ML20154H037

Rev 2 to Fire Submittal Screening Review Ter;Jm Farley, 971020

ML20154H037
Person / Time
Site:	Farley
Issue date:	10/20/1997
From:	Gregory J, Pepping R, Ross S Battelle Memorial Institute, PACIFIC NORTHWEST NATION, SANDIA NATIONAL LABORATORIES
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20154G968	List: ML20154H012 ML20154H037 ML20154H046
References
CON-FIN-W-6733 NUDOCS 9810140055
Download: ML20154H037 (20)

Text

. . . __ _ _ _ _ _ . _ _ _ _,

l l Review of the Submittal in Response to l

U.S. NRC Generic Letter 88-20, Supplement 4:'

Individual Plant Examination-External Events l

Fire Submittal Screening Review i

Technical Evaluation Report: Joseph M. Farley Revision 2: October 20,1997 Prepared by:

Richard E. Pepping Julie J. Gregory Risk Analysis and Systems Modeling Department Sandia National Laboratories Albuquerque, New Mexico 87185-0747 Steven B. Ross Battelle Albuquerque, New Mexico 87106 i

Prepared for.

Probabilistic Risk Assessment Branch Division of Systems Technology Office of Nuclear Regulatory Research U. S. Nuclear Regulatory Commission

' Washington, D.C. 205S5 USNRC JCN W6733 l

(-

9810140055 981001 PDR ADOCK 05000348 i P PDR l

\ - -

%2H00G

1.0 INTRODUCTION

This Technical Evaluation Report (TER) presents the results of the Step 0 review of the fire assessment reported in the Joseph M. Farley Nuclear Plant Individual Plant Examination of External Events (IPEEE). [1]

1.1 Plant Description 1

Joseph M. Farley Nuclear Plant (FNP) is a two-unit, Westinghouse three-loop pressurized water reactor (PWR) plant located on the Chattahoochee River in southeast Alabama. The two 1 units are essentially identical and rated at 2660 MWt. Unit I began commercial operation in December 1977, and Unit 2 began operation in July 1981. The plant layout consists of containments, an Auxiliary Building, a Diesel Generator Building, and a Turbine Building

{

housing plant functions typical of PWRs. The Southern Electric transmission grid supplies l offsite power to emergency buses. Five diesel generators supply backup emergency power.

1.2 Review Objectives The performance of an IPEEE was requested of all commercia' U.S. nuclear power plants by the U.S. Nuclear Regulatory Commission (USNRC) in Supplement 4 of Generic Letter 88-20. [2]

Additional guidance on the intent and scope of the IPEEE process was provided in NUREG-1407.

[3] The objective of this Step 0 screening review is to help the USNRC determine if the FNP submittal has met the intent of the generic letter and to also determine the extent to which the fire assessment addresses certain other specific issues and ongoing programs.

1.3 Scope and Limitations The Step 0 review was limited to the material presented in the FNP IPEEE submittal.

Furthermore, the review was limited to verifying that the critical elements of an acceptable fire analysis have been presented. An in-depth evaluation of the various inputs, assumptions, and calculations was not performed. The review was performed according to the guidance presented in Reference 4. The results of the review against the guidance in this document are presented in Section 2.0 Conclusions and a recommendation as to the adequacy of the FNP IPEEE submittal with regard to the fire assessment and its use in supporting the resolution of other issues are presented in Section 3.0.

I i

t 4

2 O

, 2.0 FIRE ASSESSMENT EVALUATION The following sections provide the results of the review of the FNP fire assessment. The review compares the fire assessment against the requirements for performing the IPEEE and its use in addressing other issues. Weaknesses and strengths of the fire assessment are highlighted.

2.1 Compliance with USNRC IPEEE Guidelines The USNRC guidelines for performance of the IPEEE fire analysis derive from two major documents. The first is NUREG-1407[3], and the second is Supplement 4 to USNRC Generic Letter 88-20[2]. In the current screening assessments, the adequacy of the utility treatment in comparison to these guidelines has been made as outlined in Guidance for the Performance of Screening Review of Submittals in Response to U. S. NRC Generic Letter 88-20, Supplement 4:

Individual Plant Examinations - External Events, Draft Revision 3, March 21,1997[4]. The following sections discuss the utility document in the context of the specific review objectives set forth in this Screening Review Guidance Document and assess the extent to which the utility submittal has achieved the stated objectives.

2.1.1 Documentation The FNP submittal documents an analysis of the 2-unit plant based upon the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [5] through the compartment screening phases, and the January 1994 draft EPRI Fire Risk Analy:is Implementation Guide (FRAIG) [6] for quantification of fire risk from unscreened compartments. A software version of the FIVE methodology was used, by which plant-specific information was inserted into a spreadsheet for evaluation. The software itself was not examined in this review. The discussion of results appears to reflect application of the FIVE methodology. The EPRI Fire Risk Analysis Implementation Guide is not approved for IPEEE submittals. However, the discussion in the submittal of the analysis is sufficiently detailed that the work can be followed and assessed.

Second tier documentation supporting the fire analysis is cited in the submittal. These documents addressed equipment locations, cable routing, fire area definition, combustible loading, and cable physical description. Included in the supporting documentation are the final revisions of the Parley FSAR [7], Appendix R analysis [8], and IPE submittal [9]. Final disposition of the results of the fire analysis is stated to be in accordance with NEI 91-04, Revision 1, Severe Accident Closure Guidelines. Procedural enhancements are to be in place by February 29,1996.

Documentation of the FNP fire analysis is sufficient to perform this screening review.

2.1.2 Plant Walkdown To perform the FIVE Phase 1 screening, locations of equipment, cabling, ignition sources, etc.

are needed, which usually requires at least one walkdown. Many references are cited in the i 3 9

submittal that seem to provide the same information. One reference, in particular, notes a collection of communications containing entries referring to FIVE walkdowns. Thus, the initial FIVE walkdowns may have been performed, but the results and significant findings are not documented in the submittal. Walkdowns are an important element of the IPEEE process. The lack of documentation of the walkdown is therefore a minor deficiency of this submittal. -

The submittal provides maps of the plant in the seismic review section. However, fire zone maps were notprovided. Extensive tabulations by fire zones and compartments of intermediate results of the study were provided and included some identification of fire barriers. These tables describe fire companment locations, criteria used in screening fire compartment interactions (FIVE Phase 1 barrier screening criteria), ignition sources, plant IPE model top events impacted by fire, and fire detection and suppression systems. The tabulation appears to be complete.

The fire portion of the submittal does not clearly state whether a focused fire walkdown was performed. This is noted as a weakness. The only walkdowns noted as part of this submittal followed (rather than preceded) the FIVE compartment screening steps. These were directed toward obtaining information to be used in detailed modeling of unscreened compartments.

Personnel are not identified, but their fields of expertise were given.

2.1.3 Fire Area Screening The only qualitative screening of fire areas reported in the submittal appear to have been performed by consulting second tier documentation. Fire compartment definition was taken from supporting documentation. The initial screening steps addressed the loss of equipment in the 4

compartment and compartment fire frequency. However, no compartments were screened based on the absence of Safe Shutdown Equipment (SSE). Rather, except in the containments, the assumption was made that any fire would require a plant trip, even in the absence of SSE and shutdown demand initiators. The Main Control Room (MCR) was retained through all phases of screening and addressed in a separate section of the submittal. Containment issues were also addressed separately.

In preparation for quantitative screening, information was assembled, room-by-room, describing ignition sources and frequencies, geometry, damage targets, fire detection and suppression, etc.,

needed to model the fire and damage. In addition, IPE top events impacted by fire damage were identified for each compartment and tabulated. An additional set of top events assumed to fail for all fires was identified, along with operator actions of interest (operator actions were not credited initially). To support screening, and the final quantification of Core Damage Frequencies, FNP used its Appendix R analysis, databases supporting the Appendix R work, argl its internal events analysis to tie the postulated loss of equipment to an initiating event. For fire-damaged equipment not necessarily associated with an unique initiating event, a representative initiating event was selected to represent the expected effects of the fire, according to the submittal. How either the representative initiator or the additional top events mentioned were selected was not discussed.

However, initiating events were assigned to equipment lost in a postulated fire, and a Conditional 4

Core Damage Probability (CCDP) associated with that loss; the CCDP initially calculated by setting the known top events and operator actions to " fail."

Compartments were dropped from consideration only after completing the FIVE Phase 2, Step 2, in which the fire frequency and estimated CCDP are multiplied and compared to the IE-6 per year screening criterion. At the end of the FIVE Phase 2, Step 2,141 compartments were dropped from the initial set of 222 compartments.

The standard FIVE approach to the Fire Compartment Interaction Analysis (FCIA) addresses combustible loads, rated fire barriers, and automatic fire detection and sappression to screen possible multi-compartment scenarios. With the assembled pre-screening compartment information, the FIVE software indicated that 26 pairs of compartments remained to be considered in multi-compartment scenarios.

FNP pursued the 26 compartment pairs with quantitative modeling to further reduce their number.

NUREG/CR-4840 barrier screening guidance, some additional modeling of barrier failure, and

)

consideration of manual recovery of failed suppression systems reduced this number to five pairs '

of compartments. All remaining compartment pairs were combinations of smaller compartmems l and a single large compartment. A generic oil fire (two 55-gallon drums) was considered in the larger compartment. It was determined that three hours would be required to fail the barriers and produce damage, during which time additional mitigation methods were assumed to succeed.

Thus, multi-compartment scenarios were eliminated altogether. This additional effort is documented in an appendix. Some of the data presented can be recogniud as generic. No basis is given for either the barrier failure results or the recovery of suppression systems.

The appendix is apparently produced by the FIVE software as a check on the fire frequencies and CCDPs as the study progresses and these quantities become better defined. It indicates compartments with automatic fire suppression, which should screen in the FIVE FCIA by Criterion 6. They are retained in the new software version, based on quantitative screening, rather than qualitatively screened.

Following screening, the FIVE software uses compartment-specific information on fixed and transient ignition sources and room and target geometr/ to perform fire modeling and estimate target damage. Fourteen additional compartments screened, based on this modeling. Final application of the FIVE software is made to estimate the probability of exceeding the critical combustion load in the compartment. Automatic fire suppression is also introduced at this stage by crediting suppression, within an overall assumed 95% reliability, when calculated damage times exceed the generic FIVE actuation time. At the end of the FIVE screening steps, the compartments remaining to be analyzed included the containments, the Main Control Room, and 23 other compartments.

Having reduced the number of compartments ofinterest to a manageable size, the EPRI Fire Risk Analysis Implementation Guide (FRAIG) is introduced and is followed for the remainder of the 5

+

t

! study. It is stated that the Fire PRA modeling includes refinements in ignition source frequencies l (partitioning), time-dependent propagation, source-target geometry, and credit for fire

! suppression, both in extinguishing and limiting propagation of fires. The discussion of the l remaining compartments focuses,on re-quantification of event sequences already developed.

Deviations from the IPE for events unique to the fire scenario are generally noted, such as giving i l credit for operator actions to manually recover equipment assumed failed in the IPE. For each l remaining fire compartment with credible damage to a target and an identified initiating event, the

! resultant Conditional Core Damage Probabilities (CCDP) are multiplied by the fire frequency and l the result compared to the IE-6 criterion. Eleven compartments remained after this final

screening step. .

-t l

1 The screening methodology is well described and appears to follow the FIVE procedure with the inclusion of the PRA results. One remaining concern follows from the effects of fire size l assumptions on the elimination (screening) of compartments from any further analysis. The j

FRAIG is cited as the reference for the assumed electrical cabinet fires with heat release rates j between 65 to 400 BTU /s. How this range is used is not described. Lower values are less likely

, to produce damage in the bounding analysis performed in screening, possibly eliminating 4 compartments that would remain, had a higher value been used. The FRAIG is known to draw '

l upon NSAC/181L [10] for some of its data, which some reviewers have criticized as being

optimistically low [11). The lack of a clear statement as to how compartments with cabinet fires were screened is noted as a weakness.

2.1.4 Fire Occurrence Fnquency j Generic fire frequencies from FIVE were used. The spreadsheet software also computes the

] various required weighting factors from plant-specific data. The resulting weighted fire i frequencies are tabulated according to ignition source type for each compartment. These l

! frequencies are used in the progressively more detailed analyses following screening. The

software also performs sums to determine the compartment fire frequency for use in screening. l j Frequency partitioning for unscreened fire compartments was performed in the later stages of the analysis. The treatment is consistent with FIVE guidance.

2.1.5 Mre Propagation and Suppression Analysis I The FIVE software was used in all fire damage modeling, with the exception of the special j treatment given to multi-compartment screening described above. Combustible loadings, ignition

! sources, and target' equipment were taken from second tier documentation supplemented by I walkdowns of the plant. Heat release rates assumed are listed in the text and appear reasonable, except for the cabinet fire range of 65-400 BTU /s, which could be higher by a factor of two or i three. Plant maps were not provided. However, tables in the subtr.ittal describe fire detection and I I

suppression systems in each compartment.

6 l

l l

__ _~_.-._ _. _ _ . _ _ . _ _ . . _ _ _ _ _ _ _ _ . _ _ _ _ _

l Assumptions used in the FIVE modeling are generally identified, Automatic fire suppression is included, with generic operating parameters given by the FIVE software. Fire suppressior, is credited with limiting the spatial extent of the fire and temperature rise in the target, once initiated. (There is no automatic fire suppression in the MCR.)

Geometry is taken as worst-case through screening. For example, the lowest cable tray is taken to assess propagation from a low fire source, the largest cable diameter is the assumed target of an exposure fire (which may not be conservative, as assumed), and all equipment in a compartment is initially assumed to fail, regardless of location within the compartment.

Following screening, as the modeling is made more realistic, the geometry and fire modeling data are improved and made specific'to the fires and targev in the compartment.

l Manual suppression is credited only after the screening sters, with the FRAIG cited as a l source of reliability information. Specification of suppression probabilities typically includes i l a time-to-suppression, which was not discussed. An example describes a manual suppression j probability of 0.24 in welding and transient fires. The basis for such numbers is not i discussed beyond citing the reference, and is noted as a weakness. '

Fire-wrap usage at FNP is briefly mentioned in several parts of the submittal, but never discussed.

In particular, Section 4.6.3 notes that credit could have been given for fire-wrap in screening.

An appendix also discusses fire-wrap usage in meeting Appendix R protection requirements.

Noting the presence of fire-wrap without discussing how it was credited or modeled is a weakness of the submittal.

The cabinet fires in the separate analysis of the MCR were not modeled in detail. The EPRI Fire l PRA guidance prescribes a procedure for the analysis of the MCR that is straightforward to apply l

' and is stated as being conservative in its result. Fire propagation is addressed only implicitly through probabilities on various events, such as the probability a ' fire on a control board propagating beyond the initiating components, the probability of successful fire suppression, and known CCDPs for shutdown following loss of critical functions. Propagation cabinet-to-cabinet is precluded by the doubic-wall plus air-gap design, as observed in Sandia tests.

l l The analysis of fire propagation and suppression is a straightforward implementation of the FIVE l methodology, supplemented with data from the FRAIG.

l 2.1.6 Mre-induced Initiating Events and Mre Scenarios i

As noted above, early in the screening steps, fires in compartments were matched to initiating events known from earlier work supporting Appendix R requirements and the internal events IPE.

These are tabulated in the submittal. Fire modeling was also refmed for the compartments 4

surviving screenmg. The CCDPs for the loss of equipment in each compartment were then

! 7 1

1

recalculated for the situation unique to the fire scenario. Operator actions not credited in screening were reconsidered in calculating the new CCDPs. The result was that fire scenario definitions and event quantification were introduced early in this analysis and continuously refined so that the compartment either screened, or was retained for the fmal estimate of the CDF.

Each of the compartments surviving screening is discussed in detail in the submittal and the fmal contribution to the combined CDF determined. Dose compartment CDFs remaining above the screening value of IE-6 per year result from end states that include 1) loss of emergency bus, alone and in combination with loss of offsite power (LOSP); 2) spurious closure of SW and CCW valves (contributing to seal LOCA); 3) loss of motor-driven auxiliary feedwater pumps; and 4) loss of SSE trains, alone and in combination.

Containments Containments were analyzed separately and are discussed later.

Main Control Room The Main Control Room' was analyzed separately and according to the FRAIG. A single room houses both units' control functions. Three-hour barri:rs isolate the MCR from the rest of the

. plant. The MCR is maintained at positive pressure, which diminishes the impact of external smoke. The MCR houses fifty cabinets presumed to be ignition sources and targets in fire scenarios. The MCR cabinet design conforms to the double-wall-plus-air-gap rule for fire isolation. The submittal does not describe fire detection in the MCR.

The submittal describes a critical cabinet approach to the MCR analysis, by which only those cabinets essential to safe shutdown are modeled in detail. At FNP, only five of the fifty cabinets are designated as critical. Fires in these cabinets would threaten two or more redundant shutdown trains or cause LOSP. The remaining cabinets are of concern only from the possibility that an

- unsuppressed fire in one of them may lead to evacuation of the MCR due to the accumulation of

. smoke. These cabinets are regarded as otherwise expendable and no risk is estimated for them.

This argument is not developed in the submittal.

? Auxiliary Shutdown Panels (ASP) are available in case of MCR evacuation. Control of both shutdown trains and a swing train, and isolation from the MCR are available from the ASP. The

-submittal notes that FNP fire procedures do not require isolation of offsite power following a MCR fire, unless the fire directly affects it, thus removing a strong reliance on diesel generators.

Other assumptions important to the MCR analysis include,

• A fully developed fire on a board in a cabinet disables the entire board, o Evacuation results from the loss of visibility due to smoke, occurs when a fire is not suppressed, and occurs at the non-suppression frequency. Abandonment results from a loss i' of control from the MCR, due to fire damage, and occurs at the scenario frequency.

8

_ . - - , , , _ ,,.,--_.s. -. --__.,

o .

.. , * - Dough not stated in the submittal, there is an assumed ability to resume control from the ASP following the MCR fire. Dat is, no equipment function or controllability are lost because of the fire.

The five cabinets ofinterest in the MCR contain boards with three functions: 1) the Main Control Board (MCB) contains controls for redundant trains of a single unit, with large separation between  ;

cabinets for each unit (2 cabinets each); 2) the Emergency Power Board (EPB) is a single board '

with four partitions separating controls for units' and trains' on-site and off-site power by a single metal bulkhead with no cable crossovers; and 3) the Metering and Relay Panels (MRP) (two '

cabinets, one per unit with large separation) contain controls for off-site power for a single unit. l

. Other information included in the MCR analysis includes, The generic FIVE MCR fire frequency of 1.9E-2/ year is partitioned among the fifty cabinets, weighted according to cabinet contents. The fire frequency among the critical cabinets is thus 1.9E-3/ year.

a. De MCR analysis cites the FRAIG predability of manual non-suppression of 3.4E-3, which is also the probability of MCR evacuation since unsuppressed fires are assumed to require evacuation.

. A fire severity factor of 20% describes the fraction of cabinet fires that propagate beyond the initiating components on a board, supported by the EPRI Fire Events Database [12].

a. The time interval, when needed, is 15 minutes: the time with the manual nonsuppression probability of 3.4E-3, the time for propagation beyond the initiating components on a board, and the time for visibility to be obscured by smoke.

FNP develops the MCR fire scenario set as follows:

1) Non-suppressed fires (Evacuation): a default scenario is defined by which shutdown is achieved from the Auxiliary Shutdown Panels (ASP). His scenario is assumed for any MCR fire requiring -

evacuation. Evacuation is required for any fire, in any cabinet, not suppressed within 15 minutes.

2) Suppressed fires:

• For a propagating fire in the MCB, both shutdown trains would be affected and shutdown from ASP required. This is assumed to occur for 20% of the MCB fires. Depending on the severity, two scenarios result,

- 1. severe: loss of two trains and shutdown from ASP (abandonment).

2. non-severe: loss of one train and remaining-train shutdown from MCR.

An EPB fire may propagate from one partition to another but requires time, again assumed to be 15 minutes. During this time, manual suppression may be effective and the damage assumed to be conf ~med to a single parution. Only this single-partition fire is quantified. (The non-suppression case, which leads to the loss of both safe shutdown trains, is subsumed by the first scenario.)

MRP fires are assumed to destroy the board and lead to LOSP for the unit, a single scenario.

9

i For each af the board-damaging scenarios and the MCR evacuation scenario, CCDPs were taken from the IPE. There was no adjustment for factors unique to the fire scenario. .

The use of the manual non-suppression failure of 3.4E-3, and the 15 minute time interval for suppression follows from presumption ofin-cabinet fire / smoke detection [11]. MCR fire and smoke detectors are not discussed in the submittal and NUREG-1150 recommends a higher frequency of MCR evacuations. This point is noted as a weakness.

2.1.7 Quantification and Uncertainty Analysis CDF estimates for each unit depend on what equipment is assumed to be operating. Contributors to the overall fire CDF from compartments and scenarios surviving the FIVE screening steps for Unit 1, assuming Train A CCW to be providing seal cooling on the RCP are as follows:

Compartment type Number CDF(per year)

Switchgear Rooms 6 7.92E-5 Electrical Penetration Rooms 2 3.27E-5 Main Control Room 1 1.33E-5 Service Water Pump Room 1 1.40E-5 Component Cooling Water HX/ Pump Room 1 1.27E-5 1.ow-voltage Switchyard 1 4.12E-6 Cable Spreading Room 1 2.02E-6 l Turbine Building 1 1.47E-6 Others 3 LHE-fi Total 1.6E-4 i

For Unit 2 the estimated total CDF from fire is 1.23E-4 per year. By comparison, the submittal

notes, the internal events IPE resulted in a CDF of 1.3E-4 per year for each unit.

Uncertainties were not discussed in the analysis described in the submittal.

i 2.1.8 Sensitivity and Importance Ranking Studies

Sensitivity and importance ranking was not performed.

2.2 SpecialIssues As a part of the IPEEE fire submittal, the utilities were asked to address a number of fire-related issues identified in the Fire Risk Scoping Study (FRSS) and USNRC Generic Safety Issues (GSI).

Specific review guidance on these issues is taken from Reference 4.

a i

I l 10 i

i u.,+w

O.

2.2.1 Decay Heat Removal (GSI A-45)

The FNP submittal includes a non-probabilistic development of its capability to provide becay Heat Removal (DHR) following shutdown. . FNP notes loss of feedwater, LOSP, and small LOCAs as being ofinterest. The DHR function is provided by the Auxiliary Feedwater (AFW) system on the secondary side or, in the event of failure of AFW, by bleed-and-feed on the primary side. Ultimately, the Residual Heat Removal (RHR) system is responsible for normal cooling.

The FNP submittal discusses the systems supporting these functions, power distribution to them, redundancy, and separation. A few points are noteworthy.

The power distribution is generally in compliance with Appendix R separation and redundancy requirements. FNP notes that the pumps and valves on the AFW system are powered by an uninterruptible power supply with a four-hour battery backup.

Generally, redundant DHR system pumps, valves, and cabling are located in separate fire I compartments. In a few instances, these items are co-located with the statement made that j

. Appendix R separation and protection requirements are satisfied. Although not explicitly -

mentioned in the DHR discussion, elsewhere in the submittal this appears to mean that co-located,  !

redundant systems' cabling is " protected if one train has fire-wrap. Among the co-located l systems supporting DHR are '

• Motor-driven AFW pumps' cabling passes through the compartment containing the turbine-  ;

driven AFW pump. FNP has identified no single ignition source that will result in the loss of I both systems.

Redundant component cooling water pumps and heat exchangers are located in a common compartment. Power cables are protected by a 3-hour barrier and fire suppression where Appendix R requirements are not met. 4 a

The normal RHR heat exchangers are located in a single fire compartment. Whether cabling to these systems' valves comes together there is not clear.

Summary discussion of the results of the fire study shows an overall CDF of 1.6E-4 per year for Unit I and 1.2E-4 per year for Unit 2. Combined with the IPE result of 1.3E-4 per year for both units, an overall CDF of 2.9E-4 per year is estimated for Unit 1. This is nearly the USNRC guideline value of 3E-4/yr in NUREG-1289 [13), the regulatory and backfit analysis of USI A-45, for which failures of the decay heat removal (DHR) function require prompt action.

2.2.2 Mre-induced Afternate Shutdown / Control Room Panel Interactions (FRSS, GSI 147, MSRP)

The issue of control systems imtractions is associated primarily with the potential that a fire in i

the Main Control Room or in tlie Cable Spreading Room might lead to failures in the remote shutdown capability.

4 11 3

-- ,- . v v.* -

The submittal states that the FRSS issues were reviewed and that no new weaknesses were identified with respect to the issue of control systems interactions. The brief discussio'n notes that Appendix R requires a remote shutdown capability in the event of a fire in either the control room or cable spreading room. FNP can achieve cold shutdown from the remote shutdown location.

The submittal does not discuss the verification of electrical independence of the main and remote control systems, the loss of control or power before transfer, the effects of spurious actuations (in the context of remote shutdown), or total system loss. There is no discussion of the plant remote shutdown procedures, the location (s) of the control panels, or the specific systems controllable from the remote panels.

The submittal also states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

2.2.3 Smoke Control and Manual Mre Mghting Effectiveness (FRSS, GSI 148)

Smoke control and manual fire fighting effectiveness is associated with the concern that nuclear power plant ventilation systems are known to be poorly configured for smoke removal in the event of a fire, and hence, significant potential exists for the buildup of smoke to hamper the efforts of the manual fire brigade to suppress fires promptly and effectively.

The submittal states that the FRSS issues were reviewed and that no new weaknesses were identified with respect to the issue of manual fire fighting effectiveness.

Manual firefighting was assumed to be very effective in the MCR, with a non-suppression  ;

probability of 3.4E-3, but was not otherwise discussed.

Brief comments are made in the section addressing the FRSS issue of manual firefighting.

Plant procedures describe the locations of portable fire extinguishers, methods of reporting fires, equipment maintenance, brigade composition (five personnel / shift ), and record keeping.

Training includes, fire fighting strategies and procedures, identification of brigade members' responsibilities, typical fire hazards, use of portable fire extinguishers, use of emergency communications, use of protective clothing, respiratory equipment, portable lighting and ventilation, and fire drills, e The FNP submittal was based on FIVE. FNP presumably examined the guidance for assessing its manual fire fighting program.

There was no specific discussion of fire fighting impacts on redundant trains, opening fire barriers in order to access a fire, or time delays associated with fire fighting (brigade assembly, verification of the fire, or time to extinguish). Smoke control was not discussed in the submittal, although breathing gear was noted as being available to fire fighters.

12 l

l l

l l

\, ' -

_ _ . _ _ _ _ _.- _._ ______.___ ____ _ _ _ _ . ~

l ,

The submittal also states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

2.2.4 Adequacy of Fire Barriers (FRSS)

Barrier reliability and inter-compartment fire effects are related to the potential that fires in one area might impact other adjacent or connected areas through the spread of heat and smoke. In general, it is expected that a utility analysis would provide for some treatment of such potential by considering that (1) manual fire fighting activities might allow for the spread of smoke and beat through the opening of access doors, and (2) that the failure of active fire barrier elements such l as normally open doors, water curtains, and ventilation dampers might compromise barrier

integrity.

The sub.mittal states that the FRSS issues were reviewed and that no new weaknesses wer identified with respect to the issue of fire barrier qualification.

The discussion at the beginning of the FIRE PRA section alludes to assumptions that appear to have been made in the FIVE screening such as credit that should have been given for fire-wrap, credit for non-rated fire barriers, and credit for separation. The submittal contained no further discussion of this subject. Where fire wrap is used and the properties ascribed to it were not discussed.

FNP cites many plant procedures addressing fire door inspection and maintenance, penetration seal inspection, and fire damper inspection, maintenance, and testing. Failure of active fire barriers

was not discussed.

2.2.5 Effects of Fire Protection System Actuation on Safety-related Equipment (FRSS, GSI 57, MSRP)

This issue is associated with the concern that traditional fire PRA methods have generally considered only direct thermal damage effects. Other potential damage mechanisms such as smoke and fire suppression damage (either from fixed systems or manual actions) have not been '

considered. In general, this is r.n area where the data base on equipment vulnerability is rather sparse. It was anticipated that a typical IPEEE analysis would provide for some treatment of both smoke and suppression-induced damage.

The submittal states that the FRSS issues were reviewed and that no new weaknesses were identified with respect to the issue of total environment equipment survival.

FNP notes that fire suppressant damage is not expected. Safe Shutdown equipment is either located away from sprinkler heads, or has been designed to preclude water damage. The submittal notes that engineers involved in the seismic walkdown of the plant concluded that seismic activation of the fire suppression system was an incredible event.

L i

13 I

i

i i

The submittal also states, without elaboration, that there is no intent to resolve any other issues

or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

l 2.2.6 Seismic / Fire Interactions (FRSS, MSRP)

The issue of Seismic Fire Interactions involves primarily two concerns. First is the potential that  !

!- seismic events might also cause fires internal to the plant, and second is the potential that seismic

{ events might either render inoperable or spuriously actuate fixed fire detection and suppression '

i systems. Following this postulated event, fire suppressant inventories may be depleted and/or

• damage to safety-related equipment may be an issue. It had been anticipated that a typical fire IPEEE submittal would provide for some treatment of these issues through a focused seismic / fire interaction walkdown.

j. According to the submittal, the FRSS issues were reviewed and that no new weaknesses were j identified with respect to the issue of seismic / fire interactions.

! The submial states that storage vessels near seismic SSE are not subject to leakage under seismic i conditions. Fire suppression systems were found to be installed according to accepted standards and are not expected to fail under postulated seismic conditions. Engineers involved in the seismic i walkdown of the plant concluded that seismic activation of the fire suppression system was an i incredible event. Therefore, the submittal does not discuss related issues of local flooding, habitability or over-pressurization of compartments, depletion of suppressant inventories, or suppressant spray damage.

l

! The submittal also states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

4

{' 2.2.7 Effects of Hydrogen Line Ruptures (MSRP)

! The use of flammable gases in the plant, including hydrogen, introduces the potential that a rupture of the gas flow lines might lead to the introduction of a serious fire hazard into plant safety l areas. It had been anticipated that a typical fire IPEEE analysis would include the consideration  !

4 of such sources in the analysis.

! The submittal states only that storage vessels near seismic SSE are not subject to leakage under I seismic conditions. j

]  !

i The submittal states, without elaboration, that there is no intent to resolve any other issues or

[ programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal,  !

l 2.2.8 Common Cause Failures Related to Hmnan Errors (MSRP) l Common cause failures resulting from human errors include operator acts of omission or

, . commission that could be initiating events or could affect redundant safety-related trains needed 14 i

i

a to mitigate other initiating events. It had been anticipated that a typical fire IPEEE analysis would include the consideration of such failures in the submittal.

1 The FNP submittal notes only those modifications to operator actions assumed in the internal l events IPE model for differenced between the internal events and the fire events.

The submittal states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal. I 2.2.9 Non-safety Related Control System / Safety Related Protection System Dependencies (MSRP)

Multiple failures in non-safety-related control systems may have an adverse impact on safety-related protection systems as a result of potential unrecognized dependencies between control and protection systems. The licensee's IPE process should provide a framework for. systematic evaluation ofinterdependence between safety-related and non-safety related systems and identify potential sources of vulnerabilities. It had been anticipated that the fire IPEEE analysis would include the consideration of such dependencies in the submittal.

The FNP submittal does not discuss this issue.

The submittal states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

2.2.10 Effects of Flooding and/or Moisture Intrusion on Non' Safety- and Safety-Related Equipment (MSRP)

Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment. This type of event can result from external flooding events, tank and pipe ruptures, actuations of the fire suppression system, or backflow through part of the plant drainage system. It had been anticipated that the fire IPEEE analysis would include the consideration of such events in the submittal.

The FNP submittal does not discuss this issue.

The submittal states, without elaboration, that there is no intent to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

2.2.11 Shutdown Systems and Electrical Instrumentation and Control Features (MSRP)

The issue of shutdown systems addresses the capacity of plants to ensure reliable shutdown using safety-grade equipment. The issue.of electrical instrumentation and control addresses the functional capabilities of electrical instrumentation and control features of systems required for 15

i .

l safe shutdown, including support systems. These systems should be designed, fabricated, installed, and tested to quality standards and remain functional following external events. It had been anticipated that the fire IPEEE analysis would include the consideration of this issue in the submittal. ,

The FNP submittal discusses decay heat removal, as described above. De submittal does not discuss instrumentation and control explicitly.

The submittal states, without elaboration, that there is no intent .to resolve any other issues or programs with respect to fire-induced events with the Farley Nuclear Plant IPEEE submittal.

j 2.3 Containment Performance Issues Unique to Fire Scenarios

' Containments were analyzed separately in a non-probabilistic manner. Only containment bypass and loss-of-isolation scenarios were discussed in detail, the containment building itself being not directly affected by fire, and containment response in other fire-induced core damaging scenarios already known.

The Farley analysis concluded that an interfacing system LOCA (ISLOCA) was the only candidate bypass scenario. This could result from an overheated RCP seal following loss of CCW for a period in excess of twenty minutes. Such loss requires the loss of both trains of SSE power, which could only occur for an MCR fire scenario, i. c. where the cabling for both trains is co-located. In this event, however, local manual control is available for the valves in question, making the scenario extremely unlikely. Other events were discussed, but either a credible fire initiator could not be identified, or the scenario was subsumed by an internal event. Hence, FNP concludes that no new ISLOCA has been identified by the fire study.

t

• Fire effects on containment isolation were also discussed in the submittal and focused on the l numerous penetrations controlled by air- and motor-operated valves. Typically, these penetrations i are valved in series with one valve inside and one outside containment. Separation of power and control cabling precludes damage to the pair from a single fire. The only credible fire scenario affecting both valves requires a fire in the MCR, where cabling comes together. For that scenario, local manual operation of the valves was available. Many scenarios postulated for loss of containment isolation required hot shorts, which could be recovered by removing power locally. Farley concludes that no new scenarios leading to loss of containment isolation have been identified in the fire study.

2.4 Plant Vulnerabilities and Improvements The submittal states that no new vulnerabilities were identified in this study. However, many e*=-x=nts to Emergency Operating Procedures were noted and are to be in place by the end i

of February 1996. De analysis documented in the submittal seems to have assumed credit for these improvements already.

i 16

r Most of the discussion of these enhancements addresses the general problem of seal LOCAs that result within about twenty minutes of the loss of RCP seal cooling. The procedures being revised i

provide for isolation and realignment of various swing components, CCW, and standby systems

• to provide the required cooling. The last procedural enhancement notes' a need to monitor the motor-drive'n AFW pumproom temperature and, if necessary, install temporary cooling in case '

of loss of ventilation of the room.

In general, the IPE and IPEEE processes have successfully identified needed improvements at FNP and the utility is responding.

A 17

g C

. 1

3.0 CONCLUSION

S AND RECOMMENDATIONS The Fa% Nuclear Plant IPEEE fire assessment was performed by application ofFIVE methodology with PRA quantification of core d'amage frequency estimates. In general, the submittal adequately  ;

hime the methods and results of the fire assessment. Some areas ofstrengths and weaknesses were identified in the analysis. They include: )

l strenghs-thorough discussion of the material presented,

' the regular inclusion of the effects of fire-induced hot shorts,

• a strong walkdown team, Inclusion of the plant internal events IPE in the fire study.

Weaknensen-The full plant walkdown is not clearly documented in the submittal, although some compartments clearly were walked down.

Manual suppression factors have been used without providing a basis to support the values.

A low probability of manual non-suppression (3.4E-3) was used in the MCR, but without describing the in-cabinet detection system required to support that assumption.

FRSS issues were discussed only briefly in the submittal.

The reviewer recommends that a sufficient level of documentation and appropriate bases for analysis have been established to conclude that the subject licensee has substantially met the intent

. of the IPEEE pocess. No further review is recommended at this time.

, 1 18

s

4.0 REFERENCES

i

1) " Joseph M. Farley Nuclear Plant, Unit 1 and Unit 2, Individual Plant Examination of External )

1 Events , Southern Nuclear Operating Company,28 June 1995.

l 4

2) USNRC, Individual Plant Bamination of External Events for Severe Accident Vulnerabilities l j - 10 CFR 550.54(f), Generic Letter 88-20, Supplement 4, April 1991.

i

3) USNRC, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, NUREG-1407, May 1991.

4) S. Nowlen, M. Bohn, J. Chen, Cigance for the Performance of Screenina Reviews of j

Submittn1< in Retnante to U.S. NRC G neric 12tter 88-20. Supniement 4 'Individunt Plant i

Framination - External Events, Rev. 3,21 Mar 1997.

' 5) EPRI TR-100370, Fire-induced Vulnerability Evaluation (FIVE), Professional Loss Control, Inc., April 1992.

6) Electric Power Research Institute Report Project 3385-01, Fire Risk Analysis Implementation j Guide , Draft Repon, Jan 1994.

t

7) Southern Nuclear Operating Company, Joseph M. Farley Final Safety Analysis Report (FSAR)

Update 4

8) Joseph M. Farley Units 1 and 2,10 CFR 50 Appendix R Fire Protection Program for Operating Nuclear Power Plants (A-350971), Rev.16.

j 9) SNC, Farley iludear Plants Units 1 and 2 Individual Plant Examination in Response to Generic Letter 88-20, June 102.

j  !

10) Electric Power Research Institute, Fire PRA Re-quantification Studies, NSAC/181L, March  ;

1993.

3 i

11) J. Lambright, et al., A Review of Fire PRA Re-quantification Studies Reported in NSAC/181, Draft, Sandia National Laboratories, April 1994.

12) Electric Power Research Institute, Fire Events Database for US Nuclear Power Plants, NSAC/178L, June 1992.

13) USNRC, Regulatory and Backfit Analysis: Unresolved Safety Issue A-45, Shutdown Decay Heat Removal Requirements, NUREG-1289, November 1988.

l 19 u _ _ _ _ _ _._ --_ _ _

.l I

l Attachment 3 l

l L

t l

l FARLEY NUCLEAR PLANT INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE)  !

TECHNICAL EVALUATION REPORT l HIGH WINDS, FLOODS, AND OTHER EXTERNAL EVENTS I

I i

i

! l 1

j.  !

f i

i

! . -. . - -