ML20151Q121
| ML20151Q121 | |
| Person / Time | |
|---|---|
| Site: | Cooper, San Onofre, Comanche Peak  |
| Issue date: | 08/14/1998 |
| From: | NEBRASKA PUBLIC POWER DISTRICT, SOUTHERN CALIFORNIA EDISON CO., TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC) |
| To: | |
| Shared Package | |
| ML20151Q119 | List: |
| References | |
| NUDOCS 9808200257 | |
| Download: ML20151Q121 (84) | |
Text
{{#Wiki_filter:. - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ . _ _ _ _ i I TOPICAL REPORT: CONTROL OF
~
HAZARD BARRIERS Prepared By: Southern California Edison Nebraska Public Power District Texas Utilities Electric Revision 0 August 14,1998 "This copy of the Topical Report is made available for review and comment only. The evaluation methodologies prescribedin this report have not been approved for use by the NRC. " 4 2 sOe yo0 $ f5 N 445 p PDR
O Topical Report. Revision 0 Control of Hazard Barriers August 14,1998 Table of Contents TABLE OF CONTE NTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I AC RO N Y M S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v I. INTRODU CTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 II. B A C K G R O U N D . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . .3. Ill. BARRIER CONTROL METHODOLOGY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 A. OVE RVI EW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 B. IDENTIFY BARRIERS FOR GIVEN HAZARD . . . . . . . . . . . . . . . . . . . . . . . . . 6 C. DETERMINISTIC EVALUATION OF BARRIERS . . . . . . . . . . . . . . . . . . . . . . . . 6 D. DETERMINISTIC / PROBABILISTIC EVALUATION OF BARRIERS . . . . . . . . . 6 - E. METHOD OF CONTROL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
- 1. Existing Plant-Specific Barrier Contml Programs . . . . . . . . . . . . . . . . . . . . . . . 7 ;
- 2. 10CFR50.59 evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 {
- 3. Allowed Outage Time perEquipment Technical Specifications . . . . . . . . . . . . 7 '
- 4. Barrier Allowed Impairment Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 l
IV. ADMINISTRATIVE CONTROLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
- 1. Process elements - general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . g
- 2. Implementation of AITs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 i
- 3. Allowed lmpairment Times (AITs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 l
i V.
SUMMARY
l CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 VI. REFERENCES (For Main Body and Appendicies) . . . . . . . . . . . . . . . . . . . . . . 14 l FIGURES i FIGURE 1 -OVERALL BARRIER CONTROL PROCESS . . . . . . . . . . . . . . . . . . . . 15 I i i k i l l
_ _ . _ ,..- m _ . . - . - m . . _.. - _ . _ . _ _ . . _ - _ . . _ _ _ _ _ . . _ . _ _ _ - _ _ _ . _ _ . O Topical Report. j Revision 0 Controlof Hazard Barriers August 14,1998 i e i
- APPENDICES i
a 1 A1. lDENTIFY APPLICABLE HAZARDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2 l 1. Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A -2 e 2. Applicable Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . _ A-3 . . A2. EVALUATE HAZARD PROPAGATION PATHWAYS . . . . . . . . . . . . . . . . . . . . A-5 1
- 1. General considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-5
- 2. Qualitative methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-6
- 3. Quantitative methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-7 A3. IDENTIFY APPUCABLE BARRIERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.6
'l 1. Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A -8 .
- 2. Sultability for hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8
- APPENDIXA FIGURES FIGURE A HAZARD PROPAGATION PATHWAYS . . . . . . . . . . . . . . . . . . . . . . A-9 l
[QiRM[K{RETERWM(SMCjEWMMMMMERSRNRM, EMS 2}$ B. EVALUATE BARRIER IMPAIRMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2
- 1. Normal access and egress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2
- 2. Exclusions for other programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2
- 3. Effects on hazard propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-3
- 4. identify affected equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-4
- 5. Determine potential consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-4
- 6. Identify available compensatory measure options . . . . . . . . . . . . . . . . . . . . . B-6
- 7. Document results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-9 ii 9
. . - . - . - . . _ . . . - . - ~ . . . . - - - . . . .,..-.. - -. ~ . - ~ - - - . - . __
Tophcal Report: Revision 0 i Control of Hazard Barriers August 14,1968 APPENDIXB FIGURES FIGURE B-1 -lNTERACTION BETWEEN TRAINS . . . . . . . . . . . . . . . . . . ... B-11 FIGURE B INTERACTIONS BETWEEN UNITS . . . . . . . . . . . . . . . . . . . . . . . . B-12 FIGURE B HAZARDS ON BOTH SIDES OF BARRIER BREACH . . . . . . . . . B-13 FIGURE B4 - ADDITIONAL INTERNAL BARRIERS BREACHED . . . . . . . . . . . B-14 FIGURE B TEMPORARY BULKHEAD OVER DOOR . . . . . . . . . . . . . . . . . . . B-15 l FIGURE B4 -TYPICAL BARRIER FEEDTHROUGH . . . . . . . . . . . . . . . . . . . . . . B-16 1 APPENDIXB ATTACHMENTS i 1-ATTACHMENT B SAMPLE FORMAT FOR BARRIER EVALUATION . . . . . . . B-17 L ATTACHMENT B SAMPLE PLANT OUTAGE BARRIER REQUIREMENTS SU MMARY TABLE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-18 i ' I?APPeNI$RWunscRMINIS7tc^/PR'OBABICI8TICWACDATIOWOKBARRIER$iI
$45 MT$#3MdiEQGWRTfANEt AITROACHjd)T:' WOR]'i'i@,
l C. EVALUATING RISK OF BARRIER IMPAlRMENT . . . . . . . . . . . . . . . . . . . . . . . C-2 !
- 1. Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2
- 2. Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2
- 3. Integrated Decision Making Process for Evaluating Risk of Barrier Impairtrents
- (Expert Panel) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-3 i APPENDIX C TABLES l
TABLE C.1 SCREENING CRITERIA . . . 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-7 iii i n i l l l
1 \ \ l Topical Report. Revision 0 l Control of Hazard Barrier
- 1 August 14.1998
. i
........s...,
.............s...........s.......
h ..
,k
)
b . .h I.EE M.MM.I! W M lQQX W $37;tT 3] l D. SAMPLE LICENSEE ADMINISTRATIVE CONTROLS FOR PROBABILISTIC B ASE D AITs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D -2 APPENDIXD TABLES i l 1 TABLE D-1: MOST RISK-SIGNIFICANT BARRIERS (SAMPLE) . . . . . . . . . . . . D-10 TABLE D-2: LESS RISK-SIGNIFICANT BARRIERS (SAMPLE) . . . . . . . . . . . . . D-11 TABLE D-3: BARRIERS WITH NO HAZARD FUNCTIONS (SAMPLE) . . . . . . . D-14 1 I l l 1 i l l l iv l 1
. - . . - . . - . . - - . . - _ . . . . ~ - - . . . - - - - . - . - . . . - ~ - . . . . . . - _ . . . . _ ,
i' L l Topical Repost. Revision 0 Control of Hazard Barriers A'r St14,1996 l ACRONYMS ! AIT Allowed Impairment Time AOT Allowed Outage Time ' BWR Boiling Water Reactor CFR Code of Federal Regulations CSRL Configuration Specific Risk Limited 2 i EIT Estimated impairment Time ! l EPRI - Electric Power Research Institute ; ! EQ Equipment Qualification l l EQML Equipment Qualification Master List " l FSAR Final Safety Analysis Report GDC- General Design Criteria HELB High Energy Line Break IDP Integrated Decision Making Process IPE Individual Plant Examination . IPEEE Individual Plant Examination of Extemal Events IST Inservice Testing l ITS Important to Safety
- . LCO Limiting Condition of Operation i LCS Licensee Controlled Specifications LOCA Loss of Coolant Accident MELB Moderate Energy Line Break NRC Nuclear Regulatory Commission NOV Notice of Violation l PRA Probabilistic Risk Assessment PSA Probabilistic Safety Assessment PWR Pressurized Watei Roactor RG Regulatory Guide SAR . Safety Analysis Report SRP Standard Review Plan SSC Systems, Structures, and Components l
T/S -Technical Specification L UFHA- Updated Fire Hazards Analysis l v c . l -
l l l l Topical Report Control omazartl Barriers Revision 0 August 14.1998 l TOPICAL REPORT: CONTROL OF HAZARD BARRIERS
- 1. INTRODUCTION Nuclear Plants have many barriers in place to protect components from various hazards such as fires, High Energy Line Breaks (HELB), Moderate Energy Line Breaks (MELB),
and other environmental conditions postulated for accident conditions. The types of ; barriers depend on conditions involved but can be block walls, doors, floors / ceilings, i ventilation dampers, etc. Most of the regulations requiring these barriers came into being subsequent to the completion of the design of the current generation of nuclear facilities and as such they were retrofitted to the facilities either during the licensing process or post-operating license issuance for the facility. This retrofit took advantage of existing barriers (walls, ventilation dampers, doors, etc.) when it was possible and minimized the physical alterations to the plant to the maximum extent possible.
~
The original design of most nuclear facilities also accommodated anticipated maintenance , needs for large components by providing floor plugs, access hatches, etc. for the removal ' and replacement of those components. Subsequent retrofitting of barrier controls necessitated that most of these maintenance access provisions remain in place and sealed during operational modes in which the barrier is required, which in some cases may be at all times. This is particularly true in the case of dual units with common areas containing critical components since it is rare that both units are simultaneously shut down. The current regulations for these barriers do not have provisions for maintenance of the barriers themselves nor for the temporary removal of the barriers to maintain the equipment they protect. Under current regulations, in order to impair a barrier, licensees feel compelled to prepare a safety evaluation per 10CFR50.59 (1) or enter the Technical > i Specification actions for the potentially affected equipment. This provides for an interesting dichotomy since good engineering practice always assumes that some degree of maintenance must occur when designing equipment. The NRC has long recognized and encouraged this engineering assumption by providing Technical Specifications Allowed Outage Times (AOTs) for critical equipment such as Diesel Generators, Auxiliary Feedwater Pumps, etc. The failure to recognize that barriers l must also be maintained and occasionally breached to maintain critical equipment has l created a situation where the units may be forced into unnecessary shutdowns to perform this maintenance. Another option would be to provide for attemate paths that do not breach the barriers 'when implementing maintenance activities. This situation creates potential personnel and nuclear safety concems by forcing removal of equipment through paths that were not originally designed for this purpose. This may create hazardous interactions with critical equipment and the potential for a plant transient. Page 1 of 15 l
_ - _ ~ - - . - . .. -~.- . . , - -. . - . . . . . . . . . . . _ _ . . . . . . . - - _ _ _ _ . _ _ _ - . . . . . Topical Report: Control of Hazard Barriers Revision 0 August 14,1998 This Topical Report is intended to correct these problems by providing a standard methodology for performing evaluations to support control of hazard barriers under the current regulatory options as well as serving as a basis for implementation of a barrier control process which provides Allowed Impairment Times for plant barriers. This report provides hazard barrier evaluation methods which, if approved by the NRC, will endorse the use of deterministic evaluations, or probabilistic assessments in combination with. deterministic evaluations to implement an acceptable plant-specific program for hazard barrier controls. For plants where existing barrier controls have been effective, the evaluation methodology described in this report may be used to supplement and enhance existing controls to further improve plant safety, timely support of plant modifications, essential surveillances, testing, maintenance and other work related activities associated with hazard barriers and the systems, structures and components (SSCs) they protect. Page 2 of 15
._. . . __.m_. _. . - ~ _ _ _ _ _ _ . . _ . . _ _ _ _ _ _ _ _ . - _ . _ _ _ _ _ _ . _ _ . . . _ _ . . _ _
l Topical Report: Revision 0 (ontrol of Hazard Barriers August 14.1998 ll. BACKGROUND in April 1997, three utilities from NRC Region IV met with the NRC to address barrier control issues. The purpose of the meeting was to discuss techniques for developing generic methodology and acceptance criteria for barrier allowed outage times. At the meeting the utility representatives agreed to develop a topical report that would provide the
)
basis for the acceptability of removing barriers from service. ( Several other utilities have developed a need for and an interest in barrier control program improvements. Recently a working group of representatives from these utilities has . initiated development of this Topical Report to set forth a common set of bases that may be used for site-specific programs to optimize control of d,esign basis hazard barriers at their facilities. During the development of the topical report the working group identified several NRC NOVs written against 10 CFR 50 Appendix B and 10 CFR 50.59 [1] criteria. l These violations were attributed to barrier impairments that may have been prevented with the basis presented in this report. . l l l l l 1 i l l l Page 3 of 15 4 9
Topical Report Revision 0 Control of Hazard Barriers August 14.1998 til. BARRIER CONTROL METHODOLOGY A. OVERWEW This Topical Report provides a barrier control methodology. The objective of this methodology is to provide controls for plant barriers which protect important-to-safety (ITS) structures, systems, and components (SSCs) from applicable design basis hazards. The normal configuration of most of the plant barriers (doors, hatches, walls, penetration seals, etc.) is closed and functional, preventing the potential propagation of hazards from sources to targets (i.e., ITS SSCs requiring protection from hazards). However, the normal configuration of dampers and mitigation system components can either be open or closed and functional. Breaches, except for normal access and egress, of these normally closed barriers temporarily depart from (change) this normal design configuration When one or . more barriers are breached, preservation of a plant's safety design basis necessitates a means of control by technical specifications and procedures. Many barriers in each plant already are controlled by existing technical specrfications (e.g., containment, fire doors) or through other administrative controls (e.g., severe weather waming) which provide allowed outage times (AOTs) and compensatory measures for the barrier. As is the case for these existing programs, barrier control programs for the remaining plant hazards should involve a planning process.. This planning should include evaluations of the safety impact of barrier breaches (also referred to as impairments). These evaluations may need to identify target SSCs, and/or determine the resultant consequences of breaches based on propagation of the hazards. It also should identify available compensatory measures for barrier impairments. Options are included in this Topical Report for compensatory measures. As discussed above, utilities currently need to perform these evaluations deterministically on a case-by-case basis, for each combination of barrier impairments. These deterministic evaluations will be based on the existing hazard analyses reported in the plant's Safety Analysis Report (SAR) and design calculations. However, SAR analyses may also need to be augmented to address conditions with barriers impaired. This information may be obtained by walkdowns to identify hazard interactions with specific openings and new analyses to extend hazard evaluations to plant modes nM previously analyzed in the SAR. Page 4 of 15
Topleal Report. Control of Hazard Barriers Revision 0 An--t 14,1998 Standard methodology for these evaluations, including use of existing design basis methods or applicable Standard Review Plan (NUREG-0800) [7] methods is provided in this Topical Report. To optimize the safety benefit of this process (i.e., avoiding cycling of the plant or postponement of necessary maintenance while freeing safety resources to areas of greater potential risk), it is feasible to perform these barrier impairment evaluations collectively using a deterministic and/or probabilistic basis to support an Allowed Impairment Time (AIT) (without compensatory measures or a 10CFR50.59
. safety evaluation for impairments as described in Appendix C).
Options' are defined in this Topical Report for developing a probabilistic basis for barrier impairments based on the Individual Plant Examination (IPE) and Individual Plant Examination of Extemal Events (IPEEE) risk models, other appropriate plant-specific Probabilistic Safety Assessment (PSA) risk models or a simplified model using applicable acceptance criteria. This section defines standard methodology, which may be used to identify, evaluate ~ and control plant hazard baniers. The evaluation process for hazard barriers found in a non-conforming or degraded condition are covered by corrective action programs per 10CFR50 Appendix B, Criterion XVI [1] and Generic Letter 91-18, Revision 1 [2]. Therefore, detailed discussions regarding such barrier impairments are excluded from the barrier control methodology described in this Topical Report. The overall barrier control process is as shown in Figure 1. This section maps Figure 1 as shown in Sections lil.B through lli.E below. Results of these evaluations, both deterministic and probabilistic, can be applied to optimize each licensee's barrier control process. Barrier impairments may be allowed under the following conditions: The risk of fuel damage attributable to the propagation effects of a design basis hazard event does not exceed applicable acceptance criteria Barrier AlTs are consistent with typical times needed to restore the barrier, implement risk reducing measures, remove the hazard (s), implement compensatory measures or perform plant maintenance, or ' The potentially affected equipment is declared inoperable, or is not required to be operable. Note that the need to consider a barrier as a support system for equipment is tied to the event or accident that the banier is designed and credited to protect against. If those events are not the bases for Technical Specifications (T/S), then the barriers are not considered to be T/S support systems. Page 5 of 15
_.____ ~ _ . . . . _ _ _ _ _ _ _ . . _ . _ _ . . _ . _ . _ . . _ - . . _ _ _ _ . _ . . . _ . . _ . _ . _ . . _ . _ . _ . . _ _ . _ . _ Topical Report Control of Hazard Barriers Revision o . A7_7.14,1933 Justified by a 10CFR50.59 safety evaluation and applicable compensatory measures. Prior to implementing an activity involving a barrier impairment, a review of applicable plant specific Licensing Basis Documents (LBDs)is ! performed to determine if the proposed impairment is a change that may affect the design, function, or method of performing the function of a Structure, System or Component (SSC) as described in the LBD. An activity involving a SSC not explicitly described in an LBD that has the potential to impact the function of a SSC which is explicitly described in the LBD is also l considered a change. Such changes are within the scope of the 10 CFR 50.59 programs and must be reviewed as required by those programs. l B. IDENTIFYBARRIERS FOR GIVENHAZARD Appendix A, Sections A1, A2 and A3 describe how to identify the barriers for a given hazard for an integrated evaluation. This methodology may also be used to identify the applicable hazard barr'ier functions for a given barrier for a barrier-by-barrier evaluation. , C. DETERMINISTIC EVALUATION OF BARRIERS Appendix B describes how to evaluate the effects of a barrier impairment (or breach) using deterministic methods. This includes hazard propagation through the breach, identification of affected equipment, potential compensatory measures, potential design improvements, and suggested documentation. ' Standards are . provided for normal access and egress without a banier evaluation, and for crediting other existing barrier control programs (e.g., fire protection). D. DETERMINISTIC / PROBABILISTIC EVALUA TION OF BARRIERS - Appendix C describes the risk methodology options that can be used to define and justify Allowed impairment Times (AITs) for barriers. This includes simplified methods for evaluating risk due to barrier impairments, and can be utilized by plants without a Probabilistic Risk Assessment (PRA) based model. Barrier AITs defined
~ by this methodology may be applied as described in Section IV of this Report.
Page 6 of 15 9
. ._. ,- . . . - . . . . - . - . . . . .. .-_.... --.. -.-.~. .- . ...- . . _ . -. .- .. - Topical Report. Control of Hazard Barriers Revision 0 August 14.1998 E. METHOD OF CONTROL The method of control to be used for the barrier impairment should be selected. The options are discussed below:
- 1. Existing Plant-Specific Barrier Control Programs There are several existing programs which control impairments of many of the hazard barriers in a plant. Typical existing programs are identified in Appendix B, Section B.2.
- 2. '
10CFR50.59 evaluation The combination of concurrent impairments can be evaluated as described in Appendix B, Sechon B.7 and justified by a 10CFR50.59 evaluation which specifically addresses the compensatory measures being imposed and any equipment being declared inoperable per the applicable Technical Specifications. This method does not require prior NRC approval of this Topical Report.
- 3. Allowed Outage Time per Equipment Technical Specifications The equipment protected by the barrier can be declared inoperable and the applicable Technical Specification actions applied. This is not a practical option for plants with multiple trains behind hazard barriers (for which Technical Specificati,n 3.0.3 would apply) or when the equipment Technical Specification action is insufficient to allow performance of the required work activity. It may also have adverse consequences for the plant safety monitor and the calculated equipment availability under the Maintenance Rule. This method does not require prior NRC approval of this Topical Report.
- 4. Barrier Allowed impairment Time Application of an Allowed Impairment Time (AIT) for the barrier impairment ' !
is not currently permitted by the NRC. Following approval of this Topical i Report, an AIT and applicable risk reduction measures for breaching a specific barrier may be determined in accordance with the risk evaluation methodology per Appendix C, and applied as described in Section IV. Page 7 of 15
. .- - . . - - ~ ~ . - _ - . _ . . . . . . ~ _ _
, . . . . _ . _ _ - - . - ~ , - - , - - . . . . s , Topical Report. j Control of Hazard Barriers Revision 0 August 14.1998 IV. ADMINISTRATIVE CONTROLS As discussed in Appendix B, Section B.2, there are several existing programs at each l facility which control hazard barriers in the plant. An existing program could be expanded j or a new program created to implement optimized control of barriers which protect the plant against design basic hazards. This optimized program would consist of administrative controls implemented through plant procedures. A sample of licensee administrative l controls is included in Appendix D. l ! The primary administrative control of hazard barriers for each facility using this Topical i Report should be a programmatic set of one or more plant procedures, which contains a j plant-specific statement of purpose consistent with the following:
"This procedure implements a process for control of plant barriers which l
protect structures, systems and components from design basis hazards. ' This process is consistent with the Topical Report titled " Control of Hazard y Barriers," dated August 14,1998." The normal configuration of plant hazard barriers shall be functional when closed or opened (i.e., for active baniers) consistent with the design basis. Barrier impairments will be allowed if: They are acceptable based on a deterministic evaluation which is documented as part of a Licensee's existing plant-specific barrier control ! process. or 4 Justified by a 10CFR50.59 safety evaluation and applicable compensatory measures. or The potentially affected structures, systems and components are declared inoperable, or are not required to be operable as discussed in Section Ill.A above. or Page 8 of 15
- . _ _ . _ . - _ _ . . _ _ _ - - _ _ _ _ _ . - _ . . . _ . ~ _ _ . _ ._
Topical Report: Revision 0 Control of Hazard Barriers August 14.1998 i l The risk of fuel damage attributable to the propagation effects of a design basis event does not exceed the plant-specific acceptance criterion for non-risk significance. Barrier allowed impairment times are consistent with
; the times needed to restore the barrier, implement risk reducing measures, or remove the hazards. Barrier allowed impairment times are based on typical times needed to perform plant maintenance or construction activities.
The Hazard Barrier Control Process will initially be limited to' control by existing plant-
- specific barrier control programs, by 10CFR50.59 and by the Technical Specification actions for the protected Structures, Systems and Components (SSCs). Following NRC approval of this Topical Report, enhanced controls may be added to permit the use of AITs forimpairment of hazard barriers.
For many Licensees, a fast and efficient means of implementation will be to add the scope of hazard barrier control to an existing program such as that for control of fire barriers. ~ l Although use of existing programs for this purpose may involve intemal jurisdictional I issues, the programs typically have the necessary structure in place to perform tracking i and control functions. A new process for hazard barrier control may also be created. Suggested process elements are identified below.
- 1. Process elements - general The administrative controls for impairment of hazard barriers should contain the following elements:
Written procedures defining program responsibilities and actions. A tracking process for impairments, with appropriate record retention, including: For planned impairment requests, controls to prevent impairment prior to appropriate evaluation and implementation of compensatory measures. l For non-conforming or degraded conditions, a process for evaluating and documenting operability when a barrier is found to be non-conforming or degraded (e.g., implement Generic Letter 91-18, Revision 1 guidance [2] ). , Page 9 of 15 l
Topical Report. Control of Hazard Barriers Revision 0 August 14.1998 Evaluation of barrier functions for planned impairment requests including ) identification of any required compensatory and risk-reducing measures, and documentation of the results per this Topical Report. l Communication of evaluation results, including required compensatory and risk-reducing measures, to the applicable organizations controlling the l associated impairment (e.g., operations, maintenance, fire protection, etc.). Verification that the risk-reducing and compensatory measures have been implemented prior to activating the impairment. I Verification that the barrier has been restored prior to deactivating the impairment. t Removal of risk-reducing and compensatory measures by the applicable work organizations, as part of deactivating an impairment.
- 2. Implementation of AITs Following NRC approval of this Topical Report, Licensees which choose to endorse the methodology prescribed herein by submitting their own plant-specific submittal to the NRC, will be permitted to use AITs evaluated to be appropriate for barrier impairments at their plant. The AITs will be implemented through Hazard Barrier
# ~' Control procedures. The implementing procedures should contain the following additional elements:
i Determination of compensatory measures (Appendix B, Section B.6), risk reduction measures (Appendix C, Section C.3, Task 6) and AITs per l Appendix C of this Topical Report. Application of AITs to implement risk reducing measures, compensatory measures, and to restore the barrier per Section IV.3 of this Topical Report, below. Identificatio , of the barriers which will be controlled by AITs, together with - the associated attemate barriers, and compensatory and risk reduction measures. Barriers forwhich risk-limited AITs are required per Appendix C of this Topical Report should be appropriately identified. Page 10 of 15
-----n .--
.. ._ . ._ _ _ . .~. _ _ - . _ _ _ . _ _ _ _ -._. _ .. _ __ _ _ _ ,__ _ _ _
i Top 6 col Report. Revision 0 Control of Hazard Barriers August 14.1998
~
The tracking process for planned impairments of AIT-controlled barriers may be simplified compared to those controlled by 10CFR50.59 or the applicable equipment Technical Specification actions: Consistent with Appendix C, Section C.3, Task 4.1 for barrier impairment frequencies and the integrated decision making . process for evaluating the risk of barrier impairments, barriers with AITs may be impaired and any predefined risk-reducing and compensatory measures implemented by the work organizations- without processing a 10CFR50.59 safety evaluation. Vorification must be performed as part of normal work control processes or surveillances. Barriers with AITs which do have a special (e.g., fire protection or security) function should continue to be tracked as described in Section IV.1 above. ruzard barriers are normally required to be functional when the structures, systems and components (SSCs) protected by the barrier are required to be operable. Barriers are functional when they are capable of performing their credited function during the applicable hazard event. During wnditions in which barrier AITs are being implemented the functional status of the hazard barrier is decoupled from operability of the potentially affected equipment unless plant conditions change which warrant recoupling, (e.g., a substantial steam leak observed). 4
- 3. Allowed impairment Times (AITs)
AITs should be determined consistent with and applied in the order specified by Appendix C of this Topical Report: For the most risk-significant barriers, those with risk-limited AITs: Restore the barrier, or implement required risk-reducing measures, if applicable, or complete a specific 10CFR50.59 evaluation to justify further impairment prior to expiration of the AIT. Page 11 cf 15
Topical W. Revision 0 Control of Hazard Barriers August 14,1998
~
l
. l With risk-reducing measures in place, if applicable, restore the bamer, or ,
complete a specific 10CFR50.59 evaluation with applicable compensatory l measures to justify further impairment prior to expiration of the AIT. I For the less risk-significant barriers, those with non-risk limited AITs: l Restore the barrier, or complete a specific 10CFR50.59 evaluation with l compensatory measures to justify further impairment prior to expiration of the AIT. l For all barriers: With an alternate barrier in place, design basis requirements are met. Restoration of degraded or non-conforming barriers may be required consistent with Generic Letter 91-18, Revision 1 guidance [2]. If any of the above conditions are not met, the structures, systems and components (SSCs) protected by the barrier should be declared inoperable and the applicable Technical Specification actions entered for the SSCs. Page 12 of 15
Topical Report: . Revision 0 Control of Hazard Barriers August 14.1998
~
V. SilMMARY / CONCLUSIONS This Topical Report provides one approach for performing evaluations to support control of hazard barriers under the current regulatory requirements as well as serving as a basis for implementation of an initial barrier control process or to enhance an existing barrier
- control process which provides AITs for plant barriers.
Upon approval by the NRC of the evaluation methodology and criteria for defining and applying AITs to hazard barriers, implementation of hazard barrier control processes as described in this Topical Report will improve support of plant modifications and essential surveillances, testing and maintenance activities on the barriers and the SSCs which credit their hazard barrier function. More important, the overall barrier control process, which includes identification, evaluation, documentation and administrative controls, provides assurance that acceptable plant safety conditions are maintained consistent with a Licensee's existing design basis requirements. Page 13 of 15
.- . . . . . . . . - . . . . _ _ . . ~ . - . = - . - - . . . - . _ . . . . ~ . . . . . ._ . .__~. . - . . . - , -
l Topical Repxt: Revision 0 Control of Hazard Barriers August 14,1998 VI. REFERENCES l [1] Title 10, Code of Federal Regulations, Part 50, " Domestic Licensing of Production and Utilization Facilities." I [2] Generic Letter No. 91-18, Revision 1, "Information To Licensing Regarding NRC Inspection Manual Section On Resolution Of Degraded and i Nonconforming Conditions," October 8,1997. [3] Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions On Piant-Specific Changos To The i Current Licensing Basis," May 20,1998.
~
[4] EPRI TR-105396, "PSA Applications Guide," August 1995. l [5] EPRI TR-102266," Pipe Failure Study Update," April 1993. l l [6] NSG Report-2/3-96-001, San Onofre Nuclear Generating Station Barrier Study, "Probabilistic Risk Assessment Barrier Control Program," June 1996. i ' [7] NUREG 0800, " Standard Review Plan For The Review Of Safety Analysis Reports For Nuclear Power Plants." l l , i l Page 14 of 15 l
l Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 1 1
- 1 5
l
- OVERALL BARRIER CONTROL PROCESS
? I IDENTIFY B ARRIERS ) FOR GNEN HAZARDS Appsedu A I INTEGRATED DECISION DETERMINISTIC APPR04Cif A i + + 1 l DETERMINISTIC D
^ ^ A P OBAB LI TIC M B EVALUATION OF BARRIERS i RESULTS ^'"*'
i i O I i l Acceptable Plant 3 Safety Condition 1mmummummmum 1P l DOCUMENT 1 APPLY j RESULTS j Appsada D METHOD. Ex STING PLANT
^" M[ BARR ER C [ESEL r"ROcII"5 CONTROL j,x,rERTgANEL y ,
u u . EQUIPMENT T/S 50.59 ACT EVALUATION N. I 4 i l
'l FIGURE 1 - OVERALL BARRIER CONTROL PROCESS i
Page 15 of 1'5 l
- _ .m___._ _ _ . __ . _ . _. . . _ _ _ . _ . _ . . . _ _ . _ _ . _ . _ . . _
i Top cal Report: Revision 0 { Control of Hazard Barriers August 14,1998 ) Appendix A 4 - i i i L APPENDIX A IDENTIFICATION OF BARRIERS FOR. GIVEN HAZARDS j i a W l l A-1 OF 9 i
.. . . ~ . _ < . . . _ < . .
N l ' l Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 Appendix A A1. IDENTIFY APPLICABLE HAZARDS l i 1. Hazards All applicable design basis hazards for the plant should be considered. Those for l which barrier impairments are already controlled by another program can be l excluded if the basis for exclusion is documented. (Exclusions are discussed ! further in Appendix B, Section B.2 of this Topical Report.) The design basis hazards to be considered include: l Pipe break and tank wall failures (e.g., SAR Sections 2.0, 3.4, 3.6), including ! the effects of: Steam (i.e., temperature, pressure, relative humidity) l Water Spray . 1 Radiation 1 Flooding Jet impingement and pipe whip
. Fire l Impairments addressed by the Technical Specifications, FSAR, Fire l Hazards Analysis Report or other Licensee Control Specifications
! (LCS), (e.g., SAR Sections 3.1.1.3 and 9.5.1, "GDC 3 - Fire Prrs tection") Equipment-generated missiles (e.g., SAR Section 3.5) Severe weather (e.g., SAR Sections 2.0,3.4 and 3.5), including: Wind, differential pressure 1 Missiles (tomado generated) l - Flooding, including combustible liquid containment Freezing Site related (e.g., SAR Section 2.0), including: Tsunamis, surges and seiches l Dam failures Chemical releases Explosions i i
- A-2 OF 9
Topical Report Revision 0 - Control of Hazard Barriers August 14.1998 Security (e.g., impairments addressed by Physical Security Plan) Ventilation (e.g., SAR Section 9.4,11.0), including: Unmonitored releases Degraded equipment heating or cooling Secondary containment Control room boundary Halon/CO2 confinement R.G.1.75/IEEE-384 electrical separation hazards Radiation hazards (not associated with pipe break) Not all of these hazards apply to any given plant, and sorne apply only in certain plant modes. Mode applicability is discussed below.
- 2. Applicable Modes The program must consider the effects of hazard event occurrence during all plant Modes and the defueled condition. Some ards are only present in operating modes 1 through 4 (PWRsymodes 1 through 3 (BWRs). Some have only been evaluated for operating modes, even though they may be present in outage Modes 5, 6 (PWRsymodes 4.5, 6 (BWRs) and the defueled condition. Those hazards that are present in the mode for which the barriers will be breached must be evaluated even if not previously addressed by the SAR forthat mode. This includes, but is not limited to:
High energy lines (e.g., auxiliary steam; lines in the operating unit of a dual unit plant). Missile sources (e.g., rotating equipment or components pressurized above missile threshold criteria during shutdown; sources in the operating unit of a dual unit plant). Flooding hazards (e.g., tanks and piping systems that remain in service; tanks and piping systems in the operating unit of a dual unit plant). A-3 OF 9
- - ' - - - - - ' - - - ' '-~
. . ~ . - . - . . . . ... . -. -._- . .-.~. - . . . ... . - . _ . . _ . . - . . . . -- ~.
Topical Report Control of Hazard Bh Revision 0 August 14,1998 Appendix A If the barriers for the hazards are breached during unit shutdown, the hazard - consequetices including the capability to maintain a safe shutdown condition should be evaluated for any hazards present that are not secured by appropriate controls. Identifying the barriers for the applicable hazards is discussed in Appendix A, l Section A0 of this Topical Report. Evaluating the effects of a breach on hazard - prope;,ation and event consequences is discussed in Appendix B. Evaluation of hazards to support a barrier breach should be consistent with the existing plant-specific SAR criteria or, as an attemative, the licensee may choose i to adopt the criteria of the applicable Standard Review Plan (NUREG-0800) (7]. In i particular, the analysis should use the same criteria for defense in depth as the existing SAP. or SRP (e.g., no loss of redundancy vs. no loss of function, as applicable). 1 l l A4 0F 9
- ... - . - _ - - . . _ _ - . - ~ , _ .- - - .. . _ . - - -. _ -- -
l Topical Report. Control of Hawd Bah Revision 0 < August 14.1998 j Appendix A 1 i 1 l A2. EVALUATE HAZARD PROPAGATION PATHWAYS
- 1. General considerations The next step in the methodology involves both qualitative and quantitative evaluation of hazard propagation to identify the design basis barriers applicable to the hazard. As shown in Figure A-1, the evaluation should consider potential hazard propagation pathways including: '
Existing barrier openings. Ventilation system (including ducting failure caused by HELB).
. Drain piping.
- Piping and electrical tunnels.
1 Barriers wh!ch may fail due to or are not designed for the event (e.g., not evaluated for resulting conditions). Conduit and penetration seals (e.g., not evaluated for resulting environmental conditions). Either standard qualitative or quantitative methods may be used to evaluate hazard propagation. For purposes of identifying the applicable barriers for each hazard, qualitative methods will typically be sufficient (e.g., it is enough to know that the environment may be harsh). For purposes of evaluating the consequences of propagation (e.g., through a barrier breach per Appendix B of this Topical Report), quantitative methods may be needed. A-5 OF 9
. __ _ .. - ~ - -.
Topical Report Revision 0 g Control of Hazard Barriers August 14,1998 Appendix A
~
}
- 2. Qualitative methods Qualitative methods may be used to identify the applicable barriers for a given hazard. Qualitative methods may reduce the analysis effort and can be validated against quantitative methods. Based on the experience at plants which developed i these methods, qualitative propagation analysis may also identify previously j unrecognized bypass paths around the design basis barriers.
i As shown in Figure A-1, potential hazard propagation paths include ventilation ducting, drain lines, unsealed conduit, and unsealed penetrations. For example: i ] Floodina: The typical SAR flooding analyses will identify the flood source and drainage paths to the final sink locations. The boundaries of these drainage paths , (e.g., floors and walls) are barriers for the flood hazard. Potential backflow via
, drains are additional propagation paths that must be considered.
4 j Missiles Typical SAR missile analyses are keyed to the source of the hazard vs.
- the barriers for that hazard. For example, a typical SAR analysis will identify a hazard (e.g., fan unit) and conclude that it is acceptable based on the surrounding i structure (e.g., concrete walls, floor and ceiling). Walkdowns can be used to verify j which faces of the surrounding structure are actually barriers for the missile, based j
on the plane of rotation for rotating equipment or potential trajectory for pressurized
; missiles. The purpose of the walkdowns would be to identify interactions between i potential rotating and component missile sources and moveable barrier features j such as doors, hatches and block walls.
i l Steam: Steam propagation can be considered qualitatively by considering the i general effects of buoyancy, pluming, and tortuous path effects. Buoyancy and ! pluming will limit the extent to which a hazard will extend across an open area (e.g., face of a building). Tortuous path effects willlimit the extent to which a hazard can j affect the environment at the other end of a stairway, pipo tunnel, unsealed conduit or drain line. Tortuous peth effects need to consider differential pressurization (if any), and flow path area vs. condensing surface area (wetted perimeter x path length). l i I l A-6 OF 9
- . -. -__... . . . . . - . - . ~ . . . . - . . - . . . - . . - - . - . . . - - - .. - .... .. . Topical Report Control of Hazard Barriers Revision 0 Au0ust 14,1998 AWix A I
- 3. Quantitative methods !
Quantitative methods include the existing SAR or applicable Standard Review Plan (NUREG-0800)[7] analysis methodology for each hazard. Standard quantitative methods used in the original design of hazard barriers include pressure / temperature transient analyses and detailed flooding and missile calculations. These methods are typically resource-intensive and may provide non-conservative results when evaluating propagation near barrier openings (e.g., bulk-average vs. localized temperatures / gradients; expanded vs. jet pressures within the zone of influence of HELB jets). Care is needed to consider localized effects in order to apply these I methods conservatively to evaluating propagation. Additional methods which may be needed, for example, are: Flooding: To determine the height of a wall that actually performs a flood barrier function, an evaluation of transient flooding may be needed. This will generally only be needed to evaluate a breach of the barrier or to define the requisite - compensatory measures for a breach per Appendix B of this Topical Report. Transient flood height can be determined by a quasi-static analysis that uses the design basis flood volume (e.g., flow rate x duration) and effective flow path area (e.g., floor area of the source or flow path). A more sophisticated transient analysis that determines the backwater elevations for predicted inflow and outflow rates from the flow path can also be used. Radiation (airbome): To determine the effect of airbome source term propagation, it may be necessary to combine the source terms from different areas that communicate (e.g., via the ventilation system). One starting point is to use the highest concentration in the two areas. If this provides an unacceptable result, the source term could be diluted into the combined volume, provided that the volumes are properly selected (e.g., minimum connected volume vs. maximum due to multiple barrier openings). Although this is not an all inclusive list of hazard propagation evaluation methods, additional qualitative or quantitative methods may be utilized consistent with the
' applicable criteria of 10 CFR 50 Appendix A [1] and any other plant-specific design basis requirements.
A-7 OF 9 I i j
Topical Report l Corstrol of Hazard Barriers Revistorio
. August 14,1998 Appendix A l
A3. IDENTIFY APPLICABLE BARRIERS l The applicable barriers are identified by the propagation evaluation discussed in Section A2, above and consideration of the following:
- 1. Types Hazard barriers consist of both passive and active plant features which protect equipment important to safety. Passive barriers include but are not limited to:
Fixed barriers Walls, floors, berms, penetration seals Movable barriers Doors, hatches, block walls
- Missile shields and pipe whip restraints Active barriers may also be credited for some hazards. Active barriers include but are not limited to:
. Dampers
- Fire, HELB, tomado i
l . Mitigation system components (e.g., for HELB) j - Fire suppression system t - Valves, fan trip circuits Pressure, temperature, level or flow switches. ! 2. Suitability for hazards l . l The credited barriers must have attributes that have been evaluated to be suitable for the applicable hazard. For example, non-watertight doors may be credited as leak-limiting but not for leak tightness. Fire dampers can be credited for HELB l ~. actuation if the setpoint is low enough and the event does not result in area l pressurization high enough to exceed the unassisted closure rating of the damper. A-8 OF 9
- . _ . - ~-
l of rd m $"uo$b4,199a l
/ t' s /,
/ '
/
O[@ ed av^coUcTim j 1 6 bHAZARD SOURCE fl /A [ G, UNSE D PENETRATION m <
//
EQUIP KNOWN EQUIP NOT KNOWN INOPERABLE INOPERABLE .
- DOOR (OPEN)
- - O! Is 01 1 -
v M
'/#/#p/###2:;26####/
/
FIGURE A HAZARD PROPAGATION PATHWAYS l l l A-9 OF 9
a d ! To# cal R*M Revision 0 3 Control of Hazard Barriers August 14.1998 Appendix B i i e 4 APPENDIX B DETERMINISTIC EVALUATION , 1 OF BARRIER IMPAIRMENTS l i l B-1 OF 18 W, y , .- m .- - .- - - -
. - . - . ~ . - . . - - . ~ ~ - - - . - ~ - - - ~ ~ - - -
Topical Report. Control of Hazard Barriers Revision 0 August 14,1998 Appendix 8 B. EVALUATE BARRIER IMPAIRMENTS
- 1. Normal access and egress Normal access and egress are part of the plant design. Hence, evaluation of the consequences of a barrier impairment is not require ( #en a door is opened for
" normal access and egress." The following standard ;;ddelines should be used when defining " normal access and egress" through a door:
A door may be open or unlatched without compensatory measures or other actions for less than 1 hour if personnel are in control (having direct view of and clear path to the door with no obstructions such as hoses or cables) and ready to close and latch the door in the event of an emergency (fire, flood, radiological release, etc.).
- 2. Exclusions for other programs There are several existing programs which control impairments of many of the hazard barriers in a plant. These programs can be credited to exclude some barrier functions from an enhanced barrier control / evaluation process for certain hazards as discussed in this Topical Report. However, to be excluded, all hazards applicable to the barrier should be addressed, and the basis for exclusion documented as part of the licensee's enhanced barrier control process (e.g., by reference). Licensees may choose to combine all existing and proposed barrier control programs as one overall process based on plant-specific needs. Typical existing programs are identified below:
Fire Barriers Technical Specifications and/or Fire Hazards Analysis Report Security Barriers Physical Security plan Vital HVAC Boundaries Technical Specifications Other HVAC Boundaries Equipment control and work clearance processes (e.g., if area temperatures and unmonitored releases are addressed) B-2 OF 18 4
Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 Appendix B Pipe Whip & Jet Impingement Work clearance process (e.g., if the high energy line must be de-energized as part of the clearance) Tomado Missile Severe Weather Response Procedures (e.g., close on waming) Extemal Flood Barriers St 'ere Weather Response Procedures (e.g., close on waming) Containment Technical Specifications Credited programs should be included by reference in each plant's barrier control process.
- 3. Effects on hazard propagation
- a. General considerations Breaches in barriers credited in a plant's design basis hazards analysis may allow one or more applicable hazards to propagate into areas which have not been previously evaluated. This can result in interactions between trains (Figure B-1) or between units (Figure B-2). Additionally, equipment on both sides of the barrier may be affected if there are different hazards on each side of the breach (Figure B-3). Each hazard event is evaluated consistent with the plant-specific licensing basis.
Evaluation of hazard propagation pathways should be consistent with the methodology of Appendix A, Sections A2 and A3 of this Topical Report.
- b. Combination of concurrently impaired barriers The combination of concurrently impaired barriers must be considered in evaluating propagation. This applies to both after-the-fact evaluations (e.g.,
for as-found degraded or non-conforming conditions) and evaluations for ' planned impairments. As shown in Figure B-4, additional areas can be affected if intemal barriers are breached in addition to the credited design basis barrier for the hazard. B-3 OF 18
l- Topical Report:
- l. Cor*ol of Hazard Barriers Mion 0 August 14,1998 j Avndix B
~
\
l l Evaluations for combinations resulting from related work activities (e.g., maintenance in multiple areas during a train outage), or for the worst case combination (or with suitable restrictions on the intemal barriers, if needed) may be reusable for subsequent impairments. 4
- 4. Identify affected equipment Identification of the systems in each area to which the hazards propagate can be made from design basis document sources including but not limited to:
The Updated Fire Hazards Analysis (UFHA) area summaries l l . Raceway database ! - Equipment database . l
. Walkdowns The evaluation process should identify those important to safety SSCs which can be excluded from consideration if it can be shown they are not required to mitigate the consequences of the hazard of interest or are not rendered nonfunctional.
- 5. Determine potential consequences
- a. General considerations -
Evaluation of potential consequences should consider the appropriate i combinations of concurrent hazards, consistent with the Licensing Basis for meeting 10CFR50 Appendix A, General Design Criterion 2 [1]. The evaluation for each hazard should be consistent with existing SAR design criteria or applicable Standard Review Plan (NUREG-0800)[7]. In particular, l the analysis should use the same criteria for defense in depth as the existing ; SAR or SRP (e.g., loss of offsite power if applicable; no loss of redundancy i vs. no loss of function, as applicable). Credit should only be taken for I equipment and cables evaluated to remain operable for the hazard (e.g., l submergence,if applicable). If acceptable results cannot be demonstrated l on these bases, then compensatory measures may be needed as addressed l in Appendix B, Section B.6 of this Topical Report. i B-4 OF 18 i l
. . ~. ~ . . . . . . . ~ . - . _ - ~ . - _ _ - - . - . _ . . _ . . - . . - -
Topical Report Revision 0 Control of Hazard Barriors August 14,1998 i AWir B . i However, if the affected important to safety SSC is not required to mitigate the effects of a hazard and there are no adverse 10CFR50.49(b)(2) interactions, then no compensatory measures are needed for the impaired barrier.
- b. 10CFR50.49 Propagation of steam, radiation or flooding hazards requires an evaluation to the criteria of 10CFR50.49 (1). Several key points conceming evaluations for barrier breaches include:
Credit may be taken for non-EQ Master List equipment if it has been evaluated for the hazard, and its configuration is controlled (e.g., by a program similar to the EQML). 10CFR50.49(b)(2) effects must be included. This includes unqualified - safety related equipment and circuits as well as non-safety related equipment and circuits. Loss of 10CFR50.49(b)(3) post-accident monitoring equipment may be acceptable if it is not needed for the event or can be declared inoperable.
- c. Mild area EQ issues Many plants did not install EQ cabling in areas that remain mild with the i hazard baniers intact but which may become harsh with a barrier breached.
Others, which did previously install qualified cabling in these areas, have subsequently installed some unqualified cables as a result of cost or material availability concems. If the EQ configuration of cabling in these areas is not controlled (e.g., restrictions on installation of new unqualified items), then the hazard barrier evaluations performed for these areas may not remain valid. This can be addressed by restrictions on installation of new unqualified cables in these areas, or analysis of each new circuit traversing the area. I B-5 OF 18 i
Topical Report Revision 0 - Control of Hatard 3arriers August 14.1998 l AWix 8 i
. l
- 6. Identify available compensatory measure options l Compensatory measures maintain or restore the required deterministic design basis functions of the barrier for the applicable hazards.
4
- a. Altemate barriers This option should be limited to those altemate barriers suitable for applicable hazards under design basis conditions. Seismic (Category l]
concrete walls and floors are considered suitable as attemate barriers for hazards if provided with appropriate penetration seals (e.g., radiation-rated for LOCA dose hazard, flood-rated for flood hazard, etc.) or otherwise shown acceptable by design analysis. Altemate barriers are not required to meet the full qualification requirements of 40 years oflife with a design basis event at the end. However, such barriers should be capable of surviving the effects of the design basis event sufficiently to assure functionality of the - potentially affected SSCs when the primary barrier is impaired. Severe weather barriers (e.g., separate tomado missile doors) may be suitable altemate barriers for the normal exterior doors. Non-load bearing interior walls (typically, expanded-metal lath and plaster construction) may not be suitable for hazards involving missiles, pipe rupture effects, or dose from LOCA shine.
- b. Temporary barriers Temporary barriers are those which are evaluated to be suitable for less than the complete set of hazards (e.g., to be used in conjunction with other restrictions), or for less than design basis conditions for one or more of the hazards. These can include, for example, temporary bulkheads bolted over or braced within a doorway per Figure B-5 (adequate for hazards other than fire), mineral wool packing in a conduit or penetration sleeve (adequate for steam but not flooding, radiation or fire), etc.
- c. Design changes
- 1) General considerations There are minor optional design changes that can significantly reduce the need to perform new barrier evaluations for recurring activities.
For example, plants which have welding outlets and compressed air connections outside the equipment rooms in which maintenance is B-6 OF 18 e.. --. - - - - . _ . _ , _ - - - - - - -
---v - - - -
.. - -- - . ~ - . _ . - - . . _ ~ . . - . - . - - . - - . - - . . - . - . . - - . - - -
Topical Report. Revision 0 Control of Hazard Berriers August 14.1998 Appendix B required, have found it beneficial to install barrier feedthroughs (piping with threaded caps) adjacent to the doors. A typical barrier feedthrough may be as shown in Figure B-6. This permits routing of cables and hoses through the barrier under a reusable impairment evaluation which does not involve b!ocking open the door. -
- 2) Equipment qualification In cases where acceptable consequences cannot be demonstrated for steam, radiation or flooding hazard propagation through a barrier .
breach, and entry to the applicable Tech Spec action for the affected equipment is impractical, it may be necessary to qualify some of the affected equipment or cables. This should be considered where the scope of items to be qualified is relatively limited. , d. Other compensatory measure options -
- 1) General considerations To demonstrate acceptable consequences for a barrier breach where suitable attemate barriers or other design features do not exist, it may be necessary to impose restrictions during the breach to:
Eliminate one or more hazards (e.g., secure high energy lines or equipment, drain a tank, etc.), or Reduce the hazards (e.g., duration of flooding event by crediting a flood watch), or Require operability of backup systems and equipment, or
. Secure affected equipment and circuits to eliminate 10CFR50.49(b)(2) interactions.
l l I
- B-7 OF 18
.i e
Topical Report. Revision 0 Control of Hazard Barriers August 14,1998 AppendixB
- 2) Standards for use of hazard watches Hazard watches may be credited to reduce consequences of hazard events that are not hazardous to the watchstander (e.g., some flooding events) provided that:
Ample time is demonstrated to exist for the watch to perform the required hazeM mitigation functions necessary to satisfy existing barrier design basis functional and safety
, requirements. Times shorter than an applicable plant-specific minimum time criterion (e.g.,10 minutes) should be justified by a 10CFR50.59 safety evaluation. And, The watchstander is briefod on the specific actions required, k caisble of performing these functions under the assumed
< .M ons, and is provided with suitable communicatons (e.g.,
to tha control room if required). And, Control room actions, if required in response to a hazard watch notification in less than the design basis response time (e.g., 30 minutes), are justified in a 10CFR50.59 safety evaluation or physically validated.
- 3) Non-EQ Master List configuration controls As discussed in Appendix B, Section B.5.b, credit may be taken for non-EQ Master List equipment if it has been evaluated for the hazard, and its configuration is controlled (e.g., by a program similar to the EQML). A non-EQML program, if credited, must ensure that the equipment is maintained in the appropriate configuration (e.g., only qualified parts of the appropriate model). Because this program will only be credited for the applicable equipment during a limited time (when the barrier is breached), it need not impose other EQML-related requirements such as maintenance schedule or qualified life.
B-8 OF 18 l
Topical Report Revision 0 Controlof Hazard Barriors August 14.1998 Appendix 8
- 7. Document results
- a. General considerations The results of the evaluation, including any required compensatory measures, should be documented in a retrievable form. (Even if the barrier combination evaluated does not recur, the evaluation could serve as a template for other combinations.) A sample format for a barrier evaluation is provided as Attachment B-1. The evaluation should inclu.de:
Identification of the barrier being evaluated (e.g., door number) and description including location. Other concurrent impairments considered in the evaluation, identified by barrier and/or tracking number. A summary of the compensatory measures required. An engineering evaluation of the barrier for each design basis hazard (including those which could be excluded based on other controls, such as fire). The evaluation should also specifically address: Any credited compensatory measures for each hazard. and The impact of the other concurrent impairments. A safety evaluation per 10CFR50.59 criteria if a 10CFR50.59 evaluation is the selected means of control. A 10CFR50.59 evaluation, if performed, should specifically address the compensatory measures being imposed, the impact of implementing such compensatory measures to other aspects of the facility as described in the SAR and any equipment being declared inoperable per the applicable Technical Specifications. It may be useful to build a summary of evaluation results, as evaluations are performed, to support repetitive plant maintenance or construction activities. B-9 OF 18
._ _ _ . _ . . . _ - -__ ._ ..__.m._ .-_.._ ._- _ _. _ _ . _ _ _ . m.__ _ . . . _ . _ . _ . __
J Topical Report: Revision 0 i Control of Hazard Barriers August 14,1998 Appendix B
- b. Special considerations for plant outage conditions {
During outage conditions, many of me design basis hazards are no longer
- present. For example, LOCAs, high energy line breaks and pressure 4
missiles from the main steam and feedwater pipi.ng in the outage unit could i not occur with the unit in cold shutdown, refueling or defueled. Although hazards could still be present from the other unit (in a dual unit plant) or from systems which remain in service (e.g., auxiliary steam, ventilation fans, etc.), many plant barriers can be effectively decontrolled during this period. This permits the barrier evaluations for shutdown to be consolidated, reducing the analysis effort compared to numerous separate evaluations. The consolidated barrier evaluation for shutdown conditions, if used, should be integrated with shutdown risk management (e.g., equipment and cabling required by the shutdown defense-in-depth analysis for each period of the outage should be protected). A sample format for a consolidated shutdown l barrier evaluation is provided as Attachment B-2. .
- c. Barriers with no hazard functions Barriers which are determined to have no hazards functions in any plant mode may be decontrolled. Although not required, experience indicates that conspicuous posting of decontrolled barriers (e.g., doors) can reduce unneeded subsequent requests for evaluation of the decontrolled barrier.
Barriers should be re-evaluated as necessary for hazard functions when introducing new hazards or important to safety SSCs on either side of such - barriers. Provisions should be made in a plant's existing modification / plant change control process to capture such potential configuration changes.
)
B-10 OF 18 L ____. _ - _ . . - . _,
Topical Report. Control of Haud Barriers Revision 0 August 14,1998 l l Appendix B *
~
i i
' /l TRAIN B CONDUIT ,
l
// T
\ FLOOR PLUG / 7(/ i
* ' Y , . l * . '
O FAN (MISSILE) O , l TRAIN A TRAIN B i O - et C) I 1 9 d FIGURE B-1 -INTERACTION BETWEEN TRAINS 4 B-11 OF 18 l l 4
S e CN *8=i= Appendix a SE'u'$ me j
~
\
l l
// '/.
I
/ :
/'
/ '
i
, /
) '
} ,, -Q-4 '
\c x( rVe/ 93 e ,-
j / 5>- . m. (t
/f'
,/ //%
/ \
/[/,
TURBINE BLDG
- h. /
TURBINE BLDG r j, / / / / / SHUTDOWN UNIT OPERATING UNIT l FIGURE B-2 -INTERACTIONS BElWEEN UNITS l B-12 OF 18
cInNiot$rd sarriers $NI,1ess
/,! {/
/
/ \ V:
/ TRAIN B
> { EQUIPMEN
/a ,/
/ b RADIATION DOSE FLOO
/M i f
//l// '
l/
' FLOOD l TRAIN A
/l 4 g l' I
PUMP
!////////// /
NOTE: ONLY ONE EVENT ASSllMED A T A TIME FIGURE B-3 ' HAZARDS ON BOTH SIDES OF BARRIER BREACH B-13 OF 18
Topical Report: . Revision 0 Control of Hazard Barriers August 14,1998 Appendix B d
** PROPAGATION PATH l _
STAIR NO.1 -+ / l SHAFT DOOR A ' 1r _ BLOCKED OPEN HELB SOURCE
.r:q ,
"3=-4 ..'.
Q'. i
&a
'I
, t . I 1
"5,,, +-DOOR B
- g. .. _. . i- L;. .
' ~
. ? .:.. .
>=-
p= __[ Aft:
=W
?P- ,
4-- DOOR C
. a
.1 -s
?! ,
I I
, .- EQ TARGET I !
- <: pj' .,' *- , - - -
*l DOOR D ',
I BLOCKED pPEN ,
.,g
.. r . . _ .
FIGURE B ADDITIONAL INTERNAL BARRIERS BREACHED l B-14 OF 18 4 e
i i i Topical Report. Revision 0 ! Control of Hazard Barriers August 14,1998 l Appendix 8 I 1 l - : l - EXISTING DObR FRAME t
-- GROUT / CAULK
-[, #:g>li '
l' ' l
![
l ',
~ TEMPORARY BULKHEAD
$ 't hl 4
%% vs + q! l .
l
!$. 'b SLOTTED HOLE FOR BRACING lH l 1 .
.l i,1 ,c f +:l +
-Y' l 4+ .
'Ig:D
[
.L:I P'
;< y
'A DOOR REMOVED 1
i FIGURE B TEMPORARY BULKHEAD OVER DOOR l l B-15 OF 18 1 l l
. . .. - - -- _ _ _ - .. -.. -..- - - . . ~ .
Topical Report:
- Revision 0 Control of Hazard Barriers August 14,1998 l
Appendix B l ~ i l l l l l THREADED HOSE , Xa DRAIN FROM HX l CAP 0000 O O 0000 w yE O HROUGHS ROUND
- - CONDUlT a .-
A MINERAL f"J WOOL 9 OR APPROVED OOOg SEAL j e NEW BARRIER f FEEDTHROUGHS y V ( A SECTION A A l [ l
- FIGURE B TYPICAL BARRIER FEEDTHROUGH 9 1
e e B-16 OF 18 i i-
- -- -- .- .- .- =.
i Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 Appendix B A. IMPAIRMENTINFORMATION:
- 1. BARRIER: AC105 2, MO No.:
- 3. Location: Door AC105 connects the control room normal HVAC room in the control room portion of the auxiliary building (fire area / zone 2-AC-9-12, room 107) with corridor 105 (fire areatzone 2- ,
AC-9-16) on the 9' elevation. The door is shown on UFHA drawing 8-5.
- 4. Reason: Block open the door to repair / replace broken latch mechanism B. ASSUMPTIONS: [ Plant-Specific]
- 1. This evaluabon will identify as a compensatory measure, any other barriers that may be required functional to support the conclusions of this evaluation.
C. EVALUATION: [ Plant-Specific Categories] l
- 1. Fire (yes)
Door AC105 is a 3 hour rated fire barrier. Compensatory measures required by procedure ( plant-specific) for impairment of a fire door will be implemented with the door blocked open. Therefore, the planned work activity will not create any previously unreviewed fire hazards interactions.
~
- 2. Missiles (No)
- 3. Flooding (No)
- 4. Unmonitored Radiological Releases (No)
- 5. Ventilation Boundary Issues (No)
- 6. Security issues (No)
Based on a review of the Physical Plan, door AC105 does not perfonn a security barrier function for the s6peret;0u of vital and non-vital areas. Therefore, no previously unreviewed security plan interactions will be created due to the planned work activitses.
- 7. HELB lasues (No)
- 8. EQ Barrier issues (No)
D. CONCLUSIONS Based on the above evaluation, door AC105 performs a hazards barrier function for fire only. The door can be blocked open for repairs provided:
- 1. Fire Protection Department implements the compensatory measures required by procedure ( plant-specific) for impairment of a fire barrier.
E. 50.59 Safety Evaluation [ Perform when a 10CFR50.59 evaluation is the selected means of barrier control] Prepared by: Date: Reviewed by: Date: ATTACHMENT B SAMPLE FORMAT FOR BARRIER EVALUATION B-17 OF 18 4
Topical Report- Rowleton 0 Control of Hamd Serviers August 14,1990 DEFENSE IN DEPTH (DID) SHEET #10A (TRAIN B) EVALUATION REV. O Outage Milestone Period: From: Begin Core Alterations- Mode 6 ID: RCS at 20' 9" SHUTDOWN SAFETY SYSTERA/ TRAIN CREDITED PROTECTED BUILDINGILOCATION REQUIRED CORAPENSATORY AREAS S FUNCTION (PRIAAARY) EQUIPRAENTI ROORA OR AREA BARRERS ELEVATION DECAY HEAT RELtOVAL Shutdown Cooung via Train B HV9326 (33*) PS/207 FH2203 FH2203: (CORE) LPSI Pump MP016 mrough HV9336 (33*) Shutdown CooRng heat - HV9379 (31*) FH2207 Ted Spec. 3.7.9 fire watch exchanger ME003 AC244, FH2207: (Continued) AC244R Tech. Spec. 3.7.9 nre watch. (DID 50.59 Evaluation HV9322 (32') PB/209 2) Todt Spec. 3.9.12.b FHIS door. Seceen VIIt D.1. through HV9325 (33*) ' Vill.D.3.) HV9331 (33-) PS/214 Requires a apar* 50.59 evaluatori under me Interim Barrier Control Prograrn prior to opening these doors REACTIVITY CONTROL Boric Acid Flowpeth - MT005 (30*) Tank BuNdingrTank MT005 Endoeure WaAs N/A, no removable baniers (SFP) HV9300 (30') Note: Vault RWST direct to me sucIlon of Flow e5 version pem SFP pump MP009 or MP010 to only. the SFP. MT006 (30-) Tank Bunding/ Tank MT006 HV9301 (30') Vault MP009 (1T*) FHB/107 FH2103 Tecti. Spec. 3.7.9 Gre watch. MP010 (17*) Floor hatch in FHB None ave 9able, hattfi must remain closed. _ room 209 Prepared By / Date: Approved By / Date-ATTACHMENT B SAMPLE PLANT OUTAGE BARRIER REQUIREMENTS
SUMMARY
TABLE B-18 OF 18
. . . . . . _ . . . . . . . . - . . . . ~ . . . . . - . . . _ . - . . - . . - . - . . -
.-....._- _ -.. . ... . ~.-
l Topical Report: I
- gu 4,1998 j Appendix C i
APPENDIX C DETERMINISTIC / PROBABILISTIC EVALUATION OF BARRIERS EXPERT PANEL APPROACH 1 i C-1 OF 22
_- ~ . - - - - . - - - - - --. 1 Topical Report . Revision 0 Control of Hazard Barriors August 14.1998 Appendix C C. EVALUATING RISK OF BARRIER IMPAIRMENT
- 1. Objective The risk of barrier impairment is evaluated using an integrated decision making approach. Elements of this approach are discussed in Appendices A and B of this report. This section includes the detailed discussion of the use of PRA in evaluating risk of barrier impairments and establishing appropriate controls to minimize the risk of these activities. This section describes the use of an expert panel to integrate these elements and evaluate the risk of hazard barrier impairments.
- 2. Background
~
Before discussing the details of the technical approach, there are some importent considerations / assumptions that should be discussed since they form the basis for the approach. First, in general, the impairment of hazard barriers, if reasonably controlled, should not normally be a risk significant activity. This was confirmed for San Onofre in its barrier study titled, "Probabilistic Risk Assessment Banier Control Program," [6]. That study shows that the average increase in core damage frequency attributable to all barrier impairments is small and that when the results are extrapolated to the plant, is less that SE-07 per year. This low level of risk was calculated using PRA methods and applying reasonable allowed impairment times to the barrier impairments. The combination of low frequency of the initiating event (e.g., a pipe break) and the relatively low unavailability of the barrier results in this low risk profile. Applicability of this conclusion should be verified at other plants. Second, there are certain barrier impairments that may pose a higher risk of core damage than others. These potentially higher risk events can be screened and categorized using a combination of deterministic and probabilistic methods. With this process, all barrier impairments need not be subject to detailed deterministic and/or probabilistic quantitative evaluations. Appropriate screening criteria can be established and only those events judged by an expert panel (or equivalent decision making process) to be in the higher risk significant category need to be evaluated in this detail. C-2 OF 22
Topical neport. Control of Hazard Barriers Revn. ion o August 14,1998 Appendix C Third, quantitative risk significance screening criteria, such as those provided in the EPRI TR-105396, "PSA Applications Guide,"[4] can be applied to hazard barrier impairments. Criteria consistent with this approach can also be developed and applied to determine acceptable (i.e., non-risk significant) allowed impairment times for barriers. The PSA~ Applications Guide provides a reasonable consensus value and is generally consistent with the philosophy of RG 1.174 [3], "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis. When the cumulative core damage frequency criterion of RG 1.174 is applied, the process presented herein provides adequate assurance that the risk of barrier impairment is properly controlled. l The integrated decision making process (IDP) described herein considers the principles described in RG 1.174 to determine the acceptability of impairments to barriers. The technical approach set forth in this topical report differs somewhat from the typical risk-informed application. This is a risk informed approach that improves the operational and engineering decisions involving the control (i.e., - l temporary impairment) of hazard barriers rather than a permanent change to the plant current licensing basis. Thus, the principles described in RG 1.174 may be applied in a manner somewhat different for this application than for others, such as risk-informed Inservice Testing (IST). Nevertheless, applying these principles to control of hazard barriers is beneficial to the overall evaluation and adds consistency to the overall process of controlling plant risk of core damage.
- 3. Integrated Decision Making Process for Evaluating Risk of Barrier Impairments (Expert Panel)
This process can be based on an expert panel which integrates the deterministic l and probabilistic analyses to assure that the overall evaluation is complete and j consistent. An expert panel is not a required component of an integrated risk-l informed decision making process, but when it is used, provides a very useful i means of implementing the key principles and associated decision criteria presented in this Topical Report. For purposes of this Topical, the term " expert panel" is used to describe any equivalent integrated decision making process utilized. The expert panel should consist of individuals who are familiar with the design bases of hazard barriers, plant operations and maintenance related to barriers, and the plant PRA. At least one individual should be familiar with the plant equipment qualification program, the plant fire protection program, the plant systems interaction program and licensing commitments related to each. C-3 OF 22 3 i e _ - _ _ _ _ _ _ . _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ _ _ __.__ ___ ___ - - - - ___ - - . , .- . . . -r
_ _ _ _ , _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ ~ Topical Report Control of Hazard Barriers Revision 0 August 14,1998 Appendix C There are several tasks of the IDP which an expert panel should oversee and include in its review and evaluation. These are to: 1) identify and assemble all applicable licensing basis documents,2) establish exclusion criteria and screening criteria,3) perform qualitative and quantitative analyses and categorize the barriers as more or less safety significant barriers,4) perform a quantitative evaluation, ' including the use of PRA analyses, of the potentially more safety significant barriers, l
- 5) determine allowed impairment times foriaore and less safety significant barriers and apply cumulative impact criteria, 6) establish risk reducing or compensatory l measures for barrier impairments and specify administrative controls, 7) document i the results of tha evaluation and incorporate the results into appropriate barrier control procedures. Each of these tasks is discussed below.
Task 1: Identify and Assemble all Anolicable Licensina Basis Documents The purpose of this step is to assure that all documents important to the expert pa.nel review and evaluation are made available for reference. These documents - include licensing basis documents such as the Final Safety Analysis Report, i technical specifications, design basis documents, etc.; plant procedures and ' maintenance work activities that relate to barrier impairments; and engineering studies, applicable plant-specific and industry data and operational experience information related to barriers. Task 2: Establish Exclusion Criteria and Screenina Criteria The expert panel will approve exclusion criteria and screening criteria for the subsequent screening and classification of hazard barriers. These criteria will be based on accepted practices and may include both qualitative and quantitative considerations / measures. Exclusion Criteria Fundamental to this approach is the consideration that not all hazard barriers need to be evaluated in detail. Exclusion criteria can be established for certain barriers as described below. In addition, a barrier need not be analyzed as part of the initial hazard evaluation if there are no plans to impair it. This is reflected in the frequency of a barrier impairment factor. However, if in the future it is necessary to impair a hazard barrier that was screened at this level, an evaluation of the scope described ~ l in this Topical should be performed. The intent of this approach is that the licensees have some discretion as to the scope of the initial hazard barrier analysis. 1 C-4 OF 22 ,
4 Topical Report . Revision 0 I control of Hazard Barders August 14.1998 Appendir C
~
i Hazards and barriers screened from further evaluation on the basis of exclusion l criteria will be justified and documented. Hazards and barriers which can be 3 excluded are: l Hazards where AITs for the associated barriers are controlled by another
- program (e.g., Fire Protection Technical Specifications, Physical Security Plan as discussed in Appendix B, Section B.2) or the program requires removal of the hazard prior to impairment or restoration of the barrier prior j to the hazard (e.g., work clearance process for whip restraints).
Barriers if historicalimpairment data shows no loss of barrier function. For i instance, in a test example for this program, fire hazards, security hazards,
- HELB pipe whip and severe weather were excluded from the impairment risk i
model consistent with the above. Fixed barrier penetration seals were also i excluded based on impairment history and significance for hazard j propagation. Historically, voluntary and as-lound impairments of penetration seals et one facility involved degradation versus complete loss of the hazard barrier function. Since typical penetration seals are relatively small in area compared to doors or hatches, significant hazard propagation could not have occurred even in the few cases where impairment involved complete loss of the seal. When this approach is used, a separate evaluation should be prepared to document the basis for excluding penetration seals. Screenino Criteria The expert panel will approve qualitative and quantitative criteria for determining the safety significance of barrier impairments (i.e., screening of both hazards and barriers). These will be based on the type of barrier, the equipment it protects, and ' the initiating event frequency. This Topical provides several screening criteria that should be used. Where the criteria used by the expert panel is different from these, the exped panel will provide a basis for the criteria for each such screening factor. The following factors should be used as screening criteria: Frequency of occurrence of the design basis event (i.e., initiating event frequency) Frequency of barrierimpairment Potential consequence of the design basis event Core Damage Frequency and Large Early Release Frequency Change in Core Damage Probability or Large Early Release Probability C-5 OF 22
,-w.,. . . , _ . . ~ . . . , , , - . , , _ _ . - . - _. - - . , , . , , , - - ,
..__ _ _..__....___..._m .._m-._m__.- _ . _ _ _ _ _ _ . . _ _ _ _ _ _ _ . . . . _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ ____ _
l l Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 Appendix C 1 In this topical, each of these is used as a screening factor and a risk significance threshold or qualitative measure is established. Events that are evaluated as greater than the appropriate screening criteria are classified as potentially more safety significant events; those less than the criteria as less safety significant events. Table C.1 provides criteria for each of these factors and a discussion of some of the salient features of each. Freauencv of Initiatina Events l A barrier impairment event can be screened if its initiating event frequency (hazard frequency) is less than 1E-06 events per year. The frequency of the initiating event should be calculated using an accepted approach, for example pipe break events will be calculated using a methodology similar to that used in the IPE flooding analysis or risk-informed in service inspection. The basis for these criteria is the generally accepted consideration that initia+ing . events which occur at a frequency of less than one in a million per year are insignificant to risk. In addition, the San Onofre barrier study [6] calculated initiating l event frequencies for the evaluated scenarios ranging from about one per year to 1E-05 per year. A frequency analysis which results in an initiating event frequency i of less than 1E-06 per year will always screen out when one of the other criteria (e.g., core damage frequency) is applied. l l l n ! C-6 OF 22 _ _ , . . __ - . . . . . _ -. . . . _ ..m_.., , .,
, - I Topical Report. Revision 0 Control of Hazard Barriers August 14,1998 Appendix C Table C.1 Screening Criter's Factor Screening Criteria DiscusslorVBasis Frequency of <1E-06 per year Events with frequencies of less than one Occurrence of the in a million are generally considered to Design Basis Event be insignificant to risk. Frequency of Zero (No This is the planned or known impairment impairmentof the impairments) of the barrier. Barriers that are not Hazard Barrier impaired when the design basis conditions exist can be screened. Potential Very Low The expert panel may establish Consequences of qualitative criteria and provida a basis for i the Design Basis each. For example, a very low impact ! Event classification may be based on one train of a mitigation system being marginally - affected. Coro Damage < 1E-08 per year per These screening criteria are set at two Frequency impairment orders of magnitude less than the values Screening Criteria in RG-1.174 [3] for permanent changes (<1E-06/yr for delta CDF and <1E-07/yr Large Early for delta LERF). These values are Release Frequency < 1E-09 per year per consistent with those used in fire and Screening Criteria impairment flooding PRA evaluations for screening events. Delta Core Damage <1E-08 per These screening criteria are set at below Probability impairment the lower end of the scale from Figure Screening Criteria 4-3 of the EPRI TR-105396, "PSA Applications Guide,"[4]. Release Probability Screening Criteria
<1E-09 per imoairment Table C.1 Screening Criteria C-7 OF 22
.., -, . . . . - - , , , , , - - m- .,.-r --- - , - -
y_______-_-m... . _ . . _ . . - . . . _ . . _ . _ . _ _ . . - _ _ _ _ _ _ . . . _ . . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ . . _ . - _ _ _ _ _ _ _ . 1 1 Topical Report. Revision 0 j Contro of Hazard Barriers August 14.1998
~
ii Potential Conseauence of the Desian Basis Event l The expert panel may establish qualitative criteria for screening barrier impairments. The expert panel will provide a basis for each such criterion. These criteria will be jl used to screen barriers that have been analyzed using deterministic methods where 4 the evaluation shows that the consequences of a design basis event are minimal. For example, a very low impact classification may be based on one train of a mitigation system being marginally affected. l { Core Damaae Freauencv/Laro_ e Early Release Freauency j The core damage frequency screening criteria are established at less than 1E-08
- per year per impairment. Similarly, the large, early release frequency screening j criteria are established at less than 1E-09 per year per impairment. These
! screening criteria are similar to those used in the IPE intemal events analyses and i
- the IPEEE fire analyses. In the screening analysis, screening values for barrier -
~ impairment frequency and estimated impairment duration are combined with an i Initiating event frequency and a core damage probability and compared to the screening criteria. No credit is given to risk reducing measures. The use of these 3 screening values for these calculations are described in Task 4. i i Chanae in Core Damaae Probabilitv/ Chance in Laroe Early R&ese Probability The change in the core damage probability screening criterion is established at less than 1E-08 per impairment. Similarly, the large, early release probability screening
- criterion is established at less than 1E-09 per impairment. This method is based on the lower values in the EPRI TR-105396, "PSA Applications Guide," (4) for i temporary increases in plant risk. This method is also similar to that used to i evaluate configuration risk for equipment out of service for compliance with the
} maintenance rule. In setting this screening criteria, an order of magnitude lower i than the low range shown in Figure 4-3 of the PSA Applications Guide was used. 1 Therefore, the value of 1E-08 per impairment or 1E-09 per impairment is { conservative and appropriate as a screening value. i J e i i l
< C-8 OF 22
- . . . - . _ - _ . _ -. _ . . . - - __ ~_ -~-._. - --- ~ . .._. --_-..-. - - _. _ . -
v Topical Report. Control of Hazard Barriers Revision 0 August 14,1998 Appendix C Task 3. Perform Qualitative and Quantitative Analvses and Cateaorize the Barriers as Lower or Hiaher Safety Sianificant Barriers This task incorporates the quantitative and qualitative considerations of this report. In performing this task, the expert panel will consider the design basis event and the plant responses to the events for each barrier or group of barriers included in its scope. The licensee may choose to use a compartmentalization approach to evaluating barriers based on the fire hazards analysis or the systems interaction program. Such factors as postulated challenges to plant equipment, single failure criteria, and initiating events should be considered. Engineering evaluations should be used where appropriate. Engineering judgment may be used to exclude certain ' propagation paths that are considered to be tortuous and that would be ineffective in creating an unacceptable environment for equipment. The objectives of this task / evaluation are to make a realistic determination of the impact of the design basis' event given that the barrier is impaired, to identify - equipment likely to be failed as a result of the initiating event, and to evaluate the consequences in order to determine if the impairment falls into the potentially higher safety significant category. PRA calculations described in Task 4 below may also be performed as part of this evaluation. This task is not intended to require that a detailed calculation be performed for each scenario. Rather, the judgment of the expert panel may be used and this judgment may be based on qualitative measures. In addition, where a detailed evaluation is necessary to determine the category, one of two approaches will be taken: 1) the - impairment will be classified as potentially more safety significant and a PRA evaluation performed for the scenario as described below; or 2) if no impairments are planned for this barrier, it will still be classified as potentially more safety significant, but the detailed evaluation can be set aside until it is required to support operations. The licensee has the option of evaluating all or some of the hazard barriers in the plant; however, the screening evaluation will address all barriers that have an impairment history. In addition, all potentially more safety significant barriers with an impairment history will be evaluated in more detail. Whenever a hazard barrier is evaluated, it will be done in accordance with this Topical. This task includes an evaluation of how defense-in-depth and safety margins are maintained. This may be done at a global level or at an impairment-specific level. This evaluation is done in part to show how unavailability and reliability are balanced in both the near term and in the longer term. Typically, a hazard barrier impairment is associated with a preventive or corrective maintenance activity or C-9 OF 22
. . _ .-. - . . - . . . - - - ~ - . . - . - - _ . . . - - - _ _ _ - . . - _ _ . . . . - - . - - . - - . . . , _ ~
Topical Report. . Revision 0 Control of Hazard Barriers August 14,1998 Appendix C 1 other plant activity. These other plant activitiea may include design modifications or other plant improvements that reduce the risk in the long term, however, the risk may increase in the short term due to the barrier being unavailable. The total impact of the impairment and the other plant activities should be evaluated collectively, and the impact of these activities on equipment functionality, reliability I and availability, and their relationship to defense-in-depth and safety margin should l be determined. Again, tnis is not intended to require a detailed, quantitative analysis for all scenarios, l Task 4. Perform a Quantitative (PRA) Analvsis where Reauired i This task describes the quantitative analysis that will be performed to determine the ! risk of barrier impairments where this is required. in general, these quantitative l analyses are PRA screening evaluations that provide the licensee with a means of j categorizing barrier impairments, which have not otherwise been screened and ! categorized in Task 3 above, as either less safety significant or potentially more . l safety significant. Those that are greater than the applicable screening criteria are l categorized as potentially more safety significant impairments and are submitted to ! a more detailed evaluation as described later in Task 5. l l For the PRA analysis, an appropriate fault tree model should be developed. The risk models used for this evaluation should be based on the Individual Plant Examination of intemal events (IPE), and Individual Plant Examination of extemal l events (IPEEE), or other appropriate plant-specific Probabilistic Safety Assessment (PSA) models. This approach does not require that a detailed barrier PRA model be developed. Rather, a simplified model can be used to evaluate all barrier impairments. Typically, the event of interest is the induced transient. That is, an event, such as a pipe break, occurs simultaneously with the barrier impairment, potentially creating consequences resulting in a loss of protected and certain other equipment. Because there may be other events that could be caused / induced by the event, Judgment should be used to determine the appropriate fault tree model to be used for the events being evaluated. This model can then be used to calculate the risk of various events using an approach similar to that described l below. 1 i
, C-10 OF 22 i
s
- - -- - c w ,-
- - - . - . . . . . _ _ _ . - . - . . - . _ _ ~ _ - - . - - - . . . . - ... _ _ _ __ - .-
Topical Report Revision 0 Control of Hazard Barriers August 14.1998 A W ixC Task 4.1 Calculation of Core Damaae Freauency Contribution due to Barrier imoairments These calculations are performed to determine the contribution of the barrier impairment to total annual average core damage frequency and large eady release frequency. The calculations can be used for screening to show that any single impairment of a barrier is low risk or for cumulative impact determinations. The core damage frequency contribution is calculated using the approach shown below. A similar calculation is made forlarge early release frequency. This approach / method is similar to that used to screen events in the IPEEE fire PRA or in IPE intemal flooding when evaluating configurations resulting from su;h events. The fault tree developed for the barrier evaluation is quantified with the affected equipment failed and the initiating event frequency set to 1.0 to determine the conditional core damage probability for the event. That is, the CCDPcs is calculated assuming that the equipment, in particular PRA equipment, which is isolated from the effects of a hazard by the barrier, is failed as a result of the initiating hazard and barrier - impairment and that the remaining PRA equipment is subject to random failures. The resulting CCDPc3 is used in the equation shown below. The results are compared to the core damage frequency screening criteria. (Fg ) * (Pau )
- CCDPcs < CDFsc i
Where F,e = lnitiating Event Frequency - Events / Year P,y = Probability the Barrier is Unavailable CCDPcs = Conditional Core Damage Probability of the Configuration CDFe = t 3 Core Damage Frequency Screening Criteria - Events / Year (Ref. Table C.1) Or expanding P,u the equation becomes, (Fe) i * (f,,
- EIT/ 8760) * (CCDPes) < CDF3e l
l Where f,, = Barrier impairment Frequency - Events / Year EIT = Estimated Impairment Time per impairment - Hours A discussion of the important elements of this calculation is provided below, i
~
- C-11 OF 22
_._ __ .. _ __ - _ _ . ~ _ _ _ _ _ . _ . _ _ . . _ . _ . _ . _ _ _ _ _ _ _ _ _ . _ - _ _ e l 1 I { Topical Report i Revision 0 Control of Hazard Barriers August 14,1998 Appendix C j _ a Evaluation Criteria
- The following criteria should be applied to the plant-specific barrier impairment risk j model as part of these calculations
All applicable hazards will be addressed that are not excluded as described i in Appendix B, Section B.2 of this Topical Report or otherwise screened as j part of the IDP. } - Estimation of probabilities of the applicable hazard events (i.e., F,) will be !
- consistent with those in the respective IPE, IPEEE or other approved plant-
- specific risk models. Pipe failure probabilities should otherwise be consistent j
with appropriate generic values (e.g., EPRI TR-102266 " Pipe Failure Study } Update" [5] ). l Hazard consequences will be evaluated deterministically, as described in ] Appendix B of this Topical Report where required. . I - In lieu of evaluating the hazard consequences deterministically, a conditional i core damage probability of 1.0 may be applied in the calculation as bounding j _ and the impairment categorized accordingly. Barrier impairment duration (open time) per year will be determined from the ! applicable estimated AITs and impairment frequency as discussed below. j The barrier open time associated with normal access and egress will be excluded consistent with Appendix B, Section B.1 of this Topical Report. The human actions in the PRA study will be evaluated to determine whether 3 changes should be made to them given the initiating event. Operator action 1- times used in the PRA should be based on a timing analysis (e.g., time to core damage) and should be consistent with existing SAR design criteria, the ; criteria of the applicable SRP [7), or hazard watch criteria described in ' , Appendix B, Section B.6.d.2 of this Topical Report.
- Generic Estimated Allowed Imoairment Times for Barriers In Appendix C, Section C.3, Task 5, standard AITs are developed for banier I impairments. These are either standard non-risk limited or risk limited AITs. For j . the screening calculation described here, a generic estimated AIT of 72 hours (or' i the known unavailability if it is higher than the estimated AIT) for a specific barrier
] impairment is used to determine whether the barrier impairment is more or less j safety significant. 1 j C-12 OF 22 4 . 5
. -- _ _ . - . . . . - - - . - - . . , . . - . - _ - . . _ . . . - . . _ - - . - - _ . - - . - - . . . ~ . .
Topical Report: Revision 0 Control of Hazard Barriers August 14,1998 Appendix C
~
i Barrier imoairment Freauencies Either plant-specific or generic screening barrier impairment frequencies may be used in this evaluation. For screening calculations, generic screening values should be used, unless plant-specific frequencies are known. Conservative generic screening values for impairment frequencies in the following categories based on-test evaluations performed for this program during Modes 1-4 (PWR) or Modes 1-3 (BWR) are: l l For locked / secured barriers, a generic frequency of 0.5 per year should be ! used, (0.75 per year for Modes 5, 6, (PWR) or Modes 4, 5, 6 (BWR) and I defueled ). l . For unlocked / unsecured barriers, a generic frequency of 3.0 per year should l be used, (8.0 per year for Modes 5, 6, (PWR) or Modes 4, 5, 6 (BWR) and defueled ). Fixed barriers and mitigation systems shou!d be plant-specific values. l Plant-specific historicalimpairment frequencies could be used for each category of ; l applicable barriers. This data can be obtained from the existing fire protection program records or through the review of existing work control records for each I ! plant. Fire barriers encompass a sufficient portion of all plant barriers (e.g.,50%) I to provide representative data for this use. Impairment frequencies should be obtained for fixed barriers; locked and unlocked barriers; and mitigation systems. Locked barriers include locked doors, hatches requiring lifting gear, etc. Typical locked doors include vital area and health physics boundary doors. Fixed and locked categories may be combined. Modelina imoairment combinations Applicable barrier impcinnent combinations will be considered for propagation of the hazard in each event. Impairment combinations expected to occur concurrently (e.g., for related work activities, such as maintenance in multiple areas during a train I outage)will be considered as a single impairment where appropriate. That is, the combination should be modeled with a single impairment frequency f, = f and the conditional core damage probability for that combination should be calculated. C-13 OF 22 l l
. . . . - . - . - - ~. . . -- - ~- - -.__ --.-.- . - . . . . - - - .- . . _ - .
Topical Report. Revision 0 Control of Hazard Barriers August 14,1998
!.~unx c Verification of oroaram imoacts This Topical assumes that the generic values of barrier impairment time and frequency of impairment are more limiting and uses these values in the screening calculations. The licensee should verify that this assurrction is reasonable for its application. Actual impairment frequencies should be verified after program implementation, in order to use plant-specific data and to verify that the frequencies have not significantly chenged as a result of permitting impairments under the AITs.
Task 4.2 ' Simolified Calculation of Chance in Core Damaae Probability oer imoairment This calculation is used to determine the change in core damage probability l l attributable to each barrier impairment. It can be used in lieu of Task 4.1 to ' l determine whether an impairment is more or less safety significant using the - i screening criterion presented in Task 4. The difference between the calculation as described in Task 4.1 and this calculation is that Task 4.2 does not account for a l barrier impairment frequency. The simplified equation is: l ACDP = (CDFcs
- Duration /8760 ) < ACDPsc Where:
ACDP = Changein Core Damage Probability CDFes = Configuration-Specific Core Damage Frequency l Duration = Duration (Estimated Barrier impairment Time) l The Configuration-Specific Core Damage Frequency is calculated assuming the i barrier is unavailable using the following equation: l CDFcs = Fe i
- CCDPcs Where F,, and CCDPc3 are as previously defined in Task 4.1 above.
For these calculations, a screening value for duration is used unless a specific estimated impairment time is more appropriate. (This duration is the generic estimated Allowed Impairment Time). In addition, the evaluation criteria and the' other considerations discussed in Task 4.1 above apply to these calculations. l C-14 OF 22 4 _ ,~ -- - w. . , , . --,.n- - -n . , _ - . - _ _ - - - - - _ _
l l Topical Report: Revision 0 Control of Hazard sarriers August 14.1998 Appendix C Task 5. Determine the Allowed lmoairment Time for both the More Safety Sionificant Hn7ard Barriers and the Less Safety Sionificant Hazard Barriers Tne PRA evaluation described in Task 4 above is used to categorize the barrier's impairments as either less safety significant or more safety significant. Those that screen in the above tasks are in the less safety significant category. These impairments are controlled u' sing the standard allowed impairment times developed in Task 5.1.1. Those that do not pass the screening criteria are classified as more safety significant barrier impairments. These impairments are evaluated further as described in this task. For those hazard barrier impairments where the generic estimated allowed impairment time, using screening values, results in exceeding the screening criteria, a further analysis will be done. The purposes of this analysis are twofold: 1) to establish standard risk-limited allowefmpairment times for barrier impairments, and
- 2) for certain impairments, to estabiish the maximum allowed impairment time for the configuration. Recall that in the screening calculation, the generic estimated allowed impairment time is assumed to be 72 hours and the core damage frequency screening criterion is <1E-08 / year per impairment. Additionally, in the screening calculations, no risk reducing measures are credited to reduce the estimated core damage frequency.
Task 5.1 Establishina Standard AITs The licensee will establish standard AITs for both risk-limiting and non-risk limiting configurations. This Task establishes methods to determine these standard allowed impairment times. Task 5.1.1 Standard Non-Risk-Limited AITs The standard non-risk limited AITs are applied to the less safety significant impairments. This time is established by the expert panel. It should be flexible enough to allow enough time for the typical need. This Topical recommends a standard non-risk limited AIT of 72 hours without risk reducing or compensatory measures. This time is based on the San Onofre probabilistic barrier evaluation (6) and is consistent with the conservative approach used for screening. Based on an C-15 OF 22 4
_ ___ _ __ . . ...~.m_-_ _ . _ _ . _ _ - . _ . . _ . . _ _ _ . _ . - - _ . . . . _ . . _ _ _ ~ _ _ _ _ Topical Report. Control of Hazard Barriers Revision 0 August 14,1998 Appendix C actual barrier impairment need, Licensees may choose to conservatively apply an administrative limit below the standard non-risk limited AIT to provide an additional measure of control of plant risk. However, such barrier impairment administrative time limits can be extended up to the pre-approved standard non-risk limited AIT, as needed to support an activity without additionaljustification. To extend a barrier impairment time beyond the standard non-risk limited AIT, the application of risk reducing measures may be used as discussed in Task 5.1.3. l Task 5.1.2 Standard Risk-limited AITs The standard risk-limited AITs are the standard times permitted by the risk criterion for more safety significant hazard barriers. The standard risk-limited AITs shall be established in a conservative manner to keep the risk of these activities as low as reasonable. For this reason, the standard risk limited AITs are still based on the low i screening criteria. l There are two methods that may be used to calculate the standard risk limited AIT. The first method is the generic approach which applies the twelve (12) hour standard risk limited AIT which shows that the top 20 potentially more safety l significant impairments all screen at this value. The second method is a plant-specific approach which bases the standard risk-limited AIT on a limiting allowed impa!rment time for the more safety significant impairments. Both of these methods provide for certain of the highest safety significant impairments (called critical impairments) to be evaluated separately. That is, these critical impairments do not need to be included in the standard risk-limited AIT determination. However, they are evaluated to establish a configuration-specific AIT and to assure that the cumulative impact on core damage frequency of these impairments is acceptable. Task 5.2 of this report describes establishing a configuration-specific AIT. Task 5.3 of this report describes the cumulctive effects evaluation. l i C-16 OF 22 f w_ _ _ _ _ - -
i Topical Report: Revision 0 Control of Hazard Barriers August 14.1998 Appendix C Generic Acoroach For this approach, a calculation like that shown in Task 4.1 above is done using the twelve (12) hour AIT in place of the EITin the equation for each of the top 20 impairments, where the ranking is determined by their contribution to core damage frequency. The objective is to demonstrate that the screening criteria are met for each of these impairments. There may be some impairments for which this is not possible to demonstrate. In this case, the impairment can be eliminated from the group and designated a critical barrier. Special considerations may be applied by the expert panel to determine whether this impairment should be undertaken. These considerations are discussed in Task 5.2. If the evaluation of the remaining impairments shows that they meet the criteria using the generic value, the twelve-hour time can be used as the standard risk-limited AIT. In performing this evaluation, the following considerations apply. The most realistic values for conditional core damage probability and frequency of barrier impairment should be used. No risk reducing measures should be credited. Plant-Soecific Acoroach This method bases the standard risk-limited AIT on the limiting allowed impairment time for the more safety significant impairments. This approach may allow a longer standard risk-limited AIT to be established for the plant. For this approach, a study should be performed of approximately the top 20 potentially higher safety significant impairments. The allowed impairment time for each configuration is calculated using the following equation: AIT = [ (CDF,c) * (8760) ] / [ (CCDPcs) * ( F,, ) * ( fa, ) ] Where the variables are as described above. C-17 OF 22
l Topical Report. Revision 0 Control of Hazard Barriers August 14,1998 Appendix C Allowed impairment times are calculated using this equation with the following considerations: The most realistic values for conditional core damage probability and frequency of barrier impairment may be used.
. No risk reducing measures should be credited.
The objective in this evaluation is to determine the range of AITs and select the most limiting that will be applied in practice as the standard risk limited AIT. This most limiting case from the initial study may be determined to be unacceptably small for the standard impairments anticipated for the plant. In these cases, the impairments can be eliminated from the group and designated as critical barriers. Special considerations may be applied by the expert panel to determine whether this impairment should be undertaken. These considerations are discussed in Task 5.2. - The standard risk limited AIT may be extended through the application of risk reducing measures. This is discussed in Task 5.1.3 below. Task 5.1.3 Extendina Standard AITs Standard non-risk limited and risk limited AITs can be extended. First, if a generic non-risk limited or risk limited AIT value was used in the initial screening, then a calculation using an extended estimated impairment time (and frequency) can be performed as described in Tasks 4.1 and 4.2 above. If this calculation shows that the impairment screens using the screening criteria in Table C.1, then the barrier impairment time can be extended accordingly. Second, the barrier impairment time can be extended using risk reducing measures. The evaluations used to develop the standard non-risk limited end risk limited AITs described above did not credit actions that might be taken to reduce the risk of a barrier impairment. ' The calculated risk of a bamar impairment can be reduced through the application of risk reducing measures. This reduction allows a commensurate increase in the standard allowed impairment time while keeping the risk less than the original screening cnteria. In applying the risk reducing measures, qualitative and quantitative bases are used to reduce the conditional core damaga probability of the impairment and the extended AIT is calculated as described above. C-18 OF 22
Topical Report Control of Hazard Barriers Revision 0 August 14.1998 A WizC Suitable risk reduction measures may consist of hazard watches or non-design basis temporary barriers to reduce the consequences or improve the human reliability for the event. Also, measures which reduce the likelihood or severity of the initiating hazard may be used. See Appendix B, Section B.6 of this Topical Report for guidance. Apply these risk reducing measures and calculate the risk and - the associated AIT. If this is unsuccessful, impairment of the applicable barriers should be evaluated as described in Task 5.2 below. Task 5.2 Estahlishina Confiouration-Soecific Risk Limited AITs. "Critiemi Barriers" This task provides a methodology to determine allowed impairment times for configurations that are outside the risk profile for the standard risk limited AITs, that is, those that are categorized as critical barriers. These configuration-specific risk limited (CSRL) AITs are determined by evaluating the configurations on a case - basis, adjusting the AIT to a value consistent with the estimated barrier impairment time for the work activity or to a generic time, then summing the core damage frequency contribution for each of the configurations and applying the cumulative risk criteria in Task 5.3. In this calculation, first, the annualized core damage frequency is calculated for each configuration. (F,) * (f ,
- EIT/ 8760) * (CCDPcs) = CDF, Where F, =
Initiating Event Frequency - Events / year CCDPc3 = Conditional Core Damage Probability of the Configuration CDF, = Core Damage Frequency for impairment q - Events / Year
/,, =
Barrier impairment Frequency - Events / year EIT = Estimated impairment Time per impairment - Hours The following considerations apply for these calculations: The most realistic values for conditional core damage probability and frequency of the initiating event may be used. ' C-19 OF 22
1 ! Topical Report: i~ Revision 0 Control of Hazard Barriers August 14.1998 Awin c
~ ,
i The conditional core r!amage probability is calculated both with and without i risk reducing measures app. lied. Then the core damage frequency contribution for each of the impairments of critical barriers is summed and shown to be less than 1E-06 events per year. I CDF,< 1E-06 These steps are performed on an iterative basis until acceptable configuration-specific risk limited (CSRL) AITs are determined, consistent with cumulative risk. Each of these configuration-specific risk limited AITs will be reviewed and approved i by an expert panel or equivalent decision making process.
)
l The CSRL AIT in this calculation will be based on no risk reducing measures, however, the AIT can be extended using the method described in step 5.1.3 above. - 1 If the configuration specific risk limiting AIT calculated for the barrier impairment is insufficient to perform the proposed work activity, the licensee should: 1) not perform the adivity or 2) perform a 10CFR50.59. safety evaluation crediting i applicable compensatory measures or 3) submit a request for a review to the NRC i since it constitutes a departure from the approach of this Topical. l l Based on analyses performed in accordance with the methodology similar to that described in this Appendix, plant-specific standard AITs can be developed without requiring a submittal to the NT.C. Examples from San Onofre of such AITs are-provided below. i i Example Standard non risk limited AITs (san Onofre Plant) AIT Purpose and Basis I 72 hrs To restore bemers. (This AIT is needed to support typical maintenance on equipment and barriers.) 7 days To restore barriers with risk reducing measures in place. (This AIT is needed to support major equipment maintenance.) C-20 OF 22 e, , . .-. _, - - - _ - -_ _ _ _ . -
Topical Report Revtlon 0 control of Hazard sorriers August 14,1998 Appendix c Example Standard risk-limited AITs (San Onofre Plant) AIT Purpose and Basis 2 hrs To restore higher safety significant barners or implement risk-reducing measures (e.g., post a hazard watch). 12 hrs To restore higher safety significant barriers. (This AIT is needed to implement risk reducing measures and support essential maintenance on barriers such as doors.) 7 days To restore higher safety significant barriers with risk reducing measures in place. (This AIT is needed to support maintenance on higher safety signifcant barriers and the equ'pment they protect.) Task 5.3 Evaluatina the Cumulative Imond of Barrier imoairments In this task, an evaluation will be performed to provide assurance that the
~
cumulative risk of barrier impairments is acceptably low. For this purpose, a criterion has been established, namely the cumulative impact on core damage frequency of < 1E-06 / year. This value is consistent with the cumulative impact criteria specified in RG 1.174 [3] for permanent plant changes. This evaluation will be performed at the completion of the screening evaluation and will consider all those barriers that were classified as critical barriers. All other barriers are insignificant contributors to core damage frequency and need not be considered. The bases for this determination is the conservative screening and the establishment of conservative standard AITs. The application of this evaluation to the determination of allowed impairment times for critical barriers is described in Task 5.2. In evaluating the cumulative impact of barrier impairments for reporting purposes, the following considerations apply: 1) the most realistic values for conditional core damage probability and frequency of the initiating events may be used, and 2) the conditional core damage probability is calculated both with and without risk reducing measures applied. If known risk reducing measures are applied to the specific impairments, the cumulative impact on risk should be determined with these measures applied. When compensatory measures are applied consistent with a 10CFR50.59 safety evaluation, the barrier is considered to be functional and no increase in risk of core damage occurs as a result of the impairment. Thus, this impairment need not be accumulated to the < 1E-06/ year criteria for the period the compensatory measure is in place. C-21 OF 22 W -
_ . . _ . _ _ _ - . _ _ _ . _ _ _ . _ . - - _ . ._._._._m. . . . _ . _ __ _ _.. _ _ . _ _ . . . . _ _ _ _ . _ . . . ._ . . _ 3 Topical Report. Revision 0 Control of Hazard Barriers August 14,1998 7 Appendix C 2 1 A Task 6. Establish Risk Reducina or Comoensatorv Measures for Barrier imoairments and Soecifv Administrative Contro!s The expert panel should establish risk reducing or compensatory measures for barrierimpairments. A systematic evaluation of the impairments and risk reducing or compensatory measures should be performed and documented. This is not to require that such measures be established for all barrier impairments rather that the overall philosophy on the application be evaluated. Risk reducing measures are identified by the expert panel, and have been analyzed and shown to reduce the overall risk for a given barrier impairment. Risk reducing measures can include any of the compensatory measures discussed in Appendix B, Section 6.d and Appendix C, Section 3, Task 5.1.3. The application of compensatory measures is discussed in detail in Appendix B, Section B.6. Task 7. Document the Results of the Evaluation and incoroorate the Results . Into Anorooriate Barrier Control Procedures The risk analyses for barrier impairments shall be documented consistent with the Licensee's standard format for risk analysis reports. The analyses should be referenced in the applicable Design Basis Documents and/or plant procedures. Quality-affecting record retention criteria shall be met at all times. C-22 OF 22 4 h
. . - ... - ~. .-. - . . . . . . . , . . . . . . - . . . . . , . . . . . . . . - . . . . . - - - . . . - . . - . . . . - ~ ~ . . . . - . - . . . Topical Report: Revision 0 Controlof Harard Barriers August 14,1998 Appendir D 1 4 APPENDIX D SAMPLE LICENSEE ADMINISTRATIVE CONTROLS D-1 OF 14
Topical Report: Centrol of Hazard Bariiers Revision 0 j August 14.1998 Appendix D D. SAMPLE LICENSEE ADMINISTRATIVE CONTROLS FOR < PROBABILISTIC BASED AITs . l (Some Terminology is specific to a particular PWR dual-Unit test example) 4 This example of Licensee administrative controls consists of hazard barrier control program procedures for a facility in which barriers for structures (e.g., whip restraints) are controlled 4 by another program. The example therefore addresses only systems and components (equipment). The facility evaluated for this example has hazard events which can occur I in all modes due to interconnections with an adjacent unit. One event (circulating water pump discharge expansion joint rupture flooding) results in sufficient risk from barrier impairments to require that the AITs be reduced for all barriers in order to meet the cumulative risk criteria. The sample procedure has 3 tables. Table 1 contains the most risk-significant hazard . barriers. Table 2 contains the less risk-significant hazard barriers. Table 3 contains the barriers with no hazard functions. This approach permits evaluation, within the specified procedural contingency actions, of any barrier subsequently determined to have been omitted from the tables. Tables 1 and 2 have common keynotes. Table 3 has separate keynotes. The example begins on the next page. I 1 D-2 OF 14
i Topical Regat: . Control of Hamd Barriers Revision 0 August 14.1998
.AWix D GENERAL CONDITIONS:
NORMAL DESIGN CONDITION: Hazards barriers shall be functional. I VALIDITY STATEMENT: Effective mm dd, yyyy APPLICABILITY: When equipment protected by the hazards berrier , is required to be operable. ACTIONS: NOTES:
- 1. Separate Condition entry is allowed for each hazard barrier.
- 2. For as-found conditions, Procedural Contingency Action entry begins at the time of discovery. Non-conforming or degraded as-found conditions should be processed in accordance with the guidance provided in Generic Letter No. 91-18, Revision 1 [2].
Reportability of as-found conditions shall be determined in accordance with 10CFR50.72 and 10CFR50.73 [1].
- 3. LCOs 3.0.3 and 3.0.4 do not apply except as specified herein. ~
CONDITION A: Condition-Most Risk-Significant Barriers (Shown in Table D-1) not functional while applicable hazards can occur. Raouired Actions and Comotetion Times (AITst
- 1. Implement the risk reducing measure for each applicable hazard shown in Table D-1 within [ plant-specific time (Note 1)], or
- 2. Complete a specific 10 CFR 50.59 evaluation to justify further impairment with associated compensatory measures for each applicable hazard shown in Table D-1 within [ plant-specific time (Note 1)] , or
- 3. Restore barrier to functional status within [ plant-specific time (Note 1)], or
- 4. Remove the applicable hazards within [ plant-specific time (Note .1)].
- 5. With risk reducing measures in place, if applicable, restore barrier, or complete a specific 10CFR50.59 evaluation with applicable compensatory measures within [ plant-specific time (Note 1)].
Note 1: Plant-specific times justified based on the guidelines of Appendix C D-3 OF 14
- . _ . . _ . . . . __ . _ . . _ _ . ~ _ . _ . _ . . _ _ _ _
Topical Report Revision 0 l Control of Hazard Barriers August 14,1998 l Appendix D CONDITION B: l Condition: Less Risk-Significant Barriers (Shown in Table D-2) not functional while applicable hazards , j can occur. ' ! Raouired Actions and Comoletion Times (AITs):
- 1. Implement the attemate barrier for each applicable hazard shown in Table D-2 within l 72 hours, or .
l 2. Implement risk reducing measures for each applicable hazard shown in Table D-2 l within 72 hours, or
- 3. Complete a specific 50.59 evaluation to justify further impairment with associated compensatory measures for each applicable hazard shown in Table D-2 within 72 hours, or l l
l
- 4. Restore the barrier to functional status within 72 hours, or
- 5. Remove the applicable hazards within 72 hours.
l CONDITION C: Condition: f Hazard banier not shown in Tables D-1 through D-3 not functional. l Reauired Actions and Comoletion Times (AITs): l l
- 1. Complete a 50.59 evaluation to justify impairment with associated compensatory i measures within 24 hours, or l 2. Restore the barrier to functional status within 24 hours.
l I l 4 D-4 OF 14 l i
, . -. . . . - . . ~ . . . . . . -~. -._ _ . . .. .. . . - . . . . . . Topical Report Control of Hazard Barriers Revision 0 August 14,1998 Appendix D CONDITION D: 1 Condition: Required actions can not be met for conditions A, B or C. Reauired Actions and Comoletion Times (AITsh
- 1. Declare the protected equipment inoperable and enter the applicable Technical l Specification Action, ;
j l l ! l i l l i h
- D-5 OF 14
Topleal Report. Control of Hazard Barriers Revision 0 August 14,1998 AppendlwD i l KEYNOTES FOR TABLE D-1 AND TABLE D-2 I i PROTECTED PROTECTED SYSTEMS HAZARD SOURCE AREA APPLICABLE HAZARDS ALTERNATE BARRIERS COMPENSATORY l l EQUIPMENT AREA (Applicable T/S) MEASURES l PROTECTED EQUlPMENT AREA: ' The plant area number (unit, building, elevation and area) which the specified barriers protect from the APPLICABLE HAZARDS. This area may contain the i PROTECTED SYSTEMS or (if the other walls / floors of the area are not sealed agemst the hazard) serve as a buffer space against propagation of the hazards into the areas in which the PROTECTED SYSTEMS are actuaNy located The specified bemers include WALLS, FLOORS, PENETRATION SEALS, DOORS, WATER-TIGHT (WT) DOORS, and HATCHES as applicable (Conduit seals are considered PENETRATION SEALS in this table) . The foNowing abbreviations are used for buildings: , AC: AuxHiary BuHding (Control Area). Indicate if this building / area is common to both Units of a dual unit plant . AR: AuxHiery Building (Radweste Area). Indicate if this building / area is common to both Units of a dual unit plant . . CT: Cable Tunnel. DG: Diesel Generator BuHding. Each unit has its own D'esel Generator Buuding. FH: 1 Fuel Handling Building. Each unit has its own Fuel Handling Building. PE: . Penetration Building. Each unit has its own Penetration BuHding. ' SE-Safety Equipment Building. Each unit has its own Safety Equipment Building. ; TB: Turtune Building. For a dual plant indicate if each unit has its own Turbme Building. Indicate if portions of the Turbine are common to both Units, including the intake structure area and Saltwater Cooling System piping tunnels. TK: Tank Building. Each unit has its own Tank Building. i i YD: Yard Area. Yard Areas 2-YD-30-200A and 2-YD-30-2008 are the Unit 2 + common and the Unit 3 yard areas, res These area designations are used for the roof areas of buudings for which a separate area designation is not assign D-6 OF 14
-. j
Topical Hoport: Revision 0 l Control of Haterd Barriors - August 14,1998 AppendixD i PROTECTED SYSTEMS fAnolicable T/S): The safety related and safe shutdown system trains located in the PROTECTED EQUlPMENT AREA, and the Technical Specificabons which apply if they mest be declared inoperable. The specific systems are identified in the applicable UFHA sections for each area. Cable is not included (based on original plant qualification) unless missile hazards apply to the area. Due to the large number of systems / trains in some areas, this may be shown as Various (Train A/B) or similar. If the area is a buffer space for adjoining areas containing protected equipment (see discussion under PROTECTED 12QUIPMENT AREA above), the designation for the area containing the protected equipment is listed in this field instead (e.g.. (2-AR 09-076)). In Modes 1-4, N the PROTECTED SYSTEMS must be declared inoperable and: a) the affected areas have not been evaluated for 10 CFR 50.49(b)(2) effects, or b) if both trains of required systems must be declared inoperable and this is not specifically addressed under the system Technical Sp6dhM, then Tech Spec 3.0.3 applies. In Modes 5/6/Defueled, one or more equipment Technical Specifications and the Fire Protechon technical control documents also apply to most barriers, but may be controlled through a separate program / process. ~ HAZARD SOURCE AREA: The plant area number (unit, building, elevation and area) in which the APPLICABLE HAZARDS may exist without credit for attemate bemers. These hazards (e.g.. line break events) may occur in the specified source area, or propagate through the specified source eres from cnother locahon (e.g.. through a corridor from the turbine building). The same abbreviatens are used as defined for hazard source areas, above ' APPLICABLE HAZARDS: The Environmental Qualificaten (EQ) and intemally-generated missile hazards that apply to the specified source area, includog steam, radiation and flooding. The hazards are applicable in all Modes unless othenmse specified (e.g., Mode 1-4. or Mode 5/6/Defueled for PWRs). If no hazards apply in the Mode, this is shown , as (none). The following hazard abbreviations are used in conjunction with the building abbreviations defined above to define the source location: ' ASLB: Auxiliary Steam Line Break (for example, ASLh (50*AR)). Postulated ruptures of the non-seismic auxiliary steam line result in direct release of high ' temperature steam (366* F) and flooding due to steam condensation ASLBs in the AR building are assumed to drain to the 9' PB and Shutdown Cooling Systej piping tunnels. This hazard applies in all Modes. CWS flood: Circulating Water System flood. Postulated ruptures of the non-seismic cuculating water system in either unit results in flooding of both turbin to elevation +10*6". This hazard applies in all Modes i FWLB: Feedwater Line Break. Postulated ruptures of the non-seismic main feedwater system results in direct release of high temperature steam (d j and flooding with jet impingement effects. This hazard applies in Modes 1-4. Some common areas are affected by a FWLB in both Units. i D-7 OF 14 i
Topical neport Control of Hazard Barriers *8 August 14,itse AppensNx D i i intomal flooding: Flooding due to fire suppression system opershon or postulated ruptures of piping (including condensation from steam line "Intemal" distinguishes these events from flooding due to extemal sources (e.g.. probable maximum precipitation events), which are address; Weather response procedures This hazard applies in all Modes. I t Internal missiles: Postulated missiles from rotating equipment and high energy lines. "Intemal* distinguishes these events from missiles due to extei (e.g., tomado missiles), which are addressed by the Severe Weather response procedures This hazard applies in all Modes. t r LDLB: Letdown Line Break. Postulated rupture of the Letdown system piping will result in direct release of high temperature sh Portions of the Letdown system piping in area AR are non-seismic. This hazard applies in Modes 1-4. Some common areas are affected by LOCA: Loss of Coolant Accident. Postulated rupture of the Reactor Coolant System in containment with TMI source terms is assumed t i of airbome activity to the Penetration Building and Safety Equipment Building (LOCA airborne), and in gamma dose via shine from cont! and post-acodent recirculation piping (LOCA shine). Doors (other than R-suffix designated shield doors) do not perform a barrier function for hazard applies in Modes 1-4. Some common areas are affected by a LOCA in both Units. , MSLB: Main Steam Line Break. Postulated rupture of the main steam lines results in direct release of high temperature steam wit ! flooding Some common due areas to condensation. are affected by aMain MSLBsteam in both piping Units. in area TB, and portions of the main steam lines in area SE are non-seismic. This h ! SDCB: Shutdown Cooling Break. The shutdown cooling system is a high energy system only during Mode 4 operabon. Postulated cooling piping under these conditions will result in direct steam release (due to flashing) and flooding , Tsunaml flooding: ! additive to other concurrent sea conditions (including tide, storm surge and wave action). This haza ALTERNATE BARRIERS: Barriers or actions which provide equivalent iwviection against the specified hazards. For example, closing the Control R against MSLB steam equivalent to that provided by the normal barrier doors. Non-load bearing interior walls can not be credite postulated pipe ruptures (e.g MSLBFWLB outside containment) or for LOCA dose hazards, due to failure modes a if shown is no ALTERNATE as (none required). BARRIERS are defined, this is shown as (NONE AVAILABLE). If the hazards do not apply in , D-8 OF 14
. _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ _ . - . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ . _ _ _ . ___._________m.____.__
Topices neport: novieson o ceneral of Hemord aanlers Aueust 14,1998 Appendix D COMPENSATORY MEASURES: Actions which temporarRy eliminate the hazard or reduce its consequences to an acceptable level. For example a) Securing a system needed fd unrestricted power operation (e.g.. auxBlary steam) can temporarty eliminale a hazard; b) Posting a flood watch can reduce a hazard by changing the assumed duration of the flood source from 20 minutes (design basis) to 10 minutes if no CORAPENSATORY MEASURES are defined, this is shown as (NONE AVAK.ABLE). If the hazards do not apply in certain Modes (e.g.. Modes 5/6/Defueled), this is shown as (none required). Tables 1 and 2 are sorted by PROTECTED EQUIPMENT AREA (unit, building, level, area number, room number). Within each PROTECTED EQUIPMENT AREA, ' entries are further sorted by HAZARD SOURCE AREA (unit, butding, level, area number, room number). Leading zeroes are included in the level and area numbers (e.g 2-ACM vs. 2-AC-9-5) for correct sorting. Table 1 identines the most risk-significant barriers, in one section. Table 1 identifies the most risk-significant barrers, in one section. Table 2 identifies the less risk-significant barriers, in 4 sections (for Protected Equipment Areas AC, AR, CT through PE, and SE through YD). b D-9 OF 14 , e
L Topical Report: Revision 0 CM of Hazard Barriors August 14.1998 Appendix D t L TABLE D-1: MOST RISK-SIGNIFICANT BARRIERS (SAMPLE) , a PROTECTED EQUIPMENT PROTECTED SYSTEMS HAZARD SOURCE APPLICABt E HAZARDS ALTERNATE BARRIERS AREA (Applicable TtS) AREA COMPENSATORY MEASURES ' 2-AR-04076 (2M-09, aN areas) 2-AC OH05 CWS flood (TB2) (NONE AVAILABLE) (Rm 103M,118), vta: l Wilhin <clant4cecinc Gme> : T:S 3.0.3 (Rm 111A) CWS flood (TB3) 1 Post flood watch in Turbine i Bldg i WAR, PENETRATION SEALS 5 elev 10'6" 2-SE+15)-136 Various Train NB 2-TB-07-148A CWS Good (TB2) WenNn <otante time > : (Rm 017), via: (NONE AVAILABLE) (T/S 3.0.3) (Rm T2-101) CWS Hood (TB3) Post Sood watch in Turbine Building, and WALL. See Table D-2 (area 2-SE-{- PENETRATION SEALS. 15)-136) for requirements WT DOOR: S2006 Within colant-soedfic tirne> : , appEcable to other hazards Berm as openings to 2 elev F S2009 5 elev.1015" See Table D-2 for Does ogt include Bkxi Wall requirements applicable to other hazards : L 2-SE-(-15) 136 Various Train NB 2-TB-07-148A CWS flood (TB2) (Rm. 017), via: (NONE AVAlt ABLE) Prior to breadt Post flood (T/S 3.0.3) (Rm. T2-101) CWS flood (TB3) s watch in Turbine Building. : BLOCK WALL and See Table D-2 (area 2-SE- berm opening to 2 elev 9.or S elev.1015* (-15)-136)forrequirements applicable to other hazards Complete a specinc 50.59 evaluason See Table D-2 for i requirements applicable to other hazards D-10 OF 14 - _ __-__ - - _ _ _ - _ _ _ m-. m__- __ - -- - - - - - - - - . - - - - - - - - - - - -- - = - - - - - - - - - - - 3
_-..-.~...-.
. . . - . - - - - ~ - - -
t Topical Report: Revleton 0 Control of Hasard Barriors August 14,1998 AppendixD TABLE D-2: LESS RISK-SIGNIFICANT BARRIERS (SAMPLE - SHEET 1 OF 2)- i PROTECTED EQUIPteENT PROTECTED SYSTEMS HAZARD SOURCE APPUCABLE HAZARDS AREA ALTERNATE BARRIERS COREPENShTORY (Applicatsie T/S) AREA MEASURES 2-AC 4-5)-169 ECWS Train A/B 2-AC 09-012 Inlemal missgos (ECWS piping tunnel).via: (NONE AVAlt.ABE) Secure fan unit (T/S 3.7.10 (Rm 107) SA1510ME295 ROOF, Elec Train B PENETRATION SEALS, (T/S 3.8.9. 3.8.10
- HATCH: manhole l
2-AG49-(ad except 2-AC Various Train A/B 2-AC-30 nnn 014), via: Intemel f.GeG.s (NONE AVAILABLE) Berm an epenings to > elev (T/S 3.0.3) (a5 except 2-AC-30-028) 31*-9" ROOF, PENETRATION SEALS 2-AC-09408 Mode 1-4. 2-TB47,1488 Mode 1-4. (Rm 114). vla- (2-AC-09, all arees) (NONE AVAILABE) (NONE AVAILABE) (Rm T3-102) MSLB (TB2) T/S 3.0.3 WALL. MSLB (TB3) PENETRATION SEALS. FWLB (TB2) DOOR. AC119 FWLB (TB3) CWS flood (TB2) CWS Sood (TB3) Mode h Mode 5/6/Defuel (2-AC49, aR aremo) (840NE AVAILABLE) MSLB/FWLB. MSLB (TB3) T/S: See keynotes FWLB (TB3) CWS Hood (TB2) g pgw w) g (NONE AVAILABLE i' Turtaine Bldg CWS Hood (TB3) D-11 OF 14 4
Topical Report: - Revision 0 Control of Hazard Barriers August 14,1998 Appendu D TABLE D-2: LESS RISK-SIGNIFICANT BARRIERS (SAMPLE - SHEET 2 OF 2) PROTECTED EQUIPMENT PROTECTED SYSTEMS HAZARD SOURCE AREA APPUCABLE HAZARDS ALTERNATE SARfuERS COMPENSATORY AREA (Applicable TIS) MEASURES 2-AC-30420A to E CREACUS boundary OTHER AREAS (none) (none required) See procedure SO23-1-829 (Conirol room area). vle: (T/S 3.7.11) OTHER BARRIERS 2-AC-30-020E Mode 1-4. 2-TB-34-1480 Mode 1-4. Close rnissile door AC201 (Rm 201. 207A). vla: ECWS Train A (NONE AVAILABLE) - (Rm T2-202) MSLB (TB2) (T/S 3.7.10) MSLB (TB3) , WALL. FWLB (TB2) PENETRATION SEALS. CREACUS Train A F%tB (TB3) DOOR. AC263. AC264 (TIS 3.7.11) ASLB (TB2-TB3)
, (2-AC-30. all areas)
T/S 3.0.3 Mode WW:. Mode SAS/Defuel Close rnissile door AC201 ECWS Train A (NONE AVAILABLE) MSLB (TB3) (T/S 3.7.10) FWLB (TB3) CREACUS Train A (T/S 3.7.11) , (2-AC-30. all areas) ; T/S: See keynotes i b e D-12 OF 14 i r e k [
- e i
Topical Report: Revision 0 Control of Harall Barriers August 14,1998 Appendix D KEYNOTES FOR TABLE D-3 l BARRIER AREA 1 AREA 2 REMARKS BARRIER: The specific barrier (block wall, door, floor plug, hatch, manhole cover, penetration seal, sleeve, vault plug, wall, etc.) which has been evaluated and determined to have no EQ (steam, flood, dose) or equipment-generated missile functions. Related barriers which are not listed (e.g., wall adjacent to a specified door, penetration seal adjacent to a specified seal, etc.) may noj be added to this listing without a specific evaluation per 10CFR50.59. AREA 1. AREA 2: The plant area numbers (unit, building, elevation and area) and rooms between which the specified barrier is located. Areas 2-YD-30-200A and 2-YD-30-2008 are the Unit 2 and Unit 3 yard areas, respectively, which include the roof areas of other buildings for which a separate fire area designation is not assigned. REMARKS: Other pertinent or clarifying information.
- 1. Unless noted otherwise, all barriers in this table are subject to applicable controls outside this implementing document for one or more of the following functions: fire protection; severe weather response procedures; Fuel Handling isolation System boundary; CREACUS boundary; security. Where none of these functions apply, "No comp measures req'd"is shown in the Remarks.
- 2. Barriers which can provide EQ/ missile functions as an alternate to a Table D-2 barrier are shown as ' Table D-2 attemate barrier"in the Remarks. Table D-3 barriers with this designation are subject to the same surveillance requirements as the corresponding Table D-2 barrier while functioning as its attemate.
Table D-3 is sorted by BARRIER, AREA 1 (unit, building, elevation and area number) and AREA 2 (unit, building, elevation and area number). I l D-13 OF 14 i
, , . 9)
. Topical Report.
Control of Hazard Barriers Revision 0 August 14,1998 A;;% D
~
i t i TABLE D-3: BARRIERS WITH NO HAZARD FUNCTIONS (SAMPLE) dARRIER AREA 1 AREA 2 REMARKS BLOCK WALL 216 2-AR-24-094 2-AR-24-094 i Room 217B Room 203C DOOR (no ta9s) 2-TB-30148H 2-TB-30-148H No Comp Measures Req'd Tank Room FFCPD CntriRoom ! DOOR AC102 2-AC-09 016 2-AC-09-016 No Comp Measures Req'd l Room 102 Room 105 ; ' i l DOOR AC105 l
- - 2-AC-09-012' 2-AC-09-016 Room 107 Room 105 l
DOOR AR102 2-AR-09-076 2-AR-09-086 Room 101 Table D-2 attemate barrier for Room 103A AR201, AR403 ! No other funchons FLOOR 2-AR 09 081 3-AR-37104 includes penetrabon seals Room 111D Room 345B Provides temperature boundary between reactor trip breakers and Tank T068 FLOOR PLUG 2-AR-09-080 2-AR-24 096 No Comp Measuret Req'd Room 110 Room 2058 FLOOR PLUGS (4) 2-TB-07-148A 2 TB 07148A Over condensate pumps MP050 Room T2-301 Room T2-201 thru MP053 HATCH COVER H4 2-TB-07-148A penetrations 2-TB-( 09)-148E Exishng screw holes, plate 9aps Room T2-101 Room SWC pipe tunnel l and hose cutouts only (total area
< 50 square inches). All other l
l Gi-,%,vegoverM by Tabis 2. MANHOLE COVER SE 2-YD 30-2000 2 YD 30-200B GTOWER4 2ND Room YARD Room DUCTBANK PENETRATION SEAL 2-DG-20-159 2 DG 20-160 S2DF204003 Room VAULT A Room VAULT B SLEEVE 2 AC-30-020A i 3 AC-30-0208 Room 208 Room 220 VAULT PLUG 2-DG-20-159 2 YD-30-200A includes walls, roof and DG TANK VAULT YARD AREA penetration seals WALL 2-AC-3(M)20A 2 AC-30-002B Room 229 Room 236 WALL 2-AC-30-020A 2 AC 30-020A No Comp Measures Req'd l Room 230 + Room 240 4 D-14 OF 14
~. _ ._}}