it was also assumed that a small break LOCA equivalent to a 1 inch break may also result from the earthquake. This is based on the results of past seismic PRA work [29]. 4) Success of a node on the SPLD was measured at the system level, not at the train level. Therefore, fcr multi-train systems, if one train was determined to be seismically rugged, the o;her trains were assumed to also be seismically rugged. This assumption is reasonable since the different trains of a system are usually arranged similarly on the same elevation in the plant. However, this assumption was verified during the walkdowns to ensure there are no plant specific design features that would invalidate this assumption. 5) For the majority of systems, the non-seismically induced unavailability was not explicitly considered in this evaluation. However, for single train systems with recognized poor availability (i.e., less than 90%), additional nodes were included in the SPLD. For River Bend, the Reactor Core Isolation Cooling (RCIC) cystem has had a historical conditional probability of failure given a valid demand as high as 13% and is a single train system (the current 18 month rolling average of maintenance unavailability plus RCIC failure to start is 9.81% as of 3/95). Therefore, RCIC was not considered as a successful node by itself. j 6) The potential effects on seismically induced relay and contactor chatter was not evaluated for River Bend since it is a reduced scope plant. l () 7) Only those systems that must function to prevent severe core damage and their support systems were considered in this analysis. Accident consequence

Riptrt Numbir SEA-95-OO1 Revision _Q, Page _13. of_15jt . Il V mitigating systems were not included. This is reasonable given the. fact that ~ e accident consequence mitigating systems are only demanded given that severe core damage has occurred. 3.1.2.3 Principal Safety Functions The first stop in the development of the SPLDs was to define the safety functions that must be accomplished to achieve and maintain a stab'e shutdown. Chapter 3 of EPRI NP-6041 [29] identifies four such functions. These are: ,1) Reactivity Control, 2) Reactor Coolant System Pressure Control, 3) Reactor Coolant System inventory Control, and 4) Decay Heat Removal. Similarly, the Level 1 PRA [14] also defines safety functions that must be accomplished to successfully mitigate the events analyzed in the PRA. The events modelled in the PRA that are of interest here are a Loss of Offsite Power event (LOSP) and/or a Small LOCA. The safety functions for a Small LOCA from ths PRA are: 1) Reactor Subcritical, O 2) Emergency Core Cooling, 3) Early Containment Overpressure Protection, and 4) Late Containment Overpressure Protection. The safety functions for LOSP from the PRA arc: 1) Reactor Subcritical, 2) RCS Overpressure Protection, 3) Emergency Core Cooling, and 4) Residual Heat Removal. As can be seen, the safety functions from EPRI NP-6041 are assentially identical to the safety functions for a LOSP as defined in the PRA. The Small LOCA safety functions l' include containment overpressure protection functinns which are not included in the other two lists. Late containment overpressure protection is equivalent to Decay Heat Removal (DHR), Short term containment overpressure protection is accomplished through passive operation of the vapor suppression systern. This consists of the weir wall inside the drywell, the drywell to suppression pool vents, and the suppression pool. These components are all passive in nature and need only maintain their structural integrity in order to accomplish the function. Since they are an integral portion of the containment design, and the containment is the most rigorously seismically designed and analyzed portion of the plant,it was assumed that the vapor suppression system is not susceptible to seismic failure and was not considered further. Therefore, from above it can be seen that the four safety functions from the EPRI NP-6041 [29) are equivalent to the safety functions defined for the eventa of interest in the PRA

R: port NumbIt SE A-95-OO1 Revision .f_ Page 19 of _151 [14]. The four safety functions formed the basis for the identification of the frontline systems for the SPLD, i 3.1.2.4 System Success Criteria For each of the four safety functions, systems that can accomplish that function, either singly or in combination, were defined. The PRA identifies successful system combinations for each of the functions for each initiator. These lists were used as the basis for identifying the frontline systems for inclusion in the SPLD. Only systems that can successfully cope with both boundary conditions (i.e., LOSP and Small LOCA) were ) identified. In this way, all success paths on the SPLD met both boundary conditions. Systems that can successfully perform each safety function, either singly or in combination, are identified below: Reactivity Control Reactor Protection System and Control Rod Drive System Alternate Rod Insertion System and Control Rod Drive System Standby Liquid Control System RCS Pressure Steam Line Safety Relief Valves Control Main Steam isolation Valves p RCS Inventory High Pressure Core Spray System Q Control Reactor Core Isolation Cooling System Low Pressure Core Spray and Automatic Depressurization System Low Pressure Coolant Injection System and Automatic Depressurization System Standby Service Water Cross-tie and Automatic Depressurization System i Decay Heat Suppression Pool Cooling Mode of Residual Heat Removal System Removal Containment Fan Unit Coolers 3.1.2.5 Support System Identification With the frontline systems identified,it was necessary to identif y the support systems that are required to function in ordar for the frontline systems to operate. As part of the PRA, system notebooks were developed for each of the systems that were modelled, in the system notebooks, dependencies between frontline and support systems and among support systems themselves are identified through the use of depen lency diagrams. The information in the dependency diagrams was collected and organized into dependency matrices. First, the system notebooks were reviewed to identify the support systems for each frontline system. This information is summarized below: Reactor Protection System / AC Electric Power ](- Control Rod Drive DC Electric Power Instrument Air System

Rrport Numbtr _ SEA-95-OO1 RIvision _Q,, Page _2Q, of _,153, n Standby Liquid AC Electric Power (,/ Control System Safety Relief Valves / ADS Engineering Safety Feature Actuation System DC Electric Power instrument Air System Penetration Valve Leakage Control System Main Steam isolation Valves ESFAS DC Electric Power Instrument Air System High Pressure Core ESFAS Spray System AC Electric Power DC Electric Power HVAC (Pump Room Cooling) Reactor Core isolation DC Electric Power Cooling System ESFAS HVAC (Main Steam Tunnel & Auxiliary Building) Low Pressure Core AC Electric Power Spray System O DC Electric Power ESFAS HVAC (Pump Room Cooling) Low Pressure Coolant AC Electric Power injection System DC Electric Power ESFAS HVAC (Pump Room Cooling) Standby Service AC Electric Power Water Cross-Tie DC Electric Power Suppression Pool Cooling AC Electric Power DC Electric Power HVAC (Pump Room Cooling) Standby Service Water Containment Fan AC Electric Power Unit Coolers DC Electric Power Standby Service Water ESFAS in addition to support systems providing support functions to the frontline systems, they also provided support to each other. These dependencies must also be identified. Aga system notebooks are prepared for the support systems modelled in the PRA and these py! were used as ti. basis for identifying support system to support system dependency.

i l Rep;rt Numbir SEA-95-OO1 Revision ' Q., j Page .21, of _15.3_ i k]f 1< These are summarized below: 3 AC Electric Power DC Electric Power Standby Service Water HVAC 4 DC Electric Power AC Electric Power HVAC Standby Service Water ESFAS DC Electric Power HVAC Instrument Air System HVAC Penetration Valve Leakage AC Electric Power Control System DC Electric Power HVAC AC Electric Power DC Electric Power - q) Standby Service Water Standby Service Water AC Electric Power DC Electric Power Reactor Plant Closed AC Electric Power Cooling Water DC Electric Power Standby Service Water The information concerning depender.cies from above is summarized in the form of dependency matrices shown in Tables 3-3 and 3-4. Note that not only complete dependencies are identified but also partial dependencies are identified. 3.1.2.6 Success Path Logic Diagram Witn the safety functions and the systems that can accomplish those safety functions identified, the SPLD were developed. The SPLD is a graphical representation showing the combinations of systems whose successful operation will result in the achievement of a stable long-term shutdown following the Seismic Margin Earthquake (SME). Each path in the SPLD for River Bend is capable of meeting the two primary boundary ccnditions, those being, LOSP and a small break LOCA. The SPLD is functionally arranged showing the combinations of systems or components that can accomplish each of the safety functions. Figure 3-1 shows the SPLD for River Bend. Each node and block on the diagram is described in detail.

Rtport Number SEA-95-OO1 Revision Q. Page 22 of _1M., O The first block on the diagram gives a listing of the support systems that are required to support the operation of at least one of the systems in the SPLD. Not all of the support systems are required for all success paths or for all systems in the success paths. The details of the dependencies between the frontline and support systems are given in Table 3-4. The axt node in the SPLD is the function of Reactivity Control. This node consists of two parallel paths. One path is made up of reactor scram block, which is accomplished by the Reactor Protection System (RPS) working in conjunction with the Control Rod Drive (CRD) System. This path and block represents t'ne insertion of control rods into the core in response to an automatic scram signal generated by RPS to shutdown the reactor. An automatic scram signal could be generated by any o~ne of a number of causes for the occurrence of a seismic event including the LOSP which would cause a load rejection and turbine trip causing a reactor scram. The second parallel path is made up of the Standby Liquid Control (SLC) System block. This block represents the injection of sodium pentaborate into the RCS by the SLC system such that the reactor is shutdown. However, the SLC system is only actuated manually and must be actuated quickly (within 10 minutes of the conditions requiring a scram). It is assumed that the stress levels on the operators will be higher under the conditions of interest here, namely an earthquake. Therefore, the reliability of the operators to successfully initiate SLC under the conditions being analyzed here is less than if the earthquake is not postulated to occur. In addition, for a small LOCA, depending on the location of the break, SLC may not be effective since the boron may bypass the core and go out the break. For these reasons, no credit was taken for SLC to accomplish Reactivity Controlin the SME. This is signified on the SPLD by the dashed lines. SLC is only included on the SPLD at all for completeness and to note that if it becomes necessary, a more detailed evaluation of using SLC under SME conditions could be performed. The third node in the SPLD represents the function of RCS Pressure Control. This node consists of two blocks in series. The first block is the Main Steam Isolation Valves (MSIV) block. This block represents the closure of either the inboard or outboard MSIV in each steam line. The steam lines must be isolated to prevent an uncontrolled blowdown of the reactor and bypassing of the suppression pool and containment. The second block in series is the Safety Relief Valves (SRV) block. This block represents the opening and closing of the SRVs to control reactor pressure once the reactor has been isolated by the closure of the MSIVs. Proper operation of the SRVs is necessary to prevent potential overpressure failure of the reactor coolant pressure boundary and also to provide a path to transfer heat from the RCS to the suppression pool. The fourth node in the SPLD represents the function of RCS Inventory Control. This node consists of two primary parallel paths. One path represents inventory control with high pressure systems while the other represents inventory control with low pressure systems. The high pressure path consists of two blocks in series. The first block is the RCIC system block. This block represents the injection of water into the core at high pressure by the RCIC system. Per Assumption 5 of Section 3.1.2.2, RCIC is not considered a st::cessful node by itself based on its historical performance. The second block in ceries on the high pressure inventory control path is the High Prossure Core Spray (HPCS) ] ) system block. This block represents the injection of water into the core at high pressure by the HPCS system. The HPCS block, by itself, would be a high pressure injection

l i R: port Number _ SEA-95-001 Revbion _Q, Page .21 of _153_, { O success node. The second path representing inventory control with the low pressure systems consists of two parts. The first part consists of the Automatic Depressurization System (ADS) block. This block represents depressurization of the reactor using the SRVs. At River Bend, the Emergency Operating Procedures (EOPs) always direct th operators to inhibit the automatic depressurization. Therefore, depressurization is only performed manually since it is assumed that the operators will follow the EOPs. Depressurization is always required for the use of the low pressure systems for control. This is true even with the assumption that a small LOCA exists since the assumed break size is too small to depressurize the reactor by itself in sufficient time to prevent core uncover by the low pressure systems. In series with the ADS block are three parallel paths representing the means available for low pressure inventory control. The first of these paths contains the RHR-Low Pressure Coolant Injection (LPCI) block. T RHR-LPCI block represents the injection of water into the core at low pressure usin) LPCI mode of RHR. '(LPCS) system block. The LPCS block represents the injection l low pressure using the LPCS system. The third parallel path contains the Standby Se Water (SSW) system Cross-tie block. The SSW Cross-tie block represents the inje i of water into the core using the SSW pumps by cross-tieing the SSW heeder to the LPC division 2 injection line. Both the high and low pressure paths for RCS inventory Contro i are capable of performing their functions for both the conditions of LOSP and the existence of a small break LOCA. The fifth and final node of the SPLD represents the function of DHR. This node consists of two primary parallel success paths. The first of these paths represents the removal of O decay heat using the Residual Heat Removal (RHR) beat exchangers in the Suppress Pool Cooling (SPC) mode. This path contnins the RHR-SPC block. The RHR SPC bloc represents operation of the RHR system in the SPC mode in which water from the suppression poolis circulated through the RHR heat exchangers. Note that for the SPC mode to work, decay heat from the core must be rejected to the suppression pool th 'l the SRVs. This also requires a continued means of making up inventory to the RCS The second parallel success path for DHR consists of the Containment Fan Cooler block. The i Containment Fan Cooler block represents operation of the containment fan coolers to remove heat from the containment atmosphere. As with SPC, this mode requires the decay heat from the core to be rejected to the suppression pool through the SRVs. The heat is then transferred from the suppression pool to the containment atmosphere steaming of the suppression pool. The decay heat is then removed from the atmosphere by forced circulation through the Containment Fan Coolers, and over their cooling c Note that this capability to use Containment Fan Coolers is unique to River Bend a all Mark lli designs. 3.1.2.7 Primary and Alternate Success Path Selection i With the SPLD developed, which defines all success paths, one primary success path ! one attemate success path were chosen. Per the requirements of EPRI NP-6041 [29), at t least one of 9ese paths must be for the case where a small containment LOCA occurs inside conta:nment. However, all of the paths included in the SPLD for River Bend are successful for small break LOCAs and this requirement did not limit the selection of the O primary and alternate success paths. It can also be seen from the SPLD that there are certain nodes that are common to all success paths. No credit was initially taken for the i

R: port Numb;r SEA-95-OO1 Rsvision _Q, Page 24 of E j_ (3 SLC as means of reactivity control. Therefore, only Reactivity Control using the RPS/CRD V block is possible and that block is common to all success paths. Also, RCS Pressure Ccntrol can only be accomplished by the MSIV and SRV blocks in series. Therefore, the MSIV and SRV blocks are common to all success paths. For the RCS Inventory Control function, there are two principle success paths, one representing use of high pressure systems and one representing use of low pressure systems. The use of high pressure systems to controlinventory is preterable to using low pressure systems since their use would avoid the need to depressurize the system and would allow a controlled cooldown and depressurization. Therefore, the high pressure success path was selected as the primary success path. Since the high pressure success path has only one path, the RCIC and HPCS blocks in series, an attemate had to be chosen from the low pressure path. The ADS block is common to all three potentiallow pressure inventory control paths. The only choice involved the actuallow pressure injection system to be used. The SSW Cross-tie is the least likely of the three to be used. This system would put relatively low quality water from the standby cooling tower into the RCS and would only be used after all other altematives have failed. Per EOP-1 (Reactor Pressure Vessel (RPV) Control, Revision 10), Level Control, the preferred order of providing injection into the vessel with low pressure systems is LPCS and then LPCI. Also, a mode of the RHR system (SPC) appears on the primary success path. Since the majority of components are the same for both LPCI and SPC, using LPCI as the injection means for the attemate success path would result in a high degree of commonality between the primary and alternate success paths. Therefore, LPCS was selected as the (O d low pressure inventory control system for the alternate success path. For the DHR function, there are only two paths on the SPLD, one with SPC and the other with the Containment Fan Coolers. SPC is the preferred means of DHR since it will minimize the temperature increase of the suppression pool and the containment atmosphere. It is also true that the RCIC system will lose Net Positive Suction Head (NPSH) if the suppression pool temperature is above 1730F and RCIC suction is aligne to the suppression pool. All other Emergency Core Cooling System (ECCS) pumps (HPCS LPCI, and LPCS) are not limited by suppression pool temperature. For these reasons, SPC mode of RHR is selected as the DHR system for the primary success path while Containment Fan Coolers are selected for the alternate success path. The primary and altemate success paths selected for River Bend are summarized in Table 3-5 and are shown in Figures 3-2 and 3-3. 3.1.2.8 System Operational Aspects In this section, the operational aspects of the systems identified on the primary and alternate success paths of the SPLD is discussed. The operational aspects determine how the systein is operated by both automatic systems and by the operators. The way the system is operated aided in the identification of the components in the system that must operate and how they must operate for the system to accomplish the required function to achieve a stable safe shutdown. O

RIport NumbIt SEA 95-OO1 Revision .Q Page _2.5. of 1.5.2, f3b Reactor Scram Reactor Scram is accomplished by insertion of the control rods into the core. The reactor scram consists of parts of two systems - the RPS and the CRD system. For the CRD, the system responds automatically to a demand signal from the RPS. The CRD then responds by driving the rods into the core and shutting down the reactor. The RPS can also function automatically. In response to any one of a number of off-normal parameters, the RPS will generate a scram signal. For example, LOSP is assumed to occur as a result of the seismic event and LOSP will cause a RPS signal to be generated. Manual actuation of reactor scram is also possible. The operator can manually initiate a RPS scram signal. He can also manually insert the control rods using the CRD controls. However, for the case under study here, conditions to produce an automatic scram will always be present. Therefore, only automatic operation of RPS and CRD was evaluated. RCS Pressure Control RCS pressure controlis accomplished by closure of the MSIVs and by opening and closing of the SRVs. The MSIVs must close to isolate the RCS and prevent excessive blowdown and loss of steam pressure and coolant inventory. The SRVs must open to prevent overpressure challenge to the integrity of the RCS and then must reclose to minimile loss of steam pressure and coolant inventory. In addition, the cycling of the SRVs serves to remove decay heat from the RCS and deposit it into the suppression pool. The SRVs will open and clo se in their relief mode to accomplish the function of RCS pressure control. In the relief misde, the SRVs require no extemal supports to function. The MSIVs receive various sigr.als to close. The MSIVs do not require power or air support to close; the valves are spring loaded to fait closed on loss of either. itis expected that the MSIVs' would receive at least one automatic close signal under the conditions being postulated here. The most likely signals are low steam pressure, low-low-low reactor vessel level (Level 1), or high condenser vacuum. Even in the event no automatic signalis generated, instrument air would be lost on LOSP and the MSIVs would close es result of loss of air pressure. Therefore, the MSIVs will close to accomplish the function of RCS pressure control without external supports or signals. RCS Inventory Control The primary success path for RCS inventory control consists of the HPCS and RCIC systems in series. Both HPCS and RCIC will be automatically started on a low-low reactor vessel level (Level 2) signal. Both of the systems have sufficient flow that they can refill the vessel, therefore, both systems will automatically trip on high reactor vessel level (Level 8). HPCS and RCIC will continue to auto-start on Level 2 and trip on Level 8 indefinitely. It is much more likely, however, that the operators will throttle flow to maintain a constant levelin the range of the normal operating level (between Level 3 and Level 4). Another issue related to operation of HPCS and RCIC is the suction source. Both HPCS and RCIC are normally aligned to receive water from the Condensate Storage Tank (CST). However, the CST does not have sufficient volume to provide suction for either RCIC or HPCS for a period of 72 hours. Therefore, the CST will drain during the mission time for this analysis. When a pre-determined low levelis reached in the CST, the suction for both RCIC and HPCS will transfer to the suppression pool automatically. Therefore, the suppression pool will be considered to be the primary water source for RCIC and HPCS. However, the CST level sensors must be available initially to allow for the transfer of the suction from the CST to the suppression pool. The attemate success path for RCS inventory control consists of the ADS and LPCS in O series. ADS is designed to automatically depressurize the reactor if a sustained low level (Level 1) occurs or Level 1 and high drywell differential pressure occurs. However, the

Report Numbsr SEA-95-001 Revision ,Q_ Page .2f_ of 1R _ O River Bend Station EOPs direct the operators to inhibit automatic actuation of ADS whenever the ADS timer has initiated. The action to depressurize the RCS using th ADS /SRVs is a manual action taken by the operator. The EOPs direct the operator to manually depressurize the RCS if the vesselIcret drops below -160" (top of active fuel) provided at least one low pressure injection source is lined up and operating or if the lev drops below -205" (minimum level to support steam cooling) regardless of the status injection systems. Therefore, the automatic logic portion of ADS is not required to be verified for ADS operation after a seismic event. Also, each ADS valve is supplied with a 60 gallon accumulator which is normally kept pressurized with air from the Safety A Compressors (SVV) with backup from the Penetration Valve Leakage Control System (PVLCS). However, there is sufficient air in the accumulators to allow operation of the valves throughout the mission time of 72 hours. At least one valve will have to be op to maintain the RCS in a depressurized state and allow continued low pressure injectio A single ADS or SRV accumulator does not have sufficient air volume for 72 hours, but the valves can be rotated and at least one kept open for the mission time.LPCS is automatically initiated on low-low-low vessel level (Level 1) or high drywell differential The LPCS injection MOV is interlocked and will not open until the RCS is pressure. depressurized below 487 psig. Therefore, on initiation, the minimum flow line must be open to prevent dead-heading the LPCS pump until the injection MOV opens. minimum flow line must then close to prevent diversion of flow to the suppression po The Al!of the actions of LPCS are automatic, but they can be performed manuallyif nec Qs::av Heat Removal The primary success path for the DHR function involves the use o the SPC mode for the RHR system. SPC is not automatically initiated; it is only initiated i ma nually. The EOPs direct the operator to initiate SPC if the suppression pool temperature e>.eeeds 95 F. The RHR pumps must be manually initiated and the MOVs aligned remote mr.nually to route return flow from the RHR heat exchangers to the suppression pool. In addition the SSW system must be started,if not already running, and flow initiated to the RHR heat exchangers. The attemate success path for DHR involves use of the containment fans. The containment fans are unique amongst U.S. BWR6/ Mark lit de The containment fans and coolers cemove decay heat from the containment atmos and transfer it to the ultimate heat sink through the SSW. The containment fans are automatically started on a LOCA signal (Iow levelin the vessel or high drywell pressure). In addition, the Turbine Building Chiller Water (HVN) supply to the containment fan coo is isolated and the coolers are automatically aligned to the SSW. Another operational aspect that must be addressed is the interaction among the sys in the success paths. In some cases this is obvious as in the requirement for ADS to depressurire the reactor in order for LPCS to provide injection. Less obvious exam the interaction between the injection systems and DHR. All of the injection systems i both the primary and attemate success paths will at some point during the mission tim i be taking suction from the suppression pool. There must be adequate NPSH availablei the pumps when drawing from the suppression pool to prevent cavitation and failure of the pumps. Fortunately, the design at River Bend Station is such that the HPCS and systems can take suction from the suppression pool with the pool water saturated and at minimum level and maintain adequate NPSH. However, RCIC will lose adequate HPSH once the suppression pool water temperature reaches 173 F. This means that for RCIC O to be successful, SPC must be used for DHR. HPCS and LPCS can be successful with

Rrport Numbrr SEA-95-OO1 Revision _Q. Page 1 2. of_152. either SPC or containment fan coolers removing decay heat. This is reflected in the definitions of the primary and alternate success paths. 3.1.2.9 Equipment identification and Selection With the frontline and support systems for the primary and alternate success paths identified, the equipment and components in those systems that must function in order for the system to accomplish its function were identified. These components formed the basis of the seismic walkdowns. The equipment can be broken down into several basic types. These are active and passive fluid-mechanical equipment and electrical equipment. Examples of each type are given below. Active Fluid-Mechanical Comoonents Examples include pumps, engines, fans, compressors, turbines, refrigeration units, and valves that' change state. Actuators on valves that do no change state, check valves with no external vulnerabilities, and manual valves are assumed to be of no concern from a seismic ruggedness standpoint and are not included in the component list. Passive Fluid-Mechanical Comoonents Examplesinclude heat exchangers, cooling towers, pipe runs, ductwork, and filters or screens or strainers that could fail the intended system safety function. Electrical Eauioment Examples include motors, generators, switchgear, load sequencers,

• O motor controf centers, panels, buses, chargers, inverters, batteries, breakers, transformers, and ceramic isolators. Since River Bend is a reduced scope plant and is not an A-46 plant, evaluation of relay chatter is not required and was not performed. Individual relays were not identified.

The equipment in the various systems was identified from review of piping and instrumentation drawings (P&lDs) and electrical schematics, in addition, the systems were all included in the Level 1 PRA (14]. The PRA fault tree models were also used as a primary source to identify the components in a system. For each of the active components, its power supplies were identified to determine the portions of the electrical system that must be included. Instrumentation and Control (l&C) components were identified based on the information provided on system operation. This identified the l&C required to operate the systems. For each item identified, its unique identifier, a brief description of the component, its size and generallocation was identified, in addition,its control and motive power sources, if applicable, were identified. The initial and operating position or state of the component was identified. Any additional comments needed to understand the functioning of the component were included in the equipment list. The components were identified on a system by system basis, with the systems grouped by safety function. With regard to valves, the following rules were used to determine whether a valve was included in the equipment list. A valve was listed on the equipment list if it was: 1) An MOV that changed state, either open to closed or closed to open. 2) An MOV on a line 2" or less in diameter. 3) A manual valve that changed state.

R:ptrt Number _ SEA-95-OO1 R; vision jl. Page .2H, of M Check valves, manual valves, AODs and MOVs that did not change state were not listed. The performance of the equipment identification task resulted in the identification of 276 components. This component list was the focus of the seismic walkdowns. 3.1.3 Seismic Walkdown This section describes approach to the walkdown, the screening criteria used and the details of the walkdown. 3.1.3.1 Approach ' The key element of a reduced-scope evaluation is the plant walkdown. The a to perform the systems and element selection walkdown, and the seismic capability walkdown follows the recommendations of EPRI NP-6041 [29). This includes the following parts: Selection of assessment team e Pre-walkdown prep 3 ration Systems and element selection for walkdown e Seismic capacity walkdown e The assessment team, all part of the Seismic Review Team (SRT), was made up of eight I members, collectively possessing the qualification requirements of EPRI NP 6041. Three SRT members are Entergy Operations Inc. (EOl), personnel and the remaining five are consultants from outside companies; two seismic engineers with Jack R. Benjamin and Associates, Inc. (JBA), and three systems engineers with Reliability And Performance Associates (RAPA). Following is a listing of the SRT members, their affiliation and area of expertise: Dr. John Reed,

JBA, seismic capability engineer Dr. Bhaman Lashkari,

JBA, seismic capability engineer Dr. Wang Lau,

RAPA, systems engineer Mr. William D. Salyer,

RAPA, systems engineer Mr. Robert F. Christie,

RAPA, systems engineer Mr. Paul A. Miktus,

EOi, seismic capability engineer Mr. Hamil O. Grimes,

EOi, seismic capability engineer Mr. Todd A. Reichardt,

EOi, systems engineer The SRT was assisted in their walkdown by utility staff from operations, who helped locate components and make plant access arrangements.

Prior to the walkdown, preparatory work was performed that consisted of gathering and reviewing information about the plant design and operation including: USAR 130}, specifications, drawings, qualification calculations, and existing hternal events PRA [14]. O

R port Numbir SEA-95-OO1 Revision ,Q, Page _21 of 1.,51 (] The frontline and support systems for the primary and alternate success path and the V equipment and the components in these systems that must function in order for the system to accomplish its intended function were identified by the systems engineers. A system and element selection walkdown was then conducted by the systems engineers to review the components for any obvious seismic problems and to locate and arrange access for equipment for the subsequent seismic capability walkdown, in addition to 276 Components, the following structures, housing the equipment, were included in the success paths: primary containment structure shield building e auxiliary building e fuel building e control building diesel generating building e ultimate heat sink (i.e., standby cooling tower) The SRT then conducted the seismic capability walkdown and reviewed the equipment and components from primary and alternate success paths for seismic adequacy (both structuralintegrity and anchorage) and system interaction (SI). The SRT review consisted of detailed walkdown of the representative equipment, and walk by of similar equipment. For a few components, because of inaccessibility or harsh radioactive environment, inspection was made based on a review of drawings. The SRT detailed walkdown results are recorded on screening and evaluation sheets (SEWS), adopted from EPRI NP-6041, Appendix F, which are retained as Tier 2 documentation. Because River Bend Station is a reduced-scope plant, no action is required for evaluation of relay chatter er potential soil failure. However, the adequacy of the relay attachment toits supporting components was verified during the walkdowns. No High Confidence-of-Low-Probability of Failure calculations were performed. Any concern identified during the walkdowns were reviewed per the USAR [30) commitments. Additionally, the potential for earthquake-caused fire hazard and intemal flooding was addressed and reviewed for the areas in which the success path equipment is located. 3.1.3.2 Screening Criteria Initially, the SRT pre-screened a number of structures, components, and equipment using the screening guidelines given in EPRI NP-6041 [291. Tables 3-6 and 3-7 provide a general listing of the pre-screened structures and equipment and the basis for the pre-screening. These tables are based on the screening guidelines given in Tables 2-3 and 2-4 of EPRI NP-6041 for the spectral accelerations less than 0.8g. The walkdown and inspection of piping and ducting systems (as well as verification of screening for cable trays; was performed on a area basis. As opposed to selecting specific trains or runs of distribution systems, the areas where these systems are located were p generally inspected. All distribution system elements in an area were either walked down d or walked by. Using this approach distribution system components included in the

l Regrt Number. SEA.95-OO1 Revision _Q_ Page 20_, of 159 (N success paths, as well as elements not included, in an area were inspected. This was () determined to be an efficient approach since all subsystems were found to be ru supported. During the walkdown the bases for pre-screening were verified for the success p structures and equipment selected for review. The issues and considerations discussed in Appendix A of EPRI NP-6041 and the judgement of the SRT were used as the b verifying that the screened out elements are seismically rugged. 3.1.3.3 Walkdown Preparation To assure an efficient use of time and to narrow the scope and focus of the seismic walkdown, preparatory work prior to the walkdown was carried out. This work consisted of reviewing plant seismic design documents. following items: The information reviewed included the Selected sections, including seismic sections, of the plant USAR [301. Plant general arrangement drawings, civil / structural drawings, specifications, and representative anchorage details for equipment in the success path. Sample seismic equipment qualification reports, example equipment anchorage calculation packages. g) In-structure response spectra for elevations where success path equipment and V components are located. Topical and vendor reports and calculations. Preliminary list of the success path equipment selected by the systems engineers Anchorage details and drawings indicate that the equipment anchorage at River Bend is extremely rugged. The constructed anchorage in the plant was verified during the walkdowns and was found to meet or exceed the standard details. For equipment with unique anchorage, adequacy was judged based on SRT experience. 3.1.3.4 Walkdown Process The SRT conducted two walkdowns during the plant planned outage. Each walkdown consisted of reviewing the success path equipment for structural integrity, anchorag adequacy, and systems interaction. Attention was directed to anchorage and SI since these would be the major modes of failure for most equipment. The SRT walkdown included detailed inspection of representative equipment and w of similar components. A few components, because of inaccessibility or harsh radioacti environment, were assumed similar to their counterparts which were confirmed based on review of drawings. To supplement the inspection of these components, a surrogate to A of the auxiliary building consisting of reviewing video photographs of the area was V conducted.

Rrport Numbsr SEA 95-OO1 Revision ,q. Page .31. of 159 The first walkdown performed on July 21,1992, focused on contaminated areas of the plant (i.e., areas requiring protective clothing) and areas which required special access;this walkdown analyzed equipment located in containment, drywell, main steam tunnel, and portions of the auxiliary building. The second walkdown performed from August 17 to August 21,1992, focused on the remaining equipment. During each walkdown the SRT requested and reviewed additional information (such as calculations and drawings) to address concerns raised during the walkdown or to confirm assumptions. Additionally, cabinets were opened when the SRT had specific interest (such as anchorage details and internal devices mounting) that allowed for a visual inspection of the internals and anchorage. 3.1.4 Walkdown Results The seismic walkdowns found River Bend Station is seismically rugged and all components in the SPLD adequately consider the seismic input. All the SPLD equipment was screened out and there were no outliers requiring further evaluation. All anchorage was found to be rugged. The SRT inspected the control room ceiling and found the ceiling to be seismically adequate with numerous wire tie-offs. All equipment above the ceiling (e.g., ducting and conduits) have rugged supports including a domestic water storage header supported on a frame consisting of large tube sections. Based on a review of USAR [30), the SRT performed an engineering evaluation which concluded that stress corrosion cracking is not a concern at River Bend. Review of design criteria for piping indicated that piping penetrations crossing buildings are properly designed to accommodate differential thermaland seismic movements of the buildings and relative settlement between the buildings. The walkdowns also confirmed that there are no system spatialinteta:: tion concerns. No j masonry or concrete block walls are located near any of the equipmrt and vibration ) isolation devices are not utilized except for a small pump for which neoprene pads are i used. These pads do not effect the pump seismic ruggedness. All structures that house success path equipment or structures that could fail, fall and impact any success path equipment were screened out based on the EPRI NP-6041 screening Table 2-3 and verification of the screening assumptions. All the concerns raised by the SRT during the walkdown were resolved either during the walkdown or afterwards based on reviewing additional information (i.e., calculations, specifications and drawings). There are no components which require further evaluation. 3.2 USl A-45, Gl-131, and Other Seismic Safety issues 3.2.1 USl A-45 " Shutdown Decay Heat Removal Requirements" USl A-45 was completed as part of the River Bend IPE submittal in Section 3.4.3. This issue was evaluated as part of the IPEEE to determine if the risk due to seismic events l

Riport Numbir SEA-95-OO1 Revision _Q. Page ,22. of.1),2. tV impacts the Category 1 vulnerability classification assessed in the IPE. River Bend did not find any vulnerabilities due to loss of decay heat removal as a result of seismic events. 3.2.2 GI-131 " Potential Seismic interaction involving the Movable in-Core Flux Mapping System Used in Westinghouse Plants" River Bend is not a Westinghouse Plant. Therefore, this issue does not apply to River Bend. 3.2.3 The Eastern U. S. Seismicity issue (The Charleston Earthquake) River Bend is categorized as a reduced scope seismic margins plant as defined in NUREG-1407. Therefore, this is not an issue at River Bend. 3.2.4 USI A-17 " System interactions in Nuclear Power Plants" All aspects of USl A-17 were completed in the River Bend IPE report except for spatial interactions due to seismic or internal fire events and human interactions due to main control room fire. Seismic spatialinteractions were evaluated in the seismic walkdowns performed for River Bend. These seismic walkdowns were performed per EPRI NP-6041-SL. River Bend did not identify any seismic vulnerabilities due to spatial interactions. Therefore, this issue is considered complete for River Bend. i O

O O O RDCIMlY RCS CONIROL PR[SSts[ CONIROL L RDCIOR SCRAM (RPS/CRD) SUPPORI SYSIEMS: SE154AC AC POW [R 10 MARC 81 DC POW [R thJ SIEAN Sg[Iy-DRIHOUAlt [SIAS IS0lAll0N WW[S R[ LEI WV[S ~ Sig[I 2 2F@ HWAC %j3 S1Af0Bf S[lMC[ WAl[R 5' 2 SIAISBf LCIS "E CONm0[ SYStu 3 e a w Figure 3-1 Success Path Logic Diagram p y w ~ e. 1 8 ~. ~

p ,y V' CT MQY GI BENIORY gg CONIROL RIACIOR CORE

g;H PESSUE IS0lAll0N C00lBC c0Rt spgAy RIR (SPCWOD()

10NCI[HW SEET 1 WE IROM LOW PKSSUR[ CONIAft(Ni ~ CO E SPRAY FAN C00llRS Aul0milC IHt y23 KPESSUR12Alpt SYSI[W (IPCI WODE) 328

• !. 3

~ 3z SSW CROSS-it ( 10 LPCI l w m Figure 3-1 Success Path Logic Diagram

• p y l

E (continued) b

U-tee SEBAC AC P9RR K POER KACNR SChiti IM015EAll MIN EENlt ClK IElN PES 93[ be ERI MWEI ~ [5i45 M ESAMBIutES Kiti WE3 ESAlWICDRSE CIB[ $PRW f#C ung[] ~ W[ [AARI se nsuu esa mac unimar m gig 2?? Figure 3-2 Primary Success Path 2 i-E aa 32 3a t m a m a b 8

O O o Surns srstuk gagg; 15 tac AC POER EACIOR SDtW IIAsl 53 TAM 105 MSSUE CONI. I Aft MRf SAIETY NHOMMC H WCal _ DC PUER (IF5/00) 150lAII0et wtWS El[I WlWS EMSSlHlA1ElliSV5MW COE SPNAY C00llRS 5Aff [AMH [5FAS swuison own sanc sse ??? Figure 3-3 Alternate Success Path 2 [] O* 3 Z or t w m R 8

Riport Numb:r SEA-95-OO1 Revision A Page .3,2,, of M [D V TABLE 3-1 Horizontal input Acceleration (g) Elevation Building 70' 96' 114' 133' 143' Reactor Building 1.0 1.0 1.0 0.5 0.5 Auxiliary Building 0.5 0.5 0.5 0.5 0.5 Control Building 1.0 0.5 0.5 0.5 0.5 Diesel Generator Building 1.0 0.5 0.5 0.5 1.0 Standby Cooling Tower 0.5 0.5 0.5 0.5 0.5 O k l l O 4

R:psrt Number SEA-95 OO1 Revision ,g_ Page .31, of j51, 'h (d TABLE 3 2 Vertical input Acceleration (g) Elevation Building 70' 96' 114' 133' 143' Reactor Building 0.5 0.5 0.5 0.5 0.5 Auxiliary Building 0.5 0.5 0.5 0.5 0.5 Control Building 0.5 0.5 0.5 0.5 0.5 Diesel Generator Building 0.5 0.5 0.5 0.5 0.5 Standby Cooling Tower 0.5 0.5 0.5 0.5 0.5

t O

O o - 0J-l ~ 1 l i l TABLE 3-3 Frontline System - Support System Dependency Matrix Support FRONTLINE SYSTEMS Systems RPS/CRD SLC SRV/ ADS MSIV HPCS RCIC LPCS LPCI SSW SPC CFS i AC

• 1 X

X X X X X X DC

• 2

'4 '8 X X X X-X X X ESFAS

• 5

'9

• 11
• 13'

- *14

• 14
• 16 IAS

'3 '6

• 10 L

PVLCS '7 HVAC

• 12 X

X X: X SSW X-X

• 15 RPCCW.

.e7 " a". t

• {}$ -'

SEE FOLLOWING PAGE FOR NOTES t g-E s> e t i;; b = ~ -.

4 t Rep:rt Number SEA.95-Oo1 Revisiin 1 Page ',,gg, of,,j,gg,, s, O-. NOTES FOR TABLE 3-3 1. RPS trip channels are powered by VAC from the RPS MG sets. However, on i i loss of power the trip channels will failin their trip state. Therefore, the AC j power is not required for RPS to accomplish its function of interest to this analysis. /i . 2. The pilot solenoid valves for CRO for rod insertion receive their power from 125-( VDC. However, all of the pilot solenoids will failin the vent position on loss of 1 DC power which will result in rod insertion. The only exceptions are the i backup scram pilot solenoids which require DC power to go to the vent position and result in rod insertion. This is accounted for in the analysis. i 3. Instrument air supplies the motive force to hold closed the scram inlet and' outlet valves during normal operation. On loss of air pressure, the inlet and outlet i valves will open, resulting in rod insertion. This is the function of interest in this j analysis. t 4. In the relief mode the SRVs do not require any external support. However, in I orde! to open the valves in the ADS mode,125-VDC power is required to energize the pilot solenoids. Each valve has two solenoids, one powered off I Division 1 DC power and one powered off Division 2 DC power. Either solenoid O is sufficient to open the valve. 5. In the automatic mode of ADS operation, ESFAS signals for low RPV level and i i high drywell pressure are required as inputs. However, the RBS EOPs direct the operators to inhibit automatic ADS. Therefore, no credit.is taken for automatic functioning of the ADS. ESFAS signals are not required to be present for manually opening the ADS valves. j 6. Instrument air normally supplies and maintains the air pressure in the i accumulators for each SRV/ ADS valve. However, the air pressure in the accumulators is sufficient to allow the valves to be opened to depressurize and l maintain the vesselin a depressurized state. Therefore, !A support is not required for the SRV/ ADS valves to accomplish the function of interest to this analysis. 7. The Penetration Valve Leakage Control System (PVLCS) supplies backup air supply to SRV/ ADS accumulators. As discussed in note 6, this is not required ) for the function of interest to this analysis. lI o e O

... ~ - ~... i Rep rt Number SEA 95-ool' Revision.

1.

Page. 41 of m ' NOTES FOR TABLE 3 3 (continued) 8. .The pilot solenoids for the MSIVs are powered by VDC power. On loss of power the solenoids will fail to the vent position resulting in the closure of the MSIVs. The position required for the MSIVs in this analysis is closed. Therefore, the DC support is not required for the MSIV to accomplish the function of interest to this analysis. 9. The MSIVs receive signals from the ESFAS (and the NSSSS instruments) to close. However, this analysis assumes a loss of offsite power, which will result in a loss of instrument air. The MSIVs will eventually close once air is lost. Also, the MSIVs receive a large number of diverse signals to close. It is assumed that at least one of these signals will be available and survive the seismic event. 10. The MSIVs are held open by the application of air pressure from the IA. Upon loss of air pressure, the MSIVs will close, however, in this analysis, the function of concern for the MSIVs is to close. Therefore, IA is not necessary for the MSIVs to accomplish the function of concern in this analysis. 11. HPCS receives an automatic start signal on low RPV level (Level 2). However, it may also be manually started by the operator. 12. The HPCS pump room has a unit cooler. The Level 1 PRA assumed that the HPCS pump room cooler was not necessary to cool the pump room because of the relatively large size of the room and the location of an open hatch in the ceiling of the room allowing an egress for rising heat. However, the unit cooler was included as required equipment since the availability of HPCS for 72 hours without room cooling is not known. 13. RCIC receives an automatic start signal on low RPV level (Level 2). However, it may also be manually started by the operator. 14. LPCS and LPCI receive an automatic start signal on low RPV level (Level 1). However, they may also be manually started by the operator. 15. RPCCW supplies normal cooling to the RHR pump bearings. However, on loss of offsite power, the RPCCW pumps trip. SSW must be manually aligned to the .RHR bearing coolers to supply cooling. 16. The Containment Fan System (CFS) starts and is aligned to SSW on-containment isolation signal. However, it can also be manually started and aligned. O

,Ge1 l g?5h ,tE3 0 ,E* a lts O.. W CC X X X X B R S W X X SS C 2 A X X X VH x S ir M S ta E C M T L X X X y S V c Y P n S e d T 4n R -3e O S p X X X X E e P A I P O LD B U Am S Te S ts A 5 S X X X E y F S S T t E O ro N pp R 3 O u C 4 2 X X X F S D E GA P G 1 2 3 N C X X X X I A W O LL O F E R E t s r S S C W T om pe C C A S C A W C I E E F A L SW S s S I V V S C pt A D F uy E P H S B FO R OP S S O T lil l ll

l l

\\ i Rep;rt Number SEA 95@1 Revision 1 j Page-A of g r-NOTES FOR TABLE 3-4 l 1. ESFAS, specifically a LOCA signal, will provide an auto start signal to the diesel generators. However, in this analysis, a loss of offsite power is assumed. A loss of offsite power will generate an auto-start signal for the diesel generators, i Therefore, no credit is taken for the LOCA signal starting the diesel generators. 2. IA provides air to hold open the dampers providing cooling to the switchgear and battery rooms..However, the dampers are supplied with a bottled air supply that is sufficient to hold open the dampers. Therefore, the lA support to the dampers for the battery and switchgear rooms is not required. - 3. Both the AC and DC power systems normally are supplied with offsite power. However, they can also receive power from the diesel generators. This analysis assumes that offsite power is lost. 4. DC power is normally supplied by AC power through the inverters / chargers. However, on loss of AC power, the batteries can supply required loads for up to 4 hours. However, since the mission time for this analysis is 72 hours, DC cannot function for the entire mission time without AC power. 5. ESFAS logic is mostly DC powered. However, DC power is dependent in the long term on AC and the ESFAS logic, unlike RPS,is energized to trip. Due to N the 4-hour rating for DIV I and DIV 11 batteries, all ESFAS actuations will have occurrad before the batteries are depleted in the event of failure of AC. Therefore, AC power is not required to support ESFAS in this analysis. \\ l l O m

RIport Numbtr SEA-95-001 Revision _Q, l Page 44 of _152. O TABLE 3-5 PRIMARY AND ALTERNATE SUCCESS PATHS - Primary Alternate Function Success Path - Success Path Reactivity Control RPS/CRD RPS/CRD l RCS Pressure Control MSIV MSIV 7 + + r SRVs SRVs RCS Inventory Control RCIC ADS + + HPCS LPCS Decay Heat Removal RHR (SPC) Containment Fan Coolers -) i O t i l l O e f 4

Report Number SEA 95-001 Revision Q, Page g of g ,m() TABLE 3-6 Pre-Screening Basis for Structural Elements Type of Structure Basis for Screening Out l Reinforced Concrete Screened-out (drawing review) Steel Containment Shell Steel pressure boundary keyed to basemat (USAR review) Containment internal structures, shear walls, Designed for SSE of 0.1g (drawing review) footings and containment shield wasils, diaphragms, and Cat. I steel and concrete frames Masonry walls None near success path equipment (confirmed during walkdowns) Control room ceilings Adequate bracing above ceiling (confirmed during walkdown) Impact between structures Screened-out (drawing and piping review) Cat. Il structures effecting' success path Justified capable of meeting 1985 UBC Zone equipment 4 requirements (drawing review) Dams, levees and dikes Not applicable to River Bend Soil failure modes Not reviewed for Reduced-Scope plant i A

i l i Rep rt Number SEA-95-OO1 Revision A, 1 Page 4,ft of,151, ,.m j l ) kJ TABLE 3 7 PRESCREENING BASIS FOR EQUIPMENT Equipment Type Basis for Screening Out NSSS primary coolant system (piping and Screened-out (review of intergranular stress vessels) corrosion cracking documents) NSSS supports Designed for combined SSE and LOCA loads (USAR review) Reactor internals Stresses for SSE less than allowables (USAR review) Control rod drive housings and mechanisms Lateral seismic support (drawing review) Cat. I piping Walkdown of representative system Valves Screened out (confirmed during walkdown, attention was directed to MOVS for 2 inch or smaller piping) Heat exchanger and pressure vessels Walkdown of anchorage and supports (sample calculation review) Atmospheric storage tanks None in success path V Buried tanks Review of piping connections drawings Batteries and racks Review of piping connections drawings 1 Diesel generators (includes engine and skid. Visual inspection (walkdown) 1 mounted equipment) Pumps Screened-out (confirmed during walkdown) Fans, air handlers, chillers and compressors None on vibration isolators (confirmed during 1 j walkdown) l i HVAC ducting and dampers Walkdown on an area basis Cable trays and conduits Screened-out (confirmed during walkdown) l Electrical panels, cabinet switchgear, MCCs Visual inspection (walkdown) of instrurnent and racks attachment (sample SSE calculation for anchorage) Transformers Visualinspection (walkdown) of anchorage, coil restrair.u for dry units and over pressure switch for liquid-filled units (sample SSE 1 calculations for anchorage) Batter chargers and inverters Visualinspection (walkdown) of anchorage (sample SSE calculations for anchorage). ( Review of qualif, cation testing results s Temperature, pressure, and level sensors Screened-out (review of qualification testing results)

Ripcrt Numbs. SE A-95-001 Revision ,g, Page 47 of M O 4.0 FIRE ANALYSIS To meet the objectives of the IPEEE a Fire PRA was performed. 4.1 Fire Hazara Analysis The Safe Shutdown Analysis (SSA) formed the core of information for the Fire PRA. Location information for cables and components was taken directly from the SSA. Success criteria of systems was taken from the Level 1 IPE. The SSA assumes a loss of offsite power (LOSP) when ensuring that a safe shutdown path will be available. This assumption means that all of the equipment credited in the SSA is fed electrically off of an emergency (Class 1 E) bus which is diesel generator (DG) backed. No equipment fed off of the normal (non-diesel backed) busses is credited in the SSA. Determining exact cable routing of additional equipment is a very time intensive process at River Bend, therefore, very little additional cable routing analysis was performed. Since the exact routing of most of the non-class 1E equipment is not readily determined, this equipment was not credited except where its presence could be excluded either from a fire area or from fire damage. The lack of cable location information for the non-class 1E equipment and thus the reliance on class 1E equipment makes the analysis very conservative. O With some minor exceptions as described below, the fire areas defined in the SSA were U used in the Fire PRA. Figures 4-1 to 4-5 are ares maps which define the location of the SSA fire areas. Some fire areas were divided into zones where the division was a wall or ceiling. If the zone boundary was determined by its physical *:haracteristics to have a high probability of preventing fire spread to the adjacent zones, then the zones were treated separately in the Fire PRA. 4.2 Review of Plant information and Walkdown The main source of information for the Fire PRA was the existing SSA. Fire area definitions, cable routings, and equipment locations vital to the analysis were all initially based on the SSA. Plant walkdowns supplemented the information in the SSA, but the vast majority of information in the SSA was used in its original form. The RBS Combustible Loading Calculation (151 formed the basis for the initial ignition frequencies. The FIVE methodology was used for calculating the ignition frequencies and the ignition frequencies for the plant locations were taken directly from the FIVE methodology. This method requires the number of ignition sources in each area and the amount of combustible materialin each area to calculate the fire ignition frequency for each area. The RBS Combustible Loading Calculation contained all of the information required by the FIVE methodology for development of fire ignition frequencies. Walkdowns of fire areas were performed by a team consisting of a fire protection engineer, a nuclear engineer experienced in Fire PRA, and a nuclear engineer intimately familiar with the RBS Internal Events PSA. This team was believed to adequatelv represent the most important areas to be covered by the walkdown: fire growth and propagation, transient fire analysis, and RBS system interaction. Walkdown checklists 1

R:ptrt NumbIr S E A-95-OO1 RIvision _Q. Page 4_H. of _1JR, /^\\ \\ ) 'd were prepared before each walkdown. Each checklist contained information describing the fire area location, the equipment located in the area, and the conduits and cable trays located in the room. During the walkdown, the team added to the checklist such information as: details regarding locations of equipment, cable trays, and conduits (heights, distances, etc.); descriptions of suppression and detection; potential for fire spread; amounts of transient combustibles; details of any Thermo lag in the area; maintenance practices (painting, welding, grinding, etc.); and any fire protection deficiencies witnessed (in cne instance a fire door was tagged as inoperable but a short time later was repaired). 4.3 Fire Growth and Propagation COMPBRN lile was used to model fire growth and propagation. Information regarding location of potential targets was obtained as part of the walkdowns and then fed into the COMPBRN life simulations. Transient tires and electrical cabinet fires were modeled as pilot fires for COMPBRN ille simulations. Other potential fixed fire sources (pumps, valves, etc.) were modeled using the parameters of the transient fire. The walkdowns convinced the team that RBS does an excellent job minimizing the existence of transient combustibles. Waste cans typically contain only small amounts of Class A combustibles (paper, dust, wood, etc.) and are usually empty, Painting teams made use of spring-loaded safety cans for flammable materials and clearly marked the rm work area to prevent any accidental spills. All welding and grinding activities observed in V the walkdowns had a fire watch present. The individual performing the fire watch has the job of watching for sparks or welding slag which can ignite a fire. Roving fire watches were frequently encountered. No credit was taken for the roving fire watches in this analysis. Contact cleaners used in the switchgear room were non-flammable. A typical RBS transient combustible pilot fire was modeled in COMPBRN lile as having a heat release rate of approximately 380 Btu /sec and a duration of approxirnately six minutes. This is representative of a fire fueled by a moderate amount of Class A combustibles as evaluated in NUREG/CR-4680, " Heat and Mass Release for Some Transient Fuel Source Fires: A Test Report," [18) and is consistent with the recommendations in EPRI's FlVE methodology regarding representative transient combustibles. Electrical cabinet fires were modeled as having a heat release rate of approximately 90 Btu /sec and a duration of approximately thirty minutes. This is consistent with the results of NUREG/CR-4679, " Quantitative Data on the Fire Behavior of Combustible Materials Found in Nuclear Power Plants: A Literature Review," [19). The fire was conservatively modeled as being based at the top of cabinet, thus maximizing any im Jacts on overhead cables. COMPBRN lile has limitations (i.e. predicting vertical spread of fire), therefore, a conservative approach was taken regarding fire growth and propagation. The results from COMPBRN life simulations were subject to evaluation for reasonableness prior to (V) subsequent application in the Fire PRA. The analysts typically expanded the calculated influence of a fire. For example, for a transient fire beside a group of vertical cable trays, COMPBRN lile predicted damage to only one of the trays. The analysts,

~- R:pstt Numb:;f SE A-95-OO1 Revision _Q, i Page 49 of_1 E however, expanded this result to include the two neighboring cable trays, resulting in three cable trays being damaged. Fire spread from a transient fire typically did not occur except in the case of a horizontal cable tray directly above the transient fire (directly in the plume). 'In this case, COMPBRN lile indicated that a critical height above the flame existed for. fire spread to occur. Conduit above such a fire was modeled as being unable to support combustion, so only i damage to the cable was modeled. The majority of RBS fire areas were modeled as closed rooms due to the existence of fire dampers in HVAC ducts and normally closed fire doors. In such rooms the smoke and gases from the fire are expected to be contained in the subject room. COMPBRN life i predicted the hot pas layer thickness and overall room heatup due to such a fire and the ' equipment damage was recorded accordingly. The large open areas were modeled in COMPBRN llie as close to the actual configuration as possible. Such large areas typically experienced little room heatup and thinner hot gas layer due to the increased ceiling area. Fire damage was generally isolated to the vicinity of the pilot fire. In no postulated fire event did the analysis indicate spread of fire or excessive heat to an adjacent SSA fire area. Fires which spread from fire area to another fire area through a rated barrier were determined to be very low probability events. The walkdowns and the fire modeling indicated no specific plant weakness to fire spread through rated barriers. In fact, the fire O modeling and walkdowns showed that the barriers would rarely be challenged. Typically, fire did not propagate within the fire area of origination, much less to another fire area. Additionally, hot gas layers were rarely formed. The probability of failure _for a rated barrier is typically in the 10'8 demand (e.g4, when challenged) range. Based on this / information, fires which spread from fire area to another fire area were not quantified. I Fire spread from zone to zone was considered in the fire modeling. However, zone to zone spread was not found to be important. Typically, when a fire area has multiple zones that means that the fire area is relatively large. A large fire area does not lend itself to the development of a hot gas layer. Also, fire zones are often separated by walls or ceilings which would prevent propagation between the zones. Zones common to one fire area typically have the same SSA shutdown method (e.g., the same equipment is protected in both zones). Therefore, the CCDP calculation may not even be affected by a zone to zone spread. Fire spread from zone to zone was not found to be important. Electrical cabinet fires and postulated component fires were modeled in their respective locations. Transient fires were modeled in various locations throughout the fire area to obtain a full profile of the effects of such fires on the targets in the room. Transient fires typically resulted in damage to nearby targets (i.e., equipment or electrical raceways), and seldom spread to any other targets. This is due primarily to the lack of comi;ustibles associated with the targets and to the fire's inability to transfer heat horizontady. For targets with a large amount of combustible material (e.g., a cable tray), transient fires typically resulted in thermal damage, but did not spread to the targets. The existence of automatic fire suppression was never explicitly credited outside of the 2 Control Room because the pilot fires were self-extinguishing and fire spread was rare. In

a. ~ Rrport Numb:r '= SEA-95-001__ Rtvisi:n A Page .jiQ_ of _1]i1 O V scenarios where COMPBRN life was acknowledged as being weak, such as modeling vertical spread of fire, one might argue that credit was taken for suppression systems stopping the spread of fire vertically up the tray. The results of COMPBRN lite I simulations' indicate that such a fire in a vertical tray would not spread to the adjacent vertical trays.' However, acknowledging that COMPBRN llle is weak in this area, it can be stated that suppression was implicitly credited for not allowing the fire to spread horizontally from tray to tray. While fire and heat detection exists throughout the plant, no credit was taken for it. This is conservative since such detection would typically alarm in the control room, alerting operations personnel to the need for manual suppression. Also, no credit was taken for the numerous fire watch personnel. ' 4.4 Evaluation of Component FragHities and Failure Modes This analysis assumed that fire induced damage to a component was complete and resulted in complete lack of function. No credit was taken for fire suppression extinguishing a fire before damage occurred to a component. Damage to a cable tray was modeled as damaging the entire contents of the tray. Damage to components was modeled as resulting in the worst configuration (e.g., a damaged MOV resulted in the valve travelling from an open to a closed position or vice versa). Damage temperatures for targets were obtained from accepted sources. Most equ'pment i at RBS, whether its a pump, valve, cable tray, or conduit, is most likely going to failin a fire due to failure of its associated cabling. A damage temperature of 700 F was used for IEEE 383 cabling as recommended in EPRI's FIVE methodology (16). Similarly, a damage temperature of 700'F was assigned to cabling inside conduit. Cabling inside conduit was considered unable to sustain a flame, however. Except for lighting and communication cables, which are typically housed in conduit and unable to support combustion, all cable at RBS is IEEE 383 rated. Fire supprecsion in the majority of the fire areas of interest utilized fusible link sprinkler heads, thus localizing the discharge of the suppression system to the area of the fire. ) While damage to neighboring components from the suppression system was considered, none could be postulated in general terms. Typically, the sprinklers are expected to discharge on insulated cable, pump casings, valve casings, and conduits. No damage to such equipment is expected from water spray. 4.5 Fire Detection and Suppression 1 Automatic fire detection exists throughout RBS, which alarms in the mair, control room. Automatic fire suppression at RBS takes three forms: halon, carbon dioxide, and water. Halon is provided under the control room floor and can be actuated automatically or man'ually. The auxiliary control room and central alarm station are equipped with halon j for the cables under the raised floors of each area. i The main turbine bearings and exciter are protected by automatic and manual carbon dioxide discharge. I

R:pSrt Number S E A-95-OO1 Revisi:n ,p_ Page 51 of.151. ) Based on the area combustible loading and importance to reactor safety, water suppression systems are provided to protect safety related systems and components. Such areas are protected by one of four types of suppression systems: wet-pipe sprinkler systems, dry-pipe sprinkler systems, pre-action sprinkler systems, or deluge sprinkler systems. Wet-pipe sprinkler systems are made of pressurized water-filled pipe right up to the fusible- ) link sprinkler head. When the fusible-link melts at a temperature of 1650F, the water is discharged through the sprinkler. No other sprinkler will discharge unless it also reaches the melting temperature. This type of suppression is used primarily in the RBS control building to protect cable trays. Dry-pipe sprinkler systems use piping with a dry-pipe valve. Between the dry-pipe valve and the fusible-linked sprinkler head, the piping contains pressurized air of sufficient pressure to maintain the dry-pipe valve closed, which in turn prevents the flow of water. When a fire melts the fusible link, the sprinkler head opens, relieving the pressurized air from the line and opening the dry-pipe valve. Water then flows through the pipe and out the open sprinkler head. Pre-action sprinkler systems utilize standard deluge valves and fusible sprinkler heads connected to a pipe that contains air that may or may not be under pressure, with a supplemental detection system installed in the same area as the sprinklers. Actuation of the detection system opens the deluge valve that permits water to enter the 4ing system ("m) and to be discharged through those sprinkler heads that are open. Such sy : ems are used in the Diesel Generator Rooms and the RCIC Pump Room. Deluge sprinkler systems consist of deluge valves and associated controls with open sprinkler heads or open head directional solid cone spray nozzles. The deluge valve is opened by a signal from a detection system, thus filling the downstream piping and discharging water through all of the sprinkler heads / nozzles. This type system is used between cable trays in the cable and pipe tunnels, in some cable vaults in the Control Building anri various other areas, l 4.6 Analysis of Plant Systems, Sequences, and Plant Response This section describes the analysis of plant systems, sequences and plant response. The section is broken down into three parts which detail the event tree, progressive screening analysis and detailed screening analysis. 4.6.1 Fire PRA Event Tree This section contains information regarding the event tree developed for quantification of sequences initiated by an internal fire in the plant. The Fire PRA event tree is epplicable for a fire initiator any where in the plant (i. e., Control Building, Auxiliary Building, etc.). Success criteria considerations are presented along with the event tree and its description. ) For discussion of the Main Control Room analysis see Section 4.10. 4.6.1.1 Success Criteria

Rtport Numbcr SEA 95-OO1 j Rsvision ,g, Page

32. of M O

The system success criteria required to mitigate a fire initiated event is presented in Table

41. Sources of information used in determining the success criteria and clarification is provided in the accompanying notes. Additionally, system success criteria required to J

mitigate a fire initiated small LOCA event is presented in Table 4-2 and system success criteria required to mitigate a fire initiated intermediate LOCA is presented in Table 4-3. Table 4-4 contains the system success criteria for a fire initiated station blackout (SBO) The system suct:ess criteria for a fire initiated LOSP event is the same as that i event. presented in Table 4-1, The system success criteria for a fire initiated LOSP that results in a small or intermediate LOCA due to stuck open SRVs is the same as that in Tables 4-2 and 4-3. 4.6.1.2 Assumptions The key assumptions used in development of Tables 4-1 through 4-4 and the fire PRA, fire initiated small LOCA, fire initiated intermediate LOCA, fire initiated LOSP, and fire initiated SBO event trees are as follows: (a) Only equipment that is included in the SSA is credited for the fire PRA event tree. The routing of cables is only known for the SSA components. Therefore, only the SSA components can be assured of operability after a fire has occurred. There are two exceptions to this. The first exception is the availability of offsite power to the emergency busses. A separate analysis was performed to identify the cables, O that if failed in a fire would result in LOSP to the standby busses. Therefore, offsite power to the standby busses will also be credited. The second exception is where feedwater is credited (see Section 4.6.3.3). (b) Loss of the Vapor Suppression System (VSS) was considered but eliminated from the event trees as relatively improbable. The VSS provides the capability to quench reactor steam in the Suppression Pool without pressurization of the containment. Loss of the VSS function could affect the ability of the Mark 111 containment to withstand steam release from the primary system through either a break or the opening of Safety Relief Valves (SRVs). For transients, the failure mechanism of the VSS is structural failure of the suppression pool. Considering these facts in the context of other system failure probabilities led to the conclusion that VSS failure could be excluded from further analysis. (c) Reactor Core Isolation Cooling (RCIC) system will fail at pool temperature of - 173*F 1201. If the pool water should reach ~1730F, pump failure for RCIC is assumed since this temperature corresponds to the maximum temperature at which the RCIC pump has sufficient NPSH. (d) The HPCS, LPCS, and RHR pumps do not fait due to lack of NPSH following containment failure. Partial boiling of the suppression pool water will occur but will O not sufficiently decrease the suppression poollevel to result in loss of NPSH [201

~ Report Nur.M SEA-95-OO1 j Revision A ( Page .52 of 15,3 O 1 '(e) The LPCS, HPCS, and RHR pumps can continue to operate while pumping 3OO'F water (saturation temperature at the expected containment failure pressure). The pump bearings can withstand temperatures in excess of 360*F. Pump seal failure _j for the HPCS, LPCS, and LPCI-C pumps can be expected at 250*F (the RHR pump l - seals will not fait due to the presence 'of seal coolers). However, pump seal failure - is assumed not to fail the pump and the pump room coolers have. sufficient f capacity for removing the heat load resulting from seal failures [20). l ~l (f) Containment failure due to overpressure is assumed to release steam into the 141' j . level of the auxiliary building [20]. The motor control centers (MCC), terminal 1 cabinets, and distribution panels are assumed to fail due to in-leakage of steam. The following mitigative systems are assumed adversely affected: J 1. The MCC for the room cooler for the LPCS, RHR A, and RCIC pumps fail I which eventually fa6 the pumps. l' 2. Loss of power to. SDC suction valve 1E12*MOVF008 renders SDC -i unavailable if not aligned prior to containment failure. t 3. Loss of power to 1E12'MOVF0428 will prevent opening the MOV to l provide a flow path for service water and fire water to the reactor vessel. If flow path.is aligned prior to containment failure, no adverse effect occurs. An alternate path through 1E12*MOVF0538 is unaffected. 4. Loss of two cabinets providing power'to all 16'SRVs will result in.SRV closure. Vessel pressurization may occur preventing low pressure injection. l The s:.fety mode operation of the SRVs is not affected. j 1 (g) Venting of containment through the existing River Bend Station configuration (a 3" .l line) will not prevent containment overpressure failure (20]. Therefore, no credit-for containment venting is taken in the fire PRA. (h) It is assumed that the operator will use the equipment available to shutdown the plant in the manner instructed by the Emergency Operating Procedures (EOPs). The systems and components available will be those in the SSA path applicable to the zone of interest. The operation of those systems, singly and in conjunction will be as outlined in the EOPs. (i) The human error probabilities used for post accident actions will be the same as those for the Level 1 IPE analysis. Essentially, this assumption implies that there is not a significant amount of increased stress or confusion generated by the fact that the initiator is a fire. This assumption is considered reasonable since unless the operators are physically threatened by the fire or the fire results in confusing indications, the operators would respond as they would to any transient and as outlined in the EOPs. (j) The basic system success criteria and sequence structure for the fire event tree is taken from the Level 1 PRA event tree developed for LOSP initiated events [211 The systems used to mitigate a LOSP (LOSP) event are essentially identical to

Rep: rt Nurnb".r SEA 95-OO1 Revision J_ Page 54 of_119_ V those available for the SSA methods. Since the fire events of concern here do not result in any more limiting failures (i. e., interfacing LOCA), the system success criteria for the LOSP event tree is applicable to the fire PRA event trees. I (k) It is assumed that a scram will succeed for all fire events. The basis for the SSA is that fire does not affect the ability to scram. Therefore, a fire event and failure 4 to scram are independent. The probability of failure to scram is about 1 x 10 while the frequency of fires is on the order of 1 x 10 2 to 1 x 10 per year per j 4 zone. This gives a frequency of failure to scram and a fire of 1 x 10* to 1 x 104 per year. This is below the truncation frequency for fire core damage events and therefore, need not be considered further. (l) It is assumed that for all fire events, sufficient instrumentation is available to allow the operator to perform manual actions as required and to monitor the progress of ~ the event. For the most part, instrumentation that only provides a monitoring function and does not initiate an automatic action is not modeled in the PRA. (m) It is assumed that either one MSIV in each steam line closes or the turbine trips so that an unmitigated reactor vessel blowdown outside of containment does not occur. This assumption is considered reasonable since for this scenario to occur, a fire would need to cause multiple hot shorts so that the turbine would not trip but the MSIV solenoids would remain energized. Additionally, the fire would have to EQ1 fail the instrument air system and *he electric power systems. A fire of O sufficient severity to result in such maitiple shorts, given the separation and g protection afforded the MSIVs since they are a high/ low pressure interface, is considered probabilistically insignificant. (n) For the fire induced small LOCA and intermediato LOCA sequences, no credit is taken for the SDC mode of RHR for late containment overpressure protection since it is uncertain whether this mode of RHR can be effective under small break conditions. However, alternate shutdown cooling is credited since it provides both reactor vessel level control and decay heat removal. (o) Credit for SSW cross-tie for core cooling is given since it is proceduralized, can be initiated from the control room, and has sufficient capacity. All of the components required to use SSW cross-tie are on the SSA list although SSW cross-tie is not credited in the SSA. (p) For the Fire PRA, successful mitigation of an initiating event is defined as the prevention of core damage. The definition of core damage for the Fire PRA is the same as the definition used in the intemal events IPE. For this analysis, core damage is defined as sustained uncovering of the active fuellength for sufficient time for the Zirconium-Water reaction to become exothermic at which time the hydrogen generation rate in the core rapidly increases. This definition of core damage will mean that momentary uncovering of the fuel will not be defined as core damage. It is also a good determinant of core damage since once the (] Zirconium-Water reaction becomes exothermic it will result in embrittlement of the V fuel clad such that the re-initiation of cooling water flow could result in the shattering of the fuel clad and the formation of a potentially uncoolable debris bed.

~ ~ -~ ~ ~. ~. , Repart Number SEA 95-OO1 - Revisiin A i Page .5L of m D 7 Therefore, re-establishment of cooling water flow prior to the Zirconium-Water : j i reaction becoming exothermic will definitely result in successful core cooling while re-establishment afterwards may not. ~l (q)' The SBO initiating event is defined as a LOSP followed by failure of the Division I and Division il DGs. The SBO initiating event frequency is developed in main fire - PRA event tree. That event tree ~also includes an event to determine if off power has been lost as a result of the particular fire event being modeled (LOSP). j It also includes a subsequent top event, B, that is defined as failure of the Division I and Division il DGs. I (r) RCIC will isolate on a high main steam tunnel temperature at approximately 5 minutes after initiation of a SBO due to loss of the north main steam tunne cooler 1201. However, AOP-0050 [22] directs the operator as part of his immediate actions, which are committed to memory, to bypass the RCIC isolation. If this is successful, RCIC will be available under SBO conditions until the batteries are i depleted. Therefore, credit is given for RCIC in the SBO event tree. 3 (s) The SBO procedure AOP-OO50 directs the operator to prepare the firewater system for use in providing injection into the vessel. The procedure directs the operator i to inject through the valve 1E12*MOVF0538 which is accessible outside i containment and can be manually opened under SBO conditions.' Firewster was credited as an injection source for some fire areas. A recovery which represented O aligning firewster within 90 minutes was applied to the TOUV sequences. j (t) The Division i and Division 11 batteries have capacities sufficient to supply voltage for 4 hours after loss of charging. The Division 111 batteries have capacity for only 2 hours 120]. The availability of the Division I or 11 batteries can be extended indefinitely by use of the manually aligned SBO DG. Credit for the SBO DG is taken.' (u) Beceuse of the large number and high reliability of the Safety Relief Valves, failure of a sufficient number of the valves to open to prevent vessel rupture due to the initial pressure rise following closure of the MSIVs ia considered to be probabilistically insignificant. (v) No credit is taken for automatic operation of the ADS. The River Bend Station EOPs 1231 direct the operator to always inhibit ADS once the automatic timer has initiated. The operator is relied on to manually depressurize the vesselif necessary. 4.6.1.3 Event Tree The fire PRA event tree is actually five event trees. The first tree is shown in Figure 4-6. The first tree is the basic structure for the shutdown sequences used to mitigate a fire event with offsite power available and no stuck open SRVs. This tree contains four , transfers based on the availability of offsite and onsite power and the occurrence of stuck open SRVs. If both onsite and offsite power are available and one SRV sticks open, the sequence is transferred to the fire initiated small LOCA event tree, Figure 4-7. If both onsite and offsite power are available and two SRVs stick open, the sequence transfers

i Rrport Numbcr S E A 95-001 - Revision A Page .5 Q. of g O i to the fire initiated intermediate LOCA event tree, Figure 4-8. If offsite power is lost but onsite power is available, the sequence transfers to the fire initiated LOSP event tree, Figure 4-9. Note that from Figure 4-9, there are transfers back to the sequences in Figures 4-7 and 4-8 to account for the sequences with of fsite power unavailable but onsite power available and one or two stuck open relief valves. If offsite power and onsite power are unavailable, the sequence transfers to the fire initiated SBO event tree, Figure 4-10. The following discussion defines the event tree headings and describes the sequences depicted by the event trees. O l O

Rep rt Number S E A-95-001 Revisiin .Q. Page ,j2, of g i '(V fy3nt Tree Headinas { FIRE This event represents the occurrence of any fire in the plant that requires a shutdown or causes an automatic scram. LOSP This event represents success or failure of offsite power supplies to the 4kV shutdown busses. Failure implies that there is no offsite power being supplied to the 4kV shutdown busses and they must be supplied from the Dgs. Success implies that offsite power is being supplied to the 4kV shutdown busses, i B This event represents success or failure of the Division I and 11 DGs. Success implies at least one of either the Division I or Division 11 DGs is successfully operating and supplying power to its associated 4kV shutdown bus. Failure implies that both the Division I and Division 11 DG are failed and there is no power supply to either 4kV shutdown bus (SBO). P1 Success or failure of SRVs opening and re-closing. Success implies that SRVs opened and re-closed, Failure implies that of the SRVs opened, one failed to reclose. One open SRV depressurizes the reactor at the same rate as for a small LOCA and the loss of coolant makeup is the same; therefore, the success criteria for one open SRV is the same as for a small LOCA 124]. O P2 Success or failure of SRVs opening and re-closing. Success implies that i Q-SRVs opened and re-closed. Failure implies that of the SRVs opened, two failed to re-close. Two open SRVs depressurize the reactor at the same rate as for an intermediate LOCA and the loss of coolant makeup is the same; therefore, the success criteria for two open SRVs is the same as for an intermediate LOCA 1211. U1SSA Success or failure of the HPCS system. Success implies that either HPCS automatically actuated at Level 2 or that it was manually actuated and is functioning and spraying coolant makeup into the reactor vessel. Failure implies that HPCS is not spraying into the vessel. U2SSA Success or failure of the RCIC system. Success implies that either RCIC automatically actuated at Level 2 or that it was manually actuated and is functioning and injecting coolant makeup into the reactor vessel. Failure implies that RCIC is not injecting into the vessel. X1SSA Success or failure of the reactor to depressurize. Success implies that the operator manually depressurized the vessel. Failure implies that the operator failed to manually depressurize causing the reactor vessel to remain at high pressure. V2SSA Success or failure of the LPCS system. Success implies that either LPCS automatically actuated at Level 1 or that it was manually actuated and is A functioning and spraying coolant makeup into the reactor vessel. Failure implies that LPCS is not spraying into the vessel.

Rep;rt NumbIr SEA 95-001 Revision 3. Page .5,3,, of,,132, l (K V V3SSA Success or failure of the LPCI system. Success implies that at least one train of LPCI either automatically actuated at Level 1 or that it was manually actuated and is functioning and injecting coolant makeup into the reactor vessel. Failure implies that all three trains of LPCI are not injecting into the vessel. V4SSA Success or failure of the SSW cross-tie to LPCI. Success has implied that the operator successfully cross-tied Train B of SSW to the injection line of Train B of LPCI and coolant makeup is being injected into the reactor vessel. Failure implies that coolant makeup is not being provided to the vessel. W1SSA Success or failure of the Suppression Pool Cooling (SPC) mode of the RHR system. Success implies that at least one train of RHR was manually aligned to its SPC function (at suppression pool temperature of 95'F). Water is being pumped from the suppression pool through the heat exchanger (where it is being cooled by SSW) back to the suppression pool. Failure implies that no coolina is taking place. 1 X2SSA Success or failure of the reactor to depressurize. Success implies that the operator manually depressurized the vessel. Failure implies that operator failed to manually depressurize causing the reactor vessel to remain at high pressure. (X2 is a subset of X1). X2SSA is considered after a high i pressure system has been successful and SPC has failed, since depressurization is required for W2SSA and ASDC. W2SSA Success or failure of the Shutdown Cooling (SDC) mode of the RHR system. Success implies that at least one train of RHR was manually aligned to its SDC function. Water is being pumped from the vessel through the heat exchanger (where it is being cooled by SSW) and back to the vessel. Failure implies that no coolina is taking place. ASDC Success or failure of the Alternate Shutdown Cooling mode of the RHR system. ASDC is equivalent to a low pressure bleed-and-feed mode of reactor cooling. Water is being pumped from the suppression pool through the RHR heat exchanger (where it is being cooled by SSW) back to the reactor vessel through the LPCI injection lines. From the reactor vessel, water flows out of the open SRVs and back to the suppression pool. Based on this definition,it can be seen that ASDC is dependent on the success of either X1SSA or X2SSA and that ASDC cannot succeed if V3SSA fails. FIRSLOCA This event represents the occurrence of any fire in the plant that requires a shutdown or causes an automatic scram followed by one and only one SRV failing to reclose after opening to relieve the initial pressure spike caused by the scram. FIRILOCA This event represents the occurrence of any fire in the plant that requires a shutdown or causes an automatic scram followed by two and only two SRVs failing to reclose after opening to relieve the initial pressure spike s caused by the scram,

a Report Number SEA 95-oO1 j R:visiin .Q - j Page . 51. of ).L%. jy 'O V3BCSSA ~ Success or failure of Train B and C of the LPCI system. Success implies that either Train B or C of LPCI either automatically actuated on low vessel level (Level 1) or high drywell pressure manually actuated and is injecting coolant into the reactor vessel. Failure implies that both Trains B and C of. LPCI are not injecting into the vessel. V3ASSA' - Success or failure of Train A of the LPCI system. Success implies that Train - A of LPCI either automatically actuated at Level 1 or due to high drywell pressure or that it was manually actuated and is functioning and injecting .j coolant makeup into the reactor vessel. Failure implies that Train A of LPCI-is not injecting into the vessel. FIRELOSP This event represents the occurrence of any fire in the plant that requires a shutdown or causes an automatic scram and also causes failure of offsite l power to the Division I, Division II, and Division til 4kV shutdown buses. FIRESBO This event represents the occurrence of any fire in the plant that requires I a shutdown or causes an automatic scram and also causes failure of offsite j power to both the Division 1, Division ll, and Division lli 4kV shutdown ~ buses and failure of both the Division I and Division ll emergency DGs. i U2SSA-ST Success or failure of the RCIC system. Success implies that either RCIC automatically actuated at Level 2 or that it was manually actuated and is functioning and injecting coolant makeup into the reactor vessel. Failure j! k - implies that RCIC is not injecting into the vessel. This top event is specifically for the SBO tree. -{ 4.8.2 Proyessive Screening Analysis l All plant areas were considered in the search for critical areas with regards to fire. Fire l frequencies were calculated using the FIVE Methodology [16). A description of all fire j areas, and their associated ignition frequency is contained in Table 4-5. To identify critical areas, a progressive screening approach was used. The screening approach provided a -t systematic means of eliminating non-critical areas from further consideration, thereby [ allowing resources to be focused on the important fire areas. Figure 4-11 provides a j flowchart of the Progressive Screening Analysis, i i t 4.6.2.1 Screen 1: Fire Areas With No SSA Equipment j The equipment credited in the SSA composes the majority of the equipment which is fed l off of the Class 1E busses. If none of the SSA equipment is damaged in a fire, there is j good assurance that the plant will be safely shutdown. The areas which contain no SSA r equipment are contained in Table 4-6. Nevertheless, some of the areas on this list had the potential to become important if a fire in the area could damage offsite power cables. j l O i P )

Repsrt Number SE A-95.OO1 R:visi:n A Page ,$.Q. of 159., O To ensure that the screen on lack of SSA equipment did not prematurely screen out - important fire areas, a cognizant electrical engineer determined the most likely areas where a LOSP could occur. These fire arcas were walked down to look for potential fire hazards and to ensure that there was not an area which had a high frequency of LOSP due to fire. This walkdown was a qualitative analysis. Based on the amount and diversity of equipment available and on the qualitative walkdown of areas where a LOSP could occur, areas which did not contain SSA equipment were. screened from further analysis. 4.6.2.2 Screen 2: Fire Areas inside Containment ,The containment building is a large cylindrical freestanding steel structure which encloses ' he drywell and suppression pool. Typically, areas in containment are large, have t communication with multiple alevations, and have low combustible loadings. Formation of a hot gas layer due to a fire is unlikely due to the size and configuration of the areas. The list of SSA equipment and cables which are located in containment is limited. Most of the equipment is indication which provides information on vessel and containment variables. Other equipment and cables in containment are for SRVs, MSIV and some system isolation valves. The SSA does not credit any fire wrap in containment, implying that good physical separation between divisions exists. This, coupled with the i expectation that a hot gas layer will not form, gives reasonable assurance that redundant O trains of critical equipment will not be damaged by a fire. Based upon this analysis, the areas in containment were judged to have low risk significance and were screened from further analysis. A list of the Fire Areas located inside containment is tabulated in Table 4-7. 4.6.2.3 Screen 3: CDF < 1 x 10*/yr; Assuming all Equipmentin Area Failed For this scraen, the assumption was made that all the equipment in the room would be damaged by a fire. A Conditional Core Damage Probability (CCDP) for the area was calculated and the Core Damage Frequency (CDF) for the area was taken to be the CCDP, with all equipment failed, multiplied by the ignition frequency. If the CDF was less than 1 x 10 /yr then the fire area was screened from further analysis. Table 4 8 contains the 4 areas which were screened in this step. 4.6.3 Detailed Screening Analysis The initial screening analysis made no attempt to determine what equipment in an area would be damaged in a fire. For the detailed screening analysis, fire modelling was performed on each area to determine the equipment damage. Large areas often had multiple damage scenarios corresponding to different locations and different sets of equipment. O

R: port Numbar S E A-95-001 I Rzvisi:n _Q, Page ,$1, of 151 The detailed screening analysis is similar to the initial screening approach in that additional resources were progressively applied if at any point in the analysis the calculated CDF fell below 1 x 10~'/yr the area was screened from further analysis. Figure 4-12 provides i a flowchart of the Detailed Screening Analysis. l 4.6.3.1 Screen 4: CDF < 1 x 10 /yr; Equipment Damage Determined by Fire 4 Modeling The CCDPs for the fire areas were recalculated with equipment damage determined by fire modelling. The CDF was recalculated based on the new CCDPs and if the CDF was less than 1 x 10'*/yr the area was screened from further analysis. The areas which were screened in this step are listed in Table 4-9. 4.6.3.2 Screen 5: CDF < 1 x 10*/yr; ignition Frequencies Specific To Scenarios For large fire areas, where fire modelling showed that damage scenarios existed, the ignition frequency was recalculated to be scenario specific. To determine the scenario ignition frequency, the fire area ignition frequency was ratioed based upon a zone of influence for the scenario targets and the relative location of fixed ignition sources to those targets. Using the scenario ignition frequencies, a CDF was calculated for all of the scenarios in k an area. The CDF for the area was taken to be the summation of the scenario CDF's. If the CDF for the fire area was less than 1 x 10/yr then the area was screened from further analysis. Fire areas screened in this step are listed in Table 4-10. 4.6.3.3 CDF < 1 x 10*/yr; Credit Given For Feedwater The SSA equipment formed the basis for the CCDP calculations. This equipment is fed electrically nff of 3 divisional busses, in specific equipment rooms, (e.g. DC equipment room) one entire division of equipment could be functionally lost. When the ignition frequency was combined with random failures on the other two divisions, the resulting CDF was relatively high. Based on area walkdowns, plant layout and engineering judgement, it was concluded that the assumed loss of all non-safety powered equipment was overly conservative in some specific areas. For these specific areas, the analysts felt that it was appropriate to credit feedwater injection. The areas were reviewed to ensure that cables supporting the feedwater system could be excluded from being in the area. A recovery was applied to the area based on the failure probability of the feedwater system. If the resulting CDF was less than 1 x 10/yr the fire area was screened from further analysis. The screened areas are listed in Table 4-11. The unscreened fire areas are listed in Table 4-12. O

Report NumbIr _ SEA 95-001 RIvision A Page ,12, of 111, I y 4.6.4 Unscreened Fire Areas The fire areas which were still unscreened after applying the Progressive Screening Analysis and the Detailed Screening Analysis are listed in Table 4-12. (Note that the Control Room was analyzed separately as described in Section 4.10). Although the screening analyses progressively removed conservatism, the analysts believed that a significant amount of conservatism remained in the CDF estimates. Several efforts were made to remove some of the conservatism. The screening analyses did not credit any manual suppression. Manual suppression was subsequently applied to areas where suppression would occur prior to significant damage. if the fire could be put out in its inc:pient stages before a significant amount of damage could occur; then it was assumed that the CDF contribution was small and was not quantified. For welding and grinding initiated transient fires, a manual non-suppression probability of 0.15 was applied [31 and 321. This is based on a fire watch being present to extinguish the fire when it starts, if the fire watch is successfulin extinguishing the fire,it is likely small with little damage. i For other transient fires a manual non-suppression probability of 0.65 was applied [31 and 321. This is the probability that the first member of the fire brigade who reaches the fire fails to extinguish it. If the first member of the fire brigade who reaches the fire is able to extinguish it, then the fire is likely small with little damage. Credit for manual suppression of transient fires removed a significant amount of conservation from the fire areas which were dominated by transient fires. Some of the fire areas dropped below the 1 x 10/yr truncation values for CDF. f i Another significant conservatism was in the treatment of fires in the Diesel Generator Rooms. No fire modelling was performed on these rooms because the rooms contain { much equipment throughout the rooms which could potentially disable the DG. For any fire of significant size in the room, the Diesel could be lost. In initially quantifying the CCDP for the Diesel Generator Rooms, the assumption was made that the Diesel Generator, the associated emergency buss and all of the equipment fed off of the buss was damaged. A review of the events in the Fire Events Database [FEDB) which make up the ignition frequency for the Diesel Generator Rooms showed that the CCDP calculations were overly conservative. For many of the fires in the database there was very little damage, much less gross equipmrant losses. A severity factor for Diesel Generator Rooms was developed by reviewing the events. Conservatively, 26 out of the 65 fire events were determined to be potentially severe enough to cause the equipment loss as assumed in the CCDP calculation. A severity factor of 0.40 (26/65) was applied to the CDFs calculated for the Diesel Generator Rooms. (g d All dropped below the CDF truncation limit of 1 x 10/yr after application of the severity ) factor.

i I i Ripert Numbir _ SEA-95 OO1 RIvision ,g, Page Q)_ of_15j_ . V) Table 4-13 presents the fire areas which have a CDF above the truncation limit. These are the fire areas which have survived the screening analysis and have had manual suppression credited. Table 4-13 represents the most risk important fire areas at River Bend. The CDFs for these fire areas are still believed to be conservative due to the conservative assumptions taken in the analysis. 4.7 Analysis of Containment Performance Plant response due to a fire is similar to the plant response analyzed in the IPE internal events evaluation. No fire unique containment failure modes were found in the Fire PRA. No additional Level ll analysis was performed for the Fire PRA t 4.8 Treatment of Fire Risk Scoping Study Issues 4.8.1

Background

As part of their Fire Protection Research Project, to identify and perform initial investigations of any potential unaddressed issues of fire risk, Sandia National Laboratory performed what is known as the Fire Risk Scoping Study. Sandia reviewed four previously completed fire probabilistic risk assessments (PRAs). The PRA risk scenarios were re-quantified using the data and information from the Fire Protection Research Project as a basis and included plant modifications made in response to implementations of Appendix R requirements at the plants under study. In the performance of this task, Sandia O developed a list of issues wnich they felt represented potential contributors to fire risks that had not been adequately addressed in previous risk assessments. The following is a list of these issues which the NRC has requested be addressed in any future fire evaluation methodology: Seismic / Fire interactions Fire Barrier Qualifications Manual Fire Fighting Effectiveness Total Environmental Equipment Survival Control Systems interactions Improved Analytical Codes 4.8.2 River Bend Station Program The Fire Protection Program at River Bend Station employs a ' Defense in Depth' concept and aims to minimize the probability of occurrence of fire, to ensure the rapid detection and control, and prompt extinguishment of fires that do occur, and to maintain the capability of safe shutdown in spite of any fire not promptly extinguished. The objectives established to effect the program goals are as follows: Control modifications to structures, components, equipment, and systems such that the design level of fire protection is not reduced. Control transient combustibles. O a

.' g 1' RepIrt Number SEA 95-001 ~ RWisiin - .g., Page. A. of,j,g., Le: Control ignition sources such that probability of fire occurrence is minimized 'and-N readily available extinguishment methods are provided should fire occur, Operate, test, and maintain fire detection and fire suppression systems in a manner e that meets operability requirements for the appropriate mode of reactor operation. l Conduct fire-fighting whenever fire occurs by a trained and equipped Fire Briga[ 3 e with supplementary assistance from the offsite fire department, if required. i Provide for handling and transporting of flammable liquids and gases to minimize I e 1 the probability of fire occurrence. e E personnel to carry out assigned responsibilities through adequate training and Provide quality assurance verification activities to evaluate implementation of the Fire Protection Program and its effectiveness. t The objectives listed above ensure that an adequate Fire Protection Program is in place i River Bend Station, and the ' Defense in Depth' concept is adhered to. The proper procedures are in place to ensure that all fire protection requirements of the plant are met. This will reduce the probability of fire at River Bend Station and ensure all fire protection features, active or passive, will limit fire damage. j ~ 4.8.3 Seismic / Fire interactions i The Seismic Review Team (SRT) reviewed the potential for earthquake caused fire hazards and internal flooding in areas where success path equipment is located. Hydrogen lines in the turbine building were not specifically addressed, since no SSA equipment is in the -! turbine building. With no SSA equipment in the turbine building there is good assurance i that a fire due to leaks in the hydrogen lines would not be significant from risk standpoin-{ Diesel fuel tanks for the Emergency Diesel Generators were: required for the Safe Shutdown paths and thus were specifically reviewed for seismic adertuacy. System interactions of the suppression systems and the equipment required for the safe shutdown -l paths were specifically addressed in the walkdowns. j '\\ 4.8.4 Fire Barrier Qualifications I This section discusses fire barriers, fire doors, penetration seals, and fire dampers as used j and maintained at River Band. 4.8.4.1 Fire Barriers STP-OOO-3602, " Fire Barrier Visual Inspection", provides guidance to visually inspect I I exposed surfaces of fire rated assemblies to verify operability as required by plant technical specifications. The procedure calls for inspection of all exposed surfaces at least - once per 18 months. This procedure is in place to ensure that fire barriers at River Bend O Station meet all technical specification requirements and to ensure that the barriers are adequate in their ability to perform their fire propagation stopping ability. g w r-. --y y ,.y .e,.- r. 4

Rrport Numbsr SE A-95-OO1 Revision _Q, Page .$.Q. of.,151, f~) V 4.8.4.2 Fire Doors STP-000-3001, " Daily Fire Door Position Check", provides guidance to verify that unlocked fire doors without electrical supervision are closed as required by plant technical specifications. The procedure also gives guidance on verifying that held open fire doors and release mechanisms are free of obstructions as required by technical specifications. This procedure is performed at a frequency of at least every 24 hours. STP-000-3101, " Locked Closed Fire Door Position Check", provides guidance to verify locked closed fire doors as required by plant technical specifications. This procedure is completed at least every 7 days. STP-000-3200, " Fire Door Supervision Functional Test", provides guidance to verify functional operability of fire door position supervision as required by plant technical specifications. This procedure is required at least every 31 days. STP-000-3401, " Semi Annual Fire Door Operability Check and Mechanism Inspection", provides ' guidance to verify that unlocked fire doors without electrical supervision are operable as required by plant technical specifications. This procedure is also used to verify fire door automatic hold-open, release and closing mechanisms and latches are operable as required by plant technical specifications. This procedure is accomplished at least every 6 months. 1 These procedures provide applicable references, required equipment, precautions and limitations, prerequisites, procedures, and acceptance criteria for performing their applicable purpose. These procedures are in place to ensure that the fire doors at River Bend Station meet all technical specification requirements and to ensure that the doors are adeouato in their ability to perform their intended function. O 4.8.4.3 Penetration Seal Assemblies STP-000-3604, " Fire Barrier 18 Month Visualinspection, Sealed Penetrations", provides guidance to visually inspect fire barrier sealed penetrations to verify operability as required by plant technical specifications. The procedure calls for 10 percent of each type of sealed penetration to be inspected every 18 months. This ensures that each penetration is inspected at least once every 15 years. The penetrations which are to be inspected are determined by the Quality Control Supervisor, and are provided on computer data sheets. This procedure provides applicable references, required equipment, precautions and limitations, prerequisites, procedures, and acceptance criteria for performing penetration sealinspections. The procedure also stipulates the requirements for records storage for auditability requirements. This procedure is in place to ensure that the penetration seals at River Bend Station meet all technical specification requirements and to ensure that the seals are adequate in their ability to perform their intended function. NRC IN 88-04 and Supplement 1, " inadequate Qualification and Documentation of Fire Barrier Penetration Seals", were provided to inform addressees of instances where installed fire barrier penetration seal designs could not be verified as qualified for the design rating of the penetrated fire barrier. Supplement 1 was provided to alert addressees to problems caused by potential misapplication of silicone foam material used in penetration openings at nuclear power plants. River Bend Station Design Engineering responded to these notices with the following: O

Rrport Numbtr _ SEA-95-OO1 R vision ,g_ Page ,sj, of M i b " River Bend Station has maintained an integrated fire penetration seal testing, installation U and inspection program starting with the construction phase of the plant and continuing into the current operational phase of the plant. This program includes specifications, material testing, installation, inspection and acceptance requirements. Testing of typical penetrations including typical repair configurations were conducted by nationally recognized testing laboratories (Southwest Research Institute) and vendors. These tests were conducted and documented in accordance with applicable industry standards and included testing of seismic qualified seals, capacity testing, differential pressure tests and hydrostatic permeability tests. A deviation from accepted industry stantiards or tested configurations requires a 50.59 review following the guidance in Generic L;tter 86-10 with respect to allowable deviations and records retention. A review of applicable data, Specification 229.180, " Penetration Seal Listing," and vendor data supplied under Specification 229.180 indicates that silicone foam sealant has not been installed on high temperature lines at River Bend Station. Fire from the installation of silicone foam (RTV-6548) around high temperature lines, without an adequate non-combustible insulation installed between the line and foam sealant, manifests itself in a rather short time after the installation. Th's manifestation of a foam sealant fire is usually the first or second exposure to excessive heat. Experience O indicates that at about 5500F, the foam will bake and form an insulating barrier between the line and foam seal. At about 6000F the foam breaks down into its constituent components which ignite. Since River Bend Station has been operating for over two years, any inadvertent misapplication of RTV-6548 would have become apparent. The diesel exhaust lines at River Bend Station operate at approximately 900 F. This is well above the 600 F temperature at which the foam willignite. The exhaust lines are insulated with ceramic fiber and covered with a heat resistant cloth to the penetration i above where the line passes through a metal sleeve with an air gap between the line and sleeve. Thorefore, silicone foam is not a problem. i The application of silicone foam and resulting fires as described in Supplement 1 of IN 88-04 is not applicable to River Bend Station." 4.8.4.4 Fire Dampers STP-OOO 3603, " Fire Damper 18 Month VisualInspection", provides guidance to visually inspect fire dampers and associated hardware to verify operability as required by plant 1 technical specifications. The procedure calls for the dampers to be inspected every 18 months. This procedure provides applicable references, required equipment, precautions and limitations, prerequisites, procedures, and acceptance criteria for performing penetration sealinspections. The procedure also stipulates the requirements for records storage for auditability requirements. O

Reprrt Numb r S E A-95-001 R; vision ,p_ Page .3Z, of,133,, _7 i ) V This procedure is in place to ensure that the fire dampers at River Bend Station meet all technical specification requirements and to ensure that the dampers are adequate in their ability to perform their intended function. NRC IN 89 52, " Potential Fire Damper Operational Problems", was provided to alert addressees to potential problems affecting the closing reliability of curtain-type fire dampers under ventilation system operational flow conditions. The notice warned of certain types of dampers which failed to close during ventilation system operational air flow conditions. River Bend Station responded to the notice with the following statement: "The Category 1 fire dampers for River Bend Station are curtain-type fire dampers, with a 160 degree Fahrenheit U.L. approved fusible link, manufactured by Quality Air Design of Cincinnati, Ohio. Specification 215.480, under which the dampers were supplied states on page 1-20 " Fire Dampers shall be capable of functioning when air is flowing." However, no test data can be found to verify this statement. Available test data is in compliance with U.L. Standard 555. In order to adequately address this IN,TCN 89-0985 was written against Fire Protection Procedure FPP-0010, Revision 6, to add a statement requiring shutdown of the ventilation system to the appropriate fire zone to ensure closure of the fire dampers. Each Pre-Fire Strategy contains room ventilation information." NRC IN 83-69, " Improperly Installed Fire Dampers at Nuclear Power Plants", provides notification of three potential problems involving proper installation of fire dampers in ventilation ducts which penetrate fire barriers in safety-related areas. The three problems s were: Failure to install any fire damper e Installation of 1-1/2-hour rated dampers instead of three-hour ratings specified Improper location within the duct River Bend Station responded to the notice with the following statement: "A surveillance was performed at River Bend Station to verify that fire dampers were being installed properly. Three (3) fire dampers located in the auxiliary building were randomly selected and all were found to be in compliance with specifications as well as with the FOC inspection plan and Construction Control and Completion (CCCP) check list plan. Installation instructions, inspection and fire damper design all preclude improper installation. Furthermore, there are no 1-1/2-hour dampers approved for use at River Bend. Further confidence in the adequacy of the design and installation of fire dampers will be developed during the Fire Protection Systems' inspection to be performed in conjunction with the Fire Hazards Analysis (FHA)." 4.8.5 Manual Fire-fighting Effectiveness This section describes the manual fire fighting program at River Bend. (O V i

i R: port Numbtr SE A-95-OO1 Revision _Q_ Page ftS_ of M ,/^} G 4.8.5.1 Reporting Fires Several procedures at River Bend Station provide guidance to plant personnel on 1 appropriate actions for personnel discovering a fire. The procedures give appropriate responsibilities of all personnel. Actions are also given for personnel who are within a fire area upon occurrence of the fire. Criteria is also stipulated to plant management for the reporting of fires to regulatory agencies and risk management personnel. The following procedures are in place to assure that proper reporting of a fire at River Bend Station will occur and action to combat the fire will happen expeditiously: ADM-0009, " Station Fire Protection Program" EIP-2-011, " Fire Emergencies" e FPP-0010, " Fire Fighting Procedure" RBNP-038, " River Bend Station Site Fire Protection Program" e RBNP-004, " Regulatory Reporting Requirements" e The procedures listed above direct plant personnel to immediately report any fire to the ~ control room by any means of communication. They instruct personnel reporting fires to report, to the extent possible, the exact location of the fire, types of combustibles involved, degree of severity (i.e. smoke, flames), and condition or state of automatic suppression systems. The procedure directs plant personnel to fight the fire if they have beon trained and if they believe the fire is small enough to use a portable fire extinguisher. Upon arrit'al of the plant Fire Brigade Leader, the procedures direct personnel to inform the Fire Brigade Leader of the circumstances of the fire. A River Bend Station has installed several communication methods to ensure reliable communications will be available for operation and maintenance of the plant. These systems have been installed to provide redundancy between methods of communication during all modes of operation of the plant including during emergencies such as fires. Separate power sources as well physicalindependence of communication circuits ensure that communication will be available during fire emergencies. The communication systems have been tested in accordance with manufacturer's instructions and intervals to ensure reliable, effective communication with the control room during all plant operating conditions. River Bend Station currently employs the following methods of communication: e PP/PA Page-party /public address system e Portable intercom system o PBX Private branch exchange system e Hand-held portable onsite radio system The page-party /public address system is a six channel system which uses one for paging and five for party communications. This system lets five separate conversations take place by means of selector switches on each unit. The system is also used as the vehicle for evacuation and fire alarm signals. O

I' R: port Numbzt SEA 95-OO1 Revision A Page JQ of f O Evacuation and fire alarm signals take priority over other paging signals to alert plant i personnel of fire and/or evacuation conditions. The portable intercom system within the plant has plug-in Jack stations located throughout the plant near certain equipment. One t station where this is located is the Remote Shutdown Panel. There are also stations in the main control room (MCR). The private branch exchange system within the plant is part of the EOl telephone system and consists of push button telephones throughout the plant. These phones can communicate with each other without interfacing with the offsite l telephone system. The hand-held portable onsite radio system is available for use in emergency situations such as fire. There is one frequency available in the UHF band. This system is battery powered and not dependent on the plant electrical system. The system is reliable and works on a fixed base and repeater method. The repeaters are located at the River Bend microwave tower which is in an isolated area of the plant and are not ) subject to fires which could also affect safety-related equipment in the plant. 4.8.5.2 Fire Brigade River Bend Station currently employs the use of a fire brigade to combat site fires. The fire brigade is made up of River Bend Station personnel assigned to fire fighting in accordance with plant technical specifications and plant operations within the owner controlled area. ADM-0009, " Station Fire Protection Program", and RBNP-038, " River Bend Station Site Fire Protection Program", stipulate that the fire brigade be made up of one fire brigade leader, two Nuclear Equipment Operators, and two other individuals who O are qualified as fire brigade members per TPP-7-021, " Fire Protection Training and Qualifications". The fire brigade leader must be a licensed, previously licensed or certified individual with the minimum certification of Nuclear Control Operator. Because the brigade leader and two other operators are qualified Nuclear Control Operators, these individuals will be knowledgeable in plant systems and operations. Each fire brigade member is trained and qualified in accordance with TPP-7-021, " Fire Protection Training and Qualifications". Included in this is an annual physical which evaluates the brigade members ability to perform fire fighting activities. Failure of this physical or failure to perform the physical in the requalification period will result in disqualification as a brigade team member. FPP-0090, " Fire-Fighting Equipment, inventory, inspections, and Maintenance", provides guidance f or the procurement, inventory, inspection, and maintenance of all fire-fighting equipment used by the fire brigade. The equipment lockers are located in the following locations: e 'T' Tunnel Elevation 95' e Auxiliary Control Building Elevation 123' e Fuel Building Elevation 113' Standby Service Water Cooling Tower Elevation 118' e e Fire Brigade Van Outside PAP Building O

me SEA-95R I Report Number Revision ,q, ,2Q, of 151 Page f l satisfy all requirements for fire-The manual fire-fighting equipment located in the loc ersHandbook, NFP k I i The fire brigade I fighting equipment as required by the Fire Protect on d Station USAR. Protection Association Codes, and the River Benalso inspected af ter act equipment lockers are inspected monthly. They are a fire scenario. " provides a means to control tinguishers and to establish a periodi FPP-0095, " Fire Extinguisher inspection and Maintenance, the permanently installed portable fire ex lant is periodically inspected and inspection / maintenance program that ensures ava h f the addition, deletion, or change i tested per this procedure. The Fire Protect on l Maintenance Supervisor ensures that i location checklist and also approves the authorizat on o d location and also arranges for the in location of all site fire extinguishers. The Electrica This ensures that fire extinguishers ' all site fire extinguishers are maintained in their assigneill correct inspection and maintenance of each fire extinguisher. h will be available to the fire brigade, and that t ey w Fire Brigade Training ssigned as fire brigade members 4.8.5.3 d duties. Fire brigade training is completed l The River Bend Station USAR states that personne a ledge and skills necessary to effectively receive formal training prior to assuming briga e h plant and to maintain and improve k to provide fire brigade members with the nowcontrol and fire-fighting force is available at the plant at i both upon initial assignment to the i those skills such that a trained and effect ve In addition, the fire i all times. The fire brigade members receive O ll performed. Each fire brigade member must also i brigade team leader receives separate training. participate in fire drills. An explanation of eac as described below: Initial fire brigade training consists of several courses t Louisiana State University TR-2502V, Nuclear Power Plant Fire Brigade Training a l des training in chemistry i Firemen Training Center or Equivalent. This course nc utilation, ele (a) of fire, breathing apparatus, interior fire fighting ications, appliances, foam, rse. The practice sessions / protective clothing, fires in nuclear plants, an knowledge gained in the classroom portion of the cou tinguishers, interior fire- / l include training on fire fighting small fires wi / olving flammable gases f i and/or pressurized liquid fuels, fighting large fl id buildings using breathing f apparatus. l des training on the duties f i TR-2500, Fire Brigade Training (onsite). This course nc uindoctrina / b and responsibilities of the fire brigade team me t hazards, fire protection I (b) l ystems, fire protection halon and f stems, fire watch duties and / i water system, fire protection water suppress on s l 9 responsibilities, and hot work fire prevention. l 1 l ~ g

R;psrt Number S E A-95-OO1 Revision _Q, Page .2Q. of 15). (D V The manual fire-fighting equipment located in the lockers satisfy all requirements for fire-fighting equipment as required by the Fire Protection Handbook, NFPA National Fire Protection Association Codes, and the River Bend Station USAR. Tho fire brigade equipment lockers are inspected monthly. They are also inspected after actual use during a fire scenario. FPP-0095, " Fire Extinguisher Inspection and Maintenance", provides a means to control the permanently installed portable fire extinguishers and to establish a periodic inspection / maintenance program that ensures availability and proper operation of all site fire extinguishers. Each fire extinguisher iocated in the plant is periodically inspected and tested per this procedure. The Fire Protection Coordinator maintains the fire extinguisher location checklist and also approves the authorization of the addition, deletion, or change in location of all site fire extinguishers. The Electrical Maintenance Supervisor ensures that 'all site fire extinguishers are maintained in their assigned location and also arranges for the inspection and maintenance of each firs extinguisher. This ensures that fire extinguishers will be available to the fire brigade, and that they will correctly operate when needed. 4.8.5.3 Fire Brigade Training The River Bend Station USAR states that personnel assigned as fire brigade members receive formal tra:ning prior to assuming brigade duties. Fire brigade training is completed to provide fire brigade members with the knowledge and skills necessary to effectively p control and/or extinguish fires which may occur in the plant and to maintain and improve those skills such that a trained and effective fire-fighting force is available at the plant at all times. The fire brigade members receive training both upon initial assignment to the l fire brigade and, requalification training is periodically performed. in addition, the fire brigade team leader receives separate training. Each fire brigade member must also participate in fire drills. An explanation of each type of training is described below. Initial fire brigade training consists of several courses as described below: (a) TR-2502V, Nuclear Power Plant Fire Brigade Training at Louisiana State University Firemen Training Center or Equivalent. This course includes training in chemistry of fire, breathing apparatus, interior fire-fighting, ventilation, electrical fires and cable tray fires, hand portable extinguishers, communications, appliances, foam, protective clothing, fires in nuclear plants, and practice sessions using the knowledge gained in the classroom portion of the course. The practice sessions include training on fire fighting small fires with portable extinguishers, interior f;te-fighting using breathing apparatus, controlling incidents involving flammable gases and/or pressurized liquid fuels, fighting large flammable liquid fires using hose lines and/or foam, and, fighting flammable liquid fires inside buildings using breathing apparatus. (b) TR 2500, Fire Brigade Training (onsite). This course ir.cludes training on the duties and responsibili ies of the fire brigade team members, indoctrination to the plant t fire-fighting plan, use of pre-fire strategies / plans, plant hazards, fire protection . /^ water system, fire protection water suppression systems, fire protection halon and caibon dioxide systems, fire detection supervisory systems, fire watch duties and responsibilities, and hot work fire prevention.

I RIpart Number SEA-95-OO1 - Rivisi:n _Q. Page-71 of 151. d[k' '(c) 'TR-2509, Fire Brigade Fire Drills.- Each fire brigade member must complete fire l drills in accordance with Section 4.8.5.5. (d) TR-2513, Fire Brigade Annual Ph, :ical. An annual physicalis required for each fire l brigade member to ensure that their ability to perform fire fighting activities is not degraded for any reason. (e) _ TR-2514, Fire Brigade Respirator Mask Fit. Each fire brigade member must complete a respirator mask fitting prior to fire fighting activities. i (f) TR-0063, General Employee Training (GET) - Level 111. Each fire brigade member must complete GET 111, Respirator Protection Training, prior to fire fighting j activities, j t Requalification for the fire brigade members consists of courses TR-2502R and TR-2502V on alternating years, portions of TR-2500 quarterly to ensure that the whole course is t covered-over a two year period, drills in accordance with Section 4.8.5.5,' an annual physical, respirator mask fitting every two years, and GET lil training in accordance with TPP-7-018, " General Employee Training". During refresher trainingi topics that are i covered include: i e Detailed review of the latest plant modifications and corresponding changes in fire-l fighting plans e Lessons learned from fire drills e Changes in pre-fire strategies e Advanced fire fighting techniques e Modifications that affect fire loading characteristics in safety-related areas I in addition to being trained as a fire brigade member, Fire Brigade Leader Training is provided to ensure fire brigade leaders have the necessary knowledge and skills to direct and coordinate fire fighting activities during a fire. The fire brigade leaders meet all the same requirements of the fire brigade members and additionally, course TR-2503, Fire Brigade Leader Training, is also required. This course consists of training on fire assessment, fireground command, strategy and tactics, coordination with off-site fire department, and fire cause investigation. This course is repeated every two years. 4.8.5.4 Practice During requalification, fire brigade members are required to complete course TR-2502R. This course includes practice of actual fire fighting experience. As a minimum this course provides hands on experience in the use of hand portable extinguishers, interior fire fighting with breathing apparatus, pressurized fuel fire, exterior flammable liquid fire, and interior flammable liquid fire with breathing apparatus. This ensures that fire brigade members receive actual experience in fire fighting. O

Rrport Numbzr SEA 95-001 Rsvision _Q, Page _7,1, of M O 4.8.5.5 Drills River Bend Station uses fire fighting drills to ensure that training of the fire brigade and other plant personnelis effective. The drills that are run are pre-planned using the Fire Drill Planning Guide in TPP-7-021, " Fire Protection Training and Qualifications". The planning guide ensures that drill objectives are known before running them and a critique is performed following to ensure that training objectives are being met. Any problems are documented along with recommendations for improvement. The lead controller of each fire drill critiques the drill. Per TPP 7-021, fire drills are conducted in accordance with the frequencies below: Each shift Fire Brigade is drilled at least once in each calendar quarter j e At least one fire drill per year for each shift fire brigade is unannounced At least one fire drill per year for each shift fire brigade is conducted on other than e the day shift Each fire brigade member participates in at least two drills per year e Each fire brigade member who is qualified in the previous calendar year participates o in at least two drills during the current calendar year. Fire Brigade members who complete initial qualification during the current calendar e year participate in at least one additional drill during the current calendar year The off-site fire department is invited to participate in at least one drill per year e At three year intervals, a randomly selected unannounced drill is critiqued by e individuals independent of River Bend staff Follow-up drills are conducted within 30 days when drill performance was e unsatisfactory Pre-fire strategies are developed for fires involving safety related or other designated equipment. The pre-fire strategies contain pertinent information for combatting fires in the area. Pre fire plans are developed for areas not covered by pre-fire strategies. The pre-fire strategies contain inf ormation such as access to space, available lighting, receptacle types, i fire suppression equipment, fire detection equipment, communications, ventilation, combustibles, fire / smoke propagation control, evaluation of fire and shutdown capability, guidelines for fire attack, and an area layout sketch. The pre-fire plans are a part of the fire brigade training as described above. 4.8.5.6 Records Program records produced as a result of fire protection training are defined and processed in accordance with TAP-5-007, " Training Records and Documentation". This procedure O documents the training received by an individual assigned to the River Bend Station.

R:p:rt Nurnbar SEA 95 OO1 Revision ,Q. Page .21 of,,,131 o k This allows for the requirements of auditability and retrievability. All training records are j reviewed by the nuclear training coordinators and then transferred to the nuclear training library, where they are transferred to the records group for entry into CICS (computer data base) and for hard copy storage. These records are retained for audit and accountability reasons. 4.8.6 Total Environment Equipment Survival This section discusses the effects on plant equipment from combustion products and spurious suppression actuation. It also discusses the effectiveness of operation actions. 4.8.6.1 Potential Adverse Effects on Plant Equipment by Combustion i Products The non-thermal effects to plant equipment outside of the fire area are expected to be minimal. The current design of River Bend Station precludes large amounts of combustion products from exiting an area in which a fire has occurred. The design of each fire area with respect to passive fire barriers such as penetrations precludes passage of smoke and other combustion products. The only passage of combustion prode':ts that may occur is l when fire-fighting teams enter areas to manually suppress the fire. This will breach fire area boundaries and allow combustion products to be released to other fire areas, l However, the fire fighting team would retard most of the combustion products while V combatting the fire. Theref ore, only minimal combustion products will be released to other areas. 4.8.6.2 Spurious or inadvertent Fire Suppression Activation NRC IN 83-41, " Actuation of Fire Suppression System Causing Inoperability of Safety-Related Equipment", alerted licensees to recent experiences involving actuation of fire suppression systems which caused damage to or inoperability of systems important to safety. General Design Criterion 3, Fire Protection, of Appendix A to 10CFR50 requires that fire fighting systems shall be designed to ensure their rupture or inadvertent operation does not significantly impair the safety capability of structures, systems and components. At River Bend Station, fire suppression systems are designed to adhere to the requirements of this design criteria. The installation procedures of Specification 248.000, "ElectricalInstallation", and the design to ensure one train of safety related components survive a fire, ensure that Design Criteria 3 requirements are met, Specification 248.000, " Electrical Installation", is used for installation of electrical equipment at River Bend Station. Installation applies to items such as cable trays, The switchgear, MCC's, conduits, control and power cables, junction boxes, etc. specification requires that conduit, which has cable terminating or starting in an area where a suppression system is, be sealed to prevent water leakage into enclosures. The specification also calls for proper sealing of cable and conduit penetrations into the ) top of panels or electrical switchgear. Cables which are used in plant applications must s pass stringent requirements, which includes a water submersion test. In short, the design

i RIport Numbtr S E A-95.OO 1 Revision _g_ Page 74 of M O specification ensures that minimal water can accumulate inside of components during inadvertent actuation of suppression systems. A number of calculations have been performed to address flooding concerns due to inadvertent suppression system actuation. The calculations determine the height of water due to inadvertent suppression system actuation in any plant area. The conclusions of the analysis stipulate that the height of water in any plant area will not be sufficient to submerse any safety related equipment or cables. The FHA and the Moderate Energy Line Crack (MELC) calculation also determine the same results. These calculations prove that inadvertent actuation of suppression systems which result in flooding of the fire area will not cause water level which will be sufficient enough to render safety related equipment inoperable. - The effects of water spray on safety related equipment is also of concern at nuclear power plants. Suppression system water can impinge upon safety related equipment while traveling to the floor and cause water damage. At River Bend Station, each fire area is designed to ensure that one method of safe shutdown will survive for a catastrophic fire within it. That is, a fire which occurs in a given fire area along with subsequent suppression activities, will not render the ability to shutdown the plant inoperable. Therefore, the inadvertent actuation of suppression systems alone, will not render safe shutdown of the plant inoperable. 4.8.6.3 Operator Action Effectiveness AOP-0031, " Shutdown From Outside the MCR",is the procedure used to safely shutdown and cooldown the reactor following an event requiring evacuation of the MCR. This procedure is used to direct operators to specific actions necessary to safely shutdown and I cooldown in the event of a control room fire and control room evacuation is necessary. AOP-0052, " Fire Outside The MCR (In Areas Containing Safety Related Equipment)", provides instructions for operators to safely shutdown and cooldown the reactor following a fire outside the MCR, in any area containing safety related equipment. Both of these procedures contain operator actions to safely shutdown using the available shutdown method as prescribed by the SSA. Pre-fire strategies are also developed to supply pertinent data for combating a fire for a particular area. Each pre-fire strategy contains information related to the specific fire area for which is was written. These safe shutdown procedures and pre-fire strategies ensure operator effectiveness in combating fires in any area of the plant. TPP-7-021, " Fire Protection Training and Qualifications", describes the training program established to ensure operators are adequately trained to perform fire-fighting. Specifically, course TR-2500, Fire Brigade Training, requires detailed training on plant fire-fighting strategies, procedures, familiarization of layout of the plant, access and egress routes for manual actions, and identification of the location of fire-fighting equipment. The fire brigade receives initial training on this procedure and then subsequent training is also received on this procedure during the requalification training process. O The training is documented and records are kept for audi ability purposes. Actual hands on training is also demonstrated during plant drills.

R;p;rt Numb:r SE A-95-OO1 Revision .Q. Page .25_ of.151, t i k./ The current Appendix R manual operator actions do not require operators to pass through fire areas that may contain smoke or fire. However, an action of this kind would, be feasible with respect to operator performance. The equipment required to be available to operators in the plant fire equipment lockers and van would allow operators to transgress through these areas. Each brigade locker contains breathing apparatus and necessary tools to perform these actions. i 4.8.7 Control Systems interactions This section is an excerpt of the River Bend Station USAR, Section 7.4.1.4: "The Remote Shutdown System (RSS) is designed to achieve and maintain hot reactor shutdown and subsequently to achieve cold shutdown from outsido the MCR following 'these postulated conditions: (a) The riant is at normal operating conditions, all plant personnel have been evacuated from the MCR, and it is inaccessible for control of the plant. 1 (b) The initial event that causes the MCR to become inaccessible is assumed to be such that the reactor operator can manually scram the reactor before leaving the MCR. The RSS is required only during times of MCR inaccessibility when normal plant operating (n) conditions exist, i.e., no transients or accidents are occurring. For this reason, only the equipment which interfaces directly with safety-related equipment (RHR, RCIC, etc) is required to be of safety-related quality. Transfer and control switches at the RSS panels and other selected control points, are provided for equipment which is controlled during remote shutdown. The controls and indications at these panels are listed in the following sections. The main steam isolation valves and the ADS valves represent potential fire-induced LOCA pathways tinat are accounted for in the design of the RSS. Isolation is assured through the respective deenergization of the RPS breakers in the RPS distribution panels at elevation 115' in the control building and the ADS breakers in the DC distribution panels at elevation 98' in the control building. The initiating event that causes the MCR to become inaccessible could be a large transient fire that includes shorts and/or spurious signals producing potential LOCA pathways and/or incorrect system lineup for shutdown. Transfer and control switches exist at the RSS Division 1 panel (single failure criteria is not a pplicable for a fire event) and the DG local control panels to achieve and maintain hot s tutdown; while local transfer and control switches for the DG fuel oil transfer pump ai d the standby service water pump house ventilation fan exist to achieve and maintain old shutdown. Iv

RIport Numbr.r S E A-95-OO 1 Revision .Q. Page 76 of,,133, ( Some of the existing systems used for normal reactor shutdown operation are also utilized in the remote shutdown capability to shut down the reactor from outside the MCR. The functions needed for remote shutdown control are provided with manual transfer switches which override controls from the MCR and transfer the controls to the remote shutdown panel and other selected control points. Remote shutdown control is not possible without actuation of the transfer switches. Power supplies and controllogic are transferred and isolated. The isolated Division I and Ill controllogic circuits required to shutdown the plant in the event of a MCR fire are furnished power from independently fused power supplies. Access to the remote shutdown panelis administratively and procedurally controlled via the plant security system. Local transfer switch positions are monitored via remote annunciation in the MCR, while proper system lineup (local control switches) is monitored via remote indication at the RSS Division I panel. Controls and instrumentation for all system equipment necessary for proper system lineup initiation are located on the remote shutdown panels. System control is available from the RSS panels and other selected control points." The ability to complete safe shutdown from the remote shutdown panel has been assured by the use of the transfer switches as described in USAR section 7.4.1.4. Transfer of control to the RSS completely isolates the control room and assures that safe shutdown can be completed successfully. Separate fusing and power supplies are not an active part of the control circuit until the transfer switches are operated. The transfer switches first remove the control room portion of the circuit, thus removing any control room faults, q Subsequently, the transfer switches then connect the separate fuses and power supplies Q to the control circuit making them operable independent of the control room. This ensures remote shutdown systems are independent of the control room, and a single fire cannot disable operability from both places. NRC IN 85-09, " Isolation Transfer Switches and Post-Fire Shutdown Capability", alerts recipients of potential discrepancies in the electrical design of isolation transfer switches installed outside the control room at many nuclear power plants. The transfer switches provide electricalisolation of certain shutdown circuits from the control room and other essential fire areas during post-fire accident conditions. The IN is associated with circuits which must be isolated from the control room to ensure operability exists from the remote shutdown panel. River Bend Station responded to this notice with the following statement: "In a response to a Staff request dated April 9,1985, Gulf States Utilities, has reviewed IE IN 85-09. The concern identified is not applicable at River Bend Station. The River Bend Station design includes remote shutdown circuits which are separately fused and isolated from the MCR circuits in order to safely shut down the plant in the event of a MCR fire." 4.8.8 Adequacy of Analytical Tools COMPBRN lite fire modelling program has been accepted by the NRC for analytical fire modelling and therefore, there is no additional evaluation required for this issue.

R:ptrt Number _ SEA 95-OO1 Revision ,g, Page 77 of_15]L ID 'V/ 4.9 USl A-45 and Other Safety issues 4.9.1 USI A-45 " Shutdown Decay Heat Removal Requirements" USl A-45 was completed as part of the River Bend IPE submittal in Section 3.4.3. This issue was evaluated as part of the IPEEE to determine if the risk due to internal fire impacts the Category 1 vulnerability classification assessed in the IPE. River Bend did not find any vulnerabilities due to loss of decay heat removal as a result of internal fire. 4.9.2 USl A-17 " Systems Interactions in System Interaction in Nuclear Power" All aspects of USl A-17 were completed in the River Bend IPE report except for spatial interactions due to seismic or internal fire events and human interactions due to main control room fire. Fire SpatialInteractions - Fire spatialinteractions were evaluated as part of the Fire PRA performed at River Bend. Any significant spatialinteractions would inherently be identified by the presence of a high calculated core damage frequency. Based on the Fire PRA results discussed in Section 4.11, River Bend did not identify any vulnerabilities due to fire. Therefore, there are no fire spatialinteractions resulting in plant vulnerabilities for River Bend. OD Main Control Room Fire - Section 4.10 addresses the aspects of human interaction due to a fire in the main control room (MCR) including evacuation of the MCR and shutdown using the Remote Shutdown System. No vulnerabilities were found due to human interaction associated with MCR fire. 4.9.3 NUREG/CR-5088 " Fire Risk Scoping Study" Section 4.8 of this report addresses the issues relating to the Fire Risk Scoping Study. Section 4.8.6.2 addresses issues in the Fire Risk Scoping Study related to Generic issue GI 57, " Effects of Fire Protection System Actuation on Safety-Related Equipment." Thus, the RBS IPEEE report has adequately addressed NUREG/CR-5088 concerns. 4.10 Main Control Room Analysis This section addresses the frequency of core damage due to a fire that originates in the Main Control Room (MCR) of River Bend Station. This analysis is bounding in nature while taking into account the specific systems and design of River Bend. The frequency of a fire in the MCR has already been determined [1]. This analysis identifies the applicable scenarios that lead to core damage given that a fire in the MCR has occurred and O determines the conditional probability of those scenarios.

Report Number _ SEA-95-001 Revision _Q. Page 78 of m O 4.10.1 Main Control Room Design The MCR at River Bend is designed and constructed using a modular concept. The primary components of the modular design are the panel modules. A panel module consists of the floor section, termination cabinet, and inter-panel cabling of a power generation control complex (PGCC) module along with the associated operator and signal conditioning panels that are mounted on the floor section. The termination cabinet provides a means of connecting the field wiring into the factory installed wiring in the PGCC to connect the plant controls in the panels to the instruments and components out in the plant. Within the PGCC floor section, cable raceways are provided for routing and separation of allinter-panel cables. Divisional cables are separated in the raceways by the use of fire stops and seals to provide physical separation of different divisions. Likewise, within the termination cabinets, unless separate cabinets are provided for the divisions, divisional cable is also kept separated by barriers. For River Bend there are a total of 28 panel modules that make up the MCR. Fire detection and suppression systems are an integral part of the design of the MCR at River Bend. Each of the 28 panel modules in the River Bend MCR is considered a separate fire protection zone. Each of the 28 MCR fire zones has its own fire protection control cabinet mounted on the center duct of the PGCC floor section. Each PGCC floor section typically contains two thermal detectors and one product of combustion detector in each of the longitudinal raceways. There are typically four longitudinal raceways in each floor 9 section. The thermal detectors are designed to alarm at a temperature increase of 15 F per minute or at a temperature of 140 F. Additionally, each termination cabinet typically contains a single product of combustion detector for each bay (for a total of four detectors per cabinet) located inside and at the top of the cabinet. Each of the operator and signal conditioning panels also typically contains a product of combustion detector, one per isolated panel bay. Any of the detectors that reaches its actuation setpoint will result in an alarm occurring at the MCR fire protection control console 1H13-P861. Visual and audible alarms will additionally be received locally at the fire control panel. Fire suppression is provided by an automatically initiated Halon 1301 system for the cable raceways in the PGCC floor sections. The system consists of two halon bottles, valves and their actuation components, and a piping distribution system. The halon bottles, valves and their actuation circuitry, and some of the piping are located inside the fire protection control cabinet f or the panel module. Both bottles connect to a single pipe that exits the cabinet and connects to a manifold located in the flocr ducts. From the manifold, piping distributes the halon to each of the four longitudirol raceways. A minimum of four nozzles, one per raceway, is provided to deliver the h'ston into the raceway. More than one nozzle may be necessary if the raceway conta3as divisional fire stops. Automatic actuation of the halon system is provided by the detector circuitry. The actuation of any of the four products of combustion detectors in the cable raceways in the PGCC floor section will result in the actuation of both visible and audible pre-alarm signals. The halon will r.ot be discharged by the actuation of the products of combustion detectors. The firing circuit is actuated by any of the two thermal detectors located in each raceway. The thermal detectors, in addition to providing alarm functions, will result in automatic valve actuation by explosive valve initiation to release tae halon from one bottle. At the same time, a timer will start that will result in actuation and discharge of the second halon bottle af ter 10 minutes. In addition to the automatic initiation circuitry, manual pull stations are l

RIport Numbu SE A-95-OO1 Revision 3, Page 79 of _j,gt O provided at each control panel. One pull station for each halon storage bottle is provided. i The halon suppression system is designed to produce a concentration of 20% halon in the atmosphere in the cable raceways and maintain that concentration for 20 minutes. For fires that may be located in the termination cabinets or operator or signal conditioning panels, automatic suppression is not provided. Instead, the panels and cabinets are provided with easy and quick opening doors to allow manual suppression. As stated above, each cabinet or panel does contain a products of combustion detector that will l generate an alarm if a fire occurs inside the cabinet or panel. Additionally, the MCR is continuously manned and any significant fire in a cabinet or panelis likely to be discoverea i by personnel due to the smoke or smell being generated. Once detected the panel fires can be manually suppressed by opening the doors and using one of the six portable CO l . fire extinguisher lect.ted in the MCR to suppress the fire. Alllicensed operators at River . Bend are trained in the use of the fire extinguishers. It is also highly probable, though not j a requirement, that one of the operators in the MCR has been a member of the plant fire brigade and is thoroughly trained in fire fighting. 4.10.2 Core Damage Scenarios Since the fire is occurring in the location where the plant's operations and control functions normally occur, loss of habitability in that location severely complicates the mitigation effort. Once the MCR is evacuated, the plant operators maylose the capability of using much of the equipment in the plant to perform a shutdown and to mitigate any O failures that may occur as a result of the fire. Additionally, the MCR is one of the few locations in the plant where all of the divisions of safety systems come together in the same area so that the potential exists for a common mode failure of multiple safety trains. Therefore, there are two basic types of scenarios that could lead to core damage given a fire in the MCR. The first involves a fire in the MCR that does not result in the evacuation of the MCR by the operators. The second scenario involves a fire in the MCR that does result in evacuation. Issues that are important to determine which of these scenarios will occur for a given fire in the MCR are discussed below. 4.10.2.1 Ignition and Propagation Two aspects of the MCR fire that are important to the severity of the fire and the ability of the operators to remain in the MCR are the origin of the fire and the potential for propagation of the fire from the site of origin. In general, potential combustible fire sources are classified as fixed or transient. For the MCR,it is assumed that transient fire sources do not pose a significant risk since the MCR is continuously manned and the likelihood that a transient fire would not be detected and extinguished in its incipient stage is very small. Therefore, only fixed combustible sources were considered. j There are two primary areas in the MCR at River Bend where fixed combustibles exist and a fire may originate. The first area is in the cables contained in the cable raceways of the PGCCs. The use of the PGCCs results in a much larger amount of cable being located in the MCR than would be present in the more traditional MCR designs. However, the cables are all contained in enclosed raceways in the PGCCs. Therefore, it is highly unlikely that the cabling could catch fire due to operations such as welding being puformed nearby. This leaves only self-ignition as a viable means of starting a cable fire in the MCR at River

) Rrport Nurnbtr S E A-95-OO1 Revision .Q. Paoe .E.Q. of_119 Bend. However, the vast majority of cabling in the MCR is qualified to IEEE-383. Data in the EPRI fire events data base 15] has shown that the likelihood for self-ignition of qualified cable is extremely small. In addition, there is an automatic detection and suppression system that would be expected to extinguish any fire during its incipient stages before it could resuit in significant damage to adjacent cables, thereby limiting damage due to any fire that did occur due to cable self-ignition to a single cable. For these reasons, cable fires are not considered to be significant sources for MCR fires at River Bend and they will not be considered further in this analysis. The second area of fixed combustibles where fires may originate in the MCR are electrical cabinets. The frequency of fires in electrical cabinets is significant and is used as the basis for MCR fires. The electrical cabinets of concem in the River Bend MCR include the PGCC termination cabinets and the operator and signal conditioning panels that are mounted on the floor section of the PGCCs. For this analysis, it is assumed that a fire is just as likely to occur in one cabinet as another. If a fire does occur in a cabinet, the extent of damage to the equipment in the cabinet as well as the potential for the fire to propagate to adjacent cabinets become additional factors that were considered. A review of the Control Room fire events contained in the Fire Events Database (FEBB) shows that most of the Control Room fires do not propagate beyond the initiating j component. Only 2 of 10 events were considered to spread beyond the initiating i component. For those fires where only the initiating component was damaged, the CDF contribution is assumed to be small. This CDF is bounded by the CDF calculated in the O internal events IPE and is not quantified in this analysis. For these fires where more than the initiating component was damaged, the CDF contribution was calculated. In calculating the CDF, it was assumed that all of the cabinet contents and equipment on the associated divisions were damaged by the fire (except where protection exists for the Remote Shutdown System.) The potential for the fire that originates in one cabinet to propagate to an adjacent cabinet is based on the electrical cabinet tests performed by Sandia Labs and reported in several EPRI documents. The Sandia tests showed that if adjacent cabinets were separated by double walls with an air gap, a fire in one cabinet would not propagate to the next. At River Bend, the cabinets mounted on the PGCC floor sections are placed next to each other without a specified gap. Therefore, while there is a double wall between any two adjacent MCR cabinets at River Bend, there is not necessarily any air gap. No credit will be taken for having an air gap between cabinets in this analysis. The conditions that seemed to resuit in propagation from one cabinet to another in the Sandia tests were the presence of a diagonal cable between the cabinets with the lower end in the cabinet with the fire and the presence of a plenum area in the top of the cabinet such that a hot gas layer can form. In the River Bend MCR the inter-cabinet cables run through the raceways in the PGCCs, so there are no diagonal cables between cabinets and this means of propagation can be ignored. Finally, the cabinets in the River Bend MCR do have enclosed tops so that a hot gas layer could form. This means of propagation is viable for River Bend and will be cons:dered. From the Sandia electrical cabinet fire tests,it takes about 15 minutes for the adjacent cabinet to begin releasing significant amounts of heat, so for O this analysis it will be assumed that if a fire in an electrical cabinet is extinguished within 15 minutes the fire does not spread to the adjacent cabinets.

Riport Numbir _ SEA-95-OO1 R: vision _g. Page Sj_ of _j,11 O 4.10.2.2 Irnpacts on Habitability V As mentioned earlier, one of the issues related to MCR fires that make their a unique is the issue of habitability. There are several environmental impacts fire that could result in the MCR crew evacuating. These impacts include tem visibility. If these impacts are severe enough,it could force the evacuation of th and complicate recovery. The impact of increased temperature and reduced to a MCR fire is related to the size of the fire. The longer the fire bums, the more s is developed and the higher the temperature. The MCR is a relatively large ar of this, temperature impacts except in the immediate vicinity of the fire are not to be significant. Therefore, it is unlikely that temperature would result in the evac of the MCR. The smoke generation in the MCR could be significant. The MCR has several features which minimize the impact of smoke and products of combustion. The MCR has sm removal fans which may or may not be damaged by the fire depending upon the location of the fire. Breathing apparatus is available to the MCR crew and alllicensed operato are qualified in the use of breathing apparatus. Data from the Sandia electric cabinet fire tests, as discussed in detailin [6), show approximately 15 minutes are available to extinguish a cabinet fire before the smoke becomes too thick to see through. Therefore, it will be assumed in this analysis th fire in an electrical cabinet is extinguished prior to 15 minutes, MCR evacuation is

required, if, however, the fire in an electrical cabinet is not extinguished within 15 i

minutes, MCR evacuation will be required and shutdown will have to be accompl through the Remote Shutdown System (RSS). j 4.10.2.3 Induced Equipment Failures As discussed above. MCR fires that are considered in this analysis are limited to t involving an electricas cabinet. To determine the impact of a fire in one of the cabi the amount of damage that occurs as a result of the fire was identified. To iden exact failures that occur in the cabinet as the fire progresses would require extensive analysis and testing. To do this rigorously would require a detailed analysis of and components in the cabinet to identify all of the components that could be aff the fire and to identify their potential failure modes. This effort would require an unreasonably large expenditure of resources. To simplify the analysis, it was assumed that when a cabinet is affected by the fire that may damage more than the initia component, it will result in the failure of the entire division to which that cabinet belon Specifically, if the cabinet damaged by a fire is a Division I cabinet, it was assumed t all of the Division I safety-related systems are failed. Likewise,if the cabinet is a Divisio ll or Division lli cabinet, it was assumed that all of Division it or 111is failed Offsite p was assumed to be available to the divisions that are not impacted by the fire. However, wer if the cabinet is non-divisional, it was assumed that all of Divisions I,11, and til are n impacted by the fire. It was assumed that offsite power is lost for a fire in a non-divisio cabinet. If a cabinet co itains multiple division equipment from any two divisions, it will be assumed that both divisions are failed by a fire in that cabinet.Finally, if a cabinet contains divisional equipment from all three divisions, it will be assumed that the operat

R port NumbIr SE A-95-OO1 Revision J, Page _QL of _15.9_ J would lose the ability to use all three divisions from the MCR and a MCR evacuation and shutdown using the RSS would be required. 4.10.2.4 Core Damage Scenario Descriptions Based on the above information a description of the specific MCR fire scenarios that could result in core damage was developed. For all MCR fires of significance, the fire originates in an electrical cabinet in the MCR. If the fire is extinguished within 15 minutes, the operators will remain in the MCR and the fire induced damage will be confined to the cabinet of origin. It will result in f ailure of the entire division to which the cabinet belongs, or LOSP if the cabinet is non-divisional. If the fire is not extinguished within 15 minutes, or the fire occurs in a cabinet that contains equipment for all three safety related divisions, then it is assumed that evacuation will be required and only the equipment operable through the RSS will be available to mitigate the event. Therefore, the scenarios addressed were: Fire in Division I cabinet, suppressed within 15 minutes - results in failure of a. Division I safety related equipment, offsite power is available to Divisions 11 and Ill. Shutdown using the Div i equipment from the RSS is credited if shutdown from the MCR is not successful. b. Fire in Division 11 cabinet, suppressed within 15 minutes - results in failure of (~} Division 11 safety related equipment, offsite power is available to Divisions I and Ill. V c. Fire in Division 111 cabinet, suppressed within 15 minutes - results in failure of Division 111 safety related equipment, offsite power is available to Divisions I and 11. d. Fire in non-divisional cabinet, suppressed within 15 minutes - results in LOSP, no divisional safety related equipment impacted by fire, Fire in cabinet with both Division I and ll equipment, regardless of suppression - e. results in failure of both Division I and 11 safety related equipment which will also result in failure of Division lli due to HVAC dependencies, therefore, MCR evacuation assumed to be required and RSS used for shutdown. f. Fire in cabinet with Division I,11, and l11 equipment, regardless of suppression - results in failure of Division I, il, and til safety related equipment, therefore, MCR evacuation assumed to be required and RSS used for shutdown. Fire in cabinet with Division I,11, or ill or non-divisional equipment, not suppressed g. within 15 minutes - results in loss of visibility for the operators, therefore, MCR evacuation assumed to be required and RSS used for shutdown. These are the scenarios that were quantified to determine the overall CDF due to MCR fires for River Bend. The following sections examine these scenarios in two groups: those that do not result in MCR evacuation and those that do result in MCR evacuation. b 4.10.3 Fires Not Resulting in Evacuation

Report Numbu SEA-95 OO1 R:visi:n .Q. Page ,61, of_152. [ This section estimates the CDF due to MCR fires that do not result in the evacuation the operators from the MCR. The basic equation for determining the CDF: CDF = F

• P
• fe,.
• Psu,,
• CC D P a

ay Where Fa =, Frequency of MCR fires P. Probability spreads from initiating component to damaged other = components. (= 0.2 per Section 4.10.2.1) fci. Fraction of MCR fires in electrical cabinet of particular division = Psu,, Probability of MCR cabinet fire being suppressed within 15 = minutes CCDPo,y CCDP given failure of division of interest = The frequency of MCR fires is 9.50 x 10-8/yr [161. The above equation was applied to each of the four non-evacuation scenarios listed in Section 4.10.2.4. 4.10.3.1 Fraction of Cabinets in MCR in order to determine the fraction of electrical cabinets in the MCR that is applicable to each of the MCR fire scenarios, the total number of cabinets and the number of Division I,11,111 and non-divisional cabinets must be known. The number of each type of cabinet was determined by reviewing the physical arrangement drawings for the MCR. There is a total of 109 cabinets in the MCR of which 22 are Div i cabinets, 23 are Div 11 cabinets, 6 are Div Ill cabinets, 52 are non-divisional and 6 are multi-divisional. For this analysis it was assumed that a fire in any of the multi-divisional cabinets would result in the loss of the ability to operate and control all of the divisions contained in the cabinet and it was assumed that the operators would lose the ability to use all three divisions from the MCR and a MCR evacuation and shutdown using RSS would be required. The fraction of each type of cabinet is calculated to be: fe, o,,, 22/109 0.202 = = feas o,,, 23/109 0.211 = = fen o. 6/109 0.055 = = fer o,, % 52/109 0.477 = = fer o,,t s. 6/109 0.055 = = 4.10.3.2 Probability of Extinguishing a Cabinet Fire

l Ripsrt Numb 0r S E A-95-OO 1 Revision ,q, Page 84 of M Ob As was discussed earlier, the critical time available to extinguish an electrical panel fire in the MCR is 15 minutes. If the operator successfully extinguishes the fire before 15 minutes, the damage is limited to the cabinet in which the fire originated and the operators are able to remain in the MCR. If, however, the operator is not able to extinguish the fire within 15 minutes, the damage will spread to adjacent cabinets and the operator will be forced to evacuate the MCR and shutdown the plant using the RSS. Note that the spread of the fire to adjacent cabinets is essentially irrelevant since once the operator abandons the MCR all of the MCR cabinets become essentially unavailable, although some j equipment is still operable through the RSS. There are no automatic suppression systems for the electrical cabinets in the MCR at River Bend. Therefore, suppression must be done manually and the human error probability for failure to suppress a fire within 15 minutes was determined in " Fire Re-quantification Studies" [61, an analysis was performed using the data from actual < ontrol room fires in the fire events data base to estimate the human ~ error probability for manual fire suppression as a function of time. The analysis used the Human Cognitive Reliability correlation [7] to analyze the observed data on MCR fires and develop a log-normal curve representing the probability of non-action f or times greater than that observed. The analysis yielded a mean estimate of failure to suppress an MCR fire prior to 15 minutes of 3.4 x 10~2 This is the value that was used as the conditional probability of MCR evacuation given a fire in the MCR. Therefore, the probability of successfully suppressing a fire prior to 15 minutes is: 1.0 - 3.4 x 10'8 0.9966 P ur = = s 4.10.3.3 CCDP for Fires Not Resulting in Evacuation The CCDP given a fire in the MCR that does not result in evacuation was determined using the fire PRA event trees and system fault trees developed in [8 and 9]. However, the divisional nature of the cabinets in the MCR made it possible to credit some additional instrumentation and automatic function for the equipment in the SSA. Even after crediting the additional instrumentation and automatic functions, the CCDP calculated are conservative because no credit was given for a significant amount of equipment. With the exception of the credit given for the Firewater system, the MCR fire analysis credits only systerr.3 contained in the SSA. The quantification process for each of the four non-evacuation scenarios is described below along with the results. 4.10.3.3.1 CCDP for a Division 1 Cabinet The CCDP for a Div i cabinet fire was quantified using the fire PRA event tree for non-LOSP sequences. This quantification was for a non-evacuation scenario where the fire is suppressed in the first 15 minutes and fire damage is limited to the cabinet of origination. To simulate the failure of Division i due to the fire, basic event EPS-BUSLOF1 ENS 1 A, which represents the Division i 4160 volt shutdown bus, had its failure probability set to 1.0 in the data base. This effectively failed all of Division I in the quantification. Additionally, basic event T1 A, representing LOSP to the Division I shutdown bus, was set to True to indicate offsite power is not available to the bus and events T1B and T1C, /\\ representing LOSP to the Division 11 and ill shutdown busses respectively, were set to False indicating that offsite power is initially available to the busses. The quantification was then performed and the CCDP was determined to be 4.48 x 10-8

Report Number _ SEA 95-001 Revision _Q, Page J.5., of _15.9_ gm ( The Remote Shutdown System (RSS) was also credited for Div i cabinet fires. The RSS is made up of Div i components which have circuitry which is protected from a fire in the MCR. If shutdown was not achievable in the MCR, the operators would evacuate and use the Div i RSS equipment. The Div i RSS equipment is independent of the CCDP calculated for Div i cabinet fires i because all of Div i were failed in the CCDP quantification. The CCDP for the RSS was calculated to be 2.74 x 10 2 (see Section 4.10.3.5). This CCDP is multiplied into the equation from 4.10.3 for the DIV I cabinets. 4.10.3.3.2 CCDP for a Division 11 Cabinet . The CCDP for a Div 11 cabinet fire was quantified using the fire PRA event tree for non-LOSP sequences. This quantification was for a non-evacuation scenario where the fire is suppressed in the first 15 minutes and fire damage is limited to the cabinet of origination. To simulate the failure of Division 11 due to the fire, basic event EPS-BUSLOF1 ENS 19, 1 which represents the Division 114160 volt shutdown bus, had its failure probability set to 1.0 in the data base. This effectively failed all of Division ll in the quantification. Additionally, basic event T1 B, representing LOSP to the Division 11 shutdown bus, was set to True to indicate offsite power is not available to the bus and events T1 A and T1C, representing LOSP to the Division I and ill shutdown busses respectively, were set to False ]V indicating that offsite power is initially available to the busses. The quantification were then performed and the CCDP was determined to ba 1.94 x 10'8 4.10.3.3.3 CCDP for a Division ill Cabinet i The CCDP for a Div Ill cabinet fire was quantified using the fire PRA event tree for non-LOSP sequences. This quantification was for a non-evacuation scenario where the fire is suppressed in the first 15 minutes and fire damage is limited to the cabinet of origination. To simulate the failure of Division 111 due to the fire, basic event EPS-BUSLOF1E22S4 which represents the Division 1114160 volt shutdown bus, had its failure probability set to 1.0 in the data base. This effectively failed all of Division 111 in the quantification. Additionally, basic event T1C, representing LOSP to the Division til shutdown bus, was set to True to indicate offsite power is not available to the bus and events T1 A and T1B, representing LOSP to the Division I and il shutdown busses respectively, are set to False j indicating that offsite power is initially available to the busses. The quantification were then performed and the CCDP was determined to be 3.15 x 10'8 4.10.3.3.4 CCDP for a Non-Divisional Cabinet The CCDP for a non-divisional cabinet fire was quantified using the Fire PRA event trees for LOSP and SBO sequences. This quantification was for a non-evacuation scenario where the fire is suppressed in the first 1S minutes and fire damage is limited to the g) cabinet of origination. The non-divisional cabinet fires were assumed to cause an LOSP. ( The Basic events T1 A, T1 B, and T1C, representing LOSP to the Division I,11,111 shutdown

Rrport Numbir SE A.95-OO1 ) Rzvision ,,q, j Page R of M l . O busses, were set to True to indicate offsite power is not available. The quantification was then performed and the CCDP was determined to be 1.79 x 10-5 4.10.3.4 CDF Fires Not Resulting in Evacuation The CDF for the MCR non-evacuation scenarios was calculated using the equation from 4.10.3 (with an additional term for the RSS on the Div i cabinet fires). The contribution to the total non-evacuation CDF from the different types of cabinets is as follows: 4.69 x 10'/yr Divi Cabinets CDF = 7.75 x 10 /yr i 4 Divll Cabinets CDF = 3.28 X 10 /yr 4 Div til Cabinets CDF = 1.62 X 10'*/yr Non-Divisional Cabinets CDF = i The total non-evacuation CDF is the sum of the different cabinet types and is determined to be 1.17 X 10/yr. 4.10.3.5 Fires Resulting in Evacuation 1 This section determines the estimated CDF due to MCR fires that result in evacuation of O 18e eae< 1o<s from the uca mo <aae're 8etoowe # io.18e ass.18ere re =we w vs in which a fire in the MCR could result in an evacuation. Firs; a fire in any cabinet which I is not be extinguished within 15 minutes is assumed to lead to evacuation due to lack of visibility. Second, a fire in one of the multi-divisional cabinets is assumed to impact the operability of all three divisions from the MCR require shutdown using the RSS. Based on this, the basic equation for determining CDF for MCR fires resulting in evacuation was: CDF. + CDFm CDF = Fm

• Fca.. "Pasur
• CCDPass + Fm
• Pm
• fers ou i.,, w,

CDF i = CCDPn Where i CDF = Core Damage Frequency for cabinet fires which are not suppressed i in the first 15 minutes. Core Damage Frequency for multi-divisional cabinets. CDFa = Frequency of fires in MCR F. = Probability spreads from initiating component to damaged other P. = components. Fraction of MCR fires in electrical cabinets containing equipment fou i,,, w, = for multiple safety divisions t -r ...v,- w e. r,, m,

I RIport Number SEA-95-001 Revision .Q. Page .31, of,15,g., l ~y Fe,.. ' = Fraction of MCR fires in electrical cabinets not containing equipment for rnultiple safety divisions. J CCDP., CCDP given evacuation of MCR and shutdown using RSS = i P a su, Probability of MCR cabinet fire ' not being successfully = suppressed within 15 minutes - From the analysis of MCR fires that do not resu!t in evacuation from Section 4.0, some-l of these values are known. From above: .i F. 9.50 x 10 3 per year 4 = fo,y,,,,,. 0.055 ~ = P n eu, 3.4 x 10'8 = The value for CCDP, is determined in the following sections. 4.10.3.5.1 MCR Evacuation Event Tree To analyre the CDF due to fires that result in the evacuation of the MCR, an event tree. defining the possible combinations of systems successes and failures that either lead to j successful core cooling or to core damage for such an event was developed. Unlike the i case of MCR fires that do not lead to evacuation that was analyzed earlier, the existing fire PRA event trees were not readily usable for determining the CCDP for this case, j instead an event tree specifically for this analysis was developed. The basis for i development of this tree was the existing event trees developed for the River Bend Station - fire PRA 181. The fire PRA event trees served as a starting point to develop this event tree. First it must be racognized that there are some differences in the availability of - equipment. As before, no credit was taken for _ systems or components that are not included in the scope of the SSA including the feedwater/ condensate, main steam, and - control rod drive systems. Also, only credit for train A of multi-train systems was taken since train B is not protected from the effects of fires in the MCR (i.e., hot shorts). Credit was taken for the use of HPCS DG and the C SSW pump since they are protected with fuses. However, the HPCS pump and MOVs are not protected and, therefore, HPCS could not be credited as a'means of reactor vessel injection. The event tree for the MCR evacuation scenarios is shown in Figure 4-13. 4.10.3.5.2 Fire Event Tree Success Criteria and Top Events The success criteria for the MCR Evacuation fire event tree is summarized in Table 4-14. Each of the top events in the MCR evacuation fire event tree shown in Figure 4-13 is defined as follows, i Event Tree Headinas u

RepIrt Number SEA-95 OO1 1 Revision .Q_ Page .B.S. of 111. /~N -Q MCRFIRE This event represents the occurrence of any fire in the MCR that requires an evacuation of the MCR and shutdown using the Remote Shutdown System. P1 Success or failure of SRVs opening and re-closing. Success implies that SRVs opened and re closed. Failure implies that of the SRVs opened, one failed to reclose. One open SRV depressurizes the reactor at the same rate as for a small LOCA and the loss of coolant makeup is the same; therefore, the success criteria for one open SRV is the same as for a small LOCA. P2 Success or failure of SRVs opening and re-closing. Success implies that SRVs opened and re-closed. Failure implies that of the SRVs opened, two failed to reclose. Two open SRVs depressurize the reactor at the same rate j as for an intermediate LOCA and the loss of coolant makeup is the same; l therefore, the success criteria for two open SRVs is the same as for an intermediate LOCA. U2 Success or failure of the RCIC system. Success implies that either RCIC automatically actuated at Level 2 or that it was manually actuated and is functioning and injecting coolant makeup into the reactor vessel. Failure implies that RCIC is not injecting into the vessel. X1 Success or, failure of the reactor to depressurize. Success implies that the O operator manually depressurized the vessel. Failure implies that the V operator failed to manually depressurize causing the reactor vessel to remain at high pressure. V3A Success or failure of Train A of the LPCI system. Successimplies that Train A of LPCI either automatically actuated at Level 1 or due to high drywell pressure or that it was manually actuated and is functioning and injecting coolant makeupinto the reactor vessel. Failure implies that Train A of LPCI l is not injecting into the vessel. W1A Success or failure of Train A of the SPC mode of the RHR system. Success implies that train A of RHR was manually aligned to its SPC function (at suppression pool temperature of 950F). Water is being pumped from the suppression pool through the heat exchanger (where it is being cooled by i SSW) back to the suppression pool. Failure implies that no coolina is taking - place. X2 Success or failure of the reactor to depressurize. Success implies that the operator manually depressurized the vessel. Failure implies that operator failed to manually depressurize causing the reactor vessel to remain at high pressure. (X2 is a subset of X1). X2 is considered after a high pressure system has been successful and SPC has failed, since depressurization is required for W2A and ASDCA. W2A Success or failure of Train A of the SDC mode of the RHR system. Success implies that train A of RHR was manually aligned to its SDC function.

R ptrt Numb:r 3EA-95-OOL R;visi:n .Q,, Page .,61 of M it is being cooled by SSW) and back to the ve .[V] nger (where coolino is taking place. . Failure implies that no ASDCA Success or failure of Train A of the Alternate Shu the RHR system. ASDCA is equivalent to a low pressure b ng mode of through the RHR heat exchanger (where e -and-feed pool the reactor vessel through the LPCIinjection lines From th y )backto on this definition, it can be seen that AS e reactor vessel, of either X1 or X2 and that ASDCA cannot succee 4.10.3.5.3 CDF for Fires Resulting in Evacuation The integrated fault tree model was solved for each of the event t paths. The final cut set file estimated the CCDP for MCR fires that l ree success and failure be 2.74 x 10 8 ead to evacuation to \\ The CDF due to fires in the MCR that result in evacuatio equation from Section 4.10.3.5: etermined using the CDF,, 8.36 x 10 /yr 4 = CDF. v 2.87 x 10/yr = The sum of these CDFs make up the CDF for the MCR events whi h Therefore, the CDF due to MCR evacuation events is estimated to b c require evacuation. i e. 0 x 10-8/yr. 4.10.3.6 Results and Conclusions damage frequency due to MCR fires that do not r s s the sum of the core - frequency due to MCR fires that do result in evacuation and the core damage i fires that do not result in MCR evacuation is 1.17 x 10'e. The core damage frequ total core damage frequency due to MCR fires is 4 8 per year. The core damage er year. Therefore, the per year. frequency, MCR fires are not considered to reThe total co per year. At this accidents at River Bend Station. Furthermore,present an outlier or vulnerability to severe to MCR fires was conducted in such a way as to ensure the cthe analysis of co results. Specific areas of conservatism in the analysis include:onservatism of th in the cabinet of origin. This is a very conservat e equipment i observed data presented in the fire events data base, even aft n in light of the severity factor. None of the observed MCR cabinet fires in the d e in significant damage to equipment located in the cabinetue . This assumption tends

Rep:rt Nurriber SE A-95-OO1 Revisitti -Q. Page .1Q. Of 151. A to exaggerate the importance of most cabinet fires that in reality would cause a insignificant amount of damage. e in addition to assuming that all of the equipment in the cabinet of origin be failed by the fire, the entire safety division to which that equipment belonged was also assumed to fail. This assumption is very conservative for most cases since even with total failure of all of the equipment in a single cabinet, there are likely to be many components belonging to the same safety division that are unaffected. However, because there is no built in redundancy within a safety division, the availability of a division cannot be guaranteed given the failure of even one component in that division without knowing exactly what the component and its failure mode are. Since this is not known, this assumption was applied. e it was assumed that a MCR cabinet fire that was contained to a non-divisional cabinet would result in a loss of offsite power and loss of all non-divisional equipment. This assumption is conservative since the majority of non-divisional cabinets do not contain equipment related to offsite power and power distribution. However, since this discrimination was not known, this assumption was applied. It was assumed that a MCR cabinet fire in a cabinet that contains equipment from all three safety divisions will result n loss of the ability to operate all three safety i divisions from the MCR and require MCR evacuation and shutdown using the Remote Shutdown System (RSS). This assumption is especially conservative givon the limited amount of equipment operable from outside the MCR using the RSS. e With the exception of the credit given for the Firewater System, the MCR fire analysis only credits systems contained in the safe shutdown analysis for use in mitigating a fire. This assumption is highly restrictive since it not only disallows the use of all non-safety related equipment in mitigating a fire, but also disallows the use of safety related equipment if it was not credited in the safe shutdown analysis. Additional equipment that is not credited includes such systems as the Control Rod Drive Hydraulic and Containment Fan Systems which the Level 1 PRA showed to be relatively significant mitigative systems. e For MCR fires that result in evacuation, only division i equipment is credited for use through the RSS. Some division 11 and lit equipment is provided with control outside the MCR: however, only division i equipment and limited division 111 equipment is provided with protective fusing to prevent potential failure due to hot shorts. Therefore, the availability of non-division i equipment through the RSS cannot be guaranteed for MCR fires. However, it is unlikely that the fire will disable all of the unprotected equipment. Therefore, this assumption tends to make the core damage frequency for fire events that result in MCR evacuation unrealistically high. e For MCR fires that result in evacuation, it is assumed that all offsite power is lost. This assumption results in the reliance on a single division of equipment (the Div Ill DG and associated service water pump is also available) mitigation of the event. g The unavailability of a single diesel generator then dominates the CCDP.

f Report Number SEA-95-OO1 Revision ,Q. Page 91 of _1M_ 7(v Given the conservatisms included in the MCR fire analysis, it can be seen that calculated core damage frequency is higher than what is believed to be the true core damage frequency. This fact should be kept in mind at all times when evaluating or judging the core damage frequency due to MCR fires for RBS. 4.11 Discussion of important Fire Areas The purpose of this section is to discuss the fire areas providing the greatest contribution to core damage frequency, the major fire scenarios in each of these fire areas, and, as required by Generic Letter 88-20, Supplement 4, to report the systemic sequences associated with these scenarios. Table 4-13 provides a listing of the dominant fire areas and the core damage frequency associated with those areas. The CDFs calculated in the Fire PRA contain a significant amount of conservatism (conservatism in the Main Control Room analysis is discussed in Section 4.10.3.6). Some specific areas of conservatism in the analysis include: The equipment credited for preventing core damage was mostly limited to e equipment in the SSA. Very little Balance-of-Plant (BOP) equipment was credited. Very little credit was taken for automatic and manual suppression. j e When fire damage occurred, damage was generally assumed to be complete and e immediate (the exception is when severity factors were applied for the Main Control Room and the Diesel Generator Rooms). e Failure of a cable was assumed to cause the associated component to failin the worst potential condition (e.g., valves were assumed to spuriously reposition to the worst position.) No credit was taken for thermo-lag barriers. While the thermo-lag barriers may not meet their required ratings, they still provide some protection for the wrapped cables. No credit was taken for roving fire watches. Roving fire watches are curren present in the plant as a compensatory action for inadequate fire separation and w..i be removed when the separation issue is resolved. The conditional core damage probabilities calculated in Section 4.10.3 for Division I, Division 11, and Division 111 differ somewhat. This is as expected for Division ill, since Division lli consists of the HPCS system and its support components and systems. Divisions I and ll would be expected to have more similarity, as each contains approximately the same equipment. However, the CCDP for Division I is approximately twice that of Division ll. Q Closer analysis indicated this difference occurs due to two primary factors. First, V dif ferences exist in the loadings and pump power supplies between the two Service Water Trains. Specifically, only one Train A pump is required whereas Train B requires both pumps. Also, the two Train A pumps are powered from Division I and lli power supplies,

R: port Numbu SE A-95-OO1 Revision ,Q, Page J1 of,,1M_ b ( whereas both Train B pumps are powered from Division ll. The impact of Service Water train differences is discussed in Section 3.2.1.13 of the River Bend IPE submittal. A second factor in the differences in CCDPs is due to the assumption that HVC/HVK Train A is assumed to be running and Train B is assumed to be in standby. This results in a higher failure rate for Train B due to the inclusion of maintenance unavailability and l demand failures for the standby train. Assuming that HVC/HVK Train A is the running l train does make failures of Division i more important than Division II. However, the overall results are not significantly affect regardless of which HVC/HVK Train is assumed to be initially running. The assumption that HVK Train A is running would not prevent the identification of a vulnerability on the Train B side. The contribution of each functional sequence to overall core damage frequency is not calculated because fire vulnerabilities are location specific. Summation of functional sequences for multiple fire locations does not provide useful information in the determination of fire vulnerabilities. Instead of providing the functional sequence contribution to the overall core damage frequency, the functional sequence contribution is provided for each of the unscreened fire areas with a computed CDF > 104/yr. Per the Level 1 PRA, there are 33 functional accident sequence groupings for River Bend Station. However, only sixteen of these functional sequences apply to the Fire PRA sequences, and only five functional sequences contributed more than 1% to any of the remaining fire areas. The top five functional sequences are: O TBU Fire-induced loss of offsite power (LOSP) followed by a failure of the Division I and 11 emergency diesel generators. HPCS is assumed to fait due to a loss of service water return path during a station blackout. RCIC is assumed to fail due to loss of flow and level instrumentation. These assumptions are conservatively made due to lack of cable routing information for these components. Without any injection, core damage occurs. Transient followed by failure of all decay heat removal. High pressure l TW coolant makeup fails immediately, but the vessel is successfully depressurized and low pressure makeup is initially successful. However, without decay heat removal, containment failure due to overpressurization eventually occurs. Containment failure results in a harsh environment in the auxiliary building which causes failure of the SRVs which repressurizes the vessel and fails the operating low pressure systems. Core damage occurs. TUV - Transient followed by a failure of all high pressure and low pressure coolant makeup. Power conversion is assumed to fait due to lack of cable routing information. Without coolant makeup, core damage occurs. { I TUX - Transient followed by a failure of allhigh pressure coolant makeup. Reactor depressurization f ails, preventing the use of low pressure c09nt makeup systems. Power conversion is assumed to fait due to lack of cable routing O information. Without coolant makeup, core damage occurs.

Reprrt Number SE A-95-OO1 ' R;visi n _Q, i Page .22, of _15.9. j .A(j.' S2UV - Transient with one stuck open relief valve followed by a failure of all high l ~ pressure _and low pressure coolant makeup. Without coolant makeup, core damage occurs. j i Fire Area C-25 l Fire Area C-25 is the main control room located on the 136' elevation of the control . building. A detailed discussion of this fire area and its contribution to core damage frequency resides in section 4.10 of this report. The functional sequences that contribute to the core damage frequency in fire area C 25 are: Functional Sequence Contribution to Area CDF TBU 76% TUV 10 % 1 TUX 9% See sections 4.10.2 and 4.10.3.3 for detailed fire damage scenarios. i Fire Area C-15 v Fire Area C-15 is a rectangular room on the 98' elevation and has floor dimensions of 57 l ft x 21 ft. The ceiling of this room is approximately 20 ft high. The room contains equipment essential to the supply of Division I standby power to various parts of the plant. The room contains four electrical cabinets and several horizontal cable trays._ The lowest -l of these cable trays is 10.5 ft above the floor. None of the cable trays travel directly over cabinets. Four fire damage scenarios were postulated and quantified for this fire area. These four scenarios are: l Scenario 1 - A transient fire in the vicinity of cabinet 1 ENS'SWG1 A was postulated to disable 4.16 KV power to Division i equipment. Loss of Division I power fails RHR A, LPCS, SSW A, and standby switchgear room cooling train A. Scenario 2 - A transient fire in the vicinity of cabinet 1ENB'SWG1 A was postulated to 1 disable 125 VDC power to Division I equipment. Loss of Division i power fails RHR A, LPCS, SSW A, and standby switchgear room cooling train A. Scenario 3 - A transient fire in the vicinity of cabinet 1EJS'X1 A was postulated to disable 480 VAC power to that bus. Loss of 1EJS*X1 A causes a loss of standby switchgear room cooling train A. Without switchgear room cooling, the Division I switchgear eventually overheats. Scenario 4 - A transient fire in the vicinity of cabinets 1EHS*MCC8A and 1 EHS *MCC14A was postulated to disable 480 VAC power to those busses. Loss of these busses causes a loss of standby switchgear room cooling

R p*rt Number SEA-95-OO1 Revision _Q. Page ,31. of,,15,3., train A. Without switchgear room cooling, the Division I switchgear ' eventually overheats. The functional sequences that contribute to the core damage frequency in fire area C-15 j are: i -) Functional Sequence Contribution to Area CDF TUX 97 % TW 3% The contribution due to loss of allinjection is primarily due to loss of Division i AC power i which coupled with an operator failure open the switchgear room doors causes core - ,' damage and DC battery depletion after 4 hours. Fire Area C-17 i Fire Area C-17 is an HVAC room on the 116' elevation. This room contains the Control Room HVAC equipment. Fire Area C-17 is a square-shaped room with approximate I dimensions of 78 ft by 68 ft. The room has a ceiling height of 20 ft. i Fire Area C-17 contains both Division I and Division ll conduits. Twelve fire damage scenarios were postulated and quantified for this fire area. Of those scenarios, the top O five accounted for 92% of the core damage frequency in fire area C-17. These five scenarios are: Scenario 1 - A transient fire in the vicinity of cabinet 1CES*PNL6A was postulated to disable 120 VAC power to Control Building HVAC equipment. Loss of this equipment was assumed to cause a loss of standby switchgear room cooling train A. Loss of switchgear room cooling train A causes a loss of Division i equipment. Scenario 2 - A transient fire in the vicinity of a long run of Division I conduits was postulated to disable standby switchgear room cooling train A. Loss of switchgear room cooling train A causes a loss of Division i equipment. Scenario 3 - A transient fire in the vicinity of a small area where Division I and ll conduits are adjacent was postulated to disable both trains of standby switchgear-- room cooling. Loss of switchgear room cooling causes a loss of all emergency switchgear if the switchgear room doors are not opened. None of these conduits are fire-wrapped. Scenario 4 - A transient fire in the vicinity of a small area where Division I and 11 conduits are adjacent was postulated to disable both trains of standby switchgear - room cooling. Loss of switchgear room cooling causes a loss of all emergency switchgear if the switchgear room doors are not opened. None of these conduits are fire-wrapped.

~. .=- Reptrt Number SEA-95-OO1 Revision q_ Page

_gg, of 1),3, O

Scenario 5 - A transient fire in the vicinity of a small area where Division I and 11 conduits i are adjacent was postulated to disable both trains 'of standby switchgear room cooling. Loss of switchgear room cooling causes a loss of all emergency switchgear if the switchgear room doors are not opened. None of these conduits are fire-wrapped. The functional sequences that contribute to the core damage frequency in fire area C-17 are: i Functional Sequence Contribution to Area CDF j TUV 86% l TUX 13% l' f The contribution due to loss of allinjection is primarily due to foss of switchgear room cooling which coupled with an operator failure to open the switchgear room doors causes core damage. Fire Area C-4 4 Fire Area C-4 is an HVAC room on the 70' elevation. This room contains the Standby Switchgear Area Air Conditioning Units. Fire Area C-4 is a rectangular room divided by a concrete wall which separates the Division i ACU and the Division ll ACU. This wall contains a normally open double door. This door is held open by fusible links which will allow the doors to close during a fire and provide a fire barrier between the two ACUS. This area has a ceiling that is approximately 25 ft high. Eight fire scenarios were postulated and quantified for this fire area. Four of the scenarios cause a loss of standby switchgear room cooling train A and the other four cause a loss of switchgear room cooling train B. The loss of train A is more important than the loss of train B because train A is assumed to be normally running and the automatic initiation signals for tiain B are not protected. No scenarios were postulated in fire area C-4 where both divisions of standby switchgear room cooling fail. The functional sequences that contribute to the core damage frequency in fire area C-4 are: Functional Sequence Contribution to Area CDF TUV 83% TUX 16% The contribution due.to loss of all injection is primarily due to loss of switchgear room cooling train A or B which coupled with an operator failure open the switchgear room doors causes core damage. Fire Area AB-2/Z 2

1 RIport Numbtr SEA 95-OO1 R:, vision _Q, Page 16, of_119., O Fire Area AB-2/Z-2 is the HPCS Pump Area on the 95' elevation of the Auxiliary Buildi This area contains six 30" cable trays along the east wall that enter through the floor, run horizontally and then rise again to exit through the ceiling. These trays are 16" apart with the lowest at 4' 8". Another run of three stacked trays,16" apart, extends from the east wall to west wall with the lowest of these trays at 7' 4" above the floor. Also, two instrument racks, each containing four service water pressure transmitters, are located in the center of the south end of the room and non-divisional trays are located along the west v5311. There are other small pieces of equipment within the room such as radiation monitors, however there are no components with a sufficient combustible loading to be considered credible pilot fires. Automatic sprinklers are present in the room, especiallyin the area of the cable trays. Eight fire scenarios were postulated and quantified for this fire area. Of those scenarios, the top three accoun'ed for 95% of the core damage frequencyin fire area AB-2 Zone 2. ~ These three scenarios are: Scenario 1 - A transient fire in the vicinity of a long run of Division 11 cable trays was postulated to disable RHR trains B and C, RCIC, and HPCS room cooling. Scenario 2 - A transient fire in the vicinity of a vertical Division 11 cable tray was postulated to disable RHR trains B and C, RCIC, and HPCS room cooling. Scenario 3 - A transient. fire in the vicinity of a vertical Division il cable tray was c postulated to disable RHR trains B and C and HPCS room cooling. ~ The functional sequences that contribute to the core damage frequency in fire area AB-2 Z 2 are: Functional Sequence Contribution to Area CDF TW 93% TUX 6% 1 The contribution due to loss of decay heat removal is primarily due to loss of HPCS and RHR B which coupled with an operator failure to start decay heat removal or an RHR train A failure causes core damage. Fire Area ET-1 i Fire Area ET-1 is the east electrical tunnel (B Tunnell between the auxiliary building and control building on the 67'6" elevation. This area is nanow and very long with a 20 ft ceiling. The ceiling, floors, and walls are all concrete. The room contains Division I and Division til conduits and cable trays and motor-operated valves 1 SWP'MOV506A and 1SWP'MOV077A. Offsite power cables also reside in this area. Automatic sprinklers are present in the room,. especially in the area of the cable trays. [G

- _ ~ _.... . - = -. i Reptrt Number SEA-95-001 R;visi:n ,g, Page _gz, of g i sO Eight fire scenarios were postulated and quantified for this fire area. Of those scenarios;. i the top three accounted for 93% of the core damage frequency in fire area ET-1. These 3 i three scenarios are: ' Scenario 1 - A transient fire located in the vicinity of a long run of conduit was postulated to disable the Division 1114.16 KV emergency AC power bus. Loss of the Division 111 bus causes a loss of HPCS and a loss of SSW pump 2C. l I Scenario 2 - A transient fire located in the vicinity of a run of conduit was postulated'to disable the HPCS pump. Scenario 3 - A transient fire located in the vicinity of a run of Division I cable trays and a Division 111 conduit was postulated to disable the Division i 4.16 KV emergency AC power bus, SSW pump 2C, offsite power to Division lil, and Service water flow to the Division lli emergency diesel generator. Loss of this equipment causes a loss of HPCS, RCIC, RHR train A, LPCS, SDC, and all other Division I and 111 equipment. i The functional sequences that contribute to the core damage frequency in fire area ET-1 are. i i Functional Sequence Contribution to Area CDF TUX 56 % ) TW 42% i S2UV 1% I i The contribution due to loss of all high pressure injection is primarily due to loss of HPCS [ and Standby Service Water Train A which coupled with an operator failure to start HVC/HVK train B causes a loss of switchgear room cooling and core damage. Fire Area AB 12-4 Fire Area AB-1, Zone 4 is in the open area of the auxiliary building on the 141 foot elevation. The area is bounded by a curved wall (the containment building) and three straight concrete walls. The area contains various electrical cabinets and vertical cable trays. Five fire scenarios were postulated in this fire area. These scenarios included evaluation I of cabinet fires in cabinets 1 EHS

• MCC2A,1 EHS
• MCC2C,1 EHS *MCC2L,1 EJS 'SWG2A and transformer 1EJS'X2A.

l The functional sequences that contribute to the core damage frequency in fire area AB-1 Z-4 are: l Functional Sequence Contribution to Area CDF j TW 82%

m _ i Reptrt Numbtr SEA-95-OO1 Pa0e .g. k Revisirri .21., of.113. Eight fire scenarios were postulated and quantified for this fire area. Of those scenarios,' ' the top three accounted for 93% of the core damage frequency in fire area ET-1. These three' scenarios are: Scenario 1 - A transient fire located in the vicinity of a long run of conduit was i postulated to disable the Division 111 4.16 KV emergency AC power bus. i Loss of the Division lit bus causes a loss of HPCS and a loss of SSW pump 2C. l Scenario 2 - A transient fire located in the vicinity of a run of conduit was postulated to i disable the HPCS pump. t Scenario 3 - A transient fire located in the vicinity of a run of Division I cable trays and e a Division 111 conduit was postulated to disable the Division i 4.16 KV emergency AC power bus, SSW pump 2C, offsite power to Division lit, and j Service water flow to the Division ill emergency diesel generator. Loss of this equipment causes a loss of HPCS, RCIC, RHR train A, LPCS, SDC, and i all other Division I and ill equipment. i The functional sequences that contribute to the core damage frequency in fire area ET-1 are: Functional Sequence Contribution to Area CDF . [ r TUX 56% f TW 42% S20V 1% The contribution due to loss of all high pressure injection is primarily due to loss of HPCS and Standby Servica Water Train A which coupled with an operator failure to start HVC/HVK train B causes a loss of switchgear room cooling and core damage. Fire Area AB 12-4 Fire Area AB-1, Zone 4 is in the open area of the auxiiiary building on the 141 foot elevation. The area is bounded by a curved wall (the containment building) and three i straight concrete walls. The area contains various electrical cabinets and vertical cable trays. Five fire scenarios were postulated in this fire area. These scenarios included evaluation i of cabinet fires in cabinets 1 EHS *MCC2A,1 EHS *MCC2C,1 EHS *MCC2L, I EJS 'SWG2A ' ( and transformer 1EJS*X2A. The functional sequences that contribute to the core damage frequency in fire area AB-1 i Z-4 are: Functional Sequence Contribution to Area CDF TW 82% l i f i

v. R: port Numbir SEA 95-OO1 Rzvisien A Page R of.151, ...'~. TUX 17% The contribution due to loss of decay heat removal is primarily due to loss of RHR train-A which coupled with a loss of RHR train B causes core damage. t i i T B ? l t ~l 1 i l

Repcrt Number ' SEA 95.OO1 RIvision .Q. Paga _91 of _L51 p FIGURE 4 Fire Area Map () dv k u il 7 x L o a 1 o e Y g. I I E C"! C3 1 c 8; i ! s EbCJ = -II ll

• i

~ c 8 i c-s c=2 o l I 1D o i g 1 Y a -1 L o o d

i Y'

'W q a o t O w I l l a L lE a h f .3 3 g f@-@ ',0 3 I ( ( fd I 'O I l _ 0 s. 3 i J 8 a E ~ ,j a g aI a l l ,e v. O I I 3 E j i j 5 i u l y 9 8-8 E '^ ~ s e -~ l3 "{ i f ', I* Ib 41 qh %; z ! Fr% E a j t c ge w a ? = r g -lr ' ff [ lg l c, 1\\1 ,a,',,s 3

l'g[

j(i@ ~ '- -tN., 4 :, - -- 9 e

g, t

k c 4 73 [ .f j i 3 E3'- ( =l iTT $ s E w m 'T I I hy L_ J (a i ~ y,u a- = r n 5 f 4 y a A p v th 80 be e edG O k s 3 } o 5! 2 b IC g r! ?I ? I c 111 1 IE 1

1 l i Reptrt Numb r SE A-9 5-OO1 ' J [. RIvision _Q, i P:ga _1QQ. of_119. FIGURE 4 Fire Area Map r) !'w) lY \\ u? u P 1 C b vW"" C C c==- = = = a C C ' d { s i f a W J I '-e-- g 1 1 3 O O _I "- U I .i g 2 C J 3 s s\\tN l WF F K.m hh e S_JI il&ll'i hh N n . MN t c IL4 e is i w Ig i n g g g e l ?

• 1 H L li s

i fin"j h

4 u !

a g i lm m-

a i ,-d I i s h 1 l$$ h ^l l l% d5 /A PA l _:-I ~ e i-p;

- q- !! ~

7["@v' T. n i ip? ~ e 5 t" l ) M 6 h ~ i g y, e

• )l d

i M El-09u0 l 11 g m ErlE = 0., _0& >I J P / al s = 2 l

,,* g r

w m 8 "I f5 Li _1 i j ~ O ce..t i t pl \\ \\ .1. a n g d d I 5 5 g _g c a on a I L "_E e 4 c @ 0 0 00be O I i I

Report Number S E A-35-001 Revisi n A Pag 3 m of g FIGURE 4 Fire Area Map [ -- I o-If 11 LO! ~ 'O! 7 8 v 8 f w @@ O !e; g!N ~ IIIII l I i s ) i e;- qs u e EEi 8 # ! 6 es L__ 1 xsam-g p + g f 87.? E._ i D O _ y+' p .I _4 5 9. Z v3 '*i; = m gc--u g 1 6 1 1 S$T T @OO ii O s . ! S EN ~ T Nld ~" e{ 'I a n.:77.c o n I a N 1 s.y sc : gg ge e k I s.ru: =c + n i gP 7 L /J uT A ? i RI O' ' N E = 80 ? YE V 1e fit u., e o6 -I j;j 7 t + v a v v e m /- , = hD. JPl 3 d ] 9 3 E l 8C [ d $ jh a 2 - j idp@ ^ ad L O nia, si' in . ceeee q w n k

Report Number SEA.95 001 R;visi:n 1 'Pags g of_1]lijl FIGURE 4 Fire Area Map .. ( s %) -(he. 1 ~+s 0 W' C2 p" tr+ 9 g g L :: ,r) O ._ 4 c-l f l y 3 7 v6 g l vrs t J l J 3 st $ @ @/G ,a E 1-(m eL R,' .s 4 ,.v-r, i =i f i E

e y c

l e

si-

,mns g CA y ;i = ILu eno e g vp wqs 3y p s e y, e At

• j

' Q y' 6 6 Ec, j; a d T1 e [0M A JE 9 s n p' g x 11 l w i Si x a s a e q g { v 3 O a e e eeee wmT. / M. oo 5 ~f g e-1g

Reptrt Numb:r ' SEA-95-001 R; vision _Q. Paga _191. Of L'il., FIGURE 4 Fire Area Map ~ ~, G 5,3 ,4 1 ) I. A ..9') f b,4y \\ / 6<./. - y i ..s g o 5 k l-.

x..

,. 3; s 5- " " '\\ eh / N i O ae h k Ed 83 \\ t[ uIi, agr 5* e!sa E i 3 k t s i 3 1+ 1 is.. Ik hi ggd E 7 f n P a 1 a 1 I L I

lI ,jj 5$3 2hi,* mygW yg. if3 yg o. /, ETA A AP T C CS O S O ORB L L S 3 D FF E S t E N KKKTTrKEDDKrKDKKKDKKKDDD RRRR I I I I E OOOCCOOOCCOOOCOOOCOOOCCCFFFF j 7T77 1 23 4 5eT8991 23 4 6 s7 01 3 4 5 8 7 8 sa22n22 Q 1 1 1 1 1 1 i 1 i 2222 S S rtnl C .euwo D nhoo S i' i' ASDC A A E S RC D S ,i 1l ,i l yl HD O 2 RS M W A Se S t S Da 2 AL X A e S RMd mo S A M W B A WE S STOI S C 4 STP V X L ] A s. .t 8 wstoc 8 oeoe 3 LYCj> V F h s A A sey S wsra S oeorp 2 LrC P S V A S 8 D 8 1 A X A l S ceto aroo 2S eo s RCtC U r y se a a t hsr geor t p irC HP S U I stn oVae 2 M wR p P T I F TS O TN E Vsn V 1 wRim P E la OSF4 ARP iv2 e s &D i' K sD G S of E F Lo1 I' r P e .e O nffw O oofOo L L P e ya t nr H AF F mp mm Qm d$m gC3 fS I Ill

I ilfi if l ,$$ {gR $?8 8. , $E,3 h yE* g O ET A T S F D KKT KKDDKKDKKDKKDDD N E OOC OOCCOOCOOCOOCCC 1 2 3 5 6 7 8G 0 1 2 3 4 5 6 7 8 9 1 1 1 1 1 1 1 1 1 1 Q ES nl C .rtuwo D thoo S i' e lSDC A A r. A s o s S te 3 c r r ap EI e e RD A RCe d 5 IPo 3 RSM W 1 sob A Wst 3 So I 8 O SreC 4 CiP V T L .t A snt wsac 33 oe lo e j 3 Lron V PCi A A sey S w sra C )V eor 3 O orc p Z LR LP S Y lS lan me Sp r s A O o s 3 t e B d cop ek r t I c c e e RD u u t dins r ng A e o eoi S en i n trtl S F (O r coao E i aeCloo U R isC A . j hs ea S gs S err Hr oo R PCS U A d C elA O ec oC L rumO 3 id F SL R b tr O qEMHhh@ m OzN M hO9k (nk* NO - ,1ll I If l lflf IllI l l ll)l lll l1

,I. 7 % y;s~ r yE

• b

-) 'cv ETA TS D F F F K T K K T K K oK K D K K T D D NE O C O O C O O c O O C O O C C C 1 2 3 4 5 o 2. g 0 1 2 3 4 5 6 1 1 1 1 1 1 1 Q ES a C ,I Y% D ,I S "J A s A S e ** ,I S B 1 W A

• g SS Ew 4

O V A S S d.g 2 V A SS n* A at 3V g ASS 3-w CB Et 3V = A i"f S S l =r 1 l X f A S T,g S 1 'n. U A d C nm O L I o R _. 2 I. F._ oU )gghbB g g$" m @a O'l M O @ g sg

~ %d FK One Two Mgh Reac. ADS Low Low SSW RW ADS R$ AMar CAUSE SPV SHVs Ress. Core Rese. Press. X-TE E Late H]C Shut LO!P Fats Fait Cere anot Core Coot TO Mads H00E Down Open Open 5 roy Coot Sprg Inpct. LPQ B Coot 9 FImamer ra n stema samma utsaa vassa v3eum vossa wasma massa waama asuc suit i me-sTAM 1 OK 2 OK N 3 OK 4 CTF S CTF H 6 OK H 7 OK 8 OK g 9 CD Ng 10 CD N 11 OK hh 12 OK Rg 13 OK 14 CD h 15 OK 16 OK 17 OK y g 'n ${f 18 CD 19 OK 5~ 2 20 OK [ 21 OK h M 22 CD -I 23 CD a m 24 CD O f 25 T FIRILOCA 26 T FIRSLOCA E g FE NTIATED LOSP PRA EVENT TREE I m =w O O C' FIRE ONE TWO HIGH IEACT. INITIATED SRV SRVS PRESS. CORE 580 FALS FAL CORE ISCL TRANSFER OPEN OPEN SPRAY COOL. FIRESBO P1 P2 U1SSA UESSA-ST SEQ #- END-STATE 1 CTF 2 CD 5 5 3 CD E m yl 4 CTF hhh 5 CD sn 6 CTF g o 7 CD IE8

• g:3 h

8 CD 'E 3 5 s ? FIRE INITIATED STATION BLACKOUT 3-o EVENT TREE 8 m u a-m s ___m___.,m 4 m. -e.w.. w, e c.m.w-.- w- ,7-- .-w-, y _._p._..g_s -.3.,.g %.-n.rm_._._,.isp,.._ .,7., 4,-, +

Figure 4-11 .p Progressive Screening Analysis Flowchart Report Number SE A-95.OO1 Tatde 4-5: AM Revision ,D., Plant Fire Areas Page 1Q3_ of,,151, Screen 1 i Thtde 44 ofSSA equipmer* 7 Wak down No Screen 2 Is the fire area in N containment 7 Thtdo 47 NO Screen 3 Is CDF4 E.06 i all equipment in

• Thtde 44 i

area failed 7 NO u n Screened fium To Detailed Screening Analysis funher analysis

I Figure 4-12 n/ Detailed Screening Analysis Flowchart i 9 Report Number SE A.95-OO1 Fire Areas from Revision .Q,, i Page 110 of 1.,5.L Screeninia Analysis 1 Screen 4 Recalculate CCDP based on Fire Modellrgi results 1 is fire area vas CDF < 1 E.06 7 N" l t j ...........N..o........................................................... Recnicusaw ignition Screen 5 Frequencies for ) Scenarios within fire area Is fire area ves CDF < 1 E-06 7 Table 4-10 j .......... N. o.......................................................... Screen 6 i j Can m Wkh Feedwater yes pexcluded Romng Feedwater ' is CDF Table 4-11 yes --+ 4y 7 area 7 NO NO l = U ,P Screened from Table 4-12: Unscmed further analysis Fire Areas j l

Report Number SE A-95-OO1 Revision g Page 111 of g r s- 'lQ,)) - [- 6 ?Q E Esaeassseeass8885se8sss8e

• • • IEIE$$ID23$yQggg E

. S6 =< W mu m k O kb$ o g Q m =e RHd e e MG z e 'E E zw WE 5 l MCR FIRE EVENT TREE FIGURE 4-13

O O O TABLE 4-1 Gera== Critorie for Fire PRA Event Tree Residual Emergency RCS Overpressure Weisser peector Core Coetag ~ Heat Removal

a. -

prosecgen HPCS 1 of 2 RHR & Htx RPS SRVs Open and Close (SDC, SPC or ASDC) FIRE g g RCIC BDd ARI associated SSW g m DEP w/3 valves and (See Note (c) and (dll Manual Rods LPCS and RPT M E DEP wl3 valves and Timely SLC 1 of 3 LPCI and RPT M (See Note (all DEP w/3 valves and SSW X-tie ISee Note (bil i it is assumed that reactor scram is successful for a fire initiated event based on probatn s Success criteria based on R8S USAR, NEDO-24708A. and MAAP calculations. Note: (al 240.201 A. Success of ASDC based on RBS Safe Shutdown Analysis. Criterion jyy (b) (c) SSW operation is needed for the operating RHR heat exchanger.

• ER (d)

S2 3 k 3 "b P e 8

l l i i 7 4 i! L

• 2cgat $ $ "'

2yd*O3 IT o yi n .y y tnb b l i at d f cn e x ( t e HC Wd e t i f t ) ns t D Sn nm a i r e us &S Sa gn e ) sa n ii e e mnd RA d e (c nt e d gneo Hr nt son g i e s girapt Roaaie y ic m t s o o o Ve a ner 2C ct t i e i ovP P sN n Rh t e f CO oS s o St s n t ae y f 1 e b eo b ( o h S r t n t n ( p o n w t n .ui e t osAoa m z dn1 ni m eio0ou a r l a a 2. or s t l st s n n,u t e bu0be o l v s e n ( c4f r c e e r n e e t e 2op w sd St nla r e gin $ u eC So e cns e h T .e s e t a V N v osv g t s ePioo n f Arl o a t s e e nes e t a m e l v evP e deAiai n t E CO S a t o aMCtrhn t id I e t i A id ., t ae t s zr n n i e. o C io ias p r w O e yi u c ~ r .l .d sg L AaVn s i f n 5 d d d 8n Ra ei a n n n a 0A Sp pw r na a a a r7 u r o ^ l i o n nt el @W* f 4 s sI s eb S e eC ei( 2 wee vlo 2 opes.of l v vP vt e d u dohVed 4e O S S C L l l a a aXt f l n s C gICgvCEv3mv3WN eEhclrSl o t t sDuk yRt e Ee as P P i a LBn e' H R 3L 3f / / o / Se cNSua h t en nle t c AI a w w1 wSe s e ee s u .e t S sRfAahnpvr Te C' P P P o es n ( s Sie t i E E E r iS r w v k ple F D D D ec b mUS Bnptuoi r r t s o aS Re s e n rcS vo f sRnet et e l e l ad i d o ehr n r n et t e o r ( e o odveiarhpc e d t t n 6*? d C n cdscego-s a a eaeput n C dh oT LT e sbf ooso E RP S P )a a f r

1. [

r un = bCethmy S e ElyR( I R t = st f P gR gl a R A ud eds haDsu b = i Cmdsemo e t e f iS

R n n mnt r

r c~ a a a o dea L s i Sma e t M T N ei t t d rf mco ee sa d .Q / e eye l [? ( e u s=sts e r sh g s s= y S s e=msmey ~ ( p. A a cc u sa sa ec iuesiehe sc sh V@!D t SCATsTd t I (I ( w A abcde ) l ) ) ) ) I f gj7g C ( t ( ( ( ( O L e S t R oN IF i 1 4 l i

1 TABLE 4-3 Success Criteria for Fire Initiated Intersnediate LOCA Event Tree initieter Re#Clet Esposgency Eas;y : Late-Cote CoeEng Containweent Containment ~ vue(doel Supos Overposeus, overwoesure pyogeggen Protection '4 % f(" g - - RPS HPCS VSS 1 of 2 RHR & Htx FIRILOCA (See Note (ell (SPC or ASDC)- g g and DEP w/3 valves and ARI associated SSW LPCS g ISee Notes (c) and (til Manuel Rods g and RPT DEP w/3 valves and 1 of 3 LPCI g Timely SLC g and RPT DEP w/3 valves and ISee Notes (a) and (dll SSW X-tie ISee Note (bil i It is assumed that reactor scram is successful for a fire initiated event based on probatulity. Success criteria based on RSS USAR, NEDO-24708A, and MAAP calculations. Note: (a) Success of ASOC based on RBS Safe Shutdown Analysis, Criterion 240.201 A. (b) ,33 Assumes SLC is effective even with stuck open SRV i.e., that loss of boron out the SRV is in y E.8 (c) j 63 This system must operate to prevent early heatup and potential overpressurization of the conta "F' id) (e) steam released through the stuck open SRVs. 3 These systems must operate to prevent late overpressurization of the containment by steam gene (f) decay heat or by non-condensibles released foNowing core damage. y 6 3

c [ ,fg3 p$e gP$8. ,yga b ,3" ' g l l d-x ( Wd t I l .l hcl S n-av D (a S )a a o l Se d e (c um rat d o de HrNaa nt s isR Ro ie et ct Ra 2Ce o o e P S sN e f H oS[ s ( a e e 1 S ( .A d d d 1 n n n 0 r a e 2 a l l a l l e a w 0 l e l s sIe C (a e g s a e i (. o 4 r yn e ( vPe vte p 2 T cA v Se l Lt aXt l ne S C a l t a oMv o e t n CgCEvCogv3 N 3WN t eo I o n gC P PN s i v e e H R 3L 3f i e r / e /oe /Se n r E ms w e w1 e wSe o ore t a S S S g i y r t E P ( c Cn P C P I [ E E E n ,a a a D D D e sh g ic M sx re ye l m at e e na Ae n s r h o a o o n R w C eewH l r ise s t wor 4t en d is od S eo n f pt 4 wlo a f d gc o u en ehi Ea i re e -p r t eiSta Le w o s hs er Bn Qr O f e i t Ah S ~P eoap f f i T. s So ~ C V n f f e R R ooSe h S nnSt r iF ooRr i i t t o r aa nf o H r r o ~ f b oo d de ( t t e d ssed ir s n ees e e d C a r r a e l i a o LT nnbn s c R S P )a ooCs a r C oi R( pp S y I t e i e a l s uuD cl P gR ml = nc R A u ede Sno = eb n mnt yyAi l l = Hu a ao nn t i a S M T N oof e or = e ee spe c e l l S bbso aae I aacW dd c vvuS AASS ~ ) ) ) ~ )a b (c d 0 ( ( ( ro 8 ta S e E t it R o in N I i F l;l l

R1 port Numbtr S E A-95-OO 1 Rsvision .Q. Page 116 of,,,1,fd, O TABt.E 4 Descdpdan and Ignition Frequency For AE Fire Areas FIRE AREAL DESCRIPTION E IGNITION : t FREQUENCY [lYRI' 4.18E-03 A-01 Aux Boiler Treatment 8.38E 04 i A 02 Aux Boiler Treatment 1.46E-03 A-03 Aux Boiler Treatment AB-1/Z-1 Auxiliary Building: West Side Crescent Area 2.77E-03 8.70E-04 AB-1/Z-2 Aur!!iary Building: West Side Crescent Area 7.50E-03 AB-1/Z-3 Auxiliary Building:We.t Side Crescent Area 6.97E-03 AB-1/Z-4 Auxiliary Building: West Side Crescent Area 2.98E-03 AB 2/Z-1 HPCS & HPCS Hatch Area 1.95E-03 A B-2/Z-2 HPCS & HPCS Hatch Area 8.10E-04 AB-3 Auxiliary Building:RHR-B (All Elevations) 2.77E-03 AB-4/Z-1 RHR-C & RCIC & RWCU Pump Area O 1.36E-03 AB-4/Z 2 RHR-C & RCIC & RWCU Pump Area 1.30E-03 AB-5 Auxiliary Building:RHR A (All Elevations) 2.73E-03 AB-6/Z-1 LPCS & LPCS Hatch Area 1.23E-03 AB-6/Z 2 LPCS & LPCS Hatch Area 2.02E-03 AB-7 D-Tunnel (El. 70') 2.83E-04 AB-10 Main Steam Tunnel South End (All Elevations) 3.85E-04 AB-13 Standby Gas Treatment B (El.141') 7.09E-04 AB-14 Auxiliary Building: Standby Gas Treatment A 8.06E-04 AB-15/Z-1 East Side / Auxiliary Building: Crescent Area 3.39E-04 AB-15/Z 2 East Side / Auxiliary Building: Crescent Area i 5.12E-03 AB-15/Z 3 East Side / Auxiliary Building: Crescent Area 1.12E-02 AB-15/Z-4 East Side / Auxiliary Building: Crescent Area 1.32E-03 AB-16 Annulus Mixing Area (El.171') 1.37E-03 AB-17 Containment Vent Filter Train Room 3.31 E-04 AB-18 D-Tunnel Cable Chase (El. 70') 7.16E-04 AX-01 Hot Machine Shop 5.58E-03 AX-02 [ Aux Control Room

Rtport Numbir SE A 95-OO1_ Revision .Q. Page 117 of_llS_ TABLE 4-5 + m r -- d . and Ignition Frequency For AE Fire Areas - FIRE AREA 1 DESCRIPTION : IGNITION: FREQUENCY [/YRI AX-03 T Tunnel West End 2.83E-04 C1A Cable Chase 1 4.04 E-04 ) C-1B Cable Chase i 3.52E-04 C-1 C Cable Chase i 3.40E-04 4.16E-04 l C 2A Cable Chase 11 l 3.54E-04 j C-2B Cable Chase il C 2C Cable Chase il 3.56E-04 C-3 Room North of ACU Rooms 3.43E-04 5.05E-04 C-4 ACU West Room C-5 Cable Area South of ACU Rooms 3.60E-04 C-6 Elevation 70' General Area 6.89E-04 C-7 Post Accident Rad Monitor Room 3.33E-04 3.89E-04 C-9A Cable Chare til 3.51 E-04 i C-98 Cable Chase ill C-9C Cable Chase til 3.56E-04 f C 10A/Z-1 Cable Chase IV 3.96E-04 3.44E-04 C-10A/Z-2 Cable Chase IV 3.54E-04 C-10B Cable Chase IV 3.69E-04 C-10C Cable Chase IV C-11 Vestibute NW Corner El. 70' 3.21 E-04 C-13 HVK Chiller Room (West Side El. 98') 6.72 E-04 1.41 E-03 C 14 Division 11 Standby Switchgear Room 1.42E-03 C-15 Division i Standby Switchgear Room 8.54E-04 C 16 Remote Shutdown Room C-17 Control Building Ventilation Room (El.116') 1.04 E-03 8.16E-04 C-18 ENB A Battery Room 8.16E-04 C-19 ENB B Battery Room 8.16E-04 C-20 HPCS Battery Room

R'. port Numbir S E A-95-OO1 Revision Q. Pege l.1.B of_ Mil. O6 V TABLE 4 Descdpdon and Ignition Frequency For AE Fire Areas FIRE AREA.. DESCRIPTION ' IGNITION ? FREQUENCYUYRIf C-21 HPCS Charger Room 6.83E-04 C-22 HPCS Switchgear Room 1.43E-03 C-23 ENB B INV/ Charger Room 9.25E-04 C 24 Control Building General Area 2.42E-03 C-25 Ccat.al Room 5.03E-03 C-26 ENB A INV/ Charger Room 9.25 E-04 C-27 East Pipe Chase 3.35 E-04 C-29 North West Vestibule 5.25E-04 C-30 Stairwell #1 2.83E-04 CT-01 Normal Cooling Towers 3.10E-03 CT-02 Normal Cooling Tower Switchgear 2.23E-03 CT-03 Service Water Cooling Switchgear House 1.87E-03 DG 1 Division 11 Diesel Generator Fuel Storage Tank 2.83E-04 DG-2 Division Ill Diesel Generator Fuel Storage Tank 2.83E-04 DG-3 Division i Diesel Generator Fuel Storage Tank 2.83E-04 DG 4/Z-1 Division 11 Diesel Generator Room 1.64E-02 DG-4/Z-2 Division 11 Diesel Generator Room 1.33E-02 DG 5/Z-1 Division ill Diesel Generator Room 1.64 E-02 DG 5/Z 2 Division 111 Diesel Generator Room 1.33 E-02 DG 6/Z-1 Division I Diesel Generator Room 1.64E-02 DG-6/Z-2 Division I Diesel Generator Room 1.33E-02 ET 1 B-Tunnel East 1.04 E-03 ET-2 B-Tunnel West 4.66E-04 ET-3 T-Tunnel West End 3.69E-04 ET 4 T-Tunnel West End 3.60E-04 ET 5 B-Tunnel South Cable Chase 3.40E-04 ET-6 C-Tunnel 2.42E-03 FB-1/Z-1 1SFC'P1 A Room, All Other Areas of Fuel Building 6.90E-03

Riport Numbcr SEA 95-OO1 Revision ,Q, Page 119 of _13,2, ~~ TAat.E 4-5 Doocription and lordtion Frequency For AE Fire Areas FIRE AREA - DESCRIPTION ' IGNITION' FREQUENCY (/YRI FB-1/Z-2 1SFC*P1 A Room, All Other Areas of Fuel Building 3.67E 03 FB-1/Z-3 1SFC*P1 A Room, All Other Areas of Fuel Building 2.07E-03 FB-1/Z-4 1SFC*P1 A Room, All Other Areas of Fuel Building 3.78E-03 FB-2/Z-1 SFC Cooling Pump B and HX B Room 7.73E-04 FB-2/Z 2 SFC Cooling Pump B and HX B Room 2.83E-04 FB-3 HVF Filter Train A Room 4.35E-04 FB-4 HVF Filter Train B Room 4.35 E-04 FP-01 Diesel Fire Pump 9.88E-03 FP-02 Motor Driven Fire Pump 6.68E-03 FP-03 Fire Pumphouse 1.04E 02 FP 04 Fire Pumphouse 5.88E-03 IS-01 Intake Structure 6.25E-03 IS-02 Intake Structure 2.81 E-03 MG-1 LFMG Building 6.52E-03 NS-01 Normal Switchgear 7.47E-04 NS-02 Normal Switchgear 1.99E-03 NS-03 Normal Switchgear 1.80E-03 NS 04 Normal Switchgear 1.49 E-03 NS-05 Normal Switchgear 8.16E-04 NS-06 Normal Switchgear 8.16E-04 1.75E-03 l NS-07 Normal Switchgear NS-08 Normal Switchgear 8.16E-04 NS-09 Normal Switchgear 1.99E-03 NS-10 Normal Switchgear 2.83E-04 PH-01/Z-1 Standby Cooling Tower Division i Side 6.04E-03 PH-01/Z-2 Standby Cooling Tower Division i Side 2.87E-03 PH-02/Z-1 Standby Cooling Tower Division 11 Side 6.04E-03 PH-02/Z-2 Standby Cooling Tower Division ll Side 2.87E-03 I

Rtport Numbu SE A-95-OO 1_ R;visicn _Q,, Page ,,,1,,22, of,,152. O TABt.E 4-5

Ci::-b '-, and ignhlon Frequency For AE Fire Areas ~

FIRE AREA DESCRIPTIONS IGNITION : FREQUENCY (/YRI' N/A PH-03 Standby Cooling Tower N/A PH-04 Standby Cooling Tower N/A PH-05 Standby Cooling Tower 6.30E-04 PT 1 E, F, & G Tunnels 2 83E-04 PT-2 E-Tunnel (SWP/CCP Areal 1.11 E-03 RB-1/Z-1 Radwaste Area 2.48E-03 RB-1/Z-2 Radwaste Area 7.33E-04 RB-1/Z-3 Radwaste Area l 1.94E-03 RB-1/Z-4 Radwaste Area l 5.86E-04 RB-1/Z-5 Radwaste Area 5.74E-04 RB-1/Z 6 Radwaste Area 7.73E-04 (/ RC-1 Reactor Building 2.83E-04 RC-2/Z 1 Reactor Building 2.83E-04 RC 2/Z-2 Reactor Building 2.87E-03 RC 3/Z-3 Reacter Building 4.39E-03 RC 3/Z-4 Reactor Building 2.83E-04 RC-4/Z-5 Reactor Building 2.62E-03 RC-4/Z 6 Reactor Building 2.97 E-03 RC-4/Z 7 Reactor Building 1.26E-03 RC-5/Z-9 Reactor Building 2.83 E-04 RC-5/Z 10 Reactor Building 2.83 E-04 RC-5/Z-11 Reactor Building 1.55EO-3 RC 5/Z 12 Reactor Building 1.33E-03 RC-5/Z 13 Reactor Building 7.73 E-04 RC-5/Z-14 Reactor Building 2.83E 04 RC-5/Z-15 Reactor Building 1.02E-03 RC-6 Reactor Building N/A RDW 1 Drywell

Rsport Numbsr S E A-95-OO1 Revision ,,g, Page 121 of M O V TABLE 4-5 e+ Descriptkm and ign.%m Frequency For AE' Fire Areas FIRE AREA? DESCRIPTION : IGNITION '- FREQUENCYUYRI-T-01 Turbine Oil Storage Room 8.23E-03 T-02/Z-1 Turbine Building 8.62E-03 T-02/Z-2 Turbine Building 8.88E-03 T-02/Z-3 Turbine Building 4.31 E-04 T-02/Z-4 Tu bi..e Building 1.64E-03 T-02/Z-5 Turbine Building 4.83E-04 T-02/Z-6 Turbine Building 5.05E-04 T-03/Z-7 Turbine Building 3.50E-03 T-03/Z-8 Turbine Building 4.3 8 E-0 ** T-03/Z-9 Turbine Building 2.83 E-04 i ) T-03/Z-10 Turbine Building 2.83E-04 T-03/Z 11 Turbine Building 7.82 E-04 T-03/Z-13 Turbine Building 4.12 E-03 T-03/Z-14 Turbine Building 7.59E-04 T-04 Turbine Building 5.48E-03 T-05/Z-14 Turbine Building 1.69E-03 T-05/Z-15 Turbine Building 4.51 E-03 T-05/Z 16 Turbine Building 4.50E-04 T-05/Z-17 Turbine Building 2.83 E-04 T-05/Z-18 Turbine Building 2.83E-04 T-05/Z-19 Turbine Building 4.39E-04 T-05/Z-20 Turbine Building 2.83E-04 T-05/Z 21 Turbine Building 1.08E-02 T-06 Turbine Building Fire Protection Room 2.83E-04 O

R port Number SE A 95-OO1 Revision A Page 122 of _l.H. O TABLE 4-6 : Screen 1: Fire' Areas Whh No SSA Equipment FIRE AREA'. DESCRIPTION ' A-01 Aux Boiler Treatment A-02 Aux Boiler Treatment A-03 Aux Boiler Treatment AX-01 Hot Machine Shop AX 02 Aux Control Room AX-03 T Tunnel West End CT-01 Normal Cooling Towers CT-02 Normal Cooling Tower Switchgear CT-03 Service Water Cooling Switchgear House ET-6 C Tunnel FB-1/Z-4 1SFC*P1 A Room, All Other Areas of Fuel Building Q FP-01 Diesel Fire Pump FP-02 Motor Driven Fire Pump FP-03 Fire Pumphouse FP-04 Fire Pumphouse IS-01 Intake Structure IS-02 Intake Structure MG1 LFMG Building NS-01 Normal Switchgear NS-02 Normal Switchgear N S-03 Normal Switchgear NS-04 Normal Switchgear NS-05 Normal Switchgear N S-06 Normal Switchgear NS-07 Normal Switchgear NS-08 Normal Switchgear NS-09 Normal Switchgear NS-10 Normal Switchgear

R:ptrt Numbtr S E A-95-OO1 Revision .Q. Page ,122, of M O

TABLE 4-6 c Screen 1: Fire Areas Whh No SSA Equipment

? FIRE AREA $ 3 DESCRhPTIOfbi PH-03 Standby Cooling Tower Standby Cooling Tower PH-04 Standby Cooling Tower PH-05 Radwaste Area RB-1/Z-1 Radwaste Area RB-1/Z-2 Radwaste Area RB-1/Z-3 Radwaste Area RB-1/Z-4 Radwaste Area RB-1/Z-5 Radwaste Area RB-1/2-6 Turbine Oil Storage Room T-01 Turbine Building T-02/Z 1 Turbine Building T-02/Z-2 Turbine Building T-02/Z 3 Turbine Building T-02/Z-4 Turbine Building T-02/Z-5 Turbine Building T 02/Z-6 Turbine Building T-03/Z-7 Turbine Building T-03/Z-8 Turbine Building T-03/Z-9 Turbine Building T-03/Z-10 Turbine Building T-03/Z-11 Turbine Building T 03/213 Turbine Building T-03/Z 14 J Turbine Building T-04 Turbine Building T-05/Z-14 Turbine Building T-05/Z 15 Turbine Building T-05/Z-16 Turbine Building T-05/Z-17 T-05/2-1 B Turbine Building

RIport Nurnbir SEA 95-OO1 R* vision .Q,, Page 124 of M O ~ TABLE 4-6 ? Screen 1: Fire Areas WHh No SSA Equipment ' FIRN ARE i ' ' DESCRIPTIONi T-05/Z-19 Turbine Building T-05/Z 20 Turbine Building T-05/Z-21 Turbine Building T-06 Turbine Building Fire Protection Room O l

l s ' Repcrt Number SEA-95-OO1 g _D., l Revisien Page 12L of _1.5.2 2 i ~ TABLE 4 Screen 2: Fire Areas in Containment ) 2*N(MRg AREA' 54;, ? RC-1 ' RC-2/Z-1 i RC-2/Z-2 j RC-3/Z-3 i RC-3/Z-4 RC-4/Z 5 RC-4/Z-6 RC-4/Z-7 - RC-5/Z-9 RC-5/Z-10 RC-5/Z-11 RC-5/Z-12 RC-5/Z-13 RC-5/Z-14 RC-5/Z-15 1 RC-6 RDW-1 i O

i i ) Reptrt Numb 2r S E A-95-001 Revision _Q, Page _120. of _119 O TABLE 4-8 i 4 Screen 3: CDF < 1 x 10 /yr Assuming All Equipment in Area is Fire Damaged es - @ e m [FIREARUDEi a I ' IlO j 4 AB-10 AB-13 AB-16 i AB-17 AB 18 C-3 C-29 C-30 ET-3 O l ET-4 i ET-5 FB-2/Z-1 FB 2/Z-2 FB-3 FB-4 PT-2 O

l Report Number SE A-95-OOT Revision _Q j- ~ Page _1.22. of 119_ TABLE 4-9 1 Screen 4: CDF < 1 x 10-6/yr Equipnent Damage Determined by Fire Modelling ,j;FIms? AREA % M AB-6/Z-2 AB-15/Z-2 C-1B C-1C C-5 C-11 C-27 ET-2 4 O i t

Reput Number SEA?"-0^1 Revision _Q, Page g, of _152. g -() i TABLE 4-10 Screen 5: CDF.< 1 x 10^*/yr Ignition Frequencies Calculated on Scenario Basis EMRE AREA 7b 2 AB-1/Z-1 i AB-1/Z-2 AB-1/Z-3 AB-3 4 AB-4/Z-1 AB-4/Z-2 AB-5 i AB 6/Z-1 AB 7 AB-14 1 AB 15/Z-1 AB-15/Z-3 AB-15/Z-4 C-1 A C-2A C-6 C7 C-9A C-98 C-9C C-10A/Z-1 j C-10A/Z 2 C-10C C-14 C-16 C-24 i

..~.. i R: pert Numbtr SE A-95-001 Revision _Q. Page _12.2. of _15.2, TABLE 4-10 1 1 Screen 5: CDF < 1 x 10 /yr 4 Ignition Frequencies Calculated on Scenario Basis b w/.:',

f. I

FB-1/Z-1 i FB-1/Z-2 FB-1/Z-3 PT-1 1 O i i O

Rep;rt Number SE A-95-OO1 Revision J., Page M of _15jl., TABLE 4-11 Screen 6: CDF < 1 x 10'/yr Feedwater Recovered Where Cables Can Be Excluded ^lN55'INE$t! ' s a j, AB-2/Z-1 C-13 C-18 C-19 C-20 C-21 C-22 C-23 C-26 ~ \\ DG-1 DG-2 DG-3 DG-5/Z-1 DG-5/Z-2 PH-01/Z-1 PH-01/Z 2 PH-02/Z-1 PH-02/Z-2 4 O

c Reptrt Number SE A 95-OO1 Revision 3,, - Page ,13j,, of lli,, O O TABLE 4-12 Unscreened Fire Areas ' %l 'un 'i?FiRWAREA5p ' AB-1/Z-4 AB-2/Z-2 C-2B C-2C C-4 C-10B C-15 C-17 C-25 DG-4/Z-1 DG-4/Z-2 DG-6/Z-1 DG-6/Z-2 ET-1 ) I

i Repert Numbtf. SE A 95-OO1_ Revision g_ PaQe l.22. of 15.2. O TABLE 4-13 Important Fire Areas . FIRE AREAS IDESCRIPTIOf6# ' CDF I/YRii C-25 Control Room 4.87E-06 C-15 Division 1 Standby Switchgear Room 4.75 E-06 C-17 Control Room Ventilation Room (EL.116') 4.56 E-06 C-4 ACU West Room 3.31 E-06 AB-2/Z-2 HPCS & HPCS Hatch Area 2.23E-06 ET-1 B-Tunnel East 1.48E-06 AB-1/Z-4 Auxiliary Building: West Side Cresent Area 1.26E-06 ' O ~

) f ( i e 4 TABLE 4-14 Success Criteria for MCR Evacuation Fire PRA Event Tree 3 SM *A W:dh ?W k

• ?

.MiO<::; y vd?%gd$fh!-w; Iu. eseector f}ig..$% ?RC'S Overpse"oure w& ^ sw Emergency 9 w p f *;fRealdu'*al AG$ ?3 5&l f ggf;QT;g lbgtitWY S:V^ - ^++ t g Inideter y s ~1 $5sr %Q@4Mift1 $XS$ubceldoelyd', s,i d s Prosecdon @. ~ C M N Heat Resnovel v - i;CoreFcoegng FIRE RPS SRVs Open and Close HPCS 1 of 2 RHR & Htx g g (SDC, SPC or ASDC) ARI RCIC pad g g associated SSW l Manual Rods DEP' w/3 valves and ISee Note (c) and (dll and RPT LPCS g E Timely SLC DEP w/3 valves and and RPT 1 of 3 LPCI [See Note (all g DEP w/3 valves and SSW X-tie j (See Note (b)] - i i Note: (a) It is assumed that reactor scram is successful for a fire initiated event based on probability. (b) Success criteria based on RBS USAR,' NEDO-24708A, and MAAP calculations. mmm (c) Success of ASDC based on RBS Safe Shutdown Analysis, Critation 240.201 A. E !.j (d) SSW operation is needed for the operating RHR heat exchanger. yj C 3 I DEP = Depressurization cr t m E4 m-e ?~ O 8 .r, f

Rep::rt Nurnber SEA-95-OO1 Revision _Q_ Page 134 of_15) 5.0 HIGH WINDS, FLOODS, AND OTHERS Other External Events are external events other than seismic, internal fire, or internal flooding events that may be initiators of accident sequences leading to core damage. Such phenomena are potentially important because they may affect multiple components. An accident involving a number of different component failures may be nearly incredible in the absence of some externalinfluence, but may be made possible or even likely by the occurrence of a tornado, for instance. As recommended in Generic Letter 88 20, Supplement 4,[21, the methodology employed for analyzing other extemal events at River Bend Station (RBS)is a screening approach. The first step in the screening approach was to determine if the criteria of the 1975 Standard Review Plan (SRP) [27] are met. In general, the information contained in the Updated Safety Analysis Report 128) was reviewed to determine its present applicability, and hardware and procedural changes were reviewed to determine any resultant significant vulnerabilities. This information was used to judge whether RBS presently meets the criteria contained in the 1975 SRP. If the criteria in the 1975 SRP are not met, a second step in the screening approach would be employed. This second step involves the use of probabilistic analyses to determine the impact on risk. 5.1 High Winds This section examines potential severe wind events that might initiate an accident O' sequence leading to core damage. Potential severe wind sources include strong winds, V tomadoes, and hurricanes. 5.1.1 Original Design Casis All seismic category I structures exposed to wind forces were designed to withstand 100 mph winds (USAR, Section 3.3). Additionally, all seismic category I structures were designed to withstand a design basis tornado of 290 mph tangential velocity and 70 mph translational velocity with a maximum pressure drop of 3.0 psi at a maximum rate of 2.0 psi /second (USAR, Section 3.3). The USAR provides a listing of the plant components and their respective tornado classification. All components necessary for safe shutdown of the rjant were designed to withstand a design basis tornado.

5. '1.2 Changes to Design Basis A printout of all design changes and their respective status was obtained. A review of this list revealed no significant changes (either complete or in progress) that would impact the design basis regarding severe winds. A search of the licensing commitment computer tracking system revealed no licensing commitments to the Nuclear Regulatory Commission (NRC) that impact the RBS design basis regarding severe winds.

i

f .Rrport Numbtr SEA-95-OO1 Revision ,Q, Page 1.15. of _1,19 O 5.1.3 Occurrences of High Wind Events at River Bend Station A review of RBS licensee event reports (LERs) revealed only one severe wind event reportable to the NRC. This event, reported as LER 92-005133), occurred on March 5, 1992, and involved high winds during a thunderstorm blowing sheet metal siding loose from the Turbine Building and onto energized components, thus damaging the No. 2 main generator step-up transformer causing a turbine-generator trip and then a reactor scram from 100% power. All safety systems functioned as designed in response to the transient. Wind gusts of 75 mph were recorded at the time of the incident by the RBS meteorological tower 2800 feet from the Turbine Building. It is possible that the wind gust that damaged the Turbine Building was over 75 mph since the building is designed to withstand a wind gust of 100 mph meast.ed at 30 feet above the ground. . Thunderstorms arc quite frequent at RBS, bu* .o other thunderstorms have actually challenged safety systems. Hurricane Andrew passed over RBS in 1992. While the plant experienced high winds and rain, RBS was in an outage and experienced no significant damage. No safety systems were challenged. There have been no incidents of tornadoes at RBS. 5.1.4 Results Of.High Winds Analysis 5.1.4.1 High Winds No design changes or licensing commitments have occurred at RBS to impact the original design basis regarding wind forces on buildings. The one incident of high winds at RBS resulted in damage to the Turbine Building: however, this was within the plant design. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding high winds. 5.1.4.2 Tornadoes No design changes or licensing commitments have occurred at RBS to adversely impact the original design basis regarding tornadoes. There have been no incidents of tornadoes to challenge the design basis. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding tornadoes. 5.1.4.3 Hurricanes Since RBS is located too far intand to receive the full impact of a hurricane, the design basis for such an event is subsumed by that for high winds and external flooding (intense precipitation). Since RBS meets the 1975 SRP criteria for these events,it is concluded that RBS meets the criteria for hurricanes also. O

Rep rt Number SEA-95-OO1 Revision .p. Page _13D of _1.5.!L .o 5.2 Floods This section examines potential external flooding events that might initiate an accident sequence and lead to core damage. Potential external flooding sources include intense precipitation, river flooding, local stream flooding, and dam failure. 5.2.1 - Original Design Basis The RBS design basis for external flooding evaluates the effects of runoff from local probable maximum precipitation on safety-related structures. It was determined that most of the runoff would flow into West Creek provided that the runoff was diverted from the open Unit 2 excavation pit. A two foot berm around the pit was constructed and is maintained to assure this diversion into West Creek. Additionally, all building roofs were sloped without parapet walls to prevent ponding on the roofs. (USAR, Section 2.4.2.2) The west bank levee (elevation 57.5 feet msl) of the Mississippi River was considered the limiting water level for the probable maximum flood (PMF) of the Mississippi River. Since RBS plant grade is at 95 feet mst, the guidelines of Regulatory Guides 1.59 and 1.102, were met as were the requirements of General Design Criteria 2 [34) with respect to runoff-produced flooding of the Mississippi River. (USAR, Section 2.4.2.3.1) Tha grade level of the cooling tower yard originally provided a sufficient barrier to keep flood waters from Grants Bayou from entering the power block area of RBS. The calculated maximum water level resulting from the PMF in Grants Bayou varies from about 95 to 102 feet mst in the reach of the stream adjacent to the cooling tower yard. Since the grade level of the cooling tower yard is 104 feet mst, the plant was in conformance with Regulatory Guides 1.59 and 1.102 with respect to potential flooding from Grants Bayou. (USAR, Section 2.4.3.2) West Creekis a small tributary of Grants Bayou that drains approximately one square mile, including most of the plant site. The reach of West Creek that originally ran through the plant site was rerouted and replaced with a 2850-foot-long man-made Fabriform-lined channel. Flooding due to West Creek was analyzed in two scenarios: normal flooding due to probable maximum precipitation and a 25-year flood coincident with a safe shutdov n earthquake. In both cases the water level was calculated to be adequately below plant grade elevathn such that the design conformed with Regulatory Guides 1.59 and 1.102 with respeh to potential flooding from West Creek. The design basis included the inspection and maintenance of the man-made part of West Creek to prevent the buildup of sediment in the channel that might hinder runoff. (USAR, Section 2.4.3.3) There are no dams on the main stem of the Mississippi River between the site and the confluence with the Ohio River. All other upstream dams are on tributaries to the Mississippi River and are more than 100 river miles upstream. Because of the diverse locations of these dams, a seismic event could fail only a few of the dams, thus causing minimal flooding at the RBS plant site. The upstream dams, therefore, do not present a danger to the site, and the site meets the criteria of the General Design Criteria with respect to seismically induced dam failures. (USAR, Section 2.4.4).

Rrport Numbzr SEA-95-OO1 Revision A Page .13.Z. of,,13.S. O 5.2.2 Changes to Design Basis A printout of all design changes and their respective statuses was obtained. A review of this list revealed no significant changes (either complete or in progress) that would impact the design basis regarding external flooding. A search of the licensing commitment computer tracking system revealed no licensing commitments to the NRC that impact the RBS design basis regarding external flooding. 5.2.3 Occurrences of Floods at River Bend Station Thunderstorms are frequent at RBS and bring intense rainstorms causing short-lived localized flooding. There have been no incidents of excessive external flooding at RBS. 5.2.4 Results Of Flooding Analysis 5.2.4.1 Flooding Due to Localintense Precipitation No design changes or licensing commitments have occurred at RBS to impact the original i design basis regarding flooding due to localintense precipitation. There have been no incidents of excessive flooding due to local precipitation. It is therefore concluded that i RBS presently meets the criteria of the 1975 SRP regarding external flooding due to local intense precipitation. O 5.2.4.2 Flooding Due to the Mississippi River No design changes or licensing commitments have occurred at RBS to impact the original design basis regarding flooding by the Mississippi River. There have been no incidents of excessive flooding due to the Mississippi River. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding external flooding by the Mississippi River. T 5.2.4.3 Flooding Due to Grants Bayou No design changes or licensing commitments have occurred at RBS to impact the original design basis regarding flooding due to Grants Bayou. There have been no incidents of excessive flooding due to Grants Bayou. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding external flooding due to Grants Bayou. 5.2.4.4 Flooding Due to West Creek c No design changes or licensing commitments have occurred at RBS to impact the original design basis regarding flooding due to West Creek. There have been no incidents of excessive flooding due to West Creek. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding external flooding due to West Creek. O

R; port NumbIr SEA-95-OO1 Revision _Q. Page .12H_ of _152, 5.3 Transportation and Nearby Facility Accidents This section examines potential core damage accidents resulting from spilling of hazardous materials while being transported by trucks, barges, railways, and pipelines, spilling hazardous materials stored onsite or at nearby facilities, barge collisions with the intako structure, and aircraft hazards. 5.3.1 Original Design Basis 5.3.1.1 Transportation of Hazardous Materials The nearest major road to RBS is U.S. Highway 61, which passes approximately 5000 feet to the north of the plant site. The daily traffic count for this section of Highway 61 was approximately 7900 vehicles per day (both directions)in 1978. The 5000 foot separation distance between the road and the plant site is sufficient to preclude any damage to the plant from a related explosion on the road. (USAR, Section 2.2) The Mississippi River is used for commercial barge traffic and is located 2 miles from the plant site. In 1977 approximately 124 million tons of cargo were transported between Baton Rouge and the Ohio River. At that time it was estimated that about one third of that cargo was potentially hazardous material. The 2-mile separation distance between the river and plant site is sufficient to preclude any damage to the plant from a related /9 explosion on the river. (USAR, Section 2.2) V The nearest railroad at the time of plant licensing was the Illinois Central Gulf line which passed throunh the plant site. At that time the railroad company indicated that hazardous materials were not normally carried on that section of the line north of the Crown Zellerbach papermill. The Missouri Pacific Railroad spur was used to transport materials to the Big Cajun No. 2 coal-fired generating station on the opposite side of the Mississippi River. Missouri Pacific indicated that it had not transported any hazardous materials in the previous year. The Kansas City, Southem Louisiana, and Arkansas Railroad Company would not indicate what hazardous materials,if any, were transported on that line. The 4-mile separation distance between the line and plant site was sufficient, however, to preclude explosive overpressures or toxic gas releases from endangering the plant site. (USAR, Section 2.2) Several buried pipelines carrying natural gas and petroleum products passed near the plant site. The two closest of these pipelines belonged to the Texas Eastern Transmission Corporation and passes within 2.1 miles of the plant. These pipelines were buried at least 30 inches deep and carried natural gas at flow rates of 726 million and 1189 million cubic feet per day. The 2.1-mile separation distance between the pipelines and the plant is sufficient to preclude explosive overpressures endangering the plant. (USAR, Section 2.2) 5.3.1.2 Onsite/ Nearby Facility Spill of Stored Hazardous Materials The only significant nearby industrial facilities were the Crown-Zellerbach papermilliocated g) approximately 3 miles south-southeast of the RBS site and Big Cajun No. 2 Power Plant ( located across the Mississippi River approximately 2.9 miles southwest of the RBS site. 1

l R: pert Numb:r SEA-95-OO1 Revision _Q_ Page 131 of _LQ, t \\ The largest containers of hazardous material shipped to Crown-Zellerbach were 90-ton rail cars of chlorine. The largest containers of hazardous material shipped to Big Cajun No. 2 are 1-ton cylinders of chlorine transported via truck. Chlorine was the largest concem regarding offsite hazardous materials. (USAR, Section 2. 2) The main concern involving a chlorine spill is maintaining the reactor control room atmosphere such that the operators can function effectively. It was determined that chlorine detectors were not required at RBS because Crown-Zellerbach agreed to place RBS on their list of those to be notified in the event of such a spill. This notification is to be made within 30 minutes which is ample time since it was calculated that it would take 2 hours for the chlorine concentration in the RBS reactor control room to reach toxic levels. It was determined that the small size of the chlorine cylinders at Big Cajun No. 2 precluded the need for chlorine detectors at RBS. (USAR, Section 2.2) Analysis was performed for all hazardous chemicals stored onsite at RBS to determine the maximum main control room concentration attained given a spill. These maximum concentrations were compared to the respective toxicity limits. It was determined that hazardous materials stored onsite at RBS posed no threat to RBS control room personnel (USAR, Table 2.2-9) 5.3.1.3 Intake Structure Inoperability Due to Barge Collision or Barge Spill Barge traffic on the Mississippi River could potentially collide with RBS intake structure O halting river water flow to the cooling towers. However, sufficient water existed in the cooling towers to safely shut down the plant should the intake structure become inoperable. In addition, the standby cooling tower was available as an independent cooling source. (USAR, Section 2.2) A barge spill of liquid hazardous materials affecting plant operation is very unlikely since no such liquids were stored at, delivered to, or transported through the intake embayment. Liquid spills upstream of the plant would be quickly diluted by the fast, turbulent river currents. Coagulant materials spilled into the river and drawn into the plant makeup system were not considered a problem since all makeup water is treated by a clarifier before being added to the circulating water system at the cooling towers. Once again,if such materials entered the condenser and hindered flow, the standby cooling tower would be available for safe shutdown. (USAR, Section 2.2) A spill of oil or cryogenic liquid into the river would have no impact on plant operations since these materials would float on the river surface and never reach the depth of the intake screens,20 feet below normal river level. (USAR, Section 2.2) A spill of corrosive materialinto the river might affect plant operation if accepted into the makeup system. However, plant safety would not be jeopardized because the materials would be detected by pH detectors in the circulating water system and would allow ample warning to employ the standby cooling tower for safe shutdown. (USAR, Section 2.2) i O

Rip:rt Number SEA-95-OO1 Revision _Q. Page 140 of,152, [V 3 5.3.1.4 Aircraft Hazards The nearest commercial airport to RBS is Ryan Airport at Baton Rouge, which is 19 miles southeast of the plant site. None of the published approaches to this airport passed near the plant site; therefore, traffic from Ryan Airport does not represent a significant hazard to RBS. (USAR, Section 3.5.1.6) Three low-altitude (below 18,000 feet) airways exist in the site vicinity. The width of such a low-altitude (Victor) airway is approximately 4.6 statute miles either side of the I airway path centerline (the path has an overall width of approximately 9.2 statute miles). The centerline of airway V71 passed 2.5 miles east of the plant, while the centerlines of V222 and V114N passed 7 miles northwest of the site and 8.5 miles northeast of site, , respectively. The edges of these two latter airways are more than 2 miles from the plant 'and do not represent a significant hazard. (USAR, Section 3.5.1.6) Airway V71 was further analyzed using the methodology presented in Section 3.5.1.6 of the SRP in which the annual probability of an aircraft crashing into the plant from this airway was calculated. The result' ant value was 4.5 x 10**/ year, which is below the i 10*'/ year acceptance criteria presented in the same SRP section. (USAR, Section 3.5.1.6) j Two high-altitude (above 18,000 feet) jet routes passed near the plant site. Route J22 and Route J58 pass approximately 7 miles northwest and 13.5 miles southwest of the plant site, respectively. The distance between these routes and the plant site results in an insignificant aircraft hazard from either route. (USAR, Section 3.5.1.6) g There are no airfields within 5 miles of the plant site. There are two small airfields, Jackson Airport and False River Air Park, located 8.1 miles northeast and 10 miles west-southwest of the plant site, respectively. The movements at these two airports are approximately 1000/ year at Jackson Airport and 4000/ year at False River Air Park. These traffic rates do not present a significant aircraft hazard at the plant site. (USAR, Section 3.5.1.6) There are no military installations or any military airspace usage that presents any hazard to the plant site. (USAR, Section 3.5.1.6) t 5.3.2 Changes to Design Basis A printout of all design changes and their respective status was obtained. A review of this list revealed no significant changes (either complete or in progress) that would impact the design basis regarding transportation accidents involving hazardous materials or collisions with plant structures or regarding spills of hazardous materials stored either onsite or offsite. A search of the licensing commitment computer tracking system revealed no licensing commitments to the NRC that adversely impact the RBS design basis regarding transportation accidents involving hazardous materials or collisions with plant structures and no licensing commitments regarding spills of hazardous materials stored either onsite j or offsite. O

Rtport Numbsr SEA.05-001 Revision _g., Page 141 of J.59 It was found, however, that many of the factors beyond the control of RBS, but_ nevertheless influencing the original design basis, have changed over the life of the plant. 5.3.2.1 Transportation of Hazardous Materials The traffic on Highway 61 has increased to 8400 vehicles per day [35]; however, the 5000-foot separation distance between the road and the plant site has not changed and is still sufficient to preclude any damage to the plant from a related explosion on the road. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding trucking accidents involving hazardous materials. While the amount of material shipped on the Mississippi River has increased by approximately 47% since 1977, the amount of hazardous materials has increased only nominally [36]. Further, the 2-mile separation distance between the river and plant site has not changed and is still sufficient to preclude any damage to the plant from a related explosion on the river. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding barge accidents on the Mississippi River involving hazardous materials. The Illinois-Central Railroad delivers chlorine to James River Papermill (formerly Crown Zellerbach). Shipments travel from the east to James River and get no closer to RBS than the James River site. The Illinois-Central tracks, which go through the RBS site into St. Francisville and then north, are no longer in service [37]. This was confirmed by O walkdown of the tracks. The Kansas City-Southern Railroad (formerly Louisiana and Arkansas Railroad) delivers chlorine to the Georgia-Pacific Papermill. it delivers no chlorine north of this site [38]. The Missouri-Pacific Railroad maintains a spur to Big Cajun No. 2 coal-fired generating i station but only coalis delivered. Hazardous materials are not transported via rail [39). Since hazardous materials are transported by railroad no closer than the James River Papermill (approximately 3.4 miles from the RBS plant), separation distance between this site and the RBS plant site is sufficient to preclude any damage to the plant from an explosion-type incident due to a railroad accident. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding railway accidents involving hazardous materials. There have been no changes to the Texas Eastern pipelines, the pipelines passing closest to RBS. The only change in pipelines is the addition of a fourth Transcontinental pipeline l that is 42 inches in diameter. It travels the same general route that the other three Transcontinental pipelines travel, is buried at the same depth, carries the same material (natural gas), and operates at the same pressure and flow rate [40]. The Transcontinental pipelines (including the new pipeline) never pass closer to RBS than those pipelines belonging to Texas Eantern Transmission Corporation. The separation distance between the Transcontinental pipelines and the plant (over 2.1 miles) is sufficient to preclude O explosive overpressures endangering the plant, it is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding pipeline accidents involving hazardous materials.

t Rrport Numbtr SEA-95-OO1 Revision ,g, Page ,M2. of _112. O 5.3.2.2 Onsite/ Nearby Facility Spill of Stored Hazardous Materials A review of the Environmental Protection Agency (EPA) Tier Two forms which are submitted annually to the West Feliciana Parish Civil Defense Department by all businesses possessing hazardous / explosive materials, revealed no new significant holds of hazardous materials in the vicinity of RBS. James River (formerly Crown-Zellerbach) papermill and Big Cajun No. 2 power plant are still the only two nearby sources of significant amounts of hazardous material. The amounts of these stored materials have not changed significantly from the amounts listed in the USAR. Hazardous materials and their amounts stored onsite at RBS have not changed significantly after reviewing the EPA Tier Two form submitted by RBS. An investigation of the contents of the chemical cleaning tanks located at the bottom of the Unit 2 excavation pit was performed to assure that the contents pose no threat to control room personnel. Conversations with the RBS Chemistry Departmer't revealed that of the three tanks (1SWP-TK11,1SWP-TK16, and 1SWP-TK18), one of the tanks is empty, the second is being drained of the saline solution presently residing there, and the third contains chemical cleaning waste water that is high iri dissolved iron and copper. None of the contents of these tanks poses any threat to main control room habitability. 5.3.2.3 Intake Structure inoperability Due to Barge Collision or Barge Spill No significant changes have occurred in the configuration or the operation of the intake structure or circulating water system. 'l 5.3.2.4 Aircraft Hazards Low-altitude airway V71 is still the only federal airway that passes within close proximity of RBS. Traffic on this route, however, has fallen from 6935 flights / year to 1825 flights / year. The threat of an aircraft from airway V71 striking the plant is somewhat reduced [41]. Two other low-altitude airways also pass near the plant, but not close enough to be regarded as a threat. Airway V222 and Airway V566 pass approximately 7 miles to the northwest and 12 miles to the northeast, respectively. Airway 114N, previously passing near the plant, no longer appears on the aeronautical chart [42]. Two high-altitude airways, J22 and J58, still pass within approximately 7 miles and 13.5 miles, respectively, of the plant site. The routes of these airways do not appear to have changed, and no new high altitude airways exist according to the most recent version of Enroute High Altitude - U.S. Chart:H5 [43). Traffic at one of the two local airfields, Jackson Airfield, has fallen from 1000 flights / year to 500 flights / year, therefore, any potential threat from this airfield has not increased [44). i 1 l

R:psrt Numb *r SEA-95-OO1 Revision ,,q, 141 of _13]L Paoe 4 V(D 5.3.3 Occurrences of Transportation and Nearby Facility Accidents at RBS There have been no occurrences of transportation accidents involving hazardous materials or collisions with plant structures that have presented any threat to RBS. Additionally, there have been no spills (offsite or onsite) of stored hazardous materials that have presented any threat to RBS. There have been no incidents of aircraft crashes at RBS. On May 10,1995, a small single engine plan made a forced landing on the river access road approximately one and one-fourth miles from the plant. This event is not considered to be significant. 5.3.4 Results Of Transportation and Nearby Facility Accident Analysis 5.3.4.1 Transportation of Hazardous Materials No design changes or licensing commitments have occurred at RBS to adversely impact the original design basis regarding the transportation of hazardous materials via truck, barge, rail, or pipeline. While many of the factors affecting the original design basis have changed over the life of the plant, none of them have changed in such a manner that the original design basis is challenged. It is therefore concluded that RBS presently meets the criteria cM the 1975 SRP regarding transportation accidents involving hazardous materials. 5.3.4.2 Onsite/ Nearby Facility Spill of Stored Hazardous Materials No design changes or licensing commitments have occurred at RBS to adversely impact the oiiginal design basis regarding spills of hazardous materials stored either onsite or at nearby facilities. The amounts and locations of stored hazardous materials have not changed significantly, therefore it is concluded that RBS presently meets the criteria of the 1975 SRP regarding spills of hazardous materials either onsite or at nearby facilities. 5.3.4.3 Intake Structure Inoperability Due to Barge Collision or Barge Spill No design changes or licensing commitments have occurred at RBS to adversely impact the original design basis regarding collisions of barges into the intake structure or barge spills. No significant changes have occurred in the configuration of the operation of the intake structure or circulating water system. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding collisions of barges into the intake structure and barge spills. 5.3.4.4 Aircraft Hazards 4 No design changes or licensing commitments have occurred at RBS to adversely impact the original design basis regarding aircraft hazards. While many of the factors affecting the original design basis have changed over the life of the plant, none of them have changed in such a manner that the original design basis is challenged. It is therefore concluded that RBS presently meets the criteria of the 1975 SRP regarding aircraft hazards.

Rtport Numbsr SEA 95 OO1 Revision Q_ j Page 144 of _LE 5.4 Severe Temperature Transients Severe temperature transients such as extreme hot or extreme cold are a potential for every nuclear plant in the U.S. and are generally limited to loss of ultimate heat sink and loss of offsite power (e.g., diesel generator failure). The climate at RBS is generalli ti N with the plant never seeing extremes of heat or cold. The ultimate heat sink at Rive, e is the Standby Cooling Tower. The Standby Cooling Tower is relatively insense .e to extreme temperatures. Failures due to cold are generally limited to full or partit.. ss of offsite power, which is sufficiently analyzed in the internal events PSA [14). Severe temperature transients are, therefore, eliminated from any further analysis. 5.5 Severe Weather Storms (Icestorms, Hailstorms, Snowstorms) Severe weather storms generally result in either a partial or complete loss of offsite power event and are fully analyzed in the internal events PSA [14]. Severe weather storms are, therefore, eliminated from any further analysis. 5.6 Lightning Lightning strikes have the potential to cause plant scrams at nuclear power plants, and to i result in losses cf offsite power to the plant. In addition, a lightning strike can disable individual components and/or systems. All such plant initiators have been fully analyzed in the intemal events PSA [14). Since RBS does not have a history of frequent lightning strikes causing plant scrams, lightning is eliminated from further analys:s. 5.7 External Fires The effects of external fires are limited to loss of offsite power and control room heating, ventilation, and a:r conditioning (HVAC) events. Loss of offsite power events are fully analyzed in the internal events PSA [14]. Control room HVAC can be isolated from the outside atmosphere, thus negating the effects of smoke from an external fire. External fires are, therefore, eliminated from further analysis. 5.8 Remaining Other External Events All remaining other extemal events listed in NUREG/CR-5042, Supplement 2, " Evaluation ] of External Hazards to Nuclear Power Plants in the United States," [45] were evaluated i and determined to be either not applicable to the location, climate, or terrain of RBS, or j simply too unlikely to examine further. 5.9 Walkdowns Walkdowns were performed to support the analyses documented in this report. Walkdowns were generally done informally without checklists due to the nature and uniqueness of the analyses. The following findings resulted from the walkdowns: ~ O

I 1 l ' Reput Number ' SEA-95-OO1 Revision .,Q_ _ Page _li!L of 15.9 i l ~ Severs Winds t No vulnerabilities were discove' red in existing structures. The walkdowns concen' trated mostly on potential missiles near the site's buildings. The site is maintained in a relatively j clean. fashion from the standpoint of potential missiles. i External Floodina ~ ' Walkdowns were limited to West Creek since this is the only external flooding source that is manmade. The walkdown found that some sediment had built in the bottom of the l channel, but was of insufficient depth to be's concern. . Transoortation and Nearby Facility Accidents Walkdowns of the local railway systems (as prompted by discussions with the railways) revealed that the lilinois-Central tracks that run through the RBS site into St. Francisville l and then north are no longer in use (vegetation has overgrown the tracks and they are ' j obviously no longer maintained or useable). 5.10 Results i RBS's design basis was reviewed with regard to the other external events described in l Section 5.0 of this report. After examining the changes in plant design, the licensing .l O commitments made since the plant started operation, and the changes af f acting the design basis but beyond the control of RBS,it was determined that the criteria of the 1975 SRP [ is currently met by RBS. No vulnerabilities unique to other external events were identified. Further, none of the other external events evaluated in this analysis present any vulnerability to containment performance that has not already been evaluated as part of i the internal events PSA (14]. { i 'l l O

RIpsrt Number ' SEA.95-OO1 I Revision _Q, Page .jfg., of. lit 6.0 LICENSEE PARTICIPATION AND INTERNAL REVIEW TEAM - P 6.1 IPEEE Program Organization e Figure 6.1 is a list of the personnel who participated in this project. i Entergy Operations, Inc. (EOI), personnel were involved in all aspects of the IPEEE. Contractor expertise was used to supplement in-house capabilities. The vast majority of contractor work was performed on-site with EOl personnel working closely with contractors. This allowed technology transfer from the contractors and also ensured that the knowledge and insights gained from the analysis remained with the utility. EOl personnel who performed the Seismic Analysis attended industry training on the EPRI ) Seismic Margin Methodology. Three individuals attended the EPRI SOUG training course and the ~ EPRI IPEEE Seismic Add-on Course. Two of these individuals meet the qualification requirements of a " Seismic Capability Engineer" as described in EPRI NP-6041. The third individual served as a systems analyst. EOl personnel who performed the Fire PRA were the same individuals who performed the lPE. Additional in-house expertise was utilized as needed. EOl personnel attended appropriate industry training courses which included instruction ranging from classic fire ^ protection to Fire PRA Methods. To meet the intent of GL 88-20, EOl expended significant resources in developing in-houta personnel to perform the analysis. By expending these resources, EOl has retained the l knowledge which was gained through the analysis and thus has met the intent of having i utility participation in the performance of the IPEEE. I s 6.2 Composition of Review Team For the Seismic Analysis, the Peer Review consisted of a review of the Success Path Logic s Diagram (S*LD). The individual who performed the review was also involved in j development of the internal events IPE and is very knowledgeable in River Bend Systems. l No additional Peer Review was performed on the seismic walkdown, adequate verification was performed during the initial walkdown. For the initial walkdown, at least two Seismic Capability Engineers have been involved for each component-where a judgement was made as to the seismic adequacy of the component. In many cases, more than two l Seismic Capability Engineers were involved. l l One of the reasons that NUREG 1407 [13] requests a Peer Review is that it would add credibility to the high confidence of low probability of failure (HCLPF) estimates No HCLPF calculations were performed for this study. Therefore, it is concluded that the seismic walkdowns have had an adequate level of review. For the Fire Analysis, the Peer Review was two-fold. First, the members of River Bend multi-disciplinary team which deals with fire protection issues each reviewed the analysis in their area of expertise. Second, an external consultant recognized as an expert in the field of Fire PRA reviewed the analysis and compared the analysis with the Grand Gulf i

c R:ptrt Number SEA-95-OO1 Revision .g. Page 147 of M analysis. The Other External Events Analysis was reviewed by two EOl personnel who jointly are knowledgeable about River Bend's history (both events and installed modification) and River Bend's Licensing Basis. 6.3 Areas of Review and Major Comments All major areas of the IPEEE have been reviewed (Note that the seismic walkdown did not have an additional review. See previous section). There were no major comments on the Seismic Analysis or other analysis sections. The major comments on the Fire Analysis were: Comment 1: The ignition frequency for the Main Control Room (MCR) was split between the MCR and the Auxiliary Control Room. It was questioned as to whether this split was conservative. Comment 2: For the MCR, no credit was given for the Remote Shutdown System (RSS) for Division I cabinets fires. Comment 3: It was noted that the MCR analysis was conservative in that (Q / it assumed every fire was severe. Comment 4: It was noted that the analysis was conservative where transient fires dominated in that no credit was taken for manual suppression. 6.4 Resolution of Comments The major comments on the Fire Analysis have been resolved and the resolutions incorporated i.nto this report as follows: Comment 1: The ignition frequency for the MCR was revised such that the frequency is no longer split between the MCR and the Auxiliary Control Room. It was i conservatively assumed that all Control Room fires occur in the Main Control Room for the MCR fire analysis. Comment 2: Credit was taken for the RSS for MCR Div. I cabinets fires. Comment 3: A severity factor was applied to the MCR cabinet fires, as described in Section 4.10.2.1. Comment 4: Credit was taken for manual suppression of transient fires, as described Section 4.6.4.

rip *rt Numbir SEA-95-OO1 R; vision .Q. Page. 148 of.15]L p Figure 6-1 IPEEE Participants Seismic Analysis Affiliation Joe L. Bunon EOI Hamil O. Grimes EOI Paul A. Miktus EOl Todd A. Reichardt EOl Robert F. Christie PT Bahman Lashkari JBA Wang Lau RAPA John W. Reed JBA William D. Salyer ORRiM i Seismic SPLD Reviewer Loys K. P,adell EOl Fire PRA Loys K. Bedell EOl Andrew L. Garrett EOl O Todd A. Reichardt EOl David C. Baird VECTRA Michael C. Klooster VECTRA William D. Salyer ORRiM J. Russell Sharpe RAPA i Fire PRA Reviewers Byron K. Ellis EOl Rudolph J. Kerar EOl Andrew L. Garrett EOl John C. Maher EOl Michael A. Stein EOl William Parkinson SAIC 1 1 Other External Events Todd A. Reichardt EOl J. Russell Sharpe RAPA O t

J f Ripert Number SEA-95-OO1 R:visi:n ,2, Page 149 of M 3 Figure 6-1 (Cont'd) IPEEE Participants Other External Events Reviewers Affiliation l John C. Maher EO! l Michael A. Stein EOl - i t f Entergy Operations, Inc. EOl = Performance Technology PT = Jack R. Benjamin and Associates, Inc. JBA = ORRiM = Oak Ridge Risk Management, Inc. O Science Applications international Corporation SAIC = i i i l T i i [O h m

.~ l Ripert Number SEA 95-OO1 l R:visi:n 1 Page M of,13,, -7.0 PLANT IMPROVEMENTS AND UNIQUE SAFETY FEATURES This section defines vulnerability for each external event and then compares River Bend i against the definition to determine if any vulnerabilities exist. k 7.1 Seismic Analysis A vulnerability due to a Seismic event is defined as a component, identified as being needed in the SPLD, which is not capable of surviving the Review Level Earthquake (RLE). { The seismic walkdowns found that the River Bend Nuclear Station is seismically rugged and that all components in the SPLD adequately considered the Seismic input. All the SPLD equipment was screened out and there are no outlines requiring further evaluation. It is therefore concluded that River Bend has no vulnerabilities with regards to Seismic events. i 7.2 Fire Analysis j One of the primary purposes of the IPEEE was to perform a systematic evaluation of each nuclear power plant to identify any potential severe accident vulnerabilities due to internal fires. In order to be consistent with the internal events IPE, the same definition of i vulnerability was used. The following is an excerpt from the RBS internal events IPE which defines a vulnerability: One of the major problems associated with vulnerability screening of the Level 1 results is that the NRC has never actually defined what constitutes a vulnerability, either quantitatively or qualitatively. To resolve this issue, NUMARC developed a screening process to identify and respond to vulnerabilities. Their methodology is documented in NUMARC 91-04 [25]. The NUMARC method uses a graded approach based on core damage frequency and percentage contribution to determine potential responses to any identified vulnerabilities. Their approach is based on the sequence level, either functional or systemic. In effect, the NUMARC methodology defines a potential l vulnerability as any functional accident sequence that has frequency greater than 1.0E-06 per y' ear or which contributes inore than 20% of the total core damage frequency. Any sequence that exceeds these limits in the NUMARC l methodology must be responded to, even if the response is just to ensure that the sequence is covered by the accident management guidelines. There are several concerns with the NUMARC methodology that make its use for identifying vulnerabilities for the River Bend IPE unacceptable. First, there j is no firm background for the definitions of categories based on frequency. The only officially stated NRC numerical guideline for acceptable risk is the 0.1% l goal as stated in the NRC Safety Goal Policy Statement 1261. This statement l explicitly addressed only risk to the health and safety of the general public. j However, the NRC staff has developed a corresponding core damage frequency limit of 1.0E-04 per year. This corresponds to the upper limit of the NUMARC screening criteria. .+- .~.,- --.--.m ~ - - ,-.-.-.r-, -m-

R; port NumbIf SE A-95-OO1 Revision ,p, Page 151 of,13J., p ( ) However, the other values in the criteria used to determine the required response,1.0E-05 per and 1.0E-06 per year, have no basis in the regulatory arena. Second, the use of percentage contributions to core damage frequency for determining a vulnerability is inappropriate. Past experience has shown that j it is possible for a sequence that is low in absolute frequency to be a large This was the case in j percentage contribution to core damage frequency. l NUREG/CR-4550 analysis of Grand Gulf which calculated a total core damage l frequency of 2.0E-06 per year but the station blackout sequence contributed over 89%. This is also the case for River Bend where the overall core damage l l frequency is relatively low but the two station blackout sequences contribute more than 87%. This is misleading and could lead to the identification of a sequence as indicating that a vulnerability exists when it does not. Therefore, the NUMARC Severe Accident Closure Guidelines are not used for identifying and dispositioning vulnerabilities for River Bend Level 1 IPE. Instead the vulnerability screening criteria for River Bend is based on the NRC's Safety Goal Policy Statement. The criteria for River Ben is that if the total core damage frequency or the core damage frequency of any functional accident sequence exceeds 1.0E-04 per year, a vulnerability associated with the overall plant or sequence is assumed to exist. In addition, the contribution that exceeds the criteria must be "real" and not a artifact of conservative modeling or analysis assumptions. I r I When this criteria for determining a vulnerability is applied to the River Bend Fire PRA, the t The Fire PRA conclusion is that there are no vulnerabilities due to internal fires. conservatively estimates the core damage frequency (CDF) due to internal fires. The estimate of CDF from internal fires is comprised of the 7 fire areas listed on Table 4-13. The CDF is spread fairly equally over the 7 fire areas with no one dominant fire area. CDFs range from a high of 4.87 x 10 /yr. to a low of 1.26 x 104/yr. The Control Room 4 has the highest fire area CDF representing approximately 22% of the total CDF. 4 Due to The summation of the fire area CDFs in Table 4-13 is 2.25 x 10 /yr. conservatisms in the analysis, this is an upper bound estimate of the true CDF. The CDFs estimated for internal fires are not and should not be directly compared to the CDFs calculated in the internal events IPE. The conservatisms (discussed in Sections 4.10.3.6 and 4.11) and uncertainties associated with a Fire PRA are much greater than those associated with an internal events IPE, thus making a direct comparison impractical and meaningless. For the Fire PRA a functional accident sequence is taken to be a fire in a particular location with its associated damage. This definition of function accident sequence implies that fire vulnerabilities are location specific. This is consistent with the guidance given in NUMARC A Review of the important fire areas shows that the Control Room (Area C-91-04[25).

25) represents approximately 22% of the total CDF due to internal fires. The next highest CDF is the Division i Switchgear Room (area C-15) which represents approximately 21 %

of the total CDF due to internal fires. The rest of the risk is spread between 5 fire areas. It is concluded that River Bend has no vulnerabilities to internal fires. This conclusion is made based on the individual fire area CDFs, the summation of the CDFs, and the fact that

i R: port Nurnb r SEA 95-001 i Revision 1 Page .152. of.159. b the risk is spread fairly evenly among the 7 fire areas. Even though no vulnerabilities were identified, insights were gained in the process of performing the analysis. The insights were transmitted to the Project Manager in charge of Fire Protection and are described below. Plant Walkdowns were performed to determine the relative location of fire targets with respect to postulated fires. The majority of the accessible fire areas in the plant were reviewed over a period of several months. Transient combustibles were minimal. Waste cans typically were either empty or only contained a small amount of Class A combustibles. Painting teams used spring loaded safety cans for flammable materials and work areas were clearly marked to help prevent accidental spills. The conclusion of the walkdown team is that the general work practices with regards to fire protection are very good. The RBS Level l PRA models were used to quantify the probability of core damage in each fire area given the occurrence of a fire. The SSA databases were used as the basis for the location of cables and components. Success criteria for systems were taken from the Level i PRA fault trees and event trees. Quantification of the PRA models provided an independent verification of the SSA equipment selection. The Fire PRA provides an independent check for the SSA equipment selection as well as valuable insights into other functional areas of the fire protection,orogram. Overall, the I equipment selection in the SSA is sound. Summarized below are the major insights D identified by the Fire PRA with regards the SSA equipment selection and the fire protection program. 1. Auxiliary Building Unit Cooler 1HVR*UC8 The SSA does not credit auxiliary building unit cooler 1HVR *UC8. This unit cooler supports RCIC operation by providing cooling to the main steam tunnel (MST). A hi h temperature in the MST is indicative of a steam line break, therefore, the MST 0 contains sensors which will generate a RCIC isolation on high temperature. RCIC is credited in safe shutdown methods 1,1 A and 1E. The unit cooler is not credited in these shutdown methods. This issue holds little safety significance because loss of the unit cooler does not significantly af fect the operator's ability to safely shutdown the plant. For methods 1 and 1 A, safe shutdown is achieved from the main Control Room. There is a bypass switch of the high temperature trip signallocated in the main Control Room. The Abnormal Operating Procedure for fires (AOP-0052) does not address the bypass switch; however, the operator should be aware of the bypass switch from Licensed Operator training. It is likely that the operator would bypass the trip signal using " toolbox skills" if the bypass were to become necessary. For method 1E, safe shutdown is achieved from the remote shutdown panel. Transfer of control of RCIC to the remote shutdown panel will automatically bypass the high temperature trip signal, In summary, the exclusion of 1HVR*UC8 from the SSA does not significantly

-~ -... i Rrpart Number SEA-95-001 Revision ,Q, t Page _152. of a i impact the operators' ability to safely ' shutdown the plant. However, as an i enhancement, the following alternative will be evaluated: 1) revise the SSA to credit the unit cooler, or 2) add a note to AOP-OO52 to inform operators of the i possible need to bypass the high temperature trip signal. 2. Condensate Storage Tank Level Transmitters for RCIC j The credited suction source for RCIC suction in the SSA is the suppression pool; however, RCIC is normally aligned to the Condensate Storage Tank (CST). Since AOP-OO52 is not prescriptive in nature, an operator will typically use whatever' equipment is available rather than go directly to the credited safe shutdown method. Thus, it is very likely that the operators would leave RCIC aligned to the CST. The CS' level transmitter (1 E51

• LTNO35A and 151 'LTNO35E) whichinitiate the swap-over of RCIC suction from the CST to the suppression pool are not credited in the SSA.

For shutdown methods which credit HPCS, the associated CST level transmitters (1 E22'LTN054C and 1 E22

• LTN054G) are credited. These level transmitters could be used by the operator in identifying the need to realign RCIC, if the transmitters were not damaged by the fire.

As an enhancement, the f ollowing altamatives will be evaluated: 1) revise the SSA [ i to credit the CST level sensors, or 2) add a caution to AOP-OO52 to inform i O operators that CST level indication could be lost due to a fire. 3. Instrument Air System for Control Building Switchgear Room Dampers. The dampers which provide the air path to the Control Building switchgear rooms are designed to faii closed on a loss of instrument air pressure. The SSA credits the dampers in an open position. Since the dampers are air operated, some form of instrument air should also be credited. The instrument air system (IAS) has a j safety grade backup for the Control Building which is provided by two banks of air l bottles (IAS *TK5A and IAS *TK58). The SSA analysis of instrument tubing implies that the air bottles and associated tubing are credited, however, it is not explicit as to whether IAS is credited. As an enhancement the need for IAS during a fire will be reviewed and the SSA will be revised so that it explicitly states which portions oflAS are credited. 4. LSV Air Compressors The shutdown method for fire area AB-15/Z-4 is method 1C. It credits the 7 ADS SRVs for depressurization and LPCS for level control. In the event of a fire in this area, it is possible that the mein steam isolation valves will close thus necessitating cycling of the SRVs in the relief mode to maintain reactor pressure. The air for the . 1) main steam safety valve SRVs would be drawn from one of the three sources: system (SW), 2) main steam positive leakage control system (LSV), or 3) the respective SRVs accumulator. Of these air sources, the air compressors for SVV and LSV may not be available .-e.- ~~..m.. n ,4y-, ,+.m... ,,.,7

m> R:pirt Numbcr SEA-95-OO1 Revision _Q. Page 154 of_15jl in the event of a fire in this area. The SVV air compressors have not been credited in the SSA and both LSV air compressors are physically located in fire area AB-15/Z-4. SVV and both LSV air compressors are physically located in fire area AB-15/Z-4. Calculations show that sufficient compressed air would be available from. the LSV system accumulators; however, this air supply would be finite. AOP-0052 does not specifically warn operators of this fact. Since the AOPis not prescriptive, depressurization may not actually occur until late in the event. As an enhancement, the following options will be evaluated: 1) revise the SSA to better document the role of the LSV system for shutdown due to fire, and 2) add a caution statement to AOP-0052 to warn operators that air pressure may be lost for those fire areas which do not credit a compressor. 5. Standby Service Water Valves to Auxiliary Building Unit Coolers Shutdown methods 1,1 A,1C,1E and 2 each credit several auxiliary building unit coolers. Standby service water is required for these unit coolers to operate. The SSA does not credit the standby service water supply and return valves to the auxiliary building unit coolers for methods 1,1 A,1C,1E and 2. Standby service water valves 1SWP'MOV171 and 172 should be credited for methods 1,1 A,1C, and 1 E and valves 1 SWP"MOV173 and 174 should be credited (7 for method 2. Review shows that safe shutdown using any of these methods V would not have been compromised. The valves would have functioned as l necessary with no spurious signal concern. The SSA will be revised to credit these valves for the respective shutdown method. The SSA is a very complex analysis. The insights identified by the Fire PRA are not surprising given the complexity of the analysis and the depth of review performed. in conclusion, no vulnerabilities to internal fire were identified for River Bend. Insights were gained on the process of performing the analysis. Several enhancements to the Fire Protection Program at River Bend are being considered based on the insights gained. No plant modifications are required as a result of the IPEEE Fire PRA. The results of the Fire PRA appear reasonable. It would be expected that the most important locations when considering fire risk in a nuclear plant would be those containing cabling for multiple systems and/or divisions, those areas providing required support (e.g., HVAC) for such areas, and areas containing important safety equipment (e.g., HPCS). The Main Control Room, where the plant's operations and control functions normally occur, is thus expected to amongst the plant areas with the largest fire risk importance. The Fire PRA study demonstrates that the fire hazard in most fire areas is relatively minor, whether the hazard is measured deterministically or probabilistically. From a deterministic perspective, fire sourcas often were predicted to damage only a few targets or, more likely, to self-extinguish. From a probabilistic perspective, the frequency of damaging fires [.,V) was typically low. Thus, the results of the Fire PRA lead to the conclusion that the River Bend fire hazards

R:p:rt Number SEA-95-OO1 Revision _Q. l Page _L5,5,, of M i and fire risk are low. l 7.3 Other External Events A vulnerability to an Other External Event is defined as a plant non-conformance, with respect to the 1975 SRP, which has a significant contribution to River Bend's CDF. The conclusion of the other External Events Analysis is that River Bend currently meets all of i the 1975 SRP criteria for the other External Events. Therefore,it is concluded that River Bend has no vulnerabilities in the area of Other External Events. 2 e O 1 i p o O i

, _ - ~ . ~ ~ - - Repcrt Numbtr SEA-95-OO1 R:;visitn ._Q. ~! Page _11g_ of.15.ll 8.0

SUMMARY

AND CONCLUSIONS (INCLUDING PROPOSED RESOLUTIONS OF USis AND GIs) EOl has performed a complete IPEEE for River Bend Station. The intent of GL 88-20 and NUREG 1407 has been met. EOl has expended significant resources developing in-house capabilities in the performance of the IPEEE. The insights and knowledge gained in the l process remain with the utility. t For the Seismic Analysis, RBS is identified as a reduced scope plant by NUREG-1407. i Therefore, the Safe Shutdown Earthquake (SSE) ground response spectra and j corresponding in-structure response spectra were used as the Review Level Earthquake (RLE) input for the walkdown and evaluation. The conclusion of the seismic walkdowns is that River Bend Station is seismically rugged and all components identified in the safe shutdown paths have adequately considered the j seismic input. All anchorage to these components were found to be rugged. No vulnerabilities to seismic events are identified. i The methodology and assumptions used in the RBS Fire Analysis have been compared to i those used at the other EOl sites. The RBS Fire Analysis was compared to Grand Gulf Nuclear Station (GGNS) study in greater detail due to the similarities in design and the fact that GGNS also performed a Fire PRA. Slight changes 'in the methodology and i assumptions were made as a result of the comparison. The principal differences in the results of GGNS study and the RBS study are related primarily to differences in plant j design. The Fire PRA conservatively estimated the core damage frequency (CDF) due to internal l' fires. The estimate of CDF from intemal fires is comprised of 7 fire areas. The CDF is spread fairly equally over the 7 fire areas with no one-fire area dominating the results. The fire area CDFs range from a high of 4.87 x 10/yr to a low of 1.26 x 10'/yr. The Control Room has the highest fire area CDF representing approximately 22% of the total estimated l CDF. j The summation of these individual CDFs is 2.25 x 10'/yr. Due to the conservatisms in l the analysis, this is an upper bound estimate of the true CDF. The CDFs estimated for .l internal fires are not and should not be directly compared to the CDFs calculated in the i internal events IPE. The conservatisms and uncertainties associated with Fire PRA are much greater than those associated with an internal events PRA, thus making a direct comparison impractical and meaningless. No vulnerabilities to internal fires are identified. I i For the High Winds, Floods, and Others analysis, RBS meets the 1975 SRP design criteria for these events. No vulnerabilities to these events are identified. ~ As part of the IPEEE, USls A 45, A-17, A-40, and A-46, GI 131, GI-57, and NUREG/CR-5088 were evaluated for applicability at River Bend Station. USIs A-45, A-17, NUREG/CR-5088, and GI-57 are addressed in Sections 3.2 and 4.9. Based upon the Fire PRA core ~ damage frequency and the seismic walkdowns, none of these issues is considered a vulnerability at River Bond. These issues are considered complete for River Bond. USIs A-40, A-46, and GI-131 are not applicable to River Bend. l

rip:rt Nurnb:r SEA-95-001 Revision A Psge _1.52_ of.15]L M

9.0 REFERENCES

i r 1. RBS Calculation G13.18.12.2-105, Revision 0, "lPEEE Fire PRA Compartment Fire ignition Frequencies. 2. Generic Letter 88-20, Supplement 4, " Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities," dated June 28,1991. 3. " Power Generation Control Complex Design Criteria and Safety Evaluation", Licensing Topical Report NEDO-10466-A, General Electric, February 1979. 4. RBS System Design Requirements Document, " Fire Protection Halon and CO,", SDRD-P23, Revision O. 5. W. Parkinson, et al., Fire Events Database for U.S. Nuclear Power Plants, Palo Alto, CA, Electric Power Research Institute, July 1992, NSAC-178L. 6. W. Parkinson, et al., Fire PRA Reouantification Studies, Palo Alto, CA; Electric Power Research Institute, March 1993, NSAC-181. 7. HRA Acoroach Usina Measurements for IPE, Palo Alto, CA; Electric Power Research Institute, December 1989, EPRI NP-650L. 8. RBS Calculation G13.18.12.3*155-0, " Fire PRA Event Trees". i 9. RBS Calculation G13.18.12.2'114-0, " System Fault Tree Model Development for the RBS Fire PRA". 10. RBS Drawing EE-27A-13, " Arrangement Main Control Room". 11. RBS Report NE-RA-93-009M, " Seismic IPE Review," November 1993, File Code G 12.23.12.1. 12. GL 88-20, Supplement 4, " Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities," dated June 28,1991. 13. NUREG-1407, " Procedural and Submittal Guidance For The Individual. Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," dated June 1991. 14. EOl Report EA-RA-93-0001 M " Generic Letter 88-20 individual Plant Examination Submittal for Internal Events at River Bend Station" dated January 15,1993. 15. RBS Calculation G13.18.12.2-22-0, " Combustible Loading." N 16. EPRI TR-100370, Fire-induced Vulnerability Evaluation (FIVE_1, Professional Loss Control, Inc., April 1992 i

Rrport Numbtr SEA-95-OO1 Revision _Q Page 153._ of 15.2. (~'\\ 17. EPRI NSAC 1981, Fire Events Database for U.S. Nuclear Power Plants. Science Application International Corporation, June 1992, 18. . NUREG/CR-4680 19. NUREG/CR-4679 20. RBS Calculation G13.18.2.7'33-1, "PRA Event Tree Assumptioris. 21. RBS Calculation G13.18.12.3*129-0, " Intermediate LOCA Event Tree for Level 1 PRA." 22. RBS Procedure AOP-0050, " Station Blackout", Rev. 5, April 6,1994. 23. River Bend Station Emergency Operating Procedures a. EOP-1, "RPV Control", Rev.10 b. EOP-1 A, "RPV Control-ATWS", Rev.10 j c. EOP-2, " Containment Control", Rev. 8 d. EOP-3, " Secondary Containment and Radioactive Release Control", Rev. 8 24. RBS Calculation G13.18.12.3*130-0, "Small LOCA Event Tree for Level 1 PRA." 25. NUMARC, Severe Accident issue Closure Guidelines. NUMARC 91-04, 1992, Nuclear Management and Resources Council, Inc., Washington, D.C. 26. USNRC, Poliev Statement on Severe Reactor Accidents Recardina Future Desian and Existina Plants, 50 FR 32138, August 8,1985. 27. NUREG-75/087, " Standard Review Plan for the Review of Safety Analysis Report for Nuclear Power Plants," United States Nuclear Regulatory Commission, September,1995. 28. RBS USAR 29. EPRI NP-6041-SL,"A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Revision 1, Jack R. Benjamin and Associates, Inc., etal., August 1991 30. RBS Criterion 240.201 A, " Safe Shutdown Analysis." 31. W. J. Parkinson, " Peer Review of the River Bend Fire PRA and Comparison to Grand Gulf," Science Application International Corporation, Project Number 01-0082 4929-300, dated June 21,1995. 32. W. J. Parkinson etal, " Fire Risk Implementation Guide," Draft Report, Project 3385-01, EPRI, January 31,1994. 33. Licensee Event Report 92-005, River Bend Station, Docket No. 50-458, April 6, 1992.

f Report Numbir SEA-95-OO1 Revision JL Page _jl2 of 153. \\') 34. General Design Criteria 2,10CFR50 Appendix A 35. TELOG between Tyler Martin, Traffic and Planning Specialist, Louisiana State Department of Transportation and Development, and Russell Sharpe, Reliability and Performance Associates, July 13,1993. 36. Waterborne Commerce of United States, Calendar Year 1989, Part 2, Waterways and Harbors, Gulf Coast, Mississippi River, and Antilles, Departments of the Army, Corps of Engineers, June 28,1991, pp.136-138. 37. TELOG between John Freedman, Trainmaster, Illinois-Central Railroad, and Russell Sharpe, Reliability and Performance Associates, May 10,1993. 38. TELOG between Gerald Erermann, Yardmaster, Kansas City-Southern Railroad, and Russell Sharpe, Reliability and Performance Associates, May 10,1993. 39. TELOG between Ed Saylor, Technical Services Engineer, Big Cajun No. 2, and Russell Sharpe, Reliability and Performance Associates, May 10,1993. 40. Letter from Curtis Jecks, Transcontinental Gas Pipe Line Corporation to Russell Sharpe, Reliability and Performance Associates, April 23,1993. /N 41. Letter from Walter A. Metzger, Air Traffic Manager, Federal Aviation U Administration, Air Traffic Control Center, Houston, TX, to Russell Sharpe, { Reliability and Performance Associates, June 19,1993. 42. Houston Section Aeronautical Chart, U. S. Department of Commerce, February 4, 1993. 43. TELOG between the Federal Aviation Agency Flight Service Station - Nashville, TN, and Russell Sharpe, Reliability and Performance Associates, September 28,1993. 44. TELOG between Chip Chiasson, Aviation Safety and Airport Compliance Officer, Louisiana State Department of Transportation and Development - Aviation Services Section, Baton Rouge, LA, and Russell Sharpe, Reliability and Performance Associates, April 22,1993. 45. NUREG/CR-5042, Supplement 2, " Evaluation of External Hazards to Nuclear Power Plants in the United States," February 1989. r (}}