ML20117K844

Submits Response to RAI Re Pilgrim Ipeee,Submitted to NRC Response to GL 88-20,Suppl 4

ML20117K844
Person / Time
Site:	Pilgrim
Issue date:	09/05/1996
From:	Boulette E BOSTON EDISON CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML20117K845	List: ML20117K844 ML20117K851 ML20117K860 ML20117K895 ML20117K905
References
BECO-2.96-081, BECO-2.96-81, GL-88-20, TAC-M83660, NUDOCS 9609120187
Download: ML20117K844 (31)

Text

- - _ - _- --_ . - _ _ _ _ _ _ _ _ -

G Boston Edison Pilgrim Nuclear Power Station Rocky Hill Road j Plymouth, Massachusetts 02360 E. T. Boulette, PhD Senior Vice President-Nuclear September 5, 1996 BECo Ltr. #2.96- 081 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 Docket No. 50-293 License No. DPR-35 Response to Request for Additional Information Regarding the Pilcrim Individual Plant Examination of External Events (IPEEEK (TAC NO. M83660)

Enclosed is Pilgrim Station's response to the NRC request for additional information related  ;

o the external event analysis submitted by us in response to Generic Letter 88-20, Supplement 4.

l This letter confirms the following actions as commitments which were assumed in the IPEEE analysis. Further details and schedules are included in the enclosed responses.

! e Eliminate the A ismic interaction hazard associated with the main transformer main l bushing and adjacent lightning arrestor.

l

• Stiffen the longitudinal direction of the muffler support for the blackout diesel g~enerator.

1

• Add friction clip restraints to the Bus A8 concrete foundation slab.

! Ifyou have any questions, please contact Mr. Jeffrey Keene, Regulatory Affairs Department Manager, at (508)830-7876.

E. T. Boulette, PhD 9609120187 960905 PDR ADOCK 05000293 Ab l 'i P

PDR

l 1

l DCC Desk l

Page 2 i

ETBUDK\pkk\radmisc\ipeeeltr

Enclosures:

Response to Request for Additional Information Attachment A: S&A Calculation No. 91C2672-C007, Rev.1 Attachment B: S&A Calculation No. 91C2672-C018, Rev. 0 ]

Attachment C: GEI Consultants, Inc. Report: Pilgrim 1 IPEEE l

Attachment D

SAIC Report: Tornado Hazard to Class 1 Electrical Conduits at l

PNPS cc: Mr. Alan B. Wang, Project Manager j Project Directorate 1-1 '

Office of Nuclear Reactor Regulation Mail Stop: 14B2 U.S. Nuclear Regulatory Commission 1 White Flint North 11555 Rockville Pike Rockville,MD 20852 l

l U.S. Nuclear Regulatory Conumssion Region I 475 Allendale Road King of Pnissia, PA 19406 l Senior Resident Inspector l Pilgrim Nuclear Power Station  !

(

I e

1

l RESPONSE TO REOUEST FOR ADDITIONAL INFORMATION l

PILGRIM NUCLEAR POWER STATION 1

A.2 Seismic '

1. The submittal states in Section 3.1.6.2 that thefraction ofearly release associated with the surrogate element is defined to be in the same proportion as that ofearly l release associated with core damage sequences, namely 30.2%. The surrogate element was estimated to be responsiblefor 2.81% of the core damagefrequency of 5.82E-05peryear, or approximately 1.64E-05peryear. Multiplying this value by 0.302 yields a large releasefrequency contributionfrom the surrogate of 5.0E-06per

year. The early releasefrequency contribution of the surrogate element is identified l in Section 3.1.6.4 as contributing afrequency of 7.61E-07 to early release. This is a contribution of 4.6%, not 30.2%. Please explain how the conditionalprobability of early release was calendatedfor the surrogate element. If theprocess didnot involve a mechanistic assessment of thefailure modeled in the surrogate element, explain in detail why the selected methodprovides a reasonable estimate cfearly releasefrom the surrogate elementfailure mode.

Answer:

l The modeling of the surrogate element in the Seismic PRA (SPRA) is intended to capture l those plant systems, structures, and equipment not explicitly modeled in the SPRA fault tree l and event trees. The surrogate element was established to represent the effects of seismic failure of all plant components with a median capacity in excess of 1.0g.

l As explained in Section 3.1.5 of the IPEEE report, the SPRA model was quantified by Jack Benjamin and Associates (JBA), using their Seismic Hazard Integration Program (SHIP). The quantification procedure is outlined in detail in Section 3.1.5.0 of the IPEEE report.

i When calculating the Level I results, JB A quantified it in two different ways. During the first round, the actual core damage frequency was determined by quantifying two sequences: the surrogate element, and a sequence in which all of the core damage cutsets were combined and i duplicate cutset elements were subsumed. Subsuming ensured duplication was removed from the cutsets so the results accurately reflected the failure of the modeled plant components.

This resulted in the CDF number of 5.82E-5/yr. reported in Section 3.1.5.2 of the IPEEE j repe:t. The CDF from the surrogate element was 2.79E-06/yr., and the CDF from all other sequences was 5.54E-05/yr.

During the second round, JBA used the SHIP program to quantify each sequence individually, including the surrogate element, in order to gain an insight into the approximate contribution

of each of the sequences to risk. The results of this quantification were not intended to be 1

l l

l ,

I l

I i

1 l

used to calculate the individual contribution of each sequence. The results of this calculation were intended to show approximate, relative magnitudes of the contributions of each sequence a

to the total CDF. I i

When the sequences were quantified individually, adding the sequences together gives a total CDF greater than in the first, more accurate quantification. This is because the sequences were not mutually exclusive with many of the same failures appearing in more than one sequence. The total CDF determined by this method was nearly double that determined by the accurate method, because of the "non-exclusive" events in the sequences. However, this quantification resulted in a comparison of the relative magnitudes of each sequence to the total CDF and is useful as a relative comparison of the individual sequences to the total CDF.

This is the reason why the surrogate element is shown as contributing 2.81% to the total CDF which would result in a value of 1.64E-06/yr. The true value of the surrogate element is 2.79E-06/yr. which is actually 4.8% of the total core damage frequency.

The Level 2 assessment of the contribution of the surrogate element to Early Release Frequency (ERF) was also performed by JBA using SHIP. This quantification was conducted in a three step process, because, as in the Level 1 quantification, the sequences in the Level 2 event tree are not all mutually exclusive. As in the Level 1 quantification, the Level 2 quantification yields an accurate number for the total ERF and approximate values for the 1

percentage of contribution from each sequence in the analysis. l l

The frequency for ERF for the surrogate element did not involve a mechanistic assessment of the failure modes modeled in the surrogate element. It was based on the assumption that the ratio of the ERF to the CDF for the surrogate element would be in the same proportion as the ratio of the ERF to the CDF for the non-surrogate sequences. This is reasonable because, as was elaborated in Section 3.1.4.1 of the report, the surrogate element was established to represent the effect of seismic failure of all plant components with a median capacity in excess

, of 1.0g. Since the seismic capacity of containment structures and equipment not explicitly modeled are quite high (far in excess of 1.0g), it was judged that assuming the same ratio of corc damage to containment failure frequencies was conservative.

The last assumption made in the Level 2 analysis concerns the percentage of core damage from the surrogate element that leads to early containment release. As discussed above, the CDF from the surrogate element was 2.79E-06/yr. The tota! SPRA CDF was 5.82E-05/yr.

The CDF from the non-surrogate sequences was 5.82E-05/yr. - 2.79E-06/yr.=5.54E-05/yr. i The total ERF from all Level 2 sequences was 1.79E-05/yr. The non-surrogate contribution was found by subtracting the surrogate element's contribution from the total. Doing this results in a value of 1.51E-05/yr. for the ERF of non-surrogate sequences. The ratio of the ERF to CDF for the non-surrogate sequences was 1.51E-05/5.54E-05. This resulted in a 1 ratio of 27.3% of all non-surrogate sequences leading to early release. This ratio was 4 incorrectly listed in the text on page 3-112 in the first paragraph of Section 3.1.6.2 as 30.2%

due to a clerical error during report assembly. It was accurately reflected in Figure 3-23 on l

l l

2 1

l 4

page 3-119a. This ratio was applied to the surrogate element CDF to result in a ERF of 0.27

• 1.79E-05/yr.=7.61E-07/yr. for surrogate element sequences.

The value of 27.3% on Figure 3-23 was not intended to imply that 27.3% of all core damage events lead to early release. It was intended to be used in conjunction with note I to show that 27.3% of all surrogate element core damage events lead to early containment failure.

1 3

i

2. Please provide the basisfor whyyoufound the core damagefrequency ofS.82x10' per reactor-year and early releasefrequency of 1.59x10'per reactor-year acceptable to resolve USI A-45.

Answer:

In resolving USI A-45, the guidance provided m NUREG-1407 ProceduralandSubmittal Guidancefor the IndividualPlant Examination ofExternal Events (IPEEE)for Severe Accident Vulnerabilities was used as the template for resolution of this issue. NUREG-1407 Section 6.3.3.1 states: "The systems and components for addressing USI A-45 will have been determined by the internal events IPE, and the purpose of the seismic IPEEE is to identify any significant and unique seismic vulnerabilities in the decay heat removal function." Generic Letter 88-20, Supplement 4, IndividualPlant Examination ofEtternalEvents (IPEEE)for Severe Accident Vulnerabilities, states: "A part of the USI A-45 activities consists of assessing the adequacy of the decay heat removal system (DHR) to deal with external events initiators."

The SPRA report, in Section 3.2.1, addresses the impact of the seismic initiator on the availability of systems for removal of decay heat from the containment. The report acknowledges that the unavailability of offsite power and instrument nitrogen severely restricts the number of systems available to remove decay heat from the containment.

However, Section 3.2.1 also indicates sufficient time is available for repair and recovery of the decay heat removal function before containment failure.

We interpret the phrase "any significant and unique seismic vulnerabilitim in the decay heat removal function" to mean a failure of plant components that would lead to an unacceptably high value for core damage or containment release frequency. This was not the case and is '

shown via the SPRA results in Sections 3.1.5 and 3.1.6 of the report. This is consistent with the definition for vulnerabilities given in the IPE report, in which we stated the criteria used to l determine if any vulnerabilities exist are:

a) Are there any new or unusual means by which core damage or containment failure occur as compared to those identified in other PRA's? ,

b) Do the results suggest that the Pilgrim core damage frequency would not be able to meet the NRC's safety goal for core damage?"

Neither of these situations was met in the seismic PRA. Therefore, USI A-45 is considered resolved.

4

, 1 1 i I

I

3. What are the controlling seismicfailure modes (including equipment / structure interactions)for the safety-relateddieselgenerators? Pleaseprovide thefragility calctdationsfor the controllingfailure modes.

Answer:

Appendix 3 A of the SPRA report DetailedModeling ofSeismic Failure Events provides a detailed description for each eierie:a ;., the SPRA model for the safety related emergency diesel generators (EDGs). When the basic events in the SPRA model are compared to the basic events in Table 3-11, it is evident that all failure modes have fragilities above tH screening value for the surrogate element, except for the basic event EBDDGBL~ , EDG Building Fails. This basic event, then, is the controlling seismic failure mode for t. )Gs.

, The fragility calculation for the EDG building, S&A Calculation 91C2672-C007, Revision 1, l is provided as Attachment A.

1 I

5 1

! 4. For the station blackout (SBO) diesel, what are the power demandsfor use of this l component? How is the SBO dieselloaded on the buses toprovide power? Please 1 explain how the SBO dieselis brought into operation, identifying the operator actions needed and their coverage in emergency operation procedures (EOPs).

L Answer:

1 The SBO diesel is designed to supply one of the safety related buses, either A5 or A6, through bus A8 when either one or both emergency diesel generators fail in conjunction with the startup and l

shutdown transformers. Tne SBO diesel is rated at 2000 kW continuously and 2200 kW for two l hours. This is sufficient to supply one ECCS pump and ib msociated support systems. The SBO l dieselis loaded at 1700 kW continuously when supplying power to A5 or A6 and one EDG is l supplying power to the other bus. This is to prevent an overload condition if the EDG were to fail and 480V bus B6 is transferred to the SBO diesel.

The operation of the SBO diesel is directed by PNPS Operations Procedure 2.2.146, Station Blackout Diesel Generator. This procedure provides detailed guidance for starting the SBO diesel and loading either A5 or A6 buses onto it. The procedure allows for operation from either the control room or locally from the SBO diesel control panel and bus A8. The operator is directed by this procedure to open all of the circuit breakers supplying power from the shutdown transformer to bus A8. The operator then starts the blackout diesel and, after waiting 30 seconds, closes the

! output breaker for the SBO diesel and energizes bus A8. Depending upon which bus he chooses, the operator takes all of the control switches for the ECCS pumps on that bus to " pull-to-lock".

The operator then closes the breaker between bus A8 and the bus he has chosen to load, while simultaneously depressing the load shedding manual initiation push-button which strips the non-vital loads from the bus. The SBO diesel is now ready to accept load. The procedure prevents the operator from starting more than one ECCS pump and gives the operator clear guidance on how much load he can place on the SBO diesel. The operators will use this procedure to supply the l power necessary to operate the systems the EOPs direct them to use.

i l In the seismic PRA (SPRA) model, this procedure including the operator actions outlined above, l was captured in the basic event EDLGESBOXY " Operator fails to complete SBO DG start l procedure" The details of the Human Reliability Analysis (HRA) are contained in Section l 3.1.3.2.5 (page 3-56) of the IPEEE report.

l l

i 1

i 6

i l

l l

l S. Regarding the SBO diesel, please provide the walk-down notes and results, and the fragility calctdationsfor the SBO diesel and its support systems (i.e., fuel supply, batteries, etc.). Further, describe the basisfor the identipedfailure to start and l failure to run valuesfor the SBO diesellistedin Table 3-4, addressing the available

plant-specific andgeneric datafor the SBO diesel. Finally, please identify the frequency of testing, surveillance, and maintenancefor the SBO diesel.

Answer:

l l The walkdown notes and results, and fragility calculations for the SBO diesel, S&A Calculation 91C2672-C018, Revision 0, are provided as Attachment B.

l The PNPS IPE used plant specific operational data collected through September 30,1989, as the primary source for its calculation of equipment failure rates. The SBO diesel procedure 8.9.16," Manually Start and Load Blackout Diesel" did not go into effect until February, 1990; thus, there was no operational data available on the SBO diesel during the data collection period of the iPE. However, extensive operational data was available on both emergency diesel generators (EDGs) from which failure to start and run failure rates had been l calculated. Since the SBO diesel and both EDGs are ALCO diesels with similar design and maintenance requirements, the EDG failure rate parameters were used to represent the i

expected long term performance of the SBO diesel.

l The operational history of the EDGs and the derivation of their failure rates are fully  ;

l documented in Appendix A of the PNPS IPE submittal, September 1992. These failure rates and failure probabilities are summarized below:

Failure Total Independent Failure MGL* MGL*

Rate Failure Failure rate Probability Beta Gamma Parameter Rate (24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Factor Factor Mission)

EDG Failure 4.86E-3/d 4.8E-3/d 4.8E-3 4.9E-5/d 7E-6/d to Start EDG Failure 3.5E-4/hr 3.3E-4/hr 7.92E-3 1.lE-5/hr 5.5E-7/hr to Run

• Multiple Greek Letter Common Cause Factors Note that the SBO diesel failure probabilities appearing in Table 3-4 are the same as the EDG values shown above.

l j

i I

7

SBO Diesel Surveillances PNPS Procedure Title Interval 8.9.16.1 Manually Start and Load Quarterly Blackout Diesel via the Shutdown Transformer 2.1.12.2 Station Blackout Diesel Daily Generator Daily Surveillance 3.M.3-61.6 Blackout Diesel Generator Every 2 years l General and Preventive l Maintenance Attachment 5:

l Blackout DG Stator Winding, Field Winding and Cable Insulation Tests l SBO Diesel Maintenance l PNPS Procedure Title Interval

! 7.1.87 Fuel oil sampling Quarterly i

_8.E.60 Instrument Calibration Every 18 mos.-2 yrs.

3.M.3-61.6 Blackout Diesel Generator Every 6 yrs.

General and Preventive Maintenance Mass. State Regulations Fuel tank testing Annually l EPRI NP-6314S Fuel tank cleaning Every 10 yrs. l l " Storage and Handling of Fuel Oil for Standby Diesel i Generators"  ;

l l

l 1

I

. l l

t l

l 8

I j 6. Please indicate whether BECo is committing, in the seismic IPEEE submittal, to make the upgrades to the SBO diesel which were assumedin the analysis. Ifnot, provide a discussion of thefragility of the SBO diesel without the upgrades and estimate the impact on CDF, seismically initiatedaccident sequencefrequencies, and early release scenariofrequencies resultingform the use of the unmodifiedSBO dieselin the analysis. Ifso, please discuss the scope of the committed enhancements l and the schedulefor their implementation.

Answer:

1 l BECo has committed to implement the upgrades to the SBO diesel and Bus A8 which were l assumed in the IPEEE analysis. These enhancements are identified and discussed below l l Enhancement Description Design Status Implementation Schedule l Stiffening modification to the Complete: FRN 94-01-51 Anticipated complete by I I

longitudinal direction of the 10/96 mutiler support for the SBO D/G I

Friction clip restraints for Bus Complete: FRN 94-01-51 Anticipated complete by A8 to its concrete foundation 10/96 slab Seismic interaction hazard Conceptual design being Schedule being developed due to the potential failure of finalized and will be based on risk the Main Transformer main significance for on-line vs.

bushing and/or adjacent off-line work. Anticipated l

lightning arrestor. complete by RFO #12 l

4 9

t l

i

1.

l i

7. Table 3-11 of the JPEEE submittal lists detailed Pilgrim Seismin Probability Risk Assessment (SPRA) fragilities. This table includes medianfragilities (Am)for seismically induced core spraypipe rupture andseismically induced RHR piping rupture of 0.00. Similarly, Table 3-12provides relayfragilities. This table includes three 0.00 medianfragilities (Relays 1810F0801A,181UF-801A, andAllSBO Relays). Please identify whether these 0.00 medianfragilities are meant as " place-keeper" values to guaranteefailure in an earthquake. Ifnot, please provide the correct value or explain why the value of 0.00g is correct and describe the basisfor the value and explain the impact of this low medianfragility on the performance of the plantfollowing sei.unic events (including the contribution ofeach of thesefailure events to core damagefrequency).

Answer:

Table 3-11, " Detailed SPRA Fragilities", documents the results of detailed fragility l

l calculations for the items in the table. The five items with a fragility value of 0.00 were items which were screened out of the model by the screening methodology described in Section j

3.14.1. They were tagged with a 0.00 fragility value and were to be removed from Table 3-11, but were inadvertently left in. These components were removed from the SPRA model j prior to final quantification.

j 1

l 2

I i

3 10 l

8. For the seismicfaults identifiedin Table 3-15 (page 3-104) of the IPEEE submittal, please provide the contributions of the events to core damagefrequency or the importance of the events in order that the sigmficance of the events may be identifed.

Answer:

The quantification of the seismic PRA model was a two step process involving the quantification of the seismic PRA model to produce cutsets and a quantification of this population of cutsets using the SHIP program (see the response to question A.2 number 1, paragraphs 2 and 3). Unlike the CAFTA software, the SHIP program does not contain algorithms to produce importance measures for each basic event in the cutset used for quantification.

Section 3.1.5.2, " Seismic PRA Detailed Results", of the report, in the section called

" Dominant Events" (page 3-98) presented the results of a series of sensitivity studies performed by JB A after the base case quantification. The first study determined the sensitivity of the results to random failures and operator actions by removing these failures from the quantification. In this case, the plant CDF was 3.13E-05/yr. Therefore, seismic failures accounted for approximately 54% of the total CDF.

The second sensitivity study looked at the contribution to the single element cutsets to the CDF. The report explained that 41% of total CDF comes from these single element cutsets, but the repsrt did not show explicitly which basic events were single element cutsets. A table containing a list of these single element cutsets follows:

NAME DESCRIPTION EBSB1415XZ Seismic Failure of B14 BIS (Correlated Failure)

EBSB1718XZ Seismic Failure of B17 B18 (Correlated Failure)

EBSY34XXXZ Seismic Failure of BUS Y3 Y4 (Correlated Failure)

EBW45/3XXZ Block Wall 45.3 Fails ECONTLRODZ Control Rod Failure EDP2233ABZ Seismic Failure of Panels C2233 A & C2233B (Correlated Failure)

EDPC93023Z Seismic Failure of Panels C930, C932 & C933 (Correlated Failure)

EDWSHIELDZ Drywell Shielding Concrete Failure EPM 202A-FZ RBCCW Pumps 202A-F Seismic (Correlated Failure)

EPM 203A-DZ Seismic Failure of the RHR Pumps 203A-D (Correlated Failure)

EPM 208A-EZ Seismic Failure of the SSW Pumps A-E (Correlated Failure)

ERWCONCWLZ Radwaste Building Concrete Wall Failure ERXBLDFOUZ Reactor Building Foundation Failure ESPCOOLXXY Operator Fails To Initiate SPC When Required ETKT201ABZ RBCCW Surge Tank T201 A and T201B (Correlated Failure)

EUPLOFLORZ Upper and Lower Drywell Floor Framing 11

The third sensitivity study dealt with the contribution of the single element cutsets and those cutsets containing the events ETK105ABNZ, " Condensate Storage Tank 105 A/B Fails Due To N2 Tank Interaction", EDLGESBOXY " Operator Fails To Complete SBO DG Procedure", and ERERESETlY " Operator Falis To Reset SBO Related Relay" The single element cutsets, plus the cutsets containing these three basic events, account for 88% of the total CDF. The second and third sensitivity study, taken together, show that cutsets containing these three events account for 47% of total CDF.

Additional sensitivity studies, in order to determine the importance of each individual l contributor, were not performed.

f f

l l

1 1

N 12 l

f l

1 1

! 9. A seismicfragility estimate is not provided explicitly in Table 3-11for the nitrogen tank which provides Automatic Depressuri:ation System (ADS) operability in the long

term. Identify the seismicfragility of the nitrogen tank system (i.e. is this the same as

l. event Condensate Storage Tanks 105 A&B ?). In addition, the submittal does not rely j on the ADS, apparently due to the low capacity of the nitrogen tanks system. Please discuss the amount of time ADS would be available without the nitrogen system, and indicate whether this time period is su.[ficient to achieve stable shutdown before the ,

nitrogen system would be required and whether this stable shutdown mode is covered i l byplantprocedures andcan be maintained without the nitrogen system. Ifso, l discuss the impact ofsuch a stable shutdown strategy on the SPRA results.  ;

i i

! Answer:

The seismic fragility of the nitrogen storage tank is the same as the entry in Table 3-11 entitled: " CST 105 A&B: CST T105 A/B Failure Due to N2 Tank Interaction". The fragility for the nitrogen storage tank is 0.16G, with a pr of 0.46G and a pu of 0.00. Because of the i Iow fragility of the nitrogen tank, ADS was not included in the seismic PRA model. Not including ADS in the model was conservative, because it was not credited in sequences where depressurization would prevent core damage. Stable shutdown in the SPRA was assumed to include RPV level control with HPCI or RCIC, RPV pressure control by the SRVs in the relief mode, and decay heat removal via torus cooling. Because the SPRA results were )

. acceptable, the omission of ADS and shutdown cooling was an acceptable assumption.  !

l The nitrogen supply for the SRV accumulators is sized for 20 actuations of the valves with a

nominal 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> mission time. This time would be sufficient for the plant to maneuver to cold l shutdown and enter the shutdown cooling mode. Entry into shutdown cooling is covered by i

EOP 1 and PNPS Procedure 2.2.19, " Residual Heat Removal." Once the plant is in the shutdown cooling mode, pressure control by the SRVs is no longer required.

Since many of the components associated with shutdown cooling are the same as those required for the suppression pool cooling mode of RHR, it was conservatively assumed during the

! development of the Pilgrim IPE model that shutdown cooling system quantification was l encompassed in the quantification ofRHR. For these reasons, the SPRA analysts determined that adding shutdown cooling would result in a negligible improvement in the results of the SPRA.

l l

l 1

l 1

l 13 y .%.- -

m -,._s w..,-, - -- 4,-

l

10. The IPEEE submittal discusses a possible interaction between seismically initiated failure ofa liquid nitrogen tank and the dieselgenerators. Please discuss how this interaction was evaluatedin the SPRA. Ifit was not included, discuss the impacts of this interaction on the results of the seismic IPEEE.

l Answer:  !

l The interaction between a seismically initiated failure of the liquid nitrogen tank (T212) and I the EDGs is discussed in various sections of the Pilgrim Station IPEEE submittal. In particular, Section 5.3.3 discusses the potential choking off of the air supply to the EDG but was based upon results from a non state-of-the-art analytic tool that lead to an erroneous conclusion. The following discussion responds to your question and provides clarification to -

Section 5.3.3.

Investigations of the nitrogen tank failure were carried out under the USI A-46 (GL 87-02)

Program. As noted in the text of the IPEEE report, segments of the USI A-46 and IPEEE seismic programs were worked in parallel and insights from one were passed to the other. A closure task for the Pilgrim Station USI A-46 program was to more completely assess the impact of the potential failure of the nitrogen tank due to a seismic initiator.

T212 is a Class II, non-safety related component that is adjacent to Class I safety-related structures, components, and Safety Enhancement Program modifications implemented in the 1986-1989 time frame. The concern is stmetures and components could be rendered inoperable as a result of a Class II over Class I interaction. The initiating events could be earthquakes or high winds that could lead to pressure boundary failure and/or instability impact damage. The following table provides an engineering e.aluation and assessment of the consequences that identifies all structures and components that could be impacted by an adverse Class II over Class I interaction.

The table demonstrates full operability and that all concerns and effects assessed are within the bounds of failures from previously analyzed events and also serves as a basis for the clarification needed for Section 5.3.3 (that is, the failure of the nitrogen tank and subsequent vaporization and transport of the nitrogen cloud will not choke off the EDG).

14

l i  ;

I System Operability Component Function Reference Concern Basis i

Reactor Protects safety FSAR 5.3 T212 falling, striking The Reactor Building is operable. The damage potential to the l Building related the Reactor Building, Reactor Building from the N 2tank is bounded by the criteria l components & breaching secondag used for tornado generated missiles. The Reactor Building's l provides containment. capability to protect safety related components is not affected,

secondary based on a comparison of the impact loading allowed in FSAR

! containment App. H design criteria to the impact loading generated by tank I

boundag T212 falling on the reactor building. The impact loading of tank

. T212 falling on the Reactor Building is much less than the impact loading assumed in the tornado generated missile i analysis.

EDG Protects EDGs FSAR 12.2.1.2, T212 falling, striking, The EDG building & EDGs are operable. The damage potential Building 12.2.3.2 damaging EDG Bldg., to the EDG building from the N2 tank is bounded by the criteria leading to loss of used for tornado generated missiles. The EDG building's EDG's. capability to protect the EDGs is not affected, based on a

comparison of the impact loading allowed in FSAR App. H j design criteria to the impact loading generated by tank T212 falling on the EDG building. The impact loading of tank T212 falling on the EDG building is much less than the impact loading assumed in the tornado generated missile analysis.

l

EDG Combustion Air IPEEE Tank o_r piping failure The EDG's are operable. Yankee Atomic Electrical Company Air Intake to support EDG pp. 5-17 & would release a performed calculation BEC 40. This calculation records that providing onsite Sect. III, YAEC nitrogen cloud that, in diesel generators typically have a lower limit of 16.5% O2for electrical power Calc. conjunction with diesel generatoi operability at rated load. Reg. Guide 1.78 BEC-40 particular specifies w orst case stability class (F) for consideration in (IPEEE), meteorological habitability. Review of the PNPS FSAR Section 2.4 and Reg. Guide conditions, could lower Appendix E shows that PNPS is subject to Class F 1.78, 02 concentration below meteorological conditions >5% time, so this stability class must FSAR 2.4, combustion limits by be used. Large and close proximity of CST structures and valve App E trapping the nitrogen pit impose urban terrain conditions in the area of tank T212 and close to the ground and the EDGs. This combination of meteorology and air flow I5

System Operability Component Function Reference Concern Basis i keeping mixing of the conditions can be described as a microclimate, and this I nitrogen and the microclimate was evaluated out to 75 feet from tank T212. i surrounding air to a YAEC analysis has determined that the O2 concentration at the  !

minimum . intake of the diesel generators will remain 218.3% under the  ;

most limiting meteorological conditions described in this microclimate. Therefore, the EDGs will start and run at rated I

load. t Condensate Condensate FSAR 11.9, T212 could CST Operability. CST tanks by design are Det safety related.

j Storage Tanks Storage System FSAR 6.3, impact / breach tanks Loss of CSTs is within existing analysis found in FSAR section I l (CSTs) has power IPEEE with loss ofinventory. 14.5.6.2. The CSTs are credited in Tech Specs as a source of j generation basis pp. 3-31, water for Core Spray for special condition of cold S/D & torus .

only. PNPS 2.2.35, u_navailable. This is a contingency condition, designed to allow Preferred supply T.S. 3.5.F the removal of CRD mechanisms with the torus drained. Should l for HPCI/RCIC (bases) the CSTs be lost, this contingency could not be used.

f The coolant quality of CST is better than the torus, but level  !

detection instrumentation recognizes when this source is not  !

available for whatever reason, usage or leakage, and  ;

automatically redirects suction of HPCI to the torus. RCIC must f i

be manually redirected. FSAR 7.4.3.2.5 and 4.7.6.  :

Containment Combustible PNPS 2.2.105, Tank T212 could cause The Containment Atmospheric Dilution function is operable. Its l Atmospheric Gas 1.3.34 Section the failure of the CAC purpose is to control H2buildup inside the primary containment Control Concentration 6.16b, 5.4.6, Purge / post LOCA. The FSAR, in Section 5.4, lists the primary sources Purge / Repress ControlInside 2.2.143, 2.2.70 Repressurization for the Purge /Repressurization system as a portable nitrogen urization Primary l Function. supply via a tmck with a vaporizer, or the existing non-seismic '

System Containment FSAR Section nitrogen storage tank with its vaporizer. General Design Criteria I 5.4 T212 could fail Class 1 41 requires redundancy and spatial isolation ofcomponents. [

connections to Trailer X-168 complies with the requirements of Criteria 41  !

10CFR50 containment outside of because it is rot within the area ofinfluence by T212. The i Appendix A; the Reactor Building. Containment Atmospheric Control penetrations are spatially 16

System Operability Component Function Reference Concern Basis General Design separated so that the failure of T212 would not challenge both Criteria 41,42, trains, and in accordance with part 50 criteria, the design 43 recognizes multiple, redundant and diverse piping that would YAEC Fax allow the pathway to be reconfigured within the 80 hears 4/4/96 assumed before Direct Torus Venting.

Nitrogen Tank / Diesel Primary containment is operable. The boundary would be Generator maintained by two (2) normally closed (key to open) isolation Calculation valves located inside the Reactor Building.

PDC 86-43 Containment Additional PNPS 1.3.34 T212 could cause The backup N2 System is Operable. The bottle system provides Instrument Supply of Section 6.16b failure ofbottle bank, backup to the normal T-212 source of drywell instrument Supply of nitrogen to FSAR Section and challenge external pneumatics. The trailer also provides backup to the bottle rack Drywell drywell 10.11 piping from trailer X- recognizing the time limited capability of the bottles.

Pneumatics pneumatics 168.

Components in the system are subject to special administrative controls which impose limits for restoration if the systems are made or found inoperable (i.e. seismic event). Multiple connections with spatial isolation by design would allow for system function.

T212 Maintains FSAR 5.4 N 2not available for Tank is not required to be operable. Tank per FSAR 5.4 is volume ofN2 @ purge. recognized not seismic and credited as backup only if available.

pressure and low PNPS 5.4.6, temperature for 2.2.143, 2.2.70 D/W inerting &

as backup to CAC Purge /

Repressurization 17

System Operability  ;

Basis I Component Function Reference Concern '

Personnel Personnel will be PNPS 2.4.16 Tank or piping failure No personnel safety concern. Similar to EDG,18.3% O2 does (habitability) in EDG Building would release N2 cloud not pose imminent threat to health & safety. A second exit from monitoring EDG Fundamentals of that in conjunction EDGs through the Radwaste truck lock would allow egress Industrial with particular without crossing visible cold temperature stream and plume.

Hygiene 3rd meteorological edition National conditions could lower We recognize that this 02 content level is below the OSHA Safety Council O2 concentration recommended limit of 19.5%. A restraining modification is below habitability therefore planned for the tank to preclude it's catastrophic .

limits. failure.

t t

t k

I i

t 4

18

l 1 l

, 1 1

11. Please provide a copy of Reference 3-16 (GE1 Consultants SSI studyfor Pilgrim).

' Answer:

1 1

See Attachment C, GEI Consultants, Inc. Report, Pilgrim 11PEEE, Plymouth, Massachusetts.

l 1

i l

l I

l l

i l

19

I A.3 Fire

1. The potential adverse ejfects on plant-related equipment due to combustion products have not been addressedin the JPEEE submittal, exceptfor the statement that "The concern relative to non-thermal combustion by-products is not addressed".

Typically, the non-thermal effects ofcombustion on safety-related equipment are j addressedduring thefire walk-down. Please provide an analysis of the effects of combustion products on safety-related equipment.

Answer:

The IPEEE Fire analysis utilized the Fire Induced Vulnerability Evaluation (FIVE) l methodology. It does not consider the potential detrimental short term or long term effects of combustion products on the ability of safe shutdown equipment to continue to function in smoke filled environments nor the evaluation of smoke transport throughout buildings.

Evaluating or quantifying nonthermal fire environmental effects is difficult. The reason for this is a lack of data on the vulnerability of plant equipment to adverse environments induced j by tire. Actual fire reports do not include this level of detail, and available fire damage experience data does not provide information on nonthermal aspects of a fire environment (e.g., smoke). Without such data, it is not possible to meaningfully quantify the impact of nonthermal combustion products on plant equipment operability. Until a more thorough l understandmg of the phenomena involved is available, this remains an unresolved issue in fire risk analysis. Based on today's level of knowledge, it is commonly accepted that the detrimental short-term effects of smoke on equipment are not believed to be significant. This is consistent with the position of the FIVE methodology for this concern.

' A review of the Heating Ventilation and Air-Conditioning (HVAC) systems suction and discharge flow paths was conducted during plant walkdowns. It was determined that sufficient separation exists among the HVAC systems to prevent smoke propagation between systems.

These systems would be used to exhaust smoke to the outside from the fire arcas provided the equipment and power were available. The Turbine, Reactor, Radwaste, and Emergency Diesel Generator Buildings and the intake structure utilize once through ventilation systems with exhaust flow to the outdoor environment. These systems are arranged with a negligible chance for the exhaust air being entrained into the supply air.

l The Control Room, Cable Spreading Room, and the plant computer room have a common system that uses recirculation. A smoke detector is located in the return air duct and is arranged to annunciate and close the recirculation damper, exhausting all of the flow outdoors. Backup lighting and Self Contained Breathing Air (SCBA) are provided to the fire l fighters and plant operators to allow access to the fire area and to safely shutdown the piant.

i 20 i

I

2. The only seismically-inducedpre sources addressedwere the release offlammable or i combustible liquids or gases. Weakly anchored electrical cabinets have beenfound to be important seismically-inducedpre risk contributors. Please provide either the justificationfor not considering electrical cabinets as a seismicfire source or the core damagefrequency analysis ofelectrical cabinet seismic / pre interactions.

Answer:

Seismically induced fire sources are a subset of the Sandia/NRC Fire Risk Scoping Study (FRSS) Issues. These issues are addressed in Section 4.12 of the IPEEE report in accordance with the guidance provided in the FIVE methodology. The guidance focused on seismic / fire interactions involving piping and/or vessels containing flammable liquids, not weakly anchored electrical cabinets. Consequently, electrical cabinets were not considered as a seismically induced fire source.

While not examined in detail during the FRSS walkdown, electrical cabinets were examined in the walkdowns supporting the USI A-46 analysis. Class lE electrical cabinets within the scope ofIPEEE fire study have been found to be seismically adequate per the USI A-46 effort.

i t

l l

l l

l l

l I

l l

i 1

21

l l

3. Fire protection systems at Pilgrim have been installedin accordance with NFPA l codes. Therefore, the submittal assumed that adequate assurance isprovided that l

fire protection systems will notfall on safe shutdown components during a seismic \

event. However, onlyfire piping standpipes are required by NFPA standards to be

[ seismically quahped Therefore, please provide the basisfor assuming that thefire l protection systems at Pilgrim (apartfrom the standpipes) will notfall on safe shutdown components during a seismic event.

Answer:

I The PNPS fire protection systems were designed and installed in accordance with NFPA codes. These codes do not impose seismic design criteria. However, Appendix A to BTP 9-5.1 required utilities to re-evaluate their fire protection systems for seismic qualification where these systems could impact safety related equipment.

PNPS analyzed every pressurized water fire suppression system in 1977 in response to l Appendix A. The only location identified as a result of the analysis was the interior fire water main over the MCC B-18. This fire water main was analyzed and resupported to assure it would not break or fall during the plant's design basis seismic event (i.e., this section of pipe meets the requirements for Class I Seismic Systems).

Subsequent to the Appendix A analysis, all new fire protection systems have been analyzed for their potential impact on safety related equipment. These systems have been seismically supported as necessary, l

i 1

l l

l I

s l

22

4. If the potentialfor cross-:onefire and smoke spread was not considered, please providejustyicationfor its exclusion. Please provide an analysis of the effect on fire-induced CDF if the potentialfor thefailure of active barrier components such as doors and dampersfor allfire areas, and the potentialfor cross-:onefire propagation is consideredfor high ha:ard areas such as the turbine building, diesel generator room, switchgear rooms and lube oil storage areas.

Answer:

The potential for cross zone fire spread was considered in assigning fire areas in the Pilgrim Station IPEEE Fire analysis. The fire areas defined do not necessarily agree with those defined for Pilgrim Station's Fire Hazards Analysis and for Pilgrim Station's Appendix R submittal. See Table 4-9 of the IPEEE report for details. Sub areas were defined for those portions of the plant where the requirement for 2 or 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire rated barriers could not be met. For some of these sub areas, fire propagation evaluations were necessary to support partitioning of the plant.

Cross zone smoke spread was considered not to be a concern. A review of the Heating Ventilation and Air-Conditioning (HVAC) systems suction and discharge flow paths was conducted during plant walkdowns. It was determined that there exists sufficient separation among the HVAC systems to prevent smol:e propagation i between systems. These systems would be used to exhaust smoke to the outside from the fire areas provided the equipment and power were available. Backup lighting and Self Contained Breathing Air (SCBA) are provided to the fire fighters and plant operators to allow acce,s to the fire area and to safely shutdown the plant.

The fire IPEEE utilized the FIVE methodology supplemented by a plant specific PRA analysis. FIVE takes credit for Appendix R and the fire rated barriers. The IPEEE fire analysis does not take credit for any barrier not already credited in the Appendix R  ;

program. Consideration of failure of active fire barrier components such as doors and '

dampers for all fire areas exceeds the approach defined in FIVE.

1 1

i l

l 23 l

1

5. Even thoughfourfire events have occurred in safety-related areas at Pilgrim, only industry-wide genericfrequencies were used. Please provide an analysis of the effect onfire-irutuced core damagefrequency if the generic data is updated utili:ing Pilgrimplant-specificfire data.  :

Answer:

PNPS utilized the accepted FIVE methodriogy in calculating fire ignition frequencies for each area. The calculated ignition frequencies are representative of the equipment in each area and the EPRI fire database experience for similar equipment in those areas.

The four fire events in safety-related areas over 20 years of PNPS operation do not have a measurable effect on the results of the analysis. The plant specific fire data for the areas in question are within acceptable bounds of the generic fire data.

Furthermore, all of the areas involved screen out of the analysis and one event l

occurred during plant shutdown and is outside the scope of the at power, IPEEE Fire Analysis.

l The four events reviewed are:

1

.D._ats Event Description I 8/22/73 Fire discovered in cast steel inlet casing of EDG B turbocharger during i surveillance run.

l 5/03/80 Fire in EDG A exciter cubicle after surveillance mn.

2/24/81 Fire near yarway racks at Reactor Building Elevation 51' due to contractor welding above the rack.

6/30/87 EDG A turbocharger exhaust insulation fire.

The emergency diesel generator fires would only affect their respective fire areas (areas 14 and 15). These areas screen out due to no plant initiating event being caused and because mitigative equipment would only be required if an unrelated coincident loss of offsite power event occurred. The last event listed occurred when the plant was offline and is outside the scope of the analysis.

The event near the Yarway racks was a small fire caused by welding sparks falling on temporarily installed foam rubber. The resulting fire burned for 2 minutes and was j extinguished by the posted fire watch. This event iepresents a transient source of fire and was caused by the failure to follow station procedures regarding removal of j combustible materials. Station procedures were revised after this event to provide

more administrative controls over such work.

{

l 24

Due to the restricted nature of the event and subsequent corrective actions, no change to the generic fire ignition frequency was deemed necessary. However, a conservative approximation of the effect ofincluding this event is presented below.

The corresponding fire area , area IC, at Reactor Building Elevation 51' East and West has a fire ignition frequency of 3.2E-03/ year of which 1.lE-03/ year is contributed from transient sources. This area was quantified and found to have a resultant core damage frequency of 8.17E-09/ year which is far below the 1E-06/ year threshold value from FIVE. Conservatively assuming a new transient frequency equal to one event in twenty years ofoperation or SE-02/ year, the new area frequency would be increased by 4.89E-02/ year for a total of 5.31E-02/ year. Applying this frequency to the CDF calculation results in a new CDF for this area as:

l (5.31 E-02/3.2E-03)*(8. I 7E-09) = 1.36E-07/ year l

This value is still below the IE-06/ year threshold value and the area screens o out. Therefore, there is no measurable effect on fire-induced core damage frequency if the generic data is updated utilizing Pilgrim plant-specific fire data.

l l

l l

l l

1-l 25 I

6. Werefire-induced loss-of-coolant accidents or inadvertent operation of valves modeled? If these events were excludedfrom consideration. please provide the justificationfor exclusion. If they were modeled, please provide the resulting core damagefrequency contribution.

Answer:

For each area, possible fire-induced plant events are analyzed involving manual and automatic trips, inadvertent actuation of protective signals, or inadvertent opening of l valves. As part of the screening approach for the Pilgrim Station IPEEE fire analysis, l

worst case fire events were assumed to fail all equipment in an area as well as support  ;

l systems in the area (e.g., cables for equipment in other areas). The affected equipment  ;

! was assumed to fail in the worst case mode. If such failures were to cause automatic  !

l or manual plant shutdown or to fail the RPS system, the areas were evaluated further.

l l

In general, LOCAs were not direct effects of fires. The failure of piping due to fires l l was not considered to be credible. However, under the right conditions, a fire-induced l opening of a valve could result in an interfacing system LOCA. However, in all cases l oflow pressure piping susceptible to an interfacing systems LOCA, an additional check valve would have to fail. The probability of an independent check valve failure, l approximately lE-04/ year, combined with a fire-induced valve opening would be on I i

the order of IE-07/ year. Combining this initiating event with the failure of core damage mitigating systems would yield a fire induced interfacing systems LOCA CDF of much less than IE-07/ year, well below the IE-06/ year threshold from the FIVE methodology.

The effects of fire were incorporated into each area with several cases involving inadvertent valve operations. The effect ofinadvertent valve operation is accounted  !

! for on an area by area basis. Separate risk assessments were performed for each area i and summed for the overall fire induced CDF. For any area of fire risk significance, the effects ofinadvertent valve operation were integrated with the effects of fire on other equipment. Therefore, it would be difficult as well as oflimited value to extract the effects due to only fire induced valve operation.

l I

i l l

l 26 l -l

7. Please provide a listing of all keyfire  !: assumptions, as requested by NUREG-1407, Section C.3.

Answer:

The Pilgrim Station IPEEE Fire analysis utilized the FIVE methodology with the then current IPE model. The IPE model was 2n updated version of the model submitted in response to the IPE (submitted in 1992). The assumptions and the methodology are one and the same and are contained within the described methodology in Sections 1.3.2,2.3.2, and 4.2 of the IPEEE report.

4 27 l

l \

8. Fire compartment interaction analysis should considerfire brigade accessing thefire area through adjacentfire :ones that contain cable and equipmentfrom an opposite safety train. Please providefire scenarios that involve this situation, and describe 1 how they have been considered in the IPEEE submittal.

Answer:

No credit was taken for fire brigade access / manual fire suppression in screening out areas. Manual fire fighting was credited for fires in the main control room due to the around the clock staffing of the room. Fire brigade access was also credited for the HPCI quad during on-line maintenance. Because of the nature of the work and (

combustible material there during the maintenance, fire brigade access is assumed to be available in time for any possible fire.

l I

i l

l l

l i

I l

l l

i 4

i 28

T l

A.4 HFOs

1. A site-specipc tornado ha:ard analysis was referenced (Reference 5-17 of the JPEEE submittal), but unavailablefor review. Pleaseprovide this reference so that the tornado ha:ard review can be completed.

Answer:

See the Attachment D, SAIC Report, " Tornado Ha:ard to Class 1 Electrical Conduits at Pilgrim Nuclear Generating Station, " December 1987.

The analysis is based on accepted techniques with conservative assumptions and predicts a very small probability (3.2E-7/ year for the auxiliary bay and 6.7E-7/ year for the water intake structure) of a tornado-induced compromise of the Class 1 electrical conduits in these buildings. It provides a very reasonable basis for determining acceptability of the as-built design for the auxiliary bay and the water intake structure.

In addition, these probability values would screen out per IPEEE guidance (NUREG-1407).

t l

4 1

29 l.

. . . . - -- . , . , . . - . . , - - .. ,, .- _