ML20203J092

Technical Evaluation Rept on 'Submittal-Only' Review of IPEEE at McGuire Nuclear Station,Units 1 & 2, Final Rept

ML20203J092
Person / Time
Site:	Mcguire, McGuire
Issue date:	02/28/1998
From:	Frank M, Khatibrahbar, Sewell R ENERGY RESEARCH, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20203J050	List: ML20203J043 ML20203J092
References
CON-NRC-04-94-050, CON-NRC-4-94-50 ERI-NRC-95-502, NUDOCS 9902230280
Download: ML20203J092 (67)

Text

..- - - .-.. . . - . . - . - _ - - - . - - - _ _ - -

ERl/NRC 95-502 e

TECHNICAL EVALUATION REPORT ON THE

" SUBMITTAL-ONLY" REVIELU OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT MCGUIRE NUCLEAR STATION, UNITS 1 AND 2 FINAL REPORT Completed: December 1996 Final: February 1998 Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847-2034 Work Performed Under the Auspices of the ffi e f Nucl a Regu ry Reses h Washington, D.C. 20555 i

Contract No. 04-94-050 -

PDR O K 050 0369 P PDR

O ERI/NRC 95-502 TECHNICAL EVALUATION REPORT ON THE ,

"SUBMTITAIA)NLY" REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT MCGUIRE NUCLEAR STATION, UNITS 1 AND 2 FINAL REPORT Completed: December 1996 Fimil: February 1998 M. Khatib-Rahbar PrincipalInvestigator Authors:

M. V. Frank , R. T. Sewell, M. Modarres2 ,

W. Werner*, J. A. Lambright, and A. S. Kuritzky Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847 Work Perfonned Under the Auspices of the United States Nuclear Reguhtory Commission Of6ce of Nuclear Regulatory Research Washington, D.C. 20555 Contract No. 04-94 050 8

Safety Factor Associates, Inc.,1410 Vanessa Circle, Suite 16, Enemitas, CA 92024 University of Maryland, D partment of Materials and Nuclear Engineenng, College Park, MD 20742 Safety Assessment Consulting, Veilchenweg 8. D-83254 Breitbrunn, Germany Formerly of Beta Corporation International, presently with Lambright Technical Associates,9009 Lagrima De Oro Road, NE Albuquerque, NM 87111 i

I TABLE OF CONTENTS EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi PREFA CE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii 1 INTRODUCTION . . . '. . . . . . . . . . . . . . . . . . . . . .......................I 1.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2 Overview of the Licensee's IPEEE Process and Important Insights . . . . . . . . . . . 1 1.2.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2.2 Fire..............................................3 1.2.3 HFO Events ........................................5 1.3 Overview of Review Process and Activities . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.3.1 S eismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.3.2 Fire..............................................6 1.3.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2 CONTRACTOR REVIEW FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1 S eis mic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1.1 Overview and Relevance of the Seismic IPEEE Process . . . . . . . . . . . . . 8 2.1.2 Logic Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 l 2.1.3 Non-Seismic Failures and Human Actions . . . . . . . . . . . . . . . . . . . . . 9 2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape) . . . . . . . . . 10 2.1.5 Structural Response and Component Demands . . . . . . . . . . . . . . . . . . 10 2.1.6 Screening Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.1.7 Plant Walkdown Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.1.8 Fragility Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.1.9 Accident Frequency Estimates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

)

2.1.10 Evaluation of Dominant Risk Contributors . . . . . . . . . . . . . . . . . . . . 12 l 2.1.11 Relay Chatter Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.1.12 Soil Failure Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4

2.1.13 Contair. ment Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 12 >

2.1.14 Seismic. Fire Interaction and Seismically Induced Flood Evaluations . . . . ,. 13 2.1.15 Treatment of USI A-45 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.1.16 Treatment of GI-131 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1 2.1.17 Other Safety lssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4 13  !

2.1.18 Process to Identify, Eliminate or Reduce Vulnerabilities . . . . . . . . . . . 14 l 2.1.19 Peer Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14  !

2.2 Fire..................................................14 ]

2.2.1 Overview and Relevance of the Fire IPEEE Process . . . . . . . . . . . . . . 14 l 2.2.2 Review of Plant Information and Walkdown . . . . . . . . . . . . . . . . . . . 15 1 2.2.3 Fire-Induced Initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.4 Screening of Fire Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . l 16 l 2.2.5 Fire Hazard Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18 j 2.2.6 Fire Growth and Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18  !

Energy Research, Inc. ii ERI/NRC 95-502 j 1

i l

.' ]

I 2.2.7 Evaluation of Component Fragilities and Failure Modes . . . . . . . . . . . 19 2.2.8 Fire Detection and Suppression . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 I 2.2.9 Analysis of Phnt Systems and Sequences . . . . . . . . . . . . . . . . . . . . . 21 2.2.10 Fire Scenarios and Core Damage Frequency Evaluation ........... 21 2.2.11 Analysis of Containment Performance . . . . . . . . . . . . . . . . . . . . . . . 23 2.2.12 Treatment of Fire Risk Scoping Study hsues . . . . . . . . . . . . . . . . . . 23 2.2.13 USI A.45 1ssue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2.3.1 High Winds and Tornadoes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.3.1.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 26 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 26 2.3.1.3 Significant Changes Since Issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.1.4 Significant Findings and Plant-Unique Features ...... 27 2.3.1.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.1.6 Boundmg Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.1.7 PRA Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.2 External Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3.2.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 28 2.3.2.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 28 2.3.2.3 Significant Changes Since Issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3.2.4 Significant Findings and Plant-Unique Features ...... 28 )

2.3.2.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . . 28 l

2.3.3 Transportation and Nearby Facility Accidents . . . . . . . . . .. . . . . . . . . 29 2.3.3.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 29 2.3.3.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 29 2.3.3.3 Significant Changes Since issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.3.3.4 Significant Findings and Plant-Unique Features . . . . . . 30 2.3.3.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.4 Generic Safety Issues (GSI-147, GSI-148 and GSI-172) . . . . . . . . . . . . . . . . . 30 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction * . 30 2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" . . . . 31 2.4.3 GSI.172, " Multiple System Responses Program (MSRP)" . . . . . . . . . . 31 3 OVERALL EVALUATION, CONCLUSIONS AND RECOMMENDATIONS . . . . . . . 36 3.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 3.2 Fire........................................ ......... 37 3.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4 IPEEE INSIGHTS, IMPROVEMENTS AND COMMITMENTS . . . . . . . . . . . . . . . . 41 4.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 4.2 Fire..................................................41 4.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 5 IPEEE DATA

SUMMARY

AND ENTRY SHEETS . . . . . . . . . . . . . . . . . . . . . . . . 43 Energy Research, Inc. iii ERI/NRC 95-502 l

i l

l l

I 4

6 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1

1 l

1 1

1 1

1 Energy Research, Inc. iv ERI/NRC 95-502

L .

4 LIST OF TABLES Table 2.1 CDF Comparison (Original vs. Sensitivity Case) for Significant Fire Locations . 22 Table 4.1 Enhancements Resulting from the IPEEE Seismic Verification Walkdown . . . . . 42 Table 5.1 External Events Results . . . . . . . . .'. . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Table 5.2 PRA Seismic Fragility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Table 5.3 PWR Accident Sequence Overview Table - For Seismic PRA Only . . . . . . . . . 46 Table 5.4 PWR Accident Sequence Overview Table - For Fire PRA Only . . . . . . . . . . . . 47 Table 5.5 PWR Accident Sequence Overview Table - For Wind PRA Only . . . . . . . . . . . 48 Table 5.6 PWR Accident Sequence Detailed Table - For Seismic PRA Only . . . . . . . . . . 49 Table 5.7 PWR Accident Sequence Detailed Table - For Fire PRA Only . . . . . . . . . . . . . 50 Table 5.8 PWR Accident Sequence Detailed Table - For Wind PRA Only . . . . . . . . . . . . 51 l

i l

l I

l I

Energy Research, Inc. v ERI/NRC 95-502 l

__7__

i

+ ,

EXECUI1VE

SUMMARY

i

- . j nis technical evaluation report (TER) documents a " submittal only" review of the individual plant I examination of external events (FEEE) conducted for the McGuire Nuclear Station, Units 1 and 2. This (

technical evaluation review was perfonned by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear l

Regulatory Commission (NRC). De submittal only review process consists of the following tasks: i

. Examine and. evaluate the. licensee's IPEEE submittal and directly relevant available documentation.

Develop requests for additional information (RAls) to supplement or clarify the licensee's IPEEE submittal, as necessary.

• Examine and evaluate the licensee's responses to RAls.

Conduct a final ansamtmant of the strengths and wanimana of the IPEEE submittal, and develop review conclusions.

This TER dccuments ERI's qualitative assessment of the McGuire, Units 1 and 2, IPEEE submittal, particularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidance presemed in McGuire is owned and operated by Duke Power Company (DPC). The McGuire FEEE considers seismic; fire; and high winds, floods, and other (HFO) external initiating events. The IPEEE represents an update of an earlier probabilistic risk assessment (PRA) conducted with the assistance'of various consultants. The IPEEE analysis itself was performed entirely by DPC personnel. .

IJoensee's IPEEE Procrss i For the seismic 1PEEE, DPC used an existing PRA as the principal technical basis for the submittal. The l existing PRA was supplemented by a walkdown that followed the seismic margin assatamant (SMA)

- walkdown procedures (EPRI NP-6041) developed by the Electric Power Research Institute (EPRI). A relay chatter evaluation was conducted, emphasizing evaluation of bad-actor relays, per the guidance (NUREG-1407) for a focused scope plant. Non-seismic failures and human actions were included in the ,

seismic IPEEE. Conrainment p.fumss was addressed, and soil failures were not found to be a problem l

- at the site. De event tree and fault tree models presented in the FEEE submittal are essentially identical to those of the earlier seismic PRA. The overall dominance of loss of offsite power did not change between the 1984 study and the FEEE. Fragilities were developed from the design analyses. The walkdown was preceded by development of new in-structure response spectra used solely for the purpose of screening anchnrages in accordance with EPRI NP-6041. The walkdown team consisted of PRA team members, station system and equipment engmeers, civil / structural engmeers trained in SMA methodology, and supporting' station craft personnel. The walkdown produced qualitative insights, and may be summarized as: (1) verifying the assumptions made during the fragility analysis; (2) verifying adequacy of equipment ancharages; and (3) i iting in discovery and correcnon of minor seismic spatial imeractions in the as-built plant configuration. ne seismic analysis generally followed conventional seismic PRA methodology. k consisted of: a hazard assessment, using the EPRI hazard curves; an existing fragility astmatmanti performed by Structural Machanica Associates; and a simplified systems analysis, using event l Energy Research, Inc'. vi ERI/NRC 95-502 e

%s . -, .- -i

trees and fault trees. Point estimates of the cutset frequencies were presented in the submittal, as a function ofpeak ground acceleration (PGA) interval. A sensitivity study which used the 1989 Lawrence Livermore Naional Laboratory (LLNL) hazard curves revealed insignificant differences in the dominant cutsets, and the fraction of total seismic core damage frequency (CDF) of each cutset.

The McGuire fire FEEE is an update of the full-scope. Level-3 McGuire PRA performed between 1984 and 1987. De analysis identified critical Gre areas, identified possible intiating events, calculated the fire initiation frequency, evaluated potential impairment of critical safety functions, and developed and quantified core damage cutsats using a functional transient event tree and associated fault trees. A special Are event tree was used to help screen out fire areas, assess fire damage, and quantify the frequency of fire damage. A screening process was used in this analysis, in which fire scenarios were not quannfied if a similar individual plant examination (PE) scenario had a larger esti*matM frequency of occurrence.

Typical of other fire PRAs, containment performance was assumed to be the same as evaluated for the  ;

internal-events study, because all fire scenarios were viewed as alternative initiating events for the internal

{

event trees. Dere was no discussion of additional initiating events or containment failure modes unique i to fires. A fire walkdown was performed to verify assumptions about plant configuration, to locate cable runs, and to address the Sandia fire risk scoping study issues. De licensee's original fire IPEEE subnuttal ,

was supplemented by two subsequent analyses. The first analysis expanded the scope of quantified I sequences by including fire scenarios that were screened out in the original IPEEE. The second analysis (a sensinvity analysis) investigaed the impacts of the number of suppression attempts for a given scenario.

l The HFO IPEEE submittal was prunarily based on the McGuire PRA. That is, the principal technical basis for the submittal was a Level-1 PRA analysis, and the results of the IPEEE reported in the submittal are similar to the PRA conclusions. De process involved: (1) identi6 cation of all potentially important external events, and (2) performance of a qualitative screemog process. Among all HFO events, tornadoes I were further analyzed using a quantitative PRA approach. Detailed event-tree and fault tree models were developed and quantified. An elaborate model for determining tornado frequency and fragilities was adapted from the PRA. External flooding, aircraft crash, land transportation accidents, and nearby hazardous facility events were discussed, but they were screened out due to their low probabilities of ,

occurrence. Dus, no formal PRA or hmaMag analysis was performed for these initiating events. HFO- l specific plant walkdowns were not performed since these had already been conducted in 1989 as part of the McGuire PRA.

Eey IPEEE Findings The IPEEE submittal esnmatM a seismic CDF of 1.1 x 108 per reactor-year (ry). The submittal states that the accident sequences that are the most important risk contributors involve loss of offsite power (LOSP) with subsequent loss of diesel generators. This finding is typical of other seismic PRA results; LOSP is '

due to earthquake-caused breakage of ceramic insulators on the main power feed transformers. Non- ,

recovery of offsite power and diesel generators was assumed in the analysis. Loss of nuclear service water was also found to be an important risk contributor. The top thirteen seismic cutsets contributed 51 % to the seismic CDF. Of these thirteen, five were directly related to LOSP and diesel generator failure; two involved LOSP and failure of 125V DC power (which, in turn, prevents diesel generator startup); four were related to loss of both trains of nuclear service water; and two involved a combination ofloss of diesel generators and nuclear service water. The study apparently assumed (although it is not explicitly stated) that an earthquake would cause a reactor trip and a turbine trip (with or without a loss of offsite Energy Research, Inc. vii ERI/NRC 95-502

t l 1

power). It appears from a review of the cutset list that the most important operator error is operator failure to align train A of nuclear service water to the pond.

In the initial / original fire IPEEE study, five areas survived screening. The assumed scenario for fires in the control room, the cable room, the vital instrumentation and control (l&C) area, and the auxiliary shutdown panel was loss of nuclear service water; and the assumed main feedwater pump scenario was loss of offsite power. Only the cutsets for these five scenarios were included in the evaluation of fire CDF.

Using the IPE model transient functional event tree and fault trees in Section 2 of the McGuire PRA, cutset frequencies summed to produce a fire CDF of 2.3x104/yr, which is less than 1 % of the total CDF for McGuire (7 x10'8/ry for internal and external events). The fire sequence for main feed pump fire falls into the TBU functional sequence category, involving a transient (T) with failure of secondary side heat removal (B) and failure of safety injection (U). Cable, control, and vital I&C area fires were identified as TQ U sequences, involving a transient (T) with a reactor coolant pump (RCP) seal loss of coolant accident (LOCA) (Q ) and failure of safety injection (U). Some notable differences in fire CDF and dominant core damage locations emerged from the subsequent expanded base-case and sensitivity case.

Namely, the esumated fire CDF increased by more than an order of magnitude and the dominant location for the sensitivity case was the turbine building, which was screened out of the original study. The most significant walkdown insight was the identification of the potential to lose nuclear service water from a fire in the vital I&C area. A fire in this area could potentially affect both a Unit-1 train-B cable and the IEVDA panel board which houses control power for the train-A 4160V breakers of nuclear service water.

The McGuire IPEEE submitral reports a total CDF from external events of 3.0 x 10'8/ry. Tornado events contribute about 63% to this value. Generally speakmg, this finding represents a relatively high tornado )

frequency. Tornadoes affect the plant either by direct wind loadmg or by tornado-induced missiles. The submmal does not consider direct wind loadmg on the buildings as being important. However, it assumes that wind loading can cause a loss of offsite power, which is considered a non-recoverable event. The tornado PRA showed that the dominant sequences leading to core damage are those involving failure of diesel generators. Unavailability of diesel generators due to mamtenance was also identified as a significant potential contributor to CDF.

Generic Issues and Unresolved Safety Issues The McGuire seismic IPEEE submittal states that the following issues have beer addressed and are now consulered closed: unresolved safety issue (USI) A-45, ' Shutdown Decay Heat Removal Requirements";

Generic Issue (GI) 131, " Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants"; the Eastern U.S. Seismicity bue (Charleston earthquake issue);

and USI A-17, " System Interactions in Nuclear Power Plants".

From the McGuire fire IPEEE, the following licensee insights pertzining to fire risk scoping study issues were developed: where smoke could be generated by fire, existing smoke control capability is sufficient to prevent ==q-f ele i damage; no cost-effective modifications to fire suppression systems are needed to mitigate the effect of fire suppression water discharge and migration; seismically induced failure of fire protection comrol panels is not a problem; automatic heat activated sprinkler heads may be actuated during an earthquake; but no corrective actions were deemed necessary; seismically induced failure of RCP motors is not a problem because fires in the motors would not affect the ability to achieve safe shutdown; and control system interactions are not a problem because of the standby shutdown system. The areas of earthquake-induced fires (other than the RCPs), fire barrier qualification, and fire brigade effectiveness Energy Research, Inc. viii ERI/NRC 95-502 l

were not discussed in the submittal. With respect to USI A-45, credit was taken for bleed and feed and l

for the standhy shutdown system. Fire was not found to be a significant contributor to the risk associated j with shutdown decay heat removal sequences.

For HFO events, the submittal did not describe any formal analysis of other safety issues. It did, however, state that some generic and unresolved safety issues were addressed and were considered closed as part of prior PRAs and the IPEEE effort. The subn'ittal considers the following issues as being closed:

1

• USI A-45, " Shutdown Decay Heat Removal Requirements" l

• USI A-17, " System Interactions in Nuclear Plants"

• GI-103, " Design for Probable Maximum Precipitation (PMP)"

Some information is also provided in the McGuire IPEEE submittal which pertains to generic safety issue (GSI)-147, GSI-148 and GSI-172.

Vulnerabilities and Plant Improvements The McGuire IPEEE submittal defmes vulnerabilities as " unduly significant sequences."

For seismic events, the IPEEE submmal discovered no vulnerabilities. Minor potential spatial interactions were found and dispositioned per Table 3-3 of the IPEEE submittal. Bad-actor relays were not found to be a problem in the study. (However, relay chatter was probabilistically treated in the plant logic model.)

Anchorage failures were considered in the evaluation of component fragilities. No unique seismic contalrament failure modes were identified.

For fire events, the study found no vulnerabilities and no unacceptable risks. The submittal did not identify plant improvements as a result of the fire IPEEE.

For HFO evens, the IPEEE also found no vulnerabilities to any severe accident risk. Although tornadoes were the principal external-events CDF contributor, because the CDF was small, the licensee did not consider any plant improvements. As a result of walkdowns performed in 1989 as part of the McGuire PRA, the HFO submittal lists some minor plant fixes, such as cleaning a corroded nut, and replacing a missing bolt.

Observations The McGuire seismic IPEEE study appears to be consistent with the guidance in NUREG-1407 for use of an existmg PRA, with exception of a few areas. The major weakness of the study is the process used to develop the overall logic model. For non-seismic failures, the analysts attempted to reduce the size of  ;

the model (from that used in the IPE) by judging whether a component would be part of a risk-significant l cutset. This is not a rigorous method of developing a comprehensive seismic model because it makes a-priori judgments about the frequency of cutsets, and may inadvenently remove dominant ones. The i

. proper method is to screen cutsets after the ennre model is assembled. The licensee stated that many levels j of review have been performed on the model, and they are confident that it captures the risk-significant ,

seismic cutsets. However, the system fault trees do not include many valves that could play an important l role in internal-event risk. The entire IPE transient model should have been used for the seismic study.  !

This would have removed any doubt about the completeness of cutsets. The primary strengths of the i Energy Research, Inc. ix ERI/NRC 95-502 i

seismic study are: (1) its general consistency with NUREG-1407; (2) the heavy participation by licensee personnel; and (3) the identification of some plant enhancements owing to the walkdown. Besides the problem mentioned above, the primary weaknesses are: (1) use of a non-site-specific spectral shape (NUREG/CR 0098 median,5% damped spectral shape), without an accompanying sensitivity study, to understand the effect of not using the suggested NUREG/CR-5250 shape; (2) lack of explanation of the impact of unit differences on seismic risk; and (3) use of human error probability failure rates that do not account for earthquake level.

For the fire IPEEE, the licensee's performance of the additional expanded base case and the sensitivity case was beneficial and revealing. The expanded base case corrected an error in the original case which increased the average fire brigade response time from 3 maman to 10 mmie=. With this fix, the fire CDF 4

. increased by a factor of three over the original base-case CDF of 2x10 /ry. The expanded case also restored and quanufied core damage sequences which were previously screened out. Little change in the fire CDF resulted from this refinement. Building on the expand 6d set of sequences, however, the sensitivity case modified the calculation of the frequency of fire damage events by allowing one (rather than multiple) opportunities for suppression. For this modification, the fire CDF increased by nearly an d

order of ====ia* to approummaly 6x10 hy. Or.e location, the turbine building, which was previously screened out, emerged as a dominant location. The emergence of the turbine building, however, resulted from assumptions that artificially increased the likelihood of a turbine building-wide fire and does not indicate a vulnerability. The core damage frequency of other important locations (e.g. Vital I&C area, main feedwater pump area, and auxiliary shutdown panel) increased as well. The sensitivity studies provided substantial additional insights into the significance of assumptions in identifying the most l 6pruud fire locanons and in calculating the core damage frequency. The Catawba and McGuire Nuclear j Generating Stations are similar plants, as is the methodology Duke Power used to analyze fires at these l stanons Interestagly, the results of the base-case fire studies for these plants are significantly different,  !

whereas the licensee noted that the results of the sensitivity-case studies are similar. This observation clearly indicates the importance of using screening methods and assumptions that either realistically or .

I somewhat conservatively represent the plant. The most notable strengths of the fire IPEEE effort include the walkdown, which was found to be thorough and comprehensive, and the fact that the entire study was perfonned by the licensee's staff. There are several methodological w aaknesses which, if corrected, would  !

add considerably to the robustness of the study's results and insights. The most important of these weaknesses include: (1) use of the outdated NUREG/CR-0654 as a basis for a fire event tree; (2) use of 4 an outdated fire daabase which led to low estimates of fire initiation frequencies in key areas; (3) lack of .

consideration of control room abandonmarv scenarios; and (4) the use of a single fire source in each room to represent the entire room. The validity of the last item hinges on the licensee's statement that ,

mechanical and electrical equipment are always in separate fire compartments. Overall, the performance of the sensiovny cases has provided confidence that the licensee has made a reasonable attempt to identify '

fire vulnerabilities. The licensee's conclusion that the McGuire Nuclear Station offers no unacceptable risks from fires appears plausible.

From the McGuire HFO IPEEE, the licensee appears to have developed an appreciation of severe accident behavior. The licensee has gained a quantitative undermaMaa of the effects of high winds and external  ;

floods, and a qualitadve understanding of transponation events. Since the IPEEE analysis was carried out by the licensee, without any outside help, the licensee has itself achieved meaningful insights. The tornado CDF is within the typical range from other PRAs. However, the frequency of occurrence of flood appears lower than typical PRA values. The principal shortcommg of the HFO IPEEE submittal is that it does not provide daailed analysis and information about external flooding and transportation events. The submittal Energy Research, Inc. x ERI/NRC 95-502

I i

t mainly relles on the analysis results obtained from the McGuire PRA. From the submittal, it is unclear which data and information have been revised or recalculated.

i i

+

i i

t l

i l

l Energy Research, Inc. xi ERI/NRC 95-502

. _ . . _ . . _ _ . . . _ . _ . . _ - _ _ _ _ _ _ . . _ ~ . . . _ . . _ _ _ . . . _ ... __.__._._ .. _ ._ . . - . . _ .

PREFACE De Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include:

. t Seismic M. Frank, Primary Reviewer R. Sewe!!, Secondary Reviewer 4

Era M. Frank, Primary Reviewer J. Lambright, Secondary Reviewer Hlah WinAc. Flande and Other Frearnal Ev=::

M. Modarres, Primary Reviewer W. Werner, Secondary Reviewer neview o,,reinhe. r nardin eian .-d i.e r.esan M. Khatib-Rahbar, Principal Investigator, Report Review A. Kuritzky, IPEEE Review Coordination and Integration R. Sewell, Report Integration his work was p=fvimed under the auspices of the United States Nuclear Regulatory Commission, Omce of Nuclear Regulatory Research. The continued technical guidance and suppon of various NRC staffis acknowledged.

i Energy Research, Inc. xii ERI/NRC 95-502

- - r

ABBREVIATIONS AFW Auxiliary Feedwater CDF. Core Damage Frequency DPC Duke Power Company EPRI Electric Power Resear:h Institute ERI Energy Research, Inc.

FIVE Fire Induced Vulnerability Evaluation FSAR Final Safety Analysis Report Gl GenericIssue GL Generic Letter GSI Generic SafetyIssue HCLPF High Confidence of Low Probability of Failure -

1 HFO High Winds, Floods and Other External Initiators HVAC Heanng, Ventilation and Air Conditioning 4 I&C Instrumentation and Control  !

IPE Individual Plant Er==in=rion l IPEEE Individual Plant Examination of External Events LER Licensee Evaluation Report l LLNL Lawrence Livermore National Laboratory 1 LOCA Loss of Coolant Accident LOSP I.oss of Offsite Power MCC Motor Control Center l NRC U.S. Nuclear Regulatory Commission NSW Nuclear Service Water OL Operating License PGA Peak Ground Acceleration PMP Probable Manmum Precipitation i PORV Power-Operated Relief Valve  !

PRA Probabilistic Risk Assessment PWR Pressunzed Water Reactor RAI Request for AdditionalInformation RCP Reactor Coolant Pump RHR Residual Heat Removal RLE Review Level Earthquake RPS Reactor Protection System RWST Refueling Water Storage Tank SI Safety Injection SMA Seismic Margin Assessment SQUG Seismic Qualifications Users Group SRP Standard Review Plan SSE Safe Shutdown Earthquake SSF Standby Shutdown Facility j SSPS . Solid State Protection System TER Technical Evaluation Report USI Unresolved Safety Issue Energy Research, Inc. xiii ERl/NRC 95-502

.~ - . .

i 1 INTRODUCTION This technical evaluation report (TER) do===== the results of the "submittalonly" review of the indrvidual plant araminarian of extemal events (IPEEE) for the McGuire Nuclear Station, Units 1 and 2

[1]. His technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external initiators, including seismic events; fires; and high winds, floods, and other (HFO) external eVGENs.

De U.S. Nuclear Regulatory Commission (NRC) objective for this review is to determine the extent to which the IPEEE process used by the licensee, Duke Power Company (DPC), meets the intent of Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE submittal are intended to provide a reliable perspective that assists in making such a determination. This review involves a qualitative evaluanon of the licensee's IPEEE subalual, development of requests for additional information (RAls), evaluation of the licensee responses to these RAls, and finalization of the TER.

The emphasta of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to the guidelines established in NUREG-1407 [3]. Numerical results are verified for ramannahleness, not for accuracy; however, when encountered, numerical inconsistencies are reported.

This TER complies with the requirements of NRC's contractor task order for an IPEEE submittal only review.

The remainder of this section of the TER describes the plant configuration and presents an overview of the licensee's IPEEE process and insights, as well as the review process employed for evaluation of the semnic, fire, and HFO event sections of the McGuire IPEEE. Sections 2.1 to 2.3 of this report present ,

ERI's findings related to the seismic, fire, and HFO event reviews, respectively. Sections 3.1 to 3.3 1 summarize ERI's conclusions and recommendations from the seismic, fire, and HFO event reviews, respectively. Section 4 summarizes the IPEEE insights, improvements, and licensee commitments.

Section 5 includes completed IPEEE data summary and entry sheets. Finally, Section 6 provides a list of references.

1.1 Plant Characterization The McGuire Nuclear Station is a two amt WaniaN,4-loop. 3,411 MWt plant with an ice condenser contr.imosat. The safe shutdown earthquake (SSE) for the site is 0.15g, and McGuire is considered an i Appendix-R plant. The IPEEE was performed on Unit 1, and the applicability of results to Unit 2 was asserted based on systems similarnies. A significant plant-specific feature is the standby shutdown facility (SSF), which houses part of the standby shutdown system. The facility was found to have a median i fragility of 0.15g, and is assumed to fail during any seismic event. The facility is significant, however, ,

' in the fire manaanmem No then== inn of the applicability of Unit-1 fragilities to Unit 2, and no discussion ,

of the pr=+i=1 sequences involving both units, were found in the reviewed documemation. I i

1.2 Overview of the Ihannae's IPEEE Premas and Important Indy5 ]

i 1.2.1 Seismic j i

McGuire is binned in the 0.3g focused-scope review category per NUREG-1407 Table 3-1 [3]. DPC )

made use of a previous probabilistic risk assessment (PRA) [4] as the technical basis for the submittal. l Energy Research, Inc. 1 ERI/NRC 95-502 1

i

That PRA was updated for purposes of the IPEEE, consistent with NUREG-1407 guidelines. The  ;

screening craenon for the original PRA was a 2.5g median peak ground acceleration (PGA) capacity. The IPEEE walkdowns were conducted for the purposes of verifying equipment anchorage, confirming the validity of the original fragility estimates in the 1984 PRA, and identifying spatial interactions in the as-built plant configuration. '!)e walkdown was p4vi-id for both units during 1993, employing Electric Power Research Institute (EPRI) NP-6041 [5] procedures. In preparation for the walkdown, new '

in-structure response spectra were developed for the auxlliary building, in order to verify that anchorages screened out in the older study would be screened out using the EPRI NP-6041 method. As a result of the walkdown, a few of the fragilities were updated, and four new components were added to the list of 3

unscreened components for which fragilities were assessed.

The overall McGuire seismic PRA followed a conventional approach, and consisted of: a hazard assessment using the EPRI hazard curves; a fragility ======w performed earlier by Structural Mechanics Associates; and a systems analysis, using event trees and fault trees. The hazard curves, including uncertainties, were presented in the submatal. The input monon for the PRA was desenbad by the generic NUREG/CR 0098 median, 5 %-damped spectral shape. EPRI seismic margin assessment (SMA) criteria were used to screen out components during the walkdown [5]. Soil-structure interaction effects were considered to be negligible due to the nature of the rock and soil characteristics. The event-tree and fault tree models presented in the IPEEE submittal [1] were essentially identical with those used in the earlier McGuire PRA. Only unscreened seismic components were included in the model, along with the random 4

failure modes and human actions that were deemed to be potentially risk significant. Cutsets were generated using the CAFTA computer program. Cutset frequencies were calculated using the SEISM code, which is able to combine hazard curves, fragilities with both uncenamties and variabilities, and random failure rates. Point estimam of the cutset frequencies were shown in the submittal as a function of PGA interval.

A relay chatter analysis was performed using procedures consistent with those recommended for a focused-4 scope, Unresolved Safety Issue (USI) A-46 plant. In addition, chatter of low-fragility relays was considered in the systems model, with an assessed seismic fragility and a conditional probability of recovery.-

The IPEEE addressed containment performance by developing fragilities for containment structures,

~

i equipment related to containment isolation, and containment safeguard systems. The laner was included 4

in the analysis by addmg seismic response of enntainment air return fans and the containment spray system to the core damage cutsets. The submittal also addressed and considered as closed the following other issues: USI A 45, Generic Issue (GI)-131, USI A-17, and the Eastern U.S. seismicity issue.

The study has defined vulnerabilities as " unduly significant sequences." Based on this definition, no seismic vulnerabilities were found. Although cutsets differed somewhat between the previous 1984 PRA and the IPEEE, the overall dominance ofloss of offsite power (LOSP) did not changed.

4

' The calculated seismic core damage frequency (CDF) was 1.1 x10 per reactor-year (ry). The subminal states that the most risk-significant accident sequences involved LOSP with subsequent loss of diesel

. generators. Non-recovery of offsite power and diesel generators was assumed. Loss of nuclear service j water was also an important CDF contributor. The top thineen cutsers comprised 51% of the seismic a CDF. Of these thirteen, five were directly releed to LOSP and diesel generator failure; two involved

_; LOSP and failure of 125V DC power which, in turn, prevents diesel generator stanup; four were related i

! Energy Research, Inc. 2 ERl/NRC 95-502 i

to loss of both trains of nuclear service water; and two involved a combination ofloss of diesel generator and nuclear service water. He study apparently assumed, even though h was not stated, that an earthquake will cause a reactor trip and a turbine trip.

Loss of coolant aceWnte (LOCAs) were screened out on the following bases: (1) mechanical and structural equipment, which could fail in a way that may cause a LOCA, are of high capacity; and (2) no bad-actor relays are associated with the potential for a LOCN. The governing failure mechanisms of the ice condenser function were identified as collapse of the surrounding containment and collapse of crane supports, both of which have high capacity.

He relay review found that bad-actor relays, associated with the IPEEE equipment list, serve an alarm function rather than a control function. No further fragility evaluation was performed for these relays, although relays were included in the systems analysis.

The submittal states that soil tests during construction indicated that soils under seismic Category I structures are not susceptible to liquefaction. Findings relevant to other specific issues are as follows:

Usl A-45. Section 6.0 of the individual plant examination (IPE) reports that the calculated CDF owing to failure of decay heat removal systems from external initiators is 108/yr, with a seismic contribution of 7.8x104/yr.

GI-131. Previous seismic analysis of the interaction of the movable in-core flux mapping system has indicated that the restraints are adequate to prevent seismic interaction and breach of the pressure boundary.

Faetarn U s. sakmicity i==na. A sensitivity study was performed using the 1989 Lawrence Livermore National Laboratory (LLNL) hazard curves for McGuire. Cutsets of the top contributors, and the total fracnonal contribution of each cutset to CDF, were not found to be significantly altered in comparison to results for EPRI hazard input.

i Mi A-17. De seismic walkdowns identified a few nunor seismic interaction issues which were corrected and idendfied as plant anhancemants in Table 3-3 of the submittal. The licensee stated that the walkdown did not identify significant interaction concerns.

1.2.2 Fire The McGuire fire IPEEE [1] is an update of the full-scope, Level-3 PRA performed between 1981 and 1984. The update was started in 1988. The fire areas were reviewed during the walkdown to determine if an area could cause one or more initiatmg events. Those areas not capable of causing an initiating event were screened out. The remaming areas were reviewed to determine the fire source initiating event that would give the " worst case result" involving a fire in that room. The submittal states: 'The risk from other possible scenarios is judged to be bounded by the risk from the scenarios araminart."

Fire iniriarina event frequencies were developed using a database containing fire events through 1985, as derived from licensee event reports (LERs) and an EPRI study published in 1983. For most areas, the fire '

laid =ia= event frequency was based on the frequency of fire for a single selected component in the area, 1

, Energy Research, Inc. 3 ERIINRC 95-502 i

1s with no consideration given to other possible sources of fire in the area. However, the fire initiation frequencies for the control and cable rooms were based on the occurrence of fires in the entire area.

Each area was screened out ifit met one of two criteria, as follows: (1) An area was screened out if the probability of damage for the worst-case scenario was esnmatad to be less than 410 per year; or (2) an area was screened out if the fire damage probability was estimated to be less than the internal events frequency for the same or similar scenario (s). The screening analysis was performed using a Gallucci style fire event tree. The fire detection, suppression, and propagation parameters of the event tree were based on NUREG/CR-0654 [6). Multiple opportunities for suppression, without regard for the opposing time of l fire damage propagation, were modeled in the event tree.

Five fire areas / scenarios survived the screening. The assumed control room and cable room scenario was loss of nuclear service water; the assumed auxiliary shutdown panel scenario was loss of nuclear service water; the assumed vital instrumentation and control (I&C) battery area scenario was loss of nuclear j service water; and the assumed main feedwater pump scenario was loss of off-site power. '

Based on the IPE model transient funcuonal event tree and fault trees in Section 2 of Reference [4], cuttet frequencies were summed to obtain a total fire CDF of 2.3 xIC'/ry, which is less than 1% of the total 4

I McGuire CDF of 7x10 /ry (for internal and exterm.: events). Tbs fire sequence for main feed pump fire falls into the TBU functional sequence category, involving a transient (T) with failure of secondary side heat removal (B) and failure of safety injection (U). Cable, control, and vital I&C area fires, which were assumed to be equivalent to loss of nuclear service water, were identified as TQ3U sequences, involve a transient (T) with reactor coolant pump (RCP) seal LOCA (Qs) and failure of safety injection (U).

1 The licensee also submitted a suppiammtal study [7] whi:h included two additional cases of analysis. The l first case was termed an " expanded base case," which increased the average fire brigade response time l from 3 minutes to 10 minutes, and quantified those scenarios that had been screened out of the original l study based on the second screemng enterion mentioned above. The second case was termed a " sensitivity case," and limited the modeling of fire suppression to a single opportunity. The total fire CDF for the i expanded case was notably different from the original base case, with the CDF result increasing by a factor l l of three. This difference was attributed to the increased fire brigade response time. The total fire CDF  !

for the sensitivity case was significandy larger (increasing by almost an order of magnitude, to 6 x 104/ry)

{

than the expanded case, owing to the increased likelihood of fire damage caused by limiting the frequency reduction obtained by multiple suppression opportunities. The turbine building was identified as being l the most significant area for the sensitmty case. The other important fire locations were the same unscreened locations as in the original study.

The most significant walkdown insight was the identification of the potential to lose nuclear sen ice water from a fire in the vital I&C area. A fire in this area could potentially affect both a Unit-1 train B cable and the IEVDA panel board which houses control power for the train A 4160V breakers of nuclear service water. It was also noted during the walkdown that water from suppression systems can migrate from the 4

upper to lower switchgear room. A bounding CDF of 3 x 10 /ry was estimated for this situation, which is neither included in the risk analysis nor identified as a vulnerability.

i Energy Research, Inc. 4 ER1/NRC 95-502 l

-. r_- . .

I.2.3 HFO Events The licensee conducted a detailed analysis for some HFO initiators. Utility personnel were directly involved in all aspects of the development, quannfication, and documentation of the HFO analysis. His review has found some strengths and a number of weaknesses of the study, as summarized in Section 3.3 of this review.

De McGuire IPEEE submittal finds no unduly sieni&i* sequences (vulnerabilities) with respect to HFO

' events. De most significam contributor to the external-events CDF was an HFO event (i.e., tornadoes).

The submittal estimated that tornado events make up 63% of the CDF from external events. Tornado-induced events were considered to cause non-recoverable loss of offsite power. The dominant sequences

)

for tornadoes are those involving operational failures of the diesel generators.

j L3 C- .h of Review Pramm and Acel *W In its qualitative review of the McGuire IPEEE, ERI focused on the study's completeness in reference to NUREG-1407 guidance; its ability to achieve the intent and objectives of GL 88-20, Supplement No. 4; its strengths and wah=== with respect to the state ofte-ut; and the robustness ofits conclusions. This review did not emphasize couTu- don of numerical accuracy of submittal results; however, any numerical errors that were obvious to the reviewers are not d in the review findings. The review process included the following major activities: l

• Completely examine the IPEEE and related documents

• Develop a preliminary TER and RAls

• Examine respons to the RAls Finalize this TER and its findings Because these actmties were performed in the context of a submittal-only review, ERI did not perform j

. a site visit or an audit of either plant configuration or detailed supperdag iPEEE analyses and data. I Consequently, it is important to nue that the ERI review team did act verify whether or not the data i presented in the IPEEE matches the actual conditions at the plant and whether or not the programs or procedures described by the license &.e Need implemented at McGuire Nuclear Station.

I.3.1 Seismic 1

In conducting the seismic review, ERI-generally followed emphasis and guidelines described in the report, Indindual Plant Exanination ofEnernal Ewnts: A n Guidance (8], for review of a seismic PRA, and the guidance provided in the NRC report, IPEEE Step 1 Review Guidance Docenent [9]. In

=Minna on the basis of the McGuire IPEEE tubminal, ERI completed data entry tables developed in the Lawrence Livennore Nanonal Laborneory (LLNL) socument entitled "IPEEEDatabase Data Entry Sheer Package" [10].

In its McGuire seismic review, ERI examined the following documents: l the McGuire IPEEE [1]

the McGuire PRA [4]  !

the McGuire IPE [11] I Energy Research, Inc. 5 ERI/NRC 95-502 j i

!

• the licensee's responses to RAls [12]

! The checklist ofitems identified in Reference [8] was generally consulted in conducting the seismic review.

Some of the primary considerations in the seismic teview have included (among others) the following hems: i

+ Were appropriate walkdown procedures implemented, and was the walkdown effort sufficient to i_

i i accomplish the objectives of the seismic FEEE7 Was the plant logic analysis performed in a manner consistent with state of-the-art practices?  ;

Were random and human failures properly included in such analysis?

Wee component demands assessed in an appropriate manner, using valid seismic motion input and i structural response modeling? l Were fragility calculations performed for a meaningful set of components, and are the fragility  !

results reasonable?  ;

• Was the approach to seismic risk quantification appropriate, and are the results meaningful?  !

• Does the subminal's discussion of qualitative assmtmank (e.g., containment performance analysis, 1 seismic-fire evaluation) reflect reasonable engineering judgment, and have all relevant concerns been addressed?

• . Has the seismic FEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have all seismic risk outliers been addressed?

In some instances, quick calculations have been performed as part of the seismic review, in order to check the implications of various intermediate and final results. i 1.3.2 Fire -

During this technical evaluation, ERI reviewed the fire-events portion of the FEEE for completeness and c)nsistency with past experience. The fire analysis of References [1,4 and 12], as supplemented by Raference [7), was reviewed for methodological completeness, accuracy, and consistency with past experience. In addition, Appendices A to C of the McGuire FE [11], and Reference [6), were briefly reviewed for backpu-id. The guidance provided in References (8 and 9) was used to formulate the review process and the organization of this document. The data entry sheets used in Section 5 are taken from Reference [10].

The process implemented for ERI's review of the fire FEEE included an examination of the licensee's methodology, data, and results. ERI reviewed the methodology for consistency with currently ace =*#

l and state of4he-art methods, paying special attention to the screening methodology to ensure that no fire l scenarios were prematurely eliminated, and to the assumpoons used, because the results of many studies are unduly influenced by assumptions made to simplify or introduce conservatism. Other methodology l elements include, for example, development of fire event trees, fire propagation, suppression and detection, and systems modeling. Data elemann include such items as cable routing, fire area partitioning, e

{ Energy Research, Inc. 6 ERIINRC 95-502 l

1 I

i fire initiation frequency, detection and non-suppression frequencies, and recovery probabilitiet Results ir.clude such items as minimmi cut sets, core damage frequency and fractional contribution af cut sets, identification of important fire areas and scenarios, and effect of fire on early containment failure.

For a few fire zones / areas that were deemed important, ERI also verified the logical development of the screening justifications / arguments (especially in the case of fire-zone screening) and the computations for fire occurrence frequencies.

1.3.3 HFO Events The review process for HFO events closely.followed the guidance provided in the report entitled IPEEE Step 1 Rew'ew G4 dance Document [9]. This process involved examinations of the methodology, the data ,

used, and the results and conclusions derived in the submittal. The IPEEE methodology was reviewed for l consistency with currently accepted practices and NRC recommended procedures. Special attention was i focused on evaluating the adequacy of data used to estimate the frequency of HFO events, and on confirming that any analysis of Standard Review Plan (SRP) conformance was appropriately executed.

In addmon, the validity of the licensee's conclusions, in consideration of the results reponed in the IPEEE submittal, was assessed. Also, in some instances, computations of frequencies of occurrence of hazards, fragility values, and failure probabilities were spot checked. Review team experience was relied upon to l

assess the reasonableness of the licensee's evaluation. '

I 4

1 l

l i Energy Research, Inc. 7 ERI/NRC 95-502

- -- - . - ._ - - _.~ . - . _ .- _.. - _

3.-..---..-

l lA 2 CONTRACTOR REVIEW MNDINGS

! 2.1 Edenic A summary of the licensee's seismic IPEEE process has been described in Section 1.2. Here, the licensee's seismic evaluation is amminad in detail, and discussion is provided regarding significant observations encountered in the present review. '

l 2.1.1 Overview and Relevance of the Seismic IPEEE Process i

McGuire is assigned, in NUREG-1407, to the focused-scope seismic review category. He review level  !*

earthquake (RLE) is described by the NUREG/CR 0098 [13] median spectral shape achored to a PGA value of 0.3g. DPC elected to update an existmg seismic PRA study in performing the seismic IPEEE for McGuire.

The sedy appears to be a thorough and technically adequate implementation of an existing seismic PRA for purposes of the IPEEE. De existing PRA was supplemented by a walkdown that followed the guidelmes of EPRI NP 6041. The walkdown was preceded by development of new floor response spectra in order to check the fragility calculations gensted in the original study, particularly with respect to anchorage failure modes. All fragilities used in the IPEEE either come from the origmal 1984 study or were generated with the same spectrum A bad-actor relay review was performed. He submitted

&-:- -- d-3n [1,4,11 and 12) is sufficiendy complete to provide confidence that, except for a few cases, the guidance of NUREG-1407 was followed with respect to use of an existmg PRA.

2.1.2 Logic Models l

The event tree and fault tree models presented in the IPEEE submittal [1] are essentially identical with  !

those of the earlier PRA. Cutsets differ somewhat due to changes in fragility values. The overall dominance ofloss of offsite power has not changed between the 1984 study and the IPEEE.

A functional transient event tree, which was developed under the assumptions ofloss of offsite power and loss ofinstrument air, was contined with top-event fault trees modified from the IPE model. He seismic event tree, however, excludes the reactor protection system (RPS), which was found to have a high mechanical capacity and no bad-actor relays. Reactor coolant pump seal LOCAs and stuck-open power-

[ operated relief valves (PORVs) were included as non-seismic transient-induced LOCAs. All other causes of LOCAs were screened out on the basis that related components have high mechanical capacity and no associated bad-actor relays. The fault tree models used in the seismic analysis were simplified fram the IPE fault trees. Ownp== semnic failure modes which had a median fragility ofless than 2.0g, and were also unscreened during the seismic walkdown, were included in the model.

The licensee states that many levels of review had been performed on the seismic model, and that it is ennMant that the model capares the risk-significant seismic cutsets. In general, the fault tree models lack many valves that play an important role in internal-events risk. Seismic capacities of valves were found to be high, and they were screened out as none yvr-i seismic contributors. This does not mean, however, that their cumulative effect owing to random failures is necessarily insignificant. De lack of 7 modeling of valves in the fault trees does not allow an assessment of their importance. Hence, this is an i

example of an assumption pre determining the results. His method has led to some obvious omissions 4

i

- Energy Research, Inc.

[

8 ERI/NRC 95-502

-P*+,- 9 4i % g* w p- -r -

v v9-w-'W**vp g -r n ysvwy m-- g y .e.ei -% y- -e+- --- - --,m- -- --- , w -me -

v -

M --yr---- e-

l l

and inconsistencies in the modeling process. Specific examples of omissions and inconsistencies in the modeling are as follows:

The model includes both centrifugal charging pumps and safety injection pumps. However, the boron injection tank isolation valves are typically closed and on the discharge side of the centrifugal charging pumps. The model does not include failure to open this path.

The model includes failure of the operator to align the residual heat removal system for high-pressure recirculation._ However, the model does not include failure of the valves that must be actuated for high-pressure recirculation.  !

e Page 14 of the seismic fault tree shows logic for the nuclear service water (NSW) pond suction source. One of the gates, labeled CBLOOPDG, refers to loss of offsite power and random hardware failures of diesel generator train B (which is modeled on Page 11). The more complete diesel generator model found on Page 10 of the fault tree, which includes common cause and seismic failures of diesel generator and related components should have been used.

Secondary side heat removal is modeled only up to the auxiliary feedwater pumps. The discharge side, which relies on the availability of a discharge path through the valves isolating the auxiliary feedwater discharge from the neam generators and through main steam power operated relief valves (or through the turbine bypass valves), is not modeled.

i e

The model includes an alternate source of water to the auxiliary feedwater system from the NSW l

system. However, the isolation valves separating service water piping from the auxiliary j feedwater suction header are not modeled.

l The model includes the steam turbine-driven auxiliary feedwater pump. However, the normally closed isolation valves from the main steam tap to the pump are not modeled.

l The seismic logic model should have been more consistent with the original IPE model, without the a-priori elimination of components.

2.1.3 Non-Seismic Failures and Human Actions Non semnic failures and human actions were introduced in the seismic analysis through use of modified IPE logic models. However, the analysts attempted to reduce the size of the seismic model by judging whether a ====* would be part of a risk-significant curset. This method was not a rigorous approach for developing a comprehensive seismic model because it made a-priori judgments about the frequency of cutsets, and may have inadvertently removed some dom m

• mw ones. The proper method would be to screen cutsets after the entire model had been assembled. The submittal states that a random failure with a probability on the order of 10 ', or lower, would typically not be significant.

Post-initiator operator actions, such as operator aligunents, establishment of bleed and feed, and establishment of recirculation, were included in the seismic model. However, human failure rates used

in the analysis do not account for the earthquake level. The m^ del and results used for the IPE were used j for the semnic assessment. He licenseejudges that earthquake-induced equipment failures would not have

) Energy Research, Inc. 9 ERl/NRC 95-502 l

l-i

1 I

! i an effect on the operators, because the same operating procedures would apply. This judgment is not

! necessarily valid.

It appears, from a review of the cutset list, that the most important operator error is operator failure to l align train A of nuclear service water to the pond.

2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape)

De ground response spectra used for the design of structures at McGuire Nuclear Station was developed by Newmark. For the IPEEE, seismic demands were obtained by scaling the SSE demand estunates for the increase of review level groand response spectrum amplitudes over the SSE ground response spectrum values. The study used the generic NUREG/CR-0098 median,5 % damped spectral shape, instead of the site-specinc median 10,000 year spectral shape, as found in NUREG/CR-5250. NUREG-1407 recommends the former for a seismic margins assessment, and the latter for a PRA.

The McGuire seismic IPEEE does not use the site-specific spectral shape recommended in NUREG-1407 for a seismic PRA. Instead, the NUREG/CR-0098 spectrum (the recommended spectrum for a seismic margins assamamant) was used to define the seismic input for the PRA.

2.1.5 Structural Response and Component Demands Am6cial earthquake -hiy records, whose response spectra envelop the smoothed ground response  ;

spectra, were used to develop the in-structure (floor) response spectra. In preparation for the walkdown, l new in structure response spectra were developed for the auxiliary building. These new spectra were used strictly to evaluate anchorages during the walkdown and were not used for fragility calculations.

Deconvolution was not used.

The w.ch to eM-% structural responses and component demands appears to be consistent with the renmmandatians of NUREG-1407.

2.1.6 Screemng Cnteria The original PRA used a screening criteria of 2.0g for components and 2.5g for structures. Anchorage

{

failure modes were included in the origmal capacity assessments, but the IPEEE walkdown also i emphasized assessment of anchorages. For the IPEEE, the Reference [5] cnteri. were used in addition to the or gmal criteria. With modifications as summarized in Table 4.1, all anchorages, except for the main comrol boards, were screened out. The turbine building was screened out because its median capacity was assessed as being greater than 2.5g. Block walls at McGuire are mechanically pinned at the floor and ceiling, and use horir stal and vertical reinforcing bars grouted against the walls. De walkdown verified the block-wall reinforcement. Functionality of the ice condenser is governed by the ability ofice to condense steam Althngh the review-level earthquake (RLE) may cause some deformation of ice haalrara, overall ice condenser functionality may likely remala. Failure of the crane wall and containment shell, however, would disable the ice condenser. These latter structures have median capacines in excess of 2.5g, and were screened out.

l The screening criteria employed in the McGuire seismic IPEEE analysis appear to be appropriate.

Energy Research, Inc. 10 ERI/NRC 95-502 l

4 2.1.7 Plant Walkdown Process

- The walkdown followed the guidance of, and used the documentation recommended in, Reference [5]!

The walkdown team consisted of PRA team members, station system and equipment engineers, i civil / structural engineers trained in seismic qualification utilities group (SQUG) and IPEEE seismic j walkdown procedures, in addition to supporting station craft personnel. The walkdown produced i quaikative insights and its objective may be summarized as: (1) verifying the assumptions made during the

' fragility analysis; (2) verifying adequacy of anchorage; and (3) resulting in discovery and correction of minor amiamic spatial interactions. . The walkdown also included evaluations of block walls and passive distribned components. Representative samples of distributed components, such as heating, ventilation, and air conditioning (HVAC) ducts, pipes, and electrical raceways, were reviewed. The subnuttal conchuled that these are all seismically rugged. The statamant is made that non-Category-I structures are -

designed against collapse onto Category-I structures.

The seismic walkdown process followed the recommended guidance of NUREG-1407.

2.1.8 Fragility Analysis Structural and component capacity and fragility evaluations'were performed by Structural Mechanics Associates for the original 1984 study, and were generally used, with a few exceptions, for the IPEEE submittal. The exceptions stem from re-analysis resulting from the walkdown. Capacity factors and fragilities for seismic events beyond the SSE were developed in accordance with the conventional fragility l' analysis approach [14]. The median plant level fragility was determined to be about 0.5g PGA.

Fragilities presented in Table 3-1 of the submittal indicate that many high confidence oflow probability l of failure (HCLPF) values are below the site RLE. Components with low HCLPFs include, for example,  ;

normal auxiliary feedwater (AFW) source water, safety injection pumps, turbine-driven auxiliary feedwater 2 pump, charging pump, refueling water storage tank (RWST), anf low-level intake structure.

No discussion of the applicability of fragilities to Unit 2, and no discussion of the potantial sequences involving both units, were found in the reviewed documemation. The system models of McGuire Unit

- I were simply deemed by the licensee to be applicable to Unit 2.

-2.1.9 Accident Frequency Estimatm Hazard curves were combined with component fragilities, non-seismic failure rates, and imman error rates l to obtain a total seismic CDF. The plant fragdity was determinad from summation of the cutset fragilities. l The plant median fragility was determined to be approximately 0.5g PGA. )

An upper bound ground motion cutoff of i.02g PGA was used in the licensee's IPEEE. It is stated that, 4

4 because the mean frequency of this acceleration is about 3 x10 per year (yr), extending the analysis beyond that level would not significantly affect the overall seismic CDF.

l The overall McGuire seismic PRA process followed conventional methodology, and made use of the  !

l following infonnation: EPRI hazard curves; a fragility assessment, performed by Structural Mechanics Aaseimas; and a systems analysis, using event trees and fault trees. Hazard curves included uncertainties

) and were generated by the EPRI EQHAZARD code; the results are presented in the submittal. The system F model was based on a simplified version of the internal-events transient event-tree and fault tree models.

l Energy Research, Inc. I1 ERI/NRC 95-502 l

_ _a ,._,_..,..a _ . .

. t Cutsets were generated using the computer program CAFTA. Cutset frequencies were calculated using l the SE1SM code, which is able to combine hazard curves, fragilities with both uncertainties and variabilities, and random failure rates. Point asumates of the cutset frequencies were provided in the subminal as a function of PGA interval.

De total seismic accident frequency is of the same order of magnitude as for many other seismic studies, and it was obtained from a plant-level fragility estimate coupled with the seismic hazard curve. The seismic core damage frequency was estimatai at 1.1 x 104/yr.

2.1.10 Evaluation of Dominant Risk Contributors De subental states that the accident sequences that are the most important risk contributors involve loss ofoffsite power with subsequent loss of diesel generators. This findmg is typical of many nuclear plants; ceramic insulators on main power feed transformers are known to be vulnerable to seismic shock loadmg.

Recovery of offsite power and recovery of diesel generators were assumed in the analysis to fail to prevent core damage. Loss of nuclear service water was also found to be an important CDF contributor.

i The top thirteen core damage cutsets contributed 51 % to the calculated seismic CDF. Of these thirteen, j five were directly related to loss of offsite power and diesel generator failure; two involved loss of offsite

! power and failure of 125V DC power which, in turn, prevents diesel generator startup; four were related i to loss of both trams of nuclear service water; and two involved a combination of loss of diesel generator

{ and nuclear service water. The study apparently assumed, although it is not stated, that an earthquake j would cause a reactor trip and a turbine trip (with or without a loss of offsite power).

l .

I 2.1.11 Relay Chatter Evaluation l

[ i A relay charter evaluation was performed using a procedure consistent with guidelines for a focused-scope, j Unresolved Safety Issue (USI) A 46 plant. It was found that all bad-actor relays, which are associated j with the IPEEE equipment list, serve an alarm function rather than a control function. No further  ;

i evaluation was performed on these relays. However, relay charter was considered in the systems model ,

j with an assessed seismic fragility and an assumed conditional probability of recovery of 0.1.  :

j 2.1.12 Soi! Failure Analysis Soil-structure interaction was considered negligible because of the rock and soil characteristics at the plant

} she. De subnuttal states that soil tests during construction indicated that soils under seismic Category-I i structures are not susceptible to liquefaction.

2.1.13 Containment Performance Analysis The study evaluated seismic fragilities for the reactor building, steel containment vessel, and building walls. It concluded that the fragilities are sufficiently high to eliminate failure of the containment structure. Penetration piping, valves, and supports were evaluated as having fragilities greater than 2.5g, and were screened out of the system model. Contamment isolation signals were included in the systems model as solid state protection system (SSPS) cabinets, motor control centers, and panel boards with a l relay chatter failure mode. The study also attempted to address containment performance by including seismic failure of containment spray and containment fans in the core-damage cutsets. The rationale and Energy Research, Inc. 12 ERI/NRC 95-502

1 l

1 model used for includmg these in some cursets, but not others, was not explained. Analysis of the fraction of seismic CDF attributable to each plant damage state, or asscciated with impaired containment performance, was not developed. Containment failure modes and plant damage states associated with seismic accident sequences were not identified, inconsistent with the guidelines in Appendix C.2 of NUREG-1407.

1 2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations No equipment with voltage less than 600V was evaluated for seismically induced fires because the licensee judged that such equipment could not generate sufficient energy during an earthquake to ignite cable I insulaton. De licensee cited industry-sponsored qualification shaker table tests which require seismically l qualified electrical components to continue normal functionality.

The submittal concluded that the reactor coolants pumps are the only high energy equipment that does not have seismic qualification. A fire involving the motors was assumed to not affect the plant's ability to achieve safe shutdown, and hence, no further work was done. The licensee reasoned that, because no other fire could reasonably be caused by an earthquake, failure of fire protection systems during an earthquake is inconsequential.

l No bad-actor relays were identified =W with fire protection equipment. All other seismic-fire issues are discussed in Section 2.2.13 of this TER. The submittal provides no discussion of the potential and effects of seismically induced flooding, other than with respect to seismic inadvertent actuation of fire suppression systems.

2.1.15 Treatment of USl A-45 Based on Section 6.0 of the McGuire IPE submittal [11], the calculated CDF owing to failure of decay heat removal systerns from external initiators is 10'8/ry, with a seismic contribution of 7.8x10/ry. An

' upus.ece o ranking revealed that the decay heat removal components most important to CDF are: upper surge tank and condensate storage tank, turbine-driven auxiliary feedwater pump, service water system low level intake, offsite power, and the diesel generator start air tank.

2.1.16 Treatment of GI-131 I i

De licensee has noted that previous seismic analysis (circa 1985), pertaining to interaction of the movable .,

l in-core flux mapping system, indicated that the restraints are adequate to prevent seismic interaction and breach of the pressure boundary.

2.1.17 Other Safety Issues

a. Eastern U.S. Seismicity issue l

l Regarding the Eastern U.S. Seismicity Issue, a sensitivity study was performed using the 1989 LLNL i- hazard curves for McGuire. Cutsets of the top contributors, and the total fractional contribution of each cutset to seismic CDF, were found not to be significantly different from corresponding results obtained using the EPRI hazard curves.

I Energy Research, Inc. 13 ERUNRC 95-502 l

1'

b. USIA-17

\

j . Regarding USI A-17, the walkdowns identified a few minor seismic interaction issues which were corrected and idennfled as plant enhancements in Table 3-3 of the submittal. De licensee states that the

. walkdown did not identify significant interaction concerns.

L

2.1.18 Process to Identify, Eliminate or Reduce Vulnerabilities 1

4 The licensee used the PRA process, coupled with the seismic walkdown, to identify potential vulnerabilities. No vulnerabilities were fmnd. ne walkdown resulted in some enhancements to reduce 1 minor seismic spaial interacnons, as addressed in Table 3-3 of the submittal under the title " Enhancements i Resulting from the IPEEE Seismic Verification Walkdown."

] 2.1.19 Peer Review Process i .

- l l A peer review was conducted in-house by a group of managers and senior engineers from the Catawba and j Oconee stations. The primary focal points of the review included: selection of areas and equipment, evaluation process, walkdown process and judgments, documentation, and results.

2.2 Bra

[

i i A summary of the licensee's fire IPEEE process has been described in Section 1.2. Here, the licensee's

! fire evaluation is described in detail, and discussion is provided regarding significant observations j encountered in the present review.

4 4

2.2.1 Overview and Relevance of the Fire IPEFE Process

a. Methodology Selected For Fire IPEEE l

The McGuire fire iPEEE [1] is an update of the full-scope, Level-3 PRA performed between 1981 and l

1984. The PRA update was inmaract in 1988. The analysis identified critical fire areas, identified possible i initiating events, calculated the fire initiation frequency, analyzed for the impairment of critical safety i functions, and developed core damage cutsats (and quantified their frequencies) using a functional tr:nsi.ent event tree and associated fault trees. A special fire event tree was used to help screen out areas, and assess i fire damage and the frequency of fire damage. This fire event tree allowed multiple attempts at j

. suppression, without regard to the opposing timing of damage propagation. A screening process was j employed in which fire scenarios were not quanafled if a similar IPE scenario had a larger estimated '

frequency of occurrence. The licensee's original IPEEE study [1] was supplemented by two additional analyses [7]. De first additional analysis (termed the expanded base case) expanded the scope of quantified sequences by including those fire scenarios that were screened out of the original study. This analysis also included a modification to the fire brigade response time, in which the average estimated response time was increased from 3 minutes to 10 minutes. The second addidonal analysis (termed the sensitivity case) limited the number of suppression anempts to one and assumed a fire that encompasses the entire room, given failure of suppression.

4 Energy Research, Inc. 14 ERI/NRC 95-502

l l

b. Key Assumptions Used in Performing de ?1re IPEEE l

The following study assumptions have a governing effect on results:

, 1. It was assumed that the effect of all control room fires, cable room fires, and fires in the vital i instrumentation and control (I&C) area were identical, and have the same effect on the plant as loss of nuclear service water.

l

' 2.' It was amn=d that the p.as of NUREGICR 0645 are applicable to the McGuire fire PRA, I even though the event tree significantly differs from the NUREG/CR 0645 sequence of events.

3. Multiple oppertunities for suppression, without knowledge of thdrelative tuning of suppression and damage propagation, were assumed in the base-case fire IPEEE model.

4. It was assumed that damage from fire suppression systems and smoke are insignificant when compared to damage owing to heat from fires, and therefore, these aspects of fire damage were not included in the analysis.

c. Staus ofAppendix R Modifcations .

The submittal indicates that McGuire is in compliance with Appendix R.

d. Newor Existing PRA i

As stated above, the McGuire fire IPEEE is an update (initiated in 1988) of the full-scope, Level-3 PRA

. performed between 1981 and 1984.

l 2.2.2 Review of Plant Information and Walkdown

a. Walkdown Team Composition ,

l The walkdown team was composed of two fire protection engineers, a PRA analyst, and a program manager, all from DPC. Peer review of the walkdown was performed by a fire protection engineer from ]

Catawba Nuclear Station.

b. Signifcant Wa& doms Findings l

'Ibe walkdown was performed to verify assumptions about plant configuration used in the PRA, and to ,

address the Sandia fire risk scoping study issues. The walkdown findings were an incentive to update the

McGuire fire PRA, as documented in Revision 2 of Section 3.5 of Reference [1]. The most significant l change to the PRA was the identification of the potential to lose nuclear service water from a fire in the

-. vital I&C area. A fire in this area could potennally affect both a Unit-1 train B cable and the IEVDA  !

l panel board, which houses control power for the train-A 4160V breakers of nuclear service water. Thus, l both trains of nuclear service water could be affected by the same fire. It was also noted during the l walkdown thm water released from suppression systems can migrate from the upper to lower switchgear room. A bounding CDF of 3x104/ry was esumated. This situation was neither included in the risk analysis nor identified as a vulnerability, because the actual core damage risk was judged to be much lower Energy Research, Inc. 15 ERI/NRC 95-502

i than the bounding estimate. 'Ibe submittal states that the walkdown verified that plant areas can adequately deal with smoke damage because of adequate ventilation or large spaces. The walkdown effort and d==aatation appeared to be quite thorough.

c. Signifcant Plant Features As stated by the licensee during a June 4,1996 meeting' at the NRC, there are no rooms with mechanical equipment that also contain electrical cabinets, panels, or motor control centers (MCCs). This unusual configuration is perhaps the most significant plant feature with respect to the fire IPEEE because it would tend to validate the licensee's approach of treating a single piece of mechanical equipment as the sole fire ignition source in a room. Other significant plant features relative to the fire analysis are the standby shmdawn system, Appendix R separation between redundant trains, ability to cross-connect offsite power between units, and the ability to cross-connect nuclear service water between units, with only one nuclear service water train required to supply the water naeds of both units. Instrument air is also shared between the two units.

The Catawba and McGuire Nuclear Generating Stations are similar plants, as is the methodology Duke Power used to analyze fires at these stations. Interestingly, the results of the base-case fire studies for these plants are significantly different, whereas the licensee noted that the results of the Jensitivity-case studies are similar.

2.2.3 Fire-Induced Initiatmg Events

a. Were Initiating Ewnts Other than Reactor Trip Considered?

The following ininarmg events were considered: plant trip, loss of offsite power, loss of main feedwater, loss of nuclear service water, loss of component cooling, loss of control area ventilation, loss of 4160 V essential power, loss of auxiliary shutdown panel, loss of vital instrumentation and control power (125 V DC and 120 V AC), loss ofinstrument air, and LOCA. Typically, only one initiatmg event was selected to represent any individual area.

b. Were the initiaring Ewnts Analy:ed Properly?

The fire areas were walked down to determine if an area could cause one or more initiating events.

Questionnaires were filled out for each area. Areas that were deemed to not cause an initiating event were screened out.  ;

The licensee performed a review of both vital and non-vital cabling to determine if a plant trip (initiating event) was plausible for each room. However, plant operators were not consulted about how the plant and the operating crew would react to fires.

2.2.4 Screening of Fire Zones

a. Was a Proper Screening Met}wdology Fanployed?

The origmal submittal [1] documented a screening analysis in which rooms were screened on the basis of an imtiating event crir.rion and two frequency criteria. First, fire areas were reviewed to determine if an Energy Research, Inc. 16 ERI/NRC 95-502

4 area could cause one or more initiating events. The areas that would not cause an initiating event were screened out. De survivmg areas were assigned a " worst case result" initiating event. Second, each area j was screened based on: (1) whether or not the probability of damage for scenarios of the worst case '

4 inniatmg event was less than 10 /yr; and (2) whether or not the fire damage probability was less than the frequency of the same or similar equipment damage scenario for internal events. A subsequent submittal ,

[7], which the licensee has termed the " expanded base case," removed the last screening criterion and quantified fire scenarios even though the fire damage probability was less than the frequency of a same or similar internal events scenario. This expanded base case also corrected an error in the estimated average fire brigade response time. The correction adjusted the average time from 3 minutes to 10 minnw.

The screenmg was f.fouoed using a Gallucci style fire event tree. De parameters of the event tree were based on NUREG/CR 0654, judgmentally adjusted for each area. NUREG/CR-0654 was published in 1979 to provide a reasonably simple, yet technically comprehensive, approach to aid designers and regulators of fire protection systems. It recommended three approaches: a deterministic approach, a l probabilistic approach, and a qualitative approach. The recommended probabi'istic approech was called a critical-path technique, and was developed in 1976. A critical path diagram shows alternative paths of fire ignaion, growth, discovery or detection, suppression or self-extmguishment. Multiple opportunities for suppression and detection are allowed in a path. The events in the diagram are associated with  ;

judgmentally (and statistically, when data existed) determmed numbers between zero and one, provided l

- in Table 4 of Reference [6], which are called probabilities. The table also provided qualitative criteria to j guide the selection of the probabilities. The authors of NUREG/CR-0654 have pointed out that the conservatism of the method depends on the conservatism of the probabilities selected.  !

~

The probabilities used by the licensee, as discussed in Section 2.2.9 below, tend to overestunate the probability of suppression, in comparison with accepted data, thereby underestimating the fire risk.

Furthermore, the event tree provided in the submittal is only an approximation of the more deteited and

explicit critical path diagram in Reference [6]. Reference [6] states

"... it was necessary to vh,ualize events at particular stages of fire development so that a valid estimate of the probability of success or

. failure could be made." The critical path diagram included parameters such as area of potential air-intake opemngs, fuel cominuity, fuel availability, and penetration of barriers, all of which do not appear as part of the licensee's fire event tree. Therefore, the use of these probabilities in the licensee's simplified event tree may not be valid.

I Selecting a " worst case result" scenario for a room is valid if the frequency of all potential core damage scenanos for the room is accounkd for. In the licensee's approach only the frequency of the selected fire scenano was quantified. Alternative scenarios from other fire sources in an area were deemed to be insignificant. Therefore, screening out the selected scenario was equivalent to sereening out the entire area. In support of this approach, as noted in Section 2.2.3c above, the licensee stated that electrical cabinets do not appear in the same rooms as mechanical equipment.

Except for 4160 V switchgear, reactor trip switchgear, and the auxiliary shutdown panel in the auxiliary feedwaer area, cabineti ninmd fires are not included in the McGuire fire IPEEE analysis. The licensee's rationale for this approach was that cabinet fires are less likely to damage the component of interest in a room (e.g., diesel generator or componet coeling waer pump) than a fire initiated at the component itself.

Here again, the licensee's statement about the non-coincidence of motor control centers and mechanical equipment is significant to the validation of the approach.

Energy Research, Inc. 17 ERI/NRC 95-502

.7-l l .

l l All of the selected sequences for fire areas involved transients. The submittal briefly addresses fire-induced LOCAs in the control room, cable room, and contamment. In all three cases, it was argued that,

! because power can be removed from the pressurizer PORVs from outside of the control room, if they fail '

open by a fire, such an occurrence was not a concern and not further examined. However, the potential ability to remove power during a fire does not equate to a certainty that the event will occur. This is panicularly the case for a control room fire that results in abandonment of the control room. In such a case, an important consideration is the ability to idennfy a failed open PORV before the control room is abandoned.

b. Haw the Cable Spreading Room and the Control Room Been Screened Out?

The cable spreading and control rooms were not screened out.

c. Were There Any Fire Zones / Areas That Haw Been bnproperly Screened Out?

He expanded base case had no significant zones or areas that were improperly screened out.

2.2.5 Fire Hazard Analysis The development of imnanng event fire frequencies by analysis of industry-wide data is laudable for a site that had linie or no operational experience in 1984. However, this database was not updated for the 1988 through 1991 study, and plant-specific data was not used. A comparison of the initiating events used in this study with the Reference [15] database shows that the cable area, control room, and switchgear room frequencies used in the McGuire study are a factor of 2 to 3 lower than those recommended in the fire induced vulnerability evaluation (FIVE) document. The Reference [15] frequencies are based on about 5 times as many fires, and more than double the number of reactor years, than the data used for the McGuire study. It is not surprising, therefore, that the fire initiation frequencies differ.

The equation used.to estimate component fire frequencies not specifically included in the database multiplied a surrogate component frequency by the ratio of operating times of the component to the surrogate component. This approach has the obvious potential to underestimate frequency because it ignores the pnea*id for the development oflatent luks which reveal themselves upon component stanup.

2.2.6 Fire Growth and Propagation C

a. Treatment of Cross-Zone Fire Spread and Associated Major Assumptions The study includes a barrier penetration probability of 0.01 for three hour barriers with doors, and a barrier penetration probability of 0.2 for 1.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> barri rs. These are meant to account for doors left open, and appear to be reasonable as overall average values. However, barrier penetration is allowed in the analysis only if the fire is at Stage 3 (fully engulfing the area). He potennal for a fire to parnally engulf an area (say Stage 2), and cause damage owing to hot gas spread through an open door or damper, is not considered.

l L

Energy Research, Inc. 18 ERI/NRC 95-502 l

l l

l

l

b. Assumptions Associated uid Detecdon and Suppression Detection and suppression were addressed within the framework of the fire event tree. The detection and suppression probabilities were based on NUREG/CR-0654.

Ten minnan to fire brigade response was useil for all scenarios / areas. The submittal states that ten minutes was verified'during the fire walkdown. Fire brigade' response data was not used. The relevant time, however, is not brigade initial response time. It is time to suppression, which must be longer than these times. No basis was provided for the cp:d ic tsuppression times in the control and diesel rooms, i

c. :Weatment ofSuppression-induced Damage to Equipment, ifAuxilable l No cost-effective modifications to fire suppression systems were identified to mitigate the effects of fire i suppression water discharge and migration.

An example of the trastmarv of the issue of suppression-induced damage is presented in Appendix B, Page

! 3.5-7, Rev. 2, of the McGuire IPEEE subminal [1]. Waer released from suppressing a fire in ETA (upper j s

switchgear area) could penetrate the ETB (lower switchgear area) on the level below, because water from '

the ETA switchgear room can drain into the ETB switchgear room. The esnmarM frequency of this scenario is above 104/yr, which is far higher than the other fire-related ETA /ETB scenarios. In the submittal, the licensee claims that the risk is, in reality, far lower because the estimate is bounding.

However, the study did not include a better estimate within the set of cutsets, did not identify this situation

, as a pardat vulnerability, and did not identify fixing the floor drainage problem as a plant improvement. j

d. Computer Code Used, ifApplicable Computer codes, such as COMPBRN, were not used for fire propagation, detection, and suppression.

2.2.7 Evaluation of Component Fragilities and Failure Modes

a. Defnidon ofRre induced Failures Although not explicitly stated, the defimtion of failure appears to be loss of equipment functionality or, in the casa of hot shorts, spurious acmation to an undesired position.

b. Medad Used to Determine Component Capacities Analytical or tabular methods, such as COMPBRN and FIVE, were not used to determine fire propagation potential. Temperature criteria for cable damage or electrical / electronic equipment damage were not used.

Fire dadaa, suppression and propagation probabilities were based solely on the generic information in NUREG/CR-0654, judgmentally adjusted to account for plant-specific features.

c. Generic Fragilides Used As marwinned above, the methodology used for the McGuire IPEEE did not include the use of fragilities.

Energy Research, Inc.- 19 ERI/NRC 95-502

~- .,- .-....--- .-.- - -.-._ ..- -.- -

l

! d. Plant 4pecifc Fragilities Used As ==nrinnart above, the methodology used for the McGuire IPEEE did not include the use of fragilities,

e. Technipe Used to lheat Operator Recovery Actions The control room, auxiliary shutdown panel, and cable room fires were each modeled in the systems l analysis as if they were a loss of nuclear service waer. The vital I&C area fire was also modeled as a loss l of nuclear service water. The most prevalent recovery actions included in the analysis were cross-connection of nuclear service weer with the other unit and initiation of the standby shutdown system.

De main feedwmer pump fire was modeled as a loss of offsite power, with loss of both diesel generators I and the turbinesiriven auxiliary feedwater pump. Failure to recover offsite power by cross connection  !

with the other unit was given a conditional probability of 4 x 10-8 1 2.2.8 Fire Detection and Suppression l

Two quantifications were performed for the significant rooms: a base case [1] and a sensitivity case [7). l The base case used an adaptation of NUREG/CR 0645 fire event sequences and parameters for suppression and propagation. This adaptation allowed, and probabilistically took credit for, multiple passes at -

detection and suppression, without regard to the timing of suppression verses propagation. Four stages of damage to components were modeled as end states in the fire event tree: no damage, damage to component that initiated the fire (Stage A), damage to adjacent equipment (Stage B), and damage to the entire room (Stage C). A significant probability was assigned to the sequences in which a fire would l induce no damage to the equipment within which it started. For example, a fire starting in the main l l feedwater pump was given a 20% chance of failing the pump (and an 80% chance of no loss of l functionality). No jusufication was provided for this number except that it is consistent with NUREG/CR-l 0645. The sensitivity case used a model that allowed only one attempt at suppression, and three stages  !

l of damage to components were modeled.

In the original study [1], the fire event tree included three opportunities for suppression. In order for a fire to be considered a Stage C fire, h must have failed suppression three times in series (if detected) irrespective of the timing of damage. This approach inherently makes assumptions that may not be I realistic. For example, it implicitly assumes that failure of automatic suppression will always be accompanied by a second and third attempt in time to prevent a Stage C fire (by either automatic systems or manual maanc). The suppression failure probabilities provided in Table 3.5-5 of the submittal are typically 0.1, 0.8, and 0.I, for a product of 8 x 10-8 For the control room, the product is 4 x 104 For the auxiliary feedwater room, the product is 2.4 x 10d; and for the service water and component cooling 4

l water rooms, the product is 1.2 x 10 . These con:bined failure probabilities are significantly lower than those typical of automatic detection / suppression. systems, which are above 108/ry. He possibility of misaligned heads or nonconforming locations was not considered.

Ina m an detection failure probabilities were treated separately. There are two cyyosunities in series to detect the fire. De failure probabilities were typically 0.1, and 0.05 to 0.01, for a product of 5 x10 4 to 1 x10 .4For automatic fire suppression systems, the industry accepted number includes detection.

Thus, the fire IPEEE study has estimated detection / suppression failure frequencies that are at least three

( orders of magnitude lower in the absence of manual suppression.

Energy Research, Inc. 20 ERI/NRC 95-502 l

l. - _ ., ._

( ..

f 2.2.9 Analysis of Plant Systems and Sequences '

i a.~ Key Asssonprions including Success Otteria and Assodated Bases L

L The assumptions discussed in previous sections, particularly the use of a single scenario to represe area, limited the comprehensiveness of sequence development. An example follows.

l The analysis of cursets for the control room assumed a Stage C fire that fully involved the control room.

While this may be the worst case with respect to the ability of the plant to deal with the situation, it m not capture the majority of the risk with respect to total CDF. For example, typical fire scenarios in control rooms may include ahndonment. De licensee explained that abandonment would be a last resort l

because the pre-fire plan includes smoke extraction proc.Ww and the donning of masks. However, a l large fire in the control room could impact the operability of components from that location by virtue of i

shorts and open circuits. Control room abandonment scenarios were not included in the McGuire study. i

b. Ewnt Dees (FuncdonalorSystemic)

Functional event trees suw er mi by fault trees were used. Fire event trees showing detection, suppression, and propagation opportunities were prov.'ded in the submittal.

c. Dependency Marnx, ifit is Drferentfrom thatpr Seismic Ewnts A dependency matrix was not provided.

1

\

d.

. Plant-Unique System Dependencies There were no identified plant-unique system dependencies, i

e. Shared SystemsprMulti-Unit Plant The McGuire units share the ability to cross-connect offsite power and nuclear service water, with only one nuclear service water train required to supply the water needs of both units. Instrument air is also shared between the two units.

f. Most Signifcant Human Actions l

l The mos: significant human actions were found to be: (1) failure to cross-connect with the other unit for either nuclear service water or offsite power; (2) failure to correctly use the remote shutdown panel; and (3) failure to initiate the standby shutdown system.

[

2.2.10 Fire Scenanos and Core Damage Frequency Evaluation In the original study [1], the five areas that survived the screening were: vital I&C area; control room;

' cable room; auxiliary shutdown panel; and main feed pump area. The selected scenario for the first four r rooms wm loss of nuclear service water. The selected scenario for main feed pump fire was loss of offsite L

power. De control and cable rooms were evaluated as if they were one area. Using the IPE model transient functional event tree and fault trees in Section 2 of Reference [4), cutset frequencies summed to Energy Research, Inc. 21 ERI/NRC 95-502

_7~___

,- I

[

i 4

j a total fire CDF of 2.3 x 10 /ry, which is less than 1 % of the total CDF of 7 x 10f/ry (for internal and  ;

external fires). De fire sequence for main feed pump fire falls imo the TBU functional sequence category,  ;

involvit g a transient (T) with failure of seco*y side heat removal (B) and failure of safety injection (U).

Cable, control, and vital I&C area fires, which were assumed to be equivalent to loss of nuclear service waer, were identified as TQsU sequences, involving a transient (T) with reactor coolant pump seal LOCA r (Q ), and faihire of safety injection (U). The computer program CAFTA was used to solve the trees, and I cutsets were presented in the subauttal. )

The assumption that all vital I&C area, control room, cable room, and auxiliary shutdown panel fires result in loss of nuclear service water manifests itself in cutsas that are comprised solely of nuclear service water related events. Since this assumption, in effect, screens out all equipment that is not related to nuclear l service water scenarios, a misconception of how the plant responds to fifes in these rooms is obtained.

This misconception limits the value of the study as a means of guidance for operator or fire protection l engmeer training De expitaded base case, however, included additional ininatmg events for rooms other l than the above unscreened locations.

The expanded base case [11) quantified the CDF for areas that were screened out in the original study.

The overall CDF increased by a factor of three owing to correction of an error. The original study used l a 3 manne fire brigade response time, while the expanded base case used a more reasonable 10 minute fire l brigade response time.

The sensitivity study [11] performed by the licensee attempted to estimate the significance of the l assumption of multiple suppression opportunities, by truncating the fire event tree after the first l

suppression and propagation opportunity. He total CDF calculated as part of the sensittvity case is a factor of 10 larger than the expanded base case. The single most important location was found to be the turbine building, with the vital I&C area, main feed pump area, alternate shutdown area and cable spread room also contributing. The following table compares the CDF of the original study with that of the i sensitivity study for each significant location.

l l Table 2.1 CDF Comparison (Original vs. Sensitivity Case) for Significant Fire Locations Location Original Case CDF Sensitivity Case CDF Turbine Building - screened out 4E-06 VitalI&C Area 1.3E-07 9E47 Main Feed Pump Area 2E48 SE47

, Alternate Shutdown Panel < 1E48 1.8E-07 l Cable Spread Room & Control Room , 8E49 6E48 Note that all but the entry for the cable spread and control rooms increased. The sensitivity case calculations for the control and cable spread rooms included an increased fire damage frequency. The decrease in their CDF occurred because additional recovery actions were added to the sensitivity case for these rooms that were not included in the original study. In fact, many of the cut sets associated with recovery events and additional non-fire failures are different from the original base case.

Anott ar osmydon tha significantly affected the quantified CDF (for all cases) was as follows: equipment i failure (e.g. loss of component cooling) can be prevented if the fire causes a hot short to ground, followed

[ by control fuse actuation, before a hot short causes equipment trip. The licensee stated that open circuits Energy Research, Inc. 22 ERI/NRC 95-502 l

l l

L . __ __

r in control circuits would not cause change of state of electrical equipment. The study estimated that hot shorts (as opposed to shorts to ground) comprised about 20% of the incidences of fire induced shorts.

Thus, the probability of losing nuclear service water owing to a fire in the cable or control rooms was reduced by a factor of 5 (i.e., previous frequency multiplied by 1/5). This approach was applied only to the cable and control rooms. While the estunate of 20% may be conservative for McGuire, the basic problem with this approach is that it assumes that hot shorts are the only source of a significant fire scenario. As discussed above, control room abandonment scenarios, which often prove to be significant, can be caused by loss of operator control owing to open circuits, and these scenarios were not considered in the McGuire fire analysis. It is, therefore, not valid to reduce the control and cable room fire-induced CDFs by a factor of 5 because of the relative occurrence probability of hot shorts.

2.2.11 Analysis of Containmant Performance

a. Signifcant Containment Performance insights Typical of other fire PRAs, containmant performance was assumed to be the same as for the internal events study, because all fire scenarios were viewed as being alternative initiating events for the internal event l trees. There was no discussion concermng additional fire-unique initiating events or contamment failure modes.

b. Plant-Unique Phenomenology Considered Plant-unique accident phenomenology associated with fires was not considered.

2.2.12 Treatment of Fire Risk Scoping Study Issues l a. Assumptions Used to Address Fire Risk Scoping Study Issues An implicit assumption made in the walkdown addressing these issues was that all ventilation equipment would be fully operational.

b. Signifcant Findings The key review findings pertinent to the IPEEE's treatment of these issues are:

1. The licensee staes that, where smoke can be generated by fire, existing smoke control capability (i.e., ventilation, automatic suppression, fire brigade action, and large areas) is sufficient to prevent n==gisle damage. 'Ihe above discussion regarding the lack of consideration of cabinet fires and the assumption of ventilation availability is also relevant here.

2. The licensee found that no cost effective modifications to fire suppression systems are needed (i.e.,

have been identified) to mitigate the effect of fire suppression water discharge and migration.

However, only water suppression has been considered, not CO2 suppression.

3. The licensee states that seismically induced failure of fire protection control panels is not a

! problem. Automatic heat activated sprinkler heads may be actuated during an earthquake. The

!- licensee found seismically induced failure of RCP motors not to be a problem, becaust fires in the Energy Research, Inc. 23 ERIINRC 95-502 m ,-, , . , - - - - , . .,

s ...e., s. -. - ~ . . . . . , - . - . - >--~..a .- .---- - - - -

motors would not affect the ability to achieve safe shutdown. However, seismically induced fire effects on other equipment was not discussed in the submittal.

4. The licensee found control system interactions not to be a problem because of the standby shutdown system.

5. Intercompartment fire barrier breaching was considered in the fire PRA by use of an average screening value. It is not clear from the study if maintenance records were reviewed to verify the  ;

state of repair of barriers, doors, and dampers. However, the standby shutdown system further l mitigates the adverse affects of failure of redundant trains caused by breach of fire barriers.

j 6. Discussion of manual fire fighting effectiveness was not included in the reviewed documents.

7. Discussion of fire barrier qualification was not included in the reviewed documents.

2.2.13 USI A-45 Issue

, a. Methods ofRemoving Decay Heat The McGuire reactor units can remove decay heat using:

i

1. Main feedwater or auxiliary feedwater, through PORVs or condenser dump valves  ;

2. Charging or safety injection (SI), and PORVs, for feed and bleed

3. Residual heat removal (RHR) and long-term recirculation  ;

4. Standby shutdown system 1

Credit was taken for feed and bleed and the standby shutdown system. Fire was not a significant contributor to the risk associated with shutdown decay heat removal sequences.

l b. Ability ofthe Plant to Feed and Bleed The plant has the capability for feed and bleed. .

c. Credit Takenfor Feed and Bleed Credit was taken for feed and bleed.

4

, d. Presence ofThermo-Lag

Modifications to elimmate reliance on Thermo-lag are scheduled to be completed in 1997.

I 2.3 HFO Events The IPEEE finds no unduly significant sequences (i.e., vulnerabilities) with respect to HFO events. The 4 most significant contributor to the external-events CDF, however, was found to be an HFO event (i.e.,

2 tornadoes). The submittal esumates that tornado events make up 63 % of the CDF due to external events, i whereas seismic events contribute about 36% to the external-events CDF. Tornado-induced events were 1

)

Energy Research, Inc. 24 ERl/NRC 95-502

1 considered to cause non-recoverable losses of offsite power. A PRA for tornado events revealed that the dominant sequences are those involving operational failures of the diesel generators (i.e., failure to start or run, or unavailability due to maintenance outage).

The general methodology unlimi in the McGuire IPEEE followed the approach recommended in NUREG-1407 for the analysis of other external events. This general methodology included the following steps:

l 1. All natural and man-made external events were identified in consideration of other PRAs, NSAC/60 [16], ANSI /ANS-2.12 [17), and NUREG/CR-2300 [18].

2. The resulting events were screened so as to select the significant events.

3. A scoping analysis was performed for the identified significant events. (Only external floods and tornadoes were selected for detailed analysis. Although floods and tornadoes were further analyzed, h ped ;cn and nearby facility accidents were also closely evaluated and reported in the submittal.) i i

4. The analysis was documented.

j i

In performing steps 2 and 3 above, the following efforts were conducted:

l l

• Review of plant-specific hazard data and licensing basis. i e

Determination of whether or not the hazard frequency is acceptably low.

• Execution of a scoping analysis, if necessary.

• Execution of a PRA, if necessary.

In Section 5.0 of the submittal, a deternunation was made as to which HFO events required further l analysis. Table 5-1 of the submittal lists the preliminary set of external initiating events, and Table 5-3 l describes the external events that were screened out. The following ambiguities were noted in the i submmal's remarks made in this table: i

• For " Fog", the table states: " Accident data involving surface vehicles or aircraft would include the effect of fog." However, in Section 5.3 of the subnuttal. no discussion on the effect of fog on aircraft and surface vehicles was provided.

• For " Hurricane," it is stated: "The effect of water from hurricane is considered similar to ths  ;

effect ofintense precipitation." Thus, the effect of high wind was apparently not considered.

l While no formal analysis is described, the IPEEE submittal does state that some generic and unresolved safery issues were addressed and were considered closed as part of prior PRAs and the IPEEE effort. The submittal considers the following issucs as being closed:

• USI A-45, " Shutdown Decay Heat Removal Requirements"

• USI A-17, " System Interactions in Nuclear Plants"

• GI-103, " Design for Probable Maximum Precipitation (PMP)"

l l Energy Research, Inc. 25 ERI/NRC 95-502

2.3.1 High Winds and Tornadoes 2.3.1.1 General Methodology

. The tornado analysis for McGuire was primarily based on the plant's existing PRA analysis [4]. The McGuire PRA .wmech used three processes to estimate tornado-induced CDF. The first process involved the determination of the effects of tornado missiles and high winds on the plant, including estunation of the frequency of occunence of tornadoes. He second process involved the development of an event tree which describes sequences of events following a tornado-induced loss of offsite power. The final process involved quantification of the event tree sequences and fault trees.

2.3.1.2 Plant-Specific Hazard Data and Licensing Basis ne frequency of a tornado strike of given intensity was obtained from models described by Twisdale [19 and 20]. Tornado occunence data were obtained from the National Severe Storm Forecast Center [21].

These data were based on actual observations within 125 nautical miles of the site. The data covers tornadoes with wind speeds of up to 300 mph. It was assumed that all tornadoes with a wind speed of 75 to 300 mph would cause irreparable damage resulting in a non-recoverable loss of offsite power. h is unclear whether or not the tomado data used in the PRA were updated for the McGuire IPEEE.

The TORMIS computer code [22) was used to calculate fragilities due to tornado missiles on the targcts ofinterest. TORMIS employs Monte Carlo simulation which ran:lomly selects a tornado intensity and a random path onentanon, and calculates the probability of missiles stnking specific targets. The submittal did not state whether new TORMIS runs were used for the IPEEE, or whether the existing PRA results ware used.

, Category-I buildings at McGuire were designed to withstand wind loads of up to 360 mph, including tomadoes. Since the study assumed that the frequency of tornadoes greater than 360 mph is very small, the effect of high winds on this class of buildings was not considered. Although the submittal did not i calculate the effect of tornadoes on other category buildings, the licensee stated that most buildings, including the SSF building, are strong enough to withstand all major tornadoes.

He effect of wind loading from tornadoes was elimmated from analysis on the basis of low frequency.

However, Table 3.41 of the McGuire PRA provided a frequency of 1.2 x 10~8/yr. No frequency estimate was provided for exceeding the design-basis wind speed. l j Tornadoes striking the transmission lines from the switchyard to the plant were assumed to cause non- 4

recoverable _ loss of offsite power. The frequency of such events was estunated at 5.4x10'/yr. The coartirianal probability of core damage, given tornado-induced loss of offsite power, was estimarM to be  ;

4

' 3.5x10'*. Bus, the total contribution of tornado-induced core damage was assessed at 1.9x10 /yr. The enattwinaal core damage probability was dominard by the failure of emergency diesel generators to start or nm for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, followed by diesel mainranance outage. De SSF equipment were credited in response to a tornado-induced loss of offsite power. In the submittal, the licensee has made the engineering judgment that the SSF building will survive a major tornado.

V l

l Energy Research, Inc. 26 ERI/NRC 95-502 l

j

- - --,,a,-- - - - - -,- , , - - - - , , , , .-,n ,, n -

. _ _ ~ _ _ . . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ - ____.

2.3.1.3 Significant Changes Since Issuance of the Operaung License j No major changes since the time of issuance of the plant operating license (OL) were identified.

l l 2.3.1.4 Significant Findings and Piant-Unique Features The submittal did not report results of any plant design review or plant walkdown. The designesis i tornado, with a wind speed of up to 360 mph, was considered harmless. No other significant findings j were cited in the submittal.

i j> 2.3.1.5 Hazard Frequency 1

! He subminal references the original McGuire PRA for esumsting the frequency of the tornado hazard.

1 Extreme tornadoes with speeds of 73-300 taph were studied, and their frequencies were esnmatad. The  !

j asn== rad frequency for transmittian line strike for the wind speed interval of 73-112 mph was 1.38 x 10d

/yr; for 113-157 mph was 1.93 x10d/yr; for 158-206 mph was 8.8x105/yr; for 207-260 mph was 1.2 x i 10d/yr; and for 260-300 mph was 1.2x10'8/yr. The probability of a missile striking a building was J

calculated using the TORMIS Monte Carlo code. The probability of a missile striking power lines was considered to be small.

( 2.3.1.6 Boundmg Analysis j The contribution of tornadoes to the final CDF is considered to be very significant (63% of the total

external-event CDF). The submittal estimates that the conditional probability of core damage, given a i

tornado-induced loss of offsite power (by stniang the transmission lines through wind loads, but not missiles).. is 3.5x10-2 This value, which is obtained by using Table A.17-7, Rev.1, " Diesel i Generator / Load Sociuencer Dominant Minimal Cut Sets," of the McGuire PRA [4], could not be i confirmed. From this table, conditional probabilities in the range of 7 x 102 to 8 x10-2 are cited. It is unclear whether or not the IPEEE subnuttal makes additional assumptions that are not discussed.

l' l

l 2.3.1.7 PRA Analysis. l c  ?

I .

1 j The functional event tree for the tornado-induced transient is discussed in the McGuire PRA [4]. The l i tornado event tree is shown in Figure 3.44 of the PRA. It was assumed that, if a tornado strikes j 4 tran==Intian lines, a loss of offsite power occurs that cannot be recovered. Also, it was assumed that '

l missiles may cause loss of offsite power and/or missiles can be thrown at the plant buildings. In such j cases, equipment in the affected buildings may be damaged. No consideration to the possibility of a j scenario involving combined wind and flood was provided in the submittal.  !

(

4 he FRA process followed a stme of4be-st wuedi to external event analysis. Twelve tornado accident sequences were identified and quannfied. The specific cutsets for these sequences are presented in i Appendix D of the McGuire PRA report [4]. De total CDF was calculated to be 1.93 x 10-8/ry. The total l contribution comes from non-recoverable loss of offsite power sequences. As such, no human recovery actions were considwed in the IPEEE.

Energy Research, Inc. 27 ERI/NRC 95-502

_ ,o - .

=.

i 2.3.2 External Flooding i 2.3.2.1 General Methodology f

The mihminal refers to the McGuire PRA for the evaluation of external flooding. The PRA report refers to other plant PRAs, where it has been shown that external flooding was un6pur-4. Also, the PRA refers e a previous Duke Power study [23), where it was shown that external flood risk was negligible.

It is not clear wha methodology was used in the referenced study. He submittal indicates that the study assumed that external flooding was mainly from Lake Norman, impounded by Duke Power Company's Cowans Ford Dam Hydroelectric Station. A flood may encroach on the turbine building and flood its basement. He total frequency of external floeds was estimated at 5.0x10*/yr. Because of this low frequency, external flood was disminand as a non-concern.

2.3.2.2 Piant-Specific Hazard Data and Licensing Basis The mihminal refers to the McGmre PRA and its final safety analysis report (FSAR), where it was shown that "the station embankment will protect the plant from a combination of the worst case upstream dam failure and half of the maximum precipitation." It is unclear if this flood scenario represents the design basis, and it is unclear what constitutes the maximum precipitation. The subantal refers to an internal study where floodung from Iake Norman has been analyzed. The submittal is unclear about the extent of the floodmg data which has been used to arrive at probabilities of various levels of flooding from Lake Norman. No data sources for dam failure frequencies and precipitation levels (which are strongly  !

corrdmed) were reported. De degree of water level increases were also not reported. The submittal did not discuss any types of flood protection devices, such as levees or warning systems, or any relevant emergency procedures used to protect the plant against external floods. The submittal did not discuss sources of external floodmg other than from Lake Norman.

2.3.2.3 Significant Changes Since Issuance of the Operating License No changes since the time of issuance of the plant OL were identified as part of the IPEEE study.

2.3.2.4 Significant Findings and Plant-Unique Features No significant findmgs relevant to external floods were reported.

2.3.2.5 Hazard Frequency External floodmg was screened out due to a low frequency of occurrence (5.0x 10*/yr). The subminal reports a conditional probability of 0.1 for the failure of diesel generators given a Sood. Also, the probability of a loss of offsite power was reported to be 1.0. The bases for these probability estimates were not provided. Also, no discussion was provided as to which accident scenarios these conditional probabilities apply. From the reported data, one may infer that the frequency of occurrence of flooding is 5.0x104/yr.

I-Energy Research, Inc. 28 ERI/NRC 95-502 l

c.

l 2.3.3 Transportation and Nearby Facility Accidents 2.3.3.1 General Methodology l De McGuire IPEEE submittal addressed aircraft crashes; water, rail and highway transportation events; releases of on-site hazardous material inventories; and potential gas pipeline ruptures.

In the analysis of aircraft crashes, the submittal used the SRP approach and accgtance criteria. If the acceptance critmia are met, then the SRP approach assumes that the frequency of a crash will be less than 10#/yr. The submittal fails to satisfy the required plant-to-airport distance enterion. Accordingly, h uses the SRP's methodology for estimating the impact frequency, which is based on: (1) detennining the in-flight crash rae per mile for aircraft accidents in the vicinity of the plant; (t) estimating the total number of yearly flights along the airway above the plant; (3) assessing the size of the target area (which includes structures sensitive to aircraft crash); and (4) assessing the width of the airway above the plant. The result of such analysis has shown that the frequency of crash is about 1.3x104 /yr, which is less than the EE--- == criterion.

l No specific methodology was cited in the submittal for analysis of nearby land and water transportation accidents. The submittal only states that " based upon the regulations noted above and the proximity of alternate major highways bypassing the site, the probability of McGuire being affected by shipment of .  !

hazardous materials on highway N.C. 73 is dmnad insignificant." Therefore, no formal methodology was i employed in the analysis of transportation events. 1 No military or industnal facilities were noted to exist within a 5-mile radius of the plant. Thus, related hazards were screened out. Similarly, a survey of on-site toxic materials concluded that hazards from the 1 on-site storage of toxic materials are minimal. The survey of on-site explosive materials has 9se concluded that exposure of hazards from these sources is remote. The submittal references several unanel studies [24, 25 and 26) which have addressed these issues. However, the submittal does not report any anmatad frequency. The submitral refers to the original PRA for evaluation of gas pipeline explosions, and concludes that the PRA's decision to screen out this event remains valid, because no changes in the gas pipeline layout have occurred since the time the PRA was released.

2.3.3.2 Plant-Specific Hazard Data and Licensing Basis

~

For aircraft crashes, the SRP licensing basis was used to determine the frequency of a crash. The i I

submittal is organized and systematic in this analysis. Since the plant-to-airpor; cnterion was not met, the frequency of a crash was calculated using the SRP approach. The in-flight crash rate was obtained from the McGuire PRA, which was based on the aircraft crashes in the continantal United States (for cases where the aircraft was destroyed). It is not clear whether or not the submittal has updated the crash data

)

subsequent to the PRA, which was based on pre-1984 data. The aircraft impact area considered was

comprised mainly of the reactor building and the auxiliary building. It is not clear if other susceptible  !

Imanns, such as the main .Mygd, were considered in the analysis. De air traffic data were obtamed  !

j from the air traffic control center at the Charlotte Airpon. The data seems to include data up to the year l l of 1994. Using the Charlotte Sectional Nautical Chart, the airway width was estimatad.

s j~ l i

j Energy Research, Inc. 29 ERI/NRC 95-502 l

i

For the analysis ofland and water transportation events, no licensing basis or specific events or hazard data were used. Transportation events were considered insignificant based on some qualitative arguments.

Dese arguments focus on the alternate routes for transportation and some federal regulations which limit shipment of hazardous materials on certain highways.

For the rest of the L.,un.Jon and nearby facilities hazards, the submittal did not provide any licensing basis information that justified not considering such' hazards. The submittal reports some internal investigations pertaining to the amount and location of on-site toxic and explosive materials.

2.3.3.3 Significant Changes Since Issuance of the Operating License

{

I No significant changes since the time ofissuance of the plant OL were identifi.xi. '

) 2.3.3.4 Significant Findings and P' lant-Unique Femures No significant findings are discussed in the subnuttal for any of the transt ortation and nearby facility accidents.

2.3.3.5 Hazard Frequency l

4 For aircraft crashes at the site, a frequency of occurrence of 1.3 x 10 /yr was estimatad by the licensee. i This value represents the impact frequency, and does not indicate the frequency of core damage. Since l the impact frequency is small, the submittal reports that no further analysis for calculating the conditional  ;

probability of core damage, given a crash, need be performed.

l No frequency estimates were made for other potentially significant transportation and nearby facility l l events. Qualitative judgments were used to screen out all of the remainmg events. The submittal states 4

that the frequency of explosion from on-site storage of hydrogen, oxygen, and nitrogen is "... extremely remote." However, the submittal does not provide any quantitative substantiation of this claim.

i l 2.4 Canaric Enfatv t====== (CEI-147. GEI-teft ==d CEt-172) i 2.4.1 GSI-147, ' Fire-Induced Alternate Shutdown /Comrol Panel Interaction" GSI-147 addresses the scenario of fire occurring in a plant (e.g., in the control room), and conditions which could develop that may create a number of potential control system vulnerabilities. Control system

, interactions can impact plant risk in the following ways:

• Electrical independence of remote shutdown control systems

• Loss of control power before transfer

• Total loss of system function i

• Spurious actuanon of components j

De licensee assumed that PORY LOCA's have an insignificant probability of occurrence because PORVs l "could be failed closed by removing power" (Appendix B, page 3.5-17, of Reference [1]). Neither hot i shorts nor the possibility of blown fuses or tripped circuits were considered in the assessment for the l purpose of assessing operability from the control room. Interfacing LOCAs were dismissed because power Energy Research, Inc. 30 ERI/NRC 95-502 1

i l

I l

i to the ." J.;ing valves is removed during Mode 1 operation. The only initiating event quantified for the control room analysis was loss of nuclear service water. The possibility of loss of station power was not L  !

included, nor was any other loss of system functionality or spurious actuation of components. Loss of  ;

instrumentation and control capability owing to fire effects was not included in the subminal. Since the i

submissal has followed the gnWara provided in FiVE concermng control system interactions (as discussed in Section 4.8.7 of the submittal), all circuitry associated with remote shutdown is assumed to have been found to be electrically independent of the control room.

2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" GSI-148 addresses the effectiveness of manual fire-fighting in the presence of smoke. Smoke can impact plant risk in the following ways:

By reducing manual fire-fighting effectiveness and causing misdirected suppression efforts

• By damgi::g or degrading electronic equipment By h.oq=ing the Operator's ability to safely shutdown the plant By initiating automatic fire protection systems in areas away from the fire Reference [27) identifies possible reduction of manual fire-fighting effectiveness and causing misdirected suppression efforts as the central issue in GSI-148. The effect of smoke and misdirected suppression was accoumed for in the walkdown [28), and some information is provided and summarized in Sections 4.8.4 and 4.8.5 of the submittal.

2.4.3 GSI-172, " Multiple System Responses Program (MSRP)"

Reference [27] provides the description of each MSRP issue stated below, and delineates the scope of informanon that may be reported in an IPEEE submittal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.

Common Cause Failures (CCFs) Related to Hwnan Errors Daenineinn of the Teena [27): CCFs resulting from human errors include operator acts of commission or omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could ininate CCFs include: manufacturmg errors in components that affect redundant trains; and installadon, maintan=nca or testag errors that are repeated on redundant trains.

In IPEEEs, licensees were requested to address only the human errors involving operator recovery actions following the occurrence of external initianng events.

Limited discussions of operator recovery actions, following seismic and fire events, respectively, are provided in Section 3.1.5 and Table 3-2, and Section 4.6, of the McGuire IPEEE submittal. Some i addnional information on operator recovery actions is provided in the McGuire PRA report [4).

Non-Sqfery-Related Control Synem/ Safety-Related Protection System Dependencies i

Daerrinrinn of the Teena [27): Multiple failures in non-safety-related control systems may have an adverse

! impact on safety-related protection systems, as a result of potential unrecognized dependencies between

[ Energy Research, Inc. 31 ERI/NRC 95-502 l

I control and protection systems. Le concern is that plant-specific implementation of the regulations regarding separation and independence of control and protection systems may be inadequate. The licensees' IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety-relmed systems, and should identify potential sources of vulnerabilities. The dapaad ades between safay-related and non-safety-related systems resulting from external events -i.e.,

concerns related to spatial and functional interactions - are addressed as part of " fire-induced alternate shutdown and control room panel interactions," GSI-147, for fire events, and " seismically induced spatial and functional interactions' for seismic events.

Information provided in the McGuire IPEEE submittal pertaining to seismically induced spatial and funninnal useractions is identified below (under the heading Seismically laduced Spatial and Functional

~

Interactions), whereas information pertaining to fire-induced alternate shutdown and control panel interactions has already been identified in Section 2.4.1 of this TER.

l Hear / Smoke / Water Propagation Efectsfrom Mres DacMwinn of the Teena [27]: Fire can damage one train of equipment in one fire zone, while a redundant train could potentially be damaged in one of following ways:

Heat, smoke, and water may pmpagate (e.g., through HVAC ducts or electrical conduit) into a second fire zone, and damage a rchndant train of equipment.

A random failure, not related to the fire, could damage a redundant train.

Multiple non-safety-related control systems could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone. i A fire can cause unmtended opersion of equipment due to hot shorts, open circuits, and shorts to ground.

Consequently, components could be energized or de-energized, valves could fail open or closed, pumps  !

could continue to run or fail to run, and electrical breakers could fa9 open or closed. The concern of l water propagation effects resulting from fire is partially addressed in GI-57, " Effects of Fire Protection System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is addressed in GSI-148. The concern of alternate shutdown / control room interactions (i.e., hot shorts and other items just mentioned) it addressed in GSI-147. '

i Informanon provided in the McGuire IPEEE submittal i sraag to GSI-147 and GSI-148 has already been identified in Seenons 2.4.1 and 2.4.2 of this TER. Section 4.8 of the submittal presents some information pertaining to this issue.

Efects ofFire Ssppression System Actuarion on Non-Safety Related and Safety-Related Equipment Decerintian of the Teena [27]: Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect interaction with non-safety related components. .

'this issue was addressed in the walkdown and summarized in Sections 4.8.5 and 4.8.6 of the IPEEE submntal.

Energy Research, Inc. 32 ERI/NRC 95-502

l l

Efects ofFlooding and/or Moisture inrntsion on Non-Safery-Related and Safery-Related Equipment DescHpHnn of the Tune [27]: Flooding and water intrusion events can affect safety-related equipment l either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related

+M. ..= This type of event can result from external flooding events, tank and pipe ruptures, actuations i

of fire suppression systems, or backflow through parts of the plant drainage system. The EE process j addresses the concerns of moisture intrusion and internal flooding (i.e., tank and pipe ruptures or backflow through part of the plant dramage system). The guidance for addressing the concern of external flooding is provided in Chapter 5 of NUREG-1407, and the con:ern of actuations of fire suppression systems is provided in Chapter 4 of NUREG-1407.

The following information is provided relevant to this issue: the McGuire IPEEE submittal discusses external floods in Section 5.2 (which references Section 3.3.1 of the McGuire PRA repon); and some discussion is provided in Sections 4.8.5 and 4.8.6 regarding actuations of fire suppression systems. The submittal provides no specific discussion of seismically induced floods.

Seismically induced Spatial and Functional Interacdons j DescHndnn of the fune [27]: Seismic events have the potential to cause multiple failures of safety-related systems through spatial and functional interactions. Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems; direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures; seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control systems' l failures; and indirect impacts, such as dust generation, disabling essential plant shutdown systems. As part of the DEEE, it was specifically requested that seismically induced spatial interactions be addressed during plant walkdowns. The guidance for performing such walkdowns can be found in EPRI hT-6041.

The McGuire IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions. The submittal states that EPRI NP-6041 guidelines were followed in the seismic walkdowns. Relevant information can be found in Section 3.1.2.3 and Table 3.3 of the submittal.

SeismicallyInduced Fires DescHednn of the Tune [27]: Seismically induced fires may cause multiple failures of safety-related systems. The occurrence of a seismic event could create fires in multiple locations, simultaneously degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related systems Seismically induced fires is one aspect of seismic-fire interaction concerns, which is addressed as part of the Fire Risk Scoping Study (FRSS) issues. (IPEEE guidance specifically requested licensees in evaluate FRSS issues.) In IPEEEs, seismically induced fires should be addressed by means of a focused meismic-fire interactions walkdown that follows the guidance of EPRI NP-6041.

Section 4.8.6 of the McGuire IPE~iE submittal provides a brief discussion of seismically induced fires.

Seismically induced Fire Suppression System Actuation DescHpHnn of the tune [27]: Seismic events can potentially cause multiple fire suppression system actuations which, in turn, may cause failures of redundant trains of safety-related systems. Analyses Energy Research, Inc. 33 ERI/NRC 95-502 l

l l

d6 i

currently required by fire protection regulations generally only examine inadvertent actuations of fire suppression systems as single, w=aadant events, whereas a seismic event could cause multiple actuations of fire suppression systems in vanous areas.

Section 4.8.6 of the McGuire FEEE submittal provides some minimal discussion of seismically induced fire suppression system actunion.

Seisnsically !=A"~d Flomiing Da=~irwian of the i== [27]: Seismically induced flooding events can potentially cause multiple failures of safety relmed systems. Rupture of small piping could provide flood sources that could potantially affect multiple safety-related components simultaneously. Similarly, non-seismically qualified tanks are a potential flood source of concern. FEEE guidance specifically requested licensees to address this issue.

He McGuire FEEE has not included discussion of seismically induced flooding.

Seinnicallyinduced Relay Gatter Dac~ireinn of the ic== [27]: Essemial relays must operate during and after an earthquake, and must meet one of the following conditions:

a remain functional (i.e., without occurrence of contact chattenng);

a be seismically qualified; or a be chatter acceptable.

It is possible that contact chatter of relays not required to operate during seismic events may produce some unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event.

PEEE guidance specifically requested licensees to address the issue of relay chatter.

As noted in Section 2.1.11 of this TER, a relay chatter analysis was performed taing prce aimes consistent with those recommended for a focused-scope and USI A-46 plant. In addition, charter oflow-fragility relays was considered in the systems model, with an assessed seismic fragility anc' a conditional probability l of recovery. The McGuire FEEE submittal provides relevrat informeion in Section 3.1.2 (page 3-9),

Section 3.1.6 (page 3-18), and Table 3-2.

Evaluation ofEarthquake Magnitudes Greater than the Safe 9sutdown Earthquake Descrintinn of the Icea [27]: ne concern of this issue is that adequate margin may not have been included in she design of some safety-reized equipment. As pe. of the IPEEE, all licensees are expected ,

to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by potuQ seismic PRAs or seismic margins naamann= rwa (SMAs). The licensee's evaluation for potential l vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address this issue.

The McGuire IPEEE has included a seismic PRA, as documented in Se',riva 3 of the submittal. The seismic input for the analysis is desenbod in Sections 3.1.2.3 (page 3-8) and 3.1.3 of the submittal.

Energy Research, Inc. 34 E*!!NRC 95-502 i

.s, E,fircts ofHydrogen Line ituptures n wiptinn of the i== [27): Hydrogen is used in electrical generators at nuclear plants to reduce windage losses, and as a heat transfer agent. It is also used in some tanks (e.g., volume control tanks) as a cover gas. Leaks or breaks in hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital safety related systems in the plants. k should be anticipated that the licensee will treat the hydrogen lines and tanks as pr*==W fixed fire sources as described in EPRI's FIVE guide, assess the effects of hydrogen line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.

Section 5.3.5 of the subnuttal discusses the effects of hydrogen tank failures and hydrogen leaks, and cites the more detailed analyses documented in References [25] and [26]. The submittal does not address hydrogen lines and tanks in the fire ass =mant.

l

)

i Energy Research, Inc. 35 ERI/NRC 95-502 i

t.

L 3 OVERALL EVALUATION, CONCLUSIONS AND RECOMMENDATIONS

'3.1 Salamic L

l The sendy appears to be consistent with the guidance in NUREG-1407 for use of an existing PRA. The overall process represents a conventional approach, and consists of: use of a hazard assaammant (EPRI hazard curves); use of a fragility assessment performed by Structural Mechanics Associates; and development of a systans analysis, using event trees and fault trees. A sensitivity study using the LLNL seismic hazard curves did not reveal a significant difference in dominant sequences. Hazard curves included uncertainties, and are presented in the submittal. Core damage cutsets were generated using the compeer program CAPTA. Cutset frequencies were calculated using the SEISM code, which is able to combine hazard curves, fragibnes with both uncertainties and vanabilities, and random failure rates. Point ann ==== of the cutset frequencies were praanrad in the submittal as a function of peak ground acceleration l

(PGA) interval.

The existing PRA was suppiamanrad by a seismic walkdown following the guidelines of EPRI NP- 6041.

A relay chatter evaluation was conducted, emphasizing bad-actor relays per the guidance for a focused-scope plant. Non-seismic failures and human actions were included in the seismic analysis, but human

~

error probabilities were not adjusted for seismic conditions, and the judgmental selection of random failures to be included in the model did not follow a tractable process. Containment performance was adequately addressed, and soil failures were not considered to be a problem at the site. The treatment of seismically induced fires was limited to components powered at levels above 6067 Among such components, only the reactor coolant pump motors were identified, and they were dismissed because of having a negligible effect on the plant's ability to achieve safe shutdown.

l The major wealcness of the seismic IPEEE study is the process used to develop the overall logic model.

For non seismic failures, the analyst; =*amarad to reduce the size of the model (from that used in the IPE) by judging whether a component would be part of a risk-significam cutset. This approach is not a rigorous method of developing a comprehensive seismic model because it makes a-priori judgments about the frequacy of cutsets, and may inadvertendy remove dominant ones. He proper method is to screen cutsets after the entire model has been assembled. The licensee states that many levels of review have been performed on the seismic model and that it is conMant that the model captures the risk-significant seismic cutsets. However, the fault tree model lacks many valves that play an important role in internal-events risk. The entire IPE transient model should have been used for the seismic study. This would have removed any doubt about the completeness of cutsets.

l Strengths:

1. With a few exceptions, the study is consistent with the NUREG-1407 guidelines.

2. Except for the fragility and ground response spectrum development, the licensee's own personnel directed and performed the study.

3. An internal peer review was pufvsed.

4. De walkdown was conducted in a mannar consistent with seismic margin methodology (EPRI

NP-6041), and licensee personnel appeared to be adequately trair.ed to conduct the walkdown.

h.

Energy Research, Inc. 36 ERI/NRC 95-502

m

5. Minor plant seismic interaction anhancements were identified and implanatM.

Esaknesass:

'1. 'Ibe method used for including non-seismic failures raises doubt concerning the completeness of ,

- the resulting cutsats.

l

2.  !

A non-site-specific spectral shape (NUREG/CR 0098 median,5% damped spectral shape) was i used without an accompanying sensitivity study to understand the effect of not using the suggested NUREG/CR-5250 shape.

3. A soil faihre analysis, i=Mia: consideration of liquefaction at the site and of damlembanhnant failures affecting the site, was not documented (although it was stated that construction records were reviewed to make the determination that liquefaction is not a problem).

4. The impact of unit differences on seismic risk results was not explained, and seismic failures that could affect similar equipment in both units were not addressed.

5. Human failure rues used in the analysis do not account for the earthquake level. The model and  ;

results used for the PE were simply used for the seismic assessment. The licensee judged that earthquake-induced equipment failures would not have an effect on the operators because the same operating procedures would apply.

3.2 Bra The McGuire fire FEEE [1] is an update of the full-scope, Level-3 PRA performed between 1981 and 1984. The update was initiated in 1988. Consistent with the guidance of NUREG-1407, the analysis identified critical fire areas, identified possible initiating events, calculated the fire initiation frequency, analyzed for the impairment of critical safety functions, and developed core damage cutsats with kr='- using a functional transient event tree and associated fault trees. A special fire event tree was used to help screen out areas, and assess fire damage and the frequency of fire damage. This fire event tree allowed multiple attempts at suppression without regard to the opposing timing of damage propagaion. A screening process was used in this analysis in which fire scenarios were not quantified if a similar IPE scenario had a larger estimated frequency of occurrence. Thus, the estimarM fire CDF pertained only to those scenarios that heppd to have a larger frequency than a similar set of IPE scenarios.

Typical of other fire PRAs, containment p immae was assumed to be the same as foi the internal event study, because all fire scenarios were viewed as being alternative initiating events for the internal event trees. There was no discussion of additional fire-unique initiating events or containment failure modes.

The walkdown was performed to verify assumptions about plant configuration, to locate cable runs, and to address the Sandia fire risk scoping study issues.

The licensee's performance of the additional expanded base case and the sensitivity case was revealing.

The expanded base case corrected an error in the onginal case, increasing the average fire brigade response time fhun 3 mimnar to 10 mmutes. The total fire core damage frequency (CDF) increased by a factor of 4

3 over the original base case of 2x10 /ry. The expanded case also restored and quantified sequences Energy Research, Inc. 37 . ERI/NRC 95-502 n

_ . _ __ __m .._ - . _ _ . . - _ . , _ - . _

4 l

which were previously screened out. Little change in total fire CDF resulted from this modification.

Buildmg on the expanded set of sequences, the sensitivity case modified the calculation of the frequency of fire damage events by allowing one (rather than multiple) opportunities for suppression. The CDF increased by nearly an order of m=Me to approximately 6x 104/ry.8 The turbine building, which had been previously screened out, emerged as a dommant location. A manifestation of the sensitivity case assumptions for the turbine building was an artificially high likelihood of a building-wide fire that might damage widely separated offsite power lines. The emergence of the turbine building, therefore, does not indicate a vulnerability. It is reasonably typical for offsite power lines to cross the turbine building. The resultant core damage frequency of this scenario is dominated by common cause failure of the emergency i diesel generators, which is also a typical result. The sensitivity studies provided substantial additional insights into the significance of assumptions in identifying the most important fire locations and in calculatmg the core damage frequency. The licensee also noted that the overall fire induced core damage frequency for Catawba and McGuire is about the same for the sensitivity case. This observation indicates the importance of using screening methods and assumptions that either realistically or somewhat conservatively represent the plant.

Overall, the performance of the sensitivity cases has provided confidence that the licensee has made a reasonable attempt to identify fire vulnerabilities. The licensee's conclusion that the McGuire Nuclear Station offers no unacceptable risks from fires appears plausible.

strennhe The strengths of the fire study are summarized as follows:

1. Consistent with the guidance of NUREG-1407, the analysis identified critical fire areas, identified possible initiating events, calculated the fire initiation frequency, analyzed for the impairment of critical safety functions, and developed core damage cutsets with frequencies using a functional transient event tree and associated fault trees.

2. A thorough and comprehensive fire walkdown was conducted.

3. The licensee had control over the study, and apparently performed the entire study.

4. Internal peer reviews were performed.

5. The licensee performed additional sensitivity analyses.

Weaknesses The weaknesses of the fire study are summarized as follows:

8 Whereas the original base-case CDFs for Catawba and McGuire differed by more than a factor 4

of 20 (approximately 2 x10 /ry for McGuire and 5 x10 4/ry for Catawba), the results of the 4

sen.itivity cases were highly comparable (approxin ately 6 x 10 /ry for McGuire and 7 x 104/ry for Catawba).

Energy Research, Inc. 38 ERI/NRC 95-502

.7 L

1 l- 1. The use of NUREG/CR-0654 values in the fire event tree, coupled with assuming multiple l opportumties for fire suppression, may not be valid. Although a sensitivity case investigated the l effect on core damage frequency of using only one (as opposed to multiple) fire suppression '

opportunities, the invalid NUREG/CR-0654 probabilities were still used. ,

2. An outdated fire database was used, which led to estimates of fire imtiation frequencies in key areas (control room, cable room, and switchgear rooms) that were a factor of 2 to 3 lower than the Reference [15] database.

l

3. The validity of using a single " worst case result" scenario in each fire area, instead of a more comprehensive approach of evaluating fires at each potential source location, depends on the licensee's statament that mechanical and electrical equipment are always in separate fire compartments.

4. The tramtmant of the conditional pmbability of hot shorts as a multiplier on core damage frequency for the control and cable rooms is not valid.

5. Control room abandonment scenarios were not considered in the study.

3.3 HFO Events The McGuire IPEEE generally followed recommended submittal guidelines. De strengths and weaknesses of the study are summarized below.

StumgtlE

1. The analysis of tornado events was detailed and employed state of-the-art methods. The suhalittal provides detailed discussions concerning probability estimations for tornado events.

2. The IPEEE is primarily based on the McGuire PRA, in which more detailed results, such as the lists of cutsets of the dominate sequences leading to core damage, can be found.

3. ' The analysis was completely performed and reviewed by Duke Power Company personnel, using their in-house expemse. His has maximirad DPC staffs appreciation of severe accident behavior and understanding of the most important sequences and contributors to core damage frequency.

Esakasassa:

1. It is unclear whether the tornado data used in the PRA were updated for the IPEEE.

2. The effect of wind loadmg from tornadoes was not considered in the analysis on the ground of low frequency. However, from the McGuire PRA, a frequency of 1.2 x 104/yr was given for these events.

3. Finmarion of the external flood frequency was not supported by a discussion of any actuarial data.

l l

! Energy Research, Inc. 39 ERI/NRC 95-502 l

l i

4.

i I De submittal refers to a previous Duke Power study [23), where it has shown that external Sood risk is negligible. It is not clear what methodology was used in the referenced study. Also, the subnuttal does not state the criteria for when a hazard should be considered negligible.

5.

he submittal does not discuss types of Bood protection devices, such as levees or warning systems, or relevant emergency procedures used to protect against external Soods.

6.

The submmal discusses the conditional probability oflosing diesel generators and the probability l

of a loss of offsite power, but h is unclear how these data were used in the flood analysis.

l 7.

l l

' No systematic methodology for adradag the likelihood of nearby land and water E.usportation accidents was used.

8. For the analysis of land and water transportation events, no licensing basis, or specific events or hazard data, were applied. Transportation events were considered insignificant based on some l

vague qualitative arguments.

9. The submittal estimates that the conditional probability of core damage given a tornado-induced loss of offsite power (by striking the transmission lines through wind loads, but not missiles) is 3.5 x 10'2. This value could not be independently verified by using Table A.17-7, Rev.1, of the McGuire PRA, entitled " Diesel Generator / Load Sequencer Dommant Minin.al Cut Sets."

l l

1 i

i I

1 .

i )

i i j Energy Research, Inc. 40 ERI/NRC 95-502 {

? l

4 IPEEE INSIGHTS, IMPROVEMENTS AND COMMITMENTS The study defines vulnerabilities as " unduly significant sequences." It finds no vulnerabilities from external events.

4.1 Seismic  !

The IPEEE submittal estimated a seismic core damage frequency (CDF) of 1.1 x 10'8 per reactor-year. The submittal states that the accident sequences that are the most important risk contributors involve loss of l

offsite power with subsequent loss of diesel generators. This finding is typical of other seismic PRA l results; LOSP is due to canhquake-caused breakage of ceramic insulators on the main power feed E" d m. Non-recovery of offsite power and diesel generators was assumed in the analysis. Loss of l nuclear service water was also found to be an imponant risk contributor. The top thirteen seismic cutsets contributed 51 % to the seismic CDF. Of these thineen, five were directly related to LOSP and diesel l generator failure; two involved LOSP and failure of 125V DC power (which, in turn, prevents diesel l generator startup); four were related to loss of both trains of nuclear service water; and two involved a j combination of loss of diesel generators and nuclear service water. The study apparently assumed l (although it is not explicitly stated) that an aanhquake would cause a reactor trip and a turbine trip (with or without a loss of offsite power). It appears from a review of the cutset list that the most important  ;

operator error is operator failure to align train A of nuclear service water to the pond.

Minor potential spatial interactions were found and dispositioned per Table 3-3 of the IPEEE submittal (reproduced in this repon as Table 4.1). Bad-actor relays were not found to be a problem in the study.

All cabinet and panel anchorages were found to be adequate. No seismic containment failure modes were identified. The licensee made no commitments for plant improvements.

4.2 Bee The most significant walkdown insight was the identification of the potential to lose nuclear service water from a fire in the vital I&C area. A fire in this area could potentially affect both a Unit-1 train-B cable and the IEVDA panel board which houses control power for the train-A 4160V breakers of nuclear service water.

The smdy found no unacceptable risks from fires. Plant improvements did not result from the fire IPEEE, and hence, no commitments were made.

4.3 HFO Events The submittal concluded that 63% of the external-events CDF is due to tornado events. However, since the total frequency of core damage from external events is estimated at only 3.4 x 10'8/yr, the contribution from all external events to potential severe accident situations was considered negligible. As such, the submittal finds "... no fundamental weakness or vulnerabilities with regard to severe accident risk at McGuire Nuclear Station." As a result, no safety enhancements were identified, and consequently, no commitments were made.

Energy Research, Inc. 41 ERl/NRC 95-502

4 I

Table 4.1 Enhancements Resulting from the IPEEE Seismic Verification Walkdown Issue Resolution Gaps between and batteries and racks on Unit Spacers are installed.

I Diesel Generator batteries Grout missing between Component Cooling Grout will be installed. Problem Investigation heat exchangers saddle base and concrete Process has been initiated, curb Grating in contact with Steam Vent valves Grating will be trimmed to maintain clearance during upcoming outages. Work Request has been written.

Bolts missing from Unit 2 Upper Surge Bolts are re-installed.

Tanks Motor Control Centers touching MCCs are connected together to act as unit.

Potential seismic interaction from movable " Guidelines for Movable Equipment" will be equipment developed and in place by 12/94.

Eight inch diameter pipe touching back top Panel will be modified to avoid seismic corner of Unit 2 Turbine Driven Auxiliary interaction. Problem Investigation Process has Feedwater Pump Control Panel been initiated.

Corrosion on Auxiliary Feedwater Nuts are cleaned and recoated.

Condensate Storage Tank anchor bolt nuts Are Barriers loose inside Main Control Barriers will be tightened in upcoming outages.

Boards Problem Investigation Process has beenm' itiated.

i l

l i ,

l Energy Research, Inc. 42 ERl/NRC 95-502 '

l l

l

i

-5 IPEEE DATA

SUMMARY

AND ENTRY SHEETS Corepleted daut entry sheets applicable to the McGuire IPEEE are provided in Tables 5.1 to 5.8. These tables have been completed in accordance with the descriptions in Reference [10). Table 5.1 lists the l overall extemal events results. Table 5.2 sunmanzes the important seismic PRA fragility values. Tables 5.3 through 5.5 provide the pressurized water reactor (PWR) Accident Sequence Overview Tables for seismic, Are, and high wind events, respectively. Tables 5.6 through 5.8 provide the PWR Accident l

Sequence Detailed Tables for seismic, fire, and high wind events, respectively.

l It should be noted that many of the data table entries are limited by the fact that the IPEEE results were reported at the cutset level rather than at the functional event sequence level.

l i

i I

l Energy Research, Inc. 43 ERI/NRC 95-502 i

o Table 5.1 External Events Raults Plant Name: McGuire Unit 1*

Event Screening CDF Plant HCLPF(g) Notes External Fire O Externst Flooding O Extreme Winds S 1.9E-05 Internal Fire S 2.3E-07  !

Nearby Facility Accidents O Seismic Activity S I.lE-05 EPRI Hazard Curve i

t Transportation Accidents O l i

Others I i

Screening: S = Plant specific analysis; O = Screened out; SO = Bounding analysis

• Unit 2 judged to be the same.

Energy Research,Inc. 44 ERJ/NRC 95-502 ,

Table 5.2 PRA Seismic Ragility Plant Name: McGuire SSE: HorizontalD L1(g) Vertical Q1Q(g)

Hazard parameter: PGA (PGA, Spectral Velocity)

Hazard Assessment EPRL LLNL 1989 (LLNL, EPRI, Site Specific)  !

Spectral Shape: .5% dannned from NURECJCR-0098 (10,000 year LLNL median UlIS, site specirx: or other)  !

Cutoff"g" 1.02.

List components and equipments with lowest seismic capacities (less than 10) which contribute to syem failure:

Component Median A & & ilCLPF(g) Seismic 4.= Seismic Success Path Capacity (g)

Dou;piios. Dou;piion oft-Site 16. 0.30 0.25 0.50 '

AFW Source Water 0.40 0.30 0.50  !

Turbine Diiva Aux. Feed Pump 0.48 0.10 0.37 Battery Charger 0.49 0.33 0.32 Low LevelIntake Siructure 0.58 0.32 0.34 RIIR Heat Exchanger 0.61 0.31 0.33  !

DG Start AirTanks 0.68 0.29 0.40 Motor Di;1u. Aux. Feed Pumps 0.69 0.10 0.35 SI Pumps 0.71 0.31 0.47 Centrifugal Charging Pump 0.71 0.31 0.47 Containment Spray HX 0.71 0.33 0.35 i Energy Research, Inc. ,

45 ERI/NRC 95-502 l

n_m. . . _ _ _ _ .-_._ _ . . - - - - . _ _ _ _ _ _ _ . _ . _ _ _ _ _ . - _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . _ _ .'

TmMe5.3 PWR Accident 4.s OTerflew Tame '

Plant Name. McGuire For Seismic PRA Only 1 m-e or i

~

1. ~ c,.-,~. PDS CDP Init Event I <= S,.m t Failed Functions Attri",Ae I CBQsU

• 8.4E-07 T-LOOP EAC SSMU, RCS-INT. SBO, TIL HPI 2 CQsU

• 8.4E-07 T-LOOP EAC SSMU, RCS-INT, SBO, TIL IIPI 3 CBQsU

• 6.9E-07 T-LOOP EAC SSMU, RCS-INT, . SBO, TIL HPI 4 CBQsU

• 4.2E-07 T-ESW ESW SSMU, RCS-INT, SBO, TIL HPI 5 CQsU

• 3.5 E-07 T-LOOP EAC RCS-INT HPI SBO, TIL 6 CBQsU

• 3.3E-07 T-LOOP DC SSMU, RCS-INT, SBO, TIL HPI ,

7 CBQsU

• 3.lE-07 T-ESW ESW SSMU, RCS-INT, SBO, TIL i HPI 8 CBQsU

• 3.0E-07 T-LOOP DC SSMU, RCS-INT, SBO, TIL ,

HPI 9 CQsU

• 2.9E-07 T-LOOP EAC RCS-INT, HPI SBO, TIL .

Imh Evans T-SSI Tf3ewek thMusert one of Wim foseelug: St. 52,33, A, V (-eth T-tDOP, TAX. T-17. T-A1WS, T-UMS. T-RCP. T-IJmIU, T-t.MN. T-EXFW. T-stDOC er Tw Systemp ,

T-StJMC, T-SGTR, T 90ItVIIORV l

(-sis sesen so eyden. _,/ , m met L h: As meet two of to feRewh AC AC9UI, AGRT2. AGRf3 AUNC2, AUxc3, AUXCS, CCW, DC, EAC. EDC ESA31. ESA52. E5W. MVAct. NVAC2, MVACS, IA, M sney be bients.

FeEnd Rascalmes: At most enee of to followh: SINT, SOEP, SSMU,903 90R, RC& TNT, RC3-DEP. NPt. ItPR Iff, t.Mt. CPSt. CPSit, C3F, VENT (if a de seafor Se ese sn andman: A..e= *,se of no fine.w:ATws, eTeAss. m. nosom. sno, cR mne nW , w w *> I e C e.e. *m ,* f,s.e I .

i Energy Research, Inc.  !

46 ERI/NRC 95-502

-i Tame 5.4 FWR AccMeat Seapsence OTerfiew Tame t i

Plant Nanie- McGuke For Five PRA Only 1 m-e or i  !

t

1. Sequence PDS CDP Init Event less Support Failed Functions Attributes 1 TQSU 7DI 1.3E-07 T-ESW ESW RCS-INT. HPI TIL 2 TQSU 7PI 4.3E-08 T-ESW ESW f

RCS-INT, HPI TIL  :

3 TQSU 7P1 2.5E-06 T-ESW ESW RCS-INT. HPt TIL 4 TBU 7PI 2.0E-06 T-LMFW AC SSMU, HPI TIL  ;

I 5 TQSU 7PI 1.3E-06 T-ESW '

t ESW RCS-INT, HPI TIL l

6 TQSU 7PL 4.3E-10 T-ESW ESW RCS-INT, HPI - TIL' 7 TQSU 7PL 2.5E-10 T-ESW i ESW RCS-INT, HPI TIL (

8 TBU 7PL 2.0E-10 T-LMFW AC SSMU, HPI TIL '

I 9 TQSU 7PL 1.3E-10 T-ESW ESW RCS-INT, HPI TIL hk Emma AuMuawk One of to fellowing: St. 32. 33. A. V (-nsl. T-IDOP. T-pK. T-TT. T-A1WS. T-tMet. 74tCP.T-tJettf. T4AtFW T-EXfW. T-StDOC T-StBIC,7 Sent. 7400tviloitV.

T-sSI.T40emen er74mspper?Sysme)

(-sal sefere to oputemel sayytommassey seneselst, taanammean:

esey to temet). At asset ese of to IsNewbqs: AC. ACDUI. ACBU2 AC9U3 AUNC2, AUXC3., AUNC4. CCW. tK' EAC. EDc, ESASI. ESAS2. ESW. IfVAct. IfvAC2. MVAC3,IA. 3887. OA3. 044. SA. STht. SW2. SW3,ii EnAnd Ramadams: As misse duas of en fulleetg* SINT. SDEP SSMU. IICS 90R. ItCS-INT. RCS-DEP. MPl. MPlt.178, IJgt. CPSI CPSIt OF VENT Of a Se endfor Se esu uneessney. =us ihm *Neest fiel4 Amtes At amont twoo of to lateetg: A1WS. ifvPASS.111,IND-SGfR. 880. (WL ItUht (FMG sney te binet)

Energy Research, Inc. 47 ERl/NRC 95-502

_ _ _ . _ - . _ . _ . - - - _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ' ' ^ ' - - - - ^ - - -

t-

\

Table 5.5 PWR Accident Sep Overview Table Plaid Name. Mm For Wind PRA Only 1 h of I

1. Sequence PDS CDF Init Event i== Support Failed Functions Attributes 1 SBO

• 1.9E-05 T-Loop EAC RCS-INT, HPI Non-Recoverable SBO, TIL Im3 Emme T-sst, Tioter), limittert:

or 743mprest OneSysene) of to Nisehg: St. 32. 33. A. V (-an), T LOOP. T-RX. T-Tr. T-ATWS, T-UBIS. T-RCP. T-l>fMti. T-l.MFW, TEXFW, 74tDOC, T SLSIC T-Sent. 740stVIIORY.

(-un) sefeve to eyelessel eWry asserial.

Ima hanmunas:

==r te 68-63 As meest tes of die folleebg: AC. AGUt. ACBU2 AGU3, AtffC2, Al1EC). AUXCI. CCW. DC EAC, EDC, IJASt. ESAS2, E5W. MVACl. ItVAC2. 9tVAC3 lA. 7887. OA3, OA4, SA, STM. .

SW2 SW). SWS VAC Gb W Rumisimmer At unset esse af en felleety: Spff. SDEP SSMU. RCS400t. RCS-fMT, RC&lMP. IIPR, NPR 179, EER, CPSI. CPSR, CF. VENT Of a de en&er 34 ese aseessery. use es "pesess' flew) antes: As smest esce of as fossets: ATWS, BYPASS. TA IPID SUtit. Sno, OR 98U4 (Flew nemy be basak) e c ,4. r.o., S.n si Energy Research, Inc. 48 ERI/NRC 95-502

_ __ _ _. .._m m.. _ _ . _ - _ _ . . . - _ _ _ _ . - -__ .. . _ . . . _ _ . . _ _ . _ _ _ _ _ . --. _ .

r t

Table 5.6 PWR Accident Seaguessee Detailed Table i i

Plant Nesne: ue-- For Seismic PRA Only a m-eor i t

4 (

Rx Pit l MARY PitfMARY PlflMARY INTBollITY INVENToltY. INVLNTORY. SECONDARY SECONDARY INIBCTION RECIRC INTBollITY INVENTURY CONTAINMENT i

4 R 9 P P P P R C H L A A A C M L A A 5 5 T M T S M N A A A A C C P P I C C I R N P I P 5 A A C H P P C I I H P P R R G G T 5 B [

G P 1 P M M M S 5 C C C I I G P U  !

, gg 5 0 R D D P P I I C I 2 P R R I 2 S A I W S w I 2 3 1 2 1 2 1 2 N M R V I 2 5 I R V P g [

v  ;

t I conio x x x insP i 2 et>U x x InsP f

3 C9Q.U x x x losP i i

4 coo.o x x x Esw s en o x x InsP e can.U x x x insP -

7 can.u x x x Esw t a coa.u x x x InsP i 9 CQ.U x x InsP t

.F i

i i  !

t i

Energy Research, Inc. 49 ERI/NRC 95-502 i

i  ?

2 Tame 5.7  :

PWR Accidesd Sequesece Detailed TmMe ,

l PlantNesse: e* For Fire PRA Only 1 h or i i t

ItX PgtIMARY P95 MARY PIBMARY

• IN11!DIETY INVENTURY. INVENTUItY. SEKTMtDARY SE!CONDARY INFECTION RECIItC INTBGgtfTY INVEN105tY CONTAINMENY I i

R B P P P P R C H L A A A C H L A A S 5 T M T 5 M N A A A A C C P P l c C l R H P I P 5 A A C H P P c I I H P P R R G G T 5 C fl F I P M M M S 5 C 5 0 R D D P P I C C I I G P (I

, g I C I 2 P R R I 2 3 A I W 5 W I 2 3 1 2 I 2 I 2 N 4

R V I 2 5 I M g R V P  ;

V ,

I TQSU X X ESW 2 TQSU X X ESW i 3 195U X X I!5W f

4 TBU X X i X LDSP i 5 TQ5U X X t

E5w e 195U X X E5w i 7 insU X X E5w  !

a teu X x t X insP t tusU X X  !

asw i

i i

r I

i

)

?

t i

Energy Research, Inc. 50 ERI/NRC 95-302 i

t i

?

f

s i Table 5.8 PWR Accident Sequence Detailed Table ,  !

u"- i Meat Name: For Wind PPA Only I wr o i I I

l Rx resMARY resMARY rssMARY INTEORITY INVENTURY- INVENTORY.

f SernNDARY SBCONDARY  !

IN)ECTION RECIRC INTEGsSTY . INVENTURY CONTAINMittT  !

E R D F F F F R C H L A A A C H L A A 5 5 T M T S M N A A A A C C 1- P I C C I R H P I P 5 A A C H P P C I I H P P R R G G T 5 R G F I F M M M S 5 C C C i

I 1 G F U '

, p 3 0 R D D F F I I C I 2 P R R I 2 3 A I W 5 W I 2 3 I 2 I 2 I 2 N M R V I 2 5 i R V P m y

I soo x x 1 une [

i f

i Energy Research,Inc. 5I ERl/NRC 95-502

L4 6 REFERENCES j l

1. "McGuire Nuclear Station FEEE Submittal Report," Duke Power Company, June 1994.

2. "Indrvidual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -

l 10CFR50.54f," U. S. Nucleer Regulatory Commission Generic Letter 88-20, Supplement 4, June 28,1991.

I

3. J. T. Chen, et al., " Procedure and Submittal Guidance for the Individual Plant Ernminatinn of j External Events (FEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory l Commission, NUREG-1407, May 1991.  !

4. "McGuire Nuclear Station Probabilistic Risk A=s====* " Duke Power Company, July 1984.

5. "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI-NP4041-SL, Revision 1, August 1991.

6. D. L. Berry and E. E. Minor, " Nuclear Power Plant Fire Protection-Fire-lie-rds Analysis (Subsystems Study Task 4)," Sandia National Laboratories, NUREGICR-0654, SAND 79-0324, September 1979.

7. "McGuire Nuclear Station, Catawba Nuclear Station Supplemental IPEEE Fire Analysis Report,"

Duke Power Company, August 1,1996.

8. R. T. Sewell, et al., " Individual Plant Framiantion for External Events: Review Guidance,"

ERI/NRC 94-501 (Draft), May 1994.

9. "IPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commimmion, June 18, 1992.

10. S. C. Lu, and A. Boissonnade, "FEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 14,1993.

11. "McGuire Nuclear Station IPE Submittal Report," Duke Power Company, November 1991.

12. "McGuire Nuclear Station, Docket Numbers 50-369 and -370, Request for Additional Information-Individual Plang Framinannn for External Events; Response," Letter to U. S. Nuclear Regulatory Commission, from M. S. Tuckman, Duke Power Company, November 17,1995.

13. " Development of Criteria for Seismic Review of Selected Nuclear Power Plants," NUREG/CR-0098, May 1978.

i 14. R. P. Kmnarly and M. K. Ravindra, " Seismic Fragilities for Nuclear Power Plant Risk Studies,"

Abclear Engineering med Design, Vol. 79, No.1, pp. 34748,1984.

i

15. " Fire Induced Vulnerability Evaluation Methodclogy (FIVE) Plant Screening Guide," Electric Power Research Institute, TR-100370, April 1992.

]4 i

i -

4 Energy Research,Inc. 52 ERI/NRC 95-502 1

l

r e .

16. "NSAC-60, Oconee PRA, A Probabilistic Risk Assessment of Oconee Unit 3," Electric Power Research Institute, June 1984.

17.

Guidelines for Combining Natural and External Man-Made Hazards at Power Plant Sites,"

American Nuclear Society, American National Standard, ANSI /ANS-2.12,1978.

! 18. "PRA Procedures Guide," American Nuclear Society and Institute of Electrical and Electric l Engmeers, United States Nuclear Regulatory Comminion, NUREG/CR-2300, January 1983.

19. L. A. Twisdale, et al., " Tornado Missile Simulation and Design Methodology," Electric Power Research Institute, EPRI NP-2005, August 1981.

l

20. L. A. Twisdale, et al., " Tornado Missile Risk Analysis," Electric Power Research Institute, EPRI '

NP-768 and NP-769, May 1978.

21. " Tornado Occurrence Rates for 125 NM Area Around McGuire Nuclear Station," National Severe Storm Forecast Center, June 1989.

22. J. H. Shulte, Whon of the TORMIS Computer Code," Duke Power Company, PSA-840, February 1984. .

{

i

23. L. J. Kachnik, Duke Power Company, Memo To File in MC-153540, April 18,1991,

24. Telecon with Kelly Bostian, Fire Protection, McGuire Nuclear Station, February 23,1994.

25. " Analysis of Hydrogen Storage Tank Failure,* Duke ISA Study 8349, File:MC1513.03; Rev. 3, August 1985.

26.

• Evaluation of Potential Hydrogen Leaks and Accumulazion in the Auxiliary Building," Duke l

Design Study MGDS-0229/00, File MG-22383/00, May 1992.  !

27. " Staff Guidance ofIPEEE Submntal Review on Resolution of Generic or Unresolved Safety Issues (GSI/USI)," U.S. Nuclear Regulatory Comminion, August 21,1997.

28. " Duke /NRC Meetmg - McGuire and Catawba Fire IPEEE," presentanon by Duke Power Company l to U.S. Nuclear Regulatory Commission, June 4,1996.

I l

i d

Energy Research,Inc. 53 ERI/NRC 95-502

!