ML20086T356

Individual Plant Exam for External Events

ML20086T356
Person / Time
Site:	Waterford
Issue date:	07/31/1995
From:	ENTERGY OPERATIONS, INC.
To:
Shared Package
ML20086T360	List: ML20086T356
References
NUDOCS 9508020325
Download: ML20086T356 (139)

Text

I WATERFORD 3 INDIVIDUAL PLANTEXAMINATIONFOR EXTERNAL EVENTS Prepared and Submitted by ENTERGY OPERATIONS, INC.

July 1995 A OCk 0600 82 P

PDR

TABLE OF CONTENTS 1.

Executive Summary 1-1 1.1 Background and Objectives 1-1 1.2 Plant Familiarization 1-1 1.3 Overall Methodology 1-3 1.4 Summary ofMajor Findings 1-3 2.

Examination Description 2-1 2.1 Introduction 2-1 2.2 Conformance with Generic Letter and Supporting Material 2-1 2.3 General Methodology 2-2 2.4 Information Assembly 2-3 3.

Seismic Analysis 3-1 3.0 Methodology Selection 3-1 3.1 Seismic Margins Method (Reduced Scope) 3-1 3.1.1 Review of Plant Information, Screening, and Walkdown 3-2 3.1.2 Systems Analysis 3-18 3.1.3 Analysis of Structure Response 3-27 3.1.4 Evaluation of Seismic Capacities of Components and Plant 3-33 3.1.5 Analysis of Containment Performance 3-40 3.2 USI A-45, GI-131, and Other Seismic Safety Issues 3-40 4.

Internal Fires Analysis 4-1 4.0 Methodology Selection 4-1 4.1 Fire Hazard Analysis 4-1 4.2 Review of Plant Information and Walkdown 4-1 4.3 Fire Growth and Propagation 4-4 4.4 Evaluation of Component Fragilities and Failure Modes 4-6 4.5 Fire Detection and Suppression 4-7 4.6 Analysis of Plant Systems, Sequences, and Plant Response 4-8 4.7 Analysis of Containment Performance (If Applicable) 4-53 4.8 Treatment of Fire Risk Scoping Study Issues 4-53 4.9 USI A-45 and other Safety Issues 4-57 ii

r 1

S.

High Winds, Floods, and Others 5-1 5.1 High Winds 5-2 5.2 Floods 5-4 i

5.3 Transportation and Nearby Facility Accidents 5-9 I

5.4 Others 5-14 6.

Licensee Participation and Internal Review Team 6-1 6.1 IPEEE Program Organization 6-1 6.2 Composition ofIndependent Review Team 6-2 6.3 Areas of Review and Major Comments 6-2 6.4 Resolution of Comments 6-2 7.

Plant Improvements and Unique Safety Features 7-1 8.

Summary and Conclusions (including proposed resolution 8-1 of USIs and GIs) i i

iii

. ~.

F 1.

EXECUTIVE

1.1 BACKGROUND

AND OBJECTIVES In November of 1988, Generic Letter 88-20 on Individual Plant Examination (IPE) (see Reference 1-1) was issued by the NRC to address severe accident risk because ofinternal events, including internal floods. Waterford 3 responded to this initiative with a Level 1 and limited scope Level 2 Probabilistic Safety Assessment, the results of which were submitted as the Waterford 3 IPE in keeping with the requirements of Generic Letter 88-20 and the guidance of NUREG-1335 (see Reference 1-2).

in June of 1991, Supplement 4 to Generic Letter 88-20 (see Reference 1-3) was issued requesting each licensee to perform an Individual Plant Examination of External Events (IPEEE) to address the severe accident risk posed by external events. External events include seismic events, internal fires, high winds and tornadoes, external floods, and transportation and nearby facility accidents.

j The purpose of the IPEEE is similar to that of the IPE:

j t

(!)

to develop an appreciation of severe accident behavior.

(2) to understand the most likely severe accident sequences that could occur.

(3) to gain a qualitative understanding of the overall probability of core damage and fission product releases.

(4) if necessary, to reduce the overall probability of core damage and fission product releases by modifying hardware and procedures that could help prevent or mitigate severe accidents.

The Waterford 3 IPEEE project has been completed and the objectives of the IPEEE have been met. This document summarizes the evaluation of the external events and constitutes the Waterford 3 IPEEE submittal. The guidance provided in NUREG-1407 (see Reference 1-4) has been used to prepare this document.

i i

1.2 PLANT FAMILIARIZATION i

The Waterford 3 Nuclear Power Plant is a Combustion Engineering designed pressurized water t

reactor located on the Mississippi River west of New Orleans, Louisiana. The rated thermal power level is 3410 MWt with a gross electrical output of 1153 MWe. Commercial operation began in the Fall of1985.

Page 1-1

e I

The NSSS is designed with two U-tube steam generators and four reactor coolant pumps.

Nominal reactor coolant system (RCS) pressure is 2250 psi and average RCS temperature is 5740F at full power. Overpressure protection is provided by two safety relief valves on the pressurizer that lift at about 2500 psi and discharge to a quench tank. The Waterford 3 design does not include power operated relief valves.

Engineered Safety Features Systems at Waterford 3 are typically divided into two separate and independent trains. Two high pressure safety injection (HPSI) pumps (discharge pressure of about 1400 psi), plus an installed spare pump that can be manually aligned to either train are provided. Each HPSI pump injects into all four RCS cold legs. Realignment of suction for the HPSI pumps to the safety injection sump in containment occurs automatically on a low refueling water storage poollevel signal. Four Safety Injection Tanks (SITS) discharge into the RCS at a pressure of 600 psi. Two low pressure safety injection pumps (discharge pressure of about 200 psi) provide a high flow rate of safety injection water at low pressure. These pumps also provide shutdown cooling flow.

Feedwater to the steam generators is provided by two steam turbine driven main feedwater pumps. Feedwater flow is automatically mnback to about 5% full flow on reactor trip.

Emergency Feedwater consists of two motor driven pumps (flow rate of about 350 gpm) and one steam turbine driven pump (flow rate of about 700 gpm). A large volume of water (well in excess of a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> supply) is available for emergency feedwater. A non-safety auxiliary feedwater pump that is normally used during reactor startup is available as a backup feedwater source.

Condensate pumps can also be used for feedwater if the steam generators are depressurized below the condensate pump discharge pressure.

Offsite power from the utility grid comes into the switchyard from two independent transmission lines through two startup transformers. During normal operation, the plant receives power from the main generator through two unit auxiliary transformers. When necessary, onsite AC power is provided by tv>o independent emergency diesel generators.

Equipment heat loads are removed by a closed Component Cooling Water (CCW) System which rejects heat to the atmosphere through forced air cooling towers. Evaporative cooling towers provide supplemental heat rejection capability when atmospheric or accident conditions warrant.

The containment structure is a large, dry free standing cylindrical steel vessel surrounded by a separate reinforced concrete shield building. Any water entering the containment flows directly to the containment sump which quickly overflows to the reactor cavity. Thus, the Waterford 3 reactor cavity is almost always wet. Two containment spray pumps control containment pressure during an accident and remove heat from the containment by pumping sump water through the containment spray / shutdown cooling heat exchangers. Four containment fan coolers also remove heat from the containment atmosphere to the CCW system.

Page 1-2

r

)

i 1.3 OVERALL METHODOLOGY The methodology employed for the IPEEE was consistent with the guidance in NUREG-1407.

For seismic events, the reduced-scope seismic margins analysis (SMA) was used, in accordance with Section 3.2 of the NUREG. The fire evaluation was done using the EPRI-sponsored Fire Induced Vulnerability Evaluation (FIVE) [Ref.1-6]. This methodology falls under Section 4.3 of the NUREG. The NRC staff endorsed the FIVE methodology in a Staff Evaluation Report [Ref.

1-7], provided that cenain enhancements were made. These enhancements were incorporated by EPRI into Revision 1 of the FIVE methodology [Ref.1-8], which was used in the Waterford 3 IPEEE. Probabilistic Risk Assessment (PRA) techniques were used produce a realistic estimate of the Core Damage Frequency (CDF) due to fires. The evaluation of other external events (high winds, floods, and transportation and nearby facility accidents) was performed using the screening approach described in Section 5 of the NUREG.

The methodology used in performing the IPEEE is described in more detail in Section 2.3 of this repon and completely in the sections for each external event (Sections 3 and 5).

1.4

SUMMARY

OF MAJOR FINDINGS 1

1.4.1 Seismic Waterford 3 used an IPEEE reduced scope Seismic Margins Analysis (SMA) that concentrated on walkdowns to identify potential seismic vulnerabilities for equipment, large tanks, distribution systems, and structures. No seismic vulnerabilities were identified. The walkdowns resulted in no outliers that are operability issues at the plant. However, there were three unresolved issues at the completion of the walkdowns. These issues are not significant to seismic risk and are being made to conform with standard practice in seismic design. The issues, proposed resolution, and schedule follow:

Issue Proposed Resolution Schedule Loose items in the Remove or restrain loose items in the Complete a modification Control Room vicinity of safety-related cabinets package by February 15,1995 Station air pipe not Formally evaluate the reasons why Complete by March 30,1995 meeting clearance the existing condition is acceptable.

requirements Storr.p of temporary Revise Transient Combustibles and Complete by April 1,1995 equipment Designated Storage Areas procedure Page 1-3

1.4.2 Internal Fires The Waterford 3 plant was divided into 45 fire areas and 51 fire compartments. The FIVE methodology uses a conservative screening approach in which all equipment associated with cables in an area are initially assumed failed by a fire. Any areas with low core damage frequencies, even with the conservative assumptions in FIVE, are not risk-significant and are " screened out." After completion of the screening process, there were 10 fire compartments not screened out: RAB 1 A, RAB IE, RAB 2, RAB 6, RAB 7, RAB 8, RAB 15, RAB 31, RAB 39, and the Turbine Generator Building (TGB).

These areas were evaluated further using the fire modeling capabilities of the FIVE methodology to determine which essential cables could actually be failed by fires in the areas. The FIVE fire initiating event frequencies and modeling results were used with the Waterford-3 Probabilistic Risk Assessment (PRA) model to estimate the Core Damage

' Frequencies (CDFs) due to fires.

The total CDF due to fire was estimated to be 7.0E-6 per year. The contribution ofindividual fire areas to the total CDF is shown in Figure 1-1. The most important fire areas are the control room (RAB-1 A), the essential chillers room (RAB-2), and the reactor auxiliary building (RAB) switchgear room (RAB-8).

Based on the following points, there are no fire vulnerabilities at Waterford 3.

I 1)

No individual fire scenario has a core damage frequency greater than 2.0x10-6 (i.e.,

less than lx10-4).

2)

No individual tire scenario contributes more than 31% of the total core damage l

frequency due to fires.

3)

No unusual and significant failures were found.

The total estimated core damage frequency due to fire of 7.0E-6 per year is over an order of magnitude lower than the NRC staffs core damage frequency objective of 1E-4 per year. This core damage frequency is less than half of the IPE core damage frequency for internal events, fwther indicating that Waterford 3 does not have an unusual core damage risk due to fire. The TGB switchgear fire on June 10,1995, was evaluated and found not to pose a significant core damage risk.

The internal fire evaluation identified a potential plant improvement that would reduce the likelihood of core damage due to a fire. In the essential chiller room (RAB-2), a fire on Chiller A or Chilled Water Pump A could damage cables associated with Chiller train B. Although the Page 1-4

Figure 1-1 Dominant Fire Areas for Waterford 3 l

l Switchgear Room Others (RAB-8) 18%

22Y.

(

Chiller Room (RAB-2)

(

29%

l Page 1-5

l design meets the requirements of Appendix R, due to the availability of the AB train during this scenario, the robustness of the plant to fire hazards in this fire area could be improved by adding fire wrap to the B Chilled Water cables in the vicinity of the A Chiller. This potential improvement will be evaluated as part of the overall severe accident management program.

1.4.3 High Winds, Floods, and Transportation and Nearby Facility Accidents The IPEEE found no high winds, floods, or off-site industrial facility accidents that significantly alters the Waterford 3 estimate of either the core damage frequency, or the distribution of containment release categories. The IPEEE concludes that the plant is in conformance with the 1975 SRP that pertains to high winds, on-site storage of hazardous materials, and off-site developments.

1.4.4 Proposed Resolution Of USIs And GIs The stated purpose of Unresolved Safety Issue (USI) A-45 (see Reference 1-5) is to " evaluate the adequacy of current designs to ensure that LWRs do not pose unacceptable risk as a result of DHR [ decay heat removal] system failures." No DHR vulnerabilities were found for seismic, fire, high wind, flood, and nearby facility accident events. Therefore, USI A-45 should be considered resolved for Waterford-3 with respect to external events.

Generic Issue (GI) 131 is not applicable, since Waterford-3 is a Combustion Engineering plant.

Waterford-3 is not a USI A-46 plant, so USl A-46 is not applicable. The issue of spatial interaction, however, has been addressed as part of the reduced scope SMA.

The Waterford 3 IPEEE has not been used to evaluate any other USIs or GIs.

REFERENCES 1-1.

Generic Letter No. 88-20, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," USNRC, November 23,1988.

1-2.

NUREG-1335, " Individual Plant Examination: Submittal Guidance," USNRC, August 1989.

Page 1-6

l t

i i

1-3.

. Generic Letter No. 88-20, Supplement 4, " Individual Plant Examination of External l

Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," USNRC, June 28,1991.

1-4.

NUREG-1407, " Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," USNRC, June 1991.

l-5.

NUREG-1289, " Regulatory and Backfit Analysis: Unresolved Safety Issue A-45, Shutdown Decay Heat Removal Requirements."

l 1-6.

Fire-induced Vulnerability Evaluation (FIVE), EPRI TR-100370 Project 3000-41, April l

1992.

j 1-7.

Letter, Ashok C. Thadani (NRC) to William H. Rasin (NUMARC), "NRC's Staff.

Evaluation Report on Revised NUMARC/EPRI Fire Vulnerability Evaluation (FIVE)

Methodology," August 21,1991.

1-8.

Letter dated 9/29/93 to NUMARC Contacts from William H. Rasin, " Revision 1 to EPRI Final Report dated April 1992, TR-100370, Fire Induced Vulnerability Evaluation Methodology".

Page 1-7

2.

EXAMINATION DESCRIPTION

2.1 INTRODUCTION

For Waterford 3, the plant specific examination requested by the IPEEE Generic Letter, Supplement 4, has been carried out.

The following sections provide a description of the Waterford 3 IPEEE, presented first from the perspective of how the examination conforms with the IPE Generic Letter, next from the perspective of technical organization and methodology, and then from the perspective of the information assembled to carry out the examination.

2.2 CONFORMANCE WITH GENERIC LETTER AND SUPPORTING MATERIAL NRC Generic Letter 88-20, Supplement 4, states that five external events should be assessed:

seismic events, internal fires, high winds and tornadoes, external floods, and transportation and nearby facility accidents. The Waterford 3 IPEEE has assessed these events. Supplement 4 further specifies the acceptable methodologies:

Seismic Generic Letter 88-20, Supplement 4, specifies: Seismic PSA, NRC Seismic Margins Method (SMM), or EPRI SMA (through the walkdown phase for reduced scope plants). The Waterford 3 IPEEE used the EPRI SMA through the walkdown phase and meets the generic letter requirement.

Internal Fires Generic Letter 88-20, Supplement 4, specifies: Level 1 Fire PRA, Simplified Fire PRA, or other methodology approved by the NRC. The FIVE approach was subsequently approved by NRC

[Ref.1-6]. The Waterford 3 IPEEE used the FIVE methodology, with improvements required by the NRC staffin their Staff Evaluation Report [Ref.1-6].

High Winds. Floods. and Transportation and Nearby Facility Accidents Generic Letter 88-20, Supplement 4, describes a screening type approach. The Waterford 3 IPEEE used the specified screening approach.

In performing the IPEEE at Waterford 3, the guidance provided by GL 88-20, Supplement 4, and NUREG-1407 was considered. The examination process not only met the Waterford 3 and Page 2-1 i

l IPEEE objectives for severe accident assessment, but also provided the framework for effective participation of the Waterford 3 staff.

The NRC encouraged utility staff participation in IPEEE preparation. With the exception of the seismic evaluation, all of the IPEEE was performed by Waterford 3 staff. The seismic evaluation utilized the expertise of a recognized seismic consultant. Utility personnel prepared the seismic i

safe shutdown equipment list, participated in the walkdowns, and provided detailed review and comment to the seismic consultant. This ensures that knowledge and skills gained during the evaluation would be retained in-house so insights and lessons learned could be incorporated into plant procedures and programs more expeditiously.

The Waterford 3 IPEEE was put into an independent peer review. The seismic peer review was performed by seismic experts at the seismic consulting firm who were not involved in the IPEEE evaluation. The fire events peer review was performed by a fire protection engineer at another Entergy nuclear plant (ANO) and by a Waterford-3 fire protection engineer who was not involved in the IPEEE. Review of the PRA portion of the fire evaluation (the determination of redundant train unavailablities) was performed by a Waterford 3 PRA engineer who had no involvement in the fire evaluation. The evaluation of other events were independently reviewed by Waterford 3 personnel. These reviews ensured the accuracy of the IPEEE process and its results.

2.3 GENERAL METHODOLOGY i

1 2.3.1 Seismic Events Waterford 3 developed and implemented a program to satisfy requirements of the IPEEE seismic evaluation. The program implemented an IPEEE reduced scope Seismic Margins Analysis (SMA) l that concentrated on walkdowns to identify potential seismic vulnerabilities for equipment, large tanks, distribution systems, and structures. The basic requirement for walkdowns was that the equipment, tanks, distribution systems, and structures be able to withstand the design basis Safe Shutdown Earthquake (SSE) at the plant and still provide its safe shutdown function. The SMA uses primarily EPRI report NP-6041-SL as guidance, which is not overly prescriptive but relies on the judgment of an experienced team to meet the basic requirement.

A Safe Shutdown Equipment List (SSEL), using safety and non-safety-related components, was selected for achieving and maintaining plant shutdown in accordance with plant operating.

procedures. The SSEL also included items that are potential seismic-induced fire and seismic-induced flood sources within the plant.

Seismic Verification Data Sheets that included each equipment item of the equipment list were developed. These sheets contain walkdown observations as well as screening results. There were Page 2-2

three walkdowns performed: the Train "B" on-line walkdown during November of 1993, the Train "A" on-line walkdown during 1994, and the outage walkdown during March 1994.

l 2.3.2 Internal Fires The evaluation ofinternal fires was performed in two major parts: a conservative screening using the EPRI FIVE methodology and a realistic fire PRA evaluation of the unscreened areas.

FIVE Screening The FIVE method is a progressive screening approach. It quantifies: (1) the frequencies of fire ignition in specific plant areas, (2) the availability of automatic suppression systems, (3) the availability of redundant or alternate safe shutdown systems, (4) the probability of having sufficient combustibles and heat release to cause damage to shutdown systems, and (5) the probability of manual suppression effectiveness. This analysis considers all Waterford 3 plant areas. The evaluation places emphasis on estimating the fire ignition frequencies and availability of safe shutdown equipment previously identified through compliance with 10CFR50 Appendix R. The methodology uses a core damage frequency screening level of IE-06. Fire Areas or Compa tments with frequencies less than 1E-06 at any point in the process were screened and further analysis was not required.

I Fire PRA Evaluation of Unscreened Areas The areas that did not screen in the FIVE evaluation were evaluated further udng the fire modeling capabilities of the FIVE methodology to determine which essential cables could actually be failed by fires in the unscreened areas (FIVE initially assumes that all cables in an area are failed). These FIVE modeling results were used to refine the list of failed systems in the calculation of redundant train unavailability (which used the Waterford-3 Probabilistic Risk Assessment (PRA) model). For example, in an area with many cables and fire sources, FIVE assumes that any fire would fail all the cables in the area. Fire modeling, however, might show that one pump would fail one particular train of EFW and nothing else, and one electrical cabinet would fail another particular train of EFW. For these cases, fire scenarios were developed, and the PRA model was quantified for these cases. Then the fire frequencies for the sources in each scenario were estimated and the probability of each scenario was calculated by multiplying the scenario fire frequency by the conditional core damage probability for the scenario. The total core damage probability for the area was the sum of the scenario probabilities.

Page 2-3 i

2.3.3 High Winds, Floods, and Transportation and Nearby Facility Accidents The IPEEE used the screening approach described in Generic Letter 88-20, Supplement 4.

i Waterford 3 searched for significant changes in the probability for high winds, floods, or off-site industrial facility accidents. The original licensing action for Waterford 3 considered all manner of winds, floods, and industrial accidents. The focus of this part of the IPEEE submittal is: "does the plant meet acceptance criteria listed in the 1975 SRP in terms of high winds, on-site storage of j

hazardous materials, and off-site developments?" The original licensing action for Waterford 3 used the 1975 SRP as a basis for finding Waterford 3 acceptable in terms of external hazards with a few exceptions that the NRC reviewed and accepted. The exceptions are technical rather than substantive, e.g., the SRP recommended technique for calculating tornado loading on the shield building was not appropriate given the shallow dome roof of the shield building.

The Waterford 3 staff reviewed the assumptions in FSAR Chapter 2 with respect to external event j

initiating frequency. Whenever that frequency is explicit in the FSAR, it is compared to the IPE Level 1 initiating event frequencies. If the external event frequency were small compared to the related Level 1 initiating event frequency, then the external event has an insignificant affect on our estimate of both the core damage frequency and distribution of containment release categories.

When the external event initiating frequency is indeterminate, the review of"High Winds, Floods, and Others" describes the plant design features and related basis with respect to external events.

Note, the external events are typically a subset of the Level 1 initiating events. For example, storm damage that causes a loss of off-site power is part of the Level 1 assumption behind the transient initiator T5.

As a further review of plant specific hazard data and licensing bases, the Waterford 3 staff also qualitatively reviewed the extemal events postulated in FSAR Chapter 2 against spectacular events in southeast Louisiana. We sought assurance that the postulated events bounded the spectacular events since initial plant startup.

The final part of the review method re-visited the 10 CFR 50.59s written since initial plant start-up regarding changes that exposed the plant to new external hazards, e.g., a new hydrogen gas pipeline across the site. The probability and consequences of the new configuration is qualitatively related to either FSAR Chapter 2 assumptions or IPE assumptions. Insignificant changes in this group are those that change neither the estimate of the core damage frequency, nor the distribution of containment release categories.

l 2.4 INFORMATION ASSEMBLY At the start of the project, a list of specific information needed to begin the IPEEE was established. A list of some of the information assembled includes:

Page 2-4

l i

4 Final Safety Analysis Report Piping and Instrumentation Drawings General Arrangement Drawings j

System Design Basis Documents Plant Procedures Associated Circuits Analysis / Cable and Conduit List (ACA/CCL)

Station Information Management System (SIMS) Component Database.

Safe Shutdown Equipment List Controlled drawings and procedures, that are updated after plant modifications, were used by the IPEEE team. This ensures that the most recent and accurate information on plant configuration and operation was incorporated. Plant walkdowns were performed for the seismic and fire evaluations to ensure that the evaluations represented the as-built plant. The evaluation of other external events included a review of plant changes since the original license issuance.

Finally, coordination ofIPEEE activities was facilitated by giving overall project responsibility and oversight to a single group. A key area ofcoordination was for seismically induced fires. Here, the seismic analysts worked together with fire protection engineering personnel to ensure that seismic-induced fire interactions were addressed in the evaluation of seismic events.

Page 2-5

i 3.

SEISMIC ANALYSIS 3.0 METHODOLOGY SELECTION i

Waterford 3 Nuclear Station is classified a reduced scope plant as defined NUREG-1407 based on the low seismicity. Therefore, a seismic review of the plant was performed to the plant's original design basis. This was accomplished by performing a Seismic Margins Assessment (SMA) of the Safe Shutdown Equipment List (SSEL) with plant walkdowns in accordance with the guidelines and procedures documented in Electrical Power Research Institute (EPRI) Report NP-6041-SL.

Since Waterford 3 Nuclear Station is a reduced scope plant, the original design basis Safe Shutdown Earthquake (SSE) ground response spectra and corresponding in-structure response spectra were used as the Review Level Earthquake (RLE) input for the walkdown and evaluation, as requested by NUREG-1407. No new in-structure response spectra were developed and those described in the Waterford 3 Nuclear Station Final Safety Analysis Report (FSAR) were utilized.

Safe shutdown success paths were developed to identify the systems that must function to successfully shutdown and cool the reactor following the occurrence of a SSE. A safe shutdown success path is a string of systems which is used to accomplish all of the required safe shutdown functions.

3.1 SEISMIC MARGINS METIIOD (REDUCED SCOPE)

In the Commission policy statement on severe accidents in nuclear power plants published August 8,1985 (50 FR 32138), the Commission concluded, based on available information, that existing plants pose no undue risk to the public health and safety and that there is no present basis for immediate action for any regulatory requirements for these plants. However, the Commission convinced itself, based on NRC and industiy experience with plant-specific probabilistic safety assessments (PSAs), of the need for a systematic examination of each existing plant to identify any plant specific vulnerabilities to severe accidents.

For the seismic evaluation, two alternative methodologies are acceptable to identify potential seismic vulnerabilities. The first is a Seismic Probabilistic Safety Assessment (SPSA). The second is one of the Seismic Margins Assessments (SMA) described in

References:

"The NRC method" and "The EPRI method" Waterford 3 chose to implement the EPRI Seismic Margins Method option as appropriate for a reduced scope pitnt as defined in NUREG/1407F to satisfy the IPEEE Seismic evaluation.

The NRC has also anticipated the coordinated hand. ling of the IPEEE with completion of other related issues such as USI A-45, " Shutdown Drey Heat Removal Requirement." The influence of the coordinated issues on the Waterford 3 response to the seismic portion of the IPEEE is included in the SMA for this project.

The reduced scope SMA consists of developing a Safe Shutdown Equipment List (SSEL) using the EPRI SMA methodology (see Reference 3.1). The seismic review of the plant used the plant's original design basis. The plant walkdown is the critical element of the SMA. The screening Page 3-1

1 i

methods and criteria described in EPRI NP-6041-SL as appropriate for a reduced scope SMA are part of this report.

3.1.1 Review of Plant Information, Screening, and Walkdown 1

3.1.1.1 General Plant Description The Waterford-3 site is on the west (right descending) bank of the Mississippi River near Taft, Louisiana in the northwest portion of St. Charles Parish. About three miles westward is the eastern boundary of St. John the Baptist Parish. The coordinates for the reactor are 29 59' 42" j

north latitude, and 90 28' 6" west longitude.

The site consists of over 3,000 acres of flat land extending from the Mississippi River to the St.

i Charles Drainage Canal. The site includes about 7500 feet of river frontage. About 3,000 feet back from State Road 18, adjacent to the levee, the Missouri Pacific Railway crosses the width of l

the property. The plant area is on a raised final grade of+17.5 ft. MSL around the Nuclear Plant Island Stmeture, and +14.5 ft. MSL around the Turbine Building. Structures housing safety-related equipment are flood protected to elevation +29.25 ft. MSL.

3.1.1.2 Site Geolony The geologic studies of the site and surrounding area were based on interpretations of geologic literature, geologic maps, topographic maps, remote sensing data, surface mapping, subsurface borings, geophysical reflection and refraction surveys, geophysical logs and laboratory tests.

The site and surrounding area lie within the Mississippi River Deltaic plain physiographic

)

province. The deltaic plain has a flat topography near sea level, with extensive areas covered by water, swamp, or marsh. In the site and surrounding area, the physiography is dominated by the present Mississippi River. The site is on the outside or eroding bend of the river, between miles 129 and 130 Above Head of the Passes. At the site, the Mississippi River has a maximum depth of about i10 feet and is 2200 feet wide.

The site is almost entirely upon the natural levee of the Mississippi River. The southwest portion of the property, about two miles southwest of the plant site, is fresh-water swamp adjacent to the natural levee. The surface elevations of the natural levee on the property range between near sea j

level in the southwestern portion to about 14 ft. MSL near the river, at the base of the man-made, flood-control levee. The crest of the Mississippi River flood-control levee, which is the highest point on the site, is about +30 ft. MSL. The lowest elevations on the site occur in the swamp at the southwestern end of the property. In this area, elevations are one to two feet above sea level.

Page 3-2

The geologic structures that exist near the site developed in thick sedimentary sequences. They consist of non-tectonic structures associated with salt and clay mobilization and growth faults associated with sediment instability at the shelf edge.

' Faulting in the site and surrounding area was thoroughly investigated by analyzing existing

. subsurface data, including the spontaneous potential and resistivity logs of 151 oil wells; the records of ten deep seismic reflection lines; and the analysis of various published and unpublished geologic maps.

1 Analysis of the electric logs of the oil wells allowed the identification of several continuous (across the site area) and correlatable marker horizons. On the basis of these correlations, several graphic interpretations were derived including locations of the sedimentary structures near the site. Geologic sections using selected oil wells show buried stmetures and the attitude of bedding. The structures within five miles of the site include the west flank of the Good Hope salt dome and its associated faulting and seven growth faults that are a portion of the fault trend designated as the Grand Chenier fault system in western Louisiana.

The nearest salt dome to the site is the Good Hope dome that is centered about six miles east of the site. It is a piercement type of salt dome buried by 9580 A. of Miocene and younger sediments. The sediments overlying the dome were uplifted and were faulted by the rising salt mass during the period ofits development. Salt dome uplift ceased during the Miocene epoch (5.5 to 22.5 Million Years Before Present). Active petroleum production is occurring from numerous wells drilled in the uplifted and faulted dome.

The excavation for the Waterford-3 seismic Category I structural mat was cut 60 ft. deep to approximately elevation -48 ft. MSL. The excavation, which exposed the upper several feet of the Pleistocene Prairie formation over an area 380 ft. by 267 fl. was mapped in detail. In the excavation, the Prairie formation at foundation level consists of horizontally bedded layers of silts and clays. The conditions encountered compare very favorably with the data taken from site borings. Mapping of the excavation disclosed no anomalies or discontinuities that may adversely affect the integrity of the foundation materials.

In performing the geologic studies of the site and surrounding areas, various forms of remote sensing data supplement surface and subsurface data. The purpose of this analysis was (1) to aid in the interpretation of depositional history of this portion of the Mississippi River deltaic plain and (2) to determine whether surficial expression exists for any of the deep underlying geologic structure.

Laboratory testing determined the engineering properties of the detailed descriptions of the soil j

types encountered by the site boring program. No zones of alteration or irregular weathering exist in the site area.

Over 40,000 fl. of mostly unconsolidated sediments lie above the crystalline basement rock beneath the site. No unrelieved residual stresses exist in the unconsolidated foundation materials.

No materials exist at the site that could be unstable due to their mineralogy.

Page 3-3

~ -

T 3.1.1.3 Nuclear Steam Supply System and Containment Structure

- The nuclear steam supply system (NSSS) is a pressurized water reactor system designed by Combustion Engineering Incorporated. The containment structure is a free-standing steel containment vessel surrounded by a reinforced concrete shield building all designed by Ebasco Services Incorporated.

11.1.4 Maior Structures The major structures include the Reactor Auxiliary Building, Fuel Handling Building, Cooling Towers, and Containment Building.

Ll.l.5 Principal Design Criteria Principal structures, systems and equipment that may serve either to prevent accidents or to mitigate their consequences are designed and are erected in accordance with applicable c' odes to-withstand the most severe earthquakes, flooding conditions, windstorms, temperature and other deleterious natural phenomena that may occur at the site during the lifetime of the plant. Principal structures, systems and equipment are sized for the design power level of the nuclear supply system output, i.e., 3390 Mwt.

Redundancy in the reactor protective and safety feature systems means no single failure of any active component of the system can prevent action necessary to avoid an unsafe condition. The plant design facilitates inspection and testing of systems and components whose reliability are important to the protection of the public and plant personnel.

The seismic Category I structures consist of the following:

a)

Reactor Building (comprising a free standing steel containment vessel, a containment internal structure and a reinforced concrete Shield.

1 b)

Reactor Auxiliary Building c)

Fuel Handling Buildiug d)

Component Cooling Water System Structure j

All seismic Category I structures are in a common structure, the Nuclear Plant Island Structure.

It is a rectangular box-like reinforced concrete structure 380 n. long,267 A. wide and extending 64.5 R. below grade.

Page 3-4

A 3.1.1.5.1. Containment Design Criteria

. The Containment System does not utilize a concrete containment. The primary containment is a free standing steel pressure vessel surrounded by a reinforced concrete Shield Building. The Shield Building is a seismic Category I structure.

The containment vessel, including all its penetrations, is a low leakage steel shell that can withstand the postulated loss of coolant accident and can confine the postulated release of radioactive material. Systems directly associated with the containment vessel are the Containment Spray System, the Containment Cooling System, and the Containment Isolation System.

The containment vessel is a cylindrical steel pressure vessel with hemispherical dome and j

ellipsoidal bottom. It houses the reactor pressure vessel, the reactor coolant piping, the pressurizer, the quench tank, the reactor coolant pumps, the steam generators, and the safety injection tanks. It is completely enclosed by the reinforced concrete Shield Building. An annular space between the walls and domes of the containment vessel and the concrete Shield Building permits construction operations and in-service inspection. The containment vessel is an independent free standing stmeture, rigidly fixed at its base near the elevation ofits bottom spring line. The containment vessel rests on a concrete base that was placed after the cylindrical shell and the ellipsoidal bottom were constructed and post weld heat treated. Both the Shield Building l

and the containment vessel rest on a common foundation mat. With the exception of the concrete placed underneath and near the knuckles at the sides of the vessel, there are no structural ties between the containment vessel and the Shield Building above the foundation slab. Therefore, there is virtually unlimited freedom for differential movement between the containment vessel and the Shield Building above the top of the concrete base at elevation -1.50 ft. MSL. Concrete floor fill was placed above the ellipsoidal shell bottom after the vessel has been post weld heat treated, to anchor the vessel.

The cylindrical portion of the steel containment shell has a minimum thickness of 1.903 in. on ar.

inside radius of 70 ft The polar crane girder support plates are welded to the shell liner at approximately six ft. on center. Except for some miscellaneous platform framing and some minor seismic restraints, no major floor framing or seismic restraint supports are attached to the shell liner. Immediately below the crane girder, a heating and ventilating duct approximately 6'-6" wide x 8'-0" deep, running the entire containment circumference, is structurally supported and attached to the shell by means of welded clips. The containment shell also supported temporary construction loads from the pedestal cranes. The 1.903 in. minimum shell plate thickness increases to a minimum of four in adjacent to all penetrations and openings. The inside radius of the hemispherical dome is 70'-15/32 in. with a dome plate of 0.95 in. thick connected to the cylindrical portion of the shell at the tangent line by means of a full penetration weld. The containment spray piping is attached to the dome by means of welded clips as are the dome inspection walkway and platforms. The Shield Building protects the containment vessel from external missiles. Protection from internal missiles is provided by the primary and secondary shield walls and other containment internal structures.

l Page 3-5

f The function of the containment piping penetration assemblies is to provide for passage of i

process, service, sampling and/or instrumentation pipe lines into the reactor containment vessel, while maintaining the desired containment integrity and providing a leak-tight seal.

i The materials used for penetrations, including the personnel access air locks, the equipment access hatch, the piping and duct penetration sleeves and the electrical penetration sleeves conform with the requirements set fonh by the ASME Boiler and Pressure Vessel Code.

j A 14 ft. diameter equipment hatch provides equipment access. This is a welded steel assembly, with a double gasketed flanged and bolted cover. Provision is made to pressure the space between the double gaskets to 44 psig. Two personnel air locks are provided. These are welded steel assemblies. Each lock has two double gasketed doors in series. Provision is made to pressurize the space between the gaskets. The doors mechanically interlock to ensure the one door cannot open until the second door seals.

The containment vessel was designed, fabricated, erected, and tested in accordance with the requirements of Section III, Subsection NE of the ASME Code for Class "MC" Components, 1971 Edition, up to and including Summer 1971 Addenda, and Code cases 1431,1454-1 and i

1517 as approved by Regulatory Guides 1.84 and 1.85. The design, fabrication and erection of suppons and bracing and similar structures not within the scope of the ASME Code conform to the requirements of the AISC specifications, except that the welding, welding procedures and welders' qualifications are in accordance with the ASME Code Section IX.

The design, fabrication, erection and testing of the containment vessel shall also conform to the ASME Boiler and Pressure Vessel Code,Section II " Material Specifications," and Section Vill "Unfired Pressure Vessels."

i The containment vessel is code stamped in accordance with Paragraph NE-8000 of Section III of the ASME Boiler and Pressure Vessel Code.

The vessel exhibits a general elastic behavior under accident and earthquake conditions ofloading.

No permanent deformations due to primary stresses have been permitted in the design under any condition ofloading. The design of the Containment vessel was based on permissible stresses as set forth in the applicable codes. The structure will safely function within the normal design limits as specified in Section III of the ASME Boiler and Pressure Vessel Code Article NE-3000 i

" Design" and Regulatory Guide 1.57 (June 1973), Design Limits and Loading Combinations for Metal Primary Reactor Containment Systems Components.

The polar crane is for erecting the major nuclear supply system equipment ar'd for servicing and refueling when the plant is in operation. The crane loads and its built up ring girder support are carried by the steel containment vessel cylindrical walls.

i Restraint framing is provided for all pipes, equipment, electrical trays and heating and ventilating ducts where failure of any of these items could effect the safe shutdown of the reactor.

Page 3-6

3.1.1.S.2 Design Criteriafor Other Category I Structures 3.1.1.5.2.1 Shield Building The Shield Building, is a reinforced concrete structure constructed as a right cylinder with a shallow dome roof. It has an outside diameter of 154 A. and a height from base slab to the top of the dome of 249.5 ft The thickness of the wall is three ft except at the base (below elevation

-18.17 ft MSL) where it is 10.0 ft thick to provide support for the construction of the containment vessel. A nominal four ft annular space exists between the interior face of the concrete shield structure walls and the outside face of the steel containment. This space provides the means of collecting and diluting any leakage from the containment vessel following a LOCA.

A 4.0 ft nominal clearance between the bottom face of the concrete shield structure dome and the top of the steel containment dome allows for access for construction and inspection and to assure freedom of movement of the steel containment.

The Shield Building is a free standing stmeture without any structural ties between it and the containment vessel above the foundation level. A concrete fillin the bottom of the structure '

supports the steel containment. The Shield Building serves the following functions:

a) as a biological shield during normal operation and after any accident within the steel containment up to and including the postulated loss of coolant accident, b) as a low leakage structure following any accident within the steel containment up to and including postulated LOCA, and c) as a shield for the primary steel containment for adverse external environmental conditions due to low temperatures, wind, tornadoes, and external missiles.

The Shield Building is designed to seismic Category I requirements. During normal operation, the Shield Building is maintained at a negative pressure by the Annulus Negative Pressure System.

After LOCA, the pressure in the annular space will increase due to thermal energy transfer from the containment vessel. This pressure increase will be vented by the Shield Building Ventilation System.

3.1.1.5.2.2 Reactor Auxiliary Building The Reactor Auxiliary Building is a multistory reinforced concrete structure located immediately south of the Reactor Building. The interior floor construction is a beam and girder constmetion supported by reinforced concrete columns. The building occupies an area approximately 260 ft by 219 ft and extends from the top of the common mat at elevation -35 ft. MSL up to rooflevels varying from elevation +46 ft MSL to elevation +106.5 ft MSL. Above the common mat, the ljuikling is structurally separated from the centrally located Reactor Building at all levels.

Page 3-7

t

'The Reactor Auxilia y Building houses the waste treatment facilities, engineered safeguards systems, switchgear, laboratories, diesel generators and main control room. It further provides protection to the cable and piping penetration areas of the Reactor Building. The building exterior walls, floors, and interior partitions provide plant personnel with the necessary biological radiation shielding, and protects the equipment from adverse atmospheric conditions such as winds, temperature, and missiles. The condensate and refueling water storage pools are an inte;;ial part of the building.

. The Reactor Auxiliary Building is seismic Category I compliant considering the loads and loading combinations for abnormal / extreme environmental conditions. The building is protected against exterior flooding up to elevation +29.25 A. MSL 3.1.1.5.2.3 Fuel Handling Building The Fuel Handling Building is a reinforced concrete stmeture located immediately north of the l

Reactor Building. It occupies an area approximately 73 A. by 117 A. and it extends from the top of the common foundation mat at elevation -35 A. MSL to the rooflevel at elevation +94 A.

- MSL. Above the common mat the building is structurally separated from the Reactor Building at all levels.

The Fuel Handling Building houses a spent fuel pool, spent fuel pool pumps, spent fuel pool heat exchanger, backup fuel pool heat exchanger, spent fuel pool purification pump and heating and ventilating equipment. The building also provides space for the new fuel vault and decontamination area for spent fuel casks, and miscellaneous equipment. The spent fuel pool is a stainless steel-lined reinforced concrete tank structure that provides space for storage of spent fuel, spent fuel casks and miscellaneous items.

The Fuel Handling Building exierior walls, floors, and interior partitions provide plant personnel with the necessary biological radiation shielding and protect equipment from the effects of adverse atmospheric conditions such as winds, temperature, missiles, flooding and corrosive environment.

The Fuel Handling Building is seismic Category I compliant, considering the loads and loading combinations for abnormal / extreme environmental conditions.

3.1.1.5.2.4 Component Cooling Water System (CCWS) Structure Component Cooling Water System (CCWS) structure comprises two independent sets of dry and wet cooling towers located on the east and west side of the Reactor Building. Each set of dry and wet cooling towers consists of a reinforced concrete box structure with overall dimension 37 A.

by 103 A. and 26 A. by 57 A., respectively. An access to the equipment hatch of the Reactor Building is provided in the west CCWS structure.

Page 3-8

i i

The cooling towers are supported on the common mat at elevation -35 R. MSL and extend in height to elevation +29.25 ft. MSL.

Each dry cooling tower is further subdivided into five reinforced concrete chambers and is equipped with three fans supported on the walls at different levels in each chamber (totaling 15 l

fans). Each wet cooling tower has two reinforced concrete chambers. The minimum thickness of

' the walls is two ft. with 3.5 ft. thick walls supporting the fans.

The CCWS structure is seismic Category I compliant, considering the loads and loading combinatico for abnormal / extreme environmental conditions.

3.1.1.5. 3 Design Criteriafor Category I Systems amiEquipment System components important to safety and the containment boundary are classified in accordance with ANSI N18.2, " Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," 1973, and ANSI N18.2a, " Revision and Addendum to Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," 1975.

System safety classifications and design and fabrication requirements meet the intent of.

Regulatory Guide 1.26, " Quality Group Classifications and Standards for Water, Steam, and Radioactive-Waste-Containing Components of Nuclear Power Plants," June 1975, with a clarification noted for the reactor coolant pump bearing oil and cooling systems. Equipment that is not designed and built to the exact ASME Code specified in Regulatory 1.26 has been specified and listed in the FSAR.

3.1.1.6 Seismic Desian Bas _i.s 3.1.1. 6.1 Site Seismicity Epicentral locations for all recorded earthquakes in the central Gulf Coastal Plain, including the Mississippi embayment, which have a reported intensity of about IV-V Modified Mercalli (MM) or greater, have been investigated. Historic earthquake data were assembled between latitude 27.5 to 37.3 North and longitude 86 to 96 West. The earthquake data is a compilation of U.S. Department of Commerce reports on U.S. Earthquakes,1928 through 1972 the Earthquake History of the United States revised through 1970 and Preliminary Determination of Epicenters Listing issued by the U.S. Geological Survey and other reports.

Ten small earthquakes have occurred within about 200 miles of the site. The earthquakes that have occurred are considered non damaging to equipment and distribution systems properly installed to industrial standards. The equipment and distribution systems at Waterford 3 are designed and installed to much more stringent seismic criteria.

Page 3-9

The uniform building code designates the vicinity of the site as Zone 0 (on the map entitled " Map of the United States Showing Zones of Approximate Equal Seismic Probability"). The U.S. Coast and Geodetic Survey indicates Zone 0 as an area of no earthquake damage.

3.1.1. 6.2 Seismic input to Structures and Equipment The seismic design was based on the acceleration ground response spectrum curces for the operational basis earthquake, OBE, and for the Safe Shutdown Earthquake, SSE. The curves were normalized to 0.05g for the OBE and 0.10g for the SSE. The FSAR commitment for an SSE of 0.10g is the legal minimum specified by 10CFR100 Appendix A. Thb very conservative surface acceleration is double the maximum acceleration appropriate for the maximura earthquake that has occurred in the site's tectonic province during the past 250 years.

A synthetic earthquake record with a maximum acceleration of 0.10g was developed to generate response spectra in the safety-related structures at Wateiford 3. In simulating the earthquakes, a maximum duration of 20 seconds was used in the model, of which 0 to two seconds is the rising period, two to seven seconds is the constant maximum acceleration peiloti, and seven to 20 seconds is the receding period. These durations mimic the available data on earthquakes in this i

region. The shape of the response spectra of the simulated earthquake for a single degree of freedom approximates N. M. Newmark's Spectrum Curve as discussed in his paper, " Design Criteria for Nuclear Reactors Subject to Earthquake Hazards," Urbana, Illinois, May 25,1967.

The maximum amplification, at two percent critical damping is approximately 3.5, greater than the value shown in the Housner Spectrum of TID 7024, but less than the Newmark value.

The design response spectra used in the plant design differ from the design response spectra recommended in NRC Regulatory Guide 1.60, Design Response Spectra for Seismic Design of Nuclear Power Plants, Revision 1 December 1973. The regulatory guide response spectra have slightly higher values in general. Use of Regulatory Guide 1.60 permits utilization of damping values indicated in Regulatory Guide 1.61, Damping Values for Seismic Design of Nuclear Power Plants, October 1973. These damping values are equal or greater than the values utilized for Waterford-3 plant design. By utilizing lower damping values in the Waterford-3 design, as compared to the damping values of Regulatory Guide 1.61, the analysis and design of Waterford-3 compensate for any differences. The following paragraph describes in further detail why this is true.

The design response spectra used in the plant design produce an amplification factor of 3.5 at two percent damping (for OBE)in the period range 0.15 to 0.5 seconds. The use of Regulatory Guide 1.60 produces an amplification range of 3.54 to 4.25 for the above damping and period range; however, the use of higher damping value allowed by Regulatory Guide 1.61 (four percent for reinforced concrete structures in OBE) results in an amplification factor range of 2.92 to 3.50 for the above period. A similar correlation exists for the SSE. Thus the design response spectra and the damping factors used for the plant design provide an adequate and approximately equivalent basis for seismic design.

l Page 3-10 j

i The horizontal design response spectra for the SSE and OBE are applied at the bottom of the -

f foundation of the common mat of the Nuclear Plant Island Structure, at the top of the Pleistocene l

formation in the free field.

There is no data in the region relating to horizontal and vertical acceleration for strong motion

[

eanhquakes. A vertical acceleration equal to two-thirds of the horizontal acceleration was used in developing the vertical design response spectra.

l i

3.1.1.7 Seismic Review Team (SRT) i The Waterford 3 IPEEE SMA included ajoint engineering effort between the Waterford 3 Design Engineering Depanment staff and the consultant project staff. In addition to the project management and contract management work associated with the use of consultant resources, l

Waterford 3 engineers were integrated with the consultant team in all aspects of the work. The principal areas where Waterford 3 engineering participation was included were in development of l

the SMA success paths, and participation as seismic walkdown team members during the seismic j

screening walkdowns.

l l

The walkdown teams were composed of the following personnel:

On-line Walkdown Train B 11/9/93 - 11/11/93 l

Team 1 -

Mr. George G. Thomas - SRT Walkdown Team Leader - Stevenson & Associates Mr. Greg Ferguson - SRT Member - Waterford 3 Engineering Mr. Steven Farkas - SRT Member - Waterford 3 Engineering, Systems Supports Mr. John Burke - SRT Member - Waterford 3 Engineering Team 2 -

Mr. Stephen Anagnostis - SRT Walkdown Team Leader - Stevenson and Associates Ms. Maria Rosa Gutierrez - SRT Member - Waterford 3 Engineering Mr. Steven Farkas - SRT Member - Waterford 3 Engineering, Systems Supports Mr. John Burke - SRT Member - Waterford 3 Engineering On-line Walkdown Train A 1/25/94 - 1/31/94 Team 1--

Ms. Maria Rosa Gutierrez - SRT - Walkdown Team Leader - Waterford 3 Engineering Mr. Greg Ferguson - SRT Member - Waterford 3 Engineering Mr. Siddarth Munshi - SRT Member - Waterford 3 Engineering j

Outage Walkdown 3/14/94 - 3/17/94 Team 1 -

Mr. George G. Thomas - SRT Walkdown Team Leader - Stevenson and Associates Ms. Maria Rosa Gutierrez - SRT Member - Waterford 3 Engineering Mr. Greg Ferguson -SRT Member - Waterford 3 Engineering Page 3-11

Stmetures Walkdown 3/21/94 - 3/23/94 Team 1 -

Dr. John D. Stevenson - SRT Walkdown Team Leader - Stevenson and Associates Ms. Maria Rosa Gutierrez - SRT Member - Waterford 3 Engineering Mr. John Burke - SRT Member - Waterford 3 Engineering 3.1.1.8 Walkdown Preparati.gn A detailed written project plan was prepared before the walkdown that outlined the scope of each task, the detailed technical approach to the performance of each task, and the interfaces between t

the team members and Waterford 3 personnel.

Before the walkdown, data assembly and evaluation was performed to define a technical baseline for the systems analysis and seismic screening walkdown. The decign documentation for structures and components were key to performing the screening walkdown evaluations. In general, the design data ofinterest was construction details (such as bolting) and seismic stress analyses and laboratory test reports that will form the basis of the reduced scope SMA. This task served the needs of the IPEEE seismic data assembly requirements for electrical and mechanical components, in NUREG 1407 and EPRI NP-6041-SL.

Specific documentation assembled and evaluated before and during the walkdowns included:

the Waterford 3 Safe Shutdown Paths and Equipment List report prepared for the IPEEE by Waterford 3 plant arrangement drawings

+

sections of the Waterford 3 FSAR relating to the seismic criteria and licensing j

a basis for the plant the ground response spectra for the SSE the floor response spectra and how they were generated a sample of construction details of the anchorage including drawings and

+

specifications a sample of procurement and seismic testing specifications for equipment examples of calculations for seismic and anchorage qualifications design basis documents for the Waterford 3 structures selected evaluations for block walls design calculations for a sample oflarge flat bottom tanks A walkdown plan was developed before the walkdowns and included the criteria to be used for the walkdown.

3.1.1.9 Screening Walkdown 3.1.1.9.1 Overall Walkdown Conduct For the SMA at Waterford 3, rigorous statistically based sampling criteria are neither practical nor desirable. The SMA procedures and guidelines used were heavily reliant on thejudgment of Page 3-12

. ~

highly experienced engineers and criteria for sampling in this plant likewise are modeled around thisjudgment.

l There are two areas of a reduced scope SMA where sampling was applicable and used at i

Waterford 3. They are;(1) screening of stmetures and components, and (2) walkdown. Issues i

that influence the sampling described in this plan are; redundancy provided by multi-train systems, j

similarity in design and location of redundant trains, treatment of single failures, access to components during walkdowns, and systems interactions potential including fire and internal flood sources.

The sampling approach described below is appropriate for modern plants of Waterford 3's i

vintage. The document review and walkdown verified that uniform practices in accordance with the plant design basis for constmetion, design and installation were implemented. Therefore, the sampling approach was used throughout the effort.

The Waterford 3 walkdown confirmed, as expected, that most items in a given equipment class were either identical or very similar. The plant documentation review and walkdown confirmed that the vast majority of equipment was manufactured, and installed as specified. The screening procedures to be used at Waterford 3 for generic categories of equipment and structures contained caveats or inclusion rules that were checked during the walkdown. Because the equipment at Waterford 3 was purchased and installed to similar codes and standards, the SRT screened generic classes of equipment on the basis of their relative ruggedness. The screening sampling size for identical or very similar equipment in a given class for caveats was one or greater. The screening size for very similar equipment in a given class with identical or very similar anchorage was two or greater. The increased sample for anchorage is based on experience at other plants that anchorage installations are not always consistent. This is consistent with the guidance given in Appendix D of EPRI NP 6041-SL. A 100 percent " walk-by" of all equipment on the SSEL was employed to check for unique equipment details and for seismic interactions.

The structures at Waterford 3 were screened generically. The drawings and analysis models were reviewed for details that might indicate seismic vulnerabilities in accordance with the requirements

)

of a reduced scope SMA. The drawing and stmetural analysis reviews confirmed that consistent good practice in design detail and analysis was utilized at Waterford 3. Therefore, it was not necessary to review more than a small sample of the details of connections, reinforcement bar placement, construction joints, etc., to make the judgments on screening.

Distribution systems installed in bulk such as piping, cable trays, HVAC ducting, electrical conduit an:1 instrument lines were screened generically after completion of a walkdown with verification that the distribution systems meet the inclusion mies. It was confirmed that the design and installation practices at Waterford 3 are consistent, therefore the screening judgment was based upon a review of the general specifications and drawings for a single mn of each generic class of distribution system. As expected the review of the general specifications and drawings did not indicate significant differences in design and installation practice that was confirmed during the equipment walkdown.

Page 3-13

i Each walkdown team consisted of at least two seismic capability engineers and at least one systems engineer or operator from Waterford 3 was also available for the duration of each walkdown to swing from team to team when systems / operations input was required.

The seismic capability walkdowns gathered the necessary data to support the SMA screening analysis. The seismic capability walkdowns also served to collect the necessaiy data for the i

component evaluations in the SMA program to implement the requirements of NP 6041-SL.

There were three walkdowns performed. An outage walkdown was performed during the Spring i

of 1994, and included equipment located in containment, as well as the containment stmetures review. The structures and distribution system reviews were performed during the course of the' outage walkdown. There were two on-line walkdowns performed, one during the Fall of 1993 i

for the B train equipment and one during the winter of 1994 for the A train equipment.

A typical day during the walkdown consisted of:

1.

reviewing issues identified on previous days for determination as to whether the item is screened or an outlier i

2.

planning the day's walkdown effort 3.

performing the walkdown 4.

seismic contractors briefing Waterford 3 on the day's progress 1

3.1.1.9.2 Walkdown Results Three Seismic Screening-and-Verification Walkdowns were performed at the Waterford 3 facility for the IPEEE SMA. The purpose of the walkdowns was to assess the relative seismic capacity based on earthquake and testing experience of a large number of selected safety-related plant 4

structures and components. The screening was performed to the licensing basis SSE at Waterford

3. The results for the walkdown are in separate sections below. The Seismic Verification Data Sheets for all the walkdowns are in Reference 3-7.

3.1.1.9.3 Walkdown Resultsfor the Train A and Train B On-line Walkdown The " Train A" on-line walkdown occurred the week of January 25,1994. The train was walked down by one team of Waterford 3 engineers. The " Train B" on-line walkdown was performed the week of Ncvember 7,1993. The train was walked down by two teams consisting of Waterford 3 and Stevenson & Associates engineers.. Section 3.1.1.7 contains the walkdown teams for each train. Train A consisted of 273 items and Train B consisted of 388 items. Train B consisted of more items since it contained the majority of the containment isolation valves. The seismic walkdowns found Waterford 3 to be seismically mgged and identified no outliers affecting plant operability. However, there was one item that could not be screened. Table 3.1 lists the equipment that was not screened.

Page 3-14

I Table 3.1 - Equipment Not Screened During Walkdown and the Reason Why Class Equipment ID No.

Issue to Resolve l

3 4KVESWGR3B XPANEL Station air pipe can impact switchgear during an eanhquake.

3.1.1. 9. 4. Walkdown Resultsfor the Outage Walkdown t

The outage walkdown occurred the week of March 14,1994. The walk down was completed by one team as stated in Section 3.1.1.7. There were 149 items on the initial list for the walkdown.

During the outage walkdown the control room ceiling was evaluated for possible interaction with control room equipment and operators. The control room ceiling is built from light-weight panels l' x l' square that interlock with one another. The ceiling suppon is a unistrut frame cantilevered from the concrete floor above. The unistrut frame only suppons the ceiling and recessed lighting. Other distribution systems such as HVAC duct and cable trays are supported '

by independent stmetural members (structural angles, channel, etc.) as they are in the plant at large.

To guard against falling of the lights and panels in the event of an earthquake, each panel and light have independent tie wires that go around a horizontal unistrut in the frame. Panels or lights that may come loose will hang from these wires. The lights above the main control board have a latch at one side for changing the lights. In the worst case the latches may come loose and the l

reflectors may hang from the hinges on the other side. In any case they will not fall on the operators.

Waterford 3 has a qualification calculation for the control room ceiling to meet the SSE seismic criteria for the plant.

Light fixtures throughout the plant were well attached without open hooks. Platform grating were all clipped down. Masonry walls by equipment reviewed were reinforced and had been previously evaluated in the Waterford 3 IE Bulletin 80-11 program. All equipment reviewed was located in seismic Category I structures, therefore, it was unnecessary to review non-seismic Category I structures.

i There were no outliers affecting plant operability found during the walkdown. However, there were several equipment items that could not be screened. Table 3.2 lists the equipment that was not screened.

Page 3-15

Table 3.2 - Equipment Not Screened during the Outage Walkdown and the Reason Why Class Equipment ID' No.

Issue to Resolve 20 IC ECP41 XPANEL Unsecured personal storage lockers and file IC ECP42 XPANEL cabinets are in close proximity of these panels.

IC ECP25 XPANEL These lockers and cabinets should be moved or IC ECP26 XPANEL secured so they cannot interact with the panels.

IC ECP43 XPANEL IC ECP44 XPANEL IC ECP45 XPANEL PMCICDSMC XPANEL IC ECP27 XPANEL IC ECP28 XPANEL IC ECP29 XPANEL IC ECP30 XPANEL IC ECP31 XPANEL IC ECP08 XPANEL IC ECP49.XPANEL IC ECP48 XPANEL IC ECP18 XPANEL 1

1 3.1.1.9.5 Containment andStructures Walkdowns The Waterford Unit 3 stmetures were reviewed on March 21 and 23 as part of the IPEEE program in response to the requirements contained in NUREG-1407. The particular structures j

evaluated included:

1) the reactor containment shell 2) the shield building 3) the containment internal structure 4) the auxiliary building a) emergency diesel generator rooms b) control room 5) containment penetrations including hatches and locks 6) containment isolation valves 7) containment ventilation and backup air systems The calculations concerning these structures have been evaluated for:

1)

Seismic inertia forces and moment on stmetures 2)

Seismic induced displacements The structures and systems listed in (1) to (7) above were also walked down to evaluate:

Page 3-16

a)

Any potential spatial interactions between structures or systems not considered in design b)

Installations which could effect the seismic adequacy given the seismic design level of 0.lg SSE-ZPGA defmed for the plant c)

Seismic evaluations of containment penetrations, ventilation and backup air and i

supporting systems have been performed by a containment walkdown.

The seismic walkdowns and structures review found Waterford 3 to be seismically rugged and identified no outliers affecting plant operability.

A walkdown of containment penetrations indicates that penetrations were, in general, supponed off the inside of the containment steel shell with flexible connections to the interior of the containment internal structure. It was also noted that large ventilation ducts were supported on the internal structure at the operating deck level and the containment shell above the operating deck. Ilowever in each such instance there was a flexible bellows connecting the sections of the duct supported on the two separate structures.

The deflection of the containment shell and other building structures are contained in Table 3.8-23 of the FSAR for two horizontal directions of SSE input earthquake. The maximum SSE relative displacements between the containment shell and the containment internal structure according to this table may be approximately 1.8 inches at the Elev. +60.3. These deflections are a combination of the in-phase and out-of-phase deflections. Almost all of this deflection is due to SSE translation and rocking. More recent evaluations of relative displacements between the auxiliary building and the shield building and between the shield building and the steel containment shell have separated the in-phase and out-of-phase deflections. The maximum relative of differential motion between the steel containment and containment internal structure will be no greater than 0.0595 inches at Elev. +60.3. The maximum SSE relative displacements at the operating deck level (Elev. +46.0) and at Elev. +21.0 are 0.048 inches and 0.030 inches, respectively. A walkdown of containment concluded that this gap existed between the containment shell and the internal structure.

A walkdown of containment also concluded that any component that was supported by the containment shell and the internal structure had suflicient flexibility.

The area between the shield building and the auxiliary building was also walked down in the areas of electrical and mechanical penetrations and it was noted that all penetrations were flexibly connected between the shield wall and the first support on the auxiliary building. While performing the walkdowns for Train A and B, the SRT also looked for other potentialinteractions and none were noted.

Page 3-17

I 3.1.2 System Analysis 3.1.2.1 Equipment Necessary to Achieve and Maintain Hot Shutdown and Development of SSEL I

3.1.2.1.1 Summary This section describes the process for creating the Safe Shutdown Equipment List (SSEL). The process depended on procedure OP-902-008, " Safety Function Recovery Procedure," wiring diagrams, flow diagrams, and the station component database (SIMS). The Full SSEL has the equipment needed to combat the IPEEE-seismic scenario:

a SSE level earthquake that causes a LOOP and a 1" SBLOCA The IPEEE-seismic analysis is based on techniques and an accident which are both described in EPRI-6041. It requires plants to prevent core melt during the IPEEE-seismic scenario for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. EPRI-6041 hypothesizes that core melt can be prevented by successfully maintaining four safety functions:

Reactivity Control Reactor Coolant Pressure Control Reactor Coolant Inventory Control Decay Heat Removal Waterford procedure OP-902-008 describes how the operators maintain seven safety functions, including the four called cut by EPRI-6041. The additional safety fimetions are:

Containment Isolation Containment Temperature & Pressure Control Combustible Gas Equipment on the Full SSEL is associated with steps in OP-902-008 that maintain the four EPRI-6041 safety functions. That " front-line" equipment as well as support equipment (found on CWDs ) and passive equipment (found on flow diagrams) appear on the Full SSEL.

t Because the goal of the IPEEE-seismic at Waterford is to walkdown the equipment on the Condensed SSEL, equipment location is provided on the Full SSEL. Equipment in the plant was located primarily with SIMS.

3.1.2.1.2 Introduction This section describes how equipment came to be listed on the " Full SSEL." There are two SSELs, a " Full SSEL" and a " Condensed SSEL." The " Condensed SSEL" is created by applying i CWDs are the plant control wiring diagrams.

Page 3-18

the EPRI-6041 " rule of the box" criteria to the " Full SSEL", e.g., only a motor control center cabinet needs to be examined during the IPEEE-Seismic walkdown, not all its cubicles. The EPRI-6041 " rule of the box" is straight forward and assumes that the " Full SSEL" is correct.

Therefore, this report will focus on the method employed for adding equipment to the " Full SSEL."

The IPEEE requires a walkdown of equipment needed to combat the following scenario for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The IPEEE assumes the plant suffers a SSE level earthquake that causes both a loss-of-off-site-power (LOOP) and a 1" diameter small break loss of coolant accident (SBLOCA). The Individual Plant Examination ofInternal Events (IPE) had a scope that included many types of accidents, but only 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> coping. Thus, a new basis for equipment selection (something besides the IPE) is needed for the IPEEE. There is one operating procedure that covers all safety functions needed to combat a LOOP & SBLOCA. It is OP-902-008, " Safety Function Recovery Procedure."

OP-902-008 addresses seven safety functions that form a superset of the four safety functions called out in EPRI-6041, i.e., Reactivity Control, Reactor Coolant Pressure Control, Reactor Coolant Inventory Control, Decay Heat Removal. The EPRI-6041 functions address preventing core damage rather than mitigating consequences of a core melt. Safety-related equipment seeks to reduce the probability of core melt and the consequences of core damage. The IPEEE presumes that preventing core damage eliminates the need to mitigate consequences. Therefore, the only equipment needed on the Full SSEL is that equipment that will prevent core damage.

SAFETY FUNCTIQN in OP-902-008 Corresponding EPRI-6041 functions Reactivity Contre!

Reactivity Control Vital Auxiliaries Support Systems RCS Inventory & Pressure Control Rector Coolant Pressure Control Reactor Coolant Inventory Control RCS & Core Heat Removal Decay Heat Removal Containment Isolation Support Systems Containment Temperature &

Support Systems Pressure Control Combustible Gas NA to SMA (re page 3-20) 3.1. 2.1.3 How 1he Full SSEL Accounts For 1he EPRI Safety Fumctions 3.1.2.1.3.1 General Notes The IPEEE asks that licensees list a primary and alternate means of achieving each EPRI-6041 safety function. For the IPEEE, it is assumed that all equipment connected to the diesel generators is available to the operators.

Page 3-19

I l

]

Due to the format of OP 902-008, the Full SSEL contains equipment from at least two trains of one safety system for each pertinent step. Some steps are impertinent because of the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> LOOP assumption, i.e., some equipment is not normally connected to the diesel generators.

Many times the pertinent OP-902-008 steps gives the operator several systems to choose from.

When only one system can fulfill the OP-902-008 step, two independent trains comprise the primary and alternate means of achieving each EPRI-6041 safety function. When more than one system can fulfill the safety function, the number ofindependent trains increase. Thus, the Full SSEL incorporates more than just a primary and secondary means of achieving each EPRI-6041 safety function.

A certified Shift Technical Advisor (STA), who is also an SRO, helped determine that steps and that equipment implement the EPRI-6041 safety functions. EPRI-6041 safety functions prevent core damage. This allowed exclusion of Waterford equipment geared solely to mitigating the consequences of either core damage (e.g., combustible gas control), or station blackout (e.g.,

controls needed to shed load off the DC busses).

OP-902-008 guides the operators into using equipment that won't be available given a LOOP.

Equipment not normally powered via the emergency on-site power system do not appear on the Full SSEL, e.g., condensate.

However, the IPEEE scenario is LOOP only, so both Emergency Diesel Generators (EDG) operate in the IPEEE scenario. Each equipment train (i.e., Train A and Train B) totally depends on its respective EDG for electric power over the course of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Some systems have an AB train. Train AB represents a third alternative in some systems, e.g., Component Cooling Water (CCW), High Pressure Safety Injection (HPSI). Because it is a third choice, there is no need to consider Safety Train AB in the Full SSEL. There is one exception. Those components designated as AB that separate train A from AB and train B from AB are included on the Full SSEL.

Because the operators will initiate shutdown cooling during the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, shutdown cooling equipment is on the Full SSEL. The IPE scope did not include shutdown cooling equipment because the IPE success criteria depended upon Reactor Cooling System (RCS) cooling via the steam generators and emergency feedwater. Therefore, simply listing equipment included in the IPE would not meet the intent of the IPEEE.

OP-902-008 asks operators to check parameters shown by instruments and the [ Class IE, seismic Category 1] Qualified Safety Parameter Display System (SPDS) in the control room. Instruments not specifically required by OP-902-008 are excluded, e.g., Heating, Venting and Air Conditioning (HVAC) temperatures. Note, the IPE scope did not include any measuring instmments. Once again, simply listing equipment included in the IPE would not meet the intent of the IPEEE. The method described below for creating the Full SSEL does meet the intent of the IPEEE.

Systems that control containment temperature and pressure are on the Full SSEL. The closest design basis accident at Waterford to a 1" SBLOCA has a 0.01 square foot break. Based on that analysis, the following conclusions underpin listing containment spray (CS), and containment fan Page 3-20

coolers (CFCs) on the Full SSEL. Given that both containment spray pumps operate when commanded by the Engineering Safety Features Actuation System, the RWSP empties out and recirculation from the Safety Injection (SI) sump begins before RCS conditions permit Shutdown Cooling (SDC) operation. Therefore, the means to condense steam in the containment fall into the scope of the Full SSEL.

Given a 1" SBLOCA, no amount of hydrogen can be produced in a non-core damage situation to threaten containment integrity. Therefore, combustible gas does not perform " core melt prevention" and it is not in the scope of the Full SSEL.

The IPEEE-seismic scenario includes LOOP, not SBO. Therefore, the OP-902-008 steps that conserve DC power were ignored in compiling the Full SSEL. For example, the controls, etc.,

needed to turn-off seal oil pumps for the main feedwater turbines were not included on the Full SSEL.

3.1.2.1.3.2 The EPRI Safety Functions The paragraphs below address each EPRI-6041 safety function in turn. At the system level, they describe why a system appears on the Full SSEL. After these functions, there is a heading for SUPPORT SYSTEMS. The description there accounts for the large amount of equipment shown on the attached Full SSEL.

Reactivity Control OP-902-008 gives the operators three options for keeping the core subcritical.

CEA insertion Boron injection with charging pumps Boron injection with safety injection system pumps CEA (control element assembly) insertion happens either automatically, or manually. The Full SSEL only includes the cabinets that cause automatic CEA insertion. Cabinets related to CEA motion for start-up and maneuvering were found unnecessary for responding to the IPEEE-seismic scenario.

High boron concentrations in the RCS can keep the nuclear chain reaction from returning to critical conditions. All of the various means of boron injcetion are included in the Full SSEL.

Thus, gravity feed valves, Boric Acid Makeup (BAM) pumps, the BAM tanks, the Volume Control Tank (VCT), and two of the three charging pumps are part of the Full SSEL. The AB charging pump is not included for reasons given above. The SI pumps fulfill this function as well as the inventory control function so they are also included in the Full SSEL. The hot leg injection valves, etc., are a means to keep baron from precipitating out of solution. However, for a 1" SBLOCA, hot leg injection should not be necessary for reactivity control. Hot leg injection valves that are also containment isolation valves are on the Full SSEL.

Page 3-21

l Reactor Coolant Pressure Control i

Reactor coolant pressure control is accomplished with either ADVs or MSSVs, and EFW feeding the SGs that relieve steam via the ADVs and SDC.

i MSSV Main Steam Safety Valves EFW Emergency Feedwater ADV Atmospheric Dump Valves SDC Shutdown Cooling All of this generally described pressure control equipment and its supporting equipment are part of the Full SSEL.

j l

Reactor Coolant Inventory Control A 1" SBLOCA is a hole that can drain the RCS faster than three charging pumps can fill the RCS.

Thus, the IPEEE-seismic scenario requires HPSI to provide RCS inventory control. HPSI needs

- a borated source of water before the Si sump fills so the RWSP is part of the Full SSEL too.

j Because leakage through the 1" SBLOCA continues even after SDC begins, HPSI must be able to recirculate SI sump water back into the RCS. Therefore, all equipment needed to establish SI sump recirculation is also part of the Full SSEL.

During the IPEEE-seismic scenario, all HPSI pumps are presumed operable, thus, only the Train A and Train B pumps were considered for the Condensed SSEL. Equipment solely for HPSI pump AB was excluded from the Condensed SSEL.

Decay Heat Removal During a 1" SBLOCA, the emergency operating philosophy is to initiate SDC as soon as possible.

The large amount of energy trapped upstream of the MSIVs needs to be diverted quickly. The operators can then gradually cooldown the RCS until SDC entry conditions exist.

The IPEEE scenario causes MSIS to close both the MFWIV and MSIV.2 LOOP will render BOP systems, e.g., Main Feedwater System (MFWS) & Steam Bypass Control System (SBCS),

i unavailable. Thus, heat from the RCS going into the SGs will be relieved near-term by the MSSVs and long-term by the ADVs. EFW will replenish the boiled off SG water (by drawing on 3

the CSP and the wet tower basins). The passive MSSVs relieve steam in the very beginning of the IPEEE-seismic scenario. The ADVs will control SG pressure during cooldown to SDC, not the SBCS (steam bypass control system). The MFWIVs, MSIVs, MSSVs, and ADVs as well as the electric motor driven trains of EFW appear on the Full SSEL. Because both motor driven l

2 MSIS Main Steam Isolation Signal MFWIV Main Feedwater Isolation Valve MSIV Main Steam Isolation Valve Page 3-22

+

Y

EFW pumps are available, no equipment solely related to the turbine driven EFW pump appears on the Full SSEL.

Given LOOP, RCS circulation from the core to the SGs must be natural, i.e., only due to pressure and density differences at different points in the RCS. Natural circulation is enhanced by proper pressurizer heater control, but it is not required according to the STA staff. Although heaters were considered for the Full SSEL, the final conclusion that they were not absolutely necessary meant leaving pressurizer heaters off the Full SSEL.

Once the RCS reaches SDC entry conditions, a combination of the LPSI system and CCW system will form the front line decay heat removal system. Operators realign LPSI so that a closed loop is created. During a 1" SBLOCA, CCW can remove decay heat (deposited in the shutdown cooling heat exchangers) withjust the dry cooling towers. Thus, wet cooling tower equipment is not included on the Full SSEL.

3.1.2.1.4 Compiling The AdiSSEL OP-902-008 was evaluated to determine equipment needed to implement each step. The object was to uniquely list all of the equipment available after a LOOP that OP-902-008 calls out.

Regardless of how many steps use the same piece of equipment, a piece of equipment (i.e., a component ID called UNID) appears on the SSEL only once. On the other hand, it was common to list more than one component ID for a single OP-902-008 step. Therefore, the cross-reference shown in the list between component ID and step is only a representative OP-902-008 step.

Because OP-902-008 covers all EPRI-6041 safety functions, this was an effective means of identifying all active equipment needed to implement the safety functions.

3.1.2.1.4.1 Support Systems Next, three systems were unconditionally included. They were emergency diesel generators, RAB HVAC, and component cooling water. Equipment associated with these systems appears on the Full SSEL.

Measuring instruments in HVAC systems were explicitly excluded. Operators would be aware (from their plant tours) when HVAC was not working adequately.

Since rain-fall is not part of the IPEEE-seismic scenario, the sump pumps for the dry cooling tower areas were excluded from the Condensed SSEL. There chief function is to prevent flooding the two MCC 315s. MCC 315 provides power for the dry tower fan motors.

Consideration was given to adding balance of plant equipment to the Full SSEL, e.g., instrument air and non-safety power for reactor coolant pumps. Based on conversations with Design Engineering and Plant Operations, it was concluded that the plant could reach SDC conditions and remain in SDC conditions up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the IPEEE initiator without using any BOP system.

Page 3-23

Air operated valves, (e g., the ADVs) can be controlled manually during the cooldown.

Specifically, the ADVs can be controlled manually. Note, ADVs typically do not " hunt" during a cooldown. ADV position needs to be adjusted infrequently to match the decay heat rate.

Natural circulation of the primary coolant will allow operators to approach SDC conditions in roughly 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The time to reach SDC could be shortened by restarting reactor coolant pumps (RCPs). Ilowever, the RCP restart steps in OP-902-008 are for convenience only. Restarting RCPs is not necessary to reach SDC conditions.

L Finally, the equipment called out on Attachment 12 and Attachment 13 to OP-902-008 was included. These attachments list the equipment that responds to SIAS and CIAS automatic actuations. The importance of having SIAS start ECCS pumps to make-up water into the RCS is obvious. CIAS is important because radioactive water will be sprayed and recirculated in the containment. The water is radioactive even without a core melt. Because EPRI-6041 was unclear on this point, valves responding to CIAS were included as a support system for the safety functions.

3.1.2.1.4.2 Other Supporting Equipment The next step was to identify CWDs that showed equipment called out by OP-902-008, or that showed any of the unconditionally listed systems, e.g., RAB HVAC. CWDs show the equipment needed to support the initial set of equipment created from OP-902-008.

With this equipment-to-CWD cross reference, it was possible to use the CCL (cable conduit list database) to list the interconnected equipment shown on the CWDs (e.g., panels, instrument contactors). This list compi.-ted the effort to itemize support systems.

l Page 3-24

1 Process for creatina the Waterford 3 SSEL GOAL j

Ok902-008]* List Step ust all equipment SCENARIO or Attachment needed to restore Ea;thquake that uses equipment safety functions.

LOOP still available given scenario i

a How to List the UNID that the O

restore Perator looks at or CWD xref from SIMS safety (CYID shows the equip.

functions.

that supports the UNID.)

n tta mn.

l l

7 CWD Sheet vs. CCL (a database of equipment shown on a CWD)

CCL TAG CCL Tag <> Ebasco Tag CCL Tag <> UNID l

CCL TAG y

y Identify steps in OP-902-008 UNID

. Determine which UNID is needed to implement the step UNIO y

Find the CWD for the UNID number Get a list of equipment on the CWD UNID Translate the CCL equipment number into a UNID y

y Physically locate the UNID in the plant with SIMS Location Location Location U

4 SAFE SHUTDOWN EQUIPMENT LIST (SSEL) 3.1.2.1.4.3 Passive Equipment At this point the Full SSEL is complete except for the " passive" equipment the operator needs to ensure safety function success. The list of passive equipment comes from tracing the systems called out by OP-902-008 as well as the unconditional systems, e.g., RAB HVAC. The equipment highlighted on the flow diagrams was listed and compared to the nearly complete Full SSEL. The equipment that did not already exist on the Full SSEL was added, e.g., tanks.

Important equipment that may be damaged following a tank collapse is on the Full SSEL. There was no specific efron to try and identify equipment in the same room with a tank. Equipment does not appear on the Full SSEL solely because it was next to a tank.

3.1.2.1.4.4 Location Cross-Reference Via SIMS and searches through the electrical design documents, a location cross-reference for this equipment was included in the Full SSEL. Although the equipment list obtained from CCL proved difficult to completely translate into UNID numbers, all of the information needed for the Condensed SSEL was found.

1 Page 3-25 1

i 3.1.2.1.4.5 Screening Applied To Equipment Added Only As A Result Of The CWD Search Adding each and every component to the Full SSEL found on the cross-referenced CWDs would f

have expanded the scope of the Full SSEL. Many of the CWD circuits are for indication only and do not perform fundamental safety functions, e.g., reactivity control.

Components such as transmitters, limit switches, cabinets, sampling equipment, etc. that only f

monitor processes were excluded from the Condensed SSEL. Instmment cabinets only associated 1

- with non-safety function systems (e.g., blowdown system) were excluded from the Condensed SSEL (e.g., IC ICDC103 houses only blowdown system instruments).

At times, CWDs show multiple solenoid operated valves. Only those valves directly related to one of the safety functions was retained on the Condensed SSEL (e.g., CAP-101 was screened out while creating the Condensed SSEL).

l t

' The CWD search resulted in adding PDP-383A to the Full SSEL. Because that PDP only l

- supplies equipment in the Water Treatment Building, PDP 383 A was excluded from the

' Condensed SSEL.

RWSP to CVC is normally closed. For the IPEEE-seismic scenario, it needs to stay closed.

There is no automatic or remote-manual action required to reach SDC and stay there for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Therefore, equipment related to connecting CVC to the RWSP was excluded from the i

Condensed SSEL.

i Both MCC 314s were added to the Full SSEL. During the screening described in this section, Waterford 3 determined that MCC 314 power supplies were not relevant to achieving shutdown cooling conditions. MCC 314 supplies loads in the Fuel Handling Building. Therefore, neither MCC 314 appears on the Condensed SSEL.

3.1.2.1.4.6 Conclusion The Full SSEL needed to include at least two independent means for maintaining the four EPRI-6041 safety functions. The Full SSEL provides at least two trains (or paths) for each pertinent step in OP-902-008. Pertinent steps implemented one of the four core damage prevention EPRI-6041 safety functions.

The Full SSEL needed to include the suppon systems needed by the front line safety systems identified above. Using CWDs and flow diagrams, the process used to compile the Full SSEL assured that all important support equipment is pan of the Full SSEL. The "mle of the box" grouped equipment under a common banner, e.g., a motor control center. Thus, no accuracy was lost after applying the " rule of the box" (in terms of maintaining the four safety functions).

EPRI-6041 lists 16 fields related to each piece of equipment on the SSEL. It was considered a guide. The attached Full SSEL does not include the following information: description, desired state, power required, and supporting system. The additional work needed to include this information merely duplicates information in SIMS. The Full SSEL includes the critical information needed to create the Condensed SSEL.

Page 3-26

3.1.2.1.5 Creating The CondensedSSEL After the SSEL was developed by Waterford 3 Design Engineering and reviewed, Waterford 3 condensed the list using " rule of the box" considerations. Equipment categories were numbered as shown in Table 3.3. For equipment included in Classes I through 20, all the components mounted on or in this equipment were considered to be part of that equipment and do not have to be evaluated separately. For example, the diesel generator (Equipment Class #17) includes not only the engine block and generator, but also all other items of equipment mounted on the diesel generator or on its skid. Components needed by the diesel generator but not included in the

" box" (i.e., not mounted on the diesel generator or on its skid) were identified and evaluated separately.

Table 3.3 EQUIPMENT CLASSES 0

OTHER 11 CHILLERS I

MOTOR CONTROL CENTERS 12 AIR COMPRESSORS 2

LOW VOLTAGE SWITCHGEAR 13 MOTOR-GENERATORS 3

MEDIUM VOLTAGE SWITCHGEAR 14 DISTRIBUTION PANELS 4

TRANSFORMERS 15 BATTERIES ON RACKS 5

HORIZONTAL PUMPS 16 BATTERY CHARGERS & INVERTERS 6

VERTICAL PUMPS 17 ENGINE-GENERATORS 7

FLUID-OPERATED VALVES 18 INSTRUMENTS ON RACKS 8

MOTOR-OPERATED AND 19 TEMPERATURE SENSORS SOLENOID OPERATED VALVES 9

FANS 20 INSTRUMENTATION AND CONTROL PANELS AND CABINETS 10 AIR HANDLERS 21 TANKS AND HEAT EXCHANGERS Rule of the box considerations were incorporated by Waterford 3 engineers during a prehmmary j

" walk by" and researching plant drawings and manuals for equipment on the SSEL shortly after SSEL development.

3.1.3 Analysis of Structure Response i

3.1.3.1 Seismic Analysis of Seismic Category I Structures The seismic analyses of all seismic Category I structures were performed using either the normal mode time history technique or the response spectrum technique.

In the case of seismic Category I structures, the seismic response was determined by the response spectra developed for the OBE (0.05g) and the SSE (0.10g).

I Page 3-27

As seismic Category I structures at Waterford 3 are on a common foundation mat, therefore, the I

mathematical modeling involved construction of a single composite model for each directional seismic analysis.

The model comprises five individual cantilevers, representing the Reactor Building, the containment vessel, the reactor internal structure, the Reactor Auxiliary Building and the Fuel i

Handling Building. The Component Cooling Water System is not separately identified and is included in the Reactor Auxiliary Building and Fuel Handling cantilevers. The five cantilevers are l

founded on the same base, that is in turn supported by foundation springs that modeled the Soil Structure Interaction between the buildings and soil. For each cantilever, the distributed masses of the structure are lumped at certain select points and connected by weightless elastic bars representing the stiffness of the structure between the lumped masses. In determining the stiffnesses, the deformation due to bending, shear and joint rotation are considered throughout.

Every mass point of the two dimensional horizontal model can have two degrees of freedom, 7

namely, translation and rotation. For the vertical model only one translational degree of freedom is considered. Torsional modes of vibration were analyzed by three-dimensional lumped-mass system using the MRI/Stardyne computer program. Each mass point of the system was given two orthogonal horizontal degrees of freedom and a third rotational degree of freedom in the same plane. The mass points were then idealized as a rigid diaphragm with three degrees of freedom, two translational and one rotational. In this analysis, torsional effect results from the translational seismic inputs because of the eccentricity between the mass center and the shear center of each floor (mass polar moment ofinertia). Torsional soil structure interaction was considered by including a torsional spring at the base.

Once the dynamic models were developed, analysis of the structures determined the natural periods for vibration of each structure. In these analyses, periods and mode shapes were determined for each mode. These data define panicipation factors for each structure. These panicipation factors together with the spectral acceleration masses and relative displacement defme resultant seismic forces in each mode. These forces were applied to Seismic Category I Structures to determine resultant shears and moments for design purposes.

3.1.3.2 Seismic Design of Mechanical and Electrical Eauipment The design basis for safety-related equipment furnished for installation at Waterford 3 is equivalent to current NRC licensing requirements. Electrical equipment was seismically qualified per the requirement ofIEEE 344-75. Generally for equipment, the venical ground acceleration specified was equal to the horizontal and is combined with the horizontal acceleration using the SRSS method. The mechanical and electrical equipment were purchased under specifications that include a description of the seismic design criteria for the plant.

Page 3-28

i

-l i

3.1.3.3 Seismic Desian ofTanks Tanks at Waterford 3 were designed to current licensing critaia. These criteria included the amplified frequency response of the impulsive fluid mass. Therefore, Waterford 3 has implicitly l

satisfied the concerns raised for flat bottom tanks in Unresolved Safety Issue A-40, (see Reference 3.2) per NUREG-1233 (September 1989). The percentage of critical damping for welded steel plate assemblies in the Waterford FSAR applicable to tanks, is given as a percentage for both the OBE and SSE. Large tanks included in the IPEEE SMA effort include the Boron Management Holdup Tank A, B, C and D and the Diesel Oil Storage Tank A and B. The walkdown confirmed that there was no bolt degradation for the tanks, and the tanks meet the.

i plant design basis with additional margin.

3.1.3.4 Seismic Desian of Distribution Systems t

3.1.3.4.1 Piping i

i All seismic Category I Piping 1/2 inch or larger, was seismically analyzed as follows:

a)

All the Code Class I piping systems are analyzed by the Modal Response Spectra Method.

j i

b)

All the Code Class 2 and 3 piping systems except as described in (c) below using either: Equivalent Static Load Method or the Modal Response Spectra Method.

c)

All Code Class 3 chilled water piping is analyzed by Chart Method.' Some additional lines with a design temperature less than 275 F were also analyzed by Chart Method.

The adequacy of the seismic design of the Reactor Coolant System components other than the main loop was determined by the Modal Response Spectra Analysis. The mathematical models employed in the analysis is in sufficient detail to reflect the dynamic response of all significant modes. All modes with natural frequencies in the range of 33 Hz and below are considered significant.

In the analysis of complex systems where closely spaced modal frequencies are encountered, the responses of the closely spaced modes are combined by summing the absolute values method and, in turn, combined with the responses of the remaining significant modes by the square root of the sum of the squares method. Modal frequencies are considered closely spaced when their difference is less than i 10 percent of the lower frequency.

Dynamic loads of a piping system are calculated using the acceleration values of the floor response spectra with an appropriate damping factor. These loads are then used in an elastic analysis to calculate stresses.

Page 3-29 i

l For all ASME Code Class I piping, the loadings and, in turn, the primary stresses produced by

~

inertial effects are determined by applying the modal responses, mode-by-mode, to the piping '

system with the supports / restraints maintained " fixed". The loadings and, in turn, the secondary stresses produced by the relative displacements of the piping supports / restraints are determined by imposing the relative displacements on the piping system. The displacements are imposed in a manner to produce maximum primary plus secondary stresses in the piping when the total inertial effects are added to the effects resulting from the imposed relative displacements. There is no i

Reactor Coolant System piping routed between buildings.

For all ASME Code Class 2 and 3 piping differential displacement between buildings is taken into account in the seismic analysis but displacements at different support points within a structure are not considered, because they are negligible. This is based on a review of all ASME Code Class 1 calculations that indicated that the maximum relative displacement between the two extremes of any calculation.

i For subsystems that would normally be analyzed by the Modal Response Spectra Method, if the first mode period of the piping is 70 percent or less of the first mode period of the structure (i.e.,

peak of the floor response spectra) a modal period of the structure was not performed. Equivalent Static Load Method, ESLM, is used as specified in Standard Review Plan Section 3.7.2.

In all cases the stiffness matrix method of natural mode analysis is employed to determine first natural period, The preset value for the maximum allowable period is 0.20 seconds that is not greater than 70 percent of the first mode period of the stmeture.

The ESLM is made directly, using an accelerating value of 1.5 times the maximum value of the floor response spectra in the period range equal to 0.20 seconds or less.

The acceleration value that is multiplied by 1.5 is taken from Floor Response Spectra at a period j

of 0.20 seconds.

To justify the ESLM analysis procedure for piping, three sample problems were prepared using both ESLM analysis and modal response spectra methods. The static analyses used 1.0 g horizontal and 0.666 g vertical accelerations. The dynamic analysis utilized seven modes for sample one and five modes for sample two and three. For all modes the horizontal acceleration was taken as 1.0 g and vertical acceleration 0.666 g. The periods for the analyzed modes of all systems were between 0.20 seconds and 0.08 seconds.

In all cases the maximum computed stress was higher for the ESLM analysis than for the dynamic analysis, with the maximum stres occurring at the same point for both methods in all three problems.

Since the ESLM yields hider stresses than the dynamic when using the same acceleration, the use

- of 1.5 times the peak cf the floor response s.oectra for piping periods less than 70 percent of the first period of the structure is conservative by at least a 1.5 factor for the three systems analyzed by both methods.

l Page 3-30 l

l The chart method of analysis consists oflocating restraints such that the period cf the first mode

}

of vibration will not exceed the preset value of 70 percent of the first mode period of the supporting stmeture. This method involves the use of appropriate and comprehensive charts and tabulations that include correction factors for the effects of concentrated loads, brar.ch connections and other effects. The piping system is studied for loading effects in each of the three coordinate directions to assure that it is adequately restrained in all directions. An additional analysis is performed to evaluate the thermal effects of the restraints of the system. This is done by means of charts that define the minimum distance required for placing restraints adjacent to any expanding leg to stay within allowable stress limits.

The computer program (PIPESTRESS 2010) was used for the modal analysis and simplified dynamic analysis using the same stiffness matrix method. The program automatically determines forces, moments and deflections in the three coordinate directions and the stresses applied to both bending moment and torsional moment.

The adequacy of seismic loadings used for the design of the Reactor Coolant System Piping were confumed by the methods of dynamic analysis employing time-history and response spectrum j

techniques.

~

F To account for possible dynamic interaction effects between the components of the system, a composite coupled model was employed in the dynamic analysis of the reactor, the two steam i

generators, the four reactor coolant pumps and the interconnecting reactor coolant piping. The analysis of these dynamically coupled multi-supported components utilized different time dependent input excitations applied simultaneously to each support. The representation of detail l

of the reactor vessel assembly used in this coupled model included sufficient detail of the reactor internals to account for possible dynamic interaction from the Reactor Coolant System to the internals.

3.1.3.4.2 Cable TrayandConduit All cable tray and conduit supports were qualified by analysis, using the response spectmm method. Maximum cable tray spans and physical properties were selected. Two types of supporting systems have been used:

a. Rigid supports (defined as having a fundamental frequency > 33 Hz)

b. Non-Rigid supports (dermed as having a fundamental frequency < 33 Hz)

For rigid supports, g values were selected for a static analysis of the support based on the response of the system.

For non-rigid supports, a system frequency was selected such that 1.5 times the corresponding response g was within the system capacity. The support frequency was then calculated and a i

dynamic analysis was performed using a simplified three dimensional model having the desired support and cable tray system frequency. The g value obtained from averaging the responses was i

then used in a static analysis of the supports.

l Page 3-31

i Supports in the Reactor Auxiliary Building were originally all designed rigid. Supports in the Reactor Containment Building were originally all designed non-rigid. For the Fuel Handling Building, both types of supports were used.

3.1.3.4.3 HVAC HVAC supports were qualified by analysis similar to the cable tray supports. Maximum allowable loads on HVAC supports were 50% of the duct weight plus 25% of the support weight.

3.1.3.5 Seismic Spatial Interaction Issues Seismic interaction with non-seismic equipment was addressed in the Wrterford 3 FSAR. Seismic interaction with block walls was also evaluated by Waterford 3 in response to IE Bulletin 80-11.

Seismic spatial interactions were addressed in the IPEEE SMA performed as discussed in Section 3.1.4.2.5 of this report. Seismic spatialinteractions were also the subject of USI A-17. This evaluation satisfies the seismic interaction issues addressed in USI A-17.

3.1.3.6 Structural Damping The damping factors used in the analyses of the various structures, equipment and distribution systems at Waterford 3 are as follows:

I Table 3.4 - Damping Values for Waterford 3 PERCENT DAMPING PERCENT DAMPING FOR OBE FOR SSE Soil 7.5 7.5 Reinforced Concrete Frames, and 2.0 5.0 l

Buildings i

Concrete Equipment Supports 2.0 5.0 Bolted Steel Framed Structures 2.5 2.5 Welded Steel Framed Stmetures 2.0 2.0 Welded Steel Plate Assemblies 1.0 1.0 Steel Piping Systems 0.5 1.0 Steel Piping Systems < 12 in.

0.5 1.0 l

Page 3-32 i

3.1.4 Evaluation 'of Seismic Capacities of Components and Plant 3.1.4.1 Overall Approach i

I The project used a SMA as the means to investigate the seismic external event of the IPEEE. The final SMA documented in Reference 3-7 represents the plant configuration as it exists at the beginning of the project, except that changes made in connection with the project have been' included in this report. Voluntary actions that Waterford 3 implemented before assembling the licensing submittal for the IPEEE are also documented.

The success path equipment was identified based on operational and systems consideratio'ns for Waterford 3. Operational and systems considerations have been implicitly considered by utilizing the Waterford procedure OP-902-008. This is the symptom based emergency operating procedure used by Waterford plant operators to maintain safety functions and shut down the plant during an accident. This includes prioritized success paths and exceeds the requirements of NP-6041-SL.

1 The project approach utilized a screening walkdown that emphasized the imponance of i

l experienced Seismic Review Team Engineers familiar with equipment and stmetural pedormance in real eanhquakes. Each SRT was composed of one Stevenson & Associates engineer, one

~

Waterford 3 seismic engineer, and one Waterford 3 systems engineer or operator that also served as a plant guide. A 100 percent walk by of all equipment on the Condensed SSEL was performed. The interface between the systems engineer and seismic engineer is impodant since these parts of the process depend on each other for input and guidance. For example, the Waterford 3 system engineer and/or operator gave guidance from the systems part of the analysis in terms of the components and systems that must function for the equipment to perform its safe shutdown function.

Before the screening walkdown portions of the Watedord plant seismic criteria, drawings, and j

documents were reviewed. The intent of this effort was to define a technical baseline from which the SMA was performed. This review included the design documentation for the structures, l

equipment and components.

The Waterford 3 plant is a reduced scope IPEEE facility. Therefore, the Review Level Earthquake (RLE) for the Seismic Margins Assessment (SMA) is the plant's licensing basis Safe Shutdown Earthquake (SSE). The vast majority of the equipment included in the SSEL have existing seismic qualification data to the SSE level at Waterford 3. This data became the baseline for the walkdown. The walkdown included a detailed review of a sample of equipment in a given category (i.e., Motor Control Centers) to have reasonable assurance that the equipment has been i

installed to the existing criteria. The remaining equipment included in the walkdown was 3

inspected primarily for seismic interaction as discussed in Section 3.1.4.2.5 of this report.

The walkdown and review effon assured that the equipment seismic capacity was not reduced through modification or design change, and has not been reduced through programmatic measures.

J Page 3-33

.. =.

Relay failure and chatter effects have been explicitly eliminated from the IPEEE seismic effort for reduced scope plants. The only exception to this is if a seismic interaction is identified during the walkdown that is potentially damaging if the equipment contains protective or essential relays.

i Soil failure evaluations have also been explicitly eliminated from the IPEEE seismic effort for reduced scope plants.

During the screening walkdown, modified Seismic Verification Data Sheets were employed. The more detailed SMA caveats and anchorage review check lists were brought with the SRT in the l

field during the walkdown for reference purposes. Equipment not screened were evaluated further to insure that it met the Waterford 3 seismic licensing basis. The seismic input and allowable stress criteria used to evaluate unscreened equipment were per the Waterford 3 original design basis. Meeting these criteria closed out the potential issue from further evaluation.

The approach taken for the entire peer review process was to have peer review as a concurrent activity during the entire project, rather than a subsequent activity after the project is almost complete. The peer reviewers began their reviews with the project plan. Selected reviews were also conducted at key milestones in the overall effort.

3.1.4.2 Screening Criteria The requirements of the IPEEE SMA for a reduced scope plant such as Waterford 3 is that the plant meet its original seismic design basis requirements. The design basis requirements include:

the equipment seismic capacity is greater than demand, the construction adequacy of the equipment, and anchorage adequacy. The Waterford 3 IPEEE SMA also addressed seismic spatial interaction. The specific criteria for satisfying these requirements are discussed in this Section.

3.1.4.2.1 Seismic Capacity Vs. Demand Seismic capacity vs. demand for the equipment was addressed for the plant in the FSAR. The design basis for safety-related equipment meet current NRC licensing requirements.

The question of seismic capacity vs. demand for equipment was thereforejudged to be acceptable on a generic basis and this requirement was not included as an item on the equipment lists or check lists.

3.1.4.2.2 Equipment Construction Adequacy EPRI NP-6041-SL contains criteria for equipment construction adequacy for various equipment categories in the form of caveats. A representative sample of equipment was checked for similarity to the equipment that had been subjected to strong motion earthquakes or seismic Page 3-34 l

_... _ _ _ _ ~. - _ _ _

_ _ ~ _ _ _ _ _

.l 1

l

- analysis or testing and also met the intent of the specific caveats for that class of equipment.

.l Caveats define vulnerabilities observed in strong motion earthquakes or seismic tests. If equipment-specific seismic qualification' data were used, then any specific restrictions 'or caveats for that qualification data apply instead. ' The guidance for the sample selection is contained in Section 3.1.1.9.1.

The SRT member engineers have significant experience and training in the area of seismic adequacy of equipment and equipment performance during earthquakes. They are very familiar with the issues in regard to equipment adequacy from their experience. The SRT engineers inspected each equipment item, and any detail they felt was seismically vulnerable was addressed.

3. M.2. 3 Anchorage Criteria An assessment of the anchorage adequacy was performed on a representative sample of equipment included on the safe shutdown list. This included an assessment of the seismic demand on the equipment anchorage (forces and stresses on the anchorage), the seismic capacity of the anchorage components (attachment of the equipment to the anchorage, the anchorage itself, and the development of the anchorage to the foundation), and whether the capacity of the weak link of the anchorage system exceeded the demand. The assessment also included whether the anchorage system had adequate stiffness. The guidance for the sample selection is contained in Section 3.1.1.9.1.

To perform the anchorage assessment the guidance contained in Section 7 (Equipment Anchorage) of the SSRAP report (see Reference 3.4) and the URS anchorage report (see Reference 3.5) was used. Other sources for performing the evaluation were knowledge of the design basis ground response spectra, elevstion of the equipment, and the available floor response spectra. The main guidance documents referred to above were supplemented when appropriate j

with Reference 3-6. SRT judgment based on their experience was also used as discussed below.

The discussion contained in Reference 3-5 was primarily used to estimate the seismic demand on i

the anchorage of mechanical and electrical equipment. The damping used met or was more conservative than the Reference 5 recommendations. The SRT used the floor response spectra when available for estimating the demand. An example of using more conservative assumptions than the criteria was the use of 2% damped spectra for the Wo trford 3 evaluations. This is because 5% damped floor spectra were not available.

Equipment weight estimates used engineering experience or the guidance given in Reference 3-5.

Estimates of equipment fundamental frequency were also made during the course of estimating the seismic demand for some items. This estimate was very rough (for example this item has a frequency above 5 Hz) and could be made using the experience of the SRT members of tests and analyses and after looking at the construction of the equipment.

The primary source for estimating the seismic capacity of the anchorage is Reference 3-5. The details with regard to anchorage allowable loads and cracked concrete considerations are in this reference.

4 Page 3-35

.~

The load path from the center of gravity, c.g., of the equipment was analyzed (by judgment and/or calculation) to the anchorage and ultimately to the supporting structure. Anchorage components above the foundation were seen and verified. The embedded or buried components were verified using plant specific documentation (e.g., drawings).

An anchorage calculation was not performed for the vast majority of equipment items. When the anchorage was obviously rugged and installed to the design basis, SRT judgment assessed anchorage adequacy. This judgment was performed in the context of the above criteria.

3.1.4.2.4 Distribution System Adequacy

-3.1.4.2.4.1 Piping The walkdown effort concentrated on identifying certain construction details that have led to past earthquake damage in industrial facilities. The limited plant walkdown of piping identified any of the following potential piping failure modes.

Valve failure caused by impact resulting from large displacements of flexible pipes.

Pipe failure caused by large displacement ofinadequately anchored equipment (e.g., tank)

Failure of small, stiff pipes attached to large, flexible pipes.

Failure of piping between buildings as a result oflarge relative displacement caused by rocking or sliding of the buildings.

Failure of brittle connections (e.g., threaded pipe), eroded or corroded piping, and brittle cast iron piping.

A limited plant walkdown was conducted by the seismic review team using the sampling guidance in Section 3.1.1.9.1. An inspection of typical safety-related piping runs at Waterford 3 that were accessible provided a reasonable sample to verify that no problems exist. Piping sections between buildings were carefully investigated.

3.1.4.2.4.2 Cable Tray and Conduit Extensive tests performed on cable trays have shown that high capacities exist. Cable trays in nuclear power plants in the past have not always conformed to design drawings and calculations.

1 Therefore, a sampling walkdown of cable tray raceways assessed the as-built seismic capacity of the Waterford 3 cable trays and conduits. The principal failure modes of concern include failure of taut cables due to large relative displacement (e.g., relative motions between buildings), and

. failure of connections (unistrut clips or in threaded rods). During the plant walkdown, example cable trays were verified to have adequate support.

j Page 3-36 l

~,.-.

j t

3.1.4.2.4.3 HVAC l

The only HVAC-related problems were with loss of anchorage of fans and blowers and possibly fan blade misalignment resulting in mbbing and banging after the canhquake. Fans associated with safe shutdown are on the SSEL and were part of the walkdown effon.

This report concludes that the dominant failure modes for HVAC systems are anchor bolt and support failures. Ducting failure is not a major concern in SMAs for reduced scope plants' because ofits high capacity.

A briefinspection using the sampling methodology described in Section 3.1.1.9.1 verified that the equipment has proper anchorage. Shock-mounted HVAC equipment was to be evaluated, however this condition was not encountered at Waterford 3. For ducting that spans between buildings, potential failure because oflarge relative displacements were evaluated.

3.1.4.2.5 Seismic SpatialInteraction The Safe Shutdown equipment was evaluated for the effect of possible seismic spatialinteractions with nearby equipmert, systems, and structures. The review assures that these possible interactions do not cause the equipment to fail to perform its intended safe shutdown function.

There was a 100% walkdown of safe shutdown equipment for seismic interactions. To verify the seismic adequacy of an item of mechanical or electrical equipment using the EPRI NP-6041-SL methodology, there was a confirmation that there are no adverse seismic spatial interactions with nearby equipment, systems, and structures that could cause the equipment to fail to perform its required safety function. The interactions of concern are (1) proximity effects, (2) structural failure and falling, (3) flexibility of attached lines and cables, and (4) seismic induced fire and flooding.

It is the intent of the SMA seismic interaction evaluation to identify and evaluate real (i.e.,

credible and significant) interaction hazards. The interaction evaluations focused on areas of concern based on past earthquake experience.

Equipment not specifically designed for seismic loads was not arbitrarily assumed to fail under earthquake loads. The SRTs differentiated between likely and unlikely interactions, using their judgment and knowledge of past earthquake experience.

Although relay reviews were out of scope for the Waterford 3 SMA, attention was given to the seismic interaction of electrical cabinets containing relays. If the relays in the electrical cabinets were found to be essential, i.e., the relays should not chatter during an earthquake, then impact on the cabinet was considered as potentially unacceptable seismic interaction.

The existing seismic interaction criteria for the plant was reviewed. Attention was focused on the following architectural features during this review and subsequent walkdowns:

Page 3-37

l Control Room Ceiling -

T-bar suspended tiles, recess-d fixtures, and sheet i'

rock are used in some plant areas (such as the control room). Seismic capabilitbs of these ceilings may be low. The SRT Engineers checked for details known to lead to failure such as open hooks, no lateral wire bracing, etc. However, falling of l

relatively small light fiber board tiles does not constitute an unacceptable interaction.

l Light Fixtures -

Normal and emergency light fixtures are used throughout the plant. Fixture designs and anchorage 2

details vary widely. Light fixtures may possess a wide range of seismic capabilities. Pendant-hung fluorescent fixtures and tubes pose the highest risk of failure and damage to sensitive equipment. The SRT Engineers checked for positive anchorage, such as closed hooks and properly twisted wires.

Typically, this problem is not a lack of strength; it is usually because of poor connections. Emergency lighting units and batteries can fall and damage safe shutdown equipment due to impact or spillage of acid.

Platform Gratings -

Unrestrained platform gratings and similar personnel access provisions may pose hazards to impact-sensitive safe shutdown equipment or components i

mounted on them. Some reasonable positive i

attachment is necessary, if the item can fall and thereby interact with equipment being evaluated.

Unreinforced Masonry Walls -

Unreinforced, masonry block walls were evaluated for possible failure and potential seismic interaction with safe shutdown equipment unless the wall has l

been seismically qualified as part of the IE Bulletin 80-11 program. The SRT Engineers reviewed the documentation for IE Bulletin 80-11 masonry walls to determine which walls have and which walls have not been seismically qualified during that program.

This determination was made by Waterford 3 Engineering.

Non-Seismic Category I Structures - If any safe shutdown equipment is in non-Seismic Class I structures, then potential structural vulnerabilities were identified.

Page 3-38

l Distribution systems were also checked for possible interaction problems caused by large relative motion between the systems and building structures, as discussed in section 3.1.4.2.4.

j

. 3.1.4.2.6 Tanks andHeat Exchangers Venical tanks were pan of the IPEEE SMA at Waterford 3 because of the occurrence of tank failures in past earthquakes. Much research has been performed to provide guidance and l

evaluation methods for vertical tanks. The procedure used for resolution ofIPEEE SMA uses current methods to provide justification of the structural integrity of vertical tanks for the Safe i

Shutdown Earthquake.

1 There are several key technical issues addressed in tHs evaluation regarding the seismic demand on the tank, the seismic capacity of the tank, and the tank critical components. The following i

discussion provided the background for the SMA evaluation oflarge flat bottom tanks at Waterford 3. The response of a vertical tank to a se.smic event is a combination of sloshing fluid and the impulsive mode from fluid-structure interaction. The sloshing of the fluid at the top surface contributes to over topping of the tank as well as producing loads on the tank roof.

Adequate freeboard should be provided to prevent the rooffailure. The sloshing effect occurs at i

very low frequencies and damping values. The impulsive mode includes the tank shell responding i

to seismic events at frequencies associated with the shell modes of vibration. This response includes the tank and its contents moving together. Though the tank shell may be rigid under empty conditions, a tank shell and its contained fluid act together become flexible. This tank flexibility usually produces a response in the amplified region of the response spectra. This mode contributes significantly to total seismic response.

The seismic demand on the tank is in terms of the base shear and overturning moment produced at the tank base. Recent technical research has produced several simplified procedures that develop the response of fluid-filled tanks. The evaluation procedure for vertical cylindrical tanks includes the sloshing and impulsive modes of the tank.

i The USI A-40 issues regarding tanks were based on the assumption that several tanks in existing i

nuclear facilities were designed considering that the impulsive mode of the tank shell and fluid were rigid. In some instances the original design of these tanks make this erroneous assumption.

i The evaluation for the IPEEE SMA will resolve all USI A-40 issues regarding these tanks. The tanks at Waterford 3 were designed considering the impulsive mode as rigid, because of the

~

modern vintage of the facility, therefore this issue is not a concern at Waterford 3. The existing documentation will be reviewed and it was determined that the following issues described below were adequately addressed.

1.

The ovenurning moment capacity is based on the compressive strength of the shell to resist buckling and the tension capacity of the anchor bolts and associated connections to the tank was greater than demand.

2.

The shear capacity based on the sliding friction between the tank base plate and supporting foundation was greater than demand.

Page 3-39

3.

The available freeboard was adequate to prevent damage to the tank roof from sloshing.

The compressive strength of the tank shell is the major resistance to the overturning moment.

i There are two buckling modes common to tanks; " elephant-foot" buckling and diamond buckling will not occur at the SSE level at Waterford 3. The tensile capacity is limited by (1) tensile capacity of the bolts, (2) the embedment of the bolts into the concrete foundation, and (3) the ability of the tank chair to transfer the tensile load to the tank shell. The overall shear capacity of the tank is based on the friction developed between the base plate and foundation and is greater than the shear demand. The anchor bolts need not be included in determining the shear resistance since the friction load path is much stiffer than the bolt load path. The failure of a tank roof to sloshing was prevented by insuring appropriate freeboard.

- Attached piping was neglected in computing tank responses. However, flexibility of attached piping was checked during the walkdown and it wasjudged that it can accommodate slight uplift expected in the tank base. Piping attached to upper parts of the tanks have the necessary flexibility to accomraodate larger deflections, horizontal and vertical, expected in the tank.

There were no major seismic issues regarding horizontal heat exchangers identified during the walkdowns.

3.1.5 Analysis of Containment Performance NUREG-1407 includes a requirement for considering early failure of containment function in the performance of the SMA.

The scope of this task consisted of a brief review of the primary containment, its internals and penetrations, and the auxiliary building, to insure that they meet the licensing basis SSE criteria.

The primary purpose of the evaluation was to identify seismic vulnerabilities involving containment, containment functions and systems that are different from those in the IPE internal events evaluation. This included reviewing penetrations, hatches and locks, supporting actuation and control systems, and containment ventilation systems. These potential vulnerabilities are discussed in EPRI NP-6041-SL. The Containment Isolation valves were included in the equipment walkdowns.

3.2 USI A-45, GI-131, OTHER SEISMIC SAFETY ISSUES 3.2.1 USI A-45 (Decay Heat Removal)

Because the seismic events evaluation showed that there are no seismic vulnerabilities, we conclude that there are no significant or unique seismic vulnerabilities in the decay heat removal ftmetion. Therefore, USI A-45 should be considered resolved with respect to seismic events.

Page 3-40

3.2.2 GI-131 (Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants)

This issue is not applicable, since Waterford-3 is a Combustion Engineering plant.

3.2.3 USI A-46 (Verification of Seismic Adequacy of Equipment in Operating Plants)

Waterford-3 is not a USI A-46 plant. The issue of spatial interaction, however, has been addressed as part of the reduced scope seismic margins method.

The Waterford 3 IPEEE has not been used to evaluate any other USIs or GIs.

REFERENCES 3-1.

EPRI NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Rev.1, Jack R. Benjamin and Associates, Inc. et. al., August 1991.

3-2.

NUREG/CR-3480, "Value/ Impact Assessment for Seismic Design Criteria USI A-40,"

Lawrence Livermore National Laboratory, Augus' 1984.

3-3.

I&E Bulletin 80-11, " Masonry Wall Design," U.S. Nuclear Regulatory Commission, Washington, D.C.,1980.

3-4.

SSRAP Report, "Use of Seismic Experience Data to Show Ruggedness of Equipment in Nuclear Power Plants," Senior Seismic Review and Advisory Panel, Sandia National laboratories Report DE 92-019328, Rev. O, June 1992.

3-5.

EPRI NP-5228, " Seismic Verification of Nuclear Plant Anchorage, Volume 1:

Development of Anchorage Guidelines; Vol. 2: Anchorage Inspection Workbook, URS Corp./ John A. Blume & Assoc., Prepared for Electric Power Research Institute, Palo Alto, CA, May 1987.

3-6.

American Concrete Institute (ACI), ACI 349-85 Appendix B - Steel Embedments, September 1,1985.

3-7.

IPEEE Reduced Scope Seismic Margins Assessment (SMA) Report for Waterford 3, Prepared by Stevenson and Associates, December 1994.

Page 3-41

1 4.

INTERNAL FIRES ANALYSIS 4.0 METHODOLOGY SELECTION The fire evaluation was done using the EPRI-sponsored Fire Induced Vulnerability Evaluation (FIVE) [Ref. 4-1] as a screening method. This methodology falls under Section 4.3 of the NUREG. The NRC staff endorsed the FIVE methodology in a Staff Evaluation Report [Ref.1-6], provided that certain enhancements were made. These enhancements were incorporated by EPRI into Revision 1 of the FIVE methodology (Ref.

1-7], which was used in the Waterford 3 IPEEE.

The FIVE methodology uses a conservative screening approach. The fire areas that did not screen in the FIVE analysis were evaluated more realistically using the fire PSA approaches described in Reference 4-10. This is discussed in Section 4.6.4.

4.1 FIRE HAZARD ANALYSIS The fire IPEEE used the existing Waterford 3 Fire Hazards Analysis, described in the

]

FSAR [Ref. 4-7, Section 9.5.1]. The Waterford 3 Associated Circuits Analysis (ACA) i and Cable and Conduit List (CCL) [Ref. 4-8] describe the fire hazard analysis in more detail.

4.2 REVIEW OF PLANT INFORMATION AND WALKDOWN Waterford 3 complies with 10CFR50 Appendix R through exemptions granted by the Nuclear Regulatory Commission. These exemptions were granted for various plant specific situations on a fire area-by-fire area basis and are documented in the Waterford 3 Fire Hazards Analysis (FSAR section 9.5.1).

4.2.1 Fire Areas and Fire Compartments Waterford 3 Fire Areas are bounded by barriers with 3-hour fire ratings. Barrier openings are provided with rated fire doors, fire dampers, and penetration seal assemblies.

Fire companments are bounded by non-combustible barriers where heat and products of combustion from a fire within the enclosure will be substantially confined. Only Fire Areas RAB 1, RAB 2, and RAB15RAB23 are considered to be companmentalized.

The Waterford 3 site consists of the following major structures-A.

Reactor Containment Building (RCB)

B.

Reactor Auxiliary Building (RAB)

Page 4-1

C.

Fuel Handling Building (FHB)

D.

Turbine Generator Building (TGB)

E.

Maintenance Support Building (MSB)

F.

Service Building (SB)

G.

Intake and Discharge Stmetures The grouping of the RCB, RAB, and FHB is referred to as the " Nuclear Island" The maintenance support and service buildings are located remotely with respect to the Nuclear Island / Generation Complex. These buildings house machine shops and office spaces; the facilities are designed and maintained in accordance with sound fire protection engineering practices. These areas are not considered for evaluation by the IPEEE, however, becrase fires in these areas can not affect important pliant equipment.

The intake and discharge structures are also located remotely from the Nuclear Island.

Both of these areas are situated on the bank of the Mississippi River, immediately across the levee from the site. These areas are not tracked for purposes of combustible loading, etc., but are considered for evaluation by the IPEEE.

A listing of Waterford 3 (FIVE) Fire Area descriptions is given in Table 4-1.

4.2.2 Walkdowns Walkdowns were performed by Design Engineering Fire Protection personnel at all stages of the evaluation. The most detailed walkdowns occurred during the data gathering and verification of the chosen fire modeling scenarios. These walkdowns involved field measurements ofignition source dimensions and distance to targets.

Cable routings for use in the walkdowns were obtained from the Waterford 3 Cable and Conduit List (CCL), a design controlled computerized database containing the fire area routings of all essential cables as identified by the Waterford 3 Associated Circuits Analysis. The CCL database is controlled and maintained by the Design Engineering configuration control process and procedures.

The checklist shown in Attachment 10.6 of the FIVE methodology was used as a basis for i

the development of the checklist used in the Waterford 3 walkdowns. This checklist was utilized only in those areas determined 'significant' during the screening process. No formal walkdown procedure was developed or utilized for purposes of this evaluation.

Design Engineering-Civil and a consultant with seismic expertise performed a walkdown review of the potential for seismically induced fires by examining tanks and piping containing combustibles liquids. This is described in Section 3, the summary of the seismic margins assessment.

Page 4-2

TABLE 4-1 FIRE AREA DESCRIPTIONS 1

Fire Aren Decerinfian CTA Coolink Tower Area A CTR Conling Tower Area R FHB Fuel Handlino Buildino 1

R AB 1 Control Ronrn Envelnne

~

~

RAB 2 H & V Mechanical Rnnm RAB3 HVAC Fouin Rm Corridor Vestibule RAB 3 A Vestibuted/ disc dreas RAR5 Electrical Penetration Area R l

RAB6 Flectrical Penetration Area A R AB 7 Relav Room Envelnne RAB8 Swit'choenr Envelone R AR 9 Auviliarv Control panel

~

RAB11 Ratterv Room R RAB 12 Batterv Room AB R AB 13 Batterv Ronm A RAB 15 RAB 23 Emerg' Diesel Gen R & Corridnrs RAB 15A FDG Oil Feed Tank Snace R RAR 16 Emergencv Diesel Generatnr A RAR 16A EDG Oil Feed Tank Snace A R AB 17 Comnonent Conline \\Qater Ht Fx R i

RAB 18 Comnonent Conlin5 Water Ht Fv A RAB 19 Comnnnent Contin 5 Water Pumn A R AR 20 Comnonent Conlinh Water Pumn AR RAB21 Comnnnent Conlin5 Water Pumn R RAB22 Dnimmino Statinn ~

RAB 23 A I -Wall Ridinactive Pine Chase RAB24 Decon Room / Hot Machine Shon RAB 25 Enuinment Access Area Mecit Flec HVAC And HP Envelone RAR 27

/

RAB 30 Admin Area Health Physics RAB11

-4 Elev Corridor And Passaceways RAR 32 Pine Penetratinns/ACCW Pitmn '

RAB 33 Shutdown Conting Ht Fv A And R R AB 34 Valve Galleries RAB 35 Safety iniection Pumn B RAB 36 Safety Iniection Pumn A RAB 37 Emer'oen'cv Feedwater Pumn A RAB 38 Emer5ency Feedwater Pumn R

~

RAB 39

-35 And -4 Flev General Ar' ens RAB 40 Diesel Storace Tank B RAB 41 Diesel Stora5e Tank A ROOFF RAB Roof F'act

_ ROOF W RAR RonfWest TGR Turbine Buildine IS intake /Discharo'e Sinacture i

Page 4-3

4.3 FIRE GROWTH AND PROPAGATION The fire model in FIVE [Ref. 4-1] was used in all fire modeling in the Waterford 3 fire

}

IPEEE. The FIVE method is a conservative estimate of the environmental conditions that l

might occur at a target as a result of a particular fire. If the predicted environmental j

conditions for a fire are lower than the damage threshold criteria (e.g., a critical damage temperature, or 700 degrees F in FIVE), the scenario is not assumed to cause failure of i

the target.

i

\\

Three fire source-target configurations are modeled in FIVE:

l l

1. Targets located directly above a fire source, in the plume;

2. Targets located outside the plume, in the hot gas layer; and

3. Targets located laterally from the fire source.

The first two fire configurations are evaluated in terms of expected environmental temperatures. For both configurations, FIVE models the formation of a hot gas layer,

)

through modeling of the four stages of enclosure fire development. Mass and energy i

balances are performed for each of the enclosure fire stages to approximate the environmental temperatures. For the first fire type, the estimate of plume / ceiling jet sub-layer temperatures are added to the hot gas layer temperatures. In the third fire configuration, radiant heat flux at the target is modeled.

The stages of enclosure fire development are:

1. Plume /ceilingjet period;

2. Unventilated enclosure smoke filling period;

3. Preflashover vented period; and

4. Postflashover vented period.

In an unventilated preflashover stage of a fire, air temperatures can be higher than in ventilated fires because no cool, fresh air is mixed into the fire plume. On the other hand, in an unventilated fire, oxygen depletion can cause the fire to burn out before temperatures he:ome hazardous. In the FIVE screening, an unventilated room with no oxygen depletion effect is conservatively assumed [Ref. 4-3].

Several other, simplifying assumptions in the FIVE fire modeling methodology contribute to its conservatism. These include neglecting the following transient effects:

Fire growth; Boundary heating; and Target heating.

l Page 4-4

In the FIVE modeling, the critical environmental conditions (those that can cause damage to cables) are described in three ways: critical temperature, critical total heat release (Qtot), and critical hen flux. These descriptions are based on the different fire source-target scenarios and are equivalent to environmental conditions that cause the damage temperature to be exceeded.

In FIVE, fires are conservatively assumed to achieve their peak heat release rate instantly and burn at this rate until the fuel is consumed [Ref. 4-3). While this is reasonable for oil fires, for electrical cabinets the heat release rate gradually increases to the peak and then falls as the combustible materials are consumed [Ref. 4-1, Figures 5a to Sc]. Figure 4-1 is a representation of this behavior. The area under each of the curves in Figure 4-1 is the total heat release, which controls the size and temperature of the hot gas layer. To make the FIVE fire medel represent a realistic fire, the duration of the FIVE fire must be set to give a total heat release equal to that of the realistic fire. A FIVE fire burning for 12 minutes at the peak heat release rate would release slightly more BTUs than a typical real cabinet fire [Ref. 4-1, Figures 5a to Sc]. This duration was used in modeling hot gas layer effects for electrical fires.

In FIVE, the fire brigade response time is used as the fire duration. Since manual suppression was not credited in the FIVE analysis, this response time is only used to calculate the total heat release for an electrical cabinet fire. A fire brigade response time of 12 minutes was used in the FIVE modeling to represent the 12 minute FIVE duration for electrical fires.

FIGURE 4-1 REALISTIC FIRES VS. FIVE FIRES 1000 e

g,v 1

E 800 isff

.. Realistic Fire 4:,

a gj600 7, -:

9 FIVE Fire

• s

,'3

- i e m 400 x

=,;

y x

j" y

n 3(m ~.

e

.c

^ 3 7.,,

x 0

0 10 20 30 Time From ignition (min)

Page 4-5

f Results of fire models were used in a variety of ways:

In some cases, fire modeling was used to show that the available ignition sources (both l

fixed and transient) had no potential to damage any of the essential targets in the compartment. These compartments were screened out as a result.

In other instances, fire modeling was used to show that the available ignition sources had no potential to damage targets of certain essential systems in a compartment. This '

i information was used in a Probabilistic Risk Assessment type evaluation to requantify the core damage frequency.

i Fire modeling was also used to demonstrate that in certain areas without in-situ j

ignition sources, transient sources did not have the potential to damage essential targets if their locations were limited to specific areas within the compartment.

i Finally, fire modeling was used to demonstrate the validity of Appendix R Safe i

Shutdown train separation in those fire areas with part-height one-hour rated walls.

4.4 EVALUATION OF COMPONENT FRAGILITIES AND FAILURE I

MODES A temperature of 700 degrees F was used as the failure temperature for IEEE-383 qualified cables. Per the FIVE methodology, a damage temperature of 425 degrees F should be applied for any non-rated cabling. All cable runs (i.e. potential targets) at Waterford 3 nre made with IEEE-383 rated cables.

In the FWE screening, through Phase II Step 2, any equipment in a fire area or with associated cables passing through a fire area was assumed failed. Only in the fire modeling phase were cable failure temperatures used. In the fire modeling part of the FIVE screening, if any essential cable in a fire area was predicted to reach the critical temperature, all cables were assumed to fail; only if no fire could cause any essential cables to reach the critical temperature would an area be screened out as a result of fire modeling.

In the fire PSA evaluation of areas not screened out, specific fire scenarios were modeled.

The FIVE models were used for evaluating the effects of these fires. This included the FIVE assumptions ofinstantaneous fire growth and a peak heat release rate sustained for 12 minutes. The FIVE critical damage temperatures were used in the modeling of these fire scenarios.

t In most cases, if cablea were predicted to exceed the critical damage temperature for a fire scenario, the associated equipment was assumed failed. In certain cases involving the EFW control and isolation valves, however, analysis of the specific fire-induced failures was required.

i Page 4-6

The EFW control and isolation valves are air-operated with DC-powered solenoid valves to control the air to the diaphragms. There are four injection paths, two for each Steam Generator.

Each path has one control valve and one isolation valve. To ensure that the ability to isolate a Steam Generator during a SGTR or Steam Line Break is not lost if one DC power train is lost, the power to the valve solenoids is arranged so that each of the four injection paths has one A-powered valve and one B-powered valve. In certain fire areas, the dominant failure in the FIVE screening was failure of all four EFW injection paths due to hypothetical hot shons in the A or B DC cables to the control and isolation valves. Realistically, the probability of multiple hot shorts occurring in different cables, without causing any other shons that would trip the DC supply breaker (which would deenergize and open the valves), is extremely low. A conservative probability of 0.01 is assumed for such a remote possibility. In the case of the ESFAS cabinet in the RAB Switchgear Room (RAB-8), the arrangement of the circuit makes the possibility of multiple hot shorts without tripping of the DC supply breaker, though still remote, more likely than in the rest of the circuits. Therefore, for fires in the ESFAS cabinets, a conservative probability of 0.1 is assumed for the occurrence of multiple hot shorts in the EFW valve cables.

4.5 FIRE DETECTION AND SUPPRESSION 4.5.1 Automatic Suppression The majority of plant areas are provided with automatic suppression systems. These systems protect either entire areas, safety related equipment / cabling in an area, or areas of high hazard. At Waterford 3, suppression systems installed include preaction, deluge, wet-pipe, and halon.

For this evaluation, it has been verified that the automatic suppression systems were designed and installed in accordance with the National Fire Codes and sound fire protection engineering principles. The systems were installed by qualified contract installers; all materials and workmanship were obtained at the Quality Class 2 level.

Automatic suppression system unavailability values take into consideration the failure of systems to operate on demand and systems being out of sersice when needed at the time of a fire. The unavailability data is generic industry data. There is not suflicient plant data to estimate plant-specific automatic suppression system unavailabilities.

From the FIVE methodology, Attachment 10.3 Table 2 [Ref. 4-1], the automatic suppression system unavailabilities applicable to Waterford 3 are:

Wet Pipe Sprinkler 2E-02 Preaction Sprinkler SE-02 Automatic suppression is not credited in the FIVE screening. In the fire PSA evaluation of areas not screened out, automatic suppression is credited in scenarios for which fire modeling showed that the time to fire damage would be greater than the actuation time of the automatic suppression system.

Page 4-7 i

4.5.2 Manual Suppressian The FIVE screening does not credit the manual actuation of suppression systems.

However, the response time of the site fire brigade was used to determine the Qact for certain combustibles (electrical cabinets, motors). Discussions with the plant fire protection engineer and with the fire brigade training coordinator determined that, based on actual drills, the brigade can respond to all drilled plant locations within 10 minutes.

For purposes of this evaluation, the brigade was considered to respond to any plant area within a more conservative 12 minutes. Manual suppression was not credited in the FIVE analysis.

In the fire PSA evaluation of areas not screened out, manual suppression was implicitly included in the analysis. The EPRI Fire Events Database [Ref. 4-2] was reviewed to determine the fraction of fires that were large. In the calculation of these large fire fractions, many fires were manually suppressed before significant fire damage occurred. It must be presumed that manual suppression was effective in preventing damage in some of these fires. Explicit credit for manual suppression was not taken in the Waterford 3 fire IPEEE.

4.6 ANALYSIS OF PLANT SYSTEMS, SEQUENCES, AND PLANT

RESPONSE

4.6.1 Methodology l

l The analysis of plant systems, sequences, and plant response was performed in two major parts: a conservative screening using the EPRI FIVE methodology and a realistic fire PSA evaluation of the areas not screened out.

4.6.1.1 FIVE Screening The FIVE method is a progressive screening approach. It quantifies: (1) the frequencies of fire ignition in specific plant areas, (2) the availability of automatic suppression systems, (3) the availability of redundant or alternate safe shutdown systems, (4) the probability of having suflicient combustibles and heat release to cause damage to shutdown systems, and (5) the probability of manual suppression effectiveness. This analysis considers all Waterford 3 plant areas. The evaluation places emphasis on estimating the fire ignition frequencies and availability of safe shutdown equipment previously identified through compliance with 10CFR50 Appendix R The methodology uses a core damage frequency l

screening level of IE-06. Fire Areas or Compartments with frequencies less than 1E-06 at any poirt in the process were screened out and further analysis was not required.

Page 4-8 i

i i

The steps in the FIVE screening are:

1. Phase I of the methodology determined the locations (by Fire Area) of all i

equipment / components / cables essential for a safe plant shutdown in the event of a fire.

j Areas that contained essential equipment / cables were not screened out in Phase I; in' i

addition, all areas containing essential components were conservatively considered to be plant trip initiators.

' Certain Appendix R exemptions impacted the manner in which the FIVE analysis was performed. Primarily, the existence of partial height one-hour rated fire barriers in fire areas RAB 7 (relay room envelope) and RAB 8 (switch gear envelope) created the j

need to determine, through fire modeling, the impact of a fire in one ' room' on the others. The determination was made with fire modeling as opposed to Fire Compartment Interaction Analysis (FCIA) because the barriers do not meet the definition of" fire companment" barriers since products of combustion would not be confined to the room ofinitiation. The existence of a wall section with less than a 3-

)

hour fire rating between fire area RAB 15 (Emergency Diesel Generator 'B') and RAB 23 (Access Corridor) created the need to combine these two fire areas into one area comprised of two compartments. This was done in order to meet the definition for

" fire area" as documented in the FIVE methodology.

2. The Fire Companment Interaction Analysis (FCIA) was applied (where applicable) to identify the potential for fire spread between fire compartments within fire areas. As a result of the plant configuration, only three fire areas were considered companmentalized for purposes of this evaluation.

3. Phase II Step 1 of the methodology consisted of determining the ignition source frequencies for each fire compartment. Fire compartments with ignition source frequencies less than 1.0E-06 were screened out and funher analysis was not specified.

4. Phase II Step 2 involved determining the likelihood ofinitiating a fire (F1 values) and failing to restore the lost function (s) with alternate / redundant systems (P2 values).

The fire PSA model was used to estimate the failure probabilities for the alternate / redundant systems (the P2 values). At this point, fire compartments with frequencies ofless than 1.0E-06 were screened out and fire modeling was not required.

5. Any compartment not screened out following completion of Phase II Step 2 was analyzed with Fire Modeling. Fire Modeling was used to determine if available in-situ ignition sources were significant enough to damage essential targets in the compartment. Those areas with no in-situ ignition sources were modeled with a transient fire in the compartment's " worst case" location.

Page 4-9

~. - --

4 l

i Ml2 Fire PSA Evaluation of Areas Not Screened Out l

The areas that did not screen in the FIVE evaluation were evaluated further using the fire modeling capabilities of the FIVE methodology to determine which essential cables could actually l

be failed by fires in the areas not screened out (FIVE initially assumes that all cables in an area are l

failed). These FIVE modeling results were used to refine the list of failed systems in the calculation of redundant train unavailability (which used the Waterford-3 Probabilistic Safety i

Assessment (PSA) model). For example, in an area with many cables and fire sources, FIVE l

assumes that any fire would fail all the cables in the area. Fire modeling, however, might show that one pump would fail one particular train of EFW and nothing else, and one electrical cabinet

[

would fail another particular train of EFW. For these cases, fire scenarios were developed, and the PSA model was quantified for these cases. Then the fire frequencies for the sources in each l

scenario were estimated and the probability of each scenario was calculated by multiplying the scenario fire frequency by the conditional core damage probability for the scenario. The total core damage probability for the area was the sum of the scenario probabilities.

j Appendix R systems are those systems which are (1) required to maintain hot standby

[

conditions or (2) required to achieve and maintain cold shutdown conditions in the event i

of a fire. The Wtterford 3 Associated Circuits Analysis documents the systems that are j

essential to safe plant shutdown in the event of a fire (in other word, Appendix R systems). Only the following systems are required and credited in the Waterford 3 PSA l

mod <:1:

j ACCW Auxiliary Component Cooling Water l

CC Component Cooling Water CHW Chilled Water l

i EFW Emergency Feedwater l

EG Emergency Diesel Generator HPSI High Pressure Safety Injection HVCC Component Cooling Water Pump Fan Coolers HVEF Emergency Feedwater Pumps Fan Coolers

{

HVEG Diesel Generator HVAC l

HVS Safeguards Room HVAC MS Main Steam j

i Non-Appendix R Systems Credited in the development of the safe shutdown system unavailability (P2) numbers are Auxiliary Feedwater and Off-Site Power.

The cable routings were verified using the Cable and Conduit List and raceway layout drawings in determining the'affected fire areas prior to the systems being credited in the analysis.-

Page 4-10

1 4.61.3 Evaluation of Fire-Induced Containment Failures

- An review'was performed to determine if there could be any fire-induced comaisunent i

failures different from those identified in the internal events analysis {Ref. 4-11]. The review consisted of two parts: review of potential containment isolation failures and review of potential containment heat removal failures. This review was done for areas that were not screened out because the core damage frequencies for areas that were screened out were too low to be significant.

Waterford 3 FSAR Table 6.2-32 lists the valves required to close on a containment isolation actuation signal (CIAS). The fire area routings of support cabling for these valves were obtained using the Waterford 3 Cable and Conduit List; the routings were i

checked for route points within the boundaries of fire compartments not screened out by l

the FIVE methodology. These cable routings were reviewed to determine if a fire in an l

area that was not screened out could cause a failure of containment isolation.

A listing of Containment Cooling System Fan Coolers required for containment heat i

removal and their fire area routings was developed. The routings of the cables associated with the operation of these fan coolers were determined using the Waterford 3 Cable and Conduit List (CCL); the routings were checked for route points within the bounds of fire compartments not screened out by the FIVE methodology. These cable routings were reviewed to determine if a fire in an area that was not screened out could cause a failure of containment heat removal.

j l

4.6.2 Assumptions 4.6.2-1 Each fire area (excluding RAB 1 and RAB 2) was considered to be one fire I

compartment, regardless of the number ofindividual rooms in the fire area. Because fire compartment boundaries must be able to contain the products of combustion, only j

fire areas RAB 1 and RAB 2 are considered compartmentalized.

Due to an existing exemption for an Appendix R barrier ofless than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, two fire areas RAB 15 and RAB 23 were combined to determine the potential for fire spread (this combined fire area is identified in the ar.alysis as RAB15RAB23).

4.6.2-2 For purposes of this evaluation, all fire compartments containing essential

. components were conservatively considered to contain plant trip initiators. In

' addition, a fire in the Turbine Building was considered to cause a plant trip.

4.6.2-3 It was assumed that all field routed cable is IEEE-383 rated as called for in purchase specifications.

~

Page 4-11 i

i I

i

4.6.2-4 The Waterford 3 ACA considers support ventilation as being essential for safe plant shutdown. These systems have been included as safe shutdown systems for this evaluation.

4.6.2-5 The Waterford 3 ACA considers the cabling for temperature elements of support ventilation to be essential. These cables / raceways were not considered to be " targets" for purposes of fire modeling due to the physical arrangement and function of the individual temperature elements. Several temperature elements are widely dispersed throughout any given room in order to provide more sampling points; the air handling unit coil alignment (heating or cooling) is controlled by the highest or lowest single temperature element in the room. Performing fire models for any one temperature element and its associated cabling is meaningless in consideration of the functional intent.

4.6.2-6 The heat release rates for pump motors, fan motors, and electrical cabinets was 2

considered to be 65 BTU /sec-R [Ref. 4-10, Appendix I].

4.6.2-7 Only the worst case scenario for a given type and size ofignition source was modeled.

4.6.2-8 A typical plant waste can was calculated to have a heat release rate of 214 BTU /sec-n2 based on the following contents:

15 lbs Newsprint @ 19.7 MJ/kg 15 lbs Cotton Rags @ 20.4 MJ/kg 15 lbs Corrugated Paper @ 2.2 MJ/kg 4.6.2-9 Reactor trip induced by a fire will not cause a grid-related loss of offsite power (LOOP). This is consistent with the IPE assumption of no LOOP on reactor trip and is based on Entergy studies of the effects on the grid of a Waterford-3 trip. LOOP due to fire damage to the offsite power feeds is included in the screening analysis. Note that FIVE does not require the use of the Appendix-R assumption of no ofTsite power.

4.6.2-10 Failure to trip the reactor is included in the Level 1 PSA in the ATWS event tree. In the present analysis, the potential for a fire to cause a transient without a reactor trip is judged to be remote. In the case of a fire in the control room area (RAB-1), the Appendix R analysis assumed that the operators would trip the reactor before evacuating the control room. If the RPS cabinets were somehow afTected by a fire, the Diverse Reactor Trip System (DRTS) could be actuated from the control room. In the incredible event that the reactor could not be tripped from the control room, the operators could manually trip the reactor at the M/G sets or CEDM cabinets (brth in the switch gear area--RAB-8). In the switch gear area, fire modeling showed that no fire could damage more than one division of safe shutdown cables. No reasonable scenario could be hypothesized that would cause a failure to scram.

Page 4-12

4.6.2-11 Normal RCS level' control using charging and letdown is not considered a significant safety function in the IPE PSA model (Reference 5). Since the present analysis adapts the IPE acceptance criteria, failure of normal charging and letdown is not assumed to affect core damage probability. The availability of safety injection is included in the analysis of fire-induced LOCAs.

4.6.2-12 Instrumentation is generally not considered in the IPE to be a 34.tificant factor m core damage risk. The Appendix R analysis deternired that separation (by distance or fire l

wrap) exists for instrumentation essential for safe shutdown. On the basis of the l

5 component failure rates in the IPE model data base, random (non-fire-induced) instrumentation failures (power supply and sensor failures) are ofinsignificant probability. For example, the following failure rates for instrumentation-related l

components come from the IPE data base [Ref. 4-11]:

Component Failure Rate (for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time)

Pressure Transmitter 3.6E-5 Temperature Transmitter 3.6E-5 120 V Bus 2.9E-6 Logic Circuit 9.4E-5 Thus, the probability of a fire failing one train ofinstrumentation, the random failure of the redundant train ofinstrumentation, and core damage due to operator failure to respond is assumed to be insignificant.

4.6.2-13 A fire in the remote shutdown panel room (RAB-9) is assumed not to cause any system failures because the panel is normally isolated from the main control panels.

4.6.2-14 A fire in the control room (RAB-1 A) or cable vault (RAB-lE) is assumed to cause system failurrs only if control can not be transferred to the remote shutdown panel.

The failure of the operators to transfer control to the remote shutdown panel is modeled using the Time Reliability Correlation (TRC) method used in the IPE.

4.6.2-15 In RAB-8, fire modeling demonstrated that the offsite power bus ducts would not be damaged by a fire in the switch gear area. Therefore, in the detailed evaluation of RAB-8, offsite power was assumed available.

4.6.2-16 Ten minutes is assumed to be required for operators to perform local recovery actions, such as manually opening valves failed closed by fire-induced shorts.

4.6.2-17 Because of the difficulty of determining the cable routing of all necessary components, the main feed water and condensate systems were assumed not to be available.

4.6.2-18 The AB essential chiller was assumed not to be normally mnning, since this is the basis of the HVAC modelin the PSA model. Since the AB chiller is the Appendix-R Page 4-13

protected chiller, this is slightly conservative in that the chillers are rotated--thus, part of the time the AB chiller is running and would not require operator action to start.

4.6.2-19 For fires affecting the EFW control and isolation valves, the probability of multiple hot shorts occurring in different cables, without causing any other shorts that would trip the DC supply breaker (which would deenergize and open the valves), is to be 0.01. For fires in the ESFAS cabinets, a probability of 0.1 is assumed for the occurrence of multiple hot shorts in the EFW valve cables. This is discussed in more detail in Section 4.4.

4.6.2-20 A fire brigade response time of 12 minutes was used in the FIVE modeling process. Since manual suppression was not credited in the FIVE analysis, this response time is only used to calculate the total heat release for an electrical cabinet fire; it does not represent a real response time. This is discussed in more detail in Section 4.3.

4.6.3 FIVE Screening 4.6.3.1 Phase I Screening (Qualitative Analysis)

Phase I screening allows a fire area to be screened out from funher evaluation if there are no Appendix R safe-shutdown components (equipment and/or cabling)in the area and a fire event in the area does not create a need for safe-shutdown functions [Ref. 4-1].

Based on these screening criteria, four fire areas screened out in Phase I: RAB 22, RAB 24, IS, and FHB. None of these areas contain Appendix R safe shutdown equipment, components, cables, or other reactor trip initiators.

4.6.3.2 Fire Compartment Interaction Analysis The Fire Compartment Interaction Analysis (FCIA)in FIVE was performed on the three compartmentalized fire areas: RAB 1, RAB 2, and RAB15RAB23. The FCIA was not used to screen out any fire areas. It was only used to confirm that a fire in one of the fire compartments could not spread to an adjacent compartment in the fire area. The FIVE manual [Ref. 4-1] describes the criteria and methods used to evaluate potential fire spread between compartments. The FCIA determined that fire spread between the compartments in RAB 1, RAB 2, and RAB15RAB23 was not credible and that these compartments could be treated separately in the Phase Il screening.

Page 4-14 l

i

. L6.3.3 Phase II Step 1 Screening (Fire Frequencies) 4.6.3.3.1 Ignition Sources Fixed or transient ignition sources are individual pieces of plant equipment or hot work activities (grinding, welding) that hr ve the potential to ignite nearby combustibles and cause damage to essential equipment er cables.

i The ignition source count was accomplished using the Waterford 3 Station Information l

Management System (SIMS) and the Waterford 3 General Arrangement Drawings, In addition, the B289 Drawing series (Motor and Power Distribution) was utilized to obtam cubicle counts for switch gear and MCC units. All information in SIMS and on the drawings was assumed correct as shown for the initialignition source count. The ignition sources were counted using the guidelines outlined in the EPRI Fire Induced Vulnerability.

Evaluation (FIVE) and Appendix D of the EPRI Fire PSA Implementation Guide.

Reference 4-11, Attachment I, is a listing of the ignition sources for the Waterford 3 malysis. The following assumptions were made:

1.

All electrical cabinets, regardless of size were counted. Switch gear cabinets and Motor Control Centers were counted as groupings ofindividual cubicles (compartments). Using the Switch gear and MCC panel layout drawings, cubicles marked SPARE were included in the count, those marked SPACE were not included. Other electrical cabinets counted included: Power Distribution Panels (PDPs), Local Control Panels (LCPs), Control Panels (cps), Lighting Panels (LPs), Instrumentation Cabinets (I&C CABS), and Multiplexers (MUXs).

2.

All pumps, regardless of size were counted.

3.

Transformers located outside electrical cabinets were included in the ignition source count. Transformers found during walkdowns to be totally enclosed were removed from the count.

4.

Ventilation system fan motors were counted regardless of size.

5.

Battery banks ofindividual cells were counted as one battery.

4.6.3.3.2 Fire Events Database The EPRI fire events database was used by the FIVE methodology as the basis for the fire frequencies. determined by the analysis. Waterford 3 fire experiences do not significantly differ from the types of fires reported in the database. For this reason, this evaluation utilized the information found in the database.

Page 4-15

4.6.3.3.3 ContainmentFires Due to the relatively small number of containment fire events and the fact that previous

' fire PSAs have not shown containment fires to be risk significant, Ontainment hres are not considered in the FIVE fire frequency data. This exclusion is furtherjustined by the fact that a hot gas layer with potential to damage cables is extremely unlikely to develop in the large containment volume. Additionally, a majority of past containment fires involved reactor coolant pumps (RCPs); these fires are seen as less likely with the improvements to the oil col' : tion systems.

The FIVE project team performed a qualitative assessment of the existing design features.

l and level of fire protection for essential componentsin the Waterford 3 containment. For the following reasons, containment fires at Waterford 3 are not viewed as credible events:

1.

. Containment volume is approximately 2,684,000 cubic feet. The interior is free of

. confined spaces that can trap the products of combustion. It is, therefore, highly unlikely that a hot gas layer will form with potential to damage cabling.

2.

Areas of concentrated cable raceways are protected with both detection and automatic suppression.

3.

The reactor coolant pumps are provided with a lube oil collection system in accordance with Appendix R.

i 4.

The reactor coolant pumps are provided with heat detection and an automatic preaction suppression system.

5.

A Combustible Gas Control System is designed in accordance with General Design Criterion 41 of 10CFR50 Appendix A and Regulatory Guide 1.7. It consists of: a hydrogen analyzer system, a hydrogen recombiner system, and the Containment Atmosphere Release System.

4.6.3.3.4 Plant Location Weighting Factors The ignition source weighting factors utilized were obtained from the FIVE manual pages 10.3-3.

Auxiliary Building i

i Diesel Generator Rooms 1

Switch gear Rooms 0.33 t

Battery Rooms 0.33 Control Room 1

Cable Spreading Room 1

Intake Structure 1

1 Page 4-16

i l

Turbine Building i

Transformer Yard 1

4.6.3.3.5 Ignition Source Weighting Factor The ignition source weighting factors utilized were obtained from the FIVE manual pages 10.3-4 and 10.3-5.

4.6.3.3.6 Fire Frequency i

With one exception, fire frequencies utilized for this evaluation were taken from the FIVE methodology Reference Table 1.2 shown on pages 10.3-4 and 10.3-5 of the FIVE manual.

The fire frequency used for transient welding / cutting fires was 1.55E-03. This figure is based on the number shown in the FIVE manual (3.1E-02) multiplied by the unavailability of an automatic suppression system ($,0E-02). This requantification is justified based on

' the administrative controls in place at Waterford 3. Cutting, grinding, and welding are all-considered ' hot work activities' and require the presence of a trained fire watch (in accordance with OSHA requirements) with the appropriate extinguishing equipment (as determined by plant fire protection engineering). For purposes of this evaluation, the equipped fire watch is considered at least as effective as an installed automatic suppression system.

4.6.3.3.7 Fire Compartments Screened Out by Frequency ofIgnition All Waterford 3 fire areas were considered to contain at least the possibility of a transient fire and a fire due to welding. As a result, no fire compartment screened out in Phase II step 1.

4.6.3.4 Phase II Step 2 Screenine (Safe Shutdown System Conditional Failure) 4.6.3.4.1 IPE Accident Sequences Utilized The FIVE methodology defines a safe and stable shutdown condition as "that point in reactor shutdown where sub-critical reactivity and reactor coolant inventory, temperature, and pressure can be maintained at target values for a period of at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without damage to the core.

The target shutdown mode of operation selected (e.g., mode 3,4, or 5) should be consistent with that achieved in the plant's IPE." Since our IPE used mode 3, the present analysis also uses mode 3, with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time.

The fire fault tree was developed from the transient sequences in the IPE PS A model [Ref. 4-11].

The three transient sequences are: TB (a transient with failure of RCS and core heat removal, i.e.,

loss of all feedwater), TQ (RCP seal LOCAs with failure of safety injection), and TPQ (stuck-open pressurizer safety valve with failure of safety injection). For the fire analysis, the TQ and

- TPQ sequences were not separated into injection and recirc failures, since a Level 2 analysis was Page 4-17

not necessary. A fire-induced initiating event was modeled as a simple reactor trip (TI), since, in most cases, an uncomplicated manual trip would be performed. The fire quantification process includes fire-induced failures explicitly. For example, if the fire were in the switch gear room (RAB-8), the main, startup, and bypass feed water valves and the feed water isolation valves could be affected, potentially causing a loss of feed water event. The fire quantification explicitly accounts for this possibility by failing all of these potentially affected components (anything with cables running through the area).

l Main feed water and condemate were not credited and were removed from the fire PSA model.

(The main, startup, and bypas s feed water valves and the feed water isolation valves were left in to model fire-induced failures of these valves that fail AFW.) This left EFW and AFW as the only systems modeled in safety function B (core and RCS heat removal). In essence, the fire PSA model is a transient with a Tl initiator and failure of EFW and AFW.

For the TQ and TPQ sequences, the loss of heat removal sequences (TQB and TPQB) were not included because these are essentially TB sequences with additional failures which make them bounded by TB.

1 4.6.3.4.2 Adjustments toIPE Cut Sets The calculation of safe shutdown system conditional failure probability was performed by solving the Level 1 PSA fault tree, described above, with all the fire-affected systems or components failed (set to tme). Therefore, no adjustments to the IPE cut sets were needed. This section describes the method used to solve the PSA model and the operator actions assumed.

i The PSA model was used to calculate the unavailability of redundant safe shutdown trains (the P2 values in the FIVE analysis). For mode 3, the safe shutdown function is feed water (normal or emergency). Main feed water and condensate were assumed unavailable in the analysis, bmuse j

of the difficulty in tracing the routing of cables. For each fire area, the analysis determined which trains of feed water (AFW and EFW A, B, and AB), and their support systems, could be affected by a fire (in the FIVE screening, if a cable or component is present in a fire area, it is assumed failed). The failed trains in the PSA model were then set to True (failed) and the model was quantified. The reactor trip initiator (TI), set to True (failed), was used to represent fire-induced reactor trips. This gives a conditional core damage probability (P2 in FIVE) that, when multiplied by the fire frequency (FI) in FIVE, gives the core damage probability.

The Associated Circuits Analysis was used to determine the systems failed. This analysis included the determination of which cables are essential fv safe shutdown and the affects of fire on these

]

cables. Use of the Associated Circuits Analysis is consistent with the FIVE method, which uses the results of Appendix R analyses to determine the systems failed.

The existing operator recoveries (from the Level 1) were reviewed to ensure that they would be l

valid in a fire scenario. If a recovery could be affected by a fire, it was adjusted to reflect the possible effect. In most cases, this meant setting the recovery to True (failed)in the fault tree. In

- Page 4-18

some cases, the recoveries were given a higher probability in the fault tree or were set to True in the appropriate cutsets.

The following recovery events were added to the model to credit operator action to manually open valves potentially failed by a fire. The human failure probability (HFP) was quantified as ex-control room, with 50 minutes available (consistent with the IPE, Ref. 4-11) and 10 minutes assumed to be required to perform the action. This gives an HFP of 0.084, which was rounded

. up to 0.1.

ZVLVS_ ROOF Operator manually opens an EFW control or isolation valve, MS401 valve, or FW bypass valve on the roof of the RAB.

ZVLVSRAB39 Operator manually opens an EFW-AB pump steam supply valve in RAB-39.

I 4.6.3.4.3 Fire Compartments Screened Out by Frequency ofSafe Shutdown System ConditionalFailure (P2) -

No P2 value was less than 1.0E-06. As a result, no fire areas screened out due to frequency of safe shutdown system conditional failure.

4.6.3.4.4 Fire Compartments Screened Out by CombinedFrequency ofIgnition and Safe Shutdown ConditionalFailure (F1 x P2)

Table 4-2 shows the fire compartments screened out in Phase II Step 2 due to F2 less than 1.0E-06.

4.6.3.5 Fire Modeling Fire modeling was performed for the areas not screened out after Phase II Step 2 (except RAB-1 A and RAB-15, which are evaluated in Section 4.6.4). Critical combustible loading evaluations were performed in preparation for fire modeling. Then fire modeling was performed using the FIVE fire modeling method described in Section 4.3. The fire models were used both in the FIVE screening and the fire PSA evaluation of areas not screened out. The fire models are described below by fire area / compartment. Two areas, RAB-2A and RAB-30 screened out in the fire modeling step of the FIVE screening because the modeling showed that no essential cables could be damaged by a fire. The remaining areas did not screen in the fire modeling step and are evaluated in Section 4.6.4.

Page 4-19

TABLE 4-2 FIRE COMPARTMENTS SCREENED OUT IN PHASE II STEP 2 Fire Area Fire Comp Description F1 P2 F2 CTA CTA Cooling Tower A 3.14E-03 1.1IE-05 3.49E-08 CTB CTB Cooling Tower B 2.76E-03 3.73E-06 1.03E-08 RAB1 RABIB Control Room HVAC Room 5.80E-04 2.1lE-05 1.22E-08 RAB1 RABIC Control Room Access Corr 2.47E,-04 2.24E-06 5.53E-10 RAB1 RABID Computer Room 2.27E-04 2.24E-06 5.08E-10 RAB11 RAB11 Battery Room B 2.46E-04 3.09E-06 7.60E-10 RAB 12 RAB 12 Battery Room AB 6.72E-04 6.88E-06 4.63 E-09 RAB 13 RAB 13 BatteryRoom A 2.46E-04 2.24E-06 5.50E-10 RAB 15A RAB 15A EDG B Oil Feed Tank 2.60E-04 3.09E-06 8.03E-10 RAB 16A RAB 16A EDG A Oil Feed Tank 2.60E-04 2.24E-06 5.82E-10 RAB 17 RAB 17 CCW Heat Exchanger B 5.79E-04 1.29E-03 7.47E-07 RAB 18 RAB 18 CCW Heat Exchanger A 4.56E-04 1.1IE-05 5.06E-09 RAB 19 RAB 19 CCW Pump A 4.37E-04 5.95E-06 2.60E-09 RAB 20 RAB 20 CCW Pump AB 5.10E-04 1.22E-05 6.22E-09 RAB 21 RAB 21 CCW Pump B 5.61E-04 2.12E-05 1.19E-08 RAB 23A RAB 23A L Wall Radioactive Chase 1.30E-04 2.49E-05 3.23 E-09 RAB 25 RAB 25 Equipment Access Area 1.13E-03 1.74E-04 1.96E-07 RAB 27 RAB 27 HP Envelope (+7 Elev) 1.99E-03 7.21E-06 1.43E-08 RAB 3 RAB3 Equip Room, Corridor 1.22E-03 1.70E-04 2.08E-08 RAB3A RAB3A Vestibules / Misc Areas 8.18E-04 3.08E-05 2.52E-08 RAB 32 RAB 32

-4,-35 Wing Areas 2.91E-03 9.91E-05

. 2.88E-07 RAB 33 RAB 33 Shutdown Heat Exchangers 6.52E-04 3.08E-05 2.01 E-08 RAB 34 RAB 34 Valve Galleries 8.77E-04 3.00E-05 2.63E-08 RAB 35 RAB 35 Safetylujection Pump B 1.35E-03 3.06E-05 4.13 E-08 RAB 36 RAB 36 SafetyInjection Pump A 1.32E-03 6.78E-05 8.93E-08 RAB 37 RAB 37 EFW Pump A 5.61E-04 1.07E-03 6.00E-07 F.AB 38 RAB 38 EFW Pump B 8.62E-04 3.00E-05 2.60E-08 RAB 40 RAB 40 Diesel Storage Tank B 4.70E-04 2.24E-06 1.05E-09 RAB 41 RAB 41 Diesel Storage Tank A 4.70E 04 3.09E-06 1.45E-09 RAB 5 RAB5 Elec. Penetration Area B 2.36E-04 6.67E-04 1.57E-07 RAB9 RAB 9 Auxiliary Cont oI Panel 3.51E-04 2.24E-06 7.86E-10 RAB15RAB23 RAB23

+21 RCA Corritor 2.21E-03 3.12E-05 6.90E-08 ROOFE ROOFE RAB Roof East 2.598E-04 2.24E-06 5.82E-10 ROOF W ROOF W RAB Roof West 2.598E-04 2.24E-06 5.82E-10 Page 4-20

'4.6.3.5.1 Critical Combustible Loading Evaluations Critical combustible loading evaluations were performed in preparation for fire modeling.

These evaluations were used to determine the probability of existing combustibles j

damaging essential equipment and/or cabling. In-situ, or fixed, combustibles were evaluated first to estimate a damage probability. In fire compartments without sufficient i

fixed combustibles to cause damage, transient combustible fires were evaluated.

Fixed combustibles are identified in the Waterford 3 Combustible Loading Calculations (CLCs) as in-situ combustibles. Fixed combustibles not identified in the CLCs but considered for purposes of this evaluation include:

Motors (Lubrication, etc.)

Pumps (Lubrication, etc.)

Electrical Cabinets (Cabling, etc.)

Transient combustibles are any combustible or flammable material that is not permanently installed or in a designated staging area. Transient combustibles typically found include trash in site approved containers, combustibles associated with specific work activities (lubricants, rags, etc.), and tools (rope, wood chisels for penetration seal material removal around energized cables, etc.).

The Waterford 3 Fire Protection Group issues less than 50 transient combustible permits during a non-outage calendar year. No repetitive or generic concerns with regards to transient combustibles have been identified through the condition report program. Controls for the handling, storage and use of transient combustibles are outlined in site procedure FP-001-017

" Transient Combustibles and Designated Storage Areas". This procedure requires that all work orders involving the use of transient combustibles include a Transient Combustible Permit and subsequent review / approval by plant Fire Protection Engineering. The control procedure also requires transient combustibles be removed from the plant or otherwise protected from ignition j

sources when unattended. It is necessary to store transient combustibles for an extended period due to maintenance or operations activities, a designated storage area may be designated by the Fire Protection Staff upon review of existing combustible loading and defense-in-depth features.

4.6.3.5.2 Fire Area RAB 1, Fire Campartment RAB JE Fire Compartment RAB IE is one fire zone of Fire Area RAB 1 (Control Room Envelope), RAB 1E is the plant Cable Spreading Room and is located directly beneath the Control Room Proper at elevation +35.00 (bounded by columns 8A-10A and G-K).

This area contains essential cabling in both solid bottom cable trays and conduit. The floor area is roughly rectangular in shape; surface area is determined as 50' X 96' (4800 square feet). The floor elevation is +35.00 and the ceiling elevation is +45.00 for a net room height of 10 feet. This fire compartment is bounded by three hour fire walls except for the ceiling which is un-rated; this implies a potential for fire spread to RAB 1 A. This i

1 I

Page 4-21

r possibility is evaluated in Section 4.6.4. Smoke detection and automatic suppression l

systems are provided throughout the zone for full-coverage protection (sprinklers are located in the cable trays).

Field walkdown verified that there are no fixed ignition sources in this compartment. As a j

result, only a transient trash can fire was modeled.

The cable spreading room presents a virtually unlimited number of possible transient fire / target scenarios; therefore, the trash can fire was modeled in specific locations based' on'where they were found during the walkdown. The trash cans were found during the walkdowns to be located immediately inside and adjacent to the door frame. With fires at these locations, the nearest essential cables were selected as the targets. No targets were failed for these scenarios. Because there is no control over the location of transient fire sources in this area, this area was assumed not to screen out through fire modeling and

was evaluated in Section 4.6.4.

l 4.6.3.5.3 Fire Area RAB 2, Fire Compartment RAB 2 Fire Compartment RAB 2 is located in the Reactor Auxiliary Building at elevation +46

. bounded by columns I A-8A and J-L. The area contains essential air handling equipment and the essential chilled water system. The area is generally rectangular in shape; for purposes of FIVE, the floor area was considered to be 64 feet by 132 feet (8448 square j

feet). This compartment is provided with full-coverage smoke detection and automatic j

suppression.

Per the Waterford 3 Safe Shutdown Analysis and Associated Circuits Analysis, this compartment contains multiple essential targets. Due to the large number ofin-situ ignition sources, only the worst-case source-to-target scenarios were modeled. The P2 value (redundant safe shutdown train unavailability) from the Phase II Step 3 screening for RAB 2 was high due to the presence of all three trains (A, B, AB) of Essential Chilled Water (CHW); as a result, scenarios involving the raceways containing the associated essential cabling were chosen as the initial worst case.

l A Chilled Water Pump Pl(3 A-SA) lube oil spill fire was modeled against conduits 31058A-SB,31068A-SAB, and 31071B-SAB (containing essential CHW cabling associated with CHW Pump B, CHW Pump AB, and CHW Valve AB respectively).

Critical conditions were indicated for the 31068A-SAB target (critical Qtot = 1,566,136 BTUs and actual Qtot = 1,968,300 BTUs. Fire modeling did not indicate critical.

conditions for the essential cable in conduits 31058A-SB (critical Qtot = 2,797,343 BTUs

- and actual Qtot = 1,968,300 BTUs) and 31071 A-SAB (critical Qtot = 4,304,050 BTUs and actual Qtot = 1,968,300 BTUs); therefore, the 'B' train of Chilled Water will be available for a CHW Pl(3 A-S A) failure.

Page 4-22 m

-r--

w

A Chilled Water Pump Pl(3B-SB) lube oil spill fire was modeled against conduit 31066A-SAB (containing essential CHW AB cabling). Critic al conditions were indicated for 31066A-SAB since critical Qtot = 626,208 and actua' Qtot = 1,968,300; this describes failure of the 'AB' train of Chilled Water.

An Exhaust Fan E-17(3B-SB) Motor fire was modeled against cable tray C201J-SB (containing essential CHW B cabling). The estimated actual Qtot was determined to be 374,400 BTUs; the estimate of critical Qtot was calculated by the sonware to be 4,108,412 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions for this scenario were not indicated and the scenario screened out.

An Exhaust Fan E-18(3B-SB) Motor fire was modeled against cable tray C201J-SB (containing essential CHW B cabling). The estimated actual Qtot was determined to be 93,600 BTUs; the estimate of critical Qtot was calculated by the sonware to be 4,108,412 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions for this scenario were not indicated and the scenario screened out.

An Exhaust Fan E-22(3B-SB) Motor Lube Oil Spill fire was modeled against cable tray P202G-SB (containing essential CHW B cabling). The estimated actual Qtot was determined to be 1,312,200 BTUs; the estimate of critical Qtot was calculated by the sonware to be 456,378 BTUs. Because the actual Qtot was more than the critical Qtot, critical conditions for this scenario were indicated and the scenario did not screen.

A Mux RA4601 fire was modeled against cable tray C20lJ-SB:4202 (containing essential CHW B cabling). The 'in-plume' geometry was selected for this model as plant walkdown revealed that the tray is located immediately above the multiplexer location.

The plume temperature was found to be 574.99 degrees F above the target's 700 degree F damage temperature, As a result, the model indicated critical conditions. Further analysis was performed in Section 4.6.4 for this scenario. The same mux cabinet was also modeled against CHW A and CHW AB cabling in nearby cable trays, critical conditions were not indicated for either of these scenarios.

An Exhaust Fan E-23(3B-SB) Motor fire was modeled against cable tray C20lN-SA (containing essential CHW A cabling). The estimated actual Qtot was determined to be 187,200 BTUs; the estimate of critical Qtot was calculated by the sonware to be 3,130,218 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions for this scenario were not indicated and the scenario screened out.

In summary, CHW A and CHW AB are lost due to a CHW Pump A lube oil spill fire, CHW B and CHW AB are lost due to a CHW Pump B lube oil spill fire, CHW B is lest for both an E-22(3B-SB) fire and a Mux RA4601 fire. Fire modeling has shown that no single RAB 2 fire can cause the loss of all three trains of Essential Chilled Water.

I Page 4-23

4.6.3.5.4 Fire Area RAB 2, Fire Compartment RAB 2A Fire Compartment RAB 2A exists only for purposes of this evaluation. The hypothetical compartment is part of Fire Area RAB 2 and is located in the Reactor Auxiliary Building (elevation +46) north of column L between the MSIV areas on the RAB roof. This 2

compartment is asymmetrical in shape; for purposes of FIVE, the floor area was considered to be 29 feet by 88 feet (2552 square feet). This compartment is not provided with detection or automatic suppression (extinguishers are provided in accordance with the fire codes).

Per the Waterford 3 Safe Shutdown Analysis, the essential components in this compartment are limited to Emergency Feedwater Valve cables in conduits 31541L-SAB, 31541M-SAB, and 31548F1-SA. The in-situ ignition sources for this compartment include one fan motor (E-50(3)) and one electrical cabinet (MUX RAS 4601). As a result, the number of possible scenarios for fire modeling is limited.

A total of three scenarios were developed: conduits 31541L and 31541M (known as EFW train AB conduits) were modeled against both the fan motor and the electrical cabinet. For the fan motor scenario, critical Qtot = 1,048,443 BTUs and actual Qtot =

234,000 BTUs. In the electrical cabinet scenario, critical Qtot = 592,133 BTUs and actual Qtot = 585,000 BTUs. Conduit 31548F1 was modeled only against the fan motor due to proximity (critical Qtot = 1,002,980 BTUs and actual Qtot = 234,000 BTUs. In all three cases, the estimate of actual Qtot was less than the estimate of the critical Qtot; therefore, critical conditions are not indicated.

l Because neither of the in-situ ignition sources failed any target, a transient trash can fire was modeled against conduits 31541L and 31541M. The trash can was located in the corner near the personnel door to the stairwell at column 9A. The estimate of actual Qtot (227,268 BTUs) was less than the estimate of critical Qtot (590,731 BTUs); as a result, critical conditions are not indicated for the compartment and no further analysis is required.

In conclusion, no single RAB 2A fire can cause the loss of any EFW train.

4.6.3.5.5 Fire Area RAB 6, Fire Compartment RAB 6 Fire Area RAB 6 is located in the Reactor Auxiliary Building at elevation +35. RAB 6 is the Electrical Penetration Area 'A'; this area includes a large number of raceways containing cabling essential for safe shutdown. The area is asymmetrical in shape; however, for purposes of this evaluation and the associated fire modeling, the area was considered to have dimensions of 65 ft x 65 ft or 4225 square feet. RAB 6 is provided with full-coverage automatic smoke detection and full-coverage automatic suppression.

Page 4-24

.-=

1 l

j i

The area contains no fixed ignition sources. As a result, a typical plant waste can was modeled as a transient ignition source against the support cables for EFW control and isolation valves EFW-223 A, EFW-224B, EFW-228A and EFW-229B (failure of these j

four valves would isolate all EFW to the steam generators). The presence of these cabics i

was the primary contributor to the high RAB 6 P2 number. Nine fire scenarios were chosen after determining the exact layout of the valve cables in RAB 6. The trash can fire j

was placed beneath or near the worst-case locations with respect to the EFW valve cable routings. None of the scenarios indicated critical conditions for more than two of four possible steam generator flow paths; In conclusion, no single RAB 6 fire can result in the loss of more than two EFW Steam Generator flow paths.

4.6.3.5.6 Fire Area RAB 7, Fire Compartment RAB 7 Fire Area RAB 7 is located in the Reactor Auxiliary Building at elevation +35. RAB 7 is the Relay Room and contains the isolation panel as well as various auxiliary panels, local control panels, and power distribution panels. Prior to evacuation of the control room due to'a fire, control room functions are transferred to the remote shutdown panel (LCP-43)

I via the transfer switches located in this companment.

RAB 7 is comprised of five ' rooms' separated by one hour rated pan height fire walls. Fire modeling was used to demonstrate the effectiveness ofinstalled Appendix R separation barriers. This was accomplished by modeling the worst case ignition source (based on size and proximity) in each of the three relay rooms (relay room A, relay room B, and relay room AB) against the nearest unwrapped cabling of the redundant trains. The modeling scenarios were selected based on engineering judgment and information gathered during plant walkdowns. Six scenarios resulted as described in the following paragraphs.

Auxiliary Panel No. 2 was modeled as an ignition source against conduit 35189-NA (containing essential BAM AB valve cabling). The actual Qtot was determined to be 234,000 BTUs; the critical Qtot was calculated by the software to be 255,155 BTUs.

Because the actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out from further consideration.

Auxiliary Panel No. 2 was modeled as an ignition source against conduit 35188-SAB (containing essential CVC AB, CCW AB and HPSI AB cabling). The actual Qtot was determined to be 234,000 BTUs; the critical Qtot was calculated by the software to be 255,155 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out.

Auxiliary Panel No. 3 was modeled as an ignition source against conduit 35189-NA

' (containing essential BAM AB valve cabling). The actual Qtot was determined to be Page 4-25

' 234,000 BTUs; the critical Qtot was calculated by the soRware to be 255,155 BTUs.

Because the actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out.

Auxiliary Panel No. 3 was modeled as an ignition source against conduit 30588C-SMB (containing essential LPSI B cabling). The actual Qtot was determined to be 234,000 BTUs; the critical Qtot was calculated by the sonware to be 255,155 BTUs. Because the j

actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out.

4 Auxiliary Panel No, 4 was modeled as an ignition source against conduit 35188-SAB (containing essential CVC AB, CCW AB and HPSI AB cabling). The actual Qtot was determined to be 234,000 BTUs; the critical Qtot was calculated by the soRware to be 255,155 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out.

- Auxiliary Panel No. 4 was modeled as an ignition source against conduit 30588C-SMB (containing essential LPSI B cabling). The actual Qtot was determined to be 234,000 BTUs; the critical Qtot was calculated by the sonware to be 255,155 BTUs. Because the actual Qtot was less than the critical Qtot, critical conditions were not indicated and the scenario screened out.-

The models were selected as a direct result of room configuration and were used to demonstrate the lack of potential to damage redundant trains due to a relay room fire, if credit is taken for the existing Appendix R fire wrap. (Credit for fire wrap is only made in the PSA analysis, Section 4.6.4.)

4. 6. 3.S. 7 Fire Area RAB 8, Fire Compartment RAB 8 Fire Area RAB 8 is comprised of three fire zones, RAB 8A, RAB 8B, and RAB 8C (Switch gear 'A' room, Switch gear 'B' room, and Switch gear 'AB' room respectively).

However, for purposes of FIVE, this area is considered to be one fire compartment; this is based on FIVE's definition of a fire compartment boundary, "...non-combustible barriers where heat and products of combustion from a fire within the enclosure will be substantially confined." These zones are separated by one-hour partial-height walls which will not promote rapid formation of a hot gas layer within a zone, nor confine the effects Of a fire to the zone ofinitiation, j

RAB 8 is provided throughout with full coverage detection and a full-coverage pre-action

)

suppression system. Additionally, essential cables run outside "same train" switch gear j

areas are provided with one hour fire barriers in accordance with 10CFR50 Appendix R.

The worst case RAB 8A ignition source (based on size and proximity) was modeled j

against the worst case unprotected targets (based on proximity) from both 'B' and 'AB'

)

Page 4-26

trains. This same logic was applied to fires in RAB 8B and RAB 8C as well. A total of six scenarios of this type were modeled to show the lack of damage to redundant trains for a fire in one of the three trains. These scenarios are described in the following paragraphs.

An MCC3A311-S Cubicle 12 fire was modeled against cable tray C201B-SAB:2180 (nearest essential AB train). The actual Qtot was determined to be 187,200 BTUs; the critical Qtot was calculated to be 1,854,260 BTUs. As a result, the potential for damage to the redundant train was not indicated and the scenario screened out.

An MCC3A311-S Cubicle 12 fire was modeled against conduit 31536P-SB (nearest essential B train). The actual Qtot was determined to be 187,200 BTUs; the critical Qtot was calculated to be 1,854,260 BTUs. As a result, the potential for damage to the redundant train was not indicated and the scenario screened out.

An MCC3B311-S Cubicle 13 fire was modeled against cable tray C201F-SAB:2174 (nearest essential A train). The actual Qtot was determined to be 187,200 BTUs; the critical Qtot was calculated to be 1,854,260 BTUs. As a result, the potential for damage ta the redundant train was not indicated and the scenario screened out.

An MCC3B311-S Cubicle 13 fire was modeled against conduit 31536P-SB (nearest essential AB train). The actual Qtot was determined to be 187,200 BTUs; the critical Qtot was calculated to be 1,854,260 BTUs. As a result, the potential for damage to the redundant train was not indicated and the scenario screened out.

A Switchgear 3AB3-S Cubicle I fire was modeled against cable tray C201F-SA:2174 (nearest essential A train). The actual Qtot was determined to be 655,200 BTUs; the critical Qtot was calculated to be 2,225,112 BTUs. As a result, the potential for damage to the redundant train was not indicated and the scenario screened out.

A Switchgear 3AB3-S Cubicle 1 fire was modeled against conduit 31536P-SB (nearest essential B train). The actual Qtot was determined to be 655,200 BTUs; the critical Qtot was calculated to be 2,225,112 BTUs. As a result, the potential for damage to the l

redundant train was not indicated and the scenario screened out.

In addition, four scenariomere developed to model the effects of a switchgear room fire on the off-site power bus ducts (feeding power from the TGB switchgear to the RAB safety-related switchgear; after a trip, this is the source of offsite power to the safety-related buses,3A3-S and 3B3-S).1) An Inverter (located in the vicinity of the bus duct's entry point to the RAB) was modeled against the B train off-site power feel The actual Qtot was determined to be 435,708 BTUs; the critical Qtot was calculated by tim se!1 ware to be 3,337,668 BTUs. As a result, critical conditions for the scenario were not indicated and the scenario screened out. 2) A line voltage regulator was modeled against the B train off-site power feed. The actual Qtot was determined to be 351,000 BTUs; the critical Qtot was calculated to be 3,152,242 BTUs. Critical conditions were not indicated and the scenario screened out with no damage to the bus cables. 3) Mux RAS 210lRA2105 was Page 4-27

l l

i modeled as an ignition source against the B train omsite power feed. The actual Qtot was determined to be 1,404,000; the critical Qtot was calculated to be 2,595,964 BTUs.

Critical conditions were not indicated knd the scenario screened out. 4) SUPS 3MDS was l

. modeled as an ignition source against the B train off-site power feed in RAB 8B. The m-plume geometry was utilized due to plant configuration. Critical conditions were l

. indicated for this scenario due to an estimated plume temperature rise of 1600 degrees l

Fahrenheit (1000 degrees F above the target damage temperature minus the ambient ~

j temperature). These models concluded that the B off-site power feed is not vulnerable to l

a switchgear 'A' room fire but is vulnerable to a fire in the SUPS 3MDS. The A off-site power feed enters the A Switchgear Room through its south wall and immediately j

terminates in cubicle 11 of the 4.16 KV SWGR 3A3-S; the bus duct does not pass over i

any potentialignition sources or combustibles. As a result, the A off-site power feed is

}

not vulnerable to either a switchgear 'A' or switchgear 'B' room fire.

The effects of the hot gas layer were examined by repetitive models using identical sources and targets but with changing geometry (i.e. target height, target distance from source).

The method was used to locate the horizontal plane in the room that represents the lowest part of the hot gas layer at which damage temperatures are present. For these scenarios, the 'A' Switchgear room was considered " enclosed" and not open to the 'AB' and 'B' l

Switchgear rooms (this provided a more conservative hot gas layer). The hot gas layer was found to damage many additional targets; however, the time to damage for the EFW Valve cables was found to be sufficient to allow timely response of the area's automatic l

suppression system.

l 4.6.3.5.8 Fire Area RAB 30, Fire Compartment RAB 30 l

Fire Area RAB 30 is located in the Reactor Auxiliary Building at elevation -4.00' (bounded by columns 8A-12A and G-L). This area contains the Health Physics offices, the Radiation Controlled Area Checkpoint, the radiochemistry labs, and locker rooms.

This plant area is not typical of Auxiliary Building locations; as a result, essential raceways are found in only three well-defined spaces which allow for access to adjacent fire areas (penetration seals and an HVAC/ Electrical chase). For purposes of FIVE, this fire area was considered to be 56 feet X 160 feet or 8960 square feet (this figure does not account for columns and walls). The area's floor elevation is -4.00' and ceiling elevation is +6.00' for a net room height of 10 feet. This fire area is bounded by 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rated fire barriers and is provided with detection (excluding showers, toilets, and corridors) and automatic suppression (excluding showers, toilets, corridors, and chemistry labs). The ignition j

sources in this area include electrical cabinets, laundiy dryers, and pumps.

During the walkdown, it was discovered that the pumps (PW MPMP0003, PSLMPMP0002) did not contain lube oil and were sufficiently small in overall dimensions to be considered negligible. As a result, the potential sources were limited to laundry 2

dryers and electrical cabinets. A heat release rate of 65 BTU /s-fl was used for all dryers and electrical cabinets.

l i

Page 4-28 j

l l

I

1 The worst case laundry dryer (by proximity) was modeled against essential A and B train cable trays (@ plan points 3027,3028). Although the trays are vertical with respect to the j

igcition source, the "out-of-plume" geometry was utilized due to the fact that there are three ron-rated physical barriers (walls) between the chosen source and target. The fire model determined that the critical heat for damage is 872,395 BTUs. The estimate of actual heat available in the source is 748,800 BTUs. Therefore, critical conditions are not '

l indicated.

The worst case electrical cabinet (by size and proximity) was modeled against essential A -

and B train cable trays (@ plan points 3027,3028).- The fire model determined that the critical heat for damage is 636,186 BTUs. The estimate of actual heat available in the source is 561,600 BTUs. Therefore, critical conditions are not indicated.

An additional electrical cabinet was modeled to expose the essential A train conduits in the lab counting room. The fire model determined that the critical heat for damage is 884,611 ~

l BTUs.' The estimate of actual heat available in the source is 374,400 BTUs. Therefore, critical conditions are not indicated.

The third grouping of essential cables is located remotely from any ignition source (approximately 96 feet) and was not modeled based on previous RAB 30 fire modeling results.

Because all fixed ignition source scenarios screened out, it was necessary to model a transient fire. RAB 30 is primarily an office space; therefore, a trash can fire was chosen as the transient ignition source. The worst case transient fire scenario screened out and no further analysis was required.

4.6.3.5.9 Fire Area RAB 31, Fire Compartment RAB 31 I

Fire Area RAB 31 is located in the Reactor Auxiliary Building at elevation -4.00' (bounded by columns l A-10A and G-L). This area includes the Refueling Water Storage Pool, the Condensate Storage Pool, the Regenerative Waste Tank, various process pumps j

and tanks, Blowdown Heat Exchangers, and access corridors. This plant area is typical in both contents and arrangement, of Auxiliary Building locations; essential raceways are found throughout the fire area, but are concentrated in the corridors and access areas.

j RAB 31 is asymmetrical in shape; surface area is estimated from drawings to be 128 feet X 110 feet (14080 sq ft). The floor elevation is -4.00' and the ceiling elevation is +20.00' for a net room height of 24 feet. This fire area is bounded by 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rated fire walls, floors, and ceilings. Automatic smoke detection and suppression systems are provided in areas of concentrated combustibles (corridors). The ignition sources in this area include electrical cabinets, pumps, fire protection panels, fan motors, transients, and

+

- welding / cutting fires.

-l

i During the walkdown, it was discovered that the fire protection panels are totally enclosed. As a result, the panels were not considered as possible sources for modeling scenarios. A heat release rate of 65 BTU /s-f@ was used for electrical cabinets and fan motors. Pump lube oil was assumed to have the heat release characteristics of transformer 2

oil (135 BTU /s-ft ),

Because the postulated loss of all three trains of Emergency Feedwater is the major contributor to the high P2 number for RAB 31, the initial worst case targets were chosen to be the two groupings of essential EFW raceways.

Ignition source Multiplexer RA0402 was modeled against A and AB train EFW conduits (in RAB 31 corridor @ column 9A). The " radiant exposure" geometry was utilized because the conduits are vertical with respect to the cabinet. The fire model for this scenario determined that the critical radiant flux distance is 4.98 feet. Field measurements determined the actual distance from source to target to be 11 feet. As a result, critical conditions are not indicated.

Ignition source Local Control Panel LCP-46 was modeled against B train EFW cable trays (in RAB 31 corridor near column 7A). The " radiant exposure" geometry was utilized because the cable trays are vertical with respect to the panel. The fire model for this scenario determined that the critical radiant flux distance is 4.98 feet. Field measurements determined that the actual distance is 11 feet. As a result, critical conditions are not indicated.

In conclusion, no single RAB 31 fire can cause the loss of any EFW cabling.

4.6.3.5.10 Fire Area RAB 39, Fire Compartment R4B 39 Fire Area RAB 39 is located in the Reactor Auxiliary Building at elevation -35.00' (bounded by columns l A-12A and G-L). This area includes the Boric Acid Condensate Tanks, assorted Waste Tanks, the Charging Pumps, the Equipment Drain Tank, Waste Gas Compressors, and the turbine-driven Emergency Feedwater Pump. This plant area is typical in both content and arrangement, of Auxiliary Building locations; essential raceways are found throughout the fire area, but are concentrated in the corridors and access areas. This area is asymmetrical in shape; surface area is estimated from drawings to be 96 feet x 256 feet (24576 square feet). The floor elevation is -35.00' and the ceiling elevation is -5.00' for a net room height of 30 feet. This fire area is bounded by 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rated fire walls and ceilings. Automatic smoke detection and suppression systems are provided in areas of concentrated combustibles (corridors). The ignition sources in this area include electrical cabinets, pumps, fan motors, transients, and welding / cutting fires.

Because the postulated loss of all three trains of Emergency Feedwater is the major contributor to the high P2 number for RAB 39, the initial worst case targets were chosen Page 4-30 i

~ -. -.

to be raceways containing essential EFW cabling.- A total of ten scenarios were modeled involving various ignition sources and EFW targets.

Instmment Cabinet C-36 was modeled as an ignition source against essential AB train Emergency Feedwater conduits in the vicinity. The estimate of actual Qtot was -

determined to be 327,600 BTUs; the estimate of critical Qtot was calculated by the program to be 9,210,920 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot, critical conditions were not indicated and this scenario screened out.

Instrument Cabinet C-39 was modeled as an ignition source against essential EFW train A cable trays, EFW train B cable trays, and two EFW train AB conduits (31537F-NB, 39240-SAB). The trays were modeled as targets in 'out-of-plume' scenarios. In both cases, the estimate of actual Qtot was 409,500 BTUs and the estimate of critical Qtot was 12,459,240 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot, critical conditions were not indicated and the scenarios screened out. The conduits were oriented vertically with respect to the electrical cabinets and were modeled as targets in ' radiant' scenarios. In both cases, the critical radiant flux distance was calculated by the program to be 4.25 feet. Because the conduit are physically located outside of this radius, critical conditions were not indicated and these scenarios screened out.

A Charging Pump 'B' lube oil spill was modeled as an ignition source against essential EFW train A cable trays and essential EFW train AB conduits. Both scenarios were modeled as 'out-of-plume' configurations due to field orientation. For the cable tray scenario, the estimate of actual Qtot was determined to be 13,899,600 BTUs and the i

estimate of critical Qtot was calculated by the program to be 14,626,070 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot, critical conditions were not indicated and this scenario screened out. For the conduit scenario, the estimate of actual Qtot was determined to be 13,899,600 BTUs and the estimate of critical Qtot was calculated by the program to be 9,813,549 BTUs. As a result, critical conditions were indicated for this scenario and further analysis was required.

A Condensate Make-Up Pump motor was modeled as an ignition source against essential EFW train A cable trays and essential EFW train AB conduits. Both scenarios were modeled as 'out-of-plume' configurations due to field orientation. In both cases, the estimate of actual Qtot was determined to be 105,300 BTUs, the estimate of critical Qtot for the cable trays was calculated by the program to be 14,896,920 BTUs and for the conduits to be 15,131,270 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot in both cases, critical conditions were not indicated and the scenarios screened out.

In conclusion, no single RAB 39 fire can cause the loss Jmore than EFW AB.

Page 4-31

i I

i l

4.6.3.3.11 Fire Area 1GB, Fire Compartment 7GB l

Fire Area TGB comprises the entire Turbine Generator Building. This building is located i

immediately south and adjacent to the Reactor Auxiliary Building. The ground floor of -

l the building is at elevation +15.00' and the building's mezzanine is at elevation +40.00'.

This fire area contains no equipment, components or cables considered essential for safe plant shutdown. However, fire area TGB does contain the Auxiliary Feedwater system and the plant's off-she power feeds. The fire area is symmetrical in shape; surface area is taken from architectural drawings to be 160 feet x 270 feet (43,200 square feet). Because l

the mezzanine is almost entirely constructed of grating, the net ceiling height is considered j

to be 50 feet. This fire area contains a separate non-safety switchgear room provided with 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rated fire barriers. The barrier separating the RAB from the TGB is rated at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Automatic smoke detection is provided throughout the area; automatic

' suppression systems are provided throughout except in the separate switchgear room.

i The ignition sources in this area include electrical cabinets, pumps, main feedwater pumps, air compressors, fire protection panels, elevator motors and ventilation subsystems.

A number of fire models were developed to support the PSA evaluation of this area (Section 4.6.4). These models are described below.

Because the loss of Auxiliary Feedwater or Off-site power is the major contributor to the P2 number for TGB, the initial worst case targets were chosen to be raceways containing the support cabling for the AFW pump and the off-site power bus ducts. Based on plant walkdowns, a total of five scenarios were modeled involv'mg these targets and various ignition sources in the vicinity.

The Condenser Air Evacuation Pump Motor was modeled as an ignition source against AFW pump cables in cable tray L301-NB at plan point 9812. The estimate of actual Qtot was determined to be 117,000 BTUs; the estimate of critical Qtot was calculated by the software to be 43,802,020 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot, critical conditions were not indicated and this scenario screened out.

Mux cabinet TB1501 was modeled as an ignition source against AFW pump cables in t

cable tray L301 A-NB at plan point 0023. The estimate of actual Qtot was determined to be 468,000 BTUs; the estimate of critical Qtot was calculated by the software to be 12,283,610 BTUs. Because the estimate of actual Qtot was less that the estimate of critical Qtot, critical conditions were not indicated and this scenario screened out.

The steam generator feedwater pumps were found to contain large lube oil reservoirs (approximately 500 gallons); the associated lobe oil piping was found during plant walkdowns to be located in the vicinity of the AFW pump and its support cabling. As a result, a lube d spill fire was postulated at the west end of the feedwater pump area in the area of the AFW pump. Two scenarios were developed to determine the potential impact of an oil spill fire on the nearby cables. The lube oil spill was modeled against AFW pump Page 4-32

cables in trays at plan point 0018. The 'in-plume' geometry was chosen due to plant j

configuration. The plume temperature was found to be 678.24 degrees F above the target's 700 degree F damage temperature. As a result, the model indicated critical conditions. The lobe oil spill fire was modeled against AFW cables in LCP-70 and box B31048-NB. The 'in-plume' geometry was chosen due to the fact that both the LCP and the adjacent box are located immediately above the postulated oil spill area. The plume temperature was found to be 1020.00 degrees F above the target's 700 degree F damage temperature. As a result, the model indicated critical conditions. Both of these scenarios were evaluated further in Section 4.6.4.

The steam generator feedwater pump lube oil system contains several small motors located on the pump pedestal. One of these motors was modeled as an ignition source against the AFW cables in trays at plan point 0018. The estimate of actual Qtot was determined to be 78,000 BTUs; the estimate of critical Qtot was calculated by the software to be 38,088,720 BTUs. Because the estimate of actual Qtot was less than the estimate of critical Qtot, critical conditions were not indicated and this scenario screened out.

In conclusion, outside the TGB switchgear room, only a Steam Generator Feedwater Pump A lube oil spill fire could cause loss of AFW. Off-site power bus ducts could be affected by a fire in the TGB battery room.

The effects of a TGB switchgear room hot gas layer were examined by repetitive models using identical sources and targets but with changing geometry (i.e. target height, target distance from source). The method was used to locate the horizontal plane in the room that represents the lowest part of the hot gas layer at which damage temperatures are present. The hot gas layer was not found to cause damage to any targets outside of the plume. The area of damage, according to the models, was limited to the plume and an approximate 2 foot radius around the point source. Therefore, no fire in the TGB switchgear room can fail the redundant train of power.

4.6.4 Evaluation Of Areas Not Screened Out i

Ten fire areas were not screened out at the end of the FIVE screening. For these areas that did not screen out in FIVE, further analysis was performed using a fire PSA approach. While the FIVE methodology is extremely conservative, the fire PSA attempts to realistically estimate the risk of fire-induced core damage events, in order to determine how best to allocate limited resources to improving plant safety.

The evaluation of areas not screened out involved three types of analysis: 1) determination of the fraction of fires that are large (i.e., could fail multiple components--the types of fires of concern to the fire IPEEE), 2) estimation of fire ignition frequencies for individual components, for use in the fire PSA scenarios (FIVE uses overall fire frequencies for each area), and 3) development and quantification of realistic fire scenarios for the areas not screened out. The large fire fractions Page 4-33

were combined with the individual component fire initiation frequencies to estimate the sequence initiation frequencies. Section 4.6.4.1, following, describes the conservatisms in the FIVE method and describes the methods for calculating the large fire probabilities, individual component fire frequencies, and developing and quantifying the fire sequences. Section 4.6.4.2 describes the analyses for each area not screened out.

l Table 4-3 gives the fire initiation frequencies (F1 values) and redundant train unavailabilities (P2 values) from the FIVE screening for the areas not screened out. These values are used in some of the PSA scenaries das::ribed below.

TABLE 4-3 F1 AND P2 VALUES FROM FIVE SCREENING FOR AREAS NOT SCREENED OUT J

F1 P2 Fire Area Fire Comp Description RAB-1 RAB-1 A Control Room 9.7E-3 1.0 i

RAB-1 RAB-lE Cable Spreading Room 3.2E-5 1.0 RAB-2 RAB-2 H&V Mechanical Room 2.4E-3 5.0E-1 RAB-6 RAB-6 Elec. Penetration Area A 2.4E-4 1.0E-2 RAB-7 RAB-7 Relay Room Envelope 1.7E-3 1.5E-1 RAB-8 RAB-8 Switchgear Room 5.0E-3 1.0 RAB-15 RAB-15 Emerg. Diesel Generator B 2.8E-2 6.0E-4 RAB-31 RAB-31

-4 Corridor and Passageways 4.4E-3 2.8E-3 RAB-39 RAB-39

-35 and -4 General Areas 1.3 E-2 1.3E-3 TGB TGB Turbine Generator Building 3.3E-2 3.5E-4 4.6.4.1 Method 4.6.4.1.1 Conservatisms In The Five Methodology The major conservatism in the FIVE method concerns the frequencies of fires (hre initiator frequencies) and the damage associated with these fires. In FIVE, fire initiator frequericies are calculated from generic industry fire data, the EPRI Fire Events Database (FEDB) [Ref. 4y The method additionally makes assumptions about the severity of these fires. From examination of the industry fire data in the FEDB, however, it is clear that very few fires have been as severe 1

as assumed in the EPRI fire methods. For example, all electrical cabinet fires are conservatively assumed in the FIVE method to be large fires in which IEEE 383-rated cable catches fire. In the FEDB, on the other hand, most electrical cabinet fires are small, producing limited damage to a single part, e.g., a relay, breaker, or single cable within the cabinet. Another example of this conservatism is in the treatment of pump or diesel generator fires. Application of the FIVE i

method typically assumes that all the oil in these pieces of equipment is spilled and the resulting oil pool ignites. The fires in the data base, however, are mostly caused by small leaks and cause superficial damage, e.g., to the insulation or paint on the initiating component. By including these Page 4-34

l insignificant fires in the calculation of the frequencies of major, damaging fires, the FIVE methodology is far too conservative.

The conservatism of the fire initiator frequency model contributes to other conservatisms. In many fire areas, the severity of the assumed fire, and the assumption that the maximum heat release rate occurs instantaneously, causes predicted fire damage to be so rapid that detection and suppression is impossible. Automatic detection and suppression takes 3 minutes to actuate 1

(charge the suppression piping with water). Manual suppression requires up to 12 minutes for the fire brigade to respond (Section 4.5). With the conservative fire severities assumed in the FIVE i

i method, damage to essential cables is often predicted to occur within a fraction of a minute. The FEDB shows that, in reality, most actual fires were quickly detected and suppressed or burned themselves out before significant damage occurred.

4.6.4.1.2 Large Fire Probabilities The determination of realistic " s initiator frequencies is based on the FEDB. The fire events are classified into two types: 1) s.. ; fires, affecting only a single component, and 2) large fires, that fail multiple components. Small fires, since they affect only a single component, are already included in the Level 1 IPE model in the basic event failure rates. The large fires, since they affect multiple components, are addressed by the fire IPEEE analysis. In essence, the fire IPEEE analysis models fire-induced common cause failures.

New initiator frequencies were calculated for large fires using the FEDB. The approach was to query the FEDB for fire events for each plant location / fire source bin (e.g., control room / electrical cabinets). The FEDB data for the fires in a bin were reviewed to determine the magnitude of each fire. If the component affected was the same as the initiating component, the event was classified as a small fire. The description was checked for consistency with the classification. In some cases, where the initiating component and components affected fields were incomplete, the description field was the primary basis for classification. The timing and extinguishing data were used as additional suppo 1 in classifying the events. The classification of events was used to calculate a fraction of fire events that were large:

N,,,,,

l arg,

total where Ni,,, = number oflarge fire events, and N,o,,i = total number of fire events.

This fraction is used with the existing fire frequencies (the Fi values in Ref. 4.1, Table 1.2) to calculate the value ofFi,y, Fiar,,=fiorg,Fi.

1 l

Page 4-35

i This is the frequency of a fire that fails multiple components. This value is a more realistic ignition frequency for use in the fire IPEEE.

Manual suppression is included implicitly in the large fire frequency determination, since almost all of the fires classified as small were manually suppressed; it is impractical to determine which of these fires would have been small if they had not been manually suppressed.

t i

Only one event (out of 132 events in the bins examined) was a fire in which damage was widespread in a fire area (as assumed in FIVE). This was an emergency diesel generator fire. In general, the vast majority of events in a bin caused damage only to the initiating component or caused no significant damage at all. Altbogh a large fire factor was calculated for the switchgear room, none of the events classified as le.:ge caused damage to nearby cable trays; damage in these I

events was confined to the bus associated with the initiating component. Therefore, the large fire factor for the switchgear room actually represents fires that damage a single bus, not fires damaging cable trays. The factors are shown in Table 4-4.

TABLE 4-4 LARGE FIRE FRACTIONS Location Initiating Component Large Fire Fraction Control Room Electrical Cabinets 0.08 i

Reactor Auxiliary Building Electrical Cabinets 0.07 Reactor Auxiliary Building Pumps 0.07 Emergency Diesel Generators Emergency Diesel 0.12 Generators Emergency Diesel Generators Electrical Cabinets 0.33 Switchgear Room Electrical Cabinets 0.32 The fire initiator frequencies for specific components were estimated from the FIVE data base

[Ref. 4-1, Table 1.2], using the number of components from FIVE. For example, for electrical cabinets in a switch gear area, FIVE gives a frequency of 1.5E-2. This is for a fire in any switch gear area in the plant. Dividing this frequency by the total number of electrical cabinets in switch gear areas gives the frequency of a fire in a single cabinet in a switch gear area. Note that a single MCC or a single switch gear enclosure is defined as an electrical cabinet. Table 4-5 summarizes these single component fire frequencies. These frequencies are used in addition to the FIVE fire frequencies of Table 4-3 in the evaluation of areas not screened out.

Page 4-36

TABLE 4-5 COMPONENT FIRE INITIATOR FREQUENCIES Component Area Initiator Freq.

Number of Components Component Initiator

[Ref. 4-1, Table 1.2l in W-3 Area Frequency (per yr)

Electrical Cabiacts 9.5 E-3 50 1.9E-4 (Control Room)

Electrical Cabinets 1.5E-2 752 (RAB) + 368 (TGB) 1.3 E-5 (Switch gear Area)

+ 32 (FHB)

Electrical Cabinets 1.9E-2 154 1.2E-4 (Auxiliary Bldg)

Pumps (RAB) 1.9E-2 181 1.0E-4 RPS M/G Sets 5.5E-3 2

2.8E-3 Battery Chargers 4.0E-3 6

6.7E-4 Ventilation 9.5E-3 131 7.3 E-5 Subsystems 4.6.4.2.4 Fire Sequence Development and Quantification This took the general form of determining through fire modeling (in FIVE) exactly which fire sources could fail which cables. For example, in an area with many cables and fire sources, FIVE assumes that any fire would fail all the cables in the area. Fire modeling, however, might show that one pump would fail one particular train of EFW and nothing else, and one electrical cabinet would fail another panicular train of EFW. For these cases, fire scenarios were developed, and the PSA model was quantified for these cases. Then the fire frequencies for the sources in each scenario were estimated and the probability of each scenario was calculated by multiplying the scenario fire frequency by the conditional core damage probability for the scenario. The total core damage probability for the area was the sum of the scenario probabilities.

In general, fire modeling was used to determine which specific fire sources could fail which trains of EFW cables. (This included EFW support systems such as HVAC and power / control cables.)

Scenarios were developed for each fire source. For example, fire modeling might show that a fire on Charging Pump A could cause failure of EFW-B-related cables. The scenario would be Charging Pump A fails EFW-B. The fire PSA model would be quantified with EFW-B failed and the resulting probability would be the conditional core damage probability (CCDP) for that scenario. (CCDP is essentially the same as P2 in FIVE; in the PSA evaluation, however, the CCDPs are based on more realistic assessment of system failures due to the fire.). The initiator frequency for the individual components modeled would be multiplied by the large fire probability to give the large fire initiator frequency. Summing the products oflarge fire initiator frequency and CCDP for each scenario gives the total core damage frequency (CDF) for the area. In general, the suppon system failures assumed in the FIVE screening were used in these scenarios, unless support system failures were the dominant causes of predicted core damage.

Page 4-37

i i

4.6.4.2 Evaluation By Fire Area 4.6.4.2.1 RAB-1A:

ControlRoom i

This area is modeled with three scenarios: 1) a fire in an electrical cabinet, except the Engineered Safety Features (ESF) cabinet (which contains EFW cables and controls) and cabinets of systems i

I that support EFW,2) a fire in the ESF cabinet, and 3) a fire in the EFW support system cabinets.

Although there are EFW cables in the Auxiliary Protection cabinets, these cables are only l

associated with testing of the ESF actuation logic.

Scenario 1. The fire frequency from FIVE is 9.7E-3 (Table 4-3). Reference [Ref. 4-10] (p. J-4) gives the probability of non-suppression of a control room cabinet fire as 3.4E-3 (i.e., the l

probability of failing to suppress the fire before smoke obscures the control panels). The fi,,,

factors are not necessary for this case, since a manual suppression failure probability appropriate for this scenario exists. In the case of a fire in the control room, the operators would transfer control to the remote shutdown panel. The failure of this recovery action is modeled as an ex-control room mistake. The response time should realistically be in the 5 to 10 minute range during an accident. The operators practice this action in simulator training. Assuming a 10 minute response time to transfer control to the remote shutdown panel and a one hour time l

available (the EFW system will automatically control level after a trip, so the available time could be much greater than an hour), the Human Failure Probability (HFP) is 6.2E-2. In the case that the fire was not suppressed before smoke obscured the panel (as assumed in the non-suppression i

probability), the fire brigade could probably put out the fire before the EFW panel was damaged; a conservative probability of 0.5 is assumed for their failure to suppress the fire in time to prevent EFW damage. The conditional core damage probability (CCDP) is assumed to be 1.0, since operation of the Auxiliary Feedwater (AFW) pump is dependent on the transfer to the remote shutdown panel (the operators would not be expected during a control room fire to attempt to use l

the AFW pump until they had transferred control to the remote shutdown panel and EFW had failed). The core damage probability (CDF) for this scenario can be estimated as:

l CDFnAn-tr = Fi

• P..pp a.

• Pn.r,

• P, ppuw

• CCDP where Fi = FIVE fire ignition frequency, P pp a. = probability of suppression failure before smoke obscures panels, I

P= r. = failure probability of transfer to the remote shutdown panel, P ppuv = probability of suppression failure before EFW is damaged, CCDP = conditional core damage probability.

l

?

i t

Page 4-38 l

i

Using the values described above:

CDFRAB-I A = 9.7E-3

• 3.4E-3

• 6.2E-2

• 0.5

• 1.0 = 1.0E-6 per year.

Scenario 2. For a fire in CP-8 (the ESF cabinet), all three trains of EFW could be failed even if suppression was successful. The probability of a fire in CP-8 is 1.9E-4 (Table 4-3, since this is a single cabinet). Thefwy value is 0.08 (Table 4-4). This value can be multiplied by the initiator frequency to give the frequency of a fire large enough to spread beyond the initiating component and damage multiple trains of EFW: Fu,,, = 1.9 E-4

• 0.08 = 1.5E-5. The non-suppressions probabilities are 1.0, because the large fire factor was derived assuming the fire causes damage even with operator intervention. Using the above large fire frequency and failure probability for transfer to the remote shutdown panel in the previous calculation gives:

CDFxAn.i A = Fu,,,

• Pun.r

• CCDP = 1.5E-5

• 6.2E-2

• 1.0 = 9.3E-7 per year.

Scenario 3. Several other control panels can afTect EFW through the dependency of the motor-driven pumps (A and B) on room cooling: CP-18, which includes the motor-driven pump room coolers, the essential chillers, and the chilled water pumps, and CP-33, which includes the wet and dry cooling towers (the heat sink for CCW and, hence, chilled water). Because the AB EFW pump is not dependent on room cooling, however, the CCDP is 1.9E-2 (from quantification of the fire model with CCW, Chillers, and IIVAC failed). This makes the CDF for fires in these panels almost two orders of magnitude lower than for CP-8 (i.e., negligible).

Total CDF for RAB-1 A. The total probability of core damage due to a control room fire is estimated as the sum of the two above scenarios:

CDFRAll-l A = 1.0E-6 + 9.7E-7 = 2.0E-6 per year.

1.6.4.2.2 RAB-1E:

Cable Spreading Room The cable spreading room is located directly below the control room and contains cables for virtually all the essential systems. The ignition sources are transient and welding fires. All of the cable trays in this area have solid metal covers or Reg Guide 1.75 fire wrap (with a 30 min.

rating). This would realistically provide protection for the cables for long enough for the automatic detection and suppression system to actuate (in 3 min.). In the Waterford-3 TGB switchgear fire, solid covers on Reactor Coolant Pump (RCP) cable trays provided complete protection to the cables even though they were immediately adjacent to the burning cabinets.

Therefore, for a fire to damage cables in this fire area, the automatic suppression system must fail.

The core damage scenario is: a fire with failure of the automatic suppression system and failure to transfer control to the remote shutdown panel. The fire frequency for the area is 3.2E-5, from the FIVE screening (Table 4-3). The failure probability for the automatic suppression system is 0.05

[Ref. 4-1]. The probability of failure of the transfer to the remote shutdown panel is 6.2E-2, as Page 4-39

~--..

~.. - -..

I e

for RAB-1 A. For an unsuppressed fire, the CCDP is assumed to be 1.0. The core damage probability is' estimated as:

.l

~ CDFaxa.in = Fi

• P..u,,,, ;

• Pu.w,

• CCDP i

where '

l F = FIVE fire ignition frequency,-

l i

P.,

= failure probability of automatic suppression system, Pu r, = failure probability of transfer to the remote shutdown panel, l

CCDP = conditional core damage probability.

l Using the values described above:

CDFRAB-lE = 3.2E-5

• 0.05

• 6.2E-2

• 1.0 = 9.9E-8 per year.

i 4.6.4.2.3 RAB-2:

- H& VMechanical Room (Essential Chillers)

This area is significant to core damage risk because it contains the Essential Chillers and Chilled Water pumps (CHW). Chilled water is needed to support room cooling of the EFW motor-driven pumps (trains A and B), the CCW pumps, and the High Pressure Safety Injection (HPSI) pumps.

)

If CHW were lost, the air temperatures in the pump rooms could reach temperatures at which the i

motors would fail.

Although FIVE fire modeling indicated that CHW train AB cables would be damaged in some of

)

these scenarios, in reality, the AB cables are wrapped (with Appendix R 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire wrap). If

)

automatic detection and suppression were successful, the AB cables would not be expected to i

. fail. Therefore, failure of automatic detection and suppression is assumed to be required for the j

AB cables to fail.

Fire modeling was used to establish five fire scenarios that could degrade the CHW system. The scenarios are described in the following paragraphs, and summarized in Table 4-6.

Scenario 1. A fire in electrical cabinet C101 A could cause failure CHW A. No CHW B or AB cables would be affected. The ignition frequency is 1.2E-4, from Table 4-5. Table 4-4 gives the large fire fraction for an RAB electrical cabinet as 0.07. Therefore, the frequency of a large fire in an electrical cabinet is 1.2E-4

• 0.07 = 8.4E-6 per year. The CCDP for CHW A failed is 4.lE-3.

Scenario 2. A fire in CHW pump A or Chiller A could cause damage to cables associated with CHW B or AB (but not both at the same time), as well as failing CHW A directly. Failure of B or AB cables would require the burning oil to pool underneath the cables. Because of the physical i

separation between the B and AB cables, they could not both be failed by the same fire. Since failure of the AB cables requires the additional failure of automatic suppression (with a probability of 0.05), and the CCDP for Chiller AB failed is significantly lower than for Chiller B failed (the Page 4-40

h i

Chiller AB failure probability is already high because it must be manually started), the failure of the B cables is the dominant failure. The ignition frequency for an RAB pump is 1.0E-4, from Table 4-5. Assuming that the fire frequency for a chiller is the same as for a pump (since the chiller compressor is similar to a pump) the fire frequency for this scenario is 2

• 1.0E-4 = 2.0E-4 per year. The large fire fraction for an RAB pump is 0.07, from Table 4-4. Therefore, the frequency of a large fire in the A CHW pump or chiller is 2.0E-4

• 0.07 = 1.4E-5 per year. The CCDP for CHW A and B failed is 0.128.

Scenario 3. A fire in CHW pump B, Chiller B, or Electrical Cabinet C1013 could cause damage to cables associated with CHW AB (if automatic suppression failed), as well as failing CHW B directly. No CHW A cables would be affected. Scenario 3 is successful automatic suppression, with CHW B failed. Scenario 4 is failure of automatic suppression, with CHW B and AB failed.

The large fire ignition frequency for the CHW pump and cl: iller is 1.4E-5, from Scenario 2. The frequency of a large fire in an electrical cabinet is 8.4E-6, fiom Scenario 1. Therefore, the total frequency of a large fire is 1.4E-5 + 8.4E-6 = 2.3E-5. The CCDP for CHW B failed is 3.8E-3.

Scenario 4. In this scenario, CHW AB is failed in addition to CHW B, since automatic suppres-sion is failed. Since this scenario involves AB cable failures, the electrical cabinet fire is not included, because the electrical cabinet fire duration would not be long enough (more than I hour)

)

to breach the fire wrap. The large fire frequency is thus 1.4E-5. Multiplying this probability by the probability of automatic suppression failure (0.05, Ref. 4.1) gives the probability of a large, unsuppressed fire that fails both the B and AB trains: 1.4E-5

• 0.05 = 7.0E-7. The CCDP for CHW B and AB failed is 1.4E-2.

Scenario 5. A fire in CHW pump AB, Chiller AB, or Electrical Cabinet C101C could cause failure of CHW AB. No CHW A or B cables would be affected. The large fire ignition frequency for this scenario is the same as for Scenario 3: 2.3E-5. The CCDP for CHW AB failed is 7.7E-4.

Total CDF for RAB-2. The total probability of core damage due to a fire in the H&V Mechanical Room is estimated as the sum of the above scenarios.

The CDF for each scenario is calculated as:

CDFun-2.i = Fury,i

• CCDPi where Fu,,.i = large fire ignition frequency for the i-th sequence, and CCDP = conditional core damage probability for the i-th sequence.

4 Page 4-41

l l

TABLE 4-6 RAB-2

SUMMARY

Scenario Description Fire Freq.

CCDP CDF 1

Large fire in Cabinet A fails CHW A 8.4 E-6 4.1E-3 3 4E-8 2

Large fire in Pump A or Chiller A fails CHW A 1.4E-5 0.128 1.8E-6 and B 3

Large fire in Pump B, Chiller B, or Cabinet B 2.3 E-5 3.8E-3 8.7E-8 i

fails CHW B 4

Large fire in Pump B or Chiller B fails CHW B 7.0E-7 1.4E-2 9.8E-9 and AB 5

Large fire in Pump AB, Chiller AB, or Cabinet 2.3 E-5 7.7E-4 1.8E-8 C fails CilW AB Total CDF:

1.9E-6 4.6.4.2.4 RAB-6:

ElectricalPenetration Area A The dominant failure in the FIVE screening for this area was failure of four EFW control and iso-lation valves (EFW-223 A, EFW-224B, EFW-228A, EFW-2298), one for each EFW injection path. These valves are all A-powered. (The other four valves are B-powered. This ensures that the ability to isolate a Steam Generator during a SGTR or Steam Line Break is not lost if one DC power train is lost.) Fire modeling showed that, because of physical separation and the large size of the fire area, no fire can fail all four valves. The fire PSA model was quantified with three of the four valves failed by the fire; the CCDP was 2.3E-3. The hot short probability of 0.01 for four hot shorts (Assumption 4.6.2-19) was assumed to apply to this scenario in which three hot shorts occur. This 0.01 hot short probability was added to the cutsets involving failure of these valves, giving a CCDP of 1.8E-3. With a fire ignition frequency of 2.4E-4 from the FIVE screening (Table 4-3), the CDF is:

CDF AB4 = Fi

• CCDP R

where Fi = FIVE fire ignition frequency, CCDP = conditional core damage probability.

Using the values described above:

CDFRin4 = 2.4E-4

• 1.8E-3 = 4.3E-7 per year.

Page 4-42

1 4.6.4.2.5 RAB-7:

Relay Room Fire modeling showed that no fire can fail the nearest unwrapped redundant train cable. Since no electrical cabinet fire in this area can realistically burn at high heat release rates for more than one hour (the cabinets are small and the cables are IEEE 387-rated), no cabinet fire can realistically fail more than one electrical train (A, B, or AB). Because of the DC power arrangement for the EFW control and isolation valves, described for RAB-6, a fire in RAB-7 could cause failure of all I

the EFW injection paths, if four hot shorts in either A-powered cables or B-powered cables were to occur.

Three scenarios were considered for this area.

Scenario 1. This scenario is a large fire in RAB-7 that fails all A train cables. The CCDP is 0.101. This is dominated by failure of four EFW control and isolation valves, requiring operator action to locally open these valves. By including the hot short probability (0.01, Assumption 4.6.2-19) to the cutset representing failure of these four valves, the CCDP becomes 1.6E-3.

Since there are seven A cabinets in RAB-7, the fire frequcacy is 7

• 1.2E-4 = 8.4E-4. The large fire fraction is 0.07, so the frequency oflarge fires involving A cabinets in RAB-7 is 0.07

• 8.4E-4

= 5.9E-5. The CDF is:

CDFRAD.7 4 = Fi,,

• CCDP where Fr,y

_ca unition frequency, and CCDP = conditional core damage probability.

Using the values described above:

CDFRAB-7.A = 5.9E-5

• 1.6E-3 = 9.4E-8 per year.

Scenario 2. This scenario is identical to scenario 1, with the exception that there are only five B train electrical cabinets. Thus, the large fire frequency is 5

• 1.2E-4

• 0.07 = 4.2E-5. The CDF is:

CDFRAB-7-B = Fi,y

• CCDP where Fi,g = fire ignition frequency, and CCDP = conditional core damage probability.

Page 4-43

i I

^

Using the values described above:

CDFaa.7.s = 4.2E-5

• 1.6E-3 = 6.7E-8 per year.

j

. Scenario 3. This is a large fire that fails all the AB components. The CCDP is 1.9E-4. Since there is only one AB cabinet in RAB-7, the fire frequency is 1.2E-4. With the large fire fraction l

o of 0.07, the frequency of a large fire in the AB cabinet is 0.07

• 1.2E-4 = 8.4E-6. Therefore, the l

CDFis:

l l

CDFaa.;.a = Fi.,

• CCDP j

i where Fi., = fire ignition frequency, and CCDP = conditional core damage probability.

i Using the values described above:

CDFara.7.a = 8.4E-6

• 1.9E-4 = 1.6E-9 per year.

'l Total CDF for RAB-7. The total probability of core damage due to a fire in the relay room is estimated as the sum of the above scenarios:

CDFRAB-7 = 9.4E-8 + 6.7E-8 + 1.6E-9 = 1.6E-7 per year.

I 4.6.4.2.6 RAB-8:

Switchgear Room Power and control cables for all the systems in the fire PSA model go through RAB-8. The FIVE methodology very conservatively assumes that, if any fire can fail any essential cable in the fire area, all fires will fail all cables in the area. Fire modeling showed, however, that because of the large size of the area, a significant hot gas layer would not form during an electrical fire and i

damage would be confined to the plume. This was the case for the Waterford 3 TGB switchgear fire, which was a very large switchgear fire. In that fire, significant damage was due to plume (and ceiling jet) effects only. RCP cables in a covered tray immediately adjacent to the fire were undamaged. The fire spread to the power and metering cabinet immediately adjacent to the initiating cabinet, but no farther. As a result of the TGB switchgear fire experience and the fire modeling, the analysis of RAB-8 was based on the following assumptions: 1) fire damage in a large electrical cabinet fire would be confined to the initiating 'switchgear, MCC, or panel and any cables in the plume or ceiling jet; and 2) since all of the trays in RAB-8 that contain essential cables are covered or are wrapped with 30 minute Reg Guide 1.75 fire wrap, damage to these

- cables in a fire plume would be delayed long enough for the automatic suppression system to Page 4-44

t actuate and control the fire; thus, automatic suppression failure would be required for cables in trays to be damaged.

The following el.'etrical cabinets supply power to' essential EFW components (those modeled in the PSA):

COMPONENT CABINET LOCATION EFW Pump A 3A3-S RAB-8A EFW 223A 3A-DC-S

' RAB-8A EFW 224B 3A-DC-S RAB-8A EFW 228 ^

3A-DC-S RAB-8A EFW 229B 3A-DC-S RAB-8A 1

EFW Pump B 3B3-S RAB-8B EFW 223B 3B-DC-S RAB-8B EFW 224A 3B-DC-3 RAB-8B EFW 228B 3B-DC-3 RAB-8B i

EFW 229A 3B-DC-S RAB-8B EFW Pump AB Gov Valve 3AB-DC-S RAB-8AB MS 401 A 3AB-DC-S RAB-8AB MS 401B 3AB-DC-S RAB-8AB Twelve scenarios were identified in RAB-8 that could be significant to core damage risk. These scenarios and their quantification are described below, and summarized in Table 4-7.

. Scenario 1. This is a large fire in the A switchgear compartment (RAB-8A) that, with failure of i

automatic suppression, damages all four A-powered EFW control and isolation valves. Because cables associated with the feedwater system (needed for the AFW pump) run through this area, AFW is assumed failed. The CCDP is 0.101 for the failure of all A cables. The dominant failure in this CCDP is the assumption of four hot-shorts in the A-powered EFW valves. With the hot short probability of 0.01 (Assumption 4.6.2-19) added to the cutset for the fire-induced EFW control and isolation valve failures, the CCDP is 1.9E-3. The only places where all four EFW control and isolation valves are together and could be failed by the plume of a cabinet fire are over MCC 3 A313-S and the ESFAS-A cabinet. Assuming that any fire in one of the eleven cabinets in MCC 3 A313-S could spread to other cabinets and affect the EFW cables, the fire frequency for MCC 3A313-S is 11

• 1.3E-5 = 1.4E-4. With an automatic suppression system failure probability of 0.05 [Ref. 4-1], the frequency of a large, unsuppressed fire in MCC 3 A313-S is 1.4E-4

• 0.05 =

7.0E-6. The ESFAS cabinet is addressed in Scenario 5 and is not included in this scenario.

Scenario 2. This is a large fire in Switchgear 3 A3-S. Even if the automatic suppression system were to work, the A train equipment powered from this bus could be failed. The CCDP for all the A train components failed (except for the EFW A-powered isolation valves, which are powered from the 3 A-DC-S bus) is 9.1E-4. Since there are 15 cabinets in 3A3-S and the frequency of a Page 4-45 i

i fire in a single switchgear room electrical cabinet is 1.3E-5, the fire frequency is 1.3E-5

• 15 =

2.0E-4. With the large fire fraction of 0.32 for switchgear cabinets, the large fire frequency is 2.0E-4

• 0.32 = 6.2E-5.

Scenario 3. This is a large fire in 3 A-DC-S (which powers EFW-228A and 229B) or LCP-61 (which controls EFW-223 A and 224B). The CCDP is 9.5E-4, for two of the four EFW valves failed. The fire frequency is 1.3E-5 for a single cabinet and 2.6E-5 for these two cabinets. With the large fire fraction of 0.32, the fire frequency for this scenario is 2.6E-5

• 0.32 = 8.3E-6.

Scenario 4. This scenario is a large fire in the 3 A3-S switchgear that produces a hot gas layer that damages all the cables in the A switchgear room (including both offsite power feeds). Fire modeling showed that if the heat from a switchgear fire were confined to RAB-8A, the hot gas layer could cause damage to the cables in that compartment. (Modeling showed, conversely, that if heat from a fire were allowed to flow unimpeded to the adjacent RAB-8 compartments, no cables in any of the rooms would be failed by the hot gas layer.) None of the other types of electrical cabinets could produce a hot gas layer that could fail cables. Realistically, some heat would escape through the grating at the top of the wall between compartment A and compartments B and AB. Because the degree to which hot air would flow into the adjacent compartments is impossible to estimate, the heat is assumed to be confined in RAB-8A for this scenario. This is conservative and represents a one bounding scenario. (The other bounding scenario is the case in which the hot gas layer flows unimpeded throughout RAB-8, potentially affecting all three trains of power; the previous scenarios represented this case.)

Significantly, the fire models showed that the time to damage was 4.5 minute:., giving the automatic detection and suppression system time to actuate. Automatic suppression would require a few seconds for detection and 180 seconds for charging the system with water. Thus, this scenario requires failure of the automatic suppression system.

The frequency of a large fire in 3 A3-S, as described in Scenario 2, is 6.2E-5. With a 0.05 failure probability for the automatic suppression system, the probability of a large, unsuppressed 3 A3-S fire is 6.2E-5

• 0.05 = 3.lE-6. The CCDP for all A train components (and both offsite power feeds) failed is 4.4E-3. This includes the 0.01 probability of four hot shorts in the A-powered EFW valve cables. This hot short probability was added to the cutset for fire-induced failure of the A EFW valves.

Scenario 5. This is a large fire in the ESFAS cabinet (which is associated with all four A-powered EFW control and isolation valves). The probability of four hot shorts in the A-powered EFW valve cables at the ESFAS part of the circuits is higher than in other parts of the circuits. As described in Assumption 4.6.2-19, this probability is assumed to be 0.1. The CCDP for all A-powered EFW valves failed by fire-induced hot shorts is 1.0E-2, with a 0.1 hot short probability added to the cutset for fire-induced failure of the A EFW valves. The fire frequency for a single cabinet is 1.3E-5. With the large fire fraction of 0.32, the fire frequency for this scenario is 1.3E-5

• 0.32 = 4.2E-6.

Page 4-46

~~

l Scenario 6. This scenario is identical to Scenario 1, but for RAB-8B. There are two MCCs that i

have all four EFW-B cables passing over them: 3B311-S, with 14 cabinets, and 3 AB312, with 4 cabinets. The large fire frequency is thus (14 +4)

• 1.3E-5

• 0.32 = 7.5E-5. With failure of suppression, the probability of a large, unsuppressed fire is 7.5E-5

• 0.05 = 3.7E-6. The CCDP is 1.7E-3.

Scenario 7. This scenario is identical to Scenario 2, but for RAB-8B. The bus is 3B3-S, with the same number of cabinets as in bus 3 A3-S in Scenario 1 (15). In addition, one SUPS cabinet was found that could fail the offsite power feed; this was added to the fire frequency, on the l

conservative assumption that loss of the offsite power feed is equivalent to loss of the bus. The probability of a large fire is thus (16/15)

• 6.2E-5 = 6.6E-5. The CCDP is 6.9E-4.

Scenario 8. This scenario is identical to Scenario 3, but for RAB-8B. The cabinets are 3B-DC-S and LCP-62. The probability of a large fire is the same as in Scenario 3: 8.3E-6. The CCDP is 6.9E-4.

S_cenario 9. This scenario is identical to Scenario 4, but for RAB-8B. The bus is 3B3-S. Since this bus has the same number of cabinets as Bus 3 A3-S in Scenario 4, the large, unsuppressed fire frequencies are the same: 3.1E-6. The CCDP is 1.7E-3.

Sssnario 10. This scenario is identical to Scenario 5, but for RAB-8B. The cabinet is ESFAS-B.

The large fire frequency is the same as for Scenario 5: 4.2E-6. The CCDP is 1.0E-2.

Scenario 11. This is a large, unsuppressed fire in the AB compartment (RAB-8C) that fails cables associated with the AB EFW pump as well as a CHW B cable that is wrapped. (Failure of CHW B could cause failure of the B EFW pump due to high room temperatures.) There are 67 electrical cabinets in RAB-8C and 2 battery chargers. With the single electrical cabinet fire frequency of 1.3E-5 and a single battery charger fire frequency of 6.7E-4 (Table 4-5), the fire frequency is 67

• 1,3E-5 + 2

• 6.7E-4 = 2.2E-3. Since the large fire fraction is for the switchgear room is 0.32, the frequency of a large fire is 2.2E-3

• 0.32 = 7.1E-4. The probability of automatic suppression failure is 0.05 [Ref. 4-1), so the frequency of a large, unsuppressed fire in RAB-8C is 7.1E-4

• 0.05 = 3.5E-5. The CCDP for this scenario is 1.7E-2.

Scenario 12. This scenario similar to Scenario 11, but with successful automatic suppression. In this case, CHW B is not failed because the cables are wrapped. The large fire frequency is 7.lE-4, as in Scenario 11. The CCDP for this scenario is 9.0E-4.

Total CDF for RAB-8. The total probability of core damage due to a fire in the RAB Switchgear Room is estimated as the sum of the above scenarios.

The CDF for each scenario is calculated as:

CDFua.u = Fu

• CCDPi Page 4-47

where N,.i = large fire ignition frequency for the i-th sequence, and CCDPi = conditional core damge probability for the i-th sequence.

TABLE 4-7 RAB-8

SUMMARY

Scenario Descript[

Fire Freq.

CCDP CDF 1

Large, unsuppressed MCC 3A313-S fire fails 7.0E-6 1.9E-3 1.3E-8 EFW A valves

'.6 E-8 2

Large fire in 3A3-S fails A train motors even 6.2E-5 9.lE-4 with suppression 3

Large fire in 3 A-DC-S or LCP-61 fails the two 8.3E-6 9.5E-4 7.9E-9 associated EFW valves 4

Large, unsuppressed fire in 3 A3-S fails all A 3.lE-6 4.4E-3 1.4E-8 train components 5

Large fire in ESFAS A cabinet fails EFW A 4.2E-6 1.0E-2 4.2E-8 valves 6

Large, unsuppressed MCC 3B313-S fire fails 3.7E-6 1.7E-3 6.3 E-9 EFW B valves 7

Large fire in 3B3-S fails B train motors even 6.6E-5 6.9E-4 4.6E-8 with suppression 8

Large fire in 3B-DC-S or LCP-62 fails the two 8.3E-6 6.9E-4 5.7E-9 associated EFW valves 9

Large, unsuppressed fire in 3B3-S fails all B 3.lE-6 1.7E-3 5.3 E-9 train components 10 Large fire in ESFAS B cabinet fails EFW B 4.2E-6 1.0E-2 4.2E-8 valves 11 Large, unsuppressed fire in RAB-8C fails all 3.5E-5 1.7E-2 6.0E-7 AB components and CHW B 12 Large, suppressed fire in RAB-8C fails all AB 7.lE-4 9.0E-4 6.4 E-7 components Total CDF:

1.5E-6 4.6.4.2.7 JL4B-15:

Emergency DieselGenerator B Cables for three EFW control and isolation valves pass through this area. If a hot short occurred in all three of these cables, three of the four EFW injection paths would be lost. The CCDP from the FIVE screening is 6.0E-4 (Table 4-3). This CCDP is dominated by failure of the fourth EFW Page 4-48

i valve, after the fire-induced failure of three EFW valves. If the probability of muhiole hot shorts (assumed to be 0.01, see Assumption 4.6.2-19)is added to the cutsets involving firt-induced EFW valve failures, the CCDP is reduced to 1.5E-4. The fire frequency for this room 1: 2.84E-2

_ per year (2.6E-2 for the Emergency Diesel Generator and 2.4E-3 for the electrical cabinet), from the FIVE screening (Table 4-3). The large fire factors for the Emergency Diesel Generator (EDG) rooms are 0.12 for the EDGs and 0.33 for the electrical cabinets. Therefore, the frequency of a large fire in this area is (2.6E-2

• 0.12) + (2.4E-3

• 0.33) = 3.9E-3. The CDF is thus:

CDFaw.is = Fu,,,

• CCDP where Fur, = large fire ignition frequency, CCDP = conditional core damage probability.

Using the values described above:

CDFam.i3 = 3.9E-3

• 1.5E-4 = 5.9E-7 per year.

4.6.4.2.8 lblB-31 Fire modeling determined that no EFW cables could be failed by a fire in this area. The PSA model was re-quantified with EFW fire-induced failures removed. The CCDP was 1.8E-4. The fire sources in this area included electrical cabinets, motors, pumps, and fans. The large fire fractions for RAB electrical cabinets and pumps are both 0.07. With a fire frequency of 4.4E-3 from FIVE (Table 4-3), the frequency oflarge fires in this area should be about 4.4E-3

• 0.07 =

3.lE-4. The CDF for RAB-31 is:

l CDFaw.3: = Fur,.

• CCDP 1

where Fur,, = fire ignition frequency, and CCDP = conditional core damage probability.

Using the values described above:

I CDFaw.3i = 3.1E-4

• 1.8E-4 = 5.5E-8 per year.

Page 4-49 1

l t.

i 4.6.4.2.9 RAB-39:

-35 arul-4 General Areas' r

In the FIVE screening, this area did not screen because the A and AB trains of EFW were l

. assumed failed (based on the Associated Circuits Analysis [Ref. 4-8]) and because there are a large number of potential fire sources in this area (which is very large, includes many separate companments, and even spans two floors of the RAB). Fire modeling showed, however, that j

only two fire sources could cause EFW cable failure: a large fire on Charging Pump B and a large fire in Electrical Cabinet C36. The fire frequencies for RAB pumps and electrical cabinets are 1.0E-4 and 1.2E-4, respectively. With the large fire factor of 0.07 applicable to both of these fire i

sources, the frequency of a large fire in one of these two initiators which can fail EFW cables is (1.0E-4 + 1.2E-4)

• 0.07 = 1.5E-5. The CCDP is 1.3E-3, from the FIVE screening (Table 4-3).

l The CDF is:

CDFRAB-3, = Fu,,

• CCDP i

- where Far, = fire ignition frequency, and

+

CCDP = conditional core damage probability.

Using the values described above:

l CDFRAB-39 = 1.5E-5

• 1.3E-3 = 2.0E-8 per year.

i 4.6.4.2.10 IGB: Turbine Generator Building On June 10,1995, Waterford 3 experienced a fire in the Turbine Generator Building (TGB)

Switchgear Room. The following description of the event is taken from the Licensee Event i

Report for the event: At 0858 hours0.00993 days <br />0.238 hours <br />0.00142 weeks <br />3.26469e-4 months <br />, on June 10, a fault recorder at the Waterford Switchyard recorded a single phase fault. Subsequent inspection identified a failed C phase lightning arrestor on the Waterford Substation No. 2 Transformer (230 KV to 34.5 KV). At approximately the same time, with the plant in mode I at 100% power, a reactor trip occurred, and one of the two independent offsite power sources was lost. Shortly thereafter a report was received from the

~

TGB operator of smoke in the TGB switchgear. A breaker in the 4.16 KV 3A2 bus in the TGB switchgear caught fire causing damage to the bus and surrounding cables and components. The fire damage was limited mainly to the Unit Auxiliary Transformer (UAT) Feeder Breaker supplying the 3A2 non-safety related bus and the adjoining meter cabinet. The root cause of the fire in the 3A2 switchgear was the improper automatic bus transfer from the Unit Auxiliary Transformer to the Startup Transformer (SUT).

In this fire, two switchgear cabinets were heavily damaged. The insulation on the 4.16KV cables in the Calven cable bus duct from the UAT to bus 3 A2 was completely destroyed over the approximately 10 feet of vertical run where the cables entered the switchgear cabinet. Damage to Page 4-50 j

I the horizontal run of the cables appeared to be confined to the plume (i.e., there did not appear to be any horizontal propagation). The cable bus duct for the SUT feed to bus 3A2 (the offsite power feed)is stacked directly above the UAT to 3A2 bus duct. Damage to the SUT to 3A2 cables was limited to external heat damage to the insulation. Subsequent testing of these cables verified that continuity and insulation integrity were intact. No other significant damage (from a fire risk standpoint) was found.

i A significant result of the TGB fire experience is that a large switchgear fire in the TGB switchgear room will not cause significant damage outside the plume /ceilingjet. This was despite the fact that the fire was not suppressed until after the UAT to 3 A2 cables were fully involved in the fire. (The Waterford 3 TGB switchgear room has an automatic detection system--that worked--but no automatic suppression system.) The Waterford TGB switchgear are contained in a large, high-ceiling concrete block room separated from the rest of the TGB. The A and B trains of offsite power are well separated by a minimum of about 20 feet. There is a part-height (about 10 fhet high) concrete block radiant shield wall between the A and B switchgear. Fire modeling confirmed that a large TGB switchgear fire will not generate a hot gas layer that could fail cables outside the plume. Therefore, TGB switchgear fires are assumed to damage only one train of offsite power.

Four scenarios were identified in the TGB that could be significant to core damage risk. These scenarios and their quantification are described below, and summarized in Table 4-8.

Scenario 1. This is a large fire in the A switchgear that causes a reactor trip and fails the A offsite power feed. The CCDP for a reactor trip with loss of offsite power A is 5.0E-6. The generic frequency of an electrical cabinet fire in a switchgear room is 1.5E-2 [Ref. 4-1]. The frequency of a fire in the A train is one half this, or 6.0E-3. A plant-specific frequency can be calculated from the June 10 fire event:

Ifire Fmn.w,

40 years - 2.5E-2 per year.

r The plant-specific frequency of a fire in either the A or B cabinets is one-half of this, or 1.3E-2. A duration of 40 years is used because the fire was caused by a failure of the bus transfer scheme.

This bus transfer scheme is being redesigned to preclude this event from happening again. With the transfer scheme changed, the Waterford 3 TGB switchgear room fire frequency should be closer to the generic frequency.

Scenario 2. This scenario is the same as for Scenario 1, but for the B cabinets. A fire in the B switchgear could fail the AFW pump, in addition to offsite power B. The CCDP for this scenario is 9.5E-6. The large fire frequency is the same as for Scenario 1,1.3E-2.

Sc. enario 3. This is a fire in Main Feedwater Pump (MFWP) A that fails the AFW pump.

Through walkdowns and fire modeling the fire analysis team determined that this is the only TGB fire (outside the switchgear room) that can fail the AFW pump. The fire frequency is 4.0E-3 for Page 4-51

the MFWPs [Ref. 4-1], or 2.0E-3 for a single pump. The CCDP for a reactor trip without the AFW pump is 5.7E-5.

Scenario 4. This scenario is a fire in the TGB battery room. Both offsite power feeds pass over this battery room. The CCDP for both offsite power feeds failed is 3.5E-4. The TGB batteries are contained in a room with corrugated sheet steel walls and ceiling. There is a wet pipe fire suppression system in the room. Thus, the suppression system would have to fail for the fire to destroy the room and fail the offsite power cables above. The frequency of a fire in a battery room is 3.2E-3 [Ref. 4-1]. With a 0.02 failure probability for a wet pipe suppression system [Ref.

4-1], the probability of an unsuppressed fire in the TGB battery room is 3.2E-3

• 0.02 = 6.4E-5.

Total CDF for TGB. The total probability of core damage due to a fire in the Turbine Generator Building is estimated as the sum of the above scenarios.

The CDF for each scenario is calculated as:

CDFmu = Fi.;

• CCDPi where Fi,,,i = large fire ignition frequency for the i-th sequence, and CCDP4 = conditional core damage probability for the i-th sequence.

TABLE 4-8 TGB

SUMMARY

Scenario Description Fire Freq.

CCDP CDF 1

Large fire in an A switchgear room cabinet fails 1.3 E-2 5.0E-6 6.5E-8 offsite power A 2

Large fire in a B switchgear room cabinet fails 1.3 E-2 9.5E-6 1.2E-7 offsite power B 3

Fire in Main Feedwater Pump A fails the AFW 2.0E-3 5.7E-5

1. l E-7 pump 4

Fire in TGB battery room fails both offsite 6.4E-5 3.5E-4 2.2E-8 power feeds Total CDF:

3.3E-7 4.6.4.4 Results For Areas Not Screened Out The areas not screened out in FIVE were evaluated further using fire PS A techniques, as described above. The resulting CDFs by fire area, based on realistic assessment of fire risk, are given in Table 4-9. The total CDF for the areas not screened out is 7.0E-6 per year. The CDFs for the Page 4-52 i

1 areas that were screened out are not added to these frequencies because the screening was very conservative; the CDFs for the screened out areas are most likely much lower than calculated in the screening analysis and would not be expected to contribute significantly to the total CDF. For the areas that were not screened out, the FIVE CDF values (F2 values) were in general several orders of magnitude higher than the realistic CDFs calculated here using PSA techniques.

TABLE 4-9 RESULTS FOR AREAS NOT SCREENED OUT Fire Area Description Core Damage Frequency (per/yr)

RAB-1 A Control Room 2.0E-6 RAB-lE Cable Spreading Room 9.9E-8 RAB-2 H&V Mechanical Room 1.9E-6 i

RAB-6 Elec. Penetration Area A 4.3E-7 RAB-7 Relay Room Envelope 1.6E-7 l

RAB-8 Switchgear Room 1.5E-6 RAB-15 Emerg. Diesel Generator B 5.9E-7 i

RAB-31

-4 Corridor and Passageways 5.5E-8 RAB-39

-35 and -4 General Areas 2.0E-8 TGB Turbine Generator Building 3.3E-7 Total CDF:

7.0E-6 4.7 ANALYSIS OF CONTAINMENT PERFORMANCE No fire-induced containment failures different from those identified in the internal events analysis [Ref. 4-11] were found.

i 4.8 TREATMENT OF FIRE RISK SCOPING STUDY ISSUES 4.8.1 Seismic Fire Interactions 4.8.1.1 Seismical!v Induced Fires Tanks containing flammable liquids were included as part of the IPEEE seismic walkdown and found to be properly designed and installed to withstand the effects of a design basis seismic event.

Page 4-53

)

I I

4.8.1.2 Seismic Actuation of Fire Suppression Systems Piping, including fire suppression piping, was sampled as part of the IPEEE seismic walkdown and found to be properly designed and installed to withstand the effects of a design basis seismic event.

4.8.1.3 Seismic Degradation of Fire Suppression Systems Piping, including fire suppression piping, was sampled as part of the IPEEE seismic walkdown and found to be properly designed and installed to withstand the effects of a design basis seismic event.

4.8.2 Fire Barrier Qualifications 4.8.2.1 Fire Barriers Waterford 3 fire barriers are shown on FSAR figures 9.5.1-2 through 9.5.1-21. All fire barriers (1-hour,2-hour, and 3-hour) are inspected for visual signs of degradation (unsealed openings, cracks, holes, dents, chips, or missing fireproofing). Any of these conditions, if outside the limits of existing acceptance criteria, can impair the ability of the barrier to perform as required.

Surveillance procedure ME-003-009 " Fire-Rated Walls, Floors, and Ceilings" is performed on a regular basis and describes the necessary actions should a nonconformance or potential nonconformance be found in any fire-rated barrier.

Any proposed changes to fire barriers are reviewed by Design Engineering Fire Protection as part of the plant design change process. This ensures that the design intent of the barrier is maintained.

4.8.2.2 Fire Doors Fire doors are surveyed on a regular basis. These inspections are conducted in accordance with established site inspection procedures (PS-015-111) which include specific guidelines and limitations for fire door operability (including gaps, holes, latching devices, closure arms, etc.). The inspections provide for compensatory measures to be initiated as soon as a fire door is found out of conformance.

4.8.2.3 Penetration Seal Assemblies Penetration fire seals are surveyed on 18 month cycles (ME-003-006)in predetermined 10% samples such that each fire seal will be inspected once every 15 years. Fire seals are visually inspected for surface degradation (gouges, voids, shrinkage, etc.). A 100%

Page 4-54

I C

i sample of penetration fire seals was performed in 1988 to address the concerns of Generic Letter 88-04 and 88-56. Suspected problems are identified to Design Engineering Fire j

Protection for evaluation and compensatory actions are continued until resolution.

l I

A computerized database is used to identify al! penetration seals. The database contains i

all the information necessary to determine the design basis for all of the Waterford 3 penetration fire seals.

4.8.2.4 Fire Damners j

Fire Dampers in ductwork penetrating fire barriers are visually inspected to ensure that l

valve seats and guides are free from obstructions and debris, that the damper is free of j

excessive corrosion, and the fusible link does not show signs of deterioration.

j 1

-4.8.3 Manual Fire Fighting Effectiveness i

j 4.8.3.1 Reponing Fires All site employees are provided with instructions on reporting fires in General Employee l

Trauung.

i 4.8.3.2 Fire Brigade 4.8.3.3 Fire Brigade Training Fire brigade training is conducted in accordance with Waterford 3 Training Procedure NTP-202 and meets the requirements of 10CFR50 Appendix R and other applicable regulatory guidance.

4.8.3.3.1 Practice i

Practice sessions are held for each shift fire brigade on the proper method of fighting the various types of fires that could occur in the plant. These sessions provide brigade members with experience in actual fire fighting and with the use of Self-Contained Breathing Apparatus (SCBA) under the strenuous conditions encountered during a fire.

Practice sessions are provided at least once per year for each fire brigade member.

4.8.3.3.2 Drills Per NTP-202, in-plant fire brigade drills are performed at regular intervals not to exceed three months for each shift brigade. Each fire brigade member should participate in each drill, but must participate in at least two drills per year. At least one drill per year per shift

-shall be unannounced to determine the readiness of brigade, brigade leader, and fire protection equipment.

Page 4-55

i 1

As a minimum, drills must address the following:

1) assessment of fire alarm effectiveness, time required to notify and assemble brigade, use of equipment, and fire fighting strategies 2) assesenent of each brigade member's knowledge of fire fighting role, conformance to procedures, use of equipment and knowledge of the pre-fire plans 3) use of equipment specific to plant area and type of fire presumed for the drill 4) assessment of brigade leader's direction to brigade members during the fire fighting effort 4.8.3.3.3 Records l

Individual records of training provided to each fire brigade member, including drul critiques, are maintained for at least three years to ensure that each member receives training in all parts of the training program.

4.8.4 Total Environment Equipment Survival 4.8.4.1 Potential Adverse Effects on Eauipment by Combustion Products This analysis is not required to address the short or long term effects of combustion products on safe shutdown equipment. The methodology states that current data on effects of combustion products is inadequate, but that the " detrimental short-term effects of smoke on equipment are not believed to be significant."

The negative effects of smoke on operators during performance of safe shutdown activities (i.e. switching, valve operation, etc.) was considered by the FIVE team when crediting manual actions in development of the P2 numbers. In addition, fire brigade members are educated on the toxic and corrosive characteristics of expected products of combustion as well as the proper use of emergency breathing equipment.

4.8.4.2 Spurious or inadvertent Actuation of Fire Suppression The spurious or inadvertent actuation of the plant's suppression systems resulting in the j

spraying down of and damage to plant components is not credible for the following reasons:

1.

Automatic suppression systems utilized in the Reactor Auxiliary Building are either pre-action systems or multicycle systems being converted to pre-action systems.

i Page 4-56 j

2.

Pre-action systems require an alarm signal from a reporting detector to open control valves for the associated suppression system. This feature vinually eliminates the inadvertent spraying down of safety related components because two events are required: the opening of the control valve to " charge" the system piping and the opening of one or more sprinkler heads.

3.

The spurious or inadvertent actuation of fire suppression systems was considered in the design and layout of the plant's safety-related electrical cabinets. Watertight seals are installed at all top penetrations in safety-related electrical cabinets; the seal material has been tested for use as a hydrostatic barrier. In addition, floor drain size and location considered the presence of fire suppression systems. The effect of water on non-electrical safety-related components is not addressed.

t 4.8.4.3 Operator Action Effectiveness 10CFR50 Appendix R Section L(3) requires that implementing procedures be in place for alternate and dedicated shutdown capability. Waterford 3 has met this requirement for Fire Area RABl A (Control Room Proper) with operating procedure OP-901-502

" Evacuation of Control Room and Subsequent Plant Shutdown". This procedure also addresses control room panel fires and cable spreading room fires which are not extinguished within 15 minutes. Operating procedure OP-901-503 " Isolation Panel Fire" details a plant shutdown from the control room upon confirmation of fire in any isolation panel companment in Fire Area RAB7. Control room personnel are trained in the j

implementation of the shutdown procedures; proficiency in the procedure is demonstrated as pan of a simulation exercise.

Should a control room evacuation be required, control room operators move to the remote shutdown room (LCP-43) on the +21 elevation of the Reactor Auxiliary Building.

4.8.5 Control Systems Interaction Waterford 3 has completed all plant modifications resulting from the Appendix R compliance effon. The NRC has reviewed the Waterford 3 Safe Shutdown Analysis and Associated Circuits Analysis; these analyses document the ability of the plant to be safely shutdown in the event of a control room fire.

4.9 USI A-45 (DECAY HEAT REMOVAL) EVALUATION The stated purpose of Unresolved Safety Issue (USI) A-45 [Ref. 8-1] is to " evaluate the adequacy of current designs to ensure that LWRs do not pose unacceptable risk as a result of DHR [ decay heat removal] system failures. The primary objectives of the USI A-45 program are to evaluate the safety adequacy of DHR systems in existing LWR power plants and to assess the value and 4

Page 4-57

impact (or benefit-cost) of alternative measures for improving the overall reliability of the DHR function."

The decay heat removal function was defined as those systems and components required to maintain primary and secondary coolant inventory control and to transfer heat from the reactor coolant system to an ultimate heat sink following shutdown of the reactor for normal events or abnormal transients such as loss of main feedwater, loss of offsite power, and small-break loss of coolant accidents (LOCAs). The A-45 program was not concerned with anticipated transients i

without scram, interfacing system (LOCAs), or emergency core cooling systems that are required l

only during the reflood phase following a large LOCA. The A-45 program is, however, concerned with support systems such as component cooling water, essential service water, and emergency (onsite) AC and DC power.

An interia value for a DHR quantitative design objective was given in NUREG-1289 as IE-5 per reactor year, Decay heat removal reliability was further categorized in terms of required action as follows:

i Category Description Core Damage Probability i

1 Frequency of core damage due

<3E-5 per yr, to failures of DHR function acceptably small or reducible to an acceptable level by simple l

improvements 2

DHR characteristics intermediate

>3E-5 but <lE-4 between categories 1 and 3 3

Frequency of core damage so large

>lE-4 per yr.

that prompt action to reduce the probability of core damage due to DHR failures to an acceptable levelis necessary w

)

The purpose of this section of the IPEEE report is to evaluate the Waterford 3 decay heat removal function, using the results of the fire risk screening described in Section 4.6, against the above A-45 criteria. Because the Waterford 3 fire IPEEE includes only transients initiated from full power conditions, this evaluation addresses only the transition from reactor trip to hot shutdown (which is of primary concern in the A-45 program).

4.9.1 Waterford 3 Decay Heat Removal Systems At Waterford 3, the high pressure safety injection (HPSI) system is used for primary inventory

~

control during a small break LOCA event. Secondary inventory control is provided by the main feedwater system (two turbine driven pumps), the auxiliary feedwater system (one motor driven pump), and the emergency feedwater system (two motor driven pumps and one turbine driven pump, each capable of maintaining secondary inventory after a reactor trip). The condensate Page 4-58

i

)

system (with three motor driven pumps) can also be used, if the steam generators are depressurized (by using the turbine bypass system or the atmospheric dump system). Transfer of heat from the reactor coolant system is accomplished by feeding the steam generators and

' dumping the steam produced into the condenser using the turbine steam bypass system or into the atmosphere using the atmospheric dump valves. For LOCAs, safety injection and coolant flow i

through the break also remove heat from the RCS. These primary and secondary inventory.

control systems, along with their support systems make up the DHR system at Waterford 3.

In the case of a loss of all main and emergency feedwater, a number of recoveries are available.

Obvious actions are to take manual control of the feedwater system or restore the failed equipment. If main feedwater were not able to be recovered, the auxiliary feedwater (AFW) pump could be started. The AFW pump is a high head motor driven pump that requires operator action to start. A motor operated valve can be opened to bypass the main feedwater control valves, if these valves are the cause of the loss of main feedwater. If AFW were not available, any one of three condensate pumps could feed the steam generators. This requires operator action to depressurize the steam generators below the shutoff head of these pumps (approximately 500 psia) using the turbine steam bypass valves or the atmospheric dump valves (ADVs). The ADVs are remotely operated, air actuated valves powered by safety buses and backed up by nitrogen accumulators. The ADVs can also be operated manually.

4.9.2 Evaluation of Waterford 3 DHR Function i

l The probability of the Waterford 3 plant losing the DHR function as defined in the A-45 program (NUREG-1289) is 7.0E-6 per year for fire-induced transients, including support system failures, such as component cooling water and emergency AC power failures. The evaluation included fire-induced small LOCAs. This is below the Category 1 probability in NUREG-1289 for plants with acceptably low DHR failure frequencies (<3E-5). Therefore, Waterford 3 has no unusual decay heat removal vulnerabilities and has a DHR failure probability that meets the A-45 definition of acceptable performance.

The Waterford 3 IPEEE has not been used to evaluate any other USIs or GIs.

Page 4-59

i l

REFERENCES 4-1.

" Fire-Induced Vulnerability Evaluation (FIVE)," EPRI TR-100370 Project 3000-

{

41, April 1992, with Errata Change Summary andPages dated September 1993.

l (This EPRI report with Errata is referred to as FIVE, Revision 1.)

4-2.

NSAC 178L revision 1, " Fire Events Database for US Nuclear Power Plants",

January 1993.

4-3.

" Methods of Quantitative Fire Hazard Analysis," EPRI TR-100443 Project 3000 '

[

37, May 1992.

4-4.

NSAC 181, " Fire PRA Requantification Studies", March 1993.

4-5.

Letter dated 9/29/93 to NUMARC Contacts from William H. Rasin, " Revision 1 to EPRI Final Report dated April 1992, TR-100370, Fire Induced Vulnerability l

Evaluation Methodology".

4-6.

FIVE, EPRI EL-6583-CCML Project 1493-4 "EPRIGEMS", December 1992.

4-7.

Waterford 3 Final Safety Analysis Report (FSAR).

l 4-8.

Waterford 3 Associated Circuits Analysis / Cable and Conduit List (ACA/CCL).

4-9.

Waterford 3 SIMS Component Database.

j 4-10.

W. J. Parkinson, "EPRI Fire PRA Implementation Guide," Draft, EPRI, Jan. 31, 1994.

t 4-11. Waterford 3 Individual Plant Examination, August 1992.

i i

s :-

1 Page 4-60

i l

5.

HIGH WINDS. F LOODS. AND OTHERS.

The focus of this part o f the IPEEE submittal is: "does the plant meet acceptance criteria listed in the 1975 SRP in terms of high winds, on-site storage of hazardous materials, and off-site j

developments?" The original hcensing action for Waterford 3 considered all manner of winds, floods, and industrial accidents. During the original licensing action, the NRC used the 1975 SRP as a basis for finding Waterford 3 acceptable in terms of external hazards with a few exceptions i

that the NRC reviewed and accepted. The exceptions are technical rather than substantive, e.g.,

the SRP recommended technique for calculating tornado loading on the shield building was not j

appropriate given the shallow dome roof of the shield building.

i The Waterford 3 staff reviewed the assumptions in FSAR Chapter 2 with respect to external event initiating frequency. Whenever that frequency is explicit in the FSAR, it is compared to the IPE l

Level 1 initiating event frequencies. If the external event frequency were small compared to the j

related Level 1 initiating event frequency, then the external event has an insignificant affect on our estimate of both the core damage frequency and distribution of containment release categories.

j When the external event initiating frequency is indeterminate, the corresponding part of Section 5 describes the plant design features and related basis with respect to external events. Note, the external events are typically a subset of the Level 1 initiating events. For example, storm damage that causes a loss of off-site power is pan of

vel 1 assumption behind the transient initiator T5.

As a further review of plant specific hazard data and licensing bases, the Waterford 3 staff also qualitatively reviewed the external events postulated in FSAR Chapter 2 against spectacular events in southeast Louisiana. We sought assurance that the postulated events bounded the spectacular events since initial plant startup.

The final part of the review involved re-visiting the 10 CFR 50.59s written since initial plant start-up regarding changes that exposed the plant to new external hazards, e.g., a new hydrogen gas pipeline across the site. The probability and consequences of the new configuration is qualitatively related to either FSAR Chapter 2 assumptions or IPE assumptions. Insignificant changes in this group are those that change neither the estimate of the core damage frequency, nor the distribution of containment release categories.

In summary, Waterford 3 found no high winds, floods, or off-site industrial facility accidents that significantly alters the Waterford 3 estimate of either the core damage frequency, or the distribution of containment release categories. Waterford 3 funher concludes that the plant is in conformance with the 1975 SRP that pertains to high winds, on-site storage of hazardous materials, and off-site developments.

Page 5-1

J I

5.1.

HIGH WINDS.

5.1.1. Plant-Specific Hazard Data and Licensing Basis.

FSAR Section 2.3.1.2.2 describes the hurricanes considered during Waterford 3 licensing. The

)

maximum sustained winds were measured at 98 mph during Hurricane Betsy (1965). The FSAR recounts that 26 hurricanes have passed New Orleans between 1886 and 1974, including three hurricane eyes. That translates to a 0.30 per year frequency for nearby hurricane passage.

The plant structures defined as seismic Category I structures are designed for a maximum sustained wind of 200 mph at 30 feet above plant grade. Those same seismic Category I l

structures were designed to resist a tornado of 300 mph tangential wind velocity and a 60 mph translational wind velocity.

5.1.2. Ident Ged Significant Changes Since OL Issuance.

3 Hurricane Jaun (1985) and Andrew (1992) would have rated inclusion in FSAR Table 2.3-137 had they occurred before initial plant startup. However, neither storm resulted in winds greater than Hurricane Betsy (1965). Although these storms were spectacular in their own rights, the consequences of a hurricane are still bounded by the current FSAR. These two occurrences since initial plant stadup result in a frequency ofless than 0.23 per year; less than initially postulated by the FSAR Chapter 2 analysis.1 There has been one tornado on-site (1994), but it did not enter the protected area immediately surrounding the nuclear plant island structure. That one tornado in the last twelve months matches the frequency estimated in FSAR Section 2.3.1.2.4.

Waterford 3 reviewed tornado protection features as documented in FSAR Table 3.5-3 for leads in a search for changes that might significantly affect core damage frequency with respect to high winds. The search yielded no significant changes to any of the features described on Table 3.5-3.

In addition, the plant has been declared in conformance with Regulatory Guide 1.76, Design Basis Tornado for Nuclear Power Plants (re FSAR Section 3.3.2.1 and FSAR 1.8).

5.1.3. Plant Robustness in Relation to 1975 SRP Criteria.

This part of the review focuses on the protection offered by the plant design against tornadoes.

The FSAR identifies all safety-related structures, systems, and components that need protection from externally generated missiles. All safety-related systems and components as well as stored j

nuclear fuel are within tornado missile-protected structures or they have tornado missile barriers.

An exception is a portion of the emergency feedwater system pipe and portions of the wet cooling 1 FSAR Table 2.3-137 ( five hurricanes in 10 years) and FSAR 2.3.1.2.2 (55 tropical or better storms in 107 years) l Page 5-2 4

towers (i.e., the ultimate heat sink). The SRP refers to several standards and techniques as one acceptable basis for plant design features that protect against tornadoes. But, the NRC found the overall design of safety-related structures at Waterford 3 acceptable while at the same time considering those same standards and techniques.

i Category I structures exposed to tornado forces and needed for the safe shutdown of the plant were designed to resist a tornado of 300 mph tangential wind velocity and a 60 mph translational wind velocity. The simultaneous atmospheric pressure drop was assumed to be 3 psiin 3 seconds. The tornado tangential velocity and translational velocity are summed algebraically, and applied on the entire building structure. Shape factors and drag coefficients are based on the procedures outlined in ASCE Paper No. 3269. The NRC reviewed the procedures that were used to determine the loadings on Seismic Category I structures, and the NRC made a determination that the procedures were acceptable. Since that time, Waterford 3 has maintained this as the technique for determining the adequacy of safety-related structures.

To assure integrity of safety-related structures in the face of tornadoes, Waterford 3 has committed to Regulatory Guides 1.13, " Spent Fuel Storage Facility Design Basis," 1.27,

" Ultimate Heat Sink for Nuclear Power Plants," 1.115, " Protection Against Low Trajectory Turbine Missiles," and 1.117, " Tornado Design Classification." The commitment to these regulatory guides has not changed since initial plant startup. Thus, the plant is everything the SRP expects in terms of tornado protection.

The SRP refers to several standards and techniques as one acceptable basis for plant design features that protect against hurricanes. The NRC found the design of safety-related structures at Waterford 3 acceptable while considering those standards and techniques.

Regarding hurricanes, Waterford 3 design is such that each safety-related structure can withstand a maximum wind of 200 mph at 30 feet above plant grade. The design wind specified has a velocity of 200 mph based on a recurrence of 100 years. The corresponding dynamic wind pressure and corresponding load on the stmetures was calculated in a manner the NRC found acceptable. Thus, Waterford 3 hac maintained these design requirements since initial plant startup.

Page 5-3

5.2.

FLOODS.

5.2.1. Plant-Specific Ilazard Data and Licensing Basis.

Safety-related equipment is housed within the Nuclear Plant Island Structure (NPIS). The NPIS is a reinforced concrete box structure with solid exterior walls and is flood protected up to elevation +29.25 feet MSL.

Flooding as a result of the probable maximum hurricane (PMH) and the instantaneous break of the levee were analyzed, and the maximum water levels at the NPIS were determined to be 25.4 R MSL and 27.6 R MSL respectively. The maximum combined static and dynamic loads would increase linearly from zero at elevations 25.4 A and 27.6 A to 493 psf and 630 psf at elevation 17.5 MSL respectively. These conditions result in water levels and loads being below the design criterion of flood protection to elevation 29.25 A MSL. In addition to the 29.25 R flood protection feature, Technical Specification 3.7.5 and the corresponding operating procedures require securing flood tight doors when the Mississippi River exceeds 27.0 R mean sea level i

USGS datum.

l Roof design has been reviewed according to the criteria for load combinations listed in FSAR Table 3.8-39, Formula 5. Both the six hour probable mazimum precipitation (PMP) giving the maximum intensity, and the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> PMP giving the maximum accumulation have been considered. All roofs of safety related structures can safely store the maximum possible ponding resulting from the PMP. FSAR Figure 2.4-8 shows the locations and sizes of all roof drains and scuppers, and the heights of parapets.

5.2.2. Identified Significant Changes Since OL Issuance.

LDCR No. 92-0010 was issued to correct the design flood level in the FSAR. The FSAR had stated that the design flood level was elevation 30 A. However, the top of the floodwall was surveyed at elevation 29.27 ft Since under the most severe flooding condition, the highest level the water will reach is 27.6 ft, the safety related equipment is protected from flooding. The exterior walls of the NPIS were designed based on calculation 6W12-RAB-002(Q). The actual design stresses are far below the allowable design stresses. Therefore, the extra buoyancy and

)

earth pressure on the walls due to 9 inches of settlement of the NPIS will not affect the design of the walb.

The original analysis conducted to evaluate effects of Standard Project Storm (SPS) on cooling tower areas is still considered valid. The new PMP analysis (re Generic Letter 89-22) did not update either the daia or the guidelines employed in the SPS study. The Generic Letter was intended for hure plants and did not require a change to plants' design basis.

Page 5-4

No events since plant startup lead anyone to believe that the levees near Waterford 3 are any more vulnerable than during initial licensing. Levee slumps have occurred downstream of Baton Rouge since initial plant startup. But, the Army Corps of Engineers lined the levees on the Waterford side of the Mississippi with concrete in 1993. That feature gives the levees greater stability.

Besides that, the Waterford 3 design features to protect against an external flood greatly over-estimates the likely water level on-site after a levee break. Thus, the external flooding hazard associated with Mississippi River levees is at worst unchanged and probably less since initial plant startup.

The discussion in Section 5.1 above implies that the frequency of a hurricane storm surge is also essentially the same as assumed during initial licensing. As discussed above, the plant is still designed to be flood resistant to 29.25 MSL.

5.2.3. Plant Robustness in Relation to 1975 SRP Criteria.

Three possible types of flooding were analyzed: (1) probable maximum hurricane (PMH) surges; (2) levee failures during Mississippi River floods; and (3) local intense precipitation.

External water levels around the turbine building six or more inches deep will leave electrical equipment in the Turbine Building Switchgear Room disabled. Floods that reach 25' MSL will put the instrument air, auxiliary feedwater (not emergency feedwater inside the NPIS, see below),

condensate and main feedwater system out-of-service should the Turbine Building switchgear survive that long. The Level I has already included secondary plant initiators as well as an internal flood analysis.

The frequencies associated with the Level 1 and its flood analysis overshadow the frequencies associated with severe external events like levee failures. Thus the focus of the following analysis is on the design features of the Nuclear Plant Island Structure (NPIS) done in terms of design basis external events and the related Standard Review Plan sections. By itself, the NPIS contains all the equipment necessary to bring the plant to a safe shutdown condition and keep it there.

5.2.3.1 Probable Maximum Hurricane Surges Two credible approaches of a hurricane surge to the site were considered: (1) up the Mississippi River from Head of Passes; and (2) from the open Gulf across the low-lying wetlands to the south. The upriver path is the most critical. The analysis assumed that the PMH would occur coincident with a hypothetical severe flood on the Mississippi River. The flood used was one l

which was developed by the Corps of Engineers and the National Weather Service, producing a discharge of 1,250,000 fl3 /sec south of Red River Landing. The maximum water level run-up at the NPIS, assuming an instantaneous levee failure, for this event was 25.4 ft MSL.

Page 5-5

5.2.3.2 Probable Maximum Flood-Induced Levee Failu.rg Waterford 3 estimated potential flooding from rainfall over the Mississippi River basin upstream of the site. The probable maximum flood (PMF), which is the hypothetical flood that is the most severe precipitation-induced flood reasonably possible, was estimated to produce flow of 5 million 3

ft /sec at Red River Landing. This estimate was made by using 165% of the Corps of Engineers 3

project design flood (PDF) estimate of 3,030,000 f1 /sec at the same location. A flood of this magnitude would overtop the Mississippi River levees upstream of Waterford 3 and because of the resultant spillage, produce water levels equal to or less than those associated with the levee PDF which produces a water level within the levees of 27 ft MSL This level is lower and less critical than that estimated for a hurricane surge.

Waterford 3 also performed an analysis of an instantaneous failure of the levee with a river stage of ?0 ft MSL. This analysis resulted in an estimated flood level higher than that calculated for the hurricane surge. The calculated maximum water level run-up at the NPIS was 27.6 fl MSL.

The NRC reviewed the analysis and concluded that the estimated run-up level is conservative.

The NPIS has been designed for a maximum flood level of 29.25 ft MSL. Since this is 2.4 ft higher than the maximum water level conservatively calculated assuming the most critical flood conditions, the NRC concluded that the flood analysis for the NPIS meets the criteria suggested in Regulatory Guide 1 59, " Design Basis Floods for Nuclear Power Plants," and Regulatory Guide 1.102, " Flood Protection for Nuclear Power Plants."

5.2.3.3 Local Intense Precipitation Waterford 3 is located so that, with the exception of the cooling tower basin areas, runoff from local intense precipitation will not affect its safety, External walls are flood proofed to elevation 29.25 ft MSL. This elevation is a minimum of 12.5 ft above plant grade and is far above any ponding which could be expected due to severe rainfall up to and including the probable maximum precipitation (PMP). The PMP for various durations is as follows:

Duration Amount (hr) m in 6

0.78 30.7 12 0.88 34.6 24 1.00 39.4 48 1.10 43.5 Waterford 3 has wet and dry cooling towers which are open at the top. There are two open cooling tower areas A and B. Local intense precipitation which falls directly over these open areas plus runoff from adjacent roofs will accumulate and pond on the floors of the dry cooling Page 5-6

_ ~

1 l

1 l

tower areas. A combination of floor drains and a network of drainage piping will convey this water to two sumps where a set of duplex pumps in each sump will remove water from the cooling tower areas.

In Amendment 21 to the FSAR, Waterford 3 performed a revised analysis of potential flooding in cooling tower areas A and B. In this analysis roof drains were assumed to be 33 percent blocked.

The analysis also assumed that one of the sump pumps in each cooling tower area would be inoperable during a probable maximum precipitation (PMP) event. This revised analysis resulted in lower ponding levels in the cooling tower areas. These levels, however, were not low enough to prevent flooding of the motor control centers which are located on the floor of the dry cooling towers. To funher reduce ponding levels in the cooling tower areas, Waterford 3 proposed to allow water to flow into and pond in the Fuel Handling Building via eight 4-in diameter openings between the cooling tower areas and the Fuel Handling Building. Waterford 3 estimated that by

)

allowing water to pond in the Fuel Handling Building, a maximum of 1.6 ft of water will pond in the cooling tower areas and in the Fuel Handling Building. The maximum height to which water can pond in the cooling tower areas before flooding of essential portions of the station service transformers occurs is 3.0 ft, and for the motor control centers it is 1.71 ft.

The NRC reviewed the material presented by Waterford 3 and performed an independent analysis.

The NRC concluded that, with the eight 4-in. diameter opening installed as indicated, water depths in the cooling tower areas will remain below 1.6 ft following a PMP event and will thus not affect the safe operation of Waterford 3.

Waterford 3 also considered an event which included an OBE, which fails the cooling tower area sump pumps, in combination with a standard project storm of 96 hour0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> duration. This event was determined to produce a total rainfall of about 23 inches and would result in a ponding depth of about 1.9 ft in the cooling tower areas assuming that all four sump pumps are inoperable. This water level is higher than the maximum allowable ponding depth of 1.71 ft. Waterford 3 committed to provide a portable pump with a pumping capacity of 100 gpm and suflicient head to pump over the cooling tower wall. Waterford 3 also committed to include the pump in the surveillance testing program which would include a demonstration at least once per refueling that the pump will circulate water. Additionally, Waterford 3 committed to store the pump on pallets away from any non-seismic Category I equipment, and, as pan of the station's emergency procedures, to incorporate a provision for setting up the portable pump within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of a seismic event if the installed pumps fail. The NRC, based on this resolution, concluded that with respect to potential flooding of the cooling tower areas, Waterford 3 meets the requirements of 10 CFR 50, Appendix A, GDC-2, and the criteria of Regulatory Guides 1.59 and 1.102.

NRC Generic Letter 89-22 communicated the revised Probable Maximum Participation (PMP) data developed by the National Oceanic Atmospheric Administration (NOAA) of the National Page 5-7 l

i Weather Service. Waterford 3 performed a study to evaluate the potential for increased roof 2

loads, cooling tower areas ponding, site drainage, and the plant area flooding. The analysis concluded the following:

The revised 6-hour and longer duration,10 square mile PMP depths used for flooding l

e analysis, are slightly higher than the values previously used and specified for the Waterford 3 Design Basis. The new 6,12, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PMP depths are 32.0,38.7 and 47,1 inches compared to previously used depths of 30.7,34.6 and 39.4 inches respectively. However, the revised PMP depths, when modified specifically for the Waterford 3 catchment area, reduce to 22.44,28.51 and 35.24 inches for 6,12, and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> durations respectively.

These PMP depths are lower than the original design basis. Therefore, the revised criteria has no adverse impact on Waterford 3 site flooding.

The short-duration, point PMP intensities are higher than the intensity originally used for

' design of the plant. The site drainage design is based on a rainfall intensity of 81/4 inches per hour, 50 year recurrence interval, whereas the roof runoff and the cooling tower area i

ponding calculations are based on 6-hour rainfall distributed hourly ranging from a low of 3.08 inch in the first hour to 11.67 inches in the 4th hour. The revised intense PMP depths for the most critical 5 min.,15 min.,30 min., and I hour durations are 6.21,9.70,14.16 and 19.4 inches respectively. These PMP depths are based on the most severe storm ever recorded with and upward moisture maximization adjustment, which makes the PMP worse than even the 100 year recurrence storm.

The local site flooding due to the new intense PMP will not have any adverse effect on the e

nuclear plant island structures because the exterior walls of the plant are flood protected up to El. +29.25 ft. (MSL),12.5 ft. to 15.5 ft. above grade, which is far above any ponding that could be expected due to a severe intense rainfall up to and including the revised PMP and assuming blocked culverts.

The ponding on the RAB and the Fuel Handling Building roofs will increase above the values originally expected due to the revised PMP data. Analysis for the RAB and the Fuel Handling Building roof slabs indicates that the original design is adequate to safety withstand the additional roof ponding loads.

Safety-related MCCs and transformers are located in the cooling tower areas. The critical depth of water in this area before flooding of essential portions of this equipment is 1.71 ft This depth will be exceeded for the revised PMP intensity, which is based on adjusted worst ever recorded storm, if the Fuel Handling Building sump pump and one of the two cooling tower area sump pumps are assumed operable. However, for the estimated 50 year recurrence rainfall, the maximum ponding depth is 1.70 ft. which is less than the

'2 PEIR 20066 Page 5-8

critical depth. If both cooling tower area sump pumps are considered operable in addition to the Fuel Handling Building sump pump, then the maximum ponding depth for the worst ever recorded storm PMP intensity is 1.65 fl. which is less than the critical depth.

Considering the conservatism in the revised PMP criteria and availability of an additional portable pump, it was concluded that additional measures are not required due to the revised PMP criteria.

The safety-related Back-up Fuel Pool Heat Exchanger is located in the Fuel Handling Building. The bottom floor of that building is at the same level as the bottom of the cooling towers. Water roughly two or more inches deep on the floor of the cooling towers will flow laterally through small pipes in to the FHB sub-basement. Thus, the maximum ponding depth is the same in the cooling tower area and in the sub-basement of the FHB. All equipment and instrumentation in the FHB are located well above the maximum ponding depth of 1.70 fl. and the critical depth of 1.71 fl.

5.3.

TRANSPORTATION AND NEARBY FACILITY ACCIDENTS.

5.3.1. Plant-Specific Hazard Data and Licensing Basis.

FSAR Sections 2.2.1,2.2.2,2.2.3, and 2.3.4 describe the location and distances ofindustrial and transportation facilities. The nature and extent of activities conducted at nearby facilities, including the products and materials likely to be processed, stored, used, or transported have been identified and evaluated. Suflicient statistical data has been documented to establish a basis for evaluating the potential hazards to the plant.

The potential hazards are of two types; (1) toxic gas hazards, and (2) fire and explosion hazards.

These hazards can result from various manufacturing industries, pipelines, roads and railroads, and ship traflic in the Mississippi River.

Technical Specification 6.9.1.9 and 6.9.1.10 help us assure that there is an appropriate design basis for the toxic gas hazard protection features of the plant and its procedures. The FSAR includes analyses of over-pressures caused by explosion hazards. Those numbers become part of the design input for safety-related structures.

Page 5-9

\\

5.3.2. Identified Significant Changes Since OL Issuance.

In April 1992, construction staned on the Evangeline pipeline.3 This pipeline supplies natural gas to the Waterford 1, Waterford 2 and Little Gypsy LP&L fossil fired power plants. A 24-inch pipeline enters the Waterford 3 propeny to the south-east of the Waterford 3 buildings. The 24-inch pipeline connects to two 20-inch pipelines at a " pig trap station" just south of the Union &

Pacific Railroad tracks. One 20-inch pipeline then runs parallel to and slightly west of the existing 26-inch Bridgeline pipeline to supply Little Gypsy. The other 20-inch pipeline then runs parallel to and just south of the railroad tracks and then parallel to the existing 16-inch LP&L pipeline to supply Waterford 1 and Waterford 2. The maximum natural gas flow rate in the 24-inch pipeline is 250E6 scf/ day. The maximum flow rate in each 20-inch pipeline is 150E06 scf/ day. With the exceptions of the " pig trap station" and the connection to the Waterford header, the Evangeline pipeline is buried for its entire length.

The hazard that the new pipeline poses to Waterford 3 is that of a potential pipeline break i

followed by an explosion. The explosion shock wave is considered when judging the adequacy of Waterford 3 structures. A break in a natural gas pipeline does not present a control room habitability concern, per FSAR Section 2.2.3.3.1, because the natural gas is likely to explode or burn before reaching the main control room.

FSAR Section 2.2.3.1.3.1 presents an analysis of the effects of a natural gas pipeline break and explosion. The new Evangeline pipeline has the potential to cause this type of accident. It should be noted, that this is an external event accident that has absolutely no effect on Waterford 3 safety-related structures. Calculation EC-M92-010 shows that the explosion hazards because of the new pipeline are bounded by the present FSAR analyses. The maximum over-pressure from an explosion on the new pipeline is 1.6-psi. The allowable over-pressure is 3.0-psi in the Waterford 3 design basis.

Concluding Remarks 4

Technical Specifications 6.9.1.9 and 6.9.1.10 require Waterford 3 to perform a survey and analysis of toxic chemicals and explosive hazards from chemical plants within the vicinity of Waterford 3. The first survey was performed in May 1988, reference 4, and the second smvey was performed in July 1992, reference 3. These surveys are intended to ensure that the toxic chemicals and explosive hazards analyses ofrecord remain bounding. Any new toxic chemicals or explosive hazards would need to be evaluated and resolved with the NRC.

3 LDCR 92-0441 i

s Page 5-10

l l

5.3.3. Plant Robustness in Relation to 1975 SRP Criteria.

5.3.3.1 Fire i

- Postulated accidents involving fires can be evaluated in two principal ways with respect to the nuclear plant. First, there may be thermal effects due to a fire at the scene of an accident.

Locations of all fixed storage facilities, pipelines, and transportation routes were examined and a determination was made that the distance to the plant in each case is sufficient such that the thermal effects with respect to the plant are acceptable. Second, postulated leakage or spillage of materials such as propane or other flammable hydrocarbons could lead to the formation and drift i

of clouds toward the plant. Analyses were performed in this regard and a finding made that thermal effects due to delayed ignition and deflagration of flammable vapor cloud are insignificant with respect to the plant. This conclusion is based primarily on the observation that the thermal fluxes and time durations of the vapor cloud fireballs are insufficient to produce appreciable heating of glant ' structures and equipment. For example, the maximum thermal fluxes are abo 287 kW/m in conjunction with a postulated LPG truck accident on LA 18, near the plant.

However, the estimated time duration for the fireball is less than 10 seconds, which is more than two orders of magnitude less than what is needed to produce significant heating of plant structures. All other postulated delayed ignition of flammable vapor clouds involves sindlar short duration times, and distances from the plant which are significantly greater than 300-foot minimum distance estimated for the propane cloud relative to the plant in the event of a LPG truck accident on LA 18. In view of the above considerations, the NRC concluded that the thermal effects due to postulated fires in the vicinity of the nuclear power plant do not pose a significant threat to the safe operation of the plant.

5.3.3.2 ExplosiQn Waterford 3 analyzed four events for explosive hazards.

l (a)

Explosion of 300,000 barrel tanker containing gasoline passing on Mississippi River 1200 fl north of safety related structures.

(b)

Explosion of LPG tmck carrying 10,500 gallons of LPG on route 18 passing a critical distance of 462 feet north, east, or west of nuclear plant island structures.

(c)

Explosion of Bridge line's 26 inch natural gas pipeline which is approximately 3168 ft from the plant.

(d)

Explosion of Union Carbide Propylene tank containing approximately Page 5-11

l i

I 6

d 5.78 x 10 lbs of propylene and located approximately 6300 ft from the plant.

The over-pressure from these events were (a) 1.3 psi, (b) 3.0 psi, (c) 1.0 psi, and (d) less than 1 psig. Acceptable over-pressure in later hazard analyses has thus become less than or equal to 3.0 psi.

1 f.3.3.3 Toxic Gas Hazards -

t 5.3.3.3.1 Evaluation ofStationary Chlorine Sources l

Potential hazards posed by stationary sources of chlorine were evaluated by comparing such

. sources to the allowable quantities listed in Table 1 of Regulatory Guide 1.95. Waterford 3 was assumed to have a Type II control room. Waterford 3 control room has local detectors, a normal air exchange rate of 0.06 vol/hr, and a measured leak rate ofless that 0.06 vol/hr.

i The stationary source of chlorine posing the greatest potential hazard is a tank on the site of the Occidental Chemical Co., which contains 500 tons and is located 1490 meters from the Waterford l

3 control room. At this distance, the maximum allowable quantity calculated by log-log interpolation, in accordance with the guidance of RG 1.95, is 662 tons. the Waterford 3 control room therefore satisfies the guidance of RG 1.95.

5.3.3.3.2 Evaluation of Other Stationary Sources The analysis of postulated accidents involving stationary sources of chemicals other than chlonne were performed in accordance with the general guidance of Regulatory Guides 1.78 and 1.95 and utilized the detailed release and atmospheric transport model described in NUREG-0570, June 1979. The atmospheric transport and dispersion of the initial puff was calculated according to the general model presented in Regulatory Guides 1.78 and 1.95. The concentration of a toxic chemical inside the control room was based on a control room air exchange rate of 0.6 per hour.

The toxic chemical concentrations calculated inside the main control room were assessed against

- their "Immediately Dangerous to Life or Health" (IDLH) concentrations.

The analysis modeled the detection of ammonia by the ammonia detectors and of most other l

chemicals by the Broad Range Toxic Gas Detectors (BRTGDs). Credit was taken for odor i

detection. Operators were assumed to don breathing apparatus two minutes after the alarm or odor detection, whichever occurs first.

Sets of meteorological conditions were constmeted which included all combinations of stability class and wind speed. Since the quantity ofliquid that is vaporized increases with temperature, j

summer temperatures were assumed for the sake of conservatism. Stability classes E-G were 4 FSAR 2.2.3.1.3.3 l

l Page 5-12 J

I

l l

I assumed to occur primarily at night. For these cases, the average ambient night-time temperature for the summer months, June through August, was calculated by taking the average of the mean temperatures and the mean minimum temperatures for each of these months. Since stability classes A - D may occur in the daytime, average daytime temperatures were calculated for those I

cases by substituting mean maximum for mean minimum temperatures. Daytime ground temperatures were assumed to be 10 C higher than the air temperatures. Night-time ground temperatures were assumed to be the same as the ambient air temperatures.

1 The frequency of occurrence of a given set of meteorological parameters for a given wmd direction was calculated as follows. Each value of the annual average joint frequency of wind i

speed and stability class was divided by the fraction of time the wind was in that sector (i.e., the joint frequencies for the given compass direction we.e normalized to 1). Thus, each new value represented the probability of the joint occurrence of that particular wind speed and stability class combination, assuming the wind is in the given sector.

Accidents under each set of meteorological conditions for the given wind direction were then modeled. The control room was assumed to be habitable if the concentration inside did not exceed the IDLH level by the time the operators were assumed to have donned breathing apparatus (two minutes after the alarm or aRer odor detection, whichever occurs first.) If the control room was habitable under meteorological conditions occurring not less than 95% of the time for the given compass direction, the given source does not pose a hazard, according to the guidance of RG 1.78.

5.3.3.3..I Analyses of Transient ChemicalSources Transient chemicals transported by truck, barge or rail in the WSES-3 vicinity were first analyzed in the same manner as the stationary sources. The release was postulated to occur at the point on the road, river channel, or rail line closest to the plant. For those postulated accidents for which the habitability criteria discussed above were not met, a probabilistic safety analysis ws:,

performed as follows. The portion of the given transportation route within a five-mile radius of the control room was divided into a number segments. An accident involving the total loss of lading of a single container was postulated to occur at the center of each segment. The probability that such an accident could cause the concentration in the control room to exceed the IDLH level within two minutes of detection was calculated, using the data on the joint frequency of occurrence of stability class, wind speed and direction. An overall annual probability of such an event was then calculated, using data on the frequency of shipment of that chemical in the particular transport mode.

Over 130 sources, either stationary sources or transient sources treated as stationary, were analyzed using the methods described above. None of the stationary sources were found to pose a hazard under the 95% percentile meteorological conditions.

i Page 5-13

i 5.4.

OTHERS.

Information on the population centers near Waterford 3 appears in Emergen.:y Planning documents in accordance with 10 CFR 50.47 and Part 50 Appendix E. No new large population centers have formed near the Waterford 3 site since initial plant startup.

Air traffic as represented in the FSAR and the corresponding NRC SER continues to bound the actual air traffic hazard to the plant.5 i

Waterford 3 knows of no other plant-unique external event that poses any significant threat of severe accident within the context of the screening approach for "High Winds, Floods, and Others."

5 W3F1-93 0055 of14May93 Page 5-14

6.

l.,1CENSEE PARTICIPATION AND INTERNAI; REVIEW TEAM GL 88-20, Supplement 4, requested significant participation by utility personnel in the performance of the IPEEE. This would allow the maximum benefit to be realized and facilitate integration of the knowledge gained into operating procedures and training. NRC also recommended that an independent review be conducted to assure the accuracy and validity of the results. This section describes the Waterford 3 IPEEE organization, the extent ofutility personnel involvement, and the independent reviews that were conducted.

6.1 IPEEE ORGANIZATION The NRC encouraged utility staff participation in IPEEE preparation. The IPEEE team consisted of Waterford 3 Design Engineering personnel from the Safety and Engineering Analysis (PSA),

Design Engineering-Civil, and Fire Protection Engineering groups. With the exception of the seismic evaluation, all of the IPEEE was performed by Waterford 3 staff. The seismic evaluation utilized the expertise of a recognized seismic consultant (Stevenson & Associates). Utility personnel prepared the seismic safe shutdown equipment list, participated in the walkdowns, and provided detailed review and comment to the seismic consultant. This ensures that knowledge and skills gained during the evaluation would be retained in-house so insights and lessons learned could be incorporated into plant procedures and programs more expeditiously.

The personnel involved in the IPEEE were:

Becky Abukhader Fire Maria Rosa Gutierrez Seismic, Condensed SSEL, High Winds, Floods, and Others Richard Finch Others Howard Brodt Fire l

StevenFarkas High Winds, Floods, and Others, Full SSEL Greg Ferguson Seismic Walkdown John Burke Seismic Walkdown Siddarth Munshi Seismic Walkdown Robert Murillo Licensing George Thomas (S&A1)

Seismic Stephen Anagnostis(S&A)

Seismic Dr. John Stevenson (S&A)

Seismic 3Stevenson & Associates Page 6-1

I i

6.2 COMPOSITION OF INDEPENDENT REVIEW TEAM The Waterford 3 IPEEE was submitted to an independent peer reviev. The seismic peer review was performed by consultant personnel, contracted by Stevenson & Arsociates (the seismic consultant), who were not involved in the IPEEE. The fire events peer review was performed by a fire protection engineer at another Entergy nuclear plant (ANO) and by a Waterford-3 fire protection engineer who was not involved in the IPEEE. The PRA portion of the fire evaluation (the determination of redundant train unavailablities) was also reviewed by a Waterford 3 PRA engineer who had no involvement in the fire evaluation. The evaluation of other events was independently reviewed by Waterford 3 personnel. The members of the peer review team were:

Tom Robinson (ANO)

Fire Tim Matey Fire John Albano Fire Howard Brodt High Winds, Floods, and Others Harry Johnson (contracted by S&A)

Seismic Robert Budnitz (contracted by S&A) Seismic These reviews ensured the accuracy of the IPEEE process and its results.

i In addition, a second level of review was performed by plant personnel not directly involved with the IPEEE. This consisted ofindividuals from Operations, Engineering, and Licensing management who reviewed the IPEEE submittal.

6.3 AREAS OF REVIEW AND MAJOR COMMENTS The peer review for the seismic events portion of the IPEEE covered all seismic evaluation portions of the project and included a review of the Project Plan of Work, the Safe Shutdown Equipment List (SSEL) development process, all systems aspects of the project, and the draft report, and included a visit to the plant site for a sample walkdown and a review of the documentation. The peer review concluded that there were no significant deficiencies in the seismic IPEEE portion of this report, the SSEL, the walkdown process and its documentation.

The peer review of the fire events portion of the IPEEE confirmed the validity of the assumptions, verified that the FIVE methodology was followed correctly, reviewed the PRA calculations for appropriateness, checked the reasonableness of the results, and reviewed the transient combustibles procedure. The peer review concluded that the fire analysis successfully met its i

objectives with a sound methodology.

Page 6-2

f The peer review of the High Winds, Floods, and Others portion of the IPEEE confirmed that the screening method was properly followed and the conclusions were justified. The review concluded that the evaluation was appropriately performed.

6.4 RESOLUTION OF COMMENTS All comments were resolved to the satisfaction of the independent reviewers. No comments were i

made which required significant changes in the analysis.

i i

Page 6-3

7.

PLANT IMPROVEMENTS AND UN!OIIE SAFETY FEATURES One of the purposes of the IPEEE is to identify plant specific severe accident vulnerabilities. The results of the vulnerability review are described in this section.

t The criteria used in the Waterford 3 IPEEE to define a vulnerability are a combination of quantitative and qualitative criteria. The quantitative criteria come from the NUMARC Severe Accident issue Closure Guidelines (see Reference 7-1). The criteria are listed below.

1) A mean core damage frequency greater than or equal to 1x10-4 per year for any external event scenario

2) A single failure which has an unusual and significant effect on the core damage frequency

3) A common cause failure of two or more components which has an unusual and significant effect on the core damage frequency

4) A support system failure that causes multiple front line system failures and thereby has an unusual and significant impact on core damage frequency i

Severe accident vulnerabilities and potential plant improvements are discussed below for each type of external event.

7.1 SEISMIC EVENTS No seismic vulnerabilities were identified. The walkdowns resulted in no outliers that are operability issues at the plant. However, there were three unresolved issues at the completion of the walkdowns. These issues are not significant to seismic risk and are being made to conform with standard practice in seismic design.

7.1.1 Resolution of Outlier Concerns CR-94-1019 was issued to document all loose items in the Control Room. This condition report addresses the loose items in the control room and justifies why it is not an operability concern.

However, the corrective action will be to remove or restrain the lockers and file cabinets in the control room, remove book shelves in the vicinity of safety-related cabinets, and relocate or restrain other loose items in the vicinity of safety-related cabinets. Waterford 3 will complete a modification package by February 15,1995, for any equipment that will be restrained by means bolting or equivalent.

Page 7-1

CR-94-111I was issued to document that the station air pipe which is adjacent to 4KVESWGR3B XPANEL does not meet the clearance requirements stated on drawing B288 Sheet.10-2A. A rod hanger which supports the station air pipe is within 1/16 of an inch from the panel. Ilowever, the station air pipe will not have any impact on the operability of the relays in the panel. The relays that would be affected are not essential relays. They are overcurrent induction disk relays and do not contain an instantaneous unit. No corrective action is necessary because there is no adverse impact to the equipment in the panel. The response to CR-94-1111 will be completed by March 30,1995, to formally evaluate and document the reasons why the existing clearance is acceptable.

7.1.2 Design Enhancement Opportunities Waterford will revise procedure FP-001-17, Transient Combustibles and Designated Storage Areas, to include guidance for temporary storage of temporary equipment inside the Seismic Category I buildings to prevent hazardous seismic interactions. The guidance will provide assurance that the safety function of components, equipment, and systems will not be affected by temporary storage ofloose items. This is one of the corrective actions for CR-94-1019. This task will be completed by April 1,1995. Until this procedure is approved, the Design Engineering Civil Department will be informed of any new items that will be stored near safety-related equipment so that they will ensure that a seismic interaction concern is not created.

7.2 INTERNAL FIRES The core damage probability results from Section 4.6 were reviewed for any core damage vulnerabilities. Based on the following points, there are no fire vulnerabilities at Waterford 3.

1)

No individual fire scenario has a core damage frequency greater than 2.0x10-6 (i.e,

less than lx10-4L 2)

No individual fire scenario contributes more than 31% of the total core damage frequency due to fires.

3)

No unusual and significant failures were found.

The total estimated core damage frequency due to fire of 7.0E-6 per year is over an order of magnitude lower than the NRC staffs core damage frequency objective of IE-4 per year. This core damage frequency is less than half of the IPE core damage frequency for internal events, further indicating that Waterford 3 does not have an unusual core damage risk due to fire.

Page 7-2

The internal fire portion of the IPEEE identified a potential plant improvement that would reduce the likelihood of core damage due to a fire. In the essential chiller room (RAB-2), a fire on Chiller A or Chilled Water Pump A could damage cables associated with Chiller train B.

Although the design meets the requirements of Appendix R, due to the availability of the AB train during this scenario, the robustness of the plant to fire hazards in this fire area could be improved by adding fire wrap to the B Chilled Water cables in the vicinity of the A Chiller. This potential improvement will be evaluated as part of the overall severe accident management program.

7.3 HIGH WINDS, FLOODS, AND TRANSPORTATION AND NEARBY FACILITY ACCIDENTS The IPEEE found no high winds, floods, or off-site industrial facility accidents that significantly alter the.Waterford 3 estimate of either the core damage frequency, or the distribution of containment release categories. Waterford 3 concludes that the plant is in conformance with the 1975 SRP that pertains to high winds, on-site storage of hazardous materials, and off-site developments. No changes to the plant are required.

REFERENCES 7-1.

NUMARC 91-04, " Severe Accident Issue Closure Guidelines", January 1992 l

l Page 7-3

8.

SUMMARY

AND CONCLUSIONS (INCLUDING PROPOSED RESOLUTION OF USIS AND GIS) 8.1 SEISMIC EVENTS Waterford 3 developed and implemented a project to satisfy requirements of the IPEEE seismic evaluation. The project implemented a Generic Letter 88-20, Supplement 4 allowed reduced scope seismic margins analysis (SMA per EPRI 6041). This project consisted of developing a Project Plan and a Walkdown Plan in that it concentrated on potential seismic vulnerabilities for equipment, large tanks, distribution systems, and structures. The implementation was appropriate and cost effective for addressing IPEEE seismic concerns at our " reduced scope" site. The basic requirement for walkdowns is that the equipment, tanks, distribution systems, and structures can all withstand the design basis SSE at the plant and still provide their safe shutdown functions.

The SMA uses primarily EPRI report NP-6041-SL as guidance which is not overly prescriptive but relies on thejudgment of an experienced team to meet the basic requirement.

A Safe Shutdown Equipment List (SSEL), using safety and non-safety-related components, was selected for achieving and maintaining plant shutdown in accordance with plant operating procedures. The SSEL also included items that are potential seismic-induced fire and seismic-induced flood sources within the plant.

There were three walkdowns performed; the Train "B" on-line walkdown during November of 1993, the Train "A" on-line walkdown during 1994 and the outage walkdown during March 1994. Documentation for the walkdowns was gathered and was available during the walkdowns.

Equipment specific documentation was placed in individual file folders for a sample of equipn'ent on the SSEL. Generic documentation (floor response spectra, etc.) was available for review during the walkdowns.

Seismic Verification Data Sheets that included each equipment item of the equipment list were developed. These sheets contain walkdown observations as well as screening results.

The walkdowns resulted in no outliers that are operability issues at the plant. However, there were some unresolved issues at the completion of the walkdowns, which will be resolved per discussion in Section 7.1.

Page 8-1

8.2 INTERNAL FIRES The Waterford 3 plant was divided into 45 fire areas and 51 fire compartments. The FIVE methodology uses a conservative screening approach in which all equipment associated with cables in an area are initially assumed failed by a fire. Any areas with low core damage frequencies, even with the conservative assumptions in FIVE, are not risk-significant and are " screened." After completion of the screening process, there were 10 unscreened fire compartments: RAB 1 A, RAB IE, RAB 2, RAB 6, RAB 7, RAB 8, RAB 15, RAB 31, RAB 39, and the Turbine Generator Building (TGB).

These areas were evaluated further using the fire modeling capabilities of the FIVE methodology to determine which essential cables could actually be failed by fires in the areas. The FIVE fire initiating event frequencies and modeling results were used with the Waterford-3 Probabilistic Risk Assessment (PRA) model to estimate the Core Darrage Frequencies (CDFs) due to fires.

The total CDF due to fire was estimated to be 7.0E-6 per year. The contribution ofindividual fire areas to the total CDF is shown in Figure 1-1. The most important fire areas are the control room (RAB-1 A), the essential chillers room (RAB-2), and the reactor auxiliary building (RAB) switchgear room (RAB-8).

i No core damage vulnerabilities to fire events were found. The TGB switchgear fire on.fune 10, 1995, was evaluated and found not to pose a significant core damage risk.

8.3 IllGli WINDS, FLOODS, AND TRANSPORTATION AND NEARBY FACILITY ACCIDENTS j

The IPEEE found no high winds, floods, or off-site industrial facility accidents that significantly alters the Waterford 3 estimate of either the core damage frequency, or the distribution of containment release categories. Waterford 3 concludes that the plant is in conformance with the 1975 SRP that pertains to high winds, on-site storage of hazardous materials, and off-site developments.

8.3 PROPOSED RESOLUTION OF USIS AND GIS 8.3.1 USI A-45 (Decay Heat Removal)

The stated purpose of Unresolved Safety Issue (USI) A-45 (NUREG-1289, see Reference 8-1)is to "evahtate the adequacy ofcurrent designs to ensure that LWRs do notpose unacceptable risk as a restdt ofDHR [ decay heat removal) systemfailures. The primary objectives of the USI A-Page 8-2

i 45 program are to evahaate the safety adequacy ofDHR ystems in existing LWRpowerplants and to assess the value andimpact (or benefit-cost) of alternative measuresfor improving the overall reliability of the DHRfunction."

The probability of the Waterford 3 plant losing the DHR function as defmed in the A-45 program (NUREG-1289) is 7.0E-6 per year for fire-induced transients, including support system failures, such as component cooling water and emergency AC power failures. The evaluation included fire-induced small LOCAs. This is below the Category 1 probability in NUREG-1289 for plants with acceptably low DHR failure frequencies (<3E-5). Therefore, Waterford 3 has no unusual decay heat removal vulnerabilities and has a DHR failure probability that meets the A-45 definition of acceptable performance.

Since the seismic events evaluation showed that there are no seismic vulnerabilities, we conclude that there are no significant or unique seismic vulnerabilities in the decay heat removal function.

The high winds, floods, and nearby facility accidents evaluation determined that these external events pose no significant risk of core damage (see Section 8.2).

Therefore, USI A-45 should be considered resolved for Waterford-3 with respect to internal fires, seismic events, and high wind, flood, and nearby facility accident events.

8.3.2 GI-131 (Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants)

This issue is not applicable, since Waterford-3 is a Combustion Engineering plant.

8.3.3 USI A-46 (Verification of Seismic Adequacy of Equipment in Operating Plants)

Waterford-3 is not a USI A-46 plant. The issue of spatial interaction, however, has been addressed as part of the reduced scope seismic margins method.

The Waterford 3 IPEEE has not been used to evaluate any other USIs or GIs.

REFERENCES 8-1.

NUREG-1289, " Regulatory and Backfit Analysis: Unresolved Safety Issue A-45, Shutdown Decay Heat Removal Requirements."

Page 8-3 t