ML20205N379

Technical Evaluation Rept on Submittal Only Review of IPE of External Events at Catawba Nuclear Station,Units 1 & 2

ML20205N379
Person / Time
Site:	Catawba
Issue date:	02/28/1998
From:	Frank M, Sewell R, Sholly S AFFILIATION NOT ASSIGNED
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20205N350	List: ML20205N347 ML20205N365 ML20205N379
References
CON-NRC-04-94-050, CON-NRC-4-94-50 ERI-NRC-95-506, NUDOCS 9904160261
Download: ML20205N379 (68)

Text

_

ERl/NRC 95-506

/

. '/

TECHNICAL EVALUATION REPOCT ON THE

" SUBMITTAL-ONLY" REVIELU OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT CATALUBA NUCLEAR STATION, UNITS 1 AND 2 FINAL REPORT Completed: December 1996 Final: February 1998 i

l Energy Research, Inc.

]

P.O. Box 2034 Rockville, Maryland 20847-2034 i

Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory Research o act No. 04 9 -050 ag patodare*la - - -

ERI/NRC 95-506 TECHNICAL EVALUATION REPORT ON TIIE "SUBMITTAleONLY" REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT CATAWHA NUCLEAR STATION, UNITS 1 AND 2 FINAL REPORT Completed: December 1996 Final: February 1998 M. Khatib-Rahbar Principal Investigator Authors:

S. C. Sholly', R. T. Sewell, M. V. Frank',

A. Mosleh', J. A. Lambrighti and A. S. Kuritzky Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission l Office of Nuclear Regulatory Research Washington D.C. 20555 Contract No. 04-94-050 Formerly of Beta Corporation international, presently w C Lambright Technical Associates. 9009 Lagrima De Oro Road

{

NE Albuquerque NM 87111 Safety Factor Associates. Inc.,1410 Vanessa Circle. Suite 16. Encimtas. CA 92024 University of Maryland. Department of Materials and Nuclear Engineering. College Park MD 20742

TABLE OF CONTENTS EXECUTIVE

SUMMARY

, . . . . . . . . . . . . vi PREFACE .. .... .. ........ . .. . . . ... . . . . . . xi ABBREVIATIONS .... ....... . ... .. .., .. . . . . . xii

! JNTRODUCTION . . . . . . . . . . . ... . . .... .. ..... . I 1.1 Plant Characterization . . . . ... . . .. .. . I 1.2 Overview of the Licensee's IPEEE Process and Important insights . . . .

l.2.1 Seismic . , ......... .,. .. ... . .... . . .

l.2.2 Fire . .. .. .... . . .. . . . ... ... 2 1.2.3 HFO Events ..... .. . . . . ... .. .4 1.3 Overview of Review Process and Activities .. .. . . ... 4 1.3.1 Seismic . . . . .. . . . . 4 1.3.2 Fire . . . . . . . . . . . . . . 5 1.3.3 HFO Events .. . . ... ... 6 2 CONTRACTOR REVIEW FINDINGS .. .. . . .7 2.1 Seismic . .... . . . .. ..7 2.1.1 Overview and Relevance of the Seismic IPEEE Process . .. 7 2.1.2 Logic Models . . . . ... . 7 2.1.3 Non-Seismic Failures and Human Actions . .. . . . .7 2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape) . .. . 8 2.1.5 Structural Responses and Component Demands . . .8 2.1.6 Screening Criteria .. . .. . 8 2.1.7 Plant Walkdown Process . . . .. . 9 2.1.8 Fragility Analysis . .. . . . . .. . .. . 9 2.1.9 Accident Frequency Estimates ... 9 2.1.10 Evaluation of Dominant Risk Contributors . . . 10 2.1.11 Relay Chatter Evaluation . . . .. . . . . . 11 2.1.12 Soil Failure Analysis . . .. . 1I 2.1.13 Containment Performance Analysis . . . 11 2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations . 12 2.1.15 Treatment of USI A-45 . . . . . .. . . . 12 2.1.16 Treatment of GI-131. . . . ... .. 12 2.1.17 Other Safety issues .. . .. . . 13 2.1.18 Process to identify, Eliminate or Reduce Vulnerabilities . . .. 13 2.1.19 Peer Review Process . .. .. . .. 16 2.2 Fire . . . . ... . . . .. . .. ..... .. 16 2.2.1 Overview and Relevance of the Fire IPEEE Process . . . . 16 2.2.2 Review of Plant Information and Walkdown . . . . 17 2.2.3 Fire-Induced initiating Events . . . . . . ... . . 18 2.2.4 Screening of Fire Zones ...... . . . .. 18 2.2.5 Fire Hazard Analysis . . . . . . 20 2.2.6 Fire Growth and Propagation . . .. . ... . 20 Energy Research, Inc. ii ERI/NRC 95-506 t

2.2.7 Evaluation of Component Fragilities and Failure Modes . .. 21 2.2.8 Fire Detection and Suppression . . . .... . . . .. .. 21 I 2.2.9 Analysis of Plant Systems and Sequences . . . . . . . . ... 22 2.2.10 fire Scenarios and Core Damage Frequency Evaluation . ... 23 2.2.11 inalysis of Containment Performance . . . 24 2.2.12 Treatment of Fire Rid Scoping Study Issues . . 24 2.2.13 USI A 45 issue . . . . . .. . .. 25 2.3 HFO Events . . ....... .. .. ... . .. . 25 2.3.1 High Winds and Tornadoes . . . . . .. . 26 2.3.1.1 General Methodology .. . . . ... 26 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis 27 2.3.1.3 Significant Changes Since Issuance of the Operating License . . .. 28 2.3.1.4 Significant Findings and Plant-Unique Features . 28 2.3.1.5 Hazard Frequency . . . . 28 2.3.1.6 PRA Analysis .. . .. 28 2.3.2 External Flooding . . . . . . . . .. 29 2.3.2.1 General Methodology ... , . 29 2.3.2.2 Plant-Specific Hazard Data and Licensing Basis . 29 2.3.2.3 Significant Changes Since Issuance of the Operating License ... . .... . . . .. 30 2.3.2.4 Significant Findings and Plant-Unique Features . 30 2.3.2.5 Hazard Frequency . . .. . . 30 2.3.3 Transportation and Nearby Facility Accidents .. . . 30 2.3.3.1 General Methodology . . . . . 30 2.3.3.2 Plant-Specific Hazard Data and Licensing Basis .. 30 2.3.3.3 Significant Changes Since Issuarce of the Operating Licensee . . .. . . .. 31 2.3.3.4 Significant Findings and Plant-Unique Features . 32 2.3.3.5 Hazard Frequency . 32 2.3.4 Other HFO Events . 32 2.4 Generie Safety Issues (GSI-147, GSI-148 and GSI-172) . 33 2.4.1 GSI-147, " Fire-induced Alternate Shutdown / Control Panel Interaction" 33 2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effactiveness" . 33 2.4.3 GSI-172, " Multiple System "- anses Program (MSRP'," . 33 3 OVERALL EVALUATION, CONCLUSIONS AND RECOMMENDATIONS . 38 3.1 Seismie . . . . 38 3.2 Fire . . . . . . 40 3.3 HFO Events . 42 4 IPEEE INSIGHTS, IMPROVEMENTS AND COMMITMENTS 43 4.1 Seismie .. . . . 43 4.2 Fire . .. . . . . . . . 43 4.3 HFO Events . . . 43 5 IPEEE DATA

SUMMARY

AND ENTRY SHEETS . 44 Energy Research, Inc. iii ERl/NRC 95-506

6 REFERENCES .. .... .... . ... - - . . . .......... 53 Energy Research, Inc. iv ERl/NRC 95-506

LIST OF TABLES Table 2.1 Summary Information on Dominant Core Damage Contributors . .... . 10 Table 5.1 External Events Results . .. .. .. . . ... . .. 45 Table 5.2 PRA Seismic Fragility . . . . . . . . . .. . . . .. . 46 Table 5.3 PWR Accident Sequence Overview Table - For Seismic PRA Only . . . 47 Table 5.4 PWR Accident Sequence Overview Table - For Fire PRA Only . .. . . 48 Table 5.5 PWR Accident Sequence Overview Table - For Wind PRA Only . . 49 Table 5.6 PWR Accident Sequence Detailed Table - For Seismic PRA Only .. . 50 Table 5.7 PWR Accident Sequence Detailed Table - For Fire PRA Only . . . 51 Table 5.8 PWR Accident Sequence Detailed Table - For Wind PRA Only . .. . 52 Energy Research, Inc. v ERI/NRC 95-506 i

j

EXECUTIVE SUNLTIARY This technical evaluation report (TER) documents a " submittal-only" review of the individual plant examination of external events (IPEEE) conducted for the Catawba Ncelear Station, Units I and 2. This technical evaluation review was performed by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear Regulatory Commission (NRC). The submittal-only review process consists of the following tasks:

• Examine and evaluate the licensee's IPEEE submittal and directly relevant available documentation.

• Develop requests for additional information (RAls) to supplement or clarify the licensee's IPEEE submittal, as necessary.

• Examine and evaluate the licensee's responses to RAls.

• Conduct a final assessment of the strengths and weaknesses of the IPEEE submittal, and develop review conclusions.

This TER documents ERI's qualitative assessment of the Catawba, Units I and 2, IPEEE submittal, particularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidance presented in NUREG-1407.

Catawba Nuclear Station is owned and operated by Duke Power Company (DPC). The Catawba IPEEE considers seismic; fire; and high winds, floods, and other (HFO) external initiating events. The IPEEE represents an update of earlier studies which were conducted with the assistance of various consultants; the earlier studies include an existing probabilistic risk assessment (PRA) and an existing seismic margin assessment (SMA) based on the Electric Power Research Institute (EPRI) methodology. The IPEEE analysis itself was performed entirely by DPC personnel.

Licensee's IPEEE Process For the seismic IPEEE of Catawba, DPC employed seismie probabilistic risk assessment methodology, modifying the existing Catawba seismic PRA. DPC stated in the IPEEE submittal that it followed the recommendations in NUREG-1407, Section 3.1.2, for use of an existing PRA. Seismic walkdowns of Catawba, Unit 2, were originally completed (meluding walkdowns of specific components, area reviews, and reviews of areas common to both units) as a result of the Catawba trial plant SMA review issued in 1989. As part of the IPEEE process, additional seismic walkdowns of both units were completed using the same procedures as for the original Unit-2 walkdowns.

The Catawba tire IPEEE is an update of the full-scope Level-3 Catawba PRA that was performed between 1984 and 1987. The analysis identitled critical fire areas, identified possible initiating events, calculated the fire initiation frequency, evaluated potential impairment of critical safety functions, and developed and quantitied core damage cutsets using a functional transient event tree and associated fault trees. A special tire event tree was used to help screen out tire areas, assess fire damage, and quantify the frequency of fire damage. A screening process was used in this analysis, in which fire scenarios were not quantified if a similar individual plant examination (IPE) scenario had a larger estimated frequency of occurrence.

Typical of other tire PRAs, containment performance was assumed to be the same as evaluated for the Energy Research, Inc. vi ERl/NRC 95-506

1 internal events study, because all tire scenarios were viewed as alternative initiating events for the internal event trees. There was no discussion of additional initiating events or containment failure modes unique to fires. A fire walkdown was performed to verify assumptions about plant configuration, to locate cable runs, and to address the Sandia tire risk scoping study issues. The licensee's original fire IPEEE submittal was supplemented by two subsequent analyses. The first analysis expanded the scope of quantified sequences by including fire scenarios that were screened out in the original IPEEE. The second analysis (a sensitivity analysis) investigated the impacts of the number of suppression attempts for a given scenario.

The Catawba HFO IPEEE submittal relied heavily on the evaluations performed for the original Catawba PRA. The general methodology utilized in the study consisted of: (1) identifying potential external events using NSAC/60, ANSI /ANS-2.12, and NUREG/CR-2300; (2) implementing a screening process; (3) performing a scoping analysis on the unsereened hazards; and (4) conducting detailed quantification of the

" tornado /high winds" hazard.

Key IPEEE Findings 4

The IPEEE submittal estimated a seismic core damage freopeney (CDF) of 1.6 x 10 per reactor-year (ry).

The submittal did not explicitly identify the dominant basic events and component failures contributing to seismic risk, but made the following general staten'ent:

"Many of the dominant sequences involve a loss of offsite power followed by a failure of the emergency diesel generators. At low ground accelerations, diesel failures are due to random start, run, or maintenance failures. At ground levels above 0.5g, the diesel failures are predominantly seismie failures (diesel generator battery chargers, diesel oil tanks, DC control power, etc.). The loss of offsite power is assumed to be non-recoverable (a potentially conservative assumption). In addition, no credit is taken for recovering either diesel generator (another potentially conservative assumption). "

Inspection of the cutset failure events in the present review has revealed that loss of offsite power (LOSP) seenarios involving seismically induced diesel failures were responsible for at least 48.6% of the seismic CDF (seven cutsets), while the LOSP seerarios involving random non-seismic diesel failures were responsible for at least 5.8% (three cutsets). An additional contribution of at least 15.9% arose from seismically initiated LOSP plus seismically initiated failures of AC and/or DC power components (such as emergency AC switehgear, inverters, and AC and DC power panel boards). Together, these three classes of seismically initiated station blackout scenarios were responsible for just over 70% of the seismic CDF. Thus, the dominant basic events / component failures that contribute to seismic risk can be inferred  ;

to be:

l

1. Seismically initiated loss of offsite power. (

2. Various failures of diesel generators and emergency AC power system components and support system components, resulting in station blackout.

In the initial / original fire IPEEE study, three areas survived screening: the control and cable rooms, and the component cooling water "short room." Only the cutsets for these three scenarios were included in the evaluation of tire CDF, producing a CDF result of 4.7 x 10*/ry, which is about 6% of the total CDF for Catawba (8 x 104 /ry for internal and external events). Fire sequences for these areas were identitled Energy Research, Inc. vii ERl/NRC 95-506

as TQ3U sequences, involving a transient (T) with a reactor coolant pump (RCP) seal loss of coolant accident (LOCA)(Qs) and failure of safety injection (U). Catawba has a safe shutdown system which will counter the effects of loss of component cooling water. The dominant contributor to loss of the safe shutdown system was determined to be human error. Some notable differences in fire CDF and dominant core damage locations emerged from the subsequent expanded base-ease and sensitivity case. Namely, the estimated fire CDF increased and dominant locations emerged (e.g., turbine building) which had been screened out in the original analysis. The most significant fire walkdown tinding was the discovery of the close approach of two trains of cables for component cooling water pumps in the elevation 568-ft "short room. "

4 For HFO events, the submittal reported that tornadoes have a CDF contribution of 2.6 x 10 /ry, which is approximately 11% of the total calculated CDF for external events. Sequences involving a tornado-induced, non-recoverable LOSP, followed by random failures of the emergency power system, were identified as the major contributors to the tornado-induced CDF. This conclusion, however, was based on the licensee's judgment that the standby shutdown system, which is partially housed in a non-Class-1 structure, would not be damaged by a tornado strike. All other HFO events were either screened out qualitatively, or in the case of aircraft crash hazard, by performing a hazard frequency assessment.

Generic Issues and Unresolved Safety Issues According to DPC, the seismic IPEEE resulted in closeout of the following issues: unresolved safety issue (USI) A-45, " Shutdown Decay Heat Removal Requirements"; Generic issue (GI) 131, " Potential Seismic Interaction involving the Movable in-Core Flux Mapping System Used in Westinghouse Plants"; the Eastern U.S. Seismicity Issue (Charleston earthquake issue); and USI A-17, " System Interactions in Nuclear Power Plants."

The licensee stated in the seismie IPEEE submittal (Section 3.2) that the decay heat removal capabi:ity of Catawba was addressed in Section 3.4.4 of the IPE report. The licensee further stated: "The calculated annual core melt frequency due to failure of decay heat removal systems for external initiators did not change significantly as a result of the IPEEE analysis. Therefore, this issue should be considered resolved for Catawba." With respect to GI-131, the submittal states that this issue was already addressed by addition of restraints during construction, and that the restraints are adequate to prevent seismie interaction and breach of the pressure boundary. (This treatment of GI-131 apparently did not consider beyond I design-basis earthquakes.) The submittal discusses USl A-17 by stating that the walkdowns identified a few minor seismic interaction issues which were corrected (and are identified in Table 3-3 of the submittal). The licensee states that the seismie walkdown did not identify any significant seismic interaction concerns.

From the Catawba fire IPEEE, the following licensee insights pertaining to tire risk scoping study issues were developed: where smoke could be generated by fire, existing smoke control capability is sufficient to prevent unacceptable damage; no cost-effective modifications to tire suppression systems are needed to mitigate the effect of fire suppression water discharge and migration; seismically induced failure of fire protection control panels is not a problem; automatic heat activated sprinkler heads may be actuated during l an earthquake, but no corrective actions were deemed necessary; seismically induced failure of RCP motors is not a problem because fires in the motors would not affect the ability to achieve safe shutdown; and control system interactions are not a problem because of the standby shutdown system. The areas of earthquake-induced tires (other than the RCPs), fire barrier qualification, and tire brigade effectiveness Energy Research, Inc. viii ERI/NRC 95-506

were not discussed in the submittal. With respect to USI A-45, credit was taken for bleed and feed and for the standby shutdown system. Fire was not found to be a significant contributor to the risk associated with shutdown decay heat removal sequences.

~

For HFO events, the licensee provided information discussing the effects of rain water build-up on plant building rootiv, as a result of the probable maximum precipitation (GI-103).

Some information is also provided in the Catawba IPEEE submittal whi'ch pertains to generic safety issue (GSI)-147, GSI-148 and GSI-172.

Vulnerabilities and Plant Improvements Based on the seismic IPEEE findings, the licensee concluded that there are no fundamental weaknesses or vulnerabilities with regard to severe accident risk at Catawba. No plant changes were identified from the seismic IPEEE analysis, and consequently, the licensee did not commit to any plant improvements.

The tire IPEEE did not result in any plant improvements. Based on defining a vulnerability as an " unduly significant sequence" (Page 1-3 of the submittal), the licensee identitled no vulnerabilities and no unacceptable risks.

For HFO events, the Catawba IPEEE submittal concluded that there are no fundamental weaknesses or vulnerabilities with regard to severe accident risk at Catawba Nuclear Station. As such no commitments were made for plant improvements with respect to HFO events.

Observations From the seismie IPEEE, the principal finding of this review is that the documentation of the containment performance analysis is deficient with respect to significant information requested in NUREG-1407, Section C.2.1. The licensee concluded that seismic events have no impact on the containment analysis, whereas this review has found that the hydrogen mitigation system would be unavailable for seismically initiated station blackout sequences (which represent at least 70% of the seismic CDF). Unavailability of the hydrogen mitigation system would render the containment susceptible to early failure due to overpressurization (noncondensible gases) and/or hydrogen detiagration/ detonation.

For the fire IPEEE, after restoring and quantifying previously screened-out areas in an expanded base-ease analysis, some differences in tindings/results were observed with respect to the original analysis. Building on the expanded set of sequences, the sensitivity case modified the calculation of the frequency of tire damage events by allowing one (rather than multiple) opportunities for suppression. One location that was previously screened out (the turbine building) emerged as a dominant fire risk location in this sensitivity case. The emergence of the turbine building, however, resulted from assumptions that anificially increased the likelihood of a turbine building-wide tire, and does not indicate a vulnerability. The original study produced a fire CDF of 4.7 x 10*/ry in which the dominant areas were the control room, cable spreading room, and component cooling "short" room. The sensitivity case produced essentially no change in the CDF of these rooms. The sensitivity study produced a fire CDF of 7.3 x 10*/ry, a 60% increase over the original case. The sensitivity studies provided substantial additional insights into the significance of assumptions in identifying the most important tire locations and in calculating the core damage frequency. The Catawba and McGuire Nuclear Generating Stations are similar plants, as is the Energy Research, Inc. ix ERI/NRC 95-506

methodology Duke Power used to analyze fires at these stations. Interestingly, the results of the base-ease fire studies for these plants are significantly different, whereas the licensee noted that the results of the sensitivity-case studies are similar. This observation indicates the importance of using screening methods and assumptions that either realistically or somewhat conservatively represent the plant. The most notable strengths of the fire IPEEE effort include the walkdown, which was found to be thorough and comprehensive, and the fact that the entire study was performed by the licensee's staff. There are several methodological weaknesses which, if corrected, would add considerably to the robustness of the study %

results and insights. The most important of these weaknesses include: (1) use of the outdated NUREG/CR-0654 as a basis for a fire event tree; (2) use of an outdated tire database which led to low estimates of fire initiation frequencies in key areas; (3) lack of consideration of control room abandonment scenarios; and (4) the use of a single fire source in each room to represent the entire room. The validity of this last item hinges on the licensee's statement that mechanical and electrical equipment are always in separate tire compartments. Overall, the performance of the sensitivity cases has provided confidence that the licensee has made a reasonable attempt to identify fire vulnerabilities. The licensee's conclusion that the Catawba Nuclear Station offers no unacceptable risks from fires appears plaasible.

Some positive features of the HFO-events submittal include the use of state-of-the-art methods for the analysis of tornado events, and the fact that the analysis was completely performed and 1: viewed by DPC personnel, using their knowledge of the plant. This approach has led to enhanced appreciation of severe accident behavior by DPC staff. In some respects, however, the HFO IPEEE submittal does not contain sufficient information for a thorough review to be performed. The submittal summarizes the conclusions of previous studies (PRAs and final safety analysis report [FSAR] evaluations) without adequate description of the basic approach and key assumptions. This tinding is particularly true in the case of external flooding. The submittal simply concludes that the contribution to plant risk from external flooding is insignificant based on the analysis presented in Section 3.4 of the FSAR and related design-basis documents. Additionally, the HFO IPEEE submittal contains many statements which are difficult to verify. For example, on page 5-8, Section 5.3.6.1, it is stated: " Previous evaluations of these lines indicates that a rupture would not significantly affect the station." However, no references to such

" previous evaluations" were provided. Due to the heavy reliance on the original Catawba PRA, the HFO IPEEE submittal also creates some pot-ial misunderstandings. For example, on page 2-3 it is stated that the flooding hazard was identified as requiring a detailed quantification. However, a more detailed review of the submittal indicates the external flooding hazard was qualitatively screened out, and that only the risk from the internal flooding hazard was quantitatively assessed.

Energy Research, Inc. x ERl/NRC 95-506

PREFACE The Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include:

Seismic S. Sholly, Primary Reviewer R. Sewell, Secondary Reviewer Brc M. Frank, Primary Reviewer J. Lambright, Secondary Reviewer Hivh Winds. Floods and Other External Events A. Mosleh Review Oversight. Coordination and Integration M. Khatib-Rahbar, Principal Investigator, Report Review A. Kuritzky, IPEEE Review Coordination and Integration R. Sewell, Report Integration This work was performed under the auspices of the United States Nuclear Regulatory Commission, Office of Nuclear Regulatory Research. The continued technical guidance and support of various NRC staff is acknowledged.

Energy Research, Inc. xi ERI/NRC 95-506

ABBREVIATIONS CDF Core Damage Frequency DPC Duke Power Company EOP Emergency Operating Procedure EPRI Electric Power Research Institute ERI Energy Research, Inc.

ESFAS Emergency Safeguards Features Actuation System FIVE Fire Induced Vulnerability Evaluation FSAR Final Safety Analysis Report GI Generic Issue GL Generic Letter GSI Generic Safety Issue HCLPF High Confidence of Low Probability of Failure HFO High Winds, Floods and Other External Events HVAC Heating, Ventilation and Air Conditioning IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events IRT Independent Review Team LER Licensee Event Report LLNL Lawrence Livermore National Laboratory LOCA Loss of Coolant Accident LOSP Loss of Offsite Power MCC Motor Control Center MSIV Main Steam Isolation Valve NRC Nuclear Regulatory Commission OBE Operating Basis Earthquake OL Operating Licensee PGA Peak Ground Acceleration PMF Probable Maximum Flood PMP Probable Maximum Precipitation PORV Power-Operated Relief Valve PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RAI Request for Additional Information RCP Reactor Coolant Pump RHR Residual Heat Removal RLE Review Level Earthquake RWST Refueling Water Storage Tank SI Safety Injection SMA Seismie Margins Assessment SPF Standard Project Flood SRP Standard Review Plan SSE Safe Shutdown Earthquake SSF Safe Shutdown Facility SSPS Solid State Protection System Energy Research, Inc. xii ERI/NRC 95-506

l l

TER T,chnical Evaluation Report UST U. resolved Safety Issue l

i l

l l

i l

) I i

I l

Energy Research, Inc. xiii ERI/NRC 95-506 J

r 1 LNTRODUCTION This technical evaluation report (TER) documents the results of the " submittal-only" r view of the individual plant examination of external events (IPEEE) for the Catawba Nuclear Station, Units I and 2

[1]. This technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external initiators, including seismic events; tires; and high winds, floods, and other (HFO) external events.

The U.S. Nuclear Regulatory Commission (NRC) objective for this review is to determine the extent to which the IPEEE process used by the licensee, Duke Power Company (DPC), meets the intent of Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE submittal are intended to provide a reliable perspective that assists in making such a determination. This review involves a qualitative evaluation of the licensee's IPEEE submittal, development of requests for additional information (RAls), evaluation of the licensee responses to these RAls, and finalization of the TER.

The emphasis of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to .he guidelines established in NUREG-1407 [3]. Numerical results are verified for reasonableness, not for accuracy; however, when encountered, numerical inconsistencies are repo-ted.

This TER complies with the requirements of NRC's contractor task order for an IPEEE submittal-only review.

The remainder of this section of the TER describes the plant contiguration and presents an overview of the licensee's IPEEE proces!, and insights, as well as the review process employed for evaluation of the seismic, tire, and HFO event sections of the Catawba IPEEE. Sections 2.1 to 2.3 of this report present ERI's findings related to the seismic, fire, and HFO event reviews, respectively. Sections 3.1 to 3.3 summarize ERI's conclusions and recommendations from the seismie, tire, and HFO event reviews, respectively. Section 4 summarizes the IPEEE insights, impro aments, and licensee commitments.

Section 5 includes completed IPEEE data summary and entry shee- Jindly, Section 6 provides a list of references.

1.1 Pinnt Characterization Catawba Nuclear Station is located in York County, South Carolina, on the shore of Lake Wylie. The plant site is situated approximately 13 miles from the city of Charlotte, North Carolina. The station consists of two nominally identical four-loop Westinghouse pressurized water reactors (PWPc), each designed to produce 3,411 MWt. The reactor containment is an ice condenser pressure suppression type, with a steel primary containment and a reinforced concrete shield building (similar to the containments at the Sequoyah and Watts Bar nuclear stations). The plant was designed and constructed by DPC. The units were placed into :ommercial operation in June 1985 (Unit 1) and August 1986 (Unit 2).

Limited information on plant configuration was provided in the IPEEE submittal. The plant seismic design basis is a safe shutdown earthquake (SSE) of 0.15g peak ground acceleration (PGA) for horizontal motion and 0.08g PGA for vertical motion.

A significant plant-specific feature at Catawba is the standby shutdown facility (SSF) which houses part of the standby shutdown system. Other plant features include: (1) the ability to cross connect nuclar Energy Research, Inc. 1 ERl/NRC 95-506

service water between units, with only one nuclear service water train required to supply the water needs of both units; and (2) the sharing of instrument air between the two units.

1,2 Overview of the Licensee's IPEEE Process and Important Insichts 1.2.1 Se;smic As documented in NUREG-1407, the Catawba Nuclear Station is binned in the 0.3g focused-seope category (with the additional caution that special attention to shallow soil conditions is appropriate for this site) [3]. Originally, DPC performed a Level-3 probabilistic risk assessment (PRA) of Catawba Unit 1, which was completed in 1987 [4]. Subsequently, Catawba Unit 2 was the subject of an Electric Power Research Institute (EPRI)-sponsored seismic margins assessment (SMA) study, which was issued in 1989

[5]. In 1992, DPC submitted an updated PRA (which included external events) to the NRC as its individual plant exammation (IPE) submitta! [6]. Finally, the external events portion of the 1992 analysis was updated again, and submitted to the NRC in 1994 as the Catawba IPEEE submittal [1]. The overall approach that was implemented for the seismic PRA generally follows the guidance described in NUREG/CR-2300 [7].

In defining the earthquake hazard for use in the seismic IPEEE submittal for Catawba, DPC used the mean EPRI hazard curve for the site [8]. In addition, DPC performed a sensitivity analysis employing the 1989 mean Lawrence Livermore National Laboratory (LI.NL) seismic hazard curve [9]. PGA was used as the ground-motion parameter for developing fragility functions and for performing accident sequence quantification. The IPEEE submittal states that the dominant accident sequences were comparable in their ranking for the EPRI and LLNL hazard curves, and that the LLNL hazard curve results do not add to or alter any of the insights of the analysis based on the EPRI hazard curve.

Seismic walkdowns of Catawba Unit 2 were originally completed (including examinations of specific components, area reviews, and reviews of areas common to both units) as a result of the Catawba trial plant SMA study issued in 1989. As part of the IPEEE process, additional walkdowns of Unit 2 and walkdowns of Unit I were completed using the same procedures as for the original Unit-2 walkdowns [5].

In addition to its treatment of IPEEE objectives, the Catawba submittal addressed the following other seismic safety issues: Generic issue (GI) 131; Unresolved Safety Issue (USI) A-17; and USI A-45.

4 The submittal estimated a seismic core damage frequency (CDF) of 1.6 x 10 per reactor-year (ry). The  !

dominant basic events / component failures that contribute to seismic risk appear to be: seismically initiated loss of offsite power (LOSP); and various failures of diesel generators and emergency AC power system components and support system components, resulting in station blackout.

No seismic vulnerabilities were encountered as a result of the IPEEE, and no related plant improvements were proposed by the licensee.

1.2.2 Fire The Catawba fire IPEEE [1] is an update of the full-scope, Level-3 PRA performed between 1984 and 1987. The fire areas were reviewed during the walkdown to determine if an area could cause one or more initiating events. Those areas not capable of causing an initiating event were screened out. The remaining Energy Research, Inc. 2 ERI/NRC 95-506

)

areas were reviewed to determine the fire source initiating event that would give the " worst case result" involving a fire in that room. The submittal states: "The risk from other possible scenarios is judged to be bounded by the risk from the scenarios examined."

Fire initiating event frequencies were developed using a database containing fire events through 1986, as derived from licensee event reports (LERs) and an EPRI study published in 1983. For most areas, fire initiating event frequency was based on the frequency of nre fer a single selected component in the area, with no consideration given to other possible sources of fire in the area.

Each area was screened out if it met one of two criteria, as follows: (1) an area was screened out if the probability of damage for the worst-case scenario was estimated to be less than 10-8 per year; or (2) an area was screened out if the fire damage probability was estimated to be less than the internal events frequency for the same or similar scenario (s). The screening analysis was performed using a Gallucci style fire event tree. The fire detection, suppression, and propagation parameters of the event tree were based on NUREG/CR-0654 [10J. Multiple opportunities for suppression, without regard for the opposing time of fire damage propagation, were rmdeled in the event tree.

Three rooms survived the au . screening: control room, cable room, and "short room" near the component cooling water pumps. Loss of component cooling water was the selected " worst case" scenario for each of these areas. Fires in the control room and cable room were combined under the assumption that they have the urne effect on the plant, namely, loss of component cooling water. Fire-induced failures were combined with random failures using the transient functional event tree / fault tree model, in order to obtain a CDF estimate.

Based on the IPE model transient event tree and fault trees in Section 2 of the Catawba PRA [4], cutset frequencies were summed to obtain a total tire CDF of 4.7x104/ry, which is about 6% of the total 4

Catawba CDF of 8 x 10 /ry (for internal and external events). Fire sequences from the unscreened areas were identifwo as TQ3U sequences, involving a transient (T) with reactor coolant pump (RCP) seal loss of coolant accident (LOCA) (Q3) and failure of safety injection (U).

The licensee also submitted a supplemental study [11l which included two additional cases of analysis.

The first case was termed an " expanded base ease" and quantified those scenarios that had been screened out of the original study based on the second screening criterion mentioned above. The second case was termed a " sensitivity case" and limited the modeling of tire suppression to a single opportunity. The total CDF for the expanded case was not significantly different from the original base case. The total tire CDF for the sensitivity case was calculated to be 7.3 x 10' per reactor year, and the dominant locations were the turbine building, component cooling water "short" room, control room and cable spreading room. The turbine building emerged as an important tire location in the sensitivity case.

The walkdown was performed to verify assumptions about plant contiguration used in the PRA, and to address the Sandia fire risk scoping study issues. The most significant walkdown insight was the discovery of the close approach of two trains of cables for component cooling water pumps in the elevation 568-ft "short room." The effort to investigate the fire risk scoping study issues did not reveal any problems, and no corrective actions were deemed necessary.

The study identified no vulnerabilities, where a vulnerability was defined as an " unduly significant sequence"(Page 1-3 of Reference [l]).

Energy Research, Inc. 3 ERI/NRC 95-506

1.2.3 HFO Events [

The Catawba IPEEE for HFO events was perfarmed on the foundation laid by the original Catawba PRA

[4] and its subsequent update [6]. The submittal summarized the examination process for external events performed from 1984-1987 for the original Catawba PRA, discussed the continuing process of updating the risk model which resulted in the updated PRA issued in 1992, and discussed the results of the latest update conducted to support the IPEEE. The licensee has documented a detailed analysis for high winds and transportation and nearby facilities accidents hazards. Additionally, other external events have also been evaluated to ensure that there are no hazards unique to the plant. The objectives for this assessment have been consistent with the objectives stated in Generic Letter 88-20, Supplement 4 [2]. Utility personnel were directly involved in all aspects of the development, quantification, and documentation of the analysis.

1.3 Overview of Review Process and Activities in its qualitative review of the Catawba IPEEE, ERI focused on the study's completeness in reference to NUREG-1407 guidance; its ability to achieve the intent and objectives of GL 88-20, Supplement No. 4; its strengths and weaknesses with respect to the state-of-the-an; and the robustness of its conclusions. This review did not emphasize confirmation of numerical accuracy of submittal results; however, any numerical errors that were obvious to the reviewers are noted in the review tindings. The review process included the following major activities:

• Completely examine the IPEEE and related documents

• Develop a preliminary TER and RAls

• Examine responses to the RAls

=

Finalize this TER and its tindings Because these activities were performed in the context of a submittal-only review, ERI did not perform a site visit or an audit of either plant configuration or detailed supporting IPEEE analyses and data.

Consequently, it is important to note that the ERI review team did not verify whether or not the data presented in the IPEEE matches the actual conditions at the plant, and whether or not the programs or procedures described by the licensee are indeed implemented at Catawba Nuclear Station.

1.3.1 Seismie In conducting the seismic review, ERI generally followed the emphasis and guidelines described in the repon, Indiddual Plant Examination of External Events: Review Guidance [12l, for review of a seismie PRA, and the guidance provided in the NRC report, /PEEE Step 1 Review Guidance Document [13]. In addition, on the basis of the Catawba IPEEE submittal, ERI completed data entry tables developed in the Lawrence Livermore National Laboratory (LLNL) document entitled "/PEEE Database Data Entry Sheet Package" [14].

In its Catawba seismic review, ERI examined the following documents:

+

the Catawba IPEEE [1]

• the licensee's responses to RAls [15]

Energy Research, Inc. 4 ERl/NRC 95-506 I

The checklist of items identitled in Reference [12] was generally consulted in conducting the seismic review. Some of the primary considerations in the seismic review have included (among others) the following items:

Were appropriate walkdown procedures implemented, and was the walkdown effort sufficient to accomplish the objectives of the seismic IPEEE?

Was the plant logic analysis performed in a manner consistent with state-of-the-art practices?

Were random and human failures properly included in such analysis?

Were component demands assessed in an appropriate manner, using valid seismic motion input and structural response modeling?

Were fragility calculations performed for a meaningful set of components, and are the fragility results reasonable?

Was the approach to seismic risk quantification appropriate, and are the results meaningful?

Does the submittal's discussion of qualitative assessments (e.g., containment performance analysis, seismic-tire evaluation) reflect reasonable engineering judgment, and have all relevant concerns been addressed?

Has the seismic IPEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have a!! seismic risk outliers been addressed?

In some instances, quick calculations have been performed as part of the seismic review, in order to check the implications of various intermediate and final results.

1.3.2 Fire During this technical evaluation, ERI reviewed the tire-events portic; of the IPEEE for completeness and consistency with past experience. The tire analysis of References i1,6 and 15], as Lpplemented by Reference [11], was reviewed for methodological completeness, auuracy and consistency with past experience. In addition, Sections 6 and A.13 of References [4J, and Refemnee [10J, were briefly reviewed for background. The guidance provided in References [12,13] was used to formulate the review process and the organization of this document. The data entry sheets used in Section 5 are taken from Reference

[14].

The process implemented for ERl's review of the fire IPEEE included an examination of the licensee's methodology, data, and results. ERI reviewed the methodology for consistency with currently accepted and state-of-the-art methods, paying special attention to the screening methodology to ensure that no tire scenarios were prematurely eliminated, and to the assumptions used, bsause the results of many studies are unduly influenced by assumptions made to simplify or introduce conservatism. Other methodology elements include, for example, development of fire event trees, tire propagation, suppression and detection, and systems modeling. Data elements include such items as cable routing, tire area partitioning, fire initiation frequency, detection and non-suppression frequencies, and recovery probabilities. Results Energy Research, Inc. 5 ERI/NRC 95-506

include such items as minimal cut sets, core damage frequency and fractional contribution of cut sets, identification ef important fire areas and scenarios, and effect of fire on early containment failure.

For a few fire zones / areas that were deemed importaat, ERI also verified the logical development of the screening justifications / arguments (especially in the case of fire-zone screening) and the computations for fire occurrence frequencies.

1.3.3 HFO Events The review process for HFO events closely followed the guidance provided in the report entitled IPEEE Step 1 Retiew Guidance Document [13]. This process involved examinations of the methodology, the data used, and the results and conclusions derived in the submittal. The IPEEE methodology was reviewed for consistency with currently accepted practices and NRC recommended procedures. Special attention was focused on evaluating the adequacy of data used to estimate the frequency of HFO events, and on confirming that any analysis of Standard Review Plan (SRP) conformance was appropriately executed.

In addition, the validity of the licensee's conclusions, in consideration of the results reported in the IPEEE submittal, was assessed. Also, in some instances, computations of frequencies of occurrence of hazards, fragility valu6a, and failure probabilities were spot checked. Review team experieace was relied upon to assess the reasonableness of the licensee's evaluation.

)

Energy Research, Inc. 6 ERl/NRC 95-506

I l

l

! 2 CONTRACTOR REVIEW FINDINGS

2.1 Seismic l

A summary of the licensee's seis nic IPEEE process has been described in Section 1.2. Here, the licensee's seismic evaluation is examined in detail, and discussion is provided regarding significant observations encountered in the present review.

i l 2.1.1 Overview and Relevance of the Seismic IPEEE Process Catawba is assigned, in NUREG-1407, to the focused-scope seismic review category. The review level earthquake (RLE) is described by the NUREG/CR-0098 [16] median spectral shape anchored to a PGA value of 0.3g. DPC elected to update an existing seismic PRA study in performing the seismic IPEEE for Catawba.

The licensee's overall seismic IPEEE process (update of an existing PRA with NUREG-1407 recommended enhancements) is relevant to assessing the resistance of Catawba to potential seismically initiated severe accidents. The submittal provided a clear and generally adequate explanation of plant severe accident functions in response to seismic events. Only minimal details of plant contiguration were described in the IPEEE submittal report. Although the submittal stated that the current plant contiguration is represented in the analysis, and the submittal describes the walkdown process that was used, there was insufficient detail presented in the submittal to permit an independent assessment as to whether or not the actual plant configuration has been represented in the IPEEE. This review has noted that the standby shutdown facility (SSF), which is an independent means of securing safe shutdown if the normal plant safety systems are unavailable, does not app:ar to be reflected in the seismic PRA assessment.

Overall, the approach taken by the licensee for conducting the seismie IPEEE of Catawba is relevant to the evaluation of seismic severe accident resistance, and is consistent with the approach requested in NUREG-1407 for an update of an existing seismic PRA.

2.1.2 Logic Models A single accident sequence event tree is presented in the Catawba IPEEE submittal (Figure 3-2 of the IPEEE submittal). The event tree is clearly diagramed and explained, and appears to be valid. Section 3.1.5 of the IPEEE submittal provides the explanation of each of the top events from the event tree, and identities and describes each of the functional event sequences (core damage sequences) which result from j the event tree. The seismic fault tree models are provided in Appendix A to the IPEEE submittal, and are j clearly diagramed.  !

l The seismic logic models in the IPEEE submittal are believed to be capable of providing a realistic depiction of seismic risks for the Catawba plant.

l 2.1.3 Non-Seismie Failures and Human Actions l

Non-seismic failures were included in the seismic PRA based on failures identified in the Catawba IPE (internal events) analysis. A specific seismic event tree was developed for the IPEEE analysis. The tree is similar to the internal events trees, and has the same functional top events.

Energy Research, Inc. 7 ERI/NRC 95-506 l i l l

l I

The licensee's assessment of accident sequence frequencies is clear, apparer.tly accurate, and well-executed. The description of how the accident sequence frequencies were calculated is generally complete and well-documented (Section 3.1.5 of the IPEEE submittal). However, even ttmugh recovery actions (human actions) are incorporated into the fault trees, no details are provided regarding the assignment of recovery probabilities. " ere is no indication that the human error probabilities considered the influence of seismic events on human performance.

The treatment of non-seismic failures is judged to be satisfactory with respect to NUREG-1407 guidelines.

Although human actions were included in the model, no details are provided to justify the assignment of recov:ry probabilities.

2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape)

The base-case seismic PRA employed the seismic hazard estimates from the EPRI seismi: hazard program.

Alternative seismic hazard estimates prepared by LI.NL for the NRC staff were used in a sensitivity analysis.

Newmark response spectra were used for characterizing ground motion input. Artificial time history records whose response spectra essentially envelop the smoothed ground re'spanse spectra were created for use in devebping the in-structure tioor response spectra. For walkdown-related evaluations, an 84th percentile site-specific spectrum developed for the Sequoyah plant, and scaled to 0.3g PGA, was used.

The spectrum is stated to be similar to the NUREGICR-0098 spectrum identified in NUREG-1407.

The seismic ground-motion hazard used in the Catawba IPEEE is consistent with NUREG-1407 guidance.

The seismic input spectrum is stated to be similar to NUREG/CR-0098, which is mentioned in the NUREG-1407 guidance.

2.1.5 Structural Responses and Component Demands New in-stmeture response spectra were developed for the auxiliary building. For other structures, seismic demands were estimated by scaling the SSE demand estimates upward to account for the increase of the review-level ground response spectrum over the SSE ground response spectrum.

The development of structural respon3es and component demands in the Catawba seismic IPEEE appears consistent with NUREG-1407 guidelines.

2.1.6 Screening Criteria Structural and component fragility screening criteria for the Catawba IPEEE were based on seismic margin methods documented in EPRI NP-6041 [17]. Structures with a median fragility greater than 2.5g, and components with a median fragility greater than 2.0g, were screened out of the seismic model.

The screening criteria used in the Catawba seismic IPEEE are consistent with NUREG-1407 guidance.

Energy Research, Inc. 8 ERI/NRC 95-506

2.1.7 Plant Walkdown Process Several walkdowns were conducted in support of the seismic PRA analysis, including walkdowns conducted for the original seismic PRA as well as for the IPEEE analysis. Detailed seismic walkdowns were conducted for Unit 2 and common items, as part of the trial plant application of the EPRI SMA conducted in 1986. Subsequently, IPEEE-related walkdowns were performed in 1993 and 1994. These walkdowns were conducted puremt to EPRI NP-6041 guidelines. More extensive walkdowns were performed of Unit 1, since Unit 2 had been extensively walked down in connection with the 1986 seismic margin analysis.

General area reviews were conducted to evaluate bulk distribution systems. Walkdowns were also conducted in both containments, including both accident prevention and mitigation systems. More extensive walkdowns were performed outside containment in the auxiliary building, the diesel generator building, the main steam and feedwater isolation compartments (" doghouses"), and the nuclear service water pump structure. These walkdowns were performed to confirm the validity of earlier walkdown findings, to review equipment with respect to lessons learned from seismic experience, to verify anchorage, and to identify potential spatial interactions. The walkdowns also considered the potential for seismically induced fires and flooding, and searched for low ruggedness relays.

The walkdown process for Catawba conformed to EPRI SMA guidance, which is consistent with NUREG-1407 recommendations. The process is judged to have been capable of identifying outliers with respect to anchorage, interaction, construction adequacy, and function.

2.1.8 Fragility Analysis Fragilit'; curves were developed for key components and structures at Catawba. These curves were used to determine the conditional probability of failure of the components and structures, as a function of ground acceleration (PGA). Structural Meehanies Associates developed the structural and equipment fragilities used in the original PRA fragility analysis. Most estimates of median safety factors, variability, and conditional frequencies of failure were based on existing analyses and engineering judgment and assumptions. Seismic qualification analysis reports, seismic qualitication test reports, past earthquake experience, and design specifications were also used as a basis for estimating fragilities.

The fragility analysis for Catawba is judged to be sound. It conforms to conventional seismic PRA fragility analysis practice employed in several seismic PRAs.

2.1.9 Accident Frequency Estimates Seismic accident frequency estimates were obtained by combining the fragility curves, using a Boolean expression based on the seismic even. tree, and convolving this failure probability with the site hazard curve. The seismic model of the plant was updated # rom an earlier study to retleet changes to the plant, updated fragility estimates, and improved fault tree lo};in Accident frequencies were calculated using the CAFTA and SEISM codes, both of which have been trequently used for this purpose in other studies.

l 1

I The approach used to obtaining accident frequency estimates appears sound, and is consistent with j NUREG-1407 guidance. j Energy Research, Inc. 9 ERI/NRC 95-506

2.1.10 Evaluation of Dominant Risk Contributors

a. Dominant Contributors to Core Damage The dominant sequences, their ceribution to seismic CDF, and their core damage timings are provided in Table 2.1 for sequences with frequencies above 104 per year.

Table 2.1 Summary Information on Dominant Core Damage Contributors Functional Sequence Percentage Estimated Time To Sequence Frequency Contribution (%) Core Damage (hr)

CQsU l .28 x 104/ry 80.8 17.0 4

CBP 2.48 x 10 /ry 15.7 2.5 CBU 3.47 x 10 /ry 2.2 2.0 LL 1.60 x 10 /ry 1.0 0.5 Functional sequence CQsU is an RCP seal failure with failure of high pressure injection: CBP is a loss of secondary side heat removal and failure of bleed and feed; CBU is a loss of secondary side heat removal and failure of high pressure injection; and LL is a large break LOCA with failure of low pressure injection.

As a general matter, however, the IPEEE submittal indicated that the seismic CDF is dominated by seismically initiated loss of offsite power (LOSP) in conjunction with seismically initiated faiiures of the diesel generators and their support systems, and by seismic LOSP in conjenetion with seismically initiated failure of other components and structures of the AC power systems. Seismic LOSPs followed by random (non-seismic) failures of the diesels and their support systems are less significant contributors to seismic CDF. This finding has been confirmed by inspection of the dominant cutsets and the seismic fault trees.

No "high-confidence of low-probability of failure (HCLPF)" results were explicitly reported (reporting of HCLPF results is identified in NUREG-1407 ss being " optional"). However, as stated in the IPEEE submittal, such values may be readily obtained from fragility parameters, according to the following standard equation: HCLPF = exp[-1.65 ( S" + 8" )l.

It should be acted that the Unit-2 seismic margin study published in 1989 concluded that all s.ructures and essential components and distribution systems (piping, cable raceways, electrical conduit, and heating, ventilation and air conditioning [HVAC) ducting), with the exception of certain relays, had HCLPF capacities above 0.30g PGA (5].

h. Dominant Contributors to Radioactive Release Given Core Damage No mapping of core damage results to plant damage states was reported in the submittal. Thus, the seismic IPEEE does not specifically list contributors to radioactive release given seismically initiated core damage scenarios.

Energy Research, Inc. 10 ERI/NRC 95-506

c. Resiew Findings The Catawba seismic IPEEE appears to produce valid insights with respect to the CDF result and accident sequence frequencies. The seismic IPEEE does not detail the mapping of the accident sequences into the containment event tree, thus there is no way to evaluate this portion of the analysis.

2.1.11 Relay Chatter Evaluation The relay chatter review was developed to be consistent with the recommendations for a focused-scope plant, as described in NUREG-1407. The focused-scope evaluation is limited to a review of low ruggedness relays (" bad actors") as documented in EPRI NP-7148-SL (18]. One bad actor relay was found in a circuit involving maintenance and testing activities. The relay is removed from the circuit when the diesel generator receives an emergency start signal, thus no further IPEEE evaluation was considered to be necessary.

The licensee's evaluation of relay chatter for Catawba is consistent with NUREG-1407 guidelines for a facused-scope plant.

2.1.12 Soil Failure Analysis All major Category-1 structures at Catawba are founded on competent rock or concrete fill extending to rock. The Unit-2 refueling water storage tank (RWST) and the associated containment wall are founded on partially weathered rock. These structures were conservatively designed to account for these conditions. Soil issues were considered in detail during the walkdowns.

Soil liquefaction was reviewed and determined not to be an issue for Catawba. There are also no structures where slope stability could be a concern for Category-1 structures, except for the nuclear service water pond dam. This structure was evaluated using seismic margin methods and found to be acceptable (including consideration of slope stability and soil liquefaction).

J The treatment of soil failures in the Catawba seismic IPEEE is judged to satisfy the guidelines in NUREG-1407 for a focused-scope plant.

2.1.13 Containment Performance Analysis Median fragilities for the reactor building and containment internal structures were found to be less than the stmetural screening value of 2.5g, thus these structures were included explicitly in the seismic IPEEE analysis. Containment isolation assessment considered both the seismic ruggedness of the containment ,

penetrations (and their associated piping, valves, and isolation signals) as well as relay chatter. None of l the Catawba containment isolation relays are " bad actors." 1 The licensee concluded that external events had no significant unique impacts on the containment l performance model. The licensee stated that the containment air return fans and the spray system were  !

seismically rugged, and that the hydrogen mitigation system, the containment ice baskets, and the doors i to the ice condenser were reviewed during plant walkdowns.

Energy Research Inc. 1I ERl/NRC 95-506 L j

Contrary to the IPEEE submittal, however, this review has found that unavailability of the hydrogen ignition systeen during seismically initiated severe accidents may be an important issue for Catawba. If failure of the hydrogen ignition system impairs containment performance during station blackout sequences and sequences involving failure of the AC panel boards which power the igniters, such scenarios could be important contributors to radioactive release given core damage in seismically initiated sequences.

J The containment performance assessment in the Catawba IPEEE appears to satisfy the relevant NUREG-1407 guidelines. However, the assessment failed to note the susceptibility of the hydrogen mitigation system to seismically related failures. This susceptibility could be an important contributor to radioactive release for seismic events.

i 2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations 4

Sandia fire risk scoping study issues, including seismic-tire interactions, were treated via the walkdown.

Additional details and review tindings are provided in the fire evaluation in Section 2.2.12 of this report.

The submittal does not discuss the potential and effects of seismically induced floods, other than with respect to seismic inadvertent actuation of fire suppression systems.

I 2.1.15 Treatment of USl A-45 The licensee stated in the IPEEE submittal (Section 3.2) that the decay heat removal capability of Catawba was addressed in Section 3.4.4 of the IPE report [6]. The licensee further states: "The calculated annual core melt frequency due to failure of decay heat removal systems for external initiators did not change significantly as a result of the IPEEE analysis. Therefore, this issue should be considered resolved for Catawba. "

The licensee provided detailed results for this issue which demonstrate that seismically initiated loss of offsite power is by far the dominant contributor to seismically initiated CDF. Other failures contributing more than 5% to seismically initiated CDF included switchgear and motor control center failures, failures of the upper surge tank and condensate storage tank, and failure of the diesel generator control panel.

These contributors are all in support systems, except tor the tank failures. These failures are responsible for a small contribution to CDF (on the order of 2.2 x 104/ry). This tinding supports the licensee's conclusion.

The licensee has thus provided a meaningful evaluation of the seismic performance of the Catawba plant with respect to decay heat removal issues.

2.1.16 Treatment of GI-131 The in-core flux mapping system in Westinghouse PWRs has movable tission chambers which are mounted at the end of long drive cables and travel in long tubes called " thimbles" which run from a location outside the biological shield, enter the reactor at the bottom of the vessel, lead up through the core, and terminate near the top of the fuel. The thimbles (which are sealed at the reactor end and are dry inside) are guide tubes for the detectors, which are inserted into the core only when a flux map is being taken.

The thimbles are also retractable, traveling within larger tubes called " conduits", which are wet inside and sealed to the reactor vessel bottom at one end, thus making them extensions of the reactor coolant pressure boundary.

Energy Research, Inc. 12 ERl/NRC 95-506

In the event of seal table break, the reactor coolant pressure decays very slowl:., :md if the leak reater than the high pressure injection capability, the core may uncover. Moreover, the low pressuu meetion pumps which would normally be able to mitigate such a leak may not be able to inject until after the entire core liquid inventory is lost. By this time, the core could be severely damaged. A potential severe accident sequence has been identined by the NRC which involves a seismic event sufficiently sevsre that the transfer mechanism falls on the seal table, causing failure of a sufficient number of seals such that the leak rate exceeds the capacity of tne Sigh pressure injection system. The core then uncovers and melts with the vessel still at high pressure. For a generic configuration with average seismic activity, the NRC estimates the frequency of this scenario at 6.42 x 10' per year [19]. It should be noted that this calculation was for the "Surry class of plants" which have less mitigation capacity than the "Sequoyah class of plants" (such as Catawba). Accordingly, this CDF calculation may be pessimistic for Catawba.

The Catawba IPEEE submittal discusses GI-131 by stating that this issue was addressed by addition of restraints during construction, and that the restraints are adequate to prevent seismic interaction and breach of the pressure boundary. The licensee thus considers GI-131 to be closed for Catawba.

The licensee's submittal appears to provide an appropriate basis for resolving GI-131. However, the approach has not address beyond-design basis events, and sequences involving seismically induced failure of the fluz mapping system were not included in the PRA.

2.1.17 Other Safety issues

a. USl A-46, USI A-17, and USI A-40 Resolution There was no evaluation of USI A-40 or USI A-46 in the IPEEE submittal. Concerning USI A-17, the submittal states that the seismic review considered spatial interactions due to seismic events, including evaluation during walkdowns. A few minor items were identitied and modified as appropriate. No significant seismic interaction concerns were identified. USI A-17 was considered by the licensee to be closed based on these efforts.

b. Eastern U.S. Seismicity issue The licensee considers the Eastern U.S. seismicity issue to have been resolved by use of the EPRI mean seismic hazard curve, and by a sensitivity study using the alternative LLNL hazard curve.

l

c. Resiew Findings l l;

The submittal provides sufficient information upon which to conclude that USI A-17 may be considered {

resolved for seismic events. The Eastern U.S. seismicity issue is similarly considered to be resolved. l 2.1.18 Process to Identify, Eliminate or Reduce Vulnerabilities J

l As the licensee identitied no seismic severe-accident vulnerabilities in the IPEEE submittal, the submittal J contains no discussion of plant improvements, other than stating that the examination of external events did not result in the identification of any major < ions or modifications which could potentially reduce the overall CDF (Section 2.2 of the IPEEE submittal).

Energy Research, Inc. 13 ERl/NRC 95-506

)

The NRC staff's review of the Catawba IPE study identified internal flooding in the turbine building as a significant contributor to CDF due to the location of all 6.9 and 4.16 kV transformers at elevation 554' of the turbine building basement. (The 1992 Catawba IPE report clarities that the flooding of concern arises from a large leak in the condenser circulating water system: see Section 3.3.7.3. The 1992 IPE also indicates that both units would lose power to the 4.16 kV essential buses; see Section 8.1.3. Thus, such a scenario could involve a concurrent, dual-unit, station blackout event.) The original PRA fragility development for Catawba estimated a median PGA capacity of 0.40g for the condenser hotwell, with uncertainty parameters of Ba=0.40 and %=0.52. Subsequent reviews of the original PRA concluded that this assignment was "probably conservative."

More importantly, offsite power has a lower estimated fragility. After a loss of offsite power due to an earthquake, the diesel generators will supply AC power to the emergency buses. The power path for the diesel generators does not include the turbine building basement transformers, hence, the scenario postulated above does not represent a concern from a seismic standpoint. This issue is thus considered to be resolved.

No vulnerabilities affecting accident prevention were identified by the licensee. Even though no vulnerabilities affecting containment performance were identified, it was found during this review that the reactor building and containment internal structures' median fragilities were less than the structural screening value of 2.5g PGA, thus they were included as part of the seismic analysis. Indeed, both the structura' failure of the reactor building (Event CEQ0082DEX) and the structural failure of containment internals (Event CEQ0080DEX) appear in the list of dominant usets. This would appear to contradict the licensee's statement in Section 3.1.6 that external events " vere judged to have no significant impact on the containment performance model," in that the initiating event for some accidents also results in containment failure it the outset of the accident (assuming, as would be consistent with earlier industry PRA studies, that both failure of the reactor building and failure of containment internal structures result in containment failure due, at the least, to substantial leakage).

The IPEEE seismic analysts reported that the containment air return fans and containment spray l components "are seismically rugged and are not a concern." The analysis also reported that the hydrogen mitigation system (igniters) and ice baskets and doors were reviewed during the plant walkdowns. In addition, the IPEEE submittal states that a screening analysis was performed of containment penetrations and their associated rWing, valves, and isolation signals. The piping and valves were found to have median fragilities ab PGA and were rereened from the analysis. The upper and lower containment hatch intlatable doe m and latches were reviewed during the pbat walkdowns (Section 3.1.6 of the j IPEEE submittal). N- pecitic results were reponed for these reviews, although the licensee indicated that components related to entainment performance both inside and outside containment were included in the walkdown. Containment performance items included in the vukdown included both items on the containment performance list as well as passive components not specifically included on the list. In some instances, components not accessible to close inspection were evaluated based on a review on drawings.

The IPEEE submittal also discusses containment isohtion signals. These signals are generated by the solid state protection system (SSPS) to the emergency safeguards features actuation system (ESFAS). The cabinets housing this equipment were evaluated for functional response to seismic events and have median fragilities of 1.30g. The panel boards and motor control centers (MCCs) that provide power to actuate the valve solenoids arJ motors were also analyzed and have estimated median fragilities of 1.0lg and 0.53g, res,ectively. This equipment was also evaluated in the walkdowns. The licensee stated that, since Energy Research, Ine. 14 ERI/NRC 95-506

l none of the relays which could compromise isolation were considered to be " bad actor" relays unde tPRI NP-7148-SL guidance, the effects of relay chatter were not considered in connection with the conteinment isciation function. Although Table 3-1 does not include a fragility assessment of the ESFAS cabinet, the licensee reported that the ESFAS logic, which causes containment isolation, is located in the SSPS cabeet; therefore, the ESFAS failure is represented via SSPS failure.

It is noted that failure of the SSPS due to unrecovered chatter (Event CEQ0054DEX

• CEQ0001DHE) and due to structural failure (CEQOO68DEX) appear among the dominant cutsets for the Catawba seismic IPEEE analysis (see submittal Table 3-4). This would appear to raise the possibility that, for these sequences, containment isolation would not occur. This result would appear to contradict the licensee's conclusion regarding containment isolation (Section 1.4.2 of the IPEEE submittal), which suggests that containment isolation failure is not a concern for seismic sequences. This issue could not be resolved during the course of the present review.

A final matter concerns the performance of the hydrogen mitigation system (igniters). According to Section 5 of the NRC's review of the Catawba IPE [20), the two trains of igniters are powered from 120 VAC panel boards which receive power from the on-site emergency power system. The igniters are apparently manually actuated from the control room by the operators in accordance with the emergency operating procedures (EOPs). Thus, it would appear that the igniters will be unavailable for station blackout sequences and for scenarios where the panel boards fail as a result of seismic loads. The review of the Catawba IPEEE submittal makes it clear that such scenarios are responsible for a large fraction of the seismic CDF (indeal, station blackout alone accounts for 70% of the seismic CDF). It is recognized from the NUREG-1150 analysis of the Sequoyah Nuclear Station (like Catawba, a large Westinghouse PWR with an ice condenser containment) that performance of the igniters in a severe accident sequence is very important. The NUREG-1150 summary report (Section 5.3.2) stated in this regard [21]:

"The Sequoyah hydrogen ignition system will significantly reduce the threat to containment from uncontrolled hydrogen combustion effects except for station blackout sequences. However, when power is recovered following a station blackout, if the igniters are turned on before the air-return fans have diluted the hydrogen concentration at or above the ice beds, the ignition could trigger a detonation or deflagration that could fail containment. These blackout sequences, however, represent a small fraction of the overall frequency of core damage."

This issue (unavailability of the igniters) has also been identified in the NRC's review of the Catawba IPE

[20]. Thus, r:cer than there having "no significant impact" on the containment from external events, as concluded by the licensee (iPEEE sub:nittal, Section 3.1.6), it would appear that the impact could be very substantial insofar as unavailability of the hydrogen ignition system is concerned. Indeed, the seismically related unavailability oDhe hydrogen ignition system could lead to early containment failure. j Overall, the licensee's process for identifying vulnerabilities cannot be considered to have been entirely successful due to the failure af the IPEEE submittal to identify a number of potentially important issues.

Some plant improvements were identified in the submittal to resolve minor spatial interactions concerns.

Energy Research, Inc. 15 ERl/NRC 95-506

2.1.19 Peer Review Process Both the original PRA study on which the IPEEE was based, and the IPEEE submittal itself, received several levels of internal review. These reviews included peer review (within the project team) of major analytical tasks. The project manager and engineering supervisor also reviewed both the analysis and its internal peer review.

Following these internal reviews, engineering personnel outside the PRA project team conducted a review of system models, underlying assumptions, system-level results, and overall results. In parallel with this review, selected station personnel also reviewed the analysis to assess the reasonableness of underlying assumptions for system operation and operator actions. Management brietmgs were also given to appraise key management personnel of the results and conclusions of the IPEEE analysis. Finally, an independent review team, consisting of senior level employees with experience in PRA methodology, seismic equipment qualification, and systems engineering, performed a review of the IPEEE process and results.

The review process for the Catawba seismie IPEEE is thus consistent with NUREG-1407 guidelines.

2.2 Hm A summary of the licensee's fire IPEEE process has been described in Section 1.2. Here, the licensee's fire evaluation is described in detail, and discussion is provided regarding significant observations encountered in the present review.

2.2.1 Overview and Relevance of the Fire IPEEE Process

a. Methodology Selected For the Fire IPEEE The Catawba fire IPEEE [1] is an update of the full-scope, Level-3 PRA performed between 1984 and 1987. The analysis identified critical fire areas, identified possible initiating events, calculated the fire initiation frequency, analyzed for the impairment of critical safety functions, and developed core damage cutsets (and quantified their frequencies) using a functional transient event tree and associated fault trees.

A special tire event tree was used to help screen out areas, and assess fire damage and the frequency of fire damage. This tire event tree allowed multiple attempts at suppression, without regard to the opposing timing of damage propagation. A screening process was employed in which tire scenarios were not quantified if a similar IPE scenario had a larger estimated frequency of occurrence. The licensee's original IPEEE study [1] was supplemented by two additional analyses [11]. The first additional analysis (termed

expanded base case) expanded the scope of quantified sequences by including those tire scenarios that were screened out of the original study. The second additional analysis (termed sensitivity case) limited the number of suppression attempts to one, and assumed a fire encompasses the entire room, given failure of suppression.

b. Key Assumptions Usedin Performing the Fire JPEEE

1. It was assumed that the effect of control room tires and cable room fires are identical, and have the same effect on the plant as tires in the component cooling water "short room," namely. loss of component cooling water. In addition, it was assumed that the initiating event frequencies for Energy Research, Inc. 16 ERI/NRC 95-506

the cable room and component cooling water short room are identical, and the fire suppression, detection and propagation frequencies for these rooms are nearly the same.

2. It was assumed that parameters of NUREG/CR-0645 are applicable to the fire Catawba PRA, even though the Catawba event tree significantly differs from the NUREG/CR-0645 sequence of events.

3. Multiple opportunities for suppression, without knowledge of the relative timing of suppression and damage propagation, were assumed in the base-ease tire IPEEE model.

4. It was assumed that damage from fire suppression systems and smoke are insignificant when compared to damage owing to heat from fires, and, therefore, these aspects of fire damage were not included in the analysis.

c. Status of Appendix R Modijcations The submittr.1 indicates that Catawba is in compliance with Appendix R.

d. New or Existing PRA As stated above, the Catawba tire IPEEE is an update of the full-scope, Level-3 PRA performed between 1984 and 1987.

2.2.2 Review of Plant Information and Walkdown

a. Walkdown Team Composition The walkdown team was composed of two fire protection engineers, a PRA analyst, and a program manager, all from DPC. Peer review of the walkdown was performed by a fire protection engineer from McGuire Nuclear Station.

b. Signijcant Walkdown Findings The wa!kdown was performed to verify assumptions about plant configuration used in the PRA, and to address the Sandia fire risk scoping study issues. The most significant walkdown finding was the discovery that cables for the train A and train B component cooling water pumps pass within 3 Net of each other, with no intervening fire barrier, in a "short room" at elevation 568L in addition, Unit-1 pump cables are not protected by automatic water sprinklers at this location. The walkdown findings led to the update of the Catawba fire PRA, as documented in Revision 2 of Section 3.5 of the Catawba IPEEE [1].

The walkdown effort and documentation appeared to be quite thorough.

c. Significant Plant Features As stated by the licensee during alune 4,1996 meeting at the NRC, there are no rooms with niechanical .

equipment that also contait electrical cabinets, panels, or MCCs. This unusual contiguration is perhaps the most significant plant feature with respect to the tire IPEEE because it would tend to validate the licensee's approach of treating a single piece of mechanical equipment as the sole tire ignition source in

]

a room. Other significant plant features relative to the tire analysis are the standby shutdown system.

Energy Research, Inc. 17 ERl/NRC 95-506

_. )

)

I Appendix R separation between redundant trains, ability to cross-connect offsite power between units, and

{

the ability to cross-connect nuclear service water between units, with only one nuclear service water train required to supply the water needs of both units. Instrument air is also shared between the two units.

The Catawba and McGuire Nuclear Generating Stations are similar plants, as is the methodology Duke Power used to analyze fires at these stations. Interestingly, the results of the base-ease fire studies for these plants are significantly different, whereas the licensee noted that the results of the sensitivity-case studies are similar.

2.2.3 Fire-Induced Initiating Events

a. Were Initiating Events Other than Reactor Trip Considered?

The following initiating events were considered: plant trip, loss of offsite power, loss of main feedwater, loss of nuclear service water, loss of component cooling, loss of control area ventilation, loss of 4160 V essential power, loss of auxiliary shutdown panel, loss of vital instrumentation and control power (125 VDC and 120 VAC), loss ofinstrument air, and LOCA. Typically, only one initiating event was selected to represent any individual area.

b. Were the Initiating Events Analyzed Properly?

The fire areas were walked down to determine if an area could cause one or more initiating events.

Questionnaires were filled out for each area. The licensee performed a review of both vital and non-vital cabling to determine if a plant trip (initiating event) was plausible for each room. However, plant operators were not consulted about how the plant and the operating crew would react to tires.

2.2.4 Screening of Fire Zones

a. Was a Proper Screening Methodology Employed?

The original submittal [1] documented a screening analysis in which rooms were screened on the basis of an laitiating event criterion and two frequency criteria. First, fire areas were reviewed to determine if an area could cause one or more initiating events. The areas that would not cause an initiating event were screened out. The surviving areas were assigned a " worst case result" initiating event. Second, each crea was screened based on: (1) whether or not the probability of damage for scenarios of the worst case initiating event was less than 10*/yr; and (2) whether or not the fire damage probability was less than the frequency of the same or similar equipment damage scenario for internal events. A subsequent submittal

[11], which the licensee termed the " expanded base case," removed the last screening criterion and quantified fire scenarios even though the tire damage probability was less than the frequency of a same or similar internal events scenario.

The screening was performed using a Gallucci style fire event tree. The parameters of the event tree were based on NUREG/CR-0654, judgmentally adjusted for each area. NUREG/CR-0654 was published in 1979 to provide a reasonably simple, yet technically comprehensive, approach to aid designers and regulators of fire protection systems. It recommended three approaches: a deterministic approach, a probabilistic approach, and a qualitative approach. The recommended probabilistic approach was called a critical-path technique, and was developed in 1976. A critical path diagram shows alternative paths of Energy Research, Inc. 18 ERl/NRC 95-506

1 fire ignition, growth, discovery or detection, and suppression or self-extinguishment. Multiple opportunities for suppression and detection are allowed in a path. The events in the diagram are associated with judgmentally (and statistically, when data existed) determined numbers between zero and one, provided in Table 4 of Reference [10], which are called probabilities. The table also provided qualitative criteria to guide the selection of the probabilities. The authors of NUREG/CR-0654 have pointed out that the conservatism of the method depends on the conservatism of the probabilities selected.

The probabilities used by the licensee, as discussed in Section 2.2:9 below, tend to overestimate the probability of suppression, in comparison with accepted data, thereby underestimating the fire risk.

Furthermore, the event tree providad in the submittal is only an approximation to the more detailed and explicit critical path diagram in Reference [10J. Reference (10] states: " it is necessary to visualize events at particular stages of fire development so that a valid estimate of the probability of success or failure could be made." The critical path diagram included parameters such as area of potential air-intake openings, fuel continuity, fuel availability, and penetration of barriers, all of which do not appear as part of the licensee's fire event tree. Therefore, the use of these probabilities in the licensee's simplitled event tree may not be valid.

An additional screening criterion was used for a few other rooms. For example, the study v. sed the argument oflow combustible loading to screen out the " dog houses" that house components whose failure could cause reactor trip. such as main steam isolation valves (MSIW) and feedwater isolation valves.

Selecting a " worst case result" scenario for a room is valid if the fiequency of all potential core damage scenarios for the room is accounted for. In tf e licensee's approach, only the frequency of the selected tire scenario was quantitled. Alternative scenarios from other fire sources in an area were deemed to be insignificant. Therefore, screening out the selected scenario was equivalent to screening out the entire area. In support of this approach, as noted in Section 2.2.3e above, the licensee stated that electrical cabinets do not appear in the same rooms as mechanical equipment.

Except for 4160 V switchgear, reactor trip switchgear, and the auxiliary shutdown panel in the auxiliary feedwater area, cabinet-initiated tires were not included in the Catawba fire IPEEE analysis. The licensee's rationale for this approach was that cabinet tires are less likely to damage the component of interest in a room (e.g., diesel generator or component cooling water pump) than a tire initiated at the component itself. Here again, the licensee's statement about the non-coincidence of motor control centers and mechanical equipment is significant to the validation of the approach.

LOCAs, other than those induced by transients, appear to have been screened out. It is argued that tire-induced opening of power-operated relief valves (PORVs) is not a concern because power could be removed from them. However, the potential ability to remove power during a tire does not equate to a certainty that the event will occur. This is particularly the case for a control room tire that results in abandonment of the control room. In such a case, an important consideration is the ability to identify a failed-open PORV before the control room is abandoned.

Residual heat removal (RHR) isolation valves, which (if open) can allow an interfacing LOCA, are either located such that redundant trains are not susceptible to the same tire, or have power removed during Mode 1.

Energy Research, Inc. 19 ERI/NRC 95-506

Interestingly, the frequency oflosing both trains of component cooling at Catawba was estimated as being less than the corresponding frequency for McGuire, even though a specific location of occurrence of close approach of cables for redundant trains has been identified for Catawba, but not for McGuire,

b. Have the Cable Spreading Room and the Control Room Been Screened Out?

The cable spreading and control rooms were not screened out.

c. Were There Any Fire Z'ones/ Areas That Have Been improperly Screened Out?

The expanded base case had no significant zones or areas that were improperly screened out.

2.2.5 Fire Hazard Analysis The development of initiating event fire frequencies by analysis of industry-wide data is laudable for a site that had little or no operational experience in 1984. However, this database was not updated for the 1988 through 1991 study, and piant-specific data was not used. A comparison of the initiating events used in this study with the Reference [22] database shows that the cable area, control room, and switchgear room frequencies used in the Catawba study are a factor of 2 to 3 lower than those recommended in the Fire Induced Vulnerability Evaluation (FIVE) document. The Reference [22] frequencies are based on about 5 times as many tires, and more than double the number of reactor years, than the data used for the Catawba study. It is not surprising, therefore, that the fire initiation frequencies differ.

The equation used to estimate component tire frequencies not specifically included in the database multiplied a surrogate component frequency by the ratio of operating times of component to surrogate component. This approach has the obvious potential to underestimate frequency because it ignores the potential for the development of latent leaks which reveal themselves upon component startup.

2.2.6 Fire Growth and Propagation

a. Treatment of Cross-Zone Fire Spread and tssociated Major Assumptions The study induded a barrier penetration prc'

..ty of 0.01 for three-hour barriers and tive-hour barriers with doors. These numbers appear t- ae reasonable as overall average values. However, barrier penetration was allowed in the analysis only if the tire is at Stage 3 (fully engulting the area). The potential for a tire to partially engulf an area (say, Stage 2) and cause damage owing to hot gas spread through an open door or damper was not considered.

b. Assumptions Associated with Detection and Suppression Detection and suppression are addressed within the framework of the tire event tree. The detection and suppression probabilities are based on NUREG/CR-0654.

Ten minutes to fire brigade response is used for all scenarios / areas except the cable and diesel rooms (3 minutes) and the control room (1 minute). The document states that ten minutes was verified during the fire walkdown. Fire brigade response data was not used. The relevant time, however, is nu brigade <

i Energy Research, Inc. 20 ERl/NRC 95-506

initial response time. It is time to suppression, which must be longer than these times. No basis is provided for the optimistic suppression times in the control and diesel rooms.

c. Treatment of Suppression-Induced Damage to Equipment, if Available No cost-effective modifications to fire suppression systems were identified to mitigate the effects of fire suppression water discharge and migration.

d. Computer Code Used, ifApplicable Computer codes, such as COMPBRN, were not used for fire propagation, detection, and suppression.

2.2.7 Evaluation of Component Fragilities and Failure Modes

a. Defnition ofFire-Induced Failures Although not explicitly stated, the definition of failure appears to be loss of equipment functionality or, in the case of hot shorts, spurious actuation to an undesired position.

b. Method Used to Determine Component Capacities Analytical or tabular methods, such as COMPBRN and FIVE, were not used to determine fire propagation potential. Temperature criteria for cable damage or electrical / electronic equipment damage were not used.

Fire detection, suppression and propagation probabilities were based solely on the generic information in NUREG/CR4654, judgmentally adjusted to account for plant-specific features.

c. Generic Fragilities Used As mentioned above, the methodology used for the Catawba IPEEE did not include the use of fragilities.

d. Plant-Specific Fragilities Used As mentioned above, the methodology used for the Catawba IPEEE did not include the use of fragilities.

e. Technique Used to Treat Operator Recovery Actions The control room, component cooling water "short room," and cable room tires were each modeled in the systems analysis as if they were a loss of component cooling water. The most prevalent recovery actions included in the analysis were initiation of the standby shutdown system and failure to cross- connect offsite power from the other unit.

2.2.8 Fire Detection and Suppression Two quantifications were performed for the significant rooms: a base case [1] and a sensitivity case [11].

The base case used an adaptation of NUREG/CR4645 tire event sequences and parameters for suppression and propagation. This adaptation allowed, and probabilistically took credit for, multiple passes at detection and suppression without regard to the timing of suppression verses propagation. Four staps of Energy Research, Inc. 21 ERI/NRC 95-506

damage to components were modeled as end states in the fire event tree: no damage, damage to component that initiated the fire (Stage A), damage to adjacent equipment (Stage B), and damage to the entire room (Stage C). A significant probability was assigned to the sequences in which a fire would induce no damage to the equipment within which it started. For example, a fire starting in the control room was given a 6%

chance of causing damage (and a 94% chance of no loss of functionality). No justification was provided for this number except that it is consistent with NUREG/CR-0645. The sensitivity case used a model that allowed only one attempt at suppression.

In the original study [1], the fire event tree included three opportunities for suppression. In order for a fire to be considered a Stage C tire, it must have failed suppression three times in series (if detected) irrespective of the timing of damage. This approach inherently makes assumptions that may not be realistic. For example, it implicitly assumes that failure of automatic suppression will always be accompanied by a second and third attempt in time to prevent a Stage C fire (by either automatic systems or manual means) regardless of the time to damage equipment. The suppression failure probabilities provided in Table 3.5-5 are typically 0.8,0.8, and 0.1, for a product of 6x 10-2 For the control room, the product is 4 x 10-2. These values are of the same order as automatic detection / suppression systems, as shown in the FIVE document [22]. The possibility of misaligned heads or nonconforming locations is not considered.

In addition, detection failure probabilities were treated separately. There are two opportunities in series to detect the fire. The failure probabilities were typically 0.1 and 0.05, for a product of 5 x 10-2 For 2

automatic tire suppression systems, the industry accepted number of approximately 10 includes detection.

Thus, Catawba estimated detection / suppression failure probabilities that are significantly lower in the absence of manual suppression. This means that, for the control room, for example, there was only a 1/200 chance of non-suppression in 1 minute. This is clearly a very optimistic assessment.

2.2 9 Analysis of Plant Systems and Sequences

a. Key Assumptions including Success Criteria and Associated Bases The assumptions discussed in previous sections, particularly the use of a single scenario to represent an area, limited the comprehensiveness of sequence development. An example follows.

The analysis of cursets for the control room assumed a Stage C fire that fully involved the control room.

While this may be the worst ease with respect to the ability of the plant to deal with the situation, it may not capture the majority of the risk with respect to total CDF. For example, typical fire scenarios in control rooms may include abandonment. The licensee explained that abandonment would be a last resort because the pre-fire plan includes smoke extraction procedures and the donning of masks. However, a large fire in the control room could impact the operability of components from that location by virtue of shorts and open circuits. Control room abandonment seennios were not included in the Catawba study.

b. Event Trees (Functional or Systemic)

Functional event trees supported by fault trees were used. Fire event trees showing detection, suppression, and propagation oppor* unities were provided in the submittal.

Energy Research, Inc. 22 ERl/NRC 95-506

i

c. Dependency Matrix, ifit is Differentfrom thatfor Seismic Events A dependency matrix was not provided.

d. Plant-Unique System Dependencies There were no identified plant-unique system dependencies.

e. Shared Systemsfor Multi-Unit Plant The Catawba units share the ability to cross-connect offsite power and nuclear service water, with only l one nuclear service water train required to supply the water needs of both units. Instrument air is also shared between the two units.

f Most Signifcant Human Actions The most signincant human actions are failure to initiate the standby shutdown facility, latent human error induced-failure of the standby shutdown facility, and failure to cross-conneet offsite power.

2.2.10 Fire Scenarios and Core Damage Frequency Evaluation In the original study [1], all areas were screened out except three. The three scenarios / areas that survived the screening were: control room, cable room, and component cooling water "short room." The selected scenario for all three rooms was loss of component cooling. Using the IPE model transient event tree and fault trees in Section 2 of the Catawba PRA [4], cutset frequencies summed to a total fire CDF of 4.7 x 10-

'/ry, which is about 6% of the total CDF of 8 x 105/ry (for internal and external events). Fire sequences from these areas were identified as TQ3U sequences, involving a transient (T) with reactor coolant pump seal LOCA (Qs) and failure of safety injection (U). All cutsets were associated with FKC, which is a fire in the component cooling "short room." The frequency of FKC is 6x 10~5/ry, which represents: (1) the sum of the products of the fire initiation frequencies with the conditional probability of Stage 2 Gres for the cable room and control room all multiplied by the damaging hot short frequency of 0.2; plus (2) the fire initiation frequency of a component cooling pump times the conditional probability of a Stage 2 fire.

The assumption that all control room and cable room fires result in loss of component cooling water manifests itself in cutsets that are comprised solely of component cooling water related events. Because this assumption, in effect, screens out all equipment that is not related to component cooling water scenarios, a misconception of how the plant responds to fires in these rooms is obtained. This misconception limits the value of the study as a means of guidance for operator or fire protection engineer training. The expanded base case, however, included different initiating events for rooms other than the control room, cable room and "short room" The expanded base case [11] quantified the CDF from areas that were screened out in the original study.

The overall CDF did not change significantly.

The sensitivity study [11], performed by the licensee, attempted to estimate the significance of the assumption of multiple suppression opponunities by truncating the fire event tree after the first suppression and propagation opportunity. The CDF estimate resulting from the sensitivity case was approximately Energy Research, Inc. 23 ERI/NRC 95-506

60% (i.e.,1.6 times) higher than the expanded base case result. The dominant room contributors for the sensitivity case also differed from the original base case, in that the turbine building, which was previously screened out, emerged as an important contributor. The importance of assumptions and approaches toward screening thus becomes apparent. The sensitivity case produced a notable increase in CDF and an additional dominant tire area.

Another assumption that significantly affected the quantitled CDF (for all cases) was as follows: equipment failure (e.g., loss of component cooling) can be prevented if the fire causes a hot short to ground, followed by control fuse actuation, before a hot short causes equipment trip. The licensee stated that open circuits in control circuits would not cause change of state of electrical equipment. The study estimated that hot shorts (as opposed to shorts to ground) were about 20% of the incidences of fire induced shorts. Thus, the probability of losing component cooling water owing to a fire in the cable or control rooms was reduced by a factor of 5 (previous frequency multiplied by 1/5). This approach was applied only to the cable and control rooms. While the estimate of 20% may be conservative for Catawba, the basic problem with this approach is that it assumes that hot shorts are the only source of a significant fire scenario. As discussed above, control room abandonment scenarios, which otten prove to be significant, can be caused by loss of operator control owing to open circuits, and these scenarios were not considered in the Catawba fire analysis. It is, therefore, not valid to reduce the control and cable room fire-induced CDFs by a factor of five because of the relative occurrence probability of hot shorts.

2.2.11 Analysis of Containment Performance

a. Signijcant Containment Performance Insights Typical of other tire PRAs, containment performance was assumed to be the same as for the internal events study, because all tire scenarios were viewed as being alternative initiating events for the internal event trees. There was no discussion concerning aditional tire-unique initiating events or containment failure modes.

b. Plant-Unique Phenomenology Cimsidered Plant-unique accident phenomenology associated with tires was not considered.

2.2.12 Treatment of Fire Risk Scoping Study Issues

a. Assumptions Used to Address Fire Risk Scoping Study issues An implicit assumption made in the walkdown addressing these issues was that all ventilation equipment would be fully operational.

b. Signifcant Findings The key findings are:

1. Where smoke could be generated by tire, existing smoke control capability (i.e., ventilation, automatic suppression, tire brigade action, and large areas) is sufficient to prevent unacceptable damage.

Energy Research, Inc. 24 ERI/NRC 95-506

I i

I

{

2. No cost-effective modifications to fire suppression systems are needed (have been identified) to I mitigate the effect of fire suppression water discharge and migration.

3. Seismically induced failure of fire protection control panels is not a problem. Automatic heat activated sprinkler heads may be actuated during an earthquake, but no mitigating / preventive actions were suggested. Seismically induced tires owing to failure of RCP motors was found to not be a problem because tires in the motors would not affect the. ability to achieve safe shutdown.

No other area of seismically induced tires was discussed.

4. Control system interactions are not a problem because of the standby shutdown system.

5. Intercompartment fire barrier breaching was considered in the fire PRA by use of an average screening value. It is not clear from the study if maintenance records were reviewed to verify the state of repair of barriers, doors, and dampers. However, the standby shutdown system further mitigates the adverse affects of failure of redundant trains caused by breach of fire barriers.

2.2.13 USI A-45 issue

a. Methods of Remosing Decay Heat The Catawba reactor units can remove decay heat using:

1. Main feedwater or auxiliary feedwater through PORVs or condenser dum valves

2. Charging or safety injection (SI), and PORVs, for feed and bleed

3. RHR and long-term recirculation

4. Standby shutdown system Credit was taken for feed and bleed and the standby shutdown system. Fire was not a significant contributor to the risk associated with shutdown decay heat removal sequences.

b. Ability of the Plant to Feed and Bleed The plant has the capability for feed and bleed.

c. Credit Takenfor Feed and Bleed Credit was taken for feed and bleed.

d. Presence of Thenno-Lag Thermo-Lag is not present at Catawba.

2.3 IIFO Events The study finds no unduly significant sequences (i.e., vulnerabilities) with respect to HFO events. Only the contribution of high winds / tornado hazard to the external events CDF was quantitied. This contribution was estimated to be 2.6x 10*/ry. All other HFO events, except aircraft crashes, were Energy Research, Inc. 25 ERI/NRC 95-506

qualitatively screened out (e.g., external tlooding, toxic gases, etc.). The contribution to CDF from aircraft crashes was determined to be insignificant based on low frequency of occurrence (less than 1.9x 104 /yr).

No significant changes since the time of issuance of the plant operating license (OL) were identified. From the submittal, it is not clear whether any chges were identified, or the impact of identified changes were considered insignificant. ,

Several HFO events were qualitatively screened out without any discussion as to plant compliance with the 1975 SRP criteria.

In some areas, the submittal does not contain sutlicient information for a thorough review to be performed.

It summarizes the conclusions of the previous studies (PRAs and final safety analysis report [FSAR]

evaluations) without adequate description of the basic approach and key assumptions. This situation is particularly true in the case of external flooding. The submittal concluded that the contribution to plant risk from external flooding was insignificant based on the analysis presented in Section 3.4 of the FSAR and a pair of design-basis documents [23,24].

Additionally, the submittal contains many statements which are difficult to verify. For example, on page 5-8, Section 5.3.6.1, it is stated that " Previous evaluations of these lines indicates that a rupture would not significantly affect the station." However, no references to such " previous evaluations" were provided.

Due to the heavy reliance on the original Catawba PRA, the submittal create 3 some potential misunder:tanding. For example, on page 2-3 it is stated that the flooding huard was identified as requiring a detailed quantification. However, a more detailed review of the submittal indicates that the external flooding hazard was qualitatively screened out, and that only the risk from the internal flooding hazard was quantitatively assessed. However, the internal flooding analysis was supposed to be evaluated as part of the IPE, not the IPEEE.

2.3.1 High Winds and Tornadoes 2.3.1.1 General Methodology The submittal presented analyses of the impact of high wind / tornado hazards on Catawba Units I and 2.

Citing Section 3.4 of the PRA report [4], the report states that the following three steps were involved in examining tornado hazards:

• The first was to determine the effects of tornado missiles and high winds on the plant.

. The second was the development of an event tree which mapped out possible sequences of events following a tornado strike.

• The third was quantification of sequences using detailed fault trees within the overall event tree model.

The first step is divided into the following substeps:

Energy Research Inc. 26 ERI/NRC 95-506 1

. Occurrence frecuenev calculation. The frequency calculation was performed based on information documented by Twisdale [25,26].

. Tornado missile analvsis. The TORMIS computer code was used to evaluate the effects of tornado missiles on the targets of interest.

. Tornado wind analvsis. The effects of high winds on the Catawba site buildings were not considered in the study on the basis that Category-I buildings at Catawba were designed to withstand the wind loading of a design-basis tornado (360 mph, -3 psig), and the probability of experiencing tornadoes of such intensity at Catawba was considered to be extremely small.

However, it was assumed that any tornado striking the transmission lines would cause an irrecoverable loss of offsite power.

2.3.1.2 Plant-Specific Hazard Data and Licensing Basis In the original Catawba PRA, the tornado occurrence data were obtained from the National Severe Storm Forecast Center [27J. The data were based on actual observations within 125 nautical miles of the site, and included tornadoes with wind speeds of 75-300 mph. It is not clear whether or not this data was updated for the IPEEE.

The TORMIS computer code [28] employs Monte Carlo simulation which randomly selects a tornado intensity and a random path orientation. If the tornado approaches a potential missile, the code (1) checks to see if the missile can be lifted, (2) determines the exit velocity and orientation, (3) tracks the missile through the trajectory, and (4) checks for a possible strike. If a strike occurs, the effects are analyzed and data recorded. The code then outputs the probability of damage for all examined structures. Plant physical description involves the compiling of design data on plant structures and the de6nition of the plant in the appropriate format for use in the TORMIS code. It is not clear what assumptions had to be made for defining the plant in the appropriate format for use in the TORMIS code. Also, potential targets were not identined in the submittal, and assumptions and uncertainties in the values of the parameters used for defining the plant structures were not specified. Also, based on the review of the data used to define plant structures in the TORMIS model, it seems that none of the analyzed structures were modeled to include openings or doors (i.e., weak points).

As noted above, the submittal states that the effects of high winds on the Catawba site buildings were not considered in the study, on the basis that Category-1 buildings at Catawba were designed to withstand the wind loading of a design-basis tornado (360 mph, -3 psig), and the probability of experiencing tornadoes i of such intensity at Catawba was considered to be extremely small. A major concern in any study of external events is the identification of structures, systems or components, which are susceptible to damage, )

and which, if damaged, could lead to a loss of PRA-credited equipment for safely shutting down the j reactor. The majority of PRA-eredited equipment are safety-related and, as such, are protected by the seismic Category-I structures (e.g., the auxiliary building). However, there are important PRA-credited ,

components located in the SSF, which is not a Category-1 structure, and are, therefore, potentially l vulnerable to external hazards.

Energy Research, Inc. 27 ERl/NRC 95-506 i

j

2.3.1.3 Signincant Changes Since Issuance of the Operating License The submittal does not catalog any significant changes since the time of issuance of the plant OL.

2.3.1.4 Significant Findings and Plant-Unique Features No significant findings were cited in the submittal. A summary of the,walkdown procedures used by the licerisee, and qualifications of the team members performing the walkdown, were not provided in the submittal.

2.3.1.5 Hazard Frequency The submittal references the original Catawba PRA for estimating the frequency of the tornado luzard.

The frequencies of extreme tornadoes (with speeds of 73 to over 300 mph) were estimated. A total " plant 4

strike frequency" of 1.39 x 10 /yr, and transmission line strike frequency of 3.84 x 10"/yr, were reported.

2.3.1.6 PRA Analysis The functional event tree and the supporting top logic are presented in Figures 3.4-4 and 3.4-5 of the original Catawba PRA, respectively. The top logic shows any events that are unique to the tornado initiator, as well as the transfer cf logic to appropriate plant system models. Based on review of the top logic figure, it is not clear how the events that are unique to tornado initiators were identified, and what frequency was applied to each event, i

The tornado event tree was evaluated twice; once for the case in which a tornado impacts the missile zone, and once for the tornado striking transmission lines. If the tornado impacted the missile zone, it was assumed that a non-recoverable loss of offsite power would occur, and that missiles could be thrown by the tornado into plant buildings. If the tornado struck transmission lines, it was assumed that a non-recoverable loss of offsite power would occur, but no missiles would be thrown at the plant buildings.

I The tornado cutsets are presented in Appendix D of the Catawba PRA report. The submictal states that:

4

• The total core-melt frequency was determined to be 2.6 x 10 /ry.

l

• All of the tornado-initiated sequences were identical to non-recoverable less of offsite power  !

sequences. f Sequences involving tornado-induced, non-recoverable loss of otisite power, followed by random failures of the emergency power system, were the maior contributors to the tornado-induced CDF.

Neither the IPEEE submittal nor the Catawba PRA study provided the following information:

1

• Key assumptions, including success criteria j

= Dependency matrix

• Any plant-unique sy: tem dependencies

• Shared systems for muhi-unit plant

• Most significant buman actions. t Energy Research, Inc. 28 ERI/NRC 95-506

It should be noted that the submittal states, based on the Catawba PRA, that the contribution of the tornado hazard to CDF is 2.6 x 10 4/ry, whereas on page 3.4-!! of the Catawba PRA, the total tornado-induced 4

CDF is reported as 2.74 x 10 /ry. Additionally, it is not clear whether this value represents the CDF for one unit or both units.

Also, the PRA states that all tornado-initiated sequences are identical to non-recoverable loss of offsite power sequences, followed by random failures of the emergency power system. This result suggests that the impact of tornado events on plant structures was judged to be minimal. To support this assessment, the licensee has stated that the SSF, which is not a Class-1 structure, can survive a tornado strike (missile impact and wind). This structure contains the emergency diesel generators, HVAC room, battery room, electrical equipment room, and the control room. As a result of this assumption, tornado-initiated sequences were quantified based on random equipment failure following a tornado-caused non-recoverable loss of offsite power. Clearly, if the SSF is damaged by a tornado, the probability of these sequences could increase significantly. The magnitude of the increase will depend on the likelihood of damage to the SSF and the critical equipment it houses.

2.3.2 External Flooding 2.3.2.1 General Methodology The threat posed by external flooding was screened out based on the evaluation of the hazard as presented in the Catawba FSAR, and in consideration of a pair of design-basis documents [23, 24]. The description of the methodology used was not provided in the submittal.

2.3.2.2 Plant-Specitie Hazard Data and Liceic :ag Basis The site was analyzed to withstand floods resulting from:

. The effect of wind on wave height and run-up, a The probable maximum flood (PMF) resulting from the probable maximum precipitation in the drainage area, i 1

• A 25-year frequency flood passing through Lake Wylie, combined with a seismic failure of the Cowans Ford Dam,

• The Standard Project Flood (SPF) passing through Lake Wylie, combined with the failure of one of the upstream dams because of an operating basis earthquake (OBE), and

. A probable maximum precipitation on-site equal to 30 inches of rainfall in six hours.

The submittal does not provide any information on the types of flood protection, warning systems, or emergenev procedures utilized at the site.

With regard to GI-103, " Design for Probable Maximum Precipitation (PMP)," the licensee trovided information [15] which states that the roofs for all safety-related structures, with the exception of the reactor buildmg, are designed so that water tiows directly off of the roofs, with no significant Energy Research, Inc. 29 ERl/NRC 95-506

1 accumulation. Also, the roof slab designs are stated to be conservative enough to withstand all loads that could potentially occur due to roof ponding. The reactor building includes a gutter drain system designed for rainfall of 5.0 inches per hour. Greater rainfall intensity will result in ponding, though once the water level reaches the top of the parapet, it will flow directly off of the roof. The licensee states that the reactor building roof is design;d to carry the live loading due to ponding.

2.3.2.3 Sir,nificant Changes Since Issuance of the Operating License The submittal does not catalog any significant changes since the time of issuance of the plant OL.

2.3.2.4 Significant Findings and Plant-Un'que Features The submittal does not identify any plant specific features or vulnerabilities. It also does not present any documentation to indicate that the plant design was compared with the applicable sections t .he SRP [29].

The submittal does not reference any walkdowns that were performed for the analysis of external floods.

2.3.2.5 Hazard Frequency External tlooding was qualitatively screened out based on the FSAR and two design basis documents [23, 24]. No specific hvard data was provided.

l 2.3.3 Transportation and Nearby Facility Accidents 2.3.3.1 General Methodology The submittal has addressed aircraft crashes; water, rail, and highway transportation events; on-site hazardous material inventory accidents; and potential gas pipeline ruptures.

The risk from aircraft crashes was evaluated by:

1. Review of plant-specific hazard data.

2. Determination of conformance to the 1975 SRP criteria.

3. Determination of the impact frequency.

The other events were qualitatively screened out based on their proximity to the plant site, plant defenses, l and/or previous evaluations of the hazards.

2.3.3.2 Plant-Specific Hazard Data and Licensing Basis l

a. Airports and Ainvays l

l The plant is located approximately 13 miles south of Douglas Airport. The total annual number of operations for 1993 at this facility was found to be 531 A 5 tlights. One military route is located within Energy Research, Inc. 30 ERl/NRC 95-506

5 statute miles of the plant, and an airway approach is located in close proximity to the station. Based on these plant specific data, the submittal concludes that the SRP screening criteria are not met.

b. Warenmys No threat from waterway traffic was identified.

c. Highmys and Railroads The closest rail approach is a mainline track of the Southern Railway. The major highways in the vicinity of the plant are locat:J between 1.3 to 9 miles away from the site. The closest highway, Highway 274, is not heavily traveled.

The submittal states that, based on review of the data summarized above, no substantial changes were noted. Thus, the risk from the these sources of accidents were screened out based on the FSAR and original PRA evaluations.

d. Impact of Nearby hiilitary and Industrial Facilities There are no military bases within a 5-mile radius of the plant. However, there are three major industrial facilities between 5 and 10 miles of J.e plant. The report states that, due to the location of these facilities and due to the location of the routes where transport of the chemicals occurs, these facilities are not considered as a threat to safe operation of the plant.

e. On-Site Storage of Toxic ofaterials Sulfuric acid, sodium hydroxide, and hypochlorite are stored on-site. A survey of on-site toxic materials has concluded that hazards from on-site storage is negligible, based on the plant defenses (e.g., collection tanks, control room HVAC system filtration system, and monitors in the control room).

f On-Site Storage of Explosive Afaterials The survey of on-site explosive materials also concluded that expocre to hazards from these sources is remote. However, no frequency data were provided.

g. Gas Pipeline Ruptures Two natural pipelines are located within the site vicinity; a 12-inch line located 6.5 miles south-south" est, and a 6-inch line located 4.3 miles south. Also, in 1990, a 4-inch plastic gas line was installed approximately 4.0 miles north of the plant. The submittal refers to " previous evaluations" to conclude that a rupture would not significantly affect the station.

2.3.3.3 Significant Changes Since issuance of the Operating Licensee Installatior, of a 4-inch plastic gas line, in 1990, is the only change since the time of OL issuance which was identified in the submittal.

Energy Research, Inc. 31 ERl/NRC 95-506

l 2.3.3.4 Significant Findings and Plant-Unique Features No significant findings were discussed in the submittal for any of the transportation and nearby facility accidents. A summary of the walkdown procedure used by the licensee, and the qualifications of the team members, were not discussed.

2.3.3.5 Hanrd Frequency

a. Ainntys l

Since the estimated number of operations per year for a local airport was found to be greater than the SRP screening value, the SRP methods were used to estimate an impact frequency of 1.8 x 10/yr for non-military air traffic. Additionally, based on plant-specitic calculations, it was shown ; hat the crash frequency for military aircraft was 7.3 x 104 lyr. Thus, the risk from aircraft crashes was cons'dered to be negligible,

b. Others Hazard frequencies were not obtained for any of the other transportation and nearby facility accident initiators.

2.3.4 Other HFO Events A review of other external events that may represent a potential severe accident vulnerability at the site ,

was conducted, and is summarized in Table 5-23 of the submittal. i l

Review of Table 5-23 of the submittal resulted in identification of the following ambiguities:

r

• ast fires are claimed to have minimal potential impact on the plant because the site is cleared, and fire cannot propagate to station buildings or equipment. However, the potential impact of smoke generated by the fires on control room habitability, on equipment, and on the loss of clean air and instrument air was not addressed. Also, fire-induced debris could interfere with offsite power transmission lines, and cause a loss of offsite power transient.

• No other external fire source was identitied for the plant.

• The impact of low winter temperature was dismissed on the basis that both the reactor building and the auxiliary building were designed for a combination of snow, ice, and rain. However, it is unclear what the impact of low winter temperature would be on the safe shutdown credited components, cabling, or structures (e.g., tanks) that are not located in these two buildings.

Energy Research, Inc. 32 ERI'NRC 95-506 l

1 l

i 2,4 Generic hfety hum (GSI-147. GSI-148 and GSI-172) l 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" GSI-147 addresses the scenario of fire occurring in a plant (e.g., in the control room), and conditions which could develop that may create a number of potential control system vulnerabilities. Control system interactions can impact plant risk in the following ways:

• Electrical independence of remote shutdown control systems Loss of control power before transfer Total loss of system function Spurious actuation of componern The licensee assumed that PORV LOCA's have an insignificant probability of occurrence because PORVs "could be failed closed by removing power" (page 3.5-16 of Reference [1]). Neither hot shorts nor the possibility of blown fuses or tripped circuits were considered in the assessment for the purpose of assessing operability from the control room. Interfacing LOCAs were dismissed because power to the interfacing valves is removed during Mode 1 operation. The only initiating event quantified for the control room analysis was loss of component cooling. The possibility of loss of station power was not included, nor was any other loss of system functionality or spurious actuation of components. Loss of instrumentation and control capability owing to fire effects was not included in the submittal. Since the submittal has followed the guidance provided in FIVE concerning control system interactions (as discussed in Section l 4.8.7 of the submittal), all circuitry associated with remote shutdown is assumed to have been found electrically independent of the control room.

2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" GSI-148 addresses the effectiveness of t..anual fire-tighting in the presence of smoke. Smoke can impact plant risk in the following ways:

By reducing manual fire-tighting effectiveness and causing misdirected suppression efforts i By damaging or degrading electronic equipment By hampering the operator's ability to safely shutdown the plant By initiating automatic fire protection systems in areas away from the fire Reference [30] identifies possible reduction of manual fire-fighting effectiveness and causing misdirected suppression efforts as the central issue in GSI-148. The effect of smoke and misdirected suppression was accounted for in the walkdown [31], and some information is provided in Sections 4.8.4 and 4.8.5 of the submittal.

2.4.3 GSI-172, " Multiple System Responses Program (MSRP)"

Reference [30] provides the descriptF.. J each MSRP issue stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.

Energy Research, Inc. 33 ERI/NRC 95-506

I l

l Common Caase Failures (CCFs) Related to Human Errors Qescrintion of the Issue [30]: CCFs resulting from human errors include operator acts of commission or omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could initiate CCFs include: manufacturing errors in components that affect redundant trains; and installation, maintenance or testing errors that are repeated on redundant trains.

In IPEEEs, licensees were requested to address only the human errors involving operator recovery actions following the occurrence of external initiating events.

Limited discussions of operator recovery actions, following seismic and fire events, respectively, are provided in Section 3.1.5 and Table 3-2, and Section 4.6, of the Catawba IPEEE submittal. Some additional infor,'ation on operator recovery actions is provided in the Catawba PRA report [4].

Non-Safety-Related Control System / Safety-Related Protection System Dependencies l

Description of the Issue [301: Multiple failures in non-safety-related control systems may have an adverse impact on safety-related protection systems, as a result of potential unrecognized dependencies between control and protection systems. The concern is that plant-speci6c implementation of the regulations regarding separation and independence of control and protection systems may be inadequate. The licensees' IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety-related systems, and should identify potential sources of vulnerabilities. The dependencies between safety-related and non-safety-related systems resulting from external events - i.e.,

concerns related to spatial and functional interactions - are addressed as part of " tire-induced alternate shutdown and control room panel interactions," GSI-147, for tire events, and " seismically induced spatial and functional interactions" for seismic events.

Information provided in the Catawba IPEEE submittal pertaining to seismically induced spatial and functional interactions is identi6ed below (under the heading Seismically Induced Spatial and Functional Interactions), whereas information pertaining to tire-induced alternate shutdown and control panel interactions has already been identified in Section 2.4.1 of this TER.

Heat /SmokeMater Propagation Effectsfrom Fires Descrintion of the Issue [30]; Fire can damage one train of equipment in orm fire zone, while a redundant train could potentially be damaged in one of following ways:

Heat, smoke, and water may propagate (e.g., through HVAC ducts or electrical conduit) into a second fire zone, and damage a redundant train of equipment.

t A random failure, not related to the fire, could damage a redundant train.

• Multiple non-safety-related control systems could be damaged by the fire, and their failures could l

affect safety-related protection equipment for a redundant train in a second zone.

A fire can cause unintended operation of equipment due to hot shorts, open circuits, and shorts to ground.

Consequently, components could be energized or de-energized, valves could fail open or closed, pumps could continue to run or fail to run, and electrical breakers could fail open or closed. The concern of Energy Research, Inc. 34 ERI/NRC 95-506

water propagation effects resulting from tire is partially addressed in GI-57, " Effects oi' Fire Protection System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is addressed in GSI-148. The concern of alternate shutdown / control room interactions (i.e., hot shorts and other items just mentioned) is addressed in GSI-147.

Information provided in the Catawba IPEEE submittal pertaining to GSI 147 and GSI-148 has already been identified in Sections 2.4.1 and 2.4.2 of this TER. Section 4.8 of the submittal presents some information pertaining to this issue.

Effects of Fire Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment Descrintion of the Issue [30]: Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect interaction with non-safety related components.

This issue was addressed by the walkdown. Information pertaining to suppression-induced damage to equipment, as well as seismically induced inadvertent actuation of fire suppression systems, can be found, respectively, in Sections 4.8.5 and 4.8.6 of the IPEEE submittal.

Effects of Flooding and/or Moisture intrusion on Non-Safety-Related and Safety-Related Equipment Descrintion of the Issue [30): Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment. This type of event can vesult from external flooding events, tank and pipe ruptures, actuations of fire suppression systems, or I acktkw through parts of the plant drainage system. The IPE process addresses the concerns of moisture intrusion and internal flooding (i.e., tank and pipe ruptures or backtlow through pan of the plant drainage system). The guidance for addressing the concern of external flooding is provided in Chapter 5 of NUREG-1407, and the concern of actuations of fire suppression systems is provided in Chapter 4 of NUREG-1407.

The following information is provided relevant to this issue: the Catawba IPEEE submittal discusses external floods in Section 5.2 (which references Section 3.3.1 of the Catawba PRA report); and some discussion is provided in Sections 4.8.5 and 4.8.6 regarding actuations of tire suppression systems. The submittal provides no specific discussion of seismically induced floods.

Selsmically Induced Spatial and Functional Interactions Descrintion of the Issue [30): Seismic events have the potential to cause multiple failures of safety-related systems through spatial and functional interactions. Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems; direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures; seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control systems' failures; and indirect impacts, such as dust generation, disabling essential plant shutdown systems. As part of the IPEEE, it was specifically requested that seismically induced spatial interactions be addressed during plant walkdowns. The guidance for performing such walkdowns can be found in EPRI NP-6041.

Energy Research, Inc. 35 ERl/NRC 95-506 i

The Catawba IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions. The submittal states that EPRI NP-6041 guidelines were followed in the seismic walkdowns.

Relevant information can be found in Section 3.1.2.3 of the submittal.

Seismically Induced Fires Descrintion of the issue [30): Seismically induced tires may cause multiple failures of safety-related systems. The occurrence of a seismic event could create tires in multiple locations, simultaneously degrade tire suppression capability, and prevent mitigation of fire damage to multiple safety-related systems. Seismically induced tires is one aspect of seismic-tire interaction concerns, which is addressed as part of the Fire Risk Scoping Study (FRSS) issuen (IPEEE guiduce specifically requested licensees to evaluate FRSS issues.) In IPEEEs, seismically induced tires should be addressed by means of a focused seismic-fire interactions walkdown that follows the guidance of EPRI NP-6041.

Section 4.8.6 of the Catawba IPEEE submittal provides a brief discussion of seismically induced fires.

Seismically Induced Fire Suppression System Actuation Descrintion of the issue [30]: Seismic events can potentially cause multiple tire suppression system actuations which, in turn, may cause failures of redundant trains of safety-related systems. Analyses currently required by tire protection regulations generally only examine inadvertent actuations of fire suppression systems as single, independent events, whereas a seismic event could cause multiple actuations of tire suppression systems in various areas.

Section 4.8.6 of the Catawba IPEEE submittal provides some minimal discussion of seismically induced tire suppression system actuation.

Seismically Induced Flooding Descrintion of the issue [30): Seismiet!!y induced flooding events can potentially cause multiple failures of safety-related systems. Rupture of small piping could provide flood sources that could potentially affect multiple safety-related components simultaneously. Similarly, non-seismically qualified tanks are a potential thod source of concern. IPEEE guidance specifically requested licensees to addreas this issue.

The Catawba IPEEE has not included a specific discussion of seismically induced flooding.

Seismically Induced Relay Charter Descrintion of the Issue [30): Essential relays must operate during and after an earthquake, and must meet one of the following conditions:

i remain functional (i.e., without occurrence of contact chattering);

be seismically qualified; or be chatter acceptable. 1 Energy Research, Inc. 36 ERI/NRC 95-506  :

( 1

It is possible that contact chatter of relays not required to operate during seismic events may produce some unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event.

IPEEE guidance specifically requested licensees to address the issue of relay chatter.

As noted in Section 2.1.11 of this TER, an evaluation of low-ruggedness relays was performed using procedures consistent with those recommended for a focused-scope and USI A-46 plant. In addition, chatter oflow-fragility relays was considered in the systems model, with an assessed seismic fragility and a conditional probability of recovery. The Catawba IPEEE submittal provides relevant information in Section 3.1.2 (page 3-9), Section 3.1.6 (page 3-18), and Table 3-2.

Evaluation of Earthquake Magnitudes Greater than the Safe Shutdown Earthquake Descrirtion of the issue [30): The concern of this issue is that adequate margin may not have been included in the design of some safety-related equipment. As part of the IPEEE, all licensees are expected to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by performing seismic PRAs or seismic margins assessments (SMAs). The licensee's evaluation for potential vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address this issue.

The Catawba IPEEE has included a seismic PRA, as documented in Section 3 of the submittal. The seismic input for the analysis is described in Sections 3.1.2.3 (page 3-8) and 3.1.3 of the submittal.

Effects of Hydrogen Line Ruptures Descrintion of the Issue [30): Hydrogen is used in electrical generators at nuclear plants to reduce windage losses, and as a heat transfer agent. It is also used in some tanks (e.g., volume control tanks) as a cover gas. Leaks or breaks in hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital safety-related systems in the plants. It should be anticipated that the licensee will treat the hydrogen lines and tanks as potential tixed tire sources as described in EPRI's FIVE guide, assess the effects of hydrogen line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.

Section 5.3.5 of the submittal discusses the effects of hydrogen tank failures and hydrogen leaks in the Auxiliary Building, and cites previous studies that address these concerns. The submittal does not address hydrogen lines and tanks in the fire assessment.

l

)

l Energy Research, Inc. 37 ERI/NRC 95-506 I L

1

)

l 3 OVERALL EVALUATION, CONCLUSIONS AND RECONBIENDATIONS 3.1 Seismic The licensee has chosen one of the approved methods of performing the seismic IPEEE analysis (update of an existing seismic PRA). The reponing format used by the licensee adopts the NUREG-1407 standard table of contents -(Table C.1 of NUREG-1407) [3].

As judged from the submittal-only review, the following items comprise the principal strengths and weaknesses pertaining to the seismic IPEEE submittal for Catawba.

Strenaths

1. The level of analysis performed for the IPEEE process (i.e., a seismic PRA).

2. The degree oflicensee carticipation in the seismic IPEEE process (i.e., the IPEEE submittal was prepared entirely by licensee personnel).

3. The more global aspects of the Catawba seismic IPEEE submittal are well explained. In addition, the documentation is arranged as recommended in NUREG-1407, which facilitated the review of the submittal.

4. DPC (as recommanded in NUREG-1407) subjected the IPEEE to internal and independent reviews. The original PRA ;tudy, rd its subsequent updates in the IPE and 'PPEE submittals, received several stages of review, including: peer revir within the projeer u; revi w by projec' anager/ engineering supen isor; review try engineeimg personnel outside t; r M proja; review of the entire draft repo:s by selected station personnel; and review by . : W -fw review team (IRT) for seismic and fire IPEEE analyses.

5. A single seismic accident sequence event tree is presented in the Catawba IPEEE subraittal. The event tree is clearly diagramed and explainC and appears to be valid. The JPEEE mbmittal provides the explanation of each of the top events from the event tree, and identifies and desciibes in some detail each of the functional event sequences (core damage sequences) which result from the event tree.

Weakneues/ Observations

1. The lack of documentation detail of the containment performance analysis represents a failure to provide important information requested in NUREG-1407, Section C.2.1. The significance of this deficiency is apparent in that the licensee has concluded that seismie events have no impact on the containment analysis, whereas this review has found that the hydrogen mitigation system would be unavailable for seismically initiated station blackout sequences (which represent at least 70%

of the seismic CDF). Unavailability of the hydrogen mitigation system may render the containment susceptible to early failure due to overpressurization (noncondensible gases) and/or hydrogen deflagration / detonation.

Energy Research, Inc. 38 ERl/NRC 95-506

i The apparent failure of the licensee to identify and highlight this concern is difficult to understand, l due to the previous analyses which have highlighted the importance of the hydrogen mitigation l system in avoiding early containment tailure, and due to the obvious fact that the system would I be unavailable for seismic station blackout scenarios which are responsible for the bulk (at least

! 70%) of the seismic CDF. Moreover, NUREG-1407, Sec: ion 3.2.6 [3], specitically identified that the primary purpose of the containment performance analysis for the seismic IPEEE was to identify vulnerabilities that involve early failure of containment functions. NUREG-1407 specifically identified these functions as including hydrogen igniters.

2. In defining the eanhquake hazard for use in the seismic IPEEE submittal for Catawba, DPC used the mean EPRI hazard curve. In addition, DPC perfonned a sesnivity anriysis employing the 1989 mean LLNL seismic hazard curve. The IPEEE submittal stated thet the dominant accident sequences are comparable in their ranking with the EPRI and LLNL havcd curves, and that the LLNL hazard curve results do not add to or alter any of the insights of the analysis based on the EPRI hazard curve. Although the reported results using the EPRI hazard curve encompass 100%

of the estimated seismic CDF, the results using the LLNL hazard curve account for only approximately 77% of the seismic CDF. Moreover, the absolute value using the LLNL hazard curve was not iaantified, although such results had been requested in NUREG-1407 (Section C.2.1). This item is not considered t6 be a significant concern.

3. Even though the licensee concluded that there are no fundamental we'knesses or vulnerabilities with regard to severe accident risk at Catawba Nuclear Station, the licensee did not describe or reference the evaluation criteria which it used to judge whether a particular result constituter a

" vulnerability" Thus, it is not possible to examine the results of the IPEEE seismic assessment to verify the licensee's conclusions regarding the lack of vulnerabilities.

4. Only minimal details of plant contiguration are described in the IPEEE submittal report. Although the submittal states that the current plant contiguration is represented in the analysis, and the submittal describes the walkdown process that was used, there is insufficient detail presented in the submittal to permit an independent assessment of whether or not the actual plant contiguration has indeed been represented in the IPEEE. This review has noted that the safe shutdown facility (SSF), which is an independent means of securing safe shutdown if the norma! plant safety systems are unavailable, does not appear to be reflected in the seismic PRA assessment.

5. Althoug 2 recovery actions (human actions) are incorporated into the fault trees, no details are provided regarding the assignment of recovery probabilities. Internal events human error probabilities are used in most cases, but several error probabilities unique to the seismic analysis (such as recovery of relay chatter) are also used. The lack of information on the basis for the assignment of recovery probabilities is regarded as a significant concern. However, a sensitivity analysis indicates that the seismic IPEEE results are not significantly affected by human recovery actions related to relay chatter.

6. Even though no vulnerabilities affecting containment performance were identified by the licensee, it was found during this review that the median fragil ties for the reactor building and containment internal structures were less than the structural screening value of 2.5g PGA, thus they were included as part of the seismic analysis, indeed, both the structural failure of the reactor building and the structural failure of containment internals appear in the list of dominant cutsets. This Energy Research, Inc. 39 ERI/NRC 95-506 i

finding would appear to contradict the licensee's statement that external events "were judged to have no significant impact on the containment performance model," in that the initiating event for some accidents also results in containment failure at the outset of the accident (assuming, as would be consistent with earlier industry PRA studies, that both failure of the reactor building and failure of containment internal structures result in containment failure due, at the least, to substantial leakage).

7. The IPEEE seismic analysis reports that the containment air return fans and containment spray components "are seismically rugged and are not a concern." The basis for this assessment is not provided by the licensee. The IPEEE submittal also reports that the ice baskets were reviewed during the plant walkdowns, though no specific results of these walkdowns are provided, it should be noted that NUREG-1407 reponed that it is not feasible to screen out the ice baskets on a generic capacity basis. It is unclear whether or not this was done in the case of Catawba. This situation is regarded as a potentially important weakness.

8. No list of key assumptions used in performing the seismic IPEEE was provided, as requested in NUREG-1407, Section C.2.1. This omission unnecessarily complicated the review.

To summanze, the licensee's submittal for Catawba represents a technically relevant approach (update of an existing seismic PRA, with enhancements recommended by NUREG-1407), that in general meets the guidelines of NUREG-1407 (with some exceptions as to reporting details).

3.2 Elrr The Catawba tire IPEEE [1] is an update of he full-scope, Level-3 PRA performed between 1984 and 1987. Consistent with the guidance of NUREC-1407, the analysis identified critical tire areas, identified possible initiating events, calculated the tire initiation frequency, analyzed for the impairment of critical safety functions, and developed core damage cutsets with frequencies using a functional transient event tree and associated fault trees. A special fire event tree was used to help screen out areas, and assess fire damage and the frequency of fire damage. This tire event tree allowed multiple attempts at suppression without regard to the opposing timing of damage propagation. A screening process was used in this analysis in which tire scenarios were not quantitled if a similar JPE scenario had a larger estimated frequency of occurrence. Thus, the estimated tire CDF pertained only to those scenarios that happened to have a larger frequency than a similar set of IPE scenarios.

Typical of other tire PRAs, containment performance was assumed to be the same as for the internal event study, because all fire scenarios were viewed as being alternative initiating events for the internal event trees. There was no discussion of additional tire-unique initiating events or containment failure modes.

The walkdown was performed to verify assumptions about plant contiguration, to locate cable runs, and to address the Sandia fire risk scoping study issues.

The licensee's perfonnance of the additional expanded base case and the sensitivity case was revealing.

After restoring and quantifying previously screened-out areas in the expanded base case, little difference was observed from the original case. Building on the expanded set of sequences, the sensitivity case modified the calculation of the frequency of tire damage events by allowing one (rather than multiple) opportunities for suppression. One location that was previously screened out (the turbine building) emerged as another dominant tire risk location in this sensitivity case. A manifestation of the sensitivity Energy Research, Inc. 40 ERl/NRC 95-506 '

case assumptions in the turbine building was an artificially high likelihood of a building-wide fire that might damage widely separated offsite power lines. The emergence of the turbine building, therefore, does not indicate a vulnerability. It is reasonably typical for offsite power lines to cross the turbine buildinj.

The resultant core damage frequency of this scenario (about 104/ry) is do ninated by common cause failare of the emergency diesel generators, which is also a typical result. The original stud;, showed an o' erall 4

fire CDF of 4.7x 10 /ry, in which the dominant areas were control room, cable spreading roott, and component cooling "short room." The sensitivity study produced an overall fire CDF of 7,3 x IQ4/ry,a 60% increase. The sensitivity studies provide:1 substantial additional insights into the signi0.cance of assumptions in identifying the most important fire locations and in calculating the core damage Wequency.

The Catawba and McGuire Nuclear Generating Stations are similar plants, as is the metheJology Duke Power used to analyze fires at these stations. Interestingly, the results of the base-ease rire studies for these plants are significantly different, whereas the licensee noted that the results of the sensitivity-case studies are similar. This observation indicates the importance of using screening methods and assumptions that either realist'.cally or somewhat conservatively represent the plant.

Overall, the performance of the sensitivity cases has provided confidence that the licensee has made a reasonable attempt to identify fire vulnerabilities. The licensee's conclusion that the Catawba Nuclear Station offers no unacceptable risks from fires appears plausible.

Strencths The strengths of the fire study are summarized as follows:

1. Consistent with the gudance of NUREG-1407, the analysis identified critical fire areas, identified possible initiating es ents, calculated the fire initiation frequency, analyzed for the impairment of critical safety functions, and developed core damage cutsets with frequencies using a functional transient event tree and associated fault trees.

2. A thorough and comprehensive fire walkdown was conducted.

3. The licensee had control over the study, and apparently performed the entire study,

4. Internal peer reviews were performed.

5. The licensee performed additional sensitivity analyses.

Weaknesses The weaknesses of the tire sWy are summarized as follows:

1. The use of NU" G/CR-0654 values in the fire event tree, coupled with assuming multiple opportunities for fi.e .ceppression, may not be valid. Although a sensitivity case investigated the effect on core damage frequency of using only one (as opposed to multiple) fire suppression opportunities, the invalid NUREGICR-0654 probabilities were still used.

I i

Energy Research Inc. 41 ERl/NRC 95-506

2. An outdated fire database was used, which led to estimates of tire initiation frequencies in key areas (control room, cable room, and switchgear rooms) that were a factor of 2 to 3 lower than the Reference [22] database.

3. The validity of using a single " worst case result" scenario in each fire area, instead of a more comprehensive approach of evaluating fires at each potential source location, depends on the licensee's statement that mechanical and electrical equipment are always in separate fire compartments. .

4. The treatment of the conditional probability of hot shorts as a multiplier on core damage frequency for the control and cable rooms is not valid.

5. Control room abandonment scenarios were not considered in the study.

3.3 HED Events The Catawba HFO IPEEE relies heavily on the previous PRA results and evaluations to meet the guidelines of Supplement 4 to Generic Letter 88-20 [2] and associated guidance described in NURF.G-1407

[3]. The strengths and weaknesses of the study are summarized below.

Strencths

1. The methodology utilized for the analysis of tornado everts is statemf-the-art.

2. The analysis was completely performed and reviewed by Duke Power Company personnel, using their plant knowledge. This has led to maximization of their statrs appreciation of severe accident behavior.

Weaknesses

1. Significant changes since the time the plant OL was issued are not discussed and documented in the submittal. In most eases, the plant design is not compared with the applicable SRP criteria.

2. The submittal contains statements which are difficult to verify. For example, on page 5-8, Section 5.3.6.1, it is stated that " Previous evaluations of these lines indicates that a rupture would not significantly affect the station." However, no references to such " previous evaluations" are provided.

3. The submittal does not provide a summary description of the walkdown activities, and how these activities were utilized to achieve the objectives of the assessment.

1 4. The submittal does not provide sufficient information on plant systems which are not housed in seismic Category-I structures, and hence, might potentially be vulnerable to external hazards. In the case of the analysis of high winds /tomadoes, the licensee has stated that the SSF, which houses i several critical pieces of equipment, such as the emergency diesel generators, can withstand the l tornado impact (wind load, in particular), even though the structure is not a Category-1 building. j Without this assumption, the frequency of tornado-inaiated scenarios could increase significantly. I Energy Research, Inc. 42 ERI/NRC 95-506

4 IPEEE INSIGIITS, IMPROVEMENTS AND COMMITMENTS The study defines vulnerabilities as " unduly significant sequences." It found no vuinerabilities from external events.

4.1 Seismic The Catawba IPEEE submittal reports the overall seismic CE im e as being 1.6x 10 4/ry (using the EPPJ mean seismic hazard curve as a quantification basis). Th '

al suggests that this seismic CDF result is dominated by seismically initiated loss of offsite po,c, a 'wed by (a) various seismically inithred failures of diesel generators and emergency AC power syste: ,;omponents and support system components, or (b) non-ceismic diesel generator failures. The scismic structural / component failures contribute about 64% to the seismic CDF, whereas an additional contribution of approximately 6% of the seismic CDF arises from the random, non-seismic diesel gererator failures. Hence, seismically initiated station blackout sequences are seen to dominate the Catawba seismic CDF (i.e., they are responsible for at least 70% of the seismic CDF).

The IPEEE analysis identified some modest seismic improvements, but indicated that they were not significant to risk. No seismic vulnerabilities were identified, hence no additional improvements were developed, and there are no outstanding commitments related to the seismic portion of the IPEEE.

4.2 Ein The most significant tire walkdown inding was the discovery of the close approach of two trains of cables for component cooling water pumps in the elevation 568-ft "short room."

The study found no unacceptable risks from fires. Plant improvements did not result from the fire IPEEE, and hence, no commitments were made.

4.3 IIFO Events A principal finding of the Catawba HFO analysis is that the licensee identifies no vulnerabilities with respect to severe accident risk. Among all the HFO events, only the contribution of the tornado /high winds hazard has been quantitatively evaluated. Tornado events, with contribution of 2.6 x 10*/ry to core damage frequency, make up approximately 1i% of 'he total calculated external events-induced CDF.

Based on these results, no plant improvements were formulated.

1 Energy Research. Inc. 43 ERI/NRC 95-506 l

l

5 IPEEE DATA

SUMMARY

AND ENTRY SIIEETS Completed data entry sheets applicable to the Catawba IPEEE are provided in Tables 5.1 to 5.8. These tables have been completed in accordance with the descriptions in Reference [14]. Table 5.1 lists the overall external events results. Table 5.2 summarizes the imponant seismic PRA fragility values. Tables 5.3 to 5.5 provide the PWR Accident Sequence Overview Tables for seismic, fire, and high wind events, respectively. Tables 5.6 through 5.8 provide the PWR Accident Sequence Detailed Tables for seismic, fire, and high wind events, respectively. .

I Energy Research,1. 44 ERl/NRC 95-506

- 6 0

5 5

9 lsa C c R s

e i

m N

/

t o e I

- h R N c E s

u

_ dr o

a z

l a

I

)

_ g

(

F P

_ L C

H t d n e a d i

l P v o

r p

t o

n s

t l

u s

e

_ 1 R y y y s

_ s r r r

/ is t * */ '/

5 n F 0 0 0 la y

l eev D 1 1 1 n 5 C x x x a 4 ba E 6 7 6 g Tl a 2 4 1 n n

i

_ d r m

. t e n

_ x k E

I

=

O S'

t; u

o d

g e n n i e

_ n e r _

e e

r O O S S O S O O S

c _

n c =

o S _

i t O t

a  ;

S is r s y

n l e a i n

- c a u c N s i

f

- a tn t s ic e b e n p m d e s d c.

a i c ic t

n n l

c I a t n A c a ,

C e s y y A l P h v '

d it n c r

e E e m e lit v io

=

a

- r i i r ic t c t S e F ~

_W i a a s ma F

F F A t r  : e l

a l

a e l c o g R N n r

n m u 9 p s

'sr in y t e r

e e r n t r im s n e n g n t x

t x

t x te a e i e

a ht e e r a n r r e l E E E I N S T O c n P S E

, 6 0

h 5 ta 5 P 9 s n C s o ei ct cp R d d d d d d d d d d N ui r ie i e i e i e e e e e e e /

Sc s f f f f i

f i

f i

f i

f i

f i

f I

ce i

t i

t n

it n

i t

i t

i t

i t it i

it R n

t iD n e e e e n

e n

e n

e n n n E m d d d d e e e i

s i i i i d

i id id d i

d i

d i

c t t o o t t S o o t

o t

o t

o t

o t

o t

o n n n n n n n n n n I I I I I I I I P

l P

l P

I P P P P P l I l l l e

c i

I l

, I I l I i l i n T, P T P T T

T, T T

T en uo N l

l N

l l

N N N N N N T,

I I 1 qi e p t

S S

- T, S I

I I

I I

Si N N S S S S S C I C I C C C C C C c R S R S R R R R R R im-sD P P

P P, P P, P, P P

P i

e O O O O O O O O O O e

r S O O O O O O O O O O l

u L L L- L- L L- L- L L L-i a T- T- T T T- T T T- T- T f

m )

t e g s (

y F s P t

o L e C e t u

I I

y 8 t

i 0 b i l r i 0 t g l n a a o 2, F r it c c A.

r h 5 c e ic ei V h 6 b ms l

)

w 4 0 2 2 3 4 6 9 8 1 5 4

ai 0 5 5 4 4 4 4 2 4 3 5 TeS 1 0 0 0 0 0 0 0 0 0 0 n

A e ht a

R 8 & 5 2

0 3 2 8 0 8 8 8 8 0 8 P e h 1 s

s 0 0 0 3

0 2

0 2

0 0

0 0

0 3

0 0

a 9 e 0 5 v l(

1 o 0 u s s )

0 o i i

c g l

a c n it n(

t S o c iay n r i

t a p d t

i o

z f o a c a e c a i

r i c Mp o m f

a 0 0 3 4 1 7 1 2 6 l u i

t n ic C 3 4 5 5 6 6 7 1

7 8 8 l r a m 0 0 0 0 0 0 0 0 0 0 E

t c u s S

c o n ic s n s S i t e r

i c d s

e u f

i e n l

c e u s

o f ia p l r r n s e ht e e l

e e u t r io e l a

i t

a t

t a

n a u t

a t

v w h p l

ia i

s s s c h St e i s t l r

c l f r l e n i a

l o r

l a

i h e t n te e e e

t n e m e f

n n t n n l e i p n e c e a p o a p

c e h c r c u

I R r iu o r e c  : p u l o t l o e l o

N A P o d e

q e m o s r t

a r

e r n r c a G E ht i o r r

t n r h t t

t n ig t n n b P f d e e c a w t 4

i c n C w e o t r h o c

n e

o c

I a

r n 8 c a o t

a c ta a c e e o p r h e r r r h t

a t m  : s s w o c r e g r e o o o c e e t n r C t t t m

s s p t o e te W o t e

t t

h c n

a r

ta r

a r a e a n i

s m n a tc e e e e a N e s f F h e s r s h o A i

c i

u n n n e m

a p a

A S  :

g p f

o C b a r w

s q e g

e g

e g R l

" m f o

l a A c e e N dr dr a r f o m V S t

r V s l e

i c

l e

y g

t a a t c

f o c s s r P e 0 d s s s r n z z o o 0 v 6 a e ie ie e a a a e p

t u

t s

N 0 S n 1 o i n

l P l l C

i L

L 6 S I 4 L D D D l l S E

,i .

I, )

S A. d 6 S- S, l

e 0 4

if 5-1 T, A "

s V e 5 r O, t 9 o S e L R t I O 3 A

% C e

e t

u T I "

e R b , Y O, ht h

S t n O R O T e N

/

B I

s t

S I 1

A S - N, u, y R T. A r E R I, a s

T 3 s e

G C c S- A e n

V T, l e r

S P c i, a n I P E i l

2 C

ht o d I l.

A 5

i t

i l - P I S- V r

u c , S l d'n n l l u T C U, I

P T, l, a

F N R L 'M.

l C ht d

e I

S U, S M M l.

V A 4 a

l C M S I

S- I f

ia R S T, I.

I F S W T(

W S N I

E, E N 2 V, E- S A IF s

t T, S C, r

W E, R o

p  ! I S

l e p t

h.

S A

P b u l

- S IC.

a S E, S T.

T t S

f

'X P

o t

l h I C, w L E, R e N.

P.

i y I

- C v l T, A l.

r n E, I

e P P. )

v O C R-C l, k

n a

O A D, R l b

3 e lP 5 cn R t n P P P T.

S W

C I. h e

P c l l y ee c O O O l i

C, P I

a 7

ba u l

i & O O O A l

T, C

4 I.

P d m

4 q m it L- L- L-S X E l

e TeS i s

e I n T T T W T

I lA, D i F(

S t

t n S A- 3 C h e r C R U T, i d o T N T, N

l R

i c F T- lA, I c S

- O, A y y y y T, 2 C

C ol r r N i R F  % -

7

/

'/ R- 'X t

R, R S, D 0 0 0 0 R W C 1 1 1 1 T.

P A, O T P x x x x O 13 tl l

S O

S 8 8 7 0 O l C E 2 4 4 6 I C I 1 2 3 R. N 1

A.

I.

1 T.

) 2 l

l x f i l i

x- i tt S d d d d

(

C S. T.

P S ie i e i e i e V. A F S S f f f if D A i

it i

A,  !' P D t n n t

n t

n 3 l

l S, n P e e e e S. IC) . T I n

o d

i d

i d

i i d 2 A, lu A N I S.

i t

t o

t o

t o

t o 1S. l a Cb S. W a n n n n S n Ae  : b g

in A T

St  : e gy g ta w r n n nu o g

n wn i

a i r l l

e w o y r lot k d i wo f

c l a loi c e l u e lo) f a f F ht l o

N c e m m et f f

n ht e ,

ht C o e c

ydL a e fo A e ht b u f oS p p c r f n w q e o Y.  ! o I n tus u t a e w4 a e e

t S t r h a O umlon a W u ht c C Us P U i

r w S, t r

r t

r a

o Si A s Q D D L t 4p t

t r 3 o c e S m C C C L i tu n rut o To AWt s S, mtm k A R e

a I

( s 2 dn  :

N s )r r e a f mW r u s

e y g

t n # 1 2 3 4 E

v twer u S tS.

F d b tu r a

t 0 )x s h le n e l

tsnT 4x a T a i t r n P I (- l S F A E

V, T, e 6 f ht R 0 O N e s 5 I l ,

u -

V

/

I A , 5 f s R y 9 o e a

r t

e t

u O

S-3 C s s C e b A c e R h n T, V e N S t l

n t R i e

/

I 1 A T G

2 r

a R S C h E A 5 t

T. V l r C i

/

o I

I, d B n s L C a n I I I I I I I I I S- A ht io P P P P P P P P P V 4 t H i l l l l l

i l

I I

l l

i I T, 1 I

a l

c ,

I C f T,

n u T T, T T T, T T

T O W, U N N N N B S F N N N N N L E T I

I I

I I

I I

I I

S- N d S S S S S S

- 2, E e S S S T, S l

i C C C C C C C C C A V, a R R R R R R R R R W S F F F E I X , C E -

I S R T, A S S P E

t r W F .

IC.

o p M C S p L D P u W W W W W W W W W -

E C, e S C C C C C C C C C T, C R

l b s s

C C C C C C C C C U E

A P L

a M T l e N C

. I.

P L D L )

w T

- L n

i e , W, R, a v P P l b

r C C l l e e ly R C I, b v n .

O m m m m m m m m m 4 P y O e te e e te te c e e T. C I I

a m

4 e A t t

S y

s ts y

t S s s is t s

t s S I

X P

5 c n y y y y y y y I U d n R e S S S S S S S S S U. A E l e

le e P v t t t t t t t t , D i F( 8 baqu e E o r r o

r o

r o

r r o

r r 1 r T, 3 S 4 -

r it p p p p o

p p o

p o p o p S C C. M TeS i F n p p p p p p p p p W X U

F U t r I u u u u u u u u u T A T, H n o S S- S- S- S- S S- S S A e F - - - N R d

i T- T T T T T- T T T T, 2,

C I

S O,

c T X C O c T - U R B A T, A k, S y y y y y y y y y ,

R r r r r r r r r r X 3, o R

• / */ '/ '/ '/

/ '/ /

/

R U B T W F D 0 0 0 0 0 0 0 B S G P 1 1 1 1 1 '01 1 'ot 1 T, C C S -

C 8 x x x x x x x x x P A. R D 6 4 4 8 4 1 l 6 C )

N 1 1 2 2 1 1 1 5 3 l Qkna i

U. I I

Bl M L, T. Cb S S

I

) A e T, x P, x I,hw S E S

(

Ua D A V.

Bm P Cd S, Y S I 1 I I I A T B A ki I I I I D P P P P P P P P P N P 7 7 7 7 7 7 7 7 7 L .F S C( I S

S. l AC  : W M, i a

g A g T t

r e nV m A S) t a w  :

g 4

memm g

y liaW. W m g r a

lo S, f

I e k m

myt e) ht l kS n o e flot r e hW t f o

f e

c o m f S o e a n Us Us 0s U3 Us Us U US Us he rk rp o2 e

r ht f c b e s t u p ht o n w q u Q Q Q Q Q Q Q Q Q f

oS u twW S e I a e T T T T T T T T T e (- s t s , d e r

t nTl a a h a S Or n oM n ht c

l: oo tmT S A t t s r C_ w ).

i tp A . o a e o r

s m e e e s.A n S m =

hi o t i

S, n o

J

)

A t

e a W 0s c l R

N t

sr 4 re m 4A r

n ie u f :s y e Tf e e

u O F 's t g

t # 1 2 3 4 5 6 7 M 9 v I r S u n E S ) s

. d e n e bi r e

l a S x s 3

A l

i r

n x e i a t F* N i

P i tn T (- L O A t

E m

J T, e 6 V. ht R t 0

O, O N ea 5 I B l

/ A, u 5 f

S V I y

9 o R le r S

t tc b O S-3 C a s C e

e u a rL T A e c

R h b eI V e N S

i r vT H n /

t o R e l l

c T 2 r

R I

A e G S C a

E R- - A ht V 5 n T. r o I I

'o N IC B

l d

n L C a S A h s -

V t n I P T, H 4

o l C f a

it i W,

c O O n

u T, B L E S T F N S- ,

N I

2 E d S T, S V e A ,

l i C W S E

F a R F I C

F X i, ,

E - S R T, A P S

S W E C t F I, r C S o

p ML D P p E u C T, C,

e S A C R l

U A P b S E E L a S M o

T L N

L C.

l P

- D L )

L w n e T, R, la i

P W. P b n C C I e

e ly R C I h

n I, v -

4. P y O O T. C l l

a m

5 e s X A t n

l U P, d 5 cn R e p o

l U A E l e

le e P v D e 9

o

, F(

baqu d E L T, 3 S 4 n t S C C M TeS i i n T- W X R U t

Wr I T

A U

A T, H n o -

2, N R e F I

O d T, C S i

c T X C O c 1 -

U R B A y T.

A R,

S r R, R */ X 3 U B O

T F R W D 0

T, B

C S

G S _

P 1 C

C x P) A . R D 6 M 2L

,)

U, I N

2 A U na L, 1

Bl M S

T. Cb S I

)

x Ae T.

x I,by P, S

(

E S U am D A B P V. Cd S, Y S A Ael T B D

• 3

,iF N ,

P 5 C( I S

S 2 l. AC :g W

a

g A T n A S. ir nV i la tS) tea  : t

i. w w4 t

g g

m m hW i l

lo i n im fo n e y w b i t s r lo S, u a f e lo S e3 l

&mSt ynet i

d o m e ft r hW t f o

f e o c e pl o m e f S o e ht f r

a n O ht pp o2, r a f e

n c b e f up o n u B oS u twW d u q S e -< s t S, t s e e

im r

I a e nTl s r e i, t

a S Or nao oM m s

ht d

t e l c

f r r o, i tmT A t t s t r

a e

t o

ai

)r e

twA S, A s

n m o u n

n c

S

-s m i tn xt s h o t r

S o di A t

a c C R i

o 4 .

N a 6 ar er Tf e n

n A t.

n ie u

l f

s e y u F 's t g

t # 1 w I,e r S O, u r E S x d te b m ) s s 3 e i e l

i s S- x t

e A l

i a N o

n r

n P h T (- l O F " A

• E

o 6 0

1 su=

e d a.

5 3 5 f I A1 . 9 o T O C i. C t

e N O.

I e R e g r N h

s lam /

I I

R I l M E RF 1 GN T CI 2 N

E M C1 1 N

I I C

A T

N FC2 O

C FC1 CS2 CS1 AM3 AM2 YY RR AMI e AD D1 l

b NN

)

E AFW X X a nV NI SP T i SI N

d MFW e y l

i l SG t

a n TB e O Y Y D A R T AI MSIV 6 e DR c R N 3

3 TT 5 n P ) 1 l

e eu c DNI I

S T

SGA 0 b q i 5

SGS ae m TS i s AR2 t

n e Y e S YR C R) ARI d r A11I R i

c o l bNC i 1 . PR c F iEI R

PV R 1 PR 1

A N I

R Cil PR W AI 2 P Y -N AI 1 Y

R)R O A11 T ACC MNrI I Et I PI R i P VN INI 1 1PI X X X C1 Pi1 RCP5 X Y 1T PAD 2 n RI i

o A ki PADI t

a MH I

RT PSRV St PNI r

a PPORV X l

e c X DI u R N RPS a c b

I n

w E a C t

a h M !t P 1 c C I Q

s B 4 1 1 r a

C C C 1

e e s m $ e a R N y g

t n r a # I 2 3 4 e l

P n

E

6 i

0 5

5 9

r o

m o C t

e N R h

e N

/

s I R

i E

1 ( f M 1

RF 1 ON T

N CI 2 E

M CI 1 IN A iC T

N O FC2 C

FC1 CS2 CS1 AM3 AM2 YY e RR AMl l A>

b DTi a hN AFW DE T fV iN N1 SF d SI l

e MFW i

a y S it t l e n TH D O Y 7 e RYl MSIV 5 n c A Ai DR e eu R N i TT l

b q P t1bN f $GA 1

5 ae e r

E S

I TS i $O5 t F Ak2 n r -

e o YR C Y

ARI d F i

R A U T R c L I LPR c ANC A I R

l'VI RI 1 PR 1

N R I CI PRI W

P A1 2 YN A1 I YR RO1 0 AT1 ACC MNCi I El LPI R V N l' i INI II Pi X X X x X x X X X CII PI

RCPS X X X x X x X X X Y Y l PAD 2 R!

A Ri PADi MB IR1 P5RV l

l' N I

PPORV

- BI a X R

b RP5 c w

a I n

t a i, C E C lc r

N E

I l

s i

t s

t t, u l t os 1 1

i l t a Q Q Q Q Q s ti Q Q s

e e

m it E

Q T T T n 4 T T T T s

e a S R N y t g n r a < e e

l P

f 1 2 3 5 7 5 9 n E

) 6 M

I 0

1 S 5 l

e 5 S b E a r

9 f T e o O v s

C t

e N a R h

e R n

- N

/

s o l N R i

E 1 U" 1

RF 1 G T

N I

CI M CI I N

I A 1 C T

N -

O FC C

FCI C52 C$I AM' AM Y Y i e R R AM' l

b AD D1 a NN AF oE T rVN 1 N1 P d 5I -

e MF l

i a ly 5U t

e n D O Y TB RY 8 e c A AI l MS'V 5 n R DRi N TT l

e eu P ) h MT 5G^ 2 b q d EN 5 a e n S I SU

_ TS i t

n W -

AR

_ e r Y d o Y R RC ARI F A UR i I c TI LP c M N.TI A IR'I PV R 1 P 1

N R I C11 ' E W

P Ai AiI YRY N RO10 AC AT7 IMNAEl i I P' R NIVN P

I I PI I X C!! PI RC S X Y

Y T RI PA 2 AR i PA"1 _

MD I

RT PS V PNI PP"RV BI X

a R b HP$ c w I n

t a ,

a E h C C c r

N ) a E M e -

e U J

I S s m H e a S R N y t g n r a f e Pl I

n E

6 REFERENCES 1.

" Catawba Nuclear Station IPEEE Submittal Report," Duke Power Company, June 21,1994.

2.

" Individual Plant Examination of External Events (IPEEE) for Severe Accident Vul 10CFR50.54(f)," U. S. Nuclear Regulatory Commission Generic Letter 88-20, Supplement No.

4, June 28,1991.

3.

J. T. Chen, et al., " Procedure and Submittal Guidance for the Individual Plant Examination of Extei a! Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory Con %sion, NUREG-1407, May 1991.

4.

" Catawba Nuclear Station Unit 1 Probabilistic Risk Assessment," Duke Power Company,1987.

5.

" Seismic Margin Assessment of the Catawba Nuclear Station," Electric Power Research Institute, EPRI NP-6359, Vols.1 & 2, April 1989.

6,

" Catawba Nuclear Station IPE Submittal Report," Duke Power Company, September 1992.

7. \

"PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments fori Nuclear Power Plants (Final Report)," American Nuclear Society and Institute of Electrical and Electronics Engineers, NUREG/CR-2300, Vols.1 & 2, January 1983.

j

8. " Seismic Hazard Methodology for the Central and Eastern United States," Electric Power Research Institute, EPRJ NP-4726-A, July 1986.

9.

" Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains,"

Lawrence Livermore National Laboratory, NUREG/CR-5250, January 1989.

10.

D. L. Berry and E. E. Minor, " Nuclear Power Plant Fire Protection-Fire-Hazards Analysis (Subsystems Study Task 4)," Sandia National Laboratories, NUREG/CR-0654. September 1979.

I1. "McGuire Nuclear Station, Catawba Nuclear Station Supplemental IPEEE Fire Analysis Report," l Duke Power Company, August 1,1996.

12. R. T. Sewell, et al., " Individual Plant Examination for External Events: Review Guidanee,"

Energy Research, Inc., ERl/NRC 94-501 (Draft), May 1994.

l

13. "lPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commission, June 18, 1992, 14.

S. C. Lu. and A. Boissonnade, "lPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboiatory, December 14, 1993.

4

15. Catawba Nuclear Station, Docket Numbers 50-413 and -414, Request for Additional Information-l Individual Plant Examination for External Events: Response," Letter to U. S. Nuclear Regulatory i Commission, from M. S. Tuckman, Duke Power Company, November 17, 1995.

l Energy Research. Inc. 53 ERI.NRC 95-506 l >

6 REFERENCES

1. " Catawba Nuclear Station IPEEE Submittal Report," Duke Power Company, June 21,19c4.

2.

" Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 10CFR50.54(f)," U. S. Nuclear Regulatory Commission Generic Letter 88-20, Supplement No.

4, June 28,1991.

3. J. T. Chen, et al., " Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities " U.S. Nuclear Regulatory Commission, NUREG-1407, May 1991.

4 " Catawba Nuclear Station Unit 1 Probabilistic Risk Assessment," Duke Power Company,1987.

5. " Seismic Margin Assessment of the Catawba Nuclear Station," Electric Power Research Institute, EPRI NP-6359, Vols.1 & 2, April 1989.

6. " Catawba Nuclear Station IPE Submittal Report," Duke Power Company, September 1992.

7. "PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants (Final Report)," American Nuclear Swiety and Institute of Electrical and Electronics Engineers, NUREG/CR-2300, Vols.1 & 2. January 1933.

8. " Seismic Hazard Methodology for the Central and Eastern United States," Electric Power Research Institute, EPRI NP-4726-A, July 1986.

9. " Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains,"

Lawrence Livermore National Laboratory, NUREG/CR-5250, January 1989.

10. D. L. Berry and E. E. Minor, " Nuclear Power Plant Fire Protection-Fire-Hazards Analysis (Subsystems Study Task 4)," Sandia National Laboratories, NUREG/CR-0654, September 1979.

I 1. "McGuire Nuclear Station, Catawba Nuclear Station Supplemental IPEEE Fire Analysis Report,"

Duke Power Company, August 1,1996.

12. R. T. Sewell, et al., " Individual Plant Examination for External Events: Review Guidance,"

Energy Research, Inc., ERI/NRC 94-501 (Draft), May 1994.

13. "IPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commission, June 18, 1992.

14. S. C. Lu, and A. Boissonnade, "lPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 14, 1993.

15. " Catawba Nuclear Station, Docket Numbers 50-413 and -414, Request for Additional Information-Individual Plant Examination for External Events; Response," Letter to U. S. Nuclear Regulatory Commission, from M. S. Tuckman, Duke Power Company, November 17, 1995.

Energy Research. Inc. 53 ERI.NRC 95-506

r

16. "Dcvelopment of Criteria for Seismic Review of Selected Nuclear Power Plants," NUREG/CR-0098, May 1978.

17. "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI NP-6041-SL, Revision 1, August 1991.

18. " Procedure for Evaluating Nuclear Power Plant Relay Seismic Functionality," Electric Power Research Institute, EPRI NP-7148-SL, December 1990.

19. " Generic Issue 131. Potential Seismic Interaction involving the Movable in-Core Flux Mapping System Used in Westinghouse Plants," U. S. Nuclear Regulatory Commission Memorandum for R. W. Houston, from E. S. Beekjord, July 31,1989.

20. " Staff Evaluation of Catawba Nuclear Station Units 1 & 2 Individual Plant Examination (IPE)

(Internal Events Only)," Ene!osure I to NRC memorandum from W. Minners to A.C. Thadani, dated January 3,1993.

21. " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Flants, Final Summary Report," U. S. Nuclear Regulatory Comniission, NUREG-1150, Vol.1, December 1990.

22. " Fire Induced Vulnerability Evaluation (FIVE) Methodology," Electric Power Research Institute, EPRI TR-100370, April 1992.

23. " Plant Design Specification for Flooding From External Sources," Duke Design Basis Document, Spec. No. CNS-1465.00=004)011, Rev. O, October 28,1991.

24. " Catawba Nuclear Station Yard Drainage Effect of Local Intense PMP," Duke Calculation, File No. CNC-114.00-00-0040.

25. L. A. Twisdale, et al., " Tornado Missile Simulation and Design Methodology," Electric Power Research Institute, EPRI NP-2005, August 1981.

26. L. A. Twisdale, et al., " Tornado Missile Risk Analysis," Electric Power Research Institute. EPRI NP-768 and NP-769, May 1978.

27. " Tornado Occurrence Rates for 125 NW Area Around Catawba Nuclear Station," National Severe Storm Forecast Center, June 10, 1991.

28. J. H. Shulte, " Documentation of the TORMIS Computer Code," Duke Power Company, PSA 0, February 1984.

29. " Standard Review Plan for the Review of Safety Analysis Report for Nuclear Power Plants," U.S.

Nuclear Regulatory Commission, NUREG 75/087, LWR Edition, December 1975.

30. " Staff Guidance of IPEEE Submittal Review on Resolution of Generic or Unresolved Safety issues (GSI/USI)," U.S. Nuclear Regulatory Commission, August 21,1997.

31. " Duke /NRC Meeting - McGuire and Catawba Fire IPEEE," presentation by Duke Power Company to U.S. Nuclear Regulatory Commission, June 4,1996.

Energy Research. Inc. 54 ERI.i.RC 95-506

. .